THE COLLECTED WORKS
OF
LARRY WOS Volume I
This page is intentionally left blank
THE COLLECTED WORKS
OF
LARRY WOS Volume I
Exploring the Power of Automated Reasoning
Larry Wos Gail W. Pieper Mathematics and Computer Science Division Argonne National Laboratory E-mail: wosimcs.anl.gov,
[email protected] Web: www.mcs.anl.gov/~wos, www.mcs.anl.gov/~pieper
World Scientific Singapore »New Jersey • London • Hong Kong
Published by World Scientific Publishing Co. Pte. Ltd. P 0 Box 128, Fairer Road, Singapore 912805 USA office: Suite 1B , 1060 Main Street, River Edge , NJ 07661 UK office: 57 Shelton Street, Covent Garden, London WC2H 9HE
British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library.
THE COLLECTED WORKS OF LARRY WOS -(Vol. I) Exploring the Power of Automated Reasoning Copyright C 2000 by World Scientific Publishing Co. Pte. Ltd. All rights reserved. This book, or parts thereof may not be reproduced in any form or by any means, electronic or mechanical, including photocopying, recording or any information storage and retrieval system now known or to be invented, without written permission from the Publisher.
For photocopying of material in this volume, please pay a copying fee through the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, USA. In this case permission to photocopy is not required from the publisher.
ISBN 981 -02-4001-5 (Set) ISBN 981 -02-4996-9 (Vol. I)
Printed in Singapore.
Foreword The scientific enterprise known as "automated reasoning" seeks to construct computer programs that can make original and important contributions to mathematics. In four decades of practical work, the field has progressed from solving very simple problems in mathematical logic to the occasional solution of difficult, open mathematical questions. The history of automated reasoning has been blessed with a singular leader, namely, Larry Wos. His position as foremost leader has been clearly recognized: • founding editor of the Journal of Automated Reasoning • first president of the Association of Automated Reasoning • first winner of the American Mathematical Society's current prize in automated reasoning (shared with Steven Winker) • first winner of the Herbrand Award in Automated Deduction His scientific papers, assembled here, constitute a very significant part of Wos's enormous contributions to automated reasoning. As all his friends will testify, Wos is an utterly ingenious fellow, a singular character, a truly wonderful person. Perhaps in the spirit of a Zen master, Wos has occasionally claimed that he is not a scientist at all. Although I know no better scientist than Wos, I think reporting his claim not to be a scientist will help those who have not had the privilege of knowing him to understand the enormous energy and joy with which Wos does his work. His appetite for inventing strategies to enhance Argonne's several automated reasoning programs is voracious. Equally amazing is his stamina for examining in extensive detail the results of running the Argonne programs on a multitude of examples. But I suspect that the reason that Wos might be reluctant to claim the title scientist is that he imagines that society would permit no proper scientist to experience the passionate ecstasy that Wos does in carrying out his research. Some of Wos's papers assembled here, especially the early ones, reflect the tenor of the traditionally austere mathematical journal, so often dry as dust. The field's early emphasis upon often sterile "completeness results" as the ultimate criterion of achievement was an idol to which Wos necessarily paid tribute in his earliest years. But as his later writings increasingly demonstrate, and as the wonderful introductory vignettes reveal, Wos passionately wishes to invite his reader to join in what Wos finds to be both the noblest and most rewarding of human experiences, the development of the power to reason.
vi
Foreword
"Reason more than anything else is man," said Aristotle. Like Aristotle, Wos has found , and wishes to share with all, a maximal good , a thinking that is a "thinking of thinking".
Robert Boyer November 1998
Preface A Life of Rewards: T h e Collected Works of Larry Wos
Among the various aspects of computing that have proved fascinating, you may find the aspect covered in the papers in this two-volume set astound ing. Specifically, the papers focus on a challenge that certain researchers—I included—accepted in the early 1960s and still accept. The challenge is that of producing a single computer program that automates logical reasoning so effectively that questions whose answers have eluded great minds for decades will frequently yield their treasure. By reading or browsing among these papers, you will see how progress occurred and what techniques were formulated to en able a program (such as William McCune's OTTER) to answer diverse open questions and solve various hard problems. You will also share a researcher's effort and excitement covering more than thirty-five years. Note that, with one exception, the order of the papers in these two volumes essentially mirrors the order in which the research occurred and the papers were written, and does not follow the accidental order in which they were published. The exception is the paper entitled "Resolution, Binary: Its Nature, History, and Impact on the Use of Computers"; in particular, the 1992 version of that paper is included, rather than the original 1987 version, to provide more up-to-date information about OTTER and its successes. Although the papers contained in the two volumes share a common author, their style ranges from the very formal to the most friendly. You may be amused by their violation of a principle of Paul Halmos: A writer should publish his works under the same name, not vary from Lawrence Wos to Larry Wos and the like. Finally, you will find (though not obviously) evidence of how my research was influenced, guided, and inspired by the Significant Seven. You will learn in this preface who they are. As is true of my writing style and of the series of names under which I pub lished, the field that is the focus of the vast majority of these collected papers underwent identity changes. In the beginning (in the early 1960s) the field was known as mechanical theorem proving, then automatic theorem proving, then automated theorem proving, and finally and correctly here in 1999 as automated reasoning. (Automated deduction is a subfield, in my view, of automated reason ing, the latter name being introduced by me in 1980.) Far, far more significant than the preceding is the progress that has occurred in less than four decades. Both the amount and the rate of progress are reflected in the papers presented in these two volumes. Indeed, in the beginning we were pleased when a reasoning program suc ceeded in proving the simplest of theorems, such as the classroom exercise that
Vlll
Preface
asserts the provability of commutativity for groups in which the square of x (for all x) is the identity e. Such an achievement by a graduate student would provide no evidence of potential in the context of research. However, it did cor rectly presage what might and, eventually, did occur in the automation of logical reasoning. For the most startling example of the fulfillment of promise, you need only glance at the marvelous success of my colleague William McCune in the area of Robbins algebra. Specifically, for more than six decades (commencing in the early 1930s), the question of whether every Robbins algebra is a Boolean alge bra remained open, not even yielding its treasure to such eminent scientists as Alfred Tarski. McCune's success in answering the question is in no way isolated, which can be seen by glancing at some of my later papers and by exploring a monograph written by McCune and our colleague R. Padmanabhan. If you are tempted to add to the successes and, therefore, wish targets, I suggest A Fascinating Country in the World of Computing: Your Guide to Automated Reasoning (the companion to this two-volume set), which offers many hard problems and numerous open questions, especially in Chapter 11. A large fraction of the problems and questions will appeal to you even if you have little or no interest in automation. On the other hand, if you would enjoy the companionship of a fine program (McCune's OTTER), the CD-ROM included in the cited book will prove most useful. Now, to fulfill the promise made in the beginning, I come to the Significant Seven, in the order in which I met them. The superlatives you will encounter are more than deserved; the gratitude that is expressed is genuine; the history that is presented is accurate. What was immediately clear to me, as I met each of the Seven, was that I was in the presence of a marvelous mind. Of the Seven, George Robinson was the first. Although he resides no longer on this planet, he is still the most logical man I have ever known. The smallest taste of his fine insights is offered in Section 1.8 of A Fascinating Country in the World of Computing. From him, I learned much, not the least of which concerns experimentation and the identification of hidden premisses. Second was Dan Carson, one of the finest computer programmers that has ever existed. Were it not for a lack of money (in those early 1960s), he would have obtained a Ph.D. His theorem-proving program (of the early and mid 1960s) was clearly crucial to the field at the time and, without it, I am almost certain that the field would have died. It remained by far the most powerful—until the third member of the Seven arrived. The person in question, Ross Overbeek, can only be described as brilliant. His reasoning programs and his ideas (that include the weighting strategy and the inference rule UR-resolution) have proved indispensable to the field. His
Pre/ace
IX
influence, which will forever be vastly underestimated, can be found in the best of all reasoning programs extant here in 1999, namely, OTTER. The fourth of the Significant Seven is Robert Veroff. You will find little of his work in the literature—what a loss! He continues to have ideas that increase the power of reasoning programs. Such is not just my opinion; indeed, d a t a strongly supports the position, including the discovery of new fine proofs and the formulation of techniques that he has freely given to colleagues. One of my failings concerns my lack of success in getting him to publish his breakthroughs. The fifth of the Seven is Steve Winker, who toured MIT in but two and one half years, obtaining his B.A; years later, he easily obtained his Ph.D. Unfortunately, he also published rather sparsely. He played a key role in the Argonne group's attack on open questions in the late 1970s and the early 1980s. His successes in Robbins algebra were crucial to McCune's remarkable result. Robert Boyer is the sixth of the Seven. His work (with his colleague J Moore) in program verification sets a standard that may never be matched. Boyer is the one person I might have believed about the existence of a finite axiomatization of set theory. Of course, he was right. He (along with his advisor Woody Bledsoe) caused me to write my book The Automation of Reasoning: An Experimenter's Notebook with OTTER Tutorial. The seventh member of the Significant Seven is William McCune. He is deservedly a legend in his own time. His program O T T E R dominates my later papers, my experimentation, and my ability to conduct research. Among other items, he has contributed strategies of note. His work (with Padmanabhan) as well as his other successes in answering open questions can be described only as beautiful. As for future greats, I suggest you follow the efforts of my latest colleague, Branden Fitelson. In less than one year of collaboration with me, jointly and sep arately, he has dispatched a number of open questions. He shows more promise than any researcher I have known since I met McCune. Branden is more than a welcome member of the Argonne group, sharing our emphasis and requirement of substantial experimentation.
X
Preface
Acknowledgments My deepest thanks to Robert Boyer for so many items. This two-volume set would not exist but for his suggestion, encouragement, and insistence. I thank William McCune for OTTER, for his aid in the preparation of the figures in the papers offered in the two volumes, and for his collaboration that began in the early 1980s. In automated reasoning, he has proved to be more than wise. I thank Branden Fitelson for his invaluable assistance and guidance in the production of the included CD-ROM. I thank him also for restoring my belief in the existence of students who are excited by science. Finally, although I now break with tradition (in view of the fact that her name appears on this book), I thank Gail Pieper for her enormous effort in ensuring that the papers found in these two volumes meet the highest standards of presentability. Without her contribution, the book would still be no more than a possibility. Larry Wos E-mail:
[email protected] Web address: www.mcs.anl.gov/~wos/ March 1999
Contents Volume 1 Foreword by Robert Boyer Preface - A Life of Rewards On Commutative Prime Power Subgroups of the Norm L. Wos Illinois J. Mathematics 2, no. 2 (1958) 271-284 The Unit Preference Strategy in Theorem Proving L. Wos, D. Carson, and G. Robinson AFIPS Proc. 26, 1964, pp. 615-621 Efficiency and Completeness of the Set of Support Strategy in Theorem Proving L. Wos, G. Robinson, and D. Carson J. ACM 12, no. 4 (1965) 536-541
v vii 1
17
29
Automatic Generation of Proofs in the Language of Mathematics L. Wos, G. Robinson, and D. Carson Proc. IFIP Congress 65, 2 (1965) 325-326
37
The Concept of Demodulation in Theorem Proving L. Wos, G. Robinson, D. Carson, and L. Shalla J. ACMU, no. 4 (1967) 698-709
40
Paramodulation and Set of Support L. Wos and G. Robinson Lecture Notes in Mathematics, 1968, pp. 276-310
54
Axiom Systems in Automatic Theorem Proving G. Robinson and L. Wos Lecture Notes in Mathematics, 1968, pp. 215-236
72
Paramodulation and Theorem-Proving in First-Order Theories with Equality G. Robinson and L. Wos Machine Intelligence IV (1969) 135-150 Maximal Model Theorem L. Wos and G. Robinson J. Symbolic Logic 34 (1969) 159-160
83
100
Contents
Completeness of Paramodulation G. Robinson and L. Wos J. Symbolic Logic 34 (1969) 160 Maximal Models and Refutation Completeness: Semidecision Procedures in Automatic Theorem Proving L. Wos and G. Robinson Word Problems: Decision Problems and the Bumside Problem in Group Theory, 1973, pp. 609-639
xii
102
104
A Theorem-Proving Language for Experimentation L. Henschen, R. Overbeek, and L. Wos Comm. ACM17, no. 6 (1974) 308-314
129
Unit Refutations and Horn Sets L. Henschen and L. Wos J. ACM21, no. 4 (1974) 590-605
143
Problems and Experiments for and with Automated Theorem-Proving Programs J. McCharen, R. Overbeek, and L. Wos IEEE Trans, on Computers C-25, no. 8 (1976) 773-782 Complexity and Related Enhancements for Automated Theorem-Proving Programs R. Overbeek, J. McCharen, and L. Wos Computers and Math, with Apps. 2 (1976) 1-16 An Unnatural Attack on the Structure Problem for the Free Jordan Ring on 3 Letters: An Application of Quad Arithmetic B. Smith and L. Wos Computers in Nonassociative Rings and Algebras, 1977, pp. 41-138 Automated Generation of Models and Counterexamples and Its Application to Open Questions in Ternary Boolean Algebra S. Winker and L. Wos Proc. 8th Int. Symposium on Multiple- Valued Logic, 1978, pp. 251-256 Hyperparamodulation: A Refinement of Paramodulation L. Wos, R. Overbeek, and L. Henschen Lecture Notes in Computer Science, 1980, pp. 208-219
166
197
220
286
298
Contents
Semigroups, Antiautomorphisms, and Involutions: A Computer Solution to an Open Problem, I S. Winker, L. Wos, and E. Lusk Math, of Computation 37, no. 156 (1981) 533-545 Solving Open Questions in Mathematics with an Automated Theorem-Proving Program L. Wos Abstracts of the AMS 2, no. 3 (1981) 336 An Automated Reasoning System L. Wos, S. Winker, and E. Lusk Proc. AFIPS National Computer Conference, 1981, pp. 697-702 Solving Open Questions with an Automated Theorem-Proving Program L, Wos Lecture Notes in Computer Science 138 (1982) 1-31 Procedure Implementation through Demodulation and Related Tricks S. Winker and L. Wos Lecture Notes in Computer Science 138 (1982) 109-131 Automated Theorem Proving 1965-1970 L. Wos and L. Henschen Classical Papers on Computational Logic 2 (1983) 1-24 Questions Concerning Possible Shortest Single Axioms for the Equivalent Calculus: An Application of Automated Theorem Proving to Infinite Domains L. Wos, S. Winker, R. Veroff, B. Smith, and L. Henschen Notre Dame J. Formal Logic 24, no. 2 (1983) 205-223 Automated Reasoning: Real Uses and Potential Uses L. Wos Proc. 8th IJCAI2 (1983) 867-876 A New Use of an Automated Reasoning Assistant: Open Questions in Equivalential Calculus and the Study of Infinite Domains L. Wos, S. Winker, R. Veroff, B. Smith, and L. Henschen J. Artificial Intelligence 22 (1984) 303-356 Open Questions Solved with the Assistance of AURA L. Wos and S. Winker Automated Theorem Proving: After 25 Years, 1984, pp. 73-88
xin
315
330
331
343
376
400
419
442
463
517
Contents
xiv
The Linked Inference Principle, II: The User's Viewpoint L. Wos, R. Veroff, B. Smith, and W. McCune Lecture Notes in Computer Science 170 (1984) 316-332
532
Achievements in Automated Reasoning L. Wos SIAM News 14, no. 4 (July 1984) 4-5
549
Automated Reasoning Programs: How They Work L. Wos SIAM News 14, no. 4 (September 1984) 4-5
560
Automated Reasoning L. Wos American Mathematical Monthly 92, no. 2 (1985) 85-92
571
What Is Automated Reasoning? L. Wos J. Automated Reasoning 1, no. 1 (1985) 6-9
583
Automating Reasoning L. Wos Abacus 2, no. 3 (1985) 6-21
589
Job-Shop Scheduling Using Automated Reasoning: A Case Study of the Car-Sequencing Problem B. Parrello, W. Kabat, and L. Wos J. Automated Reasoning 2, no. 1 (1986) 1-42
617
Negative Paramodulation L. Wos and W. McCune Lecture Notes in Computer Science, 1986, pp. 229-239
661
Set Theory in First-Order Logic: Clauses for Godel's Axioms R. Boyer, E. Lusk, W. McCune, R. Overbeek, M. Stickel, and L. Wos J. Automated Reasoning 2, no. 3 (1986) 287-327
677
A Case Study in Automated Theorem Proving: Finding Sages in Combinatory Logic W. McCune and L. Wos J. Automated Reasoning 3, no. 1 (1987) 91-108 Challenge Problems Focusing on Equality and Combinatory Logic: Evaluating Automated Theorem-Proving Programs L. Wos and W. McCune Lecture Notes in Computer Science 310 (1988) 714-729
729
748
Contents
xv
Automated Theorem Proving and Logic Programming: A Natural Symbiosis L. Wos and W. McCune J. Logic Programming 11, no. 1 (1991) 1-53
766
Volume 2 Subsumption, a Sometimes Undervalued Procedure L. Wos, R. Overbeek, and E. Lusk Festschrift for J. A. Robinson, 1991, pp. 3-40
829
Applications of Automated Reasoning L. Wos Knowledge Engineering 2 (1990) 56-83
871
Meeting the Challenge of Fifty Years of Logic L. Wos J. Automated Reasoning 6 (1990) 213-232
900
The Absence and the Presence of Fixed Point Combinators W. McCime and L. Wos Theoretical Computer Science 87 (1991) 221-228
921
Resolution, Binary L. Wos and R. Veroff Encyclopedia of Artificial Intelligence, 2nd ed., 1992,1341-1353
934
Automated Reasoning Contributes to Mathematics and Logic L. Wos, S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, and R. Butler Lecture Notes in Artificial Intelligence 449 (1990) 485-499
962
Automated Reasoning and Bledsoe's Dream for the Field L. Wos Automated Reasoning: Essays in Honor of Woody Bledsoe, 1991, pp. 297-345
979
Logical Basis for the Automation of Reasoning: Case Studies L. Wos and R. Veroff Handbook of Logic in Artificial Intelligence and Logic Programming 2 (1994) 1-40
1026
The Linked Inference Principle, I: The Formal Treatment R. Veroff and L. Wos J. Automated Reasoning 8, no. 2 (1992) 213-274
1063
Contents
The Application of Automated Reasoning to Questions from Mathematics and Logic L. Wos and W. McCune Annals of Mathematics and AI5 (1992) 321-370 Automated Reasoning and Enumerative Search with Applications to Mathematics J. Zhang and L. Wos Proc. Int. Con}, for Young Computer Scientists, 1991, pp. 543-545 Benchmark Problems in Which Equality Plays the Major Role E. Lusk and L. Wos Lecture Notes in Artificial Intelligence 607 (1992) 781-785 Experiments in Automated Deduction with Condensed Detachment W. McCune and L. Wos Lecture Notes in Artificial Intelligence 607 (1992) 209-223 Application of Automated Deduction to the Search for Single Axioms for Exponent Groups W. McCune and L. Wos Lecture Notes in Artificial Intelligence 624 (1992) 131-136 The Impossibility of the Automation of Logical Reasoning L. Wos Lecture Notes in Artificial Intelligence 607 (1992) 1-3 The Kernel Strategy and Its Use for the Study of Combinatory Logic L. Wos J. Automated Reasoning 10, no. 3 (1993) 287-343
xvi
1131
1182
1187
1193
1211
1218
1221
Automated Reasoning Answers Open Questions L. Wos Notices of the AMS 5, no. 1 (1993) 15-26
1288
Preface: The Field of Automated Reasoning L. Wos Computers and Math, with Applications 29, no. 2 (1995) xi-xiv
1311
The Resonance Strategy L. Wos Computers and Math, with Applications 29, no. 2 (1995) 133-178
1317
Contents
xvii
Searching for Circles of Pure Proofs L. Wos J. Automated Reasoning 15, no. 3 (1995) 279-315
1378
The Power of Combining Resonance with Heat L. Wos J. Automated Reasoning 17, no. 1 (1996) 23-81
1424
The Hot List Strategy L. Wos and Gail W. Pieper J. Automated Reasoning 22, no. 1 (1999) 1-44
1482
OTTER and the Moufang Identity Problem L. Wos J. Automated Reasoning 17, no. 2 (1996) 215-257
1521
Automating the Search for Elegant Proofs L. Wos J. Automated Reasoning 21, no. 2 (1998) 135-175
1571
Otter: The CADE-13 Competition Incarnations W. McCune and L. Wos J. Automated Reasoning 18, no. 2 (1997) 211-220
1613
Programs that Offer Fast, Flawless, Logical Reasoning L. Wos CACM41, no. 6 (1998) 87-102
1625
On Commutative Prime Power Subgroups of the Norm1 BY
LAWRENCE THOMAS WOS
The norm N(G) of a group G is the set of elements x € G such that x + T = T + x for every subgroup T of G. (G will be written additively in spite of the fact that G need not be commutative.) The norm is, therefore, the intersection of the normalizers of all the subgroups of G and is a characteristic, hence normal, subgroup of G. The main results of the paper are that the norm N(G) is contained in the third center of G, and that the group of automor phisms induced on N(G) by G is nilpotent of class 2. With certain reservations concerning the prime 2, we prove furthermore that the norm is contained in the second center if and only if the group of automorphisms induced on N(G) by G is commutative. R. Baer [4] proved the result that the norm of a group is 0 if and only if the center is 0. This theorem follows directly from our result that the norm is contained in the third center, for if the center is 0, then the third center is 0, and, a fortiori, the norm is 0; the necessity follows from the obvious fact that the norm contains the center. The main results of the paper are obtained from a larger program, namely, the consideration of norm pairs P, S. A norm pair P, S is defined as a pair of groups P and S, where P is a commutative p-group and a normal subgroup of a group G and contained in the norm of G, and where S is the group of automorphisms induced on P by G. If a is an automorphism of the group P, let F(a) denote the set of x € P such that x = xa, i.e., the elements left fixed by o; let P ( l — a) denote the set of x — xa = x(l — a) for x € P. A pair of groups P, S is termed a norm-like pair if P is a commutative p-group and 5 is a group of automorphisms of P such that, for every a € S, P(l — a) is cyclic and contained in F(o). We prove that norm pairs are norm-like and that norm-like pairs, under certain conditions, are norm pairs. (If P, S is a norm-like Received August 22, 1957. Reprinted with permission from the Illinois Journal of Mathematics, Vol. 2, No. 2, June 1958. Printed in U.S.A. 'Work performed under the auspices of the U.S. Atomic Energy Commission.
Collected Works of Larry Wos
2
pair, then composition in P will be denoted as addition whereas composition in S will be multiplication.) If P, S is a norm-like pair, the elements a € S of S satisfy the equality, fc(l — o) = 1 — afc for all integers k. With the aid of this equality it will be shown that, if P, S is a norm-like pair, then 5 is a p-group and, in fact, the order of a £ S equals the order of P ( l - a). For such pairs P, S we prove .9 is of class 2 and P = F3, where FQ = 0 and Fi = the set of x 6 P such that x — xa e Fj_i for every a € S with i = 1, • • • ; with p j= 2,5 is commutative if and only if P = F2. These results demonstrate the strong connection between norm pairs and norm-like pairs, especially when one realizes that F{ plays the role of the intersection of P with the ith member of the ascending central series.
Notations N(G): = the norm of the group G. Z{G)- = the center of G. Zi(G)-- = the i t h member of the ascending central series of G; in particular, Zx(G) = Z(G). = the p-component of G, i.e., the set of all elements of G whose G„ = order is a power of the prime p. o(x) == the order of the element x. 0(G)- = the order of the group G. (a) == subgroup generated by a.
Section I Throughout the whole of the paper P will denote an additive commutative p-group, i.e., a group all of whose elements have order a power of some fixed prime p. If P is contained in some larger group G as a normal subgroup and a is an element of G, we shall identify o with the automorphism a induces on P and denote the automorphism by o. Consequently P ( l — a) is, for o 6 G, the commutator subgroup of the group generated by o and P; F(a) is the centralizer of a in G. Since P is commutative, P(l - a) and F(a) are clearly subgroups of P for every automorphism a of P. Throughout this section assume that P is contained in the norm N(G) of a group G and that P is a normal subgroup of G. Thus G induces an automor phism group S on P and P, 5 is, therefore, a norm pair. LEMMA 1.1. The centralizer of P in G contains all elements of infinite order or of order prime to p.
Commutative
3
Prime Power Subgroups of the Norm
Proof. Consider to G G such that o(w) = 0 or o(w) is prime to p. (w)C[P = 0 since P is a p-group. For x G P [w, x] = —w — x + w + x = (—w — x + w) + x € P = -w + (-x + w + x) G (w)
since P is normal in G,
since x G P < N(G).
So [w, x] G (w) n P = 0, or w + x = x + w for every x G P, and the proof is complete. LEMMA 1.2. J/ o is on automorphism induced by an element of G on the p-group P, then o(a) is a power of p, and there exists a p-element a € G induc ing the automorphism a. Proof. If a = 1, there is nothing to prove. Consider a ^ 1. There exists a w G G such that w induces a on P. If o(w) = 0 or is prime to p, w commutes with P elementwise, which contradicts a ^ 1; therefore, o(w) = pkq with 0 < A; and q prime to p. So there exist elements a and w in G such that w = a + w and such that o(a) = pk and o(w) = q.w commutes with P, so o € G induces the automorphism a on P. The order of the automorphism a is the smallest multiple of a € G contained in the centralizer G of P in G, which is the smallest multiple of a contained in G D (o), which equals the index of G O (a) in (a) since (a) is a cyclic group; but this index is a power of p since a G G is a p-element. T H E O R E M 1.1. Le< P, S be a norm pair; then, P(l —a) is, for every a G 5, o ct/dic group contained in F(a) and isomorphic to P/F{a); if P is not contained in the center Z(G) of G, then P has bounded order, i.e., there exists a positive integer m such that pmP = 0. Proof. Let o be an element of S. The mapping of a; G P to x(l — a) = x — xa is an endomorphism of P with kernel F(a) and image P ( l — a). By the first isomorphism theorem, P ( l — a) is, therefore, isomorphic to P/F(a). Let a G G induce the automorphism a. For every x G P we have x — a - i G (a) since P is part of the norm of G; therefore, P ( l - a) ^ (a) and thus is a cyclic group which is contained in F(a) since a commutes with multiples of itself. Now assume that P is not contained in Z(G). Then there exists an a G S with a ^ 1. Let a G G be a p-element inducing a on P ; such an element exists by Lemma 1.2. By the above argument, P ( l — o) is contained in (a) and is cyclic. Since P is a p-group, P ( l — o) has order p* for some positive integer i and, therefore, equals pk~la where the order of a € G is p fc . Consider x G F(a). Since P is commutative, a + x induces a on P. P(l -a) < (a + x), so there exists an integer j such that pk~xa = j(a + x) = j a -I- jx. Now we distinguish two cases.
Collected Works of Larry Wos
4
Case 1. (x) n (a) = 0. Therefore, jx = pk~la — ja = 0, or ja = pk~xa. ja = pk~xa ^ 0. Hence j = pk~xj', where j ' = 1 mod p*. Furthermore jx = 0; and this implies pk~xx = 0, since o(x) is a power of p. Hence o(x) divides p fc_1 . Case 2.
(x) n (o) ^ 0.
(x) n (a) therefore contains all elements of order p in (a), which are in turn all elements of order p in (x). Let U be the subgroup of G generated by a and x; U is a finite commutative p-group since x € F(a) and x and a are p-elements. The maximum of o(u) for u € U equals the maximum of o(x) and o(a) since x and o are p-elements for the same prime p. Assume by way of contradiction that the maximum order of the elements in U is o(x). Since every element of maximum order in a finite commutative group generates a direct summand, (x) is a direct summand of U. Hence there exists a subgroup V such that U = (x) + V with (x) n V = 0. If V D (a) ^ 0, V contains all elements of order p in (a); but these elements are in (x), which contradicts V n (x) = 0. So V n (a) = 0. Since U is generated by a and x, the direct summand V is cyclic, and there exists v = ha + j x for integers j and h such that V = (v). Then P ( l - v) = P ( l - /w) < V C\ {ha) < V D (a) = 0, so that v induces 1 on P. But a is a linear combination of v and x, both of which commute with P, and a does not induce the identity on P. Thus we have a contradiction, and our assumption that o(x) was maximal in U is false. So o(x) < o(a), and this holds for all x € F(a) since x was chosen arbitrarily. As noted before, P/F(a) is isomorphic to P(l — a). So P/F(a) has order p', or ply e ^(o) for every y 6 P. But p*x = 0 for every x € F(a) from the above; therefore pk+,P = 0, and P has bounded order.
Section II We now turn to more general consideration and therefore make the following definition. DEFINITION. We term the pair P, S of groups P and S a norm-like pair if S is an automorphism group of P such that, for every a € 5,
1. P ( l — a) is cyclic, and, 2. P ( l — o) is contained in F(a). Throughout this section P, S will be a norm-like pair, but P is not assumed to be contained in some larger group. However, we assume that P is a p-group. We shall use the additive notation in P, but the multiplicative notation in 5. LEMMA
2.1. For every pair of automorphisms a and b in S, F(a)b = F(a).
Commutative Prime Power Subgroups of the Norm
5
Proof. Let x be an arbitrary element of F(a). Then x(l — b) = x — xb = x — xab = x(l — ab). From property 2 of S, y = x(l - b) = x(l - ab) e F(b) n F(ab); so y = yb = ya6. By applying 6 - 1 , y = ya. Since a; G F(a), x - y = xb € F(a). So F(a)6 < F(a). By the same argument but with 6 replaced by 6 _1 , F ( a ) 6 - 1 < F(a). Applying b to the last inequality, F(a) < F(a)b, which completes the proof. The following lemma proves a very useful and somewhat surprising equality obeyed by the elements of S. LEMMA 2.2. The following three properties of elements a and b in S are equiv alent: P(l - a) < F(b); (1 - a)b = 1 - a; 1 - ab = (1 - a) + (1 - b). Proof. The equivalence of the first two properties, and their equivalence with the third property, may be inferred from the identity: l-ab=l-b COROLLARY
+ b-ab=(l-b)
+ (l- a)b.
2.1. // P(l - a) < F(b) and P(l - b) < F{a), then ab = ba.
Proof. The hypotheses imply by Lemma 2.2 that 1 - ab = (1 - a) + (1 - 6) = 1 - ba; and this in turn implies ab = ba. COROLLARY 2.2. If U is a subgroup of S such that P(l - a) < F(b) for every pair of elements a, b in U, then mapping x in U on 1 — x (in the ring of endomorphisms of P) is a homomorphism.
This is an immediate consequence of Lemma 2.2. COROLLARY
2.2'. // a is an element in S and k an integer, then 1 — ak =
fc(l - a ) . This is a special case of Corollary 2.2. LEMMA 2.3. For every a € S,o(a) = o(P(l — a)).
Collected Works of Larry Wos
6
Proof. From property 1 of S, there exists an x € P such that x ( l — a) generates P ( l — a). Let o(P(l — a)) = r. If y € P, then yo r = y - y + yar = y - y(l - ar) = y - ry(l - a) by Corollary 2.2', = y since r = o ( P ( l — a)). On the other hand xa* = x — ix(l — a), so that x = xax if, and only if, r | z. Hence o(a) = r = o ( P ( l - a)). Since P is assumed to be a p-group for the prime p, S is therefore a p-group for that prime. LEMMA 2.4. //, for a and b in S, C is the subgroup of S generated by a and b, and i / P ( l - C) is the subgroup of P generated by all the P ( l — c) for c € C, then P ( l - C) = P ( l - a) + P ( l - b), and o{c) <max [o(o),o(6)] for every c € C. Proof It is clear that Q = P ( l - a) + P ( l - 6) < P ( l - C). Since x{\ - a)b = z ( l - a) + xa(l - b) - x ( l - b), it follows that Qb < Q. Like wise we see that Qa < Q. It is clear now that both a and b induce the identity automorphism in P/Q; and this implies t h a t all of C induces the identity on P/Q and that therefore P ( l - C) < Q. Hence Q = P ( l - C). For the re mainder of the lemma remember that, if a commutative p-group is the sum of 2 cyclic groups, the order of each of its cyclic subgroups cannot exceed the maximum of the orders of the 2 summands. From Lemma 2.3, the order of c in C equals the order of P ( l — c). Since, for every c € C, P ( l — c) is cyclic by property 1 of S, we can apply the previous remark to yield o(c) < max [o(a),o(6)]. D E F I N I T I O N . / / a and b are in S, we say a and b are disjoint elements, just disjoint, when P ( l — a) n P ( l - b) = 0.
or
C O R O L L A R Y 2.3. If C < S is the group generated by a and b, and if a and b are disjoint elements or o(a) ^ o(6), then o(ab) = max[o(a), o(b)\. Proof
Assume by symmetry that o(o) < o(6). By Lemma 2.4, o(ab) < max
[o(a), o(6)]. Case 1. o(a) < o(b). Then o(ab) < o(b). Since C is also generated by o and ab, o(b) < max [o(a),o(ab)\. But o(a) < o(6), so o(b) < o(ab). So o(b) = o(ab) = max [o(a), o(6)]. Case 2. a and 6 are disjoint. If o(a) < o(b), then o(a6) = max [o(a),o(6)] by Case 1. Assume therefore that o(a) = o(b). Since o and 6 are disjoint, P ( l - C) = P ( l - a) + P ( l - 6) and hence, by Lemma 2.3, o ( P ( l - C)) = o(a) ■ o(b) = o(a)2. Since C is likewise
Commutative Prime Power Subgroups of the Norm
7
generated by a and ab, we have P(l - C) = P(l — a) + P(l — ab); and we de duce that o(P(l - C)) is a divisor of o{a) • o(b) by Lemma 2.3. But it follows from Lemma 2.4 that o(ab) is a divisor of max [o(a), o(b)} = o(a). Hence o(a)2 = o(P(l - C)) is both a divisor and a multiple of o(a) ■ o(ab). Consequently o(ab) = o(a) = max[o(a),o(6)].
Section III We still continue the study of norm-like pairs P, S, obtaining various neces sary and sufficient conditions for elements of S to commute. LEMMA 3.1. //, for a € S and b 6 S, any of the following four conditions holds, then ab = ba:
1. P ( l - o) < F(b) and P(l - 6) < F(a); 2. P ( l - a ) < P ( l - 6 ) ; 3. 0 = P ( l - a) PI P(l - 6); 4. there exists ac S S suc/i f/iat o(a) < o(c) and c and b are disjoint elements. Proof. Assume condition 1. Then (1 - a)(l - b) = 0 = (1 - fc)(l - a), so l - a - b + ab= 1 — b - a + ba = 1 — a — b + ba; cancelling from both sides, ab = 6a. Assume 2. If the inequality is actually equality, then property 2 of S reduces condition 2 to condition 1. So assume the inequality is strict. By Lemma 2.3, o(a) < o(b); by Corollary 2.1, o(ab) = o(b). Applying Lemma 2.4, P(l — b) = P(l — ab). As in the argument above, b commutes with ab, so ab = ba. Assume 3. Assume by symmetry that o(a) < o(b). Let C be the subgroup of S generated by a and 6. Then
By Corollary 2.1, o(ba) < o(b), so 0 = P ( l - a ) n P ( l - 6a). Consider x € P(l - 6). From property 2 of S, x(l - a) = x{l - ba) € P(l - a) f~l P(l - 6a); so x(l - a) = 0, and P(l - 6) < F{a). Adding this to the fact that P ( l - a) < F(a) yields P(l - C) < F(a). So P ( l - 6a) < F(a), and therefore, P(l 6a) < F(a) n F(ba) < F(b), by applying a'1. Hence, P(l - o) < P(l - C) < F(b), and we are again reduced to condition 1, thus proving condition 3 implies a6 = 6a. Assume 4. If a and 6 are disjoint, we can apply 3. Assume a and 6
Collected Works of Larry Wos
8
are not disjoint. Since P ( l — d) is a cyclic p-group for every d € S, and since c and b are assumed disjoint, c and o must be disjoint. Since it is assumed that o(o) < o(c), we reproduce the counting argument used above in 3 to yield a and co are disjoint. Since b and o are not disjoint by assumption, b and ca are. By 3, be = cb, and bca = cab. So cab = bca = cba, and ab = ba again. COROLLARY 3.1. //, for a e S, there exist c € S and d e S such that o(a) < o(c) < o(d) and such that c and d are disjoint, then a 6 Z(S); if P ( l - 5) < F{S), where P ( l - S) is the group generated by all P(l - a) for a € S and F(S) = <~iaesF(a), then S is commutative.
Proof. Consider an arbitrary b € S. If b and c are disjoint, we can apply condition 4 of Lemma 3.1 to yield ab = ba. If b and c are not disjoint, then b and d are, since c and d are disjoint, and we can apply condition 4 to the triple a, d, 6 and obtain ab — ba. Since 6 was chosen arbitrarily, a is contained in the center of S. For the second half of the corollary, consider an arbitrary pair of elements a and b in S. P ( l - a) < P ( l - S) < F(S) < F(b); similarly, F ( l - 6) < F(a). Applying condition 1 of Lemma 3.1 yields ab = 6a. a and b were chosen arbitrarily, and the proof is complete. LEMMA
3.2. //, for a and b in S, ab = ba, then P ( l - o2) < F(b).
Proof. Using property 2 of S, 1 — ab=l-a + a-ab=(l-a + a — ab)ab = (1 - a)b + o(l - b)a = b - 1 + 1 - ab + a2 - a2b = 1 - ab + o 2 - 1 + (1 - a2)b: the last equality follows from the fact that endomorphisms of a commutative group additively commute. Subtracting 1 — ab from the first and last and trans posing a 2 - 1, we have 1 - a2 = (1 - o2)6, and the result is established. COROLLARY 3.2. If P is a p-group with p =£ 2, then a € Z(S) if and only if for every 6 € 5, P ( l - a) < F(b) and P{\ - b) < F(a).
Proof. The sufficiency has been established by condition 1 of Lemma 3.1. For the necessity, let a be in the center of 5. Consider an arbitrary b € 5. From the previous lemma, P ( l — a2) < F{b). From property 1 of S, there exists an x € P such that x(l — a) generates F ( l — a). From Lemma 2.2, x(l - a 2 ) = 2x(l - a) € F(b). But 2 and p are relatively prime, so 2x(l - a) generates P(l — a), and P{\ — a) is, therefore, contained in F(b). By the same argument, P(l - b) < F(a). Since 6 was chosen arbitrarily, we have the result. For Theorem 3.1 and for future use, we define F0 = 0, F] = F(S) = <^aesF(a), F 2 = all a; € F such that x = xa mod Fi for every a € S, and, inductively, F< = the set of x e F such that x = xa mod Fj_i for every
Commutative Prime Power Subgroups of the Norm
9
a € S(i = 1,2, • • •)• ^2 is that subgroup of P whose elements generate cosets mod Fi which are left fixed by every a G 5; there is no confusion in applying an element of S to P/F\ since the modulus is S-invariant. T H E O R E M 3.1. If P, S is a norm-like pair but with p ^ 2, and if S is com mutative, then P = F2, and (1 - f>)2, the set of (1 — a)(l — 6) /or ai/ a and 6 in 5, is 0; conversely, if P, S is a norm-like pair and P = F2, Men 5 is commwiatoe.
Proof. Assume S is commutative and p ^ 2. Consider a 6 S. By Corollary 3.2, P ( l - a) < F(6) for every 6 6 5. Therefore, for every a G 5, P ( l - a) < F(5) = Fj. So, for every x G P and every a G S,x = xa mod Fi, which is equivalent to P = F2. Since, for every x £ P and every o and 6 in 5, i ( l - a) G F(6), we have i ( l - a)(l - 6) = 0, or (1 - o)(l - 6) is the O-endomorphism of P for every a and b in 5. Since P = F2 implies P ( l - S) < F{S) = Fi, the converse of the theorem is a direct consequence of Corollary 3.1.
Section IV Throughout this Section let P, S be a norm-like pair but with the added assumption that the elements of P have bounded order p m , i.e., there exists a positive integer m such that pmP = 0. By Lemma 2.3, Sp'" = 1, so S contains elements of maximum order. In fact, every element of S has maximum order in S or can be written as a product of two such, for let a G S be of maximum order in S and consider c G S. If o(c) is maximal in S, there is nothing to prove. If o(c) < o(a), then o(ac) — o(a) by Corollary 2.1, and c = a~lac is a product of two elements of maximum order.
Remark. If S contains elements a and b of maximum order such that a and b are disjoint, then for an arbitrary c G S application of Corollary 3.1 to the triple c, b, a yields c G Z(S). Hence, S equals its center and is consequently commutative. 4.1. If S contains elements a and b of maximum order pk such that a and b are disjoint, then F(S) = F(m) for every m G S of maximum order in S, P/F{S) is cyclic of order pk, and P= F 2 . LEMMA
Proof. Let a and 6 be elements of S which are disjoint and have maxi mum order pk. By duplicating the argument at the end of the proof of Corol lary 2.1, we see that ab and 6 are disjoint and a and 6a are disjoint. If x € F(a), x(l - b) = x(l — ab) = 0 since b and ab are disjoint; so F(a) < F(b). Sim ilarly, F(6) < F(a). So F(b) = F(o). If c G S is of maximum order in S,
Collected Works of Larry Wos
10
then c and a, or c and 6, are disjoint since all P ( l — d) with d G S are cyclic p-groups. Applying the above argument to the proper pair, say c and a, we have F(c) = F(a). Therefore, all F(m) are equal for m G S of maximum or der in S. Since S is generated by its elements of maximum order [as noted at the beginning of this section], F(S) is the intersection of all the F(m) for m € S of maximum order. But all these F(m) have been shown to be equal; and thus we have F(S) = F(m) for every m G 5 of maximum order; and the first part of the lemma is established. As in Theorem 1.1, P/F(m) is isomorphic to P ( l — m) which is cyclic and has order o{m). But F(S) = F(m) for m G S of maximum order, and o(m) = pk. So P/F(S) is cyclic of order pk. For every m g S o f maximum order, P(l — m) < F{m) = F(S). Since every element of 5 is of maximum order in 5 or is a product of 2 such ele ments, Lemma 2.4 yields P(l — 5) < F(S) = Fi. This is precisely equivalent to P = F2.
Remark. If P/F{S) is cyclic, then there exists an x G P such that x(l — a) generates P ( l - a) for every a G S. For let x G P be a representative of a coset which generates P/F(S). Consider a € S. From property 1 of S, there exists a y £ P such that y(l - a) generates P ( l - a), y = kx + z for some integer fc and some z G F(5)- 2/(1 - a) = (fcr + *)(1 - a) = fcx(l - a) since F(S) < F(a). So x(l — a) generates P ( l — a). THEOREM
4.1. If P, S is a norm-like pair, S is nilpotent of class 2, i.e.,
S = Z2(S). Proof. If 5 contains elements a and b of maximum order which are disjoint, then S is commutative as has already been remarked. If S does not contain 2 such elements, let D = n m G s P ( l — m) with m of maximum order in 5; then we are going to show that 0 < D < P, and that there exist elements a and b of maximum order such that P ( l — a) f~l P ( l — b) = D. For let m G S be of maximum order in S. We can consider the various intersections P ( l — m)C\ P(\ — k) for every k G S of maximum order. Since P ( l — m) is a cyclic p-group, and since the lattice of subgroups of a cyclic p-group is simply ordered and contains a finite number of elements, there exists a j G S of maximum order such that P ( l - m) n P ( l - j) = E < P ( l - m) D P ( l - k) for every k G 5 of maximum order in S. Therefore, E < P ( l - k) for every k G 5 of maximum order, and hence E < D. From the definition of P , D < P ( l - m) Pi P ( l - j) = E.So D = E, and m and j are the elements whose existence we wish to establish. Let T < S be the set of all a € 5 such that P ( l —o) < D\ T is a normal subgroup of S. If o{D) = p*, and if o G S is of maximum order pfc, applying Lemma 2.3 to S/T and P/D yields o(oT) = pk~i. We claim aT has maximum order in S/T, for consider cT G S/T. If o(c) is maximal in 5, then o{cT) = p f c - i = o(aT). If not,
Commutative Prime Power Subgroups of the Norm
11
then o(ac) = o(a) from Corollary 2.1. Let R < S/T be the group generated by aT and acT. Applying Lemma 2.4 to R, we have o(cT) <max [o(aT),o(acT)\, hence < pk~i. So o(cT) < o(aT) for every cT € S/T, and aT has maximum order in S/T. Since P ( l - a) n P(l - 6) = D, (P/D)(l - aT) n (P/D)(\ - bT) = D, the 0 of P/D. Applying the first remark of this section to S/T, we see that S/T is commutative. For every t € T and every m 6 S of maximum order, P(l - t) < D < P ( l - m). From Lemma 3.1, *m = mt for every t € T and every m g S o f maximum order in S. Since S is generated by its elements of maximum order, T < Z(S). Therefore, 5 = Z2(S). THEOREM
4.2. 7/ P, S is a norm-like pair, P = F 3 .
Proof. If 5 contains elements a and 6 of maximum order which are disjoint, then, by Lemma 4.1, P = F-2 < F3; so P = F3. If 5 does not contain two such elements, we can define T and D as in the previous theorem. Since S/T is an automorphism group of P/D satisfying the hypothesis of Lemma 4.1, we conclude that P/D equals its F 2 with respect to S/T. Since D < F(S) = Fit this is equivalent to P = F3. T H E O R E M 4.3. // P, S is a norm-like pair such that S contains elements a and b of maximum order which are disjoint and such that p ^ 2, then S and P(l — S) are isomorphic.
Proof. By Lemma 4.1, P/F(S) is cyclic; therefore, by the second remark of this section, there exists an x € P such that x(l — c) generates P ( l — c) for every c € S. The existence of the elements o and b implies that S is commutative; this coupled with the fact that p ^ 2 implies P ( l — d) < F(c) for every d and c in S, by Theorem 2.1. Therefore, for every c and d in 5 and every y € P, 2/(1 — cd) = y(l — c + c — cd) = 2/(1 - c) + 2/(1 - d)c = 2/(1 - c) + y(l - d). If, for at € S and i/j € P, 5Zij/i(l -a*) is an arbitrary element of P ( l - S), then there exist integers ki such that E,!/iU - at) = £,fci*(l - a,) = 5 > ( 1 - a,*<) = x(l - n,a, fci )So every element of P ( l - S) equals x(l — c) for some c € S and that special x whose existence was established earlier in the proof. If we map c S S to x(l - c) S f, we have a homomorphism from S onto P(l - S), and its kernel is exactly 1.
Collected Works of Larry Wos
12
Section V We now turn to consideration of the norm N(G) of the group G. By The orem 1.1, we see that, if P, S is a norm pair, then P, S is a norm-like pair. We can there fore apply all results established in Sections II, III, and IV to norm pairs P, S. For example, where S is a member of the norm pair P, S and a £ S, o(a) = o(P(l - a)), and F(a) is normal in G. T H E O R E M 5.1. The norm N(G) of the group G is contained in the third center Z3(G) of G.
Proof. It follows directly from the definition of the norm that all subgroups of N(G) are normal in N(G) which is, therefore, commutative or hamiltonian. Case 1. N(G) contains an element of infinite order. In this case, the norm and center of G are the same (see Baer [1, 3]), and the theorem is trivially true. Case 2. N(G) is commutative and contains no elements of infinite order. Then N(G) equals the direct sum of Np, where Np is the p-component of N(G), i.e., Np is that subgroup of the norm consisting of all x 6 N(G) whose order is a power of the prime p. Consider the prime p. Np is a characteristic subgroup of N(G), and N(G) is characteristic in G\ so Np is normal in G, and G induces a group of automorphisms Sp on Np. Np, Sp is a norm pair. Np < Z(G), or, by Theorem 1.1, Np has bounded order. In the latter case we can apply Theorem 4.2 to yield Np = F3. But F, is precisely the intersection of P with the i t h member of the ascending central series of G, and therefore Np is contained in Z${G). Since p was chosen arbitrarily and N(G) equals the direct sum of the Np, N(G) < Z^{G), which completes Case 2. Case 3. AT(G) is hamiltonian. By a well known theorem hamiltonian groups are the direct sum of three groups: a commutative group all of whose elements have odd order, a commuta tive group all of whose nonzero elements have order 2, and the quaternions; see Zassenhaus [1]. So again the norm of G is the direct sum of its p-components, but, different from Case 2, A^ is not commutative. N2 is, in fact, the direct sum of the quaternions and a commutative group all of whose nonzero elements have order 2. JV2 contains a unique nonzero element w such that w = 2x for some x € iV2. (w) is therefore a characteristic subgroup of iV2. Since AT2. is normal in G, (w) is normal in G. Adding this to the fact that o(w) = 2 shows that w € Z(G). Baer [2] proved that when the norm of a group is hamiltonian, the following four statements must hold: G contains no elements of infinite order; G contains no elements whose order is divisible by 8; all elements of G whose order is divisible by 4 are of the form z + v, where v commutes with every element in Af2 and z € Af2 with o(z) = 4; all elements of G whose orders are
Commutative Prime Power Subgroups of the Norm
13
not divisible by 4 commute with every element in A^. Hence, if the commutator [a, x] = — a — x + a + x for some a € G and some x € N2 is different from 0, a = z + v, where v commutes with N2 and z £ N2 with o(z) = o(x) = 4. To see this, recall the structure of N2. Therefore, when [a, x] ^ 0 for a € G and x (z N2, there exists & z € N2 such that [a, x] = (2, x] = w. Since we established earlier that w £ Z(G), N2 < ^ ( G ) . We can apply the argument of Case 2 to the complement of N2 in N(G) to show that the complement is contained in Z${G). Since N(G) equals the direct sum of A^ and its complement, N(G) < Zs(G), and the proof of the theorem is complete. Since the norm N(G) as the intersection of all normalizers of all subgroups of G is a normal subgroup of G, G induces a group of automorphisms on N(G). T H E O R E M 5.2. The group of automorphisms induced by the group G on its norm is nilpotent of class 2.
Proof. Let S denote the group of automorphisms induced by G on N(G). If N(G) contains an element of infinite order, then N(G) = Z(G) (see Baer [1, 3]); then 5 = 1 , and there is nothing to prove. Assume that every element in the norm of G has finite order. Case 1. N{G) is commutative. Then N(G) equals the direct sum of Np. For the prime p, let Sp = all a 6 S such that a = 1 on Nq for every prime q ^ p. Np is a characteristic subgroup of N(G) for every prime p, and N(G) is characteristic in G; so Np is normal in G. By using Lemma 1.1, we have Sp is precisely the group of automorphisms induced by G on A^p. Np, Sp is a norm pair and therefore, by Theorem 1.1, is a norm-like pair. If Np < Z(G), Sp = 1. If Np is not contained in the center of G, then Np has bounded order by Theorem 1.1, and we can apply Theorem 4.2 to obtain Sp is nilpotent of class 2. Using Lemma 1.1, we see that S is the direct product of its p-components Sp, and therefore S itself must be nilpotent of class 2. Case 2. Af(G) is hamiltonian. Recall the structure of hamiltonian groups stated in Case 3 of Theorem 5.1 to see that N(G) is again the direct sum of Np. For p ^ 2, we can argue as in Case 1 to obtain Sp is nilpotent of class 2. Let C = the centralizer of N2 in G. Since N2 is a normal subgroup of G, C is normal also. Let Q be the quater nions. Using Baer's result on groups with hamiltonian norm cited in Case 3 of Theorem 5.1, we see that G = Q + C. C l~l Q = 2Q. 5 2 is isomorphic to G/C = (Q + C)/C is isomorphic to Q/QflC = Q/2Q = the 4-group. So S2 is commu tative. Since commutativity was not needed in the proof of Lemma 1.1, we can again apply Lemma 1.1, to obtain S equals the direct product of Sp. Since Sp is nilpotent of class 2 for p ^ 2, and since S2 is commutative, S is of class 2. We can connect and sharpen Theorems 5.1 and 5.2 with the following
Collected Works of Larry Wos
14 theorem.
T H E O R E M 5.3. Where N(G) is hamiltonion, N(G) < Z2(G) if and only if the group of automorphisms S induced on N(G) by G is commutative; where N(G) is a commutative group containing no elements of infinite order and 2N2 = 0, N(G) < Z2(G) if and only if S is commutative.
Proof. Assume N(G) is hamiltonian. By Theorem 3.1, Np < Z2(G) if and only if Sp is commutative for p ^ 2. For p = 2, Sp was shown to be commutative in Case 2 of Theorem 5.2, and Np < Z2{G) was shown in Case 3 of Theorem 5.1. Since 5 equals the direct product of Sp, and N(G) equals the direct sum of Np, the first part of the theorem is established. Now assume N(G) is commutative and contains no elements of infinite order and that 2N2 = 0. S2 thus contains elements of maximum order. If 52 contains 2 such which are disjoint, then, by Lemma 4.1, N2 = F2 = Z2(G) n N2; this in turn implies, by Theorem 3.1, that S2 is commutative. If 52 does not contain 2 elements of maximum order which are disjoint, then all A^(l — a) are equal for a ^ 1 6 52, since 2N2 = 0. Then N2(l - S2) < F(S2) = Z(G) n P. This implies, by Corollary 3.1, that S2 is commutative. N2(l — 52) < Z(G) is equivalent to N2 < Z2(G). Therefore, in either case, N2 < Z2(G), and 52 is commutative. For p / 2, Np < Z2(G) if and only if Sp is commutative, by Theorem 3.1. So again 5 is commutative if and only if N(G) < Z2(G). By examining the proof just completed and by recalling that, by Baer [1, 3], if the norm contains an element of infinite order, then the norm equals the center, we see there is only one obstacle to the theorem: N(G) < Z2(G) if and only if 5 is commutative. This obstacle is the prime 2 and the restriction it imposes on the sufficiency of the desired theorem. This restriction is exemplified by Theorem 3.1.
Section VI Theorem 1.1 establishes that norm pairs P, S are norm-like pairs and, if 5 / 1,P has bounded order. A trivial example of the converse is provided by the norm-like pair P,S with 5 = 1 . Theorem 6.1 gives sufficient conditions for norm-like pairs to be norm pairs. T H E O R E M 6.1. If P, S is a norm-like pair such that P has bounded order pm with p j= 2 and such that S contains elements of maximum order which are disjoint, the P, S is a norm pair.
Proof. The problem is to construct a group G such that P < N(G), P is normal in G, and G induces exactly the group of automorphisms 5 on P. If 5 = 1, let G = P. If 5 / 1,5 contains 2 elements of maximum order which
Commutative Prime Power Subgroups of the Norm
15
are disjoint. From Lemma 4.1 and the second remark of Section IV, there exists an x € P such that x(l - c) generates P(l - c) for every c € S. By the first remark of Section IV and Lemma 2.3, S is a commutative group of bounded order, and therefore S has a basis bi. Let G be the group formed by adjoining Xi to P with the following properties: Xi induces bi on P, Xi + Xj = Xj + Xi, and pmXi = i ( l — bi). G contains P as a normal subgroup, and induces exactly S as automorphism group on P. Therefore, we need only show that P < N(G). The general element of G has the form y + a with y € P and a a finite sum of Xi, where a given Xi may occur more than once. If a € G induces the automorphism a on P, then a + y = y + o + j/(l - a) since P is commutative. Since pmP = 0 and p is not divisible by 2, pm(a + y)=pma+pmy + y(l - a) + 2y(l - o) + • • • + (p m - l)y(l - a) = p m a + (pm - l)p m /2 • j/(l - a) = p m a. By Corollary 3.2, 1 - cd = 1 - c + c - cd = (1 - c) + (1 - d)c = (1 - c) + (1 - d) for every c and
1. Der Kern, eine charakteristische Untergruppe, Compositio Math., vol. 1 (1934), pp. 254-283. 2. Gruppen mit hamiltonschem Kern, Compositio Math., vol. 2 (1935), pp. 241-246. 3. Zentrum und Kern von Gruppen mit Elementen unendlicher Ordnung, Compositio Math., vol. 2 (1935), pp. 247-249. 4. Norm and Hypernorm, Publ. Math. Debrecen, vol. 4 (1956), pp. 347-350.
Collected Works of Larry Wos
16
HANS ZASSENHAUS
1. Theory of groups, New York, 1949. UNIVERSITY OF ILLINOIS URBANA, ILLINOIS ARGONNE NATIONAL LABORATORY LEMONT, ILLINOIS
The Unit Preference Strategy in Theorem Proving* Lawrence Wos, Daniel Carson, and George Robinson Argonne National Laboratory Argonne, Illinois
Unit Preference and Set of Support Strategies The theorems, axioms, etc., to which the algorithm and strategies described in this paper are applied are stated in a normal form defined as follows: A literal is formed by prefixing a predicate letter to an appropriate number of arguments (constants, variables, or expressions formed with the aid of function symbols) and then perhaps writing a negation sign (—) before the predicate letter. For example: P(b,x) - P ( b , x ) Q(y) R(a,b,x,z,c) S are all literals if P,Q,R, and S are two-, one-, five-, and zero-place predicate letters, respectively. The predicate letter is usually thought of as standing for some n-place relation. Then the literal P(a,b), for example, is thought of as saying that the ordered pair (a,b) has the property P. The literal - P ( a , b ) is thought of as saying that (a,b) does not have the property P. One may build a clause by writing a sequence of literals separated by disjunc tion (logical "or") signs. Logical "or" will be symbolized by a small letter "v" (distinguishable from possible uses of "v" as a variable from context). Where it is desired to indicate dependence of a particular argument of a predicate letter upon one or more other variables, function symbols are employed. The clause P(x,y,z) v Q(x,f(x,y)) thus says that either the ordered triple (x,y,z) has the property P or the ordered pair (x,f(x,y)) has the property Q (or both). Each of the variables in a clause is then thought of as being universally quantified (that is, if the variable x occurs in a clause, the clause is assumed to be preceded by an implicit quantifier, "for "Work performed under the auspices of the U.S. Atomic Energy Commission. Reprinted with permission from the Fall Joint Computer Conference, San Francisco, CA, AFIPS Proceedings 26, Spartan Books, Washington, D.C., pp. 615-621 (October 1964).
Collected Works of Larry Wos
18
each x." Functional expressions such as f(x,y) are then treated as existentially quantified variables. Roughly speaking, f(x,y) in the example above stands for an element (depending on x and y) which forms, when used as the second element with x as the first element, an ordered pair which has the property Q. A unit clause is a clause composed of a single literal. Finally, one may consider a sequence of clauses implicitly joined by logical "and" (conjunction). Such a sequence of clauses will be said to be in (conjunc tive) normal form. Instantiation, as applied to this normal form, can be thought of as the form ing of a possibly loss general (more specific) instance of a clause by performing a systematic replacement of variables by constants, new variables, or by expres sions formed with the aid of function symbols. Substituting b for x and f(d,u) for y in the clause P(x,y) v Q(b,y) would yield a less general instance of that clause: P(b,f(d,u)) v Q(b,f(d,u)). The latter is less general in that, while it can be deduced from the former, the former cannot be deduced from the latter. Early computer-oriented theorem-proving efforts employed search techniques involving instantiation of a given set of logical formulae. In these methods, suc cessively larger sets of constants were generated. As each set was generated, all permissible substitutions of such constants for variables were made in the origi nal formulae, producing successively larger sets of instances. These instances dif fered from the original formulae in that they included no logical quantifiers: "For each x," "For some x," etc. For sets of such quantifier-free formulae, straightfor ward techniques were known for determining validity or inconsistency. P. C. Gilmore2 described an IBM 704 program using the technique of conversion of sets of quantifier-free formulae from conjunctive normal form to disjunctive normal form. Davis and Putnam introduced a substantial improvement in the method of testing such sets of quantifier-free formulae. A 704 program4 incor porating this improvement proved to be several orders of magnitude faster than Gilmore's program for the same machine. These instantiation techniques employed the argument forms existential instantiation and universal instantiation (see for example Quine5) to infer the quantifier-free instances from the original formulae. All permissible substitutions were made in a systematic, exhaustive manner, guaranteeing that if a proof existed of the desired theorem, it would be captured in the steadily expanding sets of instances. The disastrous rate of growth of these sets, due to the inclusion of numerous unprofitable inferences, spelled the doom of exhaustive instantia tion. Study of the nature of the instances which could be expected to result from such a program led, however, to the suspicion that the logical completeness of the method could be retained but the combinatoric explosion substantially reduced
Unit Preference Strategy in Theorem
Proving
19
by considering the generalizations represented by classes of similar instances. This led to the formulation of computer-oriented rules of inference which sup pressed universal instantiation and retained universally quantified variables in their more general form. These rules were codified and put on a sound logical basis by J. A. Robinson 3 in his paper on the resolution principle. As a computer algorithm, he proposed that the original set of formulae be completely "re solved" in the sense that all possible applications of the inference rule resolution be made in a systematic, exhaustive manner. Where exhaustive instantiation methods met their downfall was in blindly forming all possible maximally specific instances from a given set of clauses; once formed, such instances were never to be discarded. Only then was consideration given to what interactions might occur between the instances (specifically, to whether the set thus generated was inconsistent). Furthermore, in most inter esting cases, many new objects to be substituted were manufactured, resulting in a combinatoric explosion of further instances. Resolution, as proposed by J. A. Robinson, curtails the number of instances produced, in that it produces a new clause only when it can be determined in advance that two existing clauses will, when each is instantiated, yield a pair of instances that will interact, forming a clause which could not have been inferred from either parent clause taken by itself. Specifically, in resolution a pair of clauses (each of which is called a resolvend) is examined to see if there is a substitution which will transform the clauses into a pair of the form L v Li v L2 v . . . v L m , —L v Ki v K2 v . . . v K n Prom such a pair, the clause Li v L2 v . . . v L m v Ki v K2 v . . . K n can be inferred. This clause (called the resolvent) is then added to the set of clauses which have been accumulated from previous inferences. Furthermore, a substitution is considered only if it is the most general that could be made, thus maintaining the maximum degree of generality in the result. Another closely related method of inference is factoring: A substitution is sought such that (a) two or more of the literals of a clause will collapse into a single literal, and (b) no more general substitution would have the same effect. The resulting clause is called a factor. Substitution of these rules of inference for the earlier instantiation inference rules was shown to produce a reduction of the combinatoric explosion by a factor in excess of 10 50 , leading to some rather spectacular achievements when compared to the instantiation techniques. Nevertheless, the search algorithm employed a more or less random generation of resolvents inferred by means of the resolution principle. Using only these techniques, previously established bench-mark problems required prohibitive amounts of machine time. It seemed that a change of emphasis would be profitable.
Collected WorJcs of Larry Wos
20
One approach would be to concentrate upon the strategies of search. The current paper considers one such strategy, the unit preference strategy. This strategy has been implemented in a theorem-proving program now successfully running on the Control Data 3600. We will describe the search algorithm em ployed in the program, prove its soundness and completeness, consider some examples, and describe additional search strategies which can be employed to effect further improvement. The principal search strategy arises from the fact that the object of the resolution principle is the generation through inference of two unit clauses which are manifestly contradictory. Here and elsewhere in this paper, contradict is used as in mathematics in the somewhat broader sense of conflict, rather than in the narrower sense frequently used in logic. Two clauses will be called contradictory if they are mutually exclusive (contrary) clauses. We do not require them to bear the relation of a clause to its negation. With this in mind, it seemed worthwhile to orient the program to produce shorter and still shorter clauses in preference to other possible inferences.
The Unit Preference Strategy The data for consideration consists of a set of clauses in the normal form. The clauses correspond to a given set of axioms and the denial of a theorem to be proved from these axioms, for it is to be remembered that the program finds proofs and not theorems. Remember that all variables that occur are treated as universally quantified; all existentially quantified variables have been replaced by constants or functions. The algorithm is divided into two sections, a unit section and a non-unit section. Where a j-clause is a clause of length j (i.e., has j literals), and the j-list is the list of j-clauses, the logic of the unit section is as follows, starting with j = l: 1. Search the unit list and the j-list for a pair of elements C and D such that C is a unit, D is of length j , and for some literal m of D resolution has not been attempted for C and D on m; if no such pair exists, execute step 2; if such a pair exists, execute step 3. (The search in the program proceeds by taking the first unit and the first j clause and examining each of its literals; the procedure is repeated with the same j-clause and the next unit, and continues until the unit list is exhausted. Then the process is applied to the next j-clause.) 2. If j is the length of the longest clause present, enter the non-unit section; if not, increase j by 1 and return to 1. 3. Resolve C and D on m; if no resolvent is generated, return to 1 and resume the search; if a resolvent of length i > 0 is generated, add the resolvent
Unit Preference Strategy in Theorem
Proving
21
to the i-list, set j = i, and return to 1; if the empty resolvent is gener ated, execute the proof recovery. (The generation of the empty resolvent is equivalent to finding that the clauses C and D are manifestly contradic tory.) In order to avoid the possibility of being caught in an infinite loop, there is a constraint placed on step 3. The constraint is formulated in terms of the concept of the level of a clause. Let So be the original set of clauses; define Sj for i > 0 to be the set of resolvents of Si_i together with Sj_i. The level k of a clause C is 0 if C is input, is that of B if C is obtained by factoring B, and is 1 greater than the maximum of the levels of A and B if C is obtained by resolving A and B. The constraint imposed on 3 is: if the resolvent of C and D is a non-unit whose level is a specified bound ko, or a unit whose level exceeds ko, then it is not added to the corresponding list, and the pair is treated as if no resolvent were generated. To illustrate the difficulty thus avoided consider the set consisting of the clauses P(a), — P(x) v P(f(x)), which correspond to a subset of the Peano axioms, and some clause of length 3. Without the level bound, the program would generate P(f(a)), P(f(f(a))), P(f(f(f(a)))),..., ad infinitum. We would be caught in an infinite loop which would continually present and execute the task of resolving a new unit with the same 2-clause instead of either passing to the proof recovery or to the non-unit section. The non-unit section beings by setting j = 2, then: 1. Search the j-list for a clause D with literals 1 and m on which factoring has not been attempted; if one exists, execute 2; if not, execute 3. 2. Factor D on 1 and m; if no factor is generated, return to 1; if a factor C of length i is generated, add C to the i-list, set j = i, and return to step 1 of the unit section. 3. If j = 2, increase j by 1 and return to step 1 of the non-unit section; if j ^ 2, execute 4. 4. Set h = 2, replace j by j - 1, and execute 5. 5. Search the h-list and the j-list for a pair C and D such that C is an h-clause with a literal 1, D is a j-clause with a literal m, and resolution has not been attempted for C and D on 1 and m; if no such pair exists, execute 6; if such a pair exists, execute 7. 6. If h ^
the maximum length of all clauses present, the program stops with
the conclusion that no proof exists within level ko; if h < this maximum and h + 1 > j , replace j by h + j and return to 1 of the non-unit section; if h + 1 < j , replace h by h + 1 by j by j - 1 and return to 5.
Collected Works of Larry Wos
22
7. Resolve C and D on 1 and m; if no resolvent is generated, return to 5; if a resolvent B of length i is generated, then add B to the i-list, set j = i, and return to 1 of the unit section. Again the level constraint imposed on Step 3 of the unit section applies.
Soundness and Completeness The soundness of the procedure follows from the fact that if C is in Si or a factor of some D in S; for any i, C is implied by So, i.e., C is a consequence of So- So, if C and D are elements of the unit list which conflict (are manifestly contradictory), So is inconsistent. The argument for completeness is as follows: J. A. Robinson3 proved in effect that if So is an inconsistent set, there exists a k such that Sk contains the empty resolvent; this implies that Sk_i contains two clauses which are units or have unit factors which conflict. The claim is that when the level bound ko of the program is equal to this k, whether ko is immediately set equal to k or set equal to 1,2,.. .k, the desired unit conflict will be obtained. At any given time the set of clauses which occur on any list is contained in Sk, and is therefore finite. The search through any list for potential factors or through any pair of lists for potential resolvents is a finite process since all lists are finite. The number of searches through any list is limited by the size of the input and the number of clauses which are adjoined and is, therefore, finite also. So any clause which occurs on any list will do so after a finite number of steps. In a similar fashion we can see that all clauses on all lists will be factored and, within the level bound, pairwise resolved in a finite number of steps. Consider the case where ko is sufficiently large to have Sko contain the empty resolvent. If ko = 1, So contains the clauses which yield the conflict, and the previous argument shows that the program will examine the pair in question. If ko = 2, the same argument shows that Si will be contained in the lists of clauses, and again the conflict will be obtained. Applying the argument ko times shows Sko-i will be contained in the lists of clauses. So we have proven the following lemma. Lemma: Using the search algorithm with level bound ko such that Sko con tains the empty resolvent, the program finds a proof if and only if So is unsatisfiable.
Subsidiary Strategies The most important subsidiary strategy is based on the concept of a chain. With the appropriate grouping, any clause which occurs on any list is expressible in terms of the elements of So together with the operators of resolution and factoring. Such an expression is called a chain, and the number of resolutions which occur therein is its length. The elements of So and the factors of those
Unit Preference Strategy in Theorem Proving
23
elements are chains of length 0; those of Si have chains of length 0 and 1; those of S2 have chains of length of 0, 1, 2 and 3. If T is a nonempty subset of S 0 and C is a chain of length 0 whose single element is in T or is a factor of an element in T, we say C is supported by T or C has T-support. Chains C of length greater than 0 have T-support if, for every resolution, that occurs in C, at least one of the resolvends has T-support. The clause B is said to be derived from T, if its chain (its expression or derivation in So) has T-support. The strategy employed here is to choose T and generate only those elements of Si for i > 0 which are derived from T. The choice of T obviously has a profound effect on the number of clauses generated during the search for a proof. The question remains as to which available choices of T preserve completeness of the procedure. By the lemma of the previous section, T = So is admissible under the appropriate conditions. For a given So the clauses might be divided into 3 categories; those which correspond to the basic axioms of the theory under study; those which correspond to the special hypotheses of the theorem under consideration, and those which correspond to the denial of the conclusion of the theorem. For example, consider the theorem: in a group, if the square of every element is the identity, the group is commutative. The first category would consist of a set of axioms which characterize groups; the second would consist of the axiom, for every x in the group x 2 = e; the third would be the denial of commutativity, there exist a and b such that ab / ba. (This example will be considered later under various conditions.) It appears that, where T is the join of the last two categories, this choice of T for set of support preserves completeness and is most valuable in obtaining proofs in a reasonable amount of time. Among the other strategies which can be employed are: deletion of the unit clause B upon generation if the unit list contains a clause A such that every instance of B is also one of A; deletion upon generation of a clause if it contains two literals which have opposite sign but are otherwise identical; deletion of B if the unit A is a resolvent of B with some C such that all instances of some literal k of B are contained in the set of instances of A. EXAMPLE 1: In an associative system with left and right solutions, there is a right identity element. Basic Axioms: Al.
-P(x,y,u) v -P(y,z,v) v -P(x,v,w) v P(u,z,w) A2. -P(x,y,u) v -P(y,z,v) v -P(u,z,w) v P(x,v,w)
(associativity)
Collected Works of Larry Wos
24
A3. P(g(x,y),x,y) A4. P(x,h(x,y),y) A5. P(x,y,f(x,y))
(left solution) (right solution) (closure)
Negation of Conclusion: A6.
-P(j(x),x,j(x))
(no right identity)
When A6 was taken as the only member of the set of support, the computer generated the following proof in 35 milliseconds with 11 clauses in memory at the time the proof was detected: 1. -P(x,y,u) v -P(y,z,v) v -P(x,v,w) v P(u,z,w) 2. P(g(x,y),x,y) 3. P(x,h(x,y),y) 4. -P(j(x),x,j(x)) 5. -P(x,yj(z)) v -P(y,z,v) v -P(x,vj(z)) 6. -P(y,z,v) v -P(g(yj(z)),v,j(z)) 7. -P(v,z,v)
(Al) (A3) (A4) (A6) (from 4 and 1) (from 2 and 5) (from 2 and 6)
Since 3 and 7 are manifestly contradictory, the proof is complete. EXAMPLE 2: In an associative system with an identity element, if the square of every element is the identity, the system is commutative. Basic Axioms: Al. P(x,e,x) A2. P(e,x,x) A3. -P(x,y,u) v -P(y,z,v) v — P(u,z,w) v P(x,v,w) A4. -P(x,y,u) v -P(y,z,v) v — P(x,v,w) v P(u,z,w)
(right identity) (left identity) (associativity)
Special Hypothesis: A5.
P(x,x,e)
(The square of every element is the identity.)
Negation of Conclusion: A6. A7.
P(a,b,c) -P(b,a,c)
(There are elements a and b which do not commute.)
When Al through A7 were used as the set of support, the machine generated the following proof in 1.124 seconds with 119 clauses in memory at the time the
Unit Preference Strategy in Theorem Proving
25
proof was detected. 1. 2. 3. 4. 5. 6. 7.
8. 9. 10. 11. 12. 13. 14.
P(x,e,x) P(e,x,x) -P(x,y,u) v -P(y,z,v) v -P(u,z,w) v P(x,v,w) -P(x,y,u) v -P(y,z,v) v -P(x,v,w) v P(u,z,w) P(x,x,e) P(a,b,c) -P(b,a,c)
-P(x,y,e) v - P ( y , w , v ) v P(x,v,w) - P ( y , w , v ) vP(y,v,w) - P ( w , y , u ) v -P(y,z,e) v P(u,z,w) - P ( w , z , u ) v P(u,z,w) P(c,b,a) P(c,a,b) -P(c,a,b)
(from (from (from (from (from (from (from
(Al) (A2) (A3) (A4) (A5) (A6) (A7)
2 and 3) 5 and 8) 1 and 4) 5 and 10) 6 and 11) 12 and 9) 7 and 11)
Since 13 and 14 are manifestly contradictory, the proof is complete. When, instead, only A5, A6, and A7 were used as the set of support, the machine generated the following proof in the faster time of 538 milliseconds with 72 clauses in memory at the time the proof was detected: 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14.
P(x,e,x) P(e,x,x) - P ( x , y , u ) v -P(y,z,v) - P ( x , y , u ) v -P(y,z,v) P(x,x,e) P(a,b,c) -P(b,a,c) —P(y,z,v) v —P(e,z,w) - P ( y , w , v ) v P(y,v,w) —P(x,z,u) v —P(x,e,w) —P(w,z,u) v P(u,z,w) P(c,b,a) P(c,a,b) -P(c,a,b)
v -P(u,z,w) v P(x,v,w) v -P(x,v,w) v P(u,z,w)
v P(y,v,w) v P(u,z,w)
(Al) (A2) (A3) (A4) (A5) (A6) (A7) (from (from (from (from (from (from (from
5 and 3) 2 and 8) 5 and 4) 1 and 10) 6 and 11) 12 and 9) 7 and 11)
Since 13 and 14 are manifestly contradictory, the proof is complete. EXAMPLE 3: In a group, if the square of every element is the identity, the group is commutative.
Collected Works of Larry Wos
26
Basic Axioms: Al. A2. A3. A4. A5. A6. A7. A8. A9.
P(x,y,f(x,y)) P(e,x,x)l P(x,e,x)J P(x,g(x),e)\ P(g(x),x,e)J R(x,x) -R(x,y) v R(y,x) -R(x,y) v -R(y,z) \r R(x,z) -P(x,y,u) v -P(x,y v) v R(u,v)
A10. All. A12. A13. A14. A15. A16. A17.
(closure) (existence of identity) (existence of inverse) (reflexivity of =) (symmetry of =) (transitivity of =) (multiplication is well-defined)
-P(x,y,u) v -P(y,z,v) v — P(u,z,w) v P(x,v,w) -P(x,y,u) v-P( y ! z,v) v - P(x,v,w) v P(u,z,w) -R(u,v) v -P(x,y,u) v P(x,y,v) -R(u,v) v -P(x,u,y) v P(x,v,y) -R(u,v) v -P(u,x,y) v P(v,x,y) -R(u,v) v R(f(x,u),f(x,v)) -R(u,v) v R(f(u,y),f(v,y)) -R(u,v) v R(g(u),g(v))
(associativity)
(substitution for =)
Special Hypothesis: A18.
P(x,x,e)
(The square of every element is the identity.)
Negation of Conclusion: A19. A20.
P(a,b,c) —P(b,a,c)
(There are elements a and b which do not commute.)
With A18 through A20 used as the set of support, the computer generated the following proof in 54 seconds with 563 clauses in memory at the time the
The Unit Preference Strategy in Theorem Proving
27
proof was detected: 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20.
P(x,y,f(x,y)) (Al) P(e,x,x) (A2) P(x,e,x) (A3) -P(x,y,u) v -P(y,z,v) v -P(u,z,w)'v P(x,v,w) (A10) -P(x,y,u) v -P(y,z,v) v -P(x,v,w) v P(u,z,w) (AH) P(x,x,e) (A18) P(a,b,c) (A19) (A20) -P(b,a,c) -P(y,z,v) v -P(e,z,w) v P(y,v,w) (from 6 and 4) -P(e,z,w) v P(y,f(y,z),w) (from 1 and 9) P(y,f(y,w),w) (from 2 and 10) -P(x,y,z) v -P(y,z,v) v P(x,v,e) (from 6 and 4) -P(x,y,z) v P(x,f(y,z),e) (from 1 and 12) P(a,f(b,c),c) (from 7 and 13) -P(b,y,u) v -P(y,z,a) v -P(u,z,c) (from 8 and 4) -P(e,z,a) v -P(b,z,c) (from 3 and 15) -P(e,f(b,c),a) (from 11 and 16) -P{y,z,v) v -P(y,v,w) v P{e,z,w) (from 6 and 5) — P(w,z,e) v P(e,z,w) (from 3 and 18) P(e,f(b,c),a) (from 14 and 19)
Since 17 and 20 are manifestly contradictory, the proof is complete.
Discussion In order to study the importance of the various strategies discussed above, Example 2 was run without the aid of the unit preference strategy or the set of support strategy. At the end of 30 minutes the program had just finished gener ating S2, having also generated Si, without obtaining a proof. By comparison, with the aid of these strategies, the proof was obtained in about .5 seconds. Example 3 serves to illustrate the comparative difficulty encountered when attacking a mathematical theorem without a priori knowledge, such as that employed in Example 2, as to which subset of the basic axioms of the theory is relevant. The proof of Example 2 was completed in about .5 seconds, while Example 3 required 54 seconds although the same strategy was applied to both. It should be noted that, without the set of support strategy, Example 3 was beyond the range of a 65,000 word machine.
BIBLIOGRAPHY 1. DAVIS, M., and PUTNAM, H., "A computing procedure for quantification
theory," J. ACM 7, 201-215 (1960).
28
Bibliography
2. GiLMORE, P. C , "A proof method for quantification theory," IBM J. Res. Develop. 4, 28-35 (1960). 3. ROBINSON, J. A., "A machine oriented logic based on the resolution prin ciple." To be published. 4.
ROBINSON, J. A., "GAMMA I, a general theorem-proving program for the IBM 704," Argonne National Laboratory Report ANL-6447. November, 1961.
5. QuiNE, W. V. O., Methods of Logic, (Holt, Rinehart, and Winston, New York, 1959), Revised Ed.
Efficiency and Completeness of the Set of Support Strategy in Theorem Proving LAWRENCE W O S , GEORGE A. ROBINSON AND DANIEL F. CARSON
Argonne National Laboratory, Argonne, Illinois
Abstract. One of the major problems in mechanical theorem proving is the generation of a plethora of redundant and irrelevant information. To use com puters effectively for obtaining proofs, it is necessary to find strategies which will materially impede the generation of irrelevant inferences. One strategy which achieves this end is the set of support strategy. With any such strategy two questions of primary interest are that of its efficiency and that of its logical completeness. Evidence of the efficiency of this strategy is presented, and a theorem giving sufficient conditions for its logical completeness is proved.
1.
Introduction
In a previous paper on theorem proving [1] a strategy based on the concept of set of support was briefly discussed. This concept, its logical significance, and the theorem establishing the logical completeness of the corresponding strategy are the focus of attention in the first part of the present paper. The remainder of the paper is concerned with the efficiency and sensitivity of the strategy. Evidence is supplied of its effect on time and memory requirements and of its effect on the importance of the choice of parameter values. Evidence is also given of the value of the strategy in obtaining proofs of theorems whose mathematical depth is measurably greater than that of those previously provable by mechanical means. The evidence was obtained with the theorem-proving program PG1 imple mented for the Control Data 3600. The language employed by PG1 is first-order predicate calculus, and the chief rule of inference employed therein is resolution [1,2,3]. Work performed under the auspices of the US Atomic Energy Commission. Reprinted with permission from the Journal of the Association for Computing Machinery, Vol. 12, no. 4, pp. 536-541 (October 1965).
Collected Works of Larry Wos
30
2.
Definitions
The following definitions are given in preparation for defining set of support. Definition 1. For a set 5 of clauses, 5° is the set of clauses B such that B is in S or there is a clause C in S such that B is a factor [l] 1 of C. For i > 0, 5* is the set of clauses B such that B is in S* -1 or there exist clauses C and D in Sl~l such that B is a resolvent [1,3] of C and D or a factor of a resolvent of C and D. Definition 2. A deduction D of the clause A from the set S of clauses is a finite sequence Ai of clauses such that: (1) A = Ai for some i, and (2) every Ai is either in S, or there exists j < i with Ai a factor of Aj, or there exist j < i and k < i with Ai a resolvent of .4j and Ak ■ Definition 3. D is a deduction of contradiction from the set S of clauses if D is a deduction from S of two unit clauses A and B such that A and B give unit conflict. A and B give unit conflict if /I and B are unit clauses (have but one literal), are opposite in sign, and if there exist instantiations of A and B which make them otherwise identical. Such a deduction D is called a proof of the theorem corresponding to 5, or just a proof. Two unit clauses which give unit conflict are called contradictory units. Definition 4- For T C 5, Tg is the set of clauses B such that B is in T or there is a clause C € T such that B is a factor of C. For i > 0, Tj is the set of clauses B such that B is in Tg'1 or there exist C in TJ _ 1 and D in S° U Tg'1 such that B is a resolvent of C and D o r a factor of a resolvent of C and D. Definition 5. The T-level of a clause B is the smallest j for which B € T^. If no such j exists, the T-level of B is undefined. Definition 6. The clause B is said to have T-support if and only if for some i > 0, S € Ts. T is said to be a set of support for B and B is said to be supported byT. To illustrate the concept of set of support, let T contain a single clause B. Where A is a given element of 5, the following are some of the clauses having T as set of support: B, any factor B' of B, any resolvent C of A and B', any resolvent of A and C where C" is a factor of C. Definition 7. The set T C 5 is a set of support for the deduction D if every Ai of D has T-support, is in S itself, or is a factor of some element in S.
'In connection with the search strategies employed herein it is most useful to consider separately as in [1] the operators of resolution and factoring. These two operators are unified into a single rule of inference in [3]; however, the term resolution as used therein does not refer to an operator.
Set of Support Strategy in Theorem Proving
3.
31
Set of Support Strategy
The set of support strategy for theorem proving consists of selecting a subset T of the given set S of clauses and an integer k and generating the elements of S° L)Tg. The integer k is called the level bound. Equivalently, the adjunction of a clause is permitted if and only if it is a factor of an element of S or it has T-support and its T-level does not exceed the level bound. To extract the full value of this strategy requires judicious choice of the set T. It is easy to construct unsatisfiable sets 5 of clauses which allow for an unwise choice of T as set of support—unwise in the sense that unsatisfiability cannot be established through use of the set of support strategy with that choice of T. A poor choice of T could in fact prevent one from discovering a proof even when seeking one for an already established theorem. A rather natural choice of T would seem to be the join of two sets of clauses: the subset of clauses within S which corresponds to the denial of the purported theorem, and that subset within 5 which corresponds to the special hypotheses of the theorem. The special hypothesis of the theorem refers to that which is given in the theorem but which is outside the basic set of axioms for the theory in question. (It is rather natural from the mathematical viewpoint to choose T in this fashion since the mathematician often seeks proof by contradiction, assuming the theorem false while focusing attention on the additional hypotheses.) The logical significance of this choice for T lies in the fact that the basic axioms of a theory are assumed to form a satisfiable set. The set of support strategy avoids seeking a proof, a demonstration of unsatisfiability, within that subset which is assumed to be itself satisfiable. The corresponding gain from the viewpoint of mechanical theorem proving lies in the fact that many clauses which correspond to trivial lemmas of the theory will not be generated, and many of the possible alternate proofs of the theorem under study will not be begun. An additional aid in avoiding trivial lemmas is provided by that feature of PG1 which allows control of literal length. One of the input parameters establishes a bound on the number of symbols which may occur in any literal of any clause generated by the program.
4.
Completeness
The question now arises connecting the given choice of T as set of support and the possible loss of logical completeness. Put in broader terms, where 5 is a finite unsatisfiable set of clauses, what condition is sufficient to force the choice of T C S as set of support to have the desired property: unsatisfiability will be established after generating a finite number of clauses when employing the set of support strategy? An answer to this question is contained in the theorem on completeness, below. In particular the choice of T discussed above has this property. This is equivalent to saying that, for a valid theorem, there exists a proof D obtainable by generating a finite number of clauses which has as set of
32
Collected Works of Larry Wos
support the join of the special hypotheses and the denial of the conclusion of the theorem. LEMMA 1. If S is a finite unsatisfiable set of clauses containing no variables,2 and ifTCSis such that S — T is satisfiable, then there exists a proof D with T as set of support.3 Proof. Let P be the set of atoms of 5. If P contains a single element, say Q, then among the elements of 5 there exist the units Q and -Q. The two-line deduction Q, —Q will suffice. Assume that Lemma 1 holds4 when P contains i elements, 1 < i < n. To complete the induction, consider P such that P contains exactly n + 1 elements. Let Q be any element of P. Let Si be that set obtained from 5 by deleting those clauses containing the literal Q and by deleting — Q from the remaining clauses. Let 7\ be obtained from T similarly. Let 52 be that set obtained from 5 by deleting those clauses containing — Q and by deleting Q from the rest. Ti is obtained from T similarly. S\ and S? are unsatisfiable since 5 is. Si - 7i or 52 - Tj (or both) are satisfiable since 5 - T is. Assume without loss of generality that Si — T\ is satisfiable. Where the induction hypothesis applies there exists a deduction of contradiction from Si with T\ as set of sup port. (The only case in which it does not apply is that in which — Q is a unit clause in 5.) Let R and — R be contradictory units contained in that deduction. The corresponding deduction from 5 has T-support. At best it contains R and —R, and the proof of Lemma 1 is complete. At worst, the clauses — Q V R and —QV—R are part of that deduction, and by adding their resolvent one has a deduction D\ of —Q as a unit, and the deduction has T-support. In the case in which the induction hypothesis does not apply, the T-supported deduction Di of — Q consists of a single line — Q. Each of the remaining cases can be extended to a deduction D\ with T-support of the unit — Q. Similarly, if 52 — T2 is satis fiable at worst there exists a deduction D2 of Q with T-support. The juxtapo sition of £>i and D2 is a deduction D of contradiction. One case remains—that in which 52 — T2 is unsatisfiable. Let U be the set of those clauses of 52 — T2 which are obtained from 5 by deletion of the literal Q. Since the elements of (52 — T2) - U are elements of 5 — T, (52 — T2) — U is satisfiable. If the induc tion hypothesis does not hold in 52 — T2, then the unit clause Q is a member of 5. In that case form the deduction D by adding the line Q to D\. Such a deduction D is a deduction of contradiction with T as set of support. When the induction hypothesis holds in 52 — T2, there exists a deduction D3 of contradic tion with (/-support. Let Ui be the set of those clauses of U which appear in D3. Let V be that subset of 5 from which Ui is obtained by deletion of the literal 2 In the hypothesis of Lemma 1 each clause in 5 is tacitly assumed to have at least one literal. Thus the so-called empty clause is excluded from S. 3 The authors are indebted to J. A. Robinson for his invaluable assistance in obtaining proofs of Lemma 1 and the corresponding completeness theorem. 4 See footnote 2.
Set of Support Strategy in Theorem
Proving
33
Q. Equivalently the elements of U\ are obtainable by successive resolution of —Q with the elements of V. Since -Q has T-support the elements of C/i do also. Therefore, the deduction formed by juxtaposing D\, V, and D3 is a deduction D of contradiction with T-support. Remark. If S and T satisfy the hypothesis of Lemma 1, then there exists a j such that Si contains contradictory units which have T-support. This follows from the fact that a proof, by definition, is finite in length and that resolution is the only rule of inference which is employed in Lemma 1. The following two lemmas are given without proof. LEMMA 2. / / C is a resolvent of A' and B' where A' and B' are obtained from A and B respectively by instantiation, then there exists a C such that C" is obtainable from C by instantiation and such that C is a resolvent of F and E, where F = A or F is a factor of A and E = B or E is a factor of B. Conversely, if C is a resolvent of A and B, and if C is obtainable from C by instantiation, then there exist A' and B' such that C is a resolvent of A' and B' and such that A' and B' are obtainable from A and B respectively by instantiation. LEMMA 3. If A' is obtainable from A by instantiation and has strictly fewer literals than A, then there exists a factor B of A such that A' is obtainable from B by instantiation and such that A' and B have the same number of literals. With Lemmas 1, 2, and 3, the proof of the completeness theorem is avail able.
T H E O R E M . If S is a finite unsatisfiable set of clauses, and ifTCSis such that S — T is satisfiable, then there exists a T-supported proof D and, more over, aj such that the clauses of D are members of 5 J . Proof. By a theorem of Herbrand there exists a finite set H of constants such that, when S is instantiated over H, a set S' of clauses is obtained which is finite, free of variables and still unsatisfiable. T', the instantiation of T over H, is such that S' - T' is satisfiable since S' — T' is contained in the set obtained by instantiating S - T over H. By Lemma 1 there exists a proof D' from S' with T'-support. The object is to construct a corresponding proof D from S with T-support. The following procedure will suffice. When A' appears in D' and is an instance of some A € S: if A' and A have the same number of literals, replace A' by A; if A' and A do not, replace A' by the sequence A, B, where A and B are determined as in Lemma 3. When C" appears in D' and is obtained by resolving A' and B' and where A and B were previously obtained from A' and B': replace C" by the sequence F, E, C as determined by Lemma 2; if the number of literals of C is strictly less than the number of C, replace C by the
Collected Works of Larry Wos
34
two-element sequence determined by Lemma 3. This procedure will replace the proof D' by a proof D from 5. D will have T-support, and the clauses of D will be members of S " - 2 , where n is the number of terms in D. Since every 5*, and hence every Tg, is finite, the completeness theorem guar antees the existence of a proof procedure based on the set of support strategy under proper choice of T as set of support. For a given T-supported proof D = A\,..., A„, not only are all the Ai in S™-2, but in fact all the Ai are in 2 T£~ . An easily proven but important corollary is: COROLLARY
1.
Resolution coupled with factoring is complete.
Proof. Let T = S in the theorem. 2. Let S be the join of K\, K
COROLLARY
5.
Examples
If a theorem-proving program is actually to be used by the mathematician to find proofs, prior knowledge as to the best choice for such parameters as level bound and literal bound will be unavailable. The examples which have been run with PG1, 5 a program implemented for the Control Data 3600, indicate that use of set of support strategy as suggested by Corollary 2 materially reduces the sensitivity to the choice of these bounds. Example 1 (below) illustrates the potential sensitivity of the choice of literal bound when the set of support strategy is abandoned. Example 2b gives the corresponding illustration for the choice of level bound. Although use of the suggested set of support may raise the level bound re quired to obtain a proof of a given theorem, the efficiency of the strategy more than compensates for this. In a number of examples there is a marked improve ment both in the total number of clauses generated and in the number of clauses retained in memory at the time proof is obtained. (Deletions due to subsidiary strategies account for the difference between the number of clauses generated and retained.) The large number of clauses generated in the absence of the set of support strategy indicates the potential combinatoric explosion, which is sharply retarded in its presence. There appear to be theorems for which a 5 In addition to the set of support strategy, PG1 employs certain search strategies, notably the unit preference strategy [1].
Set of Support Strategy in Theorem Proving Table 1: DATA
35 PG1
ON FOUR EXAMPLES RUN WITH
(When the value j appears in the column headed "Level-Proof," use of j as level bound is sufficient to obtain a proof.) Literal
Level Example
Set of Support
K2UK3 K2UK3
s s sK3
2a 2a 2a 2a 2b 2b 2b 2b 3 3 4 4
K3 K3 K3 S S K3 K3 S S K3 S K3 S
Length
Clauses
Bound
Proof
Bound
Proof
Generated
Retained
4 4 4 4 4 4 6 5 7 3 5 6 9 3 6 11 5 5 5
4 4 4 4
6 None 5 8 None 6 6 10 10 10 10 10 10 10 10 7 7 7 7
6 6 5 5
1130 1471 1908 14664 6299 188635 4100 135 302 303 9803 465 1772 337 44529 1299 40094 6462 66256
198 514 235 1443 1999 1894 712 72 142 145 1042 214 706 156 1999 371 1329 1035 1999
— — 6 5 5 3 5 6 9 3
—
11 5 5
—
— —
6 4 4 6 10 5 7 6
— 6 6 7
—
Time
(sec)
5.18 37.5 6.26 411 919 1183 30.9 .494 1.78 1.91 191 3.17 29.9 2.11 655 7.36 188 49.0 444
— indicates no proof was obtained.
proof with PG1 is unattainable without the use of this strategy. In particular, Example 4 appears to be such a theorem (see also Table 1). Example 1. In a group, if x1 = e for every x, the group is commutative. Example 2. In a group, the axioms of right identity and right inverse are dependent on the remaining. Example 2a refers to the right identity problem and 2b to the right inverse problem. Example 3. In a ring, x • 0 = 0 for every x. Example 4- In a ring, —x • —y = x ■ y for every x and y.
6.
Summary
The set of support strategy with a set of support dictated by the complete ness theorem is complete in the logical sense. Its use as dictated by Corollary 2 has both logical and mathematical significance. Logically speaking, the strategy takes advantage of the known satisfiability of the basic axioms of the mathemat ical theory under study. The mathematical significance comes from immediately focussing attention on the so-called special hypotheses of the theorem and the denial of the conclusion of the theorem. Use of the set of support strategy en ables the program PG1 to avoid generating many of the lemmas not germane
Collected Works of Larry Wos
36
to the theorem being attempted; consequently, proofs of a number of theorems of some mathematical depth have been easily obtained. RECEIVED MARCH, 1965; REVISED APRIL 1965
REFERENCES 1. Wos, L., CARSON, D., AND ROBINSON, G. The unit preference strategy in theorem proving. AFIPS Conference Proceedings 26, Spartan Books, Washington, D.C., 1964, pp. 615-621. 2.
ROBINSON, G. A., Wos, L. T., AND CARSON, D. F. Some theorem-proving strategies and their implementation. AMD Tech. Memo. No. 72, Argonne Nat. Laboratory, 1964.
3.
ROBINSON,
J. A. A machine-oriented logic based on the resolution princi ple. J. ACM 12 (Jan., 1965), 23-41.
AUTOMATIC GENERATION OF PROOFS IN THE LANGUAGE OF MATHEMATICS* LAWRENCE W O S , GEORGE A. ROBINSON, AND DANIEL F. CARSON
Argonne National Laboratory Argonne, Illinois
One of the long-term goals for a theorem-proving program is its use as a research tool by the mathematician for the generation of proofs. A desirable feature of such a program would be the generation of each such proof in the language of mathematics corresponding to the field under study. For example, it would be appropriate to have the proof of a theorem of group theory given in group-theoretic terms rather than, say, in the first-order predicate calculus. The theorem-proving program QG1, implemented for the Control Data 3600, in contrast to other such programs has this feature. The program consists of first seeking a proof for the purported theorem but in the language of first-order predicate calculus,1 and then, if one is found, translating it into the appropriate mathematical language.
Translation Algorithm The following algorithm operates on proofs obtained in the first-order predicate calculus, the two rules of inference being resolution and factoring. 1-4 The algo rithm as stated is a partial solution to the translation problem since it is only applied to proofs from the unit section1 of the program. Its extension to proofs from the nonunit section has not yet been programmed. 1. Assign translations to the various predicate and function letters occurring in the problem. 2. Translate the positive units of input as assertions using the equivalent mathematical formulations provided by (1). Translate the negative units "Work performed under the auspices of the U.S. Atomic Energy Comission. Reprinted with permission from the Proceedings IFIP Congress 65, New York, Vol. 2, Macmillan &; Co., New York, pp. 325-326 (May 1965).
Collected Works of Larry Wos
38
as denials of their corresponding mathematical statements. 3. For nonunit input clause, where possible replace the arguments of the lit erals by equivalent expansions determined by the negative literals, and delete the corresponding negative literals. If the result is a unit, treat as in (2). If not a unit, and if all the literals have the same sign, trans late the clause as a disjunction of the translations of its literals. If not a unit, and if there are both positive and negative literals, translate the clause as a conditional whose antecedent is the conjunction of the trans lations of the negative literals but treated as if they were positive units and whose consequent is the disjunction of the translations of the posi tive literals. (The translations are obtained by applying 2 to each literal separately.) 4. Search the generated clauses until a unit is found, then trace it back to its nonunit parent in the input. 5. Solve for the set of elements to which the corresponding mathematical law was applied. This is accomplished by following the successive substitutions made for the variables in going from parent to unit by resolution. The cor responding particularization of the mathematical law yields the next line of the proof. 6. Solve similarly for the application of each unit occurring in progressing from the nonunit to the unit under study from (4). 7. Starting with the particularization obtained in (5), find the sequence of mathematical steps leading to the unit of (4) by successively applying the particularizations obtained from (6) (not necessarily in the order applied by QG1 in obtaining that unit). As each step is found the corresponding particularization from (6) is cited as the justification. 8. Apply 4-7 until contradiction is obtained. Do not print trivial identities such as ab = ab. The list of letters of the alphabet which may occur as arguments to be read as general elements (implicit universal quantification), and the list of those which are to be read as specific elements (constants) are determined by the first-order predicate representation of the problem. [Note that (3) leads to an oversimplification. In particular, the associative laws become x(yz) = (xy)z and (xy)z = x(yz). This problem stems from the fact that the conjunctive normal form forces associativity, for example, to be come two separate clauses (3 and 4 in example 1), and from the fact that both statements are not applicable simultaneously. Application of a generalization of
Automatic Generation of Proofs
39
(3) could lead to difficulty when applied to nonunits generated by the program. Such clauses are used only to find the particularizations of 5 and 6.]
The Set of Support Strategy Let K\ be a set of clauses1'3 in the first-order predicate calculus which corre spond to a characterization of the basic axioms of some field of mathematics. Consider the purported theorem of the form: if L then M, where the theorem is in the field under study and is representable in first-order predicate calculus. Let Ki be a set of clauses corresponding to L, and Kz a set corresponding to the denial of M. Let S be the join of K\, K2, and K3. If everything is in order, K\ U Ki will be consistent, but S will be inconsistent. In order to sharply retard the combinatoric explosion resulting from appli cation of the inference rules to such an S, the set of support strategy was formu lated. Informally speaking, the strategy consists of choosing a subset Tof S and allowing any element of S or any generated element to be factored and allowing any pair of elements to be resolved unless both are in 5 — T. T is generally chosen to be K3 or Ki U K$, and thus, because of the constraint placed on resolving, many trivial lemmas of the theory and many lemmas not germane to the theorem under consideration are avoided. The logical significance of the strategy lies in the utilization of the consis tency of K\ and K\ U ^ - This appears to be the first strategy in theorem proving which attempts to utilize such information. The formal development of the concept of set of support and the corresponding strategy can be found in Ref. 4.
REFERENCES 1. L. Wos, D. Carson, and G. Robinson, "The Unit Preference Strategy in Theorem Proving," AFIPS Conference Proceedings, Vol. 26 (1964), pp. 615621. 2. G. A. Robinson, L. T. Wos, and D. F. Carson, "Some Theorem-Proving Strategies and Their Implementation," AMD Technical Memorandum No. 72, Argonne National Laboratory (1964). 3. J. A. Robinson, "A Machine-Oriented Logic Based on the Resolution Prin ciple," J. ACM 12 (January 1965), pp. 23-41. 4. L. Wos, G. A. Robinson, and D. F. Carson, "The Efficiency and Complete ness of the Set of Support Strategy in Theorem Proving." (To be published in J. ACM.)
The Concept of Demodulation in Theorem Proving LAWRENCE WOS Argonne National Laboratory, Argonne, Illinois G E O R G E A. ROBINSON The University of Wisconsin, Madison, Wisconsin and Argonne National Laboratory, Argonne, Illinois DANIEL F. CARSON Stanford Linear Accelerator Center, Stanford,
California
AND LEON SHALLA Argonne National Laboratory, Argonne, Illinois ABSTRACT. In many fields of mathematics the richness of the underlying ax iom set leads to the establishment of a number of very general equalities. For example, it is easy to prove that in groups ( a ; - 1 ) - 1 = x and that in rings -x ■ -y = x • y. In the presence of such an equality, each new inference made during a proof search by a theorem-proving program may immediately yield a set of very closely related inferences. If, for example, b ■ a = c is inferred in the presence of ( x - 1 ) - 1 = x, substitution immediately yields obviously related inferences such as ( f t - 1 ) - 1 • a = c. Retention of many members of each such set of inferences has seriously impeded the effectiveness of automatic theorem proving. Similar to the gain made by discarding instances of inferences already present is that made by discarding instances of repeated application of a given equality. The latter is achieved by use of demodulation. Its definition, evidence of its value, and a related rule of inference are given. In addition a number of concepts are defined the implementation of which reduces both the number and sensitivity to choice of parameters governing the theorem-proving procedures.
This work was performed partially under the auspices of the US Atomic Energy Commission. Reprinted with permission from the Journal of the Association for Computing Machinery, Vol. 14, no. 4, pp. 698-709 (October 1967).
Concept of Demodulation in Theorem Proving
1
41
Introduction
The field of automatic theorem proving is fraught with a number of somewhat obvious, but nevertheless difficult, problems. Among such problems are: (1) the generation of a large number of irrelevant, although perhaps interest ing, inferences; (2) the generation of a discouragingly large number of apparently relevant but redundant inferences; (3) the need for determination of a direction in which to proceed—one in which the expectation is high of finding a proof within reasonable time and memory requirements; (4) the reduction both of number (ideally to zero) and sensitivity to choice of parameters governing the theorem-proving procedure; (5) the retention of inferences germane but dispensable to the theorem under consideration. The seriousness of items (l)-(4) was materially decreased with the set of sup port strategy [10]. In this paper we concentrate on the fourth and fifth problems and, to a lesser extent, on the second. First discussed is the concept of demodulation, whose implementation ma terially reduces the number of retained clauses, and a corresponding extension of resolution [4, 10], called fc-modulation, as a rule of inference. Demodulation and ^-modulation are closely connected to the problem of "building in" equality into theorem-proving programs. Discussed next is the concept of degree and a program now being developed employing degree in place of level [10]. This program, PG5, is free of the pa rameter of degree bound (and of level bound) and is therefore more nearly a completely automatic procedure. In the last part of the paper we deal with extending set of support strategies and the corresponding effect on the ease of obtaining proofs.
2
General Discussion
In general, regardless of the rules of inference, the number of inferences con tained in a proof obtained by a theorem-proving program is a small fraction of the number made during the search for that proof; it is a still smaller fraction of the number of attempted applications of the inference rules. Thus, the effective ness of such programs would be sharply increased by a corresponding reduction either of the number of successful applications of the inference rules or of the total number of attempts including unsuccessful ones. Strategies which restrict inference are therefore of interest and of potentially great value, depending on the accompanying side effects.
42
Collected Works of Larry Wos
The theorem-proving programs referred to in this paper all employ the lan guage of first-order predicate calculus, and all require that the set of logical statements corresponding to the theorem under consideration be in conjunctive normal form. Each such set of statements can be divided into three subsets: K\ corresponding to the basic axioms of the theory from which the theorem is taken, Ki to the special hypothesis of the theorem, and K3 to the denial of the conclusion of the theorem. Because of the richness of most mathematical theories it is possible from the basic axioms alone to make a number of inferences, many of which are, for a given theorem, irrelevant to finding a proof for that theorem. These ir relevant inferences or lemmas are not in themselves always prohibitive but, when allowed to interact freely with the special hypothesis set and the denial of conclusion set for any theorem, result in the generation of a large number of apparently relevant but actually redundant inferences. Redundant inferences include those which are either alphabetic variants or instances of those already obtained. Such inferences are apparently relevant since they depend in part on the theorem under consideration. To curtail the generation of both irrelevant and relevant but redundant in ferences, the set of support strategy [10] was formulated. Briefly speaking, the set of support strategy consists of forbidding application of the rule of infer ence to a pair of clauses both of which are axioms. (Although this definition is slightly more restrictive than that given in [10], completeness is not lost [7].) An intuitive justification of the strategy is that, if an inference is made from axioms alone, it applies to the entire theory and is not necessarily helpful in establishing the validity of a specified theorem. It is perhaps surprising that the strategy was proven to be complete [10], surprising in that, not only are infer ences from axiom pairs forbidden, but such inferences are in turn not available to interact with those which are made. (It is not to be concluded that lemmas applying to the theory as a whole should always be excluded from the proof search. For example, ( a ; - 1 ) - 1 = x appears to be one lemma which should al ways be included in seeking proof for a purported theorem of group theory. It is probably profitable to include as lemmas for ring theory problems x ■ 0 = 0 and —x • —y = x ■ y. Such lemmas should not be in the set of support.) Strategies, such as the set of support strategy and hyperresolution [5], which restrict application of the rules of inference have, among others, two side effects worth noting. Employment of such a strategy, first, usually raises the level or corresponding measure of difficulty of proof, and second, can transform the search from one yielding a unit proof into one yielding only a nonunit proof. (A unit proof is one in which every pair of clauses to which a rule of inference is applied contains at least one unit clause [9].) One or both of these side effects may more than offset the gain from curtailing inference locally.
Concept of Demodulation in Theorem Proving
3
43
Demodulation and k-Modulation
Mathematical proofs often contain steps such as, "substitute e ■ x for x where e is the group identity," or, "replace x by ( x - 1 ) - 1 . " Retention by a theoremproving program of inferences stemming from these and similar substitutions can soon produce a long list of inferences even after the obvious pruning for instances of inferences already retained. The length of the inference list has a corresponding exponential effect on the number of resolutions (or applications of the corresponding inference rules) which must be attempted to obtain a proof. One method of sharply reducing the length of this list is by applying to each clause a transformation which replaces a by (3, where /? is in some sense simpler than a and it is known that /? = a; the method then calls for the transformed clause to be discarded if it is an instance of a clause already present. With this in mind the concept of demodulation was formulated. For the remainder of the paper let R be the predicate letter used for equality regardless of the field of mathematics under discussion. A set of group theory axioms [9]l can be formulated in terms of the predicate Pxyz for x • y = z, the function f(xy) for x • y, and the function g(x) for x _ 1 . The following can easily be proven from that set of axioms by resolution: Rf(ex)x, Rf(xe)x, Rf(g(x)x)e, Rf(xg(x))e, Reg(e), and Rg(g(x))x. Such clauses are called equal ity units. Definition. Let I f b e a finite set of equality units. The clause C is an im mediate modulant relative to W of the clause A if and only if either C is an alphabetic variant of A or can be obtained from A by replacing a single oc currence of the term a in A by the term /3, where Ra0 is an instance of some element Ra'0' in W such that Ra'fi' has no instance Ra-y strictly more general than Raf3. Definition. The clause C is called a k-modulant relative to W of the clause A if and only if there exist clauses Ao, . ■., Ak such that A = Ao, C = Ak, and Ai+\ for 0 < i < k is an immediate modulant relative to W of Ai. C is a modulant relative to W of A if and only if it is a fc-modulant for some k. Immediate modulants are, therefore, fc-modulants with k = 1. The set of modulants (without counting alphabetic variants) of a given clause A is in gen eral infinite since W often contains such elements as Rg(g(x))x. For fixed k, however, since the maximum generality restriction guarantees finiteness of the set of immediate modulants, the set of fc-modulants of A (not counting alpha betic variants) is always finite since W is finite. Now let W be the set of equality units available to the theorem prover at a given time. Let A be the next clause which is generated. Definition. Demodulation consists of replacing A by a modulant C of A relative to W. C is determined by generating a sequence Ao,.. .,Ak such that A = AQ, C — Ak, Ai+i is an immediate modulant of Ai relative to W for 0 < i < 'For the examples given later, the presence of right and left cancellation laws is assumed.
44
Collected Works of Larry Wos
k, Ai+i has strictly fewer symbols than Ai, and Ak has no immediate modulant relative to W with fewer symbols. Intuitively, the motivation is retention of the mathematical information con tained in A in as simple and useful a form as possible. As an example of demodulation, let W be the set of six equality units given above. Let Pf(ef(eg(g(a))))bc be the next generated unit. Pabc would replace Pf(ef(eg{g(a))))bc by demodulation. Using Rf(ex)x and Rg(g(x))x, an admis sible sequence is: Pf(ef(eg(g(a))))bc, Pf(eg(g(a)))bc, Pg(g(a))bc, Pabc. In the presence of W and the substitution axiom on the first argument of P, Pabc is deducible (in six steps by resolution, for example) from Pf(ef(eg(g(a))))bc, and conversely. Demodulation can yield more powerful inferences at an earlier stage of the procedure and with fewer clauses in memory. Some results are given later to illustrate the effect on clause retention, clause generation, and time required to obtain proof. Thus, upon generation of each clause, demodulation replaces it if possible by an appropriate member of the corresponding (usually infinite) class of modulants. That demodulation is not a canonical reduction procedure is obvious from the following example: Let W = {Rf(ab)d,Rf(bc)k, Rf(xf(yz))f(f(xy)z)}. Then, although Qf(f(ab)c) and Qf(af(bc)) are modulants, they do not demod ulate to the same clause. The former demodulates only to Qf(dc) and the latter only to Qf(ak). The lack of a canonical reduction procedure is not due to the particular formulation of demodulation; for the unsolvability of the word prob lem for semi-groups (the Post-Markov theorem-see, e.g., [1]) in itself precludes the existence of any such canonical reduction procedure. The set of support strategy tends to restrict inferences to those germane to the theorem under consideration. Since in many fields (rings and groups, for example) it is easy to generate many elements of the same modulant class relative to a given W, coupling of set of support and demodulation sharply reduces the number of retained clauses germane but dispensable; consequently, demodulation generally reduces the total number of resolutions and the time needed to obtain proof. As a secondary effect, demodulation further reduces the sensitivity to choice of parameters governing the theorem-proving proce dures. Unlimited application of demodulation, as with arbitrary choice of set of support [10], can play havoc with completeness. As a result one might wish to seek sufficient conditions for its use or seek an extension of the rules of inference. Thus we have the advent of the rule(s) of inference k-modulation. Definition, k-modidation: Infer from clauses A and B the clause C, where C is any resolvent of A^ and B^ with A^ a fc-modulant of A and B^ a fc-modulant of B. With k = 0, fc-modulation is resolution. For each pair of clauses A and B and for fixed k, the number of essentially different clauses C inferable by fc-modulation is finite. As a result, the incompleteness connected with demod ulation can be remedied in a number of ways, none of which has yet been pro-
Concept of Demodulation in Theorem Proving
45
grammed. Some real progress has been made, however, with the incorporation of a limited form of /c-modulation.
4
Singly Connectedness
It is obviously potentially undesirable to generate the same clause more than once in the course of the search for a proof. For example, given the clauses (1) Qxy Py Rxy, (2) Qaz, (3) Pb, one might first resolve (2) against (1), obtaining (4) Pz Raz and then (3) against (4), obtaining (5) Rab. Alternatively, one could first resolve (3) against (1), obtaining (6) Qxb Rxb and then (2) against (6), again obtaining (5). Let us identify the literal Qxb in (6) with its "ancestor" Qxy in (1), and likewise Pz in (4) with Py in (1). It is then recognized that in either case (2) is resolved against the first literal (or its direct descendant) in (1), and (3) is resolved against the second literal (or its direct descendant) in (1). In this sense, only the order in which the resolutions were performed is different. In both deductions (5) was generated after a series of resolutions each of which involved some literal (or direct descendant thereof) of the focal clause (1). Now let {Ai} be some given set of clauses and let D be any given clause upon which we wish to focus attention such that Do = D and Di (i = 1 , . . . , k) is the resolvent of Ai and £>i_i. Furthermore, assume that each of the resolutions involves a specified literal (or direct descendant thereof) of the focus of attention, D. In such a case D/t is said to be obtained from [A\,..., A^; D].2 Thus, for the given example, (5) is obtained from [(2), (3); (1)] in two ways. If C is obtained from [A\,..., Ak\ D], there are ordinarily k\ ways to so ob tain C. A procedure based on resolution is called singly connected if and only if, given [y4i,..., Ak\ D] and a correspondence associating a literal of each Ai with a literal of D, any clause C is so obtained at most once. (A procedure which also satisfies set of support criteria may not even obtain such a clause once.) 2
The concept of clash (6) is related and similarly motivated.
Collected WorJcs of Larry Wos
46
In the given example, singly connectedness would not exclude the generation of (4) and (6), but it would allow only at most one of the resolutions, that of (3) and (4) or that of (2) and (6). Some idea of the gain in efficiency can be grasped by considering [i4i,..., A^\ JD], where the Ai are units, where D is a 5-clause, and where C is obtained from [A\,... ,An; D). Not only are there 24 ways to obtain C, at least 23 of which are excluded by having the procedure singly connected, but there are 6 excluded ways to obtain clauses with three literals and 20 excluded ways to obtain clauses with two literals due to singly connectedness. (There exist clauses E, A, and B where E has four literals and A and B are units such that E', the resolvent of E and A, has but two literals, and such that E' and B resolve to yield the unit C. Note that if the order of resolutions in deducing C is changed so that E and B are first resolved, it will in general be necessary to resolve with B again on the way to deducing C. In this given case B implicitly resolves on the common descendant of two of the literals of E, and by convention C is said to be obtained from [A, B, B; E\.)
5
Degree
The level of a clause strongly reflects the number of resolutions employed in deriving it. If axioms L and V are represented respectively by the clauses D and D'', where D has more literals than D', units derived from D will in general have higher level (and hence, in a saturation scheme, will be deferred until later in the search) than units derived from D'. It was conjectured that the unfavorable treatment thus accorded descendants of axioms with more literals might adversely affect proof search efficiency. To avoid this, i.e., to treat the axioms more uniformly, the concept of degree was formulated. Empirical results, indicating markedly greater proof search efficiency, obtained from subsequent experience with theorem-proving programs appear to justify the preference for degree over level. Definition. Let S' be a given finite set of clauses and S C 5 ' be the set of unit clauses. Let 5° = 5. For i > 0 let S*"1"1 = S* U Ei, where Ei is the set of all units C such that there exists a clause D in S' — S and a set of units Ai,..., Ak in 5* with C obtainable from \A\,.. .,Ak\D\. The degree of the unit C is the smallest n such that C 6 5™. Thus, if C is obtained from [Ai,..., Ak; D] and the respective degrees of A\,..., Ak are n i , . . . , n^, the degree of C is less than or equal to 1 plus the maximum of nj. For all i, S* is finite. Definition. Let S' be a given finite set of clauses and let T Q S' be a set of support. Let S be the set of units of S' and let T? = TCiS. For i > 0 let ^»' +1 = ^7 u El, where Ei is the set of all units C such that there exist units A\,.. .,Ak and a clause D all in S'UT} with C obtainable from [A\,.. -,Ak\ D], and with D in T or at least one of the Aj in T j . The T-degree of C is the smallest
Concept of Demodulation in Theorem Proving
47
n such that C € TJV When T = S', T-degree becomes degree. Definition. Let S be a given finite set of clauses. Let S° be the set of all clauses C such that C is in S or there exists a clause B in S with C a factor of B. For i > 0 let 5* + 1 = S* U £*, where Ei is the set of all clauses C such that there exists a clause D in S* and a set of clauses A\,..., Ak in S* with C obtainable from \A\,.. .,Ak\D] or with C a factor of a clause obtainable from [A\,... ,Ak\ D]. The generalized degree of C is the smallest n such that C is in S". The generalized T-degree is then defined in a similar fashion. Note that gen eralized degree is not an extension of degree. Although the generalized degree of a clause is always less than or equal to its degree, it is not always equal. If {Si, 52,...} is a nested sequence of sets (i.e., if i < j then Si C Sj), a search strategy which examines all of Si before examining any of 5 , - Si for j > i can be termed a saturation strategy. If, for example, Si is taken to be the set of all clauses with degree less than or equal to i, then such a strategy is termed a degree saturation strategy. Similarly, within the unit section (the section in which resolving of two nonunit clauses is not permitted) of resolution based theorem-proving programs, degree saturation (or T-degree saturation) appears to be more efficient than level saturation (or T-level saturation). To carry the comparison into the nonunit section would involve a comparison of generalized (T-) degree saturation with (T-) level saturation. Although there seems to be no a priori reason to suppose that the results of such a comparison would differ from the results just mentioned for the unit section (and described in more detail in Sections 7 through 9), experience with unit preference strategy [9] versus nonunit saturation strategies suggests that nonunit generalized Tdegree saturation is not a potentially promising alternative. Consequently, the combination of T-degree saturation and unit preference rather than generalized T-degree saturation was selected for implementation.
6
Extended Set of Support Strategies
In [10] two choices were recommended as natural of set of support T.K3 (the denial of the conclusion of the theorem) and Ki U K${K2 being the special hy pothesis). Meltzer [3] gives a method based on renaming for choosing a smallest (in the sense of number of clauses) set of support. It appears that either such a minimal or the maximal (all clauses) set as choice for set of support T is not in general the most efficient. The latter produces too many irrelevant inferences [10], and the former is too subject to the side effect of level-raising (or degreeraising). More important, the former often forces proof out of the unit section [9]. If given a finite unsatisfiable set S of clauses with no clue as to the accompa nying semantics, T can be chosen as the set of all clauses A such that A has no positive literals (or as the set of all clauses A having no negative literals), and
Collected Works of Larry Wos
48
the completeness theorem applies since S — T is obviously satisfiable. In such an event it would be impossible to identify Ki or K3, and Meltzer's approach might have much merit. But when Ki and Kz can be identified, the previously recommended semantic approach seems better. There is, however, in all cases an extension of the set of support strategy which appears worthwhile. Let the set of support T be any set with S — T both satisfiable and nonempty. Although completeness has not been lost, there may be clauses A which are deducible from S but not with T-support and are yet most useful. In group theory ( x - 1 ) - 1 = x and the cancellation laws are examples. For many choices of T it is easy to find such clauses A which are in fact deducible from S — T alone. If A is deducible from S — T, the adjunction of A to S — T yields a still satisfiable set. A variety of extended set of support strategies may be obtained in the fol lowing manner. First, choose within the given S two subsets, T\ and T2, such that S — Ti is satisfiable and T\ is contained in S — T2. Second, from the set Z = (S — T2) U {A\,..., Ak), where the Ai are deduced from S - T
7
Implementation
In order to study the importance to automatic theorem proving of the con cepts discussed in the preceding sections, four programs are written and are currently running on the Control Data 3600. (See Table 1.) The first of these programs, PG2, implements demodulation and a limited form of ^-modulation (limited principally in that functions are not substituted for functions), fcmodulation is called only when resolution is blocked. Demodulation is free of constraints. PG3 differs from PG2 by being singly connected and contains no nonunit section. PG4 is PG3 without demodulation or fc-modulation (except of course for A; = 0, which is simply resolution). PG5 (also singly connected) is an implementation of the concept of degree and a fc-modulation rule which is more constrained than that in PG3. When resolution is blocked fc-modulation is called if and only if demodulation has been applied to one of the ancestors of one of the symbols preventing resolution. Only that equality unit which was last used in the demodulation is considered for fcmodulation.
T a b l e 1 DATA COMPARISONS
Example
1
Program
Set of Support
Level Degree Bound
Literal Bound
Generated
Retained
Ttme to Obtain Proof (seconds)
PG4
K2 U Kz
4 4 8 11 4
10 15 8 11 50
737 757 4358 2721 757
362 382 543 543 382
18.8 19.7 >110.0 >110.0 19.7
PG3
Extended
6 6 10 13 6
10 15 8 11 50
470 611 316 261 611
126 172 87 100 172
13.2 20.0 9.9 9.2 20.0
PG5
Ki U K3
None
8 10 11 15 50
1056 1518 1518 1518 1518
77 88 88
8.1 12.8 12.8 12.8 12.8
PG5
Extended
None
8 10 11 15 50
235 257 257 265 265
111 126 126 132 132
7.6 8.2 8.2 8.5 8.5
2a
PG5
Extended
None
50
57
47
1.5
2b
PG5
Extended
None
50
182
39
2.0
7050
360
>104.0
907
67
6.4
37032
1248
>580.0
89 397
Ki U K3
None
56 126 586 40 340
Extended
None
7 10 7 10 15 7 10 15 7 10 15
PG4
S K2 U K3
PG3
PG5
PG5
PG4
Extended
2253
549
5.5 14.7 107.4
4.3
1271
46.3 >287.0
1628
59 99 482
18.5 73.5
2602 4884
119 348
7.5
S
5
7
25603
1270
>579.0
K2uK3
7 10 7 10 50 50 7 10 50
1596 4104
349 1548
54.4 >529.0
7 10 50
PG3
Extended
5 5 5 5 2 5
PG5
K2 U K3
None
Extended
None
23.2 26.3 21.2 26.5
1425 1885
141 175 131 177 94 230 239
140 150 150
120 130 130
19.0 19.3 19.3
234 293 176 296 565
7.8 29.8 43.3
(continued)
Collected Works of Larry Wos
50 Table 1 (Continued)
Example
5
6a
6b
7
8
Program
Set oj Support
Level Degree Bound
Literal Bound
Clauses Generated Retained
Time to Obtain Proof (seconds)
PGl
All negative units
14
4
5564
1213
120.5
PG2
All negative units
14
4
1409
413
17.7
PG4
K2UrV3
3
6
23T
117
2.6
PG3
Extended
3
6
228
136
5.0
PG5
Extended
None
6
126
111
4.9
PG4
K2UK3
6
6
11418
1511
>586.0
PG3
Extended
4
6
1223
362
51.8
PG5
Extended
None
6
1018
272
27.5
PG4
K2UK3
6
6
8478
426
>284.0
PG3
Extended
6
6
8679
228
110.7
PG5
K2UK2
None
6
9223
174
82.6
PG5
Extended
None
6
3098
150
41.7
PG5
Extended
None
1*
19039
792
728.9
•Example 8 was run with literal bound replaced by function depth. NOTES TO TABLE 1. A time of >290.0 signifies that no proof was obtained in 290 seconds. The extended set of support strategy used was that given at the beginning of Section 8. S in the set of support column denotes that all clauses were given set of support. For example run with PG3-5 the number given for generated clauses includes only retained unit clauses and those which arc rejected because of being instances of retained unit clauses. For fixed example, program, and set of support, the level bound of the first case given is such that for smaller level bound no proof is known to exist (within the constraints corresponding to that study).
PG5 contains only a unit section. The strategy of search is essentially Tdegree saturation combined with unit preference [9]. The limitation to theorems with unit proofs when using PG3-5 is not as se vere as might first appear. Some interesting examples are given later of theorems provable in the unit section. Other examples exist which can be converted into theorems of this class. The technique is simple but promising, and it appears to be significant for theorems whose mathematical proof is one of case analysis. If in the representation of the theorem, Ki U K$ contains a nonunit clause free of variables with, say, k literals, DeMorgan's law is applied to produce k cases. Example 6 illustrates an interesting generalization of the technique: Adjoin cer tain variable-free tautologies involving constants occurring in K2UK3, where the predicate occurring therein is at most binary, and then apply DeMorgan's law. The restriction to binary predicates usually prevents the number of cases from becoming prohibitive. Because PG5 essentially saturates T-degree, only one parameter governs its use, that of literal bound (or its correspondent—function depth). The parameter
Concept of Demodulation
in Theorem
Proving
51
of function depth enables rejection of an inference if one of its literals contains an argument involving nesting of functions to a depth greater than specified or if one of its literals contains more functional arguments than specified. (Re placement of literal bound by function depth is an option for all four programs.) When demodulation and ^-modulation coupled with an extended set of sup port strategy are used, the equality units of Z — S are not used for resolution. Such units are only used for demodulation and fc-modulation and in testing for unit conflict. If an equality unit is generated with T^-support during the proof search, it is not so restricted. This fact coupled with the satisfiability of Z shows that completeness is not lost (see completeness theorem [10]). Before the proof search with T-j-support is begun, the clauses are transformed by use of demodulation to remove as many functions as possible. In Example 8 this transformation eliminates all occurrences of the function g (inverse).
8
Examples
The most promising approach appears to be use of the program PG5 with an extended set of support strategy consisting of letting T2 be the set of negative units of K3, letting 7\ be the set of units in S — T2, and adjoining all the generated unit clauses A{ of degree less than or equal to 1 having Ti-support. The combination of extended set of support and demodulation and ^-modulation appears to be much less sensitive to parameter choices than the use of Ki U A'3 as set of support without demodulation or ^-modulation. (Some additional results are given for comparing the approach of putting everything in the set of support, which amounts to ignoring set of support.) As can be seen from the data, a number of theorems were provable with the parameter of literal bound effectively eliminated by setting it to 50. Example 5 was proposed by Hao Wang [8] to test the power of theoremproving programs. When Example 6 was transformed by the technique of tautology adjunc tion, a unit proof was obtained where previously only nonunit proofs had been obtained. Example 8, taken from Boolean rings, is perhaps the most difficult theorem yet dispatched by a computer program. The theorem in its given form is sug gested as an excellent test case for theorem-proving programs. Example 1. In a group, if x 2 = e, the group is commutative. Example 2. Among the axioms for a group, those of right identity and right inverse are dependent. The correspondent of the right identity problem is 2a; that of right inverse is 2b. Example 3. In a ring, x ■ 0 = 0. Example 4. In a ring, where x -0 = 0 ■ x = 0 is given, —x-—y = x-y.
Collected Works of Larry Wos
52
Example 5. EXQl [8]. (No unit proof of the theorem is known.) Example 6. If a subgroup 0 has index less than or equal to 2, 0 is a normal subgroup. (The clause Oa V Oa is adjoined and DeMorgan's law is applied producing two subproblems, one involving the unit Oa and one involving the unit Oa.) The case where a is assumed to be an element of O is 6a, and the case where o is assumed not to be an element of O is 6b. Example 7. Boolean rings have characteristic 2. Example 8. Boolean rings where the characteristic is given equal to 2 are commutative.
9
Conclusions
Depending on the available memory, the growth of the list of clauses retained during proof search can be a serious problem. Even more serious is the corre sponding effect on the time required to complete the search successfully. Use of demodulation and the extended set of support strategies sharply retards this growth and, even though time is required to execute these strategies, produces a correspondingly advantageous effect on the time required to obtain proof. If in addition the procedure is singly connected and level is replaced by degree, the number of clauses generated during a successful proof search is substantially reduced. Incorporation of singly connectedness into the unit section appears to be an unmixed advantage. It achieves (or so empirical evidence suggests) considerable gain in efficiency in search for unit proofs with no loss of logical completeness of the total program (including the nonunit section). Unless an as yet unknown trick is forthcoming, an implementation of singly connectedness in the nonunit section appears to require sufficient additional bookkeeping that it would not add substantial gain in efficiency to that which has already been achieved in the unit section. Implementation of the various concepts discussed herein has markedly de creased the sensitivity of the theorem-proving procedures to parameter choices. Where previously proof was obtained only by judicious choice of parameter values, PG5 (governed by a single parameter of literal bound) has found proof for some of those same theorems with the parameter set effectively to infinity. REFERENCES
1. DAVIS, MARTIN. Computability and Unsolvability. McGraw-Hill, New York, 1958, pp. 95-98.
Concept of Demodulation in Theorem Proving
53
2. MELTZER, B. Theorem-proving for computers: some results on resolution and renaming. Computer J. 8 (1966), 341-343. 3.
AND POGGI, P. An improved complete strategy for theoremproving by resolution. (Unpublished.)
4. ROBINSON, J. A. A machine-oriented logic based on the resolution prin ciple. J. ACM 12, 1 (Jan. 1965), 23-41. 5.
Automatic deduction with hyper-resolution. Int. J. of Computer Math. 1 (1965), 227-234.
6.
A review of automatic theorem-proving. Proc. Symp. Appl. Math., Vol. 19. Amer. Math. Soc, Providence, R. I., 1967.
7. SLAGLE, JAMES. Automatic theorem proving with renamable and se mantic resolution. J. ACM 14, 4 (Oct. 1967), 687-697 (this issue). 8. WANG, H. Formalization and automatic theorem-proving. Proc. IFIP Congr. 65, Vol. 1, pp. 51-58 (Spartan Books, Washington, D. C ) . 9. W o s , L., CARSON, D., AND ROBINSON, G. The unit preference strategy in theorem proving. Proc. AFIPS 1964 Fall Joint Comput. Conf., Vol. 26, Pt. II, pp. 615-621 (Spartan Books, Washington, D. C ) . 10.
, ROBINSON, G. A., AND .CARSON, D. F .
Efficiency and com
pleteness of the set of support strategy in theorem proving. J. A CM. 12, 4 (Oct. 1965), 536-541. 11.
, , AND Automatic generation of proofs in the lan guage of mathematics. Proc. IFIP Congr. 65, Vol. 2, pp. 325-326 (Spartan Books, Washington, D. C ) .
Paramodulation and Set of Support* Lawrence Wos • George Robinson
INTRODUCTION The applications of the set-of-support strategy in fields in which automatic the orem proving plays an important role continue to increase. Question-answering systems such as that of Green [3] and information-retrieval systems such as that of Darlington [2] rely heavily on automatic theorem proving. Since one of the principal problems in theorem proving is generation of a very large num ber of "irrelevant" inferences, this problem is important for any system based on a theorem-proving subprogram. The set-of-support strategy was formulated to impede the generation of irrelevant inferences and thus restrict the number of inferences to be examined during the search for a refutation. It is desirable however for the restricted system to retain refutation completeness. Two inference systems will be considered in this paper: the system II em ploying the inference rules paramodulation, resolution, and factoring, and the system E employing only resolution and factoring. The system n is applicable to first-order theories with equality, while E is efficiently applied only to or dinary first-order theories. FIT and ET are identical to II and £ respectively, except that only T-supported inferences are allowed. The system ET (E with T as set of support) has been shown to be refutation complete when S is finite and S — T is satisfiable. (The finiteness consideration for S is not necessary for refutation-completeness, but is necessary to show that a certain procedure is a refutation procedure.) A number of papers have been published modifying the original resolution principle. Such modifications include hyper-resolution [8], semantic resolution [9], and resolution with merging [1]. Due no doubt in part to the success with which the set-of-support strategy has met, a common point of interest has been the question of refutation completeness of the system combining set of support with the particular modification of resolution then under consideration. For such systems the conclusion usually is, briefly speaking, that set of support is com plete. More formally, for such modified systems f2, fiT is frequently refutation complete. Reprinted with permission from the IRIA Symposium on Automatic Demonstration at Versailles, France, Dec. 16-21, 1968, in Lecture Notes m Mathematics, Springer-Verlag, pp. 276-310. "Work performed under the auspices of the U.S. Atomic Energy Commission.
Paramodulation
and Set of Support
55
In this paper the definition of set of support is extended to inference systems based on paramodulation, thus extending the scope of automatic theorem-proving from ordinary first-order theories to first-order theories with equality, the former being the subject of earlier theorem-proving papers. The question which naturally comes to mind is answered in the main result of the paper: set of support is refutation complete for functionally reflexive first-order theories with equality.
DEFINITIONS AND NOTATION In this paper A, B, C, D, E, and F will be clauses; R will be the equality predicate; S, T, and U will be (not necessarily finite) sets of (not necessarily ground) clauses; f will be a function symbol; k, 1, and m will be literals; s, t, and u will be terms; x j , X 2 , . . . will be individual variables;
56
Collected Works of Larry Wos
Definition ( R e s o l u t i o n ) : If A and B are clauses (with no variables in common) with literals k and 1 respectively such that k and 1 are opposite in sign (i.e., exactly one of them is an atom) but | k | and ) 11 have a most general common instance m, and if a and T are most general substitutions with m = | k \a = 11 |r, then infer from (any variants A* and B* of) A and B the clause C = (A — {k})<7 U (B - {\})T. C is called a resolvent of A and B and is inferred by resolution [4] [7]. Definition (Factoring): If A is a clause with literals k and 1 such that k and 1 have a most general common instance m, and if a is a most general substitution with ka = \a = m, then infer the clause A' = (A — {k})<7 from A. A' is called an immediate factor of A. T h e factors of A are given by: A is a factor of A, and an immediate factor of a factor of A is a factor of A. As with paramodulation, resolution yields a number of possible inferences from a given pair A and B of clauses. S7£T will be {C | C is a resolvent of A G S and B e T } , etc. ^"S will be {C | C is a factor of A € S}, etc. Definition: If R is the equality predicate, a set S of clauses is functionally reflexive if Rxx 0 S and if, for each n-ary function f occurring in S, R f ( x i , . . . , x n ) f ( x i , . . . , x n ) C- S. The theories of interest are the functionally reflexive first-order theories with equality. The scope of interest would be all first-order theories with equality if it were not for the fact that refutation completeness for II without functional reflexivity is an open question. If and when the corresponding theorem is proved, it would be desirable to extend the results which follow to all first-order theories with equality. Since the inference systems which play the main role throughout are II (the inference system consisting of paramodulation, resolution, and factoring) and IIT (identical to IT except that only clauses with T as set of support are allowed), it becomes necessary to extend the definition of set of support [10] to include inferences made through paramodulation. Definition: Given a set S with subset T, a clause C has T-support (with respect to S) if C € T, or if C is a factor of a clause with T-support, or if C is a paramodulant or resolvent of clauses A and B where B has T-support and either A has T-support or is a factor of a clause in S — T. T is called a set of support for C. The definition could be further extended to any inference system il by re placing paramodulation, resolution, and factoring by "some rule of fi". T h a t the definition of set of support given above is no more than an extension of the definition given in [10] can be seen by examining the alternate definition for "C having T-support" given below. In the definition below, Tg is extended from that given in [10]. Definition: S° is the set of clauses B such that B is in S or there is a clause C in S with B a factor of C. For i > 0, S1 is the set of clauses A such that A € S 1 _ 1 , or there exist clauses C G S 1 _ 1 , and D € S 1 _ 1 such that A is a
Paramodu/afcion and Set of Support
57
paramodulant or a resolvent of C and D or A is a factor of a pararnodulant or resolvent of C and D. Definition: For T C S, T | is the set of clauses A such that A € T or such that A is a factor of some clause B with B € T. For i > 0, T' s is the set of clauses A such that A e Tg - 1 , or there exist clauses C e T ^ " 1 and D £ S° U T s _ 1 such that A is a paramodulant or a resolvent of C and D or A is a factor of a paramodulant or a resolvent of C and D. Since the factors of a clause A include A itself as a trivial factor, S° consists of the factors of the clauses of S. When S contains only ground clauses, it is obvious that S° = S. Normally, however, S contains nonground clauses, and in many such cases S° - S is not empty. (From the fact that A is a factor of itself it follows that some of the definitions given above can be appropriately shortened.) Definition: The S-level of a clause A (relative to il) is the smallest i such that A 6 S \ The Ts-levell of A is the smallest i with A € T s . Since, for all clauses A, A is a factor of itself, Tg for i > 0 can be obtained from T s _ 1 by adjoining to T s - 1 all clauses E which are factors of some clause D where D is in turn inferrable by paramodulation or resolution from some pair B and F with B in T s _ 1 and F in the S° U T s _ 1 . D e f i n i t i o n : Given a set S of clauses, a subset T of S, and a clause A deducible from S, A is said to have T-support if, for some i > 0, A € T s . T is said to be a set of support for A, and A is said to be supported by T. Definition: A T-supported deduction Di, D 2 , . . . , D n (relative to S and ft) is a deduction in ft in which every D; has T-support in ft or is a factor of a clause in S - T. If such a deduction exists we write S h- frrD n Definition: A set S of clauses is R-satisfiable if it has an R-model, i.e., a model in which the predicate R is mapped to an equality relation. Definition: A refutation of S is a deduction from S of the empty clause, □. Definition: An inference system ft (or ftT) is R-refutation complete if for R-unsatisfiable S, S h n D(or S r- QT D). Definition: If T C S and S I- pC, then C has T-heritage (relative to S and ft) if in ft there is no deduction of C from S — T (i.e., S — T 1/ nC). The concept of T-heritage bears an interesting relation to the; concept of T-support as evidenced by Lemmas 5 and 6. T-heritage is a concept which has in the past been confused with T-support; this point and related ones will be clarified in the next section. That the concept of T-heritage is distinct from the concept of T-support can be seen from the following example: Let A = { - P . - Q . R } , B = {P,Q}, C = { P , - Q } , S = {A.B.C}, T = {C}. F = { Q , - Q , R } is a (tautologous) resolvent of A and B, and D = { P , - Q , R } is a resolvent of F and C. D has T-heritage, but D is not in T s for any i and, therefore does not have T-support. 'That which is now termed Tg-level was formerly termed T-level in some of our earlier papers.
58
Collected Works of Larry Wos
MISCONCEPTIONS AND NON-EQUIVALENT DEFINITIONS OF SET OF SUPPORT It is incorrect, as can be seen from the example given below, to restate casually the heart of the definition of set of support as follows: If C is inferrable by paramodulation or resolution from A and B, and if at least one of A and B has T-support and both are deducible from S, then C has T-support. The example under consideration is t h a t given at the end of the previous section. The clause D does not have T-support even though one of its parents, C, does. As has been said, D has T-heritage, and there exists by Lemmas 5 and 6 a subclause E of D such that E has T-support. The only element of (C72.B)7£A will do for E (as can be seen by examining the proof of Lemma 1). We give an additional example to show that the casual rendering of the set of support definition given above can lead to an error when both paramodulation and resolution arc: involved as rules of inference. Let A = { R a b , - Q c } , B = {Pa,Qc},C = { P a , - Q c } , S = {A,B,C},T = {C}. D, the only element of (AVB)TZC, is { P a , P b , - Q c } . Although D has T-heritage, D does not have T-support even though one of its parents does. The proof of Lemma 3 gives the clause E = { P b , - Q c } , which is a clause whose existence is demanded by Lemmas 5 and 6. E has T-support and is a subclause of D. K is the only element of (CTIB)'PA. The question of T-support status for some given clause D is in general only semidecidable even if S is finite. Although one can have a decidable test for D being an element of a given TJS (the union of T5, T 5 , . . . , TJg is finite for each j), all that can be said in general is that, if D has T-support, then this fact can be ascertained eventually since D will be in some T s . If D does not have T-support, the situation is analogous to attempting to prove that a given non-theorem is in fact a non-theorem. The question of T-heritage for a given clause is also in general only semide cidable. (Putting the set of support question another way, one normally cannot show that D is not in T s for all i.) For us if a clause is in some Tg it has T-support regardless of whether or not it is deducible from S - T. Slagle [9] demands that, in order for a deduction to have T-support, no resolution occurs between members of S — T (ignoring factoring for this discus sion). Thus all of his T-supported deductions are for us also T-supported, but not conversely as can be seen from the following example: 2 He also assumes S - T satisfiable, which is irrelevant to what follows and is mainly done because of his intended application; we wish not to make this assumption because of the gen erality gained and because of other applications by other authors such as Green [3] concerning question-answering systems.
Paramodulation
and Set of Support
59
S - T = {A,B,C,E}, T = {F}, A = {P,R}, B = { P , - R } , C = {Q,R}, E = { Q , - R } , F = { - P , Q } . D , = {P,R}. D 2 = { P , - R } . D 3 = { - P , Q } . D 4 = {Q,R}, a resolvent of D a and D 3 . D 5 = { Q , - R } , a resolvent of D3 and D2. D6 = {Q}, a resolvent of D4 and D 5 . The deduction Di through D6 has T-support for us, but not for Slagle since he does not allow the resolution of D4 and D5, both of which are in S — T. This resolution is allowable for us because D4 and D 5 have T-support since they are elements of T§. Although Slagle does not define set of support for clauses but instead only for deductions, he would in effect exclude {Q} from having T-support while {Q} would have T-support for us. He would in effect generate each T s , but before retaining it remove from it all elements already in S — T. The reason for such attention to this difference in definition is two-fold. First of all, one should note that his refutation completeness theorem is strictly stronger than that given in [10]. Secondly, since Slagle's definition allows fewer deductions, (smaller T s ) , it might seem best to prove in this paper the stronger refutation completeness theorem as his approach might be more efficient.3 The proof of Lemma 5, however, breaks down immediately since, even with F in S - T one cannot conclude that the elements of C7£F or C P F have T-support when C does since some or all of such elements may also be in S - T. Even with the obvious possible modification Lemma 5 is false for Slagle. For a counter-exam pie, let S - T consist of the three clauses {P,R}, { Q , - R } , {—R,S}, and T consist of the clause {-Q,S}. D = {P,S} is a clause satisfying the hypothesis of Lemma 5 and, therefore, for us must have a subclause with set of support. D itself for us has T-support, but no subclause of D exists either in S — T or obtainable with a T-supported deduction in the sense of Slagle. The question of whether or not Lemma 6 holds with Slagle's definition of T-support is at the present an open question. The example just given does not serve as a counter-example since the clause D of the example does not have T-heritage. Lemmas 5 and 6 may give real insight into the question, intuitively speaking, of why set of support is refutation complete for FIT (in the presence of functional reflexivity) and E T .
LEMMAS, COROLLARIES, AND THEOREMS Lemmas 1 to 6 are reordering lemmas with 1 to 4 being local and 5 to 6 global. All six are proved on the ground level here, although analogous lem mas are probably provable on the non-ground level if factoring is appropriately 3 Slagle's definition of set of support corresponds, at least on the unit level, to that which has been programmed in PGl through PG5. Besides the stronger completeness theorem, he has shown (unpublished) that an instance C of a clause C in S - T can be discarded without losing refutation completeness even when C has T-support. For unit clauses this result has been used for a number of years in the programs PGl through PG5.
60
Collected Works of Larry Wos
utilized. Lemmas 7 and 8 are used to obtain a non-ground refutation from a given ground-clause refutation and are so-called "capturing lemmas" for fac toring and resolution. The obvious analog to Lemma 8, but with resolution replaced by paramodulation, is frequently not true. (For a counter-example, let A = R a b = A', B = Qx, B' = Qg(a), C = Qg(b); the only factor respectively of A and B are A and B themselves, A P B consists of {Qa} and {Qb}. There is, therefore, no C in E P F with C as an instance, see Lemma 8.) The lack of a paramodulation "capturing lemma" analogous to 8 has been the source of difficulty in proving refutation completeness of paramodulation-based inference systems when functional reflexivity was not assumed [6]. For the proofs of Lemmas 1 through 4, note that V and 1Z are symmetric: S P T = TVS and SftT = TftS for all sets S and T. Note also that the relation of "ancestry" is one between occurrences of literals rather than between literals themselves. When the proof calls for the paramodulation of a pair of clauses on a pair of literals, it is intended that the choice both of direction of paramodulation and of term occurrence is dictated by the history of the case under study unless specifically otherwise stated. L e m m a 1. If D is a clause in (A7£B)7£C then there exists a subclause E of D with E € {CTUi)Tlk u {CRk)TLB U (CJlB)K(Cllk). Proof. Let D be in (ATCB)TCC. Then there exists a clause F e A7£B such that D is a resolvent of F and C. F and C must, therefore, contain complementary literals, say q in F and —q in C. Similarly, there exist literals p in B and - p in A such that F is inferrable by resolution from B and A on p and —p. D is inferred from F and C on q and - q . Since q € F, q G B or q e A (or both). If q is in B, and if q = —p or q is not in A, then, where G is the resolvent of C and B on —q and q, let E be the resolvent of G and A on p and - p . E G (C7£B)7?A and is a subclause of D. If q is in both B and A, and if q ^ - p , then, where G is as above and H is the resolvent of C and A on —q and q, let E be the resolvent of G and II on p and - p . E € (C7£B)7?.(C72A) and is a subclause of D. The remaining case yields a subclause E of D with E G (C7?.A)72.B. The proof is complete. L e m m a 2. If D 6 ( A P B ) P C , then there exists a subclause E of D with E € ( C P B ) P A u (CVk)VB U {(CVk)VB)VC U {{CVB)Vk)VC. Proof. Let I) € {kVB)VC. Then there exists F € kVB with D a paramodulant of C and F. Case 1. D is inferred by paramodulation from F into C. Let ?2 £ F be the (equality) literal of paramodulation. Since F € A P B , depending on whether paramodulation was from A into B or from B into A, one of A and B contains the (equality) literal, say ri, of paramodulation and the other contains the literal, say p i , containing the term occurrence of paramodulation. Since ?2 S F, there exists a literal r which is an ancestor of ?2 in A or B (or both), r ^ f2 precisely when r is that literal pi which is involved in inferring F in the discussion above. Case la. There exists an ancestor T2 of ?2 such that r2 € B and ?2 = T2. Let G be inferred by paramodulation on ?2 6 B into P2 S C, where P2 contains the
Paramodulation
and Set of Support
61
term occurrence in the paramodulation of C and F to get D. The literals of G are, with one possible exception, elements of D. The possible exception is the literal (?i or pi) from B. The only literal of B which may not be in G is ?2. If F was obtained by paramodulation from B into A, then ri was in B, and ri is not equal to fa (since ri € B is deleted in the inferring of F, so could not be an ancestor of f2 in B). So ri would be in G. Paramodulate G into A on T\ and pi to infer H. The only literal which may be in H and not in D is f2. If this is not the case, let E be H. If it is the case, let E be inferred by paramodulating H into C on f2 and P2. Thus, if F was inferred by paramodulating B into A, there exists an E satisfying the theorem with E in the union of (CPB)'PA and ({CPB)Pk)VC. Now consider the case in which F was inferred by paramodulating A into B. If pi $ G, pi must equal r2 since f2 is the only literal which may be in B and not in G. But then, from the hypothesis of la., pi is unchanged by paramodulating A into B. So ri must be of the form Rtt for some term t. Let p2 € G be the descendant of P2 6 C. If P2 contains t as a term, paramodulate A into G on ri and P2- Let Hi be the resulting inference. If Hi is a subclause of D, let E be Hi. If not, then ?2 is in Hi and not in D. Then paramodulate Hi into C on f2 and P2. Thus, if p 2 contains t as a term, the desired E is in {CVB)Vkvj {{CVB)V k)VC. If P2 does not contain t as a term, then P2 must since t is a term of ?2. Then let Gi be the paramodulant of A into C on ri and P2. Since ri = Rtt in the case under discussion the descendant of P2 in Gi is P2- Let H2 be the paramodulant of B into G] on ?2 and P2. The only literal which can be in H2 and not in D is T2. If not, let E be H2. If such is the case, 1st E be the paramodulant of H2 into C on f2 and p 2 . E € (CVk)VB U ((CVk)VB)VC. The last subcase to consider is where pi € G. If f2 € A and ?2 -f ri, let H 3 be the paramodulant of A into G on ri and p j . Then let E be the pararnodulant of H3 into C on f2 and P2. If f2 = ri or f2 £ A, again let H 3 be the paramodulant of A into G on ri and pi. Let pi € H3 be the descendant of p x . The only literal of H3 in this case which may not be in D is p i . If this is not the case, let E be H3. If it is the case, then pi = f2. Then let E be the paramodulant of H 3 into C on f2 and p 2 . E C {{CPB)Vk)VC U {Q,VB)Vk. Case lb. There exists an ancestor r2 of f2 such that r2 € A and r 2 = ?2- In this case there exists a subclause E of D with E € ( C P A ) P B U ( ( C P A ) P B ) VC U (CVB)Pk U ((CPB)PA)7>C. The argument parallels that of la. Case lc. No ancestor of f2 is equal to f2, but there exists an ancestor r 2 of f2 with r 2 in B. It follows that r 2 = Pi, and that either f2 ^ A or f2 = r ^ There exists, therefore, an argument Ui of r2 such that ui is replaced by u in inferring F. Since the literal of paramodulation of F and C is f2, either u or u 2 , the other argument of r 2 , may be the argument being "matched" with a term in P2 € C. U2 is unchanged in passing from B to F in all cases since all clauses herein are ground clauses. If u 2 is the argument for match, then let G be the paramodulant of B into C with literal of paramodulation X2 in B, using U2 as the match argument. P2 6 C becomes p 2 S G. Let E be the paramodulant
62
Collected Works of Larry Wos
of A into G on ri and P2. E is a subclause of D and is in (CPB)PA. On the other hand, if u is the match argument for F and C, then an argument of ri can be successfully matched with the term in P2. Let H be the resulting inference from A and C, and let P3 be the transform of P2. Let E be the paramodulant of B into H on 12 and P3, using ui G T2 as the argument for match, where r2 = R.U1U2 or r2 = R.U2U1. E is a subclause of D and is in (CPA)PB. Case Id. No ancestor of ?2 equals ?2, but there exists an ancestor r2 of F2 with T2 € A. By paralleling the argument of lc, we obtain a subclause E of D with E € (CPA)PB U (CPB)VA. Case 2. D is inferred by paramodulation from C into F. Thus there exists a literal r2 in C of paramodulation and a literal p>2 in F containing the term occurrence. Let ri and pi be the literals for inferring F from A and B. There exists an ancestor of P2 in A or in B or in both. If there exists an ancestor P2 of p2 such that P2 € B and P2 = P2, we can argue as in la. If F was inferred by paramodulating from B into A, then the desired E exists in (CPB)PA U ((CPB)PA)PC. If F was inferred by paramod ulating A into B, let G be the paramodulant of C into B on r2 and p2- If Pi £ G, then ri — Rtt as in la. If u is the term of paramodulation in B used for inferring F, and if u is not involved in the inference of G, the desired E is in (CPB)PA U ((CPB)PA)PC. If u is involved in the inference of G, E is in {CPA)PB U {{CPA)PB)PC. However, in this last case if G was inferred by paramodulating on a proper subterm of t in u, one must paramodulate from C into A rather than from A into C as in la. Finally, if pi € G, E € (CPB)PA U ((C7 : 'B)PA)PC. If there exists an ancestor P2 of P2 with P2 € A and P2 = P2, we argue as in lb. E G (CPA)7>B U ((CPA)VB)VC U (CPB)PA u {(CPB)PA)PC. If no ancestor of P2 equals P2, but there exists an ancestor P2 of p2 with P2 € B, as in lc there is an E which is a subclause of D and is in (CPB)PA U (CPA)'PB. The argument parallels the subcases of lc. One may, however, be forced to paramodulate from C into A rather than from A into C as was required at the end of the first subcase of case 2. If no ancestor of P2 equals P2, but there is an ancestor P2 of P2 in A, then the desired E is in (CPA)PB U (CPB)PA. The proof is complete. Lemma 3. If D € (APB)TZC, then there exists a subclause E of D with E £ (CftB)PA u (CPA)ftB U ((CKA)PB)11C U (C1ZA)PB U (CPB)ftA u ((CKB)PA)TIC. Proof. Let D be a clause in (A'PB)'R.C. Then there exists an F € APB such that D is in FP.C Thus there exist literals q in F and - q in C with D = (F - {q})u(C — {-q})- As in the proof of Lemma 2, we can conclude that there exist literals qi in A or B as ancestor of q, ri and pi (one in A, the other in B) with F a paramodulant of A and B on ri and pi and with D S C7£F. Case 3a. There exists an ancestor q of q in B such that q = q. Let G be the resolvent of C and B on — q and q. If F was obtained by paramodulating B into A, let H be the paramodulant
Para.modula.tion and Set of Support
63
of G into A on ri and p i . If H is a subclause of D, let E be H. If not, then the only literal in H and not in D is q. Then let E be the resolvent of H and C on q and - q . If F was obtained by paramodulating A into B, and if pi ^ G, then ri = Rtt for some term t and pi = q. Let Gi be the paramodulant of A into C on ri and —q. Let Hi be the resolvent of Gi and B on —q and q. If Hi is a subclause of D, let E be Hi. If not, then q S A and q / ri. In this case q is the only literal in Hi and not in D. Then let Fi be the resolvent of C and A on —q and q. Let F2 be the paramodulant of Fi into B on ri and p i . Let E be the resolvent of F2 and C on q and —q. If F was obtained by paramodulating A into B and if pi € G, let H2 be the paramodulant of A into G on ri and p i . If H2 is a subclause of D, let E be H2. If not, then the only literal in H2 and not in D is q. Then let E be the resolvent of H2 and C on q and —q. In case 3a, we can find a subclause E of D with E 6 (C1ZB)VA U ((C72.B)P A ) f t C U (CVA)11B U ((CR.A)PB)nC). Case 3b. There exists an ancestor q of q with q S A and q — q. Then, by arguing as in 3a, there exists a subclause E of D with E € (CR.A)VB U ((CTZA)VB)11C U (CPB)ftA u ((C1IB)VA)TZC. Case 3c. No ancestor of q is equal to q, but there exists an ancestor q of q with q € B. Then ri is in A and is of the form Rst for terms s and t. In obtaining F, q becomes q by replacing the appropriate occurrence of s by t (or by replacing the appropriate occurrence of t by s). Let G2 be the paramodulant of A into C on ri and - q . Let E be the resolvent of G2 and B on - q and q, which is possible since —q is the descendant in G2 of —q in C. E is a subclause of D since, in the case under discussion, no ancestor of q equals q. E G (CVA)7iB. Case 3d. If no ancestor of q equals q, but an ancestor q of q is in A, E £ (CVB)TZA. The proof is complete. L e m m a 4. If D € (ATZ.B)'PC, then there exists a subclause E of D with E € (CPB)TCA U (CPB)ft(CPA) U (CPA)ftB. Proof. Let q and —q be respectively in A and B as required for F € A72.B with D € F P C , for arbitrary D. If D was obtained by paramodulating C into F, C contains the (equality) literal, say ri, of paramodulation and F contains the literal, say pi, containing the term of paramodulation for inferring D. If an ancestor of pi is in B, let G be the paramodulant of C into B on ri and pi. If Pi $ A or pi = q, let E be the resolvent of G and A on - q and q. If pi € A and pi 5^ q, let H be the paramodulant of C into A on ri and p j . Let E be the resolvent of G and H on —q and q. Thus, in the case under discussion, a subclause E of D can be found in (CPB)ftA U (C7 3 B)TC(CPA). If B contains no ancestor of pi, then A must. In that case a subclause E of D exists in (CPA)ftB. If D was obtained by paramodulating F into C, by paralleling the argument just given but with the roles of pi and ri interchanged one can show the existence of a subclause E of D with E e (CPB)ftA U {CPB)K(CVA) U (CVA)TIB. The
64
Collected Works of Larry Wos
proof is complete. L e m m a 5. Let S and T C S be given and let U be the smallest set con taining S — T such that U is closed both under paramodulation and resolution. (Factoring is irrelevant on the ground level.) If F € U, and C has T-support, and if D E C ^ F U C7?.F, then there exists a clause H such that H is a subclause of D and, more importantly, H has T-support. Proof. Let (S — T)° = S - T (since ground clauses have no non-trivial fac tors), and for j > 0 let (S - T ) j + 1 = (S - T ) j U A P B U ATZB for all clauses A a n d B in ( S - T ) j . Then U = Uj(S — T) J . Let F be a clause in U, C a clause with T-support and D a clause in the union of CPF and C7?.F. The proof proceeds by induction on the (S - T)-level of F, where the (S - T)-level n of F is (as given earlier) the smallest n such that F € (S - T ) n . If the (S - T)-level of F is 0, then F € S - T and D by definition has T-support since C has and F is a paramodulant or a resolvent of C and a clause in S — T. Assume by induction that the lemma is true for clauses G with (S — T)-level j with 0 < j < n, and let F be of (S — T)-level n + 1. Then there exist clauses A and B in (S - T ) n with F E A P B U ATIB. D, therefore, is in the union of (ATIB)TZC, ( A P B ) P C , (APB)TCC and (A1IB)VC. Depending on which of the just given four sets contains D, one of Lemmas 1 through 4 applies to yield a subclause E of D. In addition one knows that E is itself contained in some union of sets dependent on C, B, and A, and on some combination of paramodulation and resolution. We shall give the argument for the case in which E G ((C1ZA)VB)1ZC and show that a subclause H of E and hence a subclause of D, exists and has T-support. The remaining cases can be proved by an argument similar to that which follows but less involved. Since in the case under discussion E is assumed in ((CTZA)VB)TZC, there exist clauses Gi and G 2 with Cn € CTZA, G 2 € GiPB, and K G G 2 7£C. Since C has T-support and A G (S — T ) n , by induction there exists the clause Ei which is a subclause of Gi and has T-support. Ei is either itself a subclause of G2 or Ei contains the literal relevant to the paramodulation of Gi and B. In the first case, let E2 = E i . In the second, apply the induction hypothesis to Ei and B to show that there exists an E2 which is a subclause of G2 and which has T-support. Thus in either case we have a T-supported subclause E2 of G2Either E2 is a subclause itself of E or contains the literal for resolution with C corresponding to that by which E was inferred. Since E2 has T-support and since every resolvent of E2 and C has T-support (for they both do), we have an E3 which has T-support and is a subclause of E which is a subclause of D. E3 = E2 or is in E272.C. H = E3 is the desired subclause of D having T-support. Lemmas 5 and 6 are proved with IIT as the underlying inference system. The obvious modification of those proofs will give corresponding lemmas for E T . L e m m a 6. Given S and T C S and a clause D with T-heritage (relative to S and TI) then there exists a subclause E of D such that E has T-support. Proof. Let D be a clause with T-heritage, not deducible with paramodula-
Para.modula.tion and Set of Support
65
tion and resolution from S - T but deducible from S with those same inference rules. The proof proceeds by induction on the S-level of D. If D has S-level 0, then D € T since D has T-heritage. So D itself has T-support. Assume by induc tion that all clauses with S-level less than or equal to n having T-heritage possess a subclause having T-support, and let D have S-level n + 1. Then there exist clauses C and F of S-level less than or equal to n such that D 6 C P F U C72.F. If neither C nor F have T-heritage then both are deducible in II from S — T, and D, therefore, is deducible in II from S — T. But D has T-heritage in II, which would be a contradiction, so one of C and F say C has T-heritage. By the induction hypothesis, C has a subclause Ci having T-support. If F has T-heritage, then by the induction hypothesis there exists a subclause Fi of F having T-support. Now C and F with paramodulation or resolution yielded D. Hence C and F each contain a literal relevant to this paramodulation or resolution. If either Ci or Fi (subclauses respectively of C and F) lack that particular literal, then the clause lacking the literal is a subclause of D and has T-support from the above. If both Ci and Fi have the literals in question then paramodulation or resolution of Ci and Fi on that literal pair yields a subclause of D. This subclause has T-support since Ci and Fi both do. Now consider the case where F does not have T-heritage and is, therefore, deducible in II from S - T. Paramodulation or resolution can be applied to Ci and F on the literal pair used to infer D, unless Ci is a subclause of D. In the latter case we are finished. In the former we infer from F and Ci the clause G which, since Ci is a subclause of C, is a subclause of D. We apply Lemma 5 to F, Ci, and G to obtain a subclause C2 of G. C2 is, therefore, a subclause of D, and by Lemma 5 it has T-support. It has already been shown by example (see the end of the section on def initions and notation) that the concept of T-heritage is distinct from that of T-support. It follows that, given a clause with T-heritage, Lemmas 5 and 6 may yield at best a proper subclause having T-support. In the example just cited the clause with T-heritage was { P , - Q R } , and the subclause provided by Lemmas 5 or 6 is { - Q , R } . Remark. By examining the proofs of Lemmas 5 and 6, one can prove the corresponding lemmas with II replaced by E. The correspondent of 6 states that, if D has T-heritage relative to S and E, there is a subclause E of D which has T-support relative to S and E. A similar statement is the correspondent to Lemma 5. The heart of the matter is Lemma 1, which guarantees the existence of a clause (ground) inferrable by resolution with some appropriate re-ordering when presented with a clause D in (A72.B)7£C. Definition: fi is R-sound if, whenever S I- n C , C holds in all R-models of S in which C is defined. An R-model of S is a model of S in which R (the equality predicate) is mapped to an equality relation. Corollary 1. If S is an unsatisfiable set of ground clauses with T C S such that S — T is satisfiable, then S I- E T D (set of support is ground refutation complete in E).
Collected Works of Larry Wos
66
Proof. Let S be an unsatisfiable set of ground clauses with T C S such that S — T is satisfiable. Since resolution is refutation complete, S H j D , the empty clause is deducible from S. Since resolution is sound and S - T satisfiable, the empty clause has T-heritage (relative to S and £ ) . By the remark above, there exists a subclause of □ having T-support relative to S and E. (Contradictory units could have been the focus of attention instead.) Thus set of support is ground refutation complete in E. Corollary 2. If S is an R-unsatisfiable set of ground clauses and if T C S is such that S - T is R-satisfiable and if S contains all clauses of the form Rtt for t in the Herbrand universe of S, then S I- n T D ; set of support is ground refutation complete in II. Proof. Let S and T C S satisfy the hypothesis of the corollary. Since II has been shown to be refutation complete for such an S [11] [5], and since paramodulation and resolution are both R-sound and S — T is R-satisfiable, the empty clause has T-hcritage (relative to II and S). Apply Lemma 6. Paramodulation, though R-sound (i.e., sound for first order theories with equality), is of course not sound for ordinary first order theories. Qb is a paramodulant of Qa and Rab but not a logical consequence of Qa and Rab. In Corollary 2 it is not sufficient to require S — T to be satisfiable rather than R-satisfiable as can be seen from the following example. S - T = {{Qa},{-Qb},{Rab}},
and
T = {Pa}.
S is R-unsatisfiable. S — T is satisfiable but R-unsatisfiable. Obviously there is no T-supported refutation relative to S and II. L e m m a 7. If A' is an instance of A, then there exists a factor B of A having the same number of literals as A' and having A' as an instance. L e m m a 8. If A' and B' are instances respectively of A and B and if C is an element of A'TZB', then there exists a clause C € E72.F having C as an instance, where E is a factor of A and F is a factor of B. Lemmas 7 and 8 are true for all instances and not just for ground instances. For the theorem which follows, the proof is one of obtaining a deduction based on a set S of clauses from a ground clause deduction based on a set of instances of S. Occurrences of terms in two literals are said to be in the same position if each is the i n -th argument of the i n - i - s t argument of . . . of the ii-st argument of its literal. L e m m a 9. If A' and B' are ground instances of clauses A and B respectively, and if C is a paramodulant of A' into B', and if B has a term in the position corresponding to the term of paramodulation in B', then there exists a clause C that is a paramodulant of some factor of A and some factor of B and such that C is an instance of C [12]. T h e o r e m 1. If S is a functionally-reflexive R-unsatisfiable set of (not nec essarily ground) clauses and if T C S with S - T R-satisfiable, then S h n T n ; set of support is R-refutation complete (in IIT) for functionally reflexive sets.
Paramodulation
and Set of Support
67
Proof. Let H be the Herbrand universe of S, and let S' be the full instanti ation of S over H. Since S is R-unsatisfiable, S' is R-unsatisfiable. S' contains all clauses of the form Rtt for all terms t in H, where R is the equality predicate. Let the full instantiation of S - T over H be (S - T ) ' . (S - T ) ' is R-satisfiable since S - T is. T", the full instantiation of T over H, is such that S' - T' is Rsatisfiable since S' — T' C (S — T) . By Corollary 2 there exists a T'-supported refutation D[, D 2 , . . . , DJ,. Using the refutation D[, D 2 , . . . , DJ,, the following procedure yields a T-supported refutation D j , D 2 , . . . , Dh of S itself within II. For each clause DJ of the ground refutation, the procedure yields a finite sequence U; of clauses such that the last clause in U, has DJ as an instance and also has precisely the same number of literals as DJ. The juxtaposition of Ui, U 2 , . . . , U n will be a T-supported refutation Di, D 2 , . . . , Dh in IT of S. In many cases h will be greater than n. This results from two causes: the need for factoring or the need for extra steps due to the lack of a capturing lemma of the desired type for paramodulation. For each DJ whose justification is that DJ is in T', there exists an A in T with DJ as an instance. If A and DJ have the same number of literals, let Ui = A. If not, let Ui be A,B as provided by Lemma 7. For each DJ whose justification is that DJ is in S' — T', there exists an A in S — T with Dj as an instance. If A and Dj have the same number of literals, let Uj = A. If not, let Uj be A,B as provided by Lemma 7. For each DJ whose justification is that DJ is a resolvent of Dj and D k , consider the corresponding Uj and Uk. Let A be the last element of Uj and B be the last element of Uk- Since by construction A, B, Dj, and D'k satisfy the hypothesis of Lemma 8, there exists a C in ETZF having DJ as an instance, where E and F are respectively factors of A and B. A, however, has the same number of literals as Dj by construction. One can deduce, therefore, that E = A. Similarly, it follows that F = B. If C and DJ have the same number of literals, let Ui =■ C. If not, apply Lemma 7 to obtain the clause D such that D has the same number of literals as DJ and has DJ as an instance. Then let Ui be C,D. For each DJ whoso justification is that D[ is a paramodulant of Dj and D k . let the paramodulation be, without loss of generality, from Dj into I)' k . Let A and B be respectively the last elements of the corresponding Uj and Uk- Let u' in D k be the term occurrence of paramodulation relevant to the inference of DJ. If B contains a term in the corresponding position to that of u' in D k , then by Lemma 9 there exist factors E and F of A and B respectively such that some C in E P F has Dj as an instance. Since by construction, Dj and A have the same number of literals and similarly D k and B have the same number of literals, E = A and F = B. If C and DJ have the same number of literals, let Uj be C. If not, let Uj be C,D, where D is obtained by applying Lemma 7 to DJ and C. When B does not have a term in the position corresponding to that of u' in Djj, the property of functional reflexivity comes into play. In the case now under discussion DJ is inferred by paramodulation from Dj into D k , A and B are respectively the last elements of Uj and Uk, and B does not
68
Collected Works of Larry Wos
have a term u in the position (within the corresponding literal) corresponding to u' (the term of paramodulation) in D k . Normally A and H will not have a paramodulant C having D{ as an instance. Depending on whether or not D k has T'-support, there are two alternatives for obtaining a pair of clauses one of whose paramodulants has D{ as an instance. Consider the case in which D'k has T'-support. We show that a clause B r can be inferred by paramodulation from B and a set of functional reflexivity axioms. B r will have D k as an instance and will also have a term u in the position corresponding to u'. Since D k is an instance of B, there is a substitution a such that Bcr = D'k. Since B lacks a term in the position corresponding to u', there exists a variable x in B and a non-empty set of functions f 1, f2, - - •, fp in D k such that a contains fi(.. .f2(... f p (.. . u ' . . . ) . . -))/x, i.e., x is replaced in passing from B to D k by instantiation by fi(.. .f2(.. . f p ( . . . u ' . . . ) . . . ) ) . The vector giving the position of x in B is an initial segment of that for u', i.e., the vectors agree on the first q coordinates where q is the number of coordinates giving the position of x in B. Let G i , G 2 , . . . , G p be the functional reflexivity axioms corresponding to f 1, f2, - - -, fp- Let Bi be the paramodulant of Gi into B on x. In general for 1 5; m % p - 1, let B m + i be the paramodulant of G m + i into B m on the variable occurring as the t-th argument of fm where t is the (q + m + l)-st coordinate of the position vector for u'. By construction Bi and, therefore, all B m , 1 ^ m 5? p, have the same number of literals as D k . Let B r = B p . A, B p , D' and D k satisfy the hypothesis of Lemma 9. So there exists a clause C in YJVY having D[ as an instance, where E and F are respectively factors of A and B p . As earlier in the proof one can conclude that E = A and F = B p since B p and D'k have the same number of literals. If C and D[ have the same number of literals let Uj be G i , G 2 , . . . , G p , Bi, B 2 , . . . , B p , C. If not, apply Lemma 7 to C and D| to obtain a clause D having D[ as an instance and having the same number of literals as D(. Then let Ui be G i , . . . , C, D. The other alternative occurs when D k does not have T'-support. But then, since the ground deduction has T'-support, D' has T'-support. Now the pro cedure just given would, or course, still yield a clause D p with most of the desired properties. But, because of the consideration of T-support desired for Di, D 2 , . . ., Dh, Bp will not do. We shall show instead, therefore, that there ex ists a clause A p which can be inferred from A, the last element of Uj, and the G r , the functional reflexivity axioms of the previous paragraph such that paramodulation from A p into B yields a clause having a subclause of DJ as an instance. First we re-number the G r . For 1 5? m 5j p with r — m = p -r- 1, let H m be G r . Since the inference of D[ was by paramodulation from D' into D k ,Dj contains an equality literal Rs't'. Since the term of paramodulation in D'k relevant to this inference was u', and since Dj and D k are ground clauses, s' or t' = u'. Without loss of generality say that s' = u'. Since by construc tion Dj is an instance of A (the last element of Uj), A contains a correspond ing equality literal Rst. A p will be identical to a subclause of A except that Rst will be replaced by Rfi(f 2 (.. . f p ( s ) . . .))fi(f2(- • • f p ( t ) . . .))> and the last p
Paramodulation
and Set of Support
69
coordinates of the position vector of s will be identical to the last p for u'. Let A 0 = A, and A t for 1 ^ t ^ p be the paramodulant of A t _i into H t . Each paramodulation is into the second argument of the corresponding H t and into the r-th subargument therein where r is the (q + p + 1 - t)-th coordinate of the position vector of u'. The literals of paramodulation are respectively, Rst, Rfp(s)f p (t),..., Rf 2 (f 3 (. • • fP(s) • • -))h{h(- • • f P (t) ■■•))• A s was seen earlier there exists the variable x occurring in the position in B whose first q posi tion coordinates are identical to the first q of u' in D^. Let Bi be obtained by paramodulation of A p into B on Rfi(f 2 (... f p ( s ) . . .))fi(f 2 (... f p ( t ) . . . ) ) into the above mentioned occurrence of x. Let xi be the term occurrence resulting from the replacement of that occurrence of x. Let B 2 be the paramodulant of A on Rst into t in xi in Bi, where t in its literal in Bi and u' in its literal in D k are in the same position, and let x 2 be the corresponding resulting term occurrence—x 2 replaces x i . Let B3 be obtained by paramodulation of A on Rst into s in x 2 in B 2 , where s in its literal in B 2 and u' in its literal in D'k are in the same position. B3 has DJ as an instance. If B3 and D[ have the same number of literals, let Uj be H i , H 2 , . . ., H p , Ai, A 2 , . . . , A p , Bj, B 2 ,B3. If not, apply Lemma 7 to B3 and D[ to obtain B4 such that B4 has D( as an instance and B4 and D[ have the same number of literals. Then let Uj be H i , . . . , B3, B4. The need for application of paramodulation to A and Bi and then to A and B 2 is that certain literals needed to capture D[ as an instance of A might be lost in passing from A to A p and then to Bi. Now generate in order Ui, U 2 , . . . , U n from D[, D'2,..., D[, by applying the procedure given above. The desired (possibly) non-ground deduction Di, D 2 , . . . , Dh is obtained by juxtaposing Uj, U 2 , . . . , U n . Since D n is the empty clause and, by the construction, the last element of U n has D n as an instance, Di, J ) 2 , . . . , Dh is a refutation. (That D j , D 2 , . . . , Dh is a deduction including justifications fol lows from the construction.) The argument that D i , D 2 , . . . , Dh is a T-supported refutation proceeds by induction. We show that for each Uj, all elements of Uj are either factors of clauses in S - T or have T-support, and in addition we show that, for all i, if D[ has T'-support, then the last element of Ui has T-support. D[ is in S' - T ' or in T'. So by construction the elements of U, are either factors of clauses in S - T or factors of clauses in T. If D[ has T'-support then by construction the last element of Ui is a factor of a clause in T. Now assume by induction that our statement holds for U t with 1 ^ t ^ r, and consider U r + i . If D't+1 is justified by being in S' — T', then U r + i has its elements among factors of S - T. If D'r+l is justified by being in T', again as above U r + i consists of factors of elements of T, and, therefore, the last element of U r ) 1 has Tsupport. If DJ.+ 1 is a resolvent of D' and D k , at least one of D- and D k has T'-support since the ground deduction has T'-support. Say without loss of generality that D k has T'-support. But then by induction the last line B of U k has T-support. Also by induction A, the last element of Uj, either has T-support or is a factor
70 Collected Works of Larry Wos
of a clause in S - T. Ur+1 by construction consists either of C or C and D, where C is a resolvent of A and B and D (if needed) is a factor of C. In either case Ur+1 has all of its elements with T-support. If Dr+1 is justified as a paramodulant of two earlier clauses A and B, and if B has a term in a position corresponding to the term (on the ground level) of paramodulation, we can parallel the arguments just given for D;.+1 when D'r+1 is a resolvent. If D'r+1 is justified by paramodulation from D' into Dk where Dk has T'-support, and if B is the last element of Uk but does not have a term in the corresponding position to that of the term of paramodulation in Dk then the procedure gives as Ur+1 the sequence G1, G2i ..., GP, B1, B2, ... , Bp, C or possibly ... C, D. G1, G2, ... , Gp are in S. By induction B has T-support since Dk does. Therefore B1, B2,. . ., Bp have T-support. By induction the last element A of Ui either is a factor of an element of S - T or has T-support, so C has T-support. If the procedure calls for an application of Lemma 7 to yield a clause D, then D has T-support. The last line of Ur+1, therefore, has T-support. If D,+1 has T'-support and is a paramodulant of DJ ^ into Dk, but Dk does not have T'-support, then Df has T'-support since the ground deduction is T'supported. We can parallel the argument just given in the previous paragraph and conclude that Ur+1 consists either of factors of clauses of S - T or clauses with T-support and that the last element of Ur+1 has T-support. The induction is, therefore, complete, and we have the proof of Theorem 1.
Since S' - T' was shown to be R-satisfiable, the empty clause must have T'-support. Dh, therefore, must have T-support since Dh is the last element of U1. (It should not be concluded that a completeness theorem for paramodulation without functional reflexivity would lead directly to the completeness theorem for paramodulation with set of support in the absence of functional reflexivity. The functional reflexivity axioms were used directly in the proof of Theorem 1.) Theorem 2. If S is an unsatisfiable set of (not necessarily ground) clauses, and if T C S is such that S - T is satisfiable, then S I- ETD; set of support is refutation complete within ET. Proof. The proof parallels that just given for Theorem 1, omitting all references to functional reflexivity, paramodulation, and replacing R-satisfiability by satisfiability, etc. It is perhaps interesting to note that the proof of Theorem 1 easily yields refutation completeness within ET, i.e., completeness of set of support for resolution. The previously given proofs for refutation completeness in ET [9][10], however, do not seem to generalize easily to refutation completeness in IIT. Corollary 3. For finite functionally reflexive sets there is a refutation procedure for H with set of support. That is, there is a uniform procedure that will, given any T and a finite functionally reflexive R-unsatisfiable S D T with S - T R-satisfiable, generate (in a finite number of steps) a refutation of S in the system IIT.
Paramodulation and Set of Support
71
Proof. By Theorem 1 there exists a T-supported refutation Di, D-2, • • •, Dk. Since by definition refutations are finite in length and the D; either are factors of S — T or are in some Tg, there exists an n such that S° U T§ contains all Dj. Consider the procedure which generates (S - T) , then Tg, T ^ , . . . , T£. Since S is finite, (S — T)° and TJS for 0 ^ j ^ n are all finite, the given procedure will find the T-supported refutation of S after generating only finitely many clauses.
References 1. Andrews, P. "Resolution with Merging." J. ACM15 (1968), pp. 367-381. 2. Darlington, J. "Theorem-proving and Information Retrieval." Machine Intelligence IV (1969), ed. by D. Michie and B. Meltzer. 3. Green, C. "Theorem-proving by Resolution as a Basis for Question-answering Systems." Machine Intelligence /V(1969), ed. by D. Michie and B. Meltzer. 4. Robinson, G., Wos, L., and Carson, D. "Some Theorem-proving Strategies and Their Implementation," AMD Technical Memorandum #72, Argonne National Laboratory (1964). 5. Robinson, G, and Wos, L. "Completeness of Paramodulation." (Abstract), J. Symb. Logic, 34 (1969), p. 160. 6. Robinson, G., and Wos, L. "Paramodulation and Theorem-proving in First-order Theories with Equality." Machine Intelligence IV (1969), ed. by D. Michie and B. Meltzer, pp. 135-150. 7. Robinson, J. "A Machine-oriented Logic Based on the Resolution Princi ple." J. ACM 12 (1965), pp. 23-41. 8. Robinson, J. "Automatic Deduction with Hyper Resolution." Internat. J. Assoc. Comput. Math. 1 (1965), pp. 227-234. 9. Slagle, J. "Automatic Theorem Proving with Renamable and Semantic Resolution." J. ACM 14 (1967), pp. 687-697. 10. Wos, L., Robinson, G., and Carson, D. "Efficiency and Completeness of the Set of Support Strategy in Theorem Proving." J. ACM 12 (1965), pp. 536-541. 11. Wos, L., and Robinson, G. "The Maximal Model Theorem." (Abstract), J. Symb. Logic, 34 (1969), pp. 159-160. 12. Wos, L. and Robinson, G. "Maximal Models and Refutation Complete ness." (Unpublished)
AXIOM SYSTEMS IN AUTOMATIC THEOREM PROVING* George Robinson
. Lawrence Wos
In judging the suitability of axiom systems for automatic theorem proving in a particular domain, two considerations are of prime importance: logical strength and proof-search efficiency. The axiom system should be just strong enough to yield all the theorems of the theory and only the theorems of the theory. We shall employ the concept of adequacy (defined in the following station) to study this property. Given two axiom systems each of appropriate strength for the theory in question, one would prefer to use the system that would, when used by the theorem-proving programs in question, discover proofs in the shortest time (or using the smallest amount of memory or other computer resources). Examples showing how the choice of axiom system can have important effects on proof-search will be given in the section on efficiency. We shall be dealing with a language equipped with denumerably many in dividual variables, individual constants, n-adic function constants, and n-adic predicate constants. An individual constant or individual variable is a term, as is an n-adic function constant followed by n terms. A ground term is one involving no variables. An atomic formula (or atom) is an n-adic predicate letter followed by n-terms. A literal is an atomic formula or the negation thereof. A clause is the disjunction of finitely many literals; it is a ground clause if no variables occur. It is often profitable to identify clauses, particularly ground clauses, with the set whose members are the literals occurring in the clause. If some or all of the variables of a clause are systematically replaced by terms, the resulting clause is an instance of the original clause. A set of ground literals (literals involving no variables) satisfies a ground clause if it has a non-empty intersection with the clause; it satisfies any clause (with respect to some herbrand universe, Hs) if it satisfies all ground instances (over Hs) of that clause. If a set of literals contains the negation of each literal of a ground clause, it condemns the ground clause; if it condemns some ground instance of any clause, it condemns the clause. The clause Q (read "the empty "Work performed under the auspices of the U.S. Atomic Energy Commission. Reprinted with permission from the IRIA Symposium on Automatic Demonstration, Ver sailles, FVance, Dec. 16—21, 1968, in Lecture Notes in Mathematics, Springer-Verlag, pp. 215236.
Axiom Systems in Automatic
Theorem
Proving
73
clause" or just "nil") having no literals can be satisfied by no set of literals and is (vacuously) condemned by every such set. The herbrand universe, Hs, of a set S of clauses is the set of all ground terms that can be formed from the functions and individual constants occur ring in S, with the constant a being supplied in the case that S contains no indidual constants. An herbrand atom for S is an atomic formula composed of a predicate letter occurring in S and the appropriate number of terms from HsAn interpretation I of S over Hs is a set of (ground) literals such that for each herbrand atom L for S, exactly one of L or ~ L is in I. A model of S (over Hs) is an interpretation of S over Hs that satisfies S. If S and T are sets of clauses, the S implies T (S \= T) if no model of S condemns T. Then each clause C in T is a logical consequence of S (is implied by S, S h C). This paper concerns itself principally with sets of clauses. There appears to be no reason, in principle, why the discussion should not go over to more general sentences, such as those obtained by using logical operators for conjunc tion, conditional, biconditional, and more general application of negation and quantification. (In effect, with clauses one considers only universal quantifica tion over each clause.) In the discussion of eliminability, the biconditional s is in fact used, since the statement of this property appears to become inordi nately complex in terms of clauses alone. We assume some conventional rules of function, inference, and semantics for these additional connectives. For clauses, three rules of inference are of prime importance in automatic theorem proving: factoring, paramodulation, and resolution. Definition (Paramodulation): Let A and B be clauses such that a literal Rst (or Rts) occurs in A and a term u occurs in (a particular position in) B. Further assume that s and u have a most general common instance s' = scr = UT where a and r are the most general substitutions such that; sa = UT. Where B is obtained by replacing by tcr the occurrence of UT in the position in B T corresponding to the particular position of the occurrence of u in B, infer the clause C = B U (A - {Rst})<7 (or C = B U (A - {Rts})
Definition (Resolution): If A and B are clauses with literals k and 1 respectively, such that k and 1 are opposite in sign (i.e., exactly one of them is an atom) but / k / and / l / have most general common instance m, and if a and r are the most general substitutions with m = /k/o~ = /1/r, then infer from A and B the clause C — (A — {k})u U (B - {1})T. C is called a resolvent of A and
74
Collected Works of Larry Wos
B and is inferred by resolution. Definition (Factoring): If A is a clause with literals k and 1 such that k and 1 have a most general common instance m, and if a is the most general substitution with k
Adequacy of an Axiom System A set E of sentences is a non-creative* extension of a set E' if V(E) C\ W(E ) = V(E'); it is an eliminable extension if for every C € W(E) there is a C € W(E') such that E t= C = C . In Figure 1 two (redundant) sets of axioms are given.** Al- 8 were obtained by writing in clause form a set of axioms given by Abraham Robinson*** for group theory in terms of a single binary relation R and two functions f and g. Bl-2, B5-9, B l l , and B13 were obtained from another set of group theory axioms in the same book**** by replacement (in a set of sentences not origi nally involving function symbols) of existentially-quantified variables by Skolem function symbols. Consider the set S4 = SI U {B15.B16}, where SI = {B6,B7,B11,B12,B13}. Thus defined, S4 is obviously a non-creative, eliminable extension of SI. If a theory T is a non-creative, eliminable extension of a sot S of axioms, then the set S is of appropriate logical strength for a study of the theory T by "The concepts of non-creativity and eliminability as used here are closely related to the two criteria for definitions given in [7], page 154; hence the choice of terminology. **{A1,... ,A8}, {A6,... ,A10}, and {A6,A7,A8,A9,A11,A12} are equivalent sets. {B1,B2, B5,B6,B7,B8,B9,H11,B13}, {B6,B7,B9,B11,B13,B14}, and {B6,B7,B11,B12,B13,B15,B16} are equivalent sets and each of them implies the three sets of A-axioms. Since A3 appears to be a more natural way of stating associativity one might ask whether A10 might not be replaced by A3 in the set A6-10. This question is answered negatively by the following counter-example: Consider a domain of three elements {0,1,2}. Let f map to the usual cyclic group op eration on this domain, let g map to the corresponding group inverse operation, and let e map to 0, but let R map to the equivalence relation K such that 0 / 1 = 2; namely K = {(0,0), (1,1), (1,2), (2,1), (2,2)}. A3, A6, A7, A8, and A9 are all obviously satisfied, but A5 is falsified by the choice ofx = y = z = l and u = 2, since (1,1) 6 K, (1,2) 6 K, and (f(ll),f(12))=(2,0)£K. •"Reference [3], p. 26. •***op. cit., p. 229.
Axiom Systems in Automatic
Theorem
Proving
75
means of automatic theorem-proving. That is, since every sentence C in W(T) can be mapped into a sentence C/i in W(S) in such a way that C/i is in V(S) iff C is in V(T), we need only apply a proof procedure to V(S). But confin ing the choice of axiom sets to those which have T as a non-creative, diminable Al A2 A3 A4 A5 A6 A7 A8 A9 A10 All A12
Rxy Ryx (sym) Bl Rxy Ryz Rxz (trans) B2 Rf(f(xy)z)f(xf(yz)) (assoc.) RxyRg(x)g(y) (g-subst.) Rxz Ryu Rf(xy)f(zu) (f-subst.) B5 Rf(ex)x (l.ident.) B6 Rf(g(x)x)e (l.inv.) B7 Rxx (reflex.) B8 Rxz Ryz Rxy B9 Rf(xy)u Rf(yz)t Rf(usOf(xt) Rf(xy)u Rf(yz)t Rf(uz)w Rf(xt)wl , \JB11 assoc Rf(xy)u Rf(yz)t Rf(xt)w Rf(uz)wi ^ > \ B 1 2 B13 B14 B15 B16 B17 B18 B19 B20 A21 Rf(xe)x (r.ident.) B21 A22 Rf(xg(x))e (r.inv.) B22
Rxy Ryx Rxy Ryz Rxz
Rxt Ryu Rzw Pxyz Ptuw Pexx Pg(x)xe Rxx Pxyz Pxyu Rzu (uniq.of prod.) Pxyu Pyzt Puzw Pxtw Pxyu Pyzt Pxtw Puzw Pxyf(xy) (closure) Rzu Pxyz Pxyu (P 3 -subst) Rxy Pexy Pexy Rxy Pxyz Pxyu Pezu Pezu Pxyz Pxyu Rf(xy)z Pxyz Pxyz Rf(xy)z Pxex Pxg(x)e
Figure 1. extension is unnecessarily restrictive. It forbids, for example, using a system such as SI to study one such as A1-A8, when the former is much more efficient in proof search with some types of inference apparatus than the latter. This problem is not avoidexl by allowing the use of a set S which is itself a non-creative, eliminable extension of the theory. It appears appropriate for automatic theorem proving to make only a requirement concerning the existence of an appropriate (and effective) mapping /i. We shall do this by defining a set of sentences S to be adequate for a theory T iff there exists a uniform means of transforming the atomic formulae of W(T) into atomic formulae of W(S) such that the mapping y. induced on all sentences of W(T) maps the sentences C in W(T) into sentences Cfi of W(S) such that C/i G V(S) iff C 6 V(T).* *It may be possible to generalize the concept of adequacy by partially relaxing the re striction that fi be induced by a transformation of atomic formulae. The restriction is quite natural for automatic theorem proving, since it requires, in effect, that C/i be a clause if C is a clause. The restriction apparently cannot be completely removed to allow arbitrary effective
76
Collected Works of Larry Wos
Whenever T is a non-creative, (effectively) eliminable extension of S, S is adequate for T. By effectively eliminable we mean that there is an effective means of determining the C , given the C. In that case, let C/x = C for C € W(T) - W(S) and let C/x = C for C € W(S). Then for C G W(S), Ciz = C G V(S) iff C G V(T) since V(T) n W(S) = V(S). For C G V(T) - V(S), we have Cn G V(T)(since T |= C = C/i) and hence C/x G V(S). For C G W(T) - V(T), we have Cfi $ V(S), since if C/i G V(S) we would have C/x G V(T) and hence C G V(T) (since T | = C s C/x) contrary to hypothesis. On the other hand, S can be adequate for T but fail to be a non-creative extension of S as illustrated by the trivial example T = {P}, S = {P} (fj, is the mapping from P to P, and from P to P). If we let S2 = {B9,B14} and consider S3 = SI U S2 we find that SI is adequate for S3.t To see that this is the case, let r map each atomic formula of the form Ra/3 into Pea/3 while leaving one of the form P-ya0 unchanged. Then let 6 be the mapping on clauses induced by r. First we show that 0 maps V(S3) into V(S1). Suppose by way of contradiction that for some C, S3 (= C but SI ^ CO. Then there is a model M of SI over Hsi that condemns some ground instance DO of CO, where D is a ground instance of C. Let M* = M U {Ra0\Pea0 G M} U {Ra0\ Pea/3 g M}. Then M* is an interpretation of S3 that satisfies SI. If Ra0 and PjSa are in M*, then Pea/3 and P7<5a must be in M and, since Pezu Pxyz Pxyu is a theorem of SI, it follows that Py50 is in M and hence in M*. Thus M* satisfies B14. A similar argument shows that M* satisfies B9 as well, hence M* is a model of S3 and must satisfy D. Let M* n D = E. Then M PI DO = E 0 ^
, contrary to the hypothesis that M condemned DO. It remains to show that 6 maps only elements of V(S3) into V(S1): Since S3 |= Pexy Rxy and S3 |= Rxy Pexy, it follows that S3,C0 \= C for any C G W(S3). If SI |= CO, then S3 \= CO, since SI C S3. Hence if SI (= CO, S3 \= C. To show that S3 is adequate for A1-8, let /j. be the identity mapping on clauses and first note that S3 (= Ai for i - 1, . . . , 8. (Two of the examples in the section on proof search efficiency contain proofs that S3 I- B21-22. Proofs that S3,B21-22 h A l - 8 are given in Appendix A.) Hence if C e V(Al-8), then C/x = C G V(S3). Now suppose that C G W ( A l - 8 ) - V(Al-8). Then there must be a model M of A l - 8 over H A I - S that condemns C. Let M* = M U {Pa0y | Rf(a/3)7 € M} U {Pa0-y | R((a0)y i M}. Now A l - 8 U {Rf(xy)z Pxyz, Pxyz Rf(xy)z} f= S3. Hence M* must be a model of S3. Since M* condemns C, C/i = C cannot be in V(S3). In general, if S' is adequate for S and S is adequate for T, it follows that S' is adequate for T. since if / / is the mapping of S into S' and fi the mapping of T into S, /u/x' will do for the mapping of T into S'. In particular, since SI is H without admitting, for example, certain pathological mappings by which any set of tautolo gies in a sufficiently rich vocabulary could be shown adequate for any finitely-axiomatizable theory. 'Henceforth we shall restrict the discussion to consider only clauses as sentences, i.e., W(S) will always be a set of clauses.
Axiom Systems in Automatic Theorem Proving
77
adequate for S3 and S3 adequate for Al-8, SI must be adequate for Al-8 and in turn for any theories for which Al-8 may be adequate. One might wish to note that Al-8 is not a non-creative extension of SI.
Proof-search Efficiency In the literature on automatic theorem-proving, considerable attention has been devoted to selection of an efficient proof search algorithm. [1], [2], [4], [6], [8], [10]. Nevertheless, at the present state of the art, the ease—even the feasibility— of automatic theorem proving in a given theory (e.g., group theory) is vitally affected by the choice of axioms and representations of theorem-candidates for the study of the theory. Indeed, the choice can be so important that it is difficult to find examples to compare search times for systems such as Al-8 with more efficient (with a given proof search algorithm) systems such as S3. With an unfortunate choice of axioms, the running times for quite simple theorems can be prohibitively long to obtain a numerical comparison. The figures for running times given in this section are for the PG1-PG5 series of theorem-proving programs developed at Argonne a number of years ago and more fully described in [8], [9], and [10]. PG5 has been singled out for use in most of the cases run because it provides the fairest basis for comparing diverse axiom systems, even though it is slower in some cases than some others in the P G 1 PG5 family. In order to obtain numerical comparisons for efficiency of axiom systems in ordinary first-order theories with no special treatment of equality, the demodulation apparatus of PG5 was disabled. It proved to be infeasible to obtain, with the programs available, conclusive efficiency comparisons for firstorder theories with equality, due to incompleteness difficulties introduced by the treatment of demodulation in those programs having special treatment of equality. First we shall consider the example of proving that in a group a right inverse exists. As is usually the case in automatic theorem proving, the procedure is to deny the existence of a right inverse and proceed to refute the denial by appeal to the axioms. In the vocabulary of Al-8, the denial is Rf(ay)e; for S3 it is Paye. PG5 obtained a refutation from S3 in less than one second, but could obtain no refutation from Al- 8 in the 288 seconds allowed for running the case. Some insight into the difficulties may perhaps be obtained by examining refutations in the two systems. One refutation from Aln-8 is as follows:
78
Collected Works of Larry Wos
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31.
Rxy Ryx Al-sym Rxy Ryz Rxz A2-trans Rf(f(xy)z)f(xf(yz)) A3-assoc Rxz Ryu Rf(xy)f(zu) A5-f-subst Rf(ex)x A6-1. ident Rf(g(x)x)e A7-1. inv Rxx A8-reflx Rf(ay)e denial A3-A1J, Rf(xf(yz))f(f(xy)z) Rxz Rf(xf(ey))f(zy) A6-A5 2 Rf(xf(ey))f(xy) IO1-A8 Rwf(zf(ex)) Rwf(zx) 11-A2 2 Rf(f(ze)x)f(zx) A3-12, Rwf(g(x)x) Rf(we) A7-A2! Rf(f(g(x)e)x)e 13-14! Rf(ax)y Rye 8-A2 3 Rf(ax)f(f(g(y)e)y) 15-162 Raf(g(y)e Rxy 17-A5 3 Raf(g(x)e A8-I82 Ryu Rf(f(g(x)x)y)f(eu;) A7-A5i Rf(f(g(x)x)y)f(ey) A8-20i Rwf(f(g(x)x)y) Rwf(ey) 21-A2 2 Rf(g(x)f(xz))f(ez) 9-22i Rwf(ez) Rwz A6-A2 2 Rf(g(x)f(xz))z 23-241 Rzf(g(x)f(xz)) 25-Ah Rf(g(x)f(xz))w Rzw 26-A2i Rf(g(x)f(xa))f(g(y)e) 19-272 28-A5 3 Rg(x)g(v) Rf(xa)e Rf(ya)e A8-29i A7-30
D
Contrast that refutation with the following one obtained from S3:
Axiom Systems in Automatic
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12.
Pexx Pg(x)xe Pxyu Pyzt Puzw Pxtw Pxyu Pyzt Pxtw Puzw Paye Pxya Pyzt Pxte Pxea Pxte Pg(t)ea Pg(t)yu Pyze Puza Pg(t)ye Pyae Pyae
D
Theorem Proving
79
B6-l.ident B7-1.inverse Bll B12 denial 5-44 l-6 2 2-7 2 8-3 4 l-9 3 2-lOj 11-2
For further contrast, we cite the following proof from A l - 8 using the special equality mechanisms of paramodulation. This proof suggests that A l - 8 (more precisely the subset {A3,A6,A7,A8}) is probably a better choice than S3 when such special mechanisms for equality are incorporated into the theorem-proving program. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.
Rf(f(xy)z)f(xf(yz)) Rf(ex)x Rf(g(x)x)e Rf(ay)e Rf(f(xg(z))z)f(xe) Rf(f(ez)f(g(g(z))e) Rzf(g(g(z))e) Rf(f(xe)z)f(xz) Rf(f(g(z)e)z)e Rf(zg(z)e)
D
A3 A6 A7 denial of theorem A7(f(g(x)x))-A3(f(yz)) A7(f(g(x)x))-5(f(xg(z)) A6(f(ex))-6(f(ez)) A6(f(ex))-A3(f(yz)) A7(f(g(x)x))-8(f(xz)) 7(f(g(g(z)e))-9(f(g(z)e)) 10-4
Similar results are obtained when the two systems S3 and A l - 8 are used to refute the denial that in a group, the left identity element is also a right identity. A refutation from A1-A8 looks much like that for right inverse. No refutation is obtained by PG5 from this set after 288 seconds, while less than one second is required for a refutation from S3. This is not surprising since short refutations such as the following are available from S3.
Collected Works of Larry Wos
80
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.
Pexx Pg(x)xe Pxyu Pyzt Pxyu Pyzt Paea Pxya Pyet Pxea Pxyu Pyze Pxye Pyae Pyae
Puzw Pxtw Pxtw Puzw Pxta Puza
D
B6 B7 Bll B12 denial 5-B12 4 B6-6 2 7-BII4 B6-83 B7-9i 10-B7
If we are correct in our conjecture that it is advantageous to use additional free variables and, if necessary, additional literals in order to avoid long terms as arguments, one would expect that adding, say, A l l and A12 (or replacing A3 by A l l - 1 2 ) might improve the performance of that set. PG5 does in fact get a proof of right identity from Al—8,11—12 in less than two seconds, while it failed to find a proof from A l - 8 alone in 288 seconds. If we go to slightly more difficult (to prove from the basic axioms) theorems such as that if in a group the square of every element is the identity then the group is commutative, we find that even S3 is sorely taxed. This is one of a large class of theorems for which proof-search efficiency is greatly improved by the addition of the logically dependent axioms B21-22 for right identity and right inverse. This phenomenon—that inclusion of dependent axioms does not always detract from proof search efficiency but may be a positive benefit, possibly even a necessity—is one of the more important insights into axiom selection, at least with the type of search algorithms we employ in our programs. The denial of the theorem above is Rf(xx)e A Rf(ab)c A Rf(ba)c for A l - 8 and Pxxe A Pabc A Pbac for S3. The proof from Al-8,A21-22 is again quite tedious: 1. 2.
Rxy Ryx Rxy Ryz Rxz
Al A2
Axiom Systems in Automatic
3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31. 32. 33. 34. 35.
Rf(f(xy)z)f(xf(yz)) Rxz Ryu Rf(xy)f(zu) Rf(ex)x Rxx Rf(xe)x Rf(xx)e Rf(ab)c Rf(ba)c Ref(xx) Rzu Rf(xz)f(xu) Rf(ue)f(uf(xx)) Rf(xf(yz))f(f(xy)z) Rf(uf(xx))z Rf(ue)z Rf(ue)f(f(ux)x) Ruf(ue) Rf(ue)z Ruz Ruf(f(ux)x) Rf(xu)f(xf(f(uw)w)) Ruf(xf(yz)) Ruf(f(xy)z) Rf(xu)f(f(xf(uw))w) Rzu Rf(zy)f(uy) Rf(f(zz)yf(ey) Rxf(f(zz)y) Rxf(ey) Rf(f(uw)u)f(ow) Rxf(ez) Rxz Rf(f(uw)u)w Rxf(ab) Rxc Rf(ba)f(ab) Rf(ab)f(ba) Rf(ab)y Ryf(ba) Rf(f(f(ab)z)z)f(ba) Rf(f(ab)a)b
D
Theorem Proving
81
A3 A5 A6 A8 A21 denial of // « // // 8-Al! A8-A5j 11-12! A3-Ah 13-A2! 14-lSj A21-A1, 17-A2i 16-18! 19-12i 14-A22 20-21; A8-A5 2 8-23, 24-A2 2 22-25i A6-A2 2 26-27i 9-A22 10-292 30-Al 2 31-A2 3 19-32i 33-23 2 34-28
The proof from S3 U {B21,B22} is, as before, shorter (still shorter proofs than the one given below have been obtained by the computer): 1. 2. 3. 4. 5.
Pexx Pxex Pxg(x)e Pxyu Pyzt Puzw Pxtw Pxyu Pyzt Pxtw Puzw
B6 B21 B22 Bll B12
Collected Works of Larry Wos
82
6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20.
Pxxe Pabc Pbac Pxye Pywt Pytw Pywt Pytw Pacb Pyzt Pezw Pytw Pbza Pezc Pwyu Pyze Puzw Pg(w)ze Pezw Peg(w)w Pbg(c)a Pwyu Pug(y)w Pbg(c)a
□
denial // n l-4 3 6-9i 7-10! 6-4! 8-12 3 2-5 3 3-14! 6-15! 16-13 2 3-142 ll-18i 17-19
References 1. Kowalski, R., and Hayes, P. "Semantic trees in automatic theorem proving," Machine Intelligence IV, ed. by D. Michie and B. Meltzer (1969). 2. Luckhain, D. "Some tree-paring strategies for theorem-proving." Machine Intelligence III, ed. by D. Michie, Edinburgh Univ. Press, Edinburgh (1968). 3. Robinson, A. Model theory and the mathematics Amsterdam (1963).
of algebra. North Holland,
4. Robinson. G., and Wos, L. "Paramodulation and theorem-proving in firstorder theories with equality." Machine Intelligence IV, ed. by D. Michie and B. Meltzer (1969). 5. Robinson, .1. "A machine-oriented logic based on the resolution principle." J. ACM ii? (1965), pp. 23-41. 6. Slagle, J. "Automatic theorem proving with renumerable and semantic res olution." J. ACM 14 (1967), pp. 687-697. 7. Suppes, P. Introduction to Logic, Prentice Hall, New York (1957). 8. Wos, L., Carson, D., and Robinson, G. "The unit preference strategy in theorem proving." AFIPS Conf. Proc. 26, Spartan Books, Washington D.C. (1964), pp. 615-621. 9. Wos, L., Robinson, G., and Carson, D. "Efficiency and completeness of the set of support strategy in theorem proving." J. ACM 12 (1965), pp. 536-541. 10. Wos, L., Robinson, G., Carson, D., and Shalla, L. "The concept of demod ulation in theorem proving." J. ACM 14 (1967), pp. 698-709.
Paramodulation and Theorem-proving in First-Order Theories with Equality
G. R o b i n s o n Stanford Linear Accelerator Center Stanford, California and L. W o s Argonne National Laboratory Argonne, Illinois
INTRODUCTION A term is an individual constant or variable or an roadie function letter followed by n terms. An atomic formula is an riradic predicate letter followed by n terms. A literal is an atomic formula or the negation thereof. A clause is a set of literals and is thought of as representing the universally-quantified disjunction of its members. It will sometimes be notationally convenient 1 to distinguish between the empty clause Q , viewed as a clause, and 'other' empty sets such as the empty set of clauses, even though all these empty sets are the same settheoretic object <j>. A ground clause (term, literal) is one with no variables. A clause C" (literal, term) is an instance of another clause C (literal, term) if there is a uniform replacement of the variables in C by terms that transform C into C. The Herbrand universe Hs of a set S of clauses is the set of all terms that can be formed from the function letters and individual constants occurring in S (with the proviso that if S contains no individual constant, the constant a is used). An interpretation I of a set S of clauses is a set of ground literals such that for each atomic formula F that can be formed from an n-adic predicate letter occurring in S and n terms from Hs, exactly one of the literals F or F (the negation of F ) is in / . Reprinted with permission from Fourth Annual Machine Intelligence Workshop, Edin burgh, Scotland, Aug. 12-21, 1968, in Machine Intelligence, Vol. IV, ed. D. Michie and R. Meltzer, pp. 135-150 (1969) 1 Note, for example, that the empty set is a satisfiable set of clauses but at the same time is an unsatisfiable clause.
Collected Works of Larry Wos
84
For any set J of literals, J is the set of negations of members of J. The set J satisfies a ground clause C if J D C ^ 4> and condemns C if C - J = . J satisfies a non-ground cluase C if it satisfies every instance of C and condemns Cif it condemns some instance of C. A clause (possibly ground) that is neither satisfied nor condemned by J is said to be undefined for J; otherwise it is defined for J. J satisfies a set S of clauses if it satisfies every clause in S and condemns S if it condemns some clause in S. An R-interpretation of a set S of clauses is an interpretation I of S having the following properties: Let a, (5, and 7 be any terms in Hs and L any literal in /. Then 1. (a = a) e I 2. If (a = /?) € / then (0 = a) e I 3. U (a = P) £ I and ((3 = 7) e /, then (a = 7) 6 /. 4. If L' is the result of replacing some one occurrence of a in L by /? and (a = /?) € /■, then L' S /. An {R-)model of S is an (iJ-)interpretation of S that satisfies »S'. A set S of clauses is (R-)satisfiable if there is an (/?-)model of S; otherwise it is (R-)unsatisfiable. If S is a set of clauses or a single clause and T is a set of clauses or a single clause, S(R-)implies T (abbreviation S \= T or S \= RT) if no (.ft-)model of S condemns T. A deductive system W is (R-)deduction-complete if S h w'f\T is deducible from S in the system W) whenever S \= T (S [= R T). W is (R-)refutationcomplete if 5 h vvC] whenever S is (/?-)unsatisfiable. EQUALITY IN AUTOMATIC THEOREM-PROVING The methods for dealing with the concept of equality in theorem-proving can be grouped roughly into three classes: (1) those which employ a set of first-order axioms for equality, for example, the following set (which we shall call E(K), where K is the set of first-order sentences under study): (i) (x t )(xi
=xi)
(ii) (xi)...(xn)(x0)(xj (iii) (x1)...{xn)(x0){xj
^ i j V P i ! ...Xj...xn J^XQVf(xi
...Xj...xn)
V Pxi = /(ii
...x0...xn) (j =
l,...,n)
...x0...xn)) (j = l , . . . , n )
where n axioms of the form (ii) are included for each n-adic (n > 0) predicate letter P occurring in K, and n axioms of the form (iii) are included for each
Paramodulation
and
Theorem-Proving
F
85
G
E B
F
Figure 1 n-adic (n > 0) function letter in K2; (2) those which employ a smaller set of second-order axioms for equality; and (3) those which employ a substitution rule for equals as a rule of inference. SOME DESIRABLE PROPERTIES F O R THEOREM-PROVING ALGORITHMS In addition to the logical properties of soundness and completeness, two sets of somewhat more elusive properties are of interest in judging the usefulness of the inference apparatus for automatic theorem-proving. The first set, efficiency, brevity, and naturalness, are global properties in that they deal with the entire proof or proof-search, and are of interest in them selves. Efficiency refers to the ease or dispatch with which the search procedure locates a proof. Brevity refers to the lengths of proofs found. Naturalness refers to being in the spirit of what a human mathematician might write in a proof. Other factors being equal, a briefer proof might be considered more natural, but naturalness goes beyond this. For example, among proofs of roughly the same length, a unit resolution proof3 might be considered more natural than a non-unit proof. The second set, immediacy, convergence, and generality, are local properties in that they focus on only a small part of the proof or proof-search and are of interest primarily because they contribute to other properties such as efficiency. Immediacy is rather easily grasped. One inference apparatus A is said to be more immediate than another apparatus B (at least for the case in question) when A enables one to deduce a given conclusion from a given set of hypotheses in fewer steps than B. For example (see figure 1), if to infer F from I) and E by B one first had to infer G from D and only then infer F from E and G, while A allowed the inference of F directly from D and E in one step without recourse 2
Note that an interpretation / of K is an fl-interpretation of K iff it satisfies E(K). In effect one that is free from simultaneous case-analysis type reasoning and which prefers modus ponens to syllogism—formally, one in which non-unit clauses are never resolved against each other. 3
86
Collected Works of Larry
Wos
to G, then A would (for this case) be more immediate than B. Convergence is a slightly subtler but, for automatic theorem-proving, per haps more important property. Consider the clause G in the example above. Often such an intermediate result will seriously detract from proof-search effi ciency by interacting with other clauses t o produce unnecessary 'noise' in the proof-search space, either by generating successive generations of less than help ful clauses, or, somewhat less seriously, by requiring additional machine time to determine that no interesting clauses can be inferred from G. Freedom from this generation of 'side-effect' clauses we call convergence. Thus in the example, A is both more immediate and more convergent than B. Generality refers to choosing to infer a clause C rather than a proper instance of C, when either inference could be made from the premises without loss of soundness. For example, inferring from f(xa) = g(x) and Qf(xa) the conclusion Qg{b), although sound, would be less general than inferring Qg(x). It is not difficult to see the advantage of inferring a clause rather than a proper instance of that clause, since the more general clause, being stronger, has greater potential for future inferences. Perhaps even easier to see is the problem of deciding which proper instance to select if a proper instance were to be preferred to the more general clause. Usually there is an infinite set of proper instances. For example, from h(xyy) = g(x) and Qh(zww)a, we can infer Qg(x)a by substitution. There is, however, an infinite set of proper in stances of Qg(x)a which could also be legitimately inferred. Among these are Qg(a)a, Qg(g(a))a, Qg(g(g(a)))a.... We shall apply the phrase most general to a clause (or term) C with respect to some given condition when C satisfies the condition and no clause (term) which satisfies the condition has C as a proper instance. Of the approaches to equality described above, approach 1 has three obvious disadvantages. One has to do with length of deduction chains in the proof. In order to infer from (1) Qa and (2) a = b the result (3) Qb one must first infer from the axiom (4)
x^yVQxVQy
and, say (1), the intermediate result (5)
a^yVQy,
before passing from (5) and (2) to (3). By contrast, approach 3 would allow us to go directly from (1) and (2) to (3) without ever inferring the intermediate
Paramodulation
and
Theorem-Proving
87
result (5). Thus approach 3 contributes to brevity of proofs. More important for proof search, it contributes (by means of immediacy) to brevity of deduction chains within proofs. A second, and perhaps more serious disadvantage of approach 1 as com pared to approach 3, is that the intermediate debris such as step (5) tends to spawn increasingly larger generations of generally useless offspring, polluting the search space badly. We describe this difference by saying that approach 3 tends to be more convergent than approach 1. (Presence of various subsidiary strategies, such as set-of-support, may possibly mitigate the severity of such non-convergence effects.) The third disadvantage of approach 1 is perhaps the least important, al though superficially the most obvious: the equality axioms E(K) must be present. The clerical chore of writing them all down could be eliminated merely by in corporating into the theorem-prover a program to generate them. Alternatively they may be specified by means of a schema (we shall call this variation ap proach lb), or in approach 2 by means of a few second-order axioms. We feel that this third disadvantage is so superficial and trivial (since one can simply place E(K) outside the set of support as is done in the standard set-of-support variant of approach 1) as to be quite spurious. The method given by Darlington (1968), whether it be classed as approach l b or as approach 2, can be taken as typical of methods which avoid the third disadvantage (greater number of explicit axioms) but fail to dent the first and second disadvantages (longer deduction chains and non-convergence). In effect Darlington infers (5) from (1) and
(4')
x?y\/tp(x)\/
which is thought of either as a schema defining a set of first-order axioms in cluding (4), or as a single second-order axiom having (4) as an instance. PARAMODULATION Since our automatic theorem-proving environment consists exclusively of clauses, we should like our rule of inference for equality to operate on two clauses and yield a clause. Furthermore, we should like it to apply to units and non-units alike 4 and to yield a most general clause t h a t can be fl-soundly inferred. We shall now describe the inference rule for paramodulation, which is asserted to have these properties. Examples of paramodulation are given in figure 2. 5 Paramodulation: Given clauses A and a' = 13' V B (or 0' = a' V B) having no variable in common and such that A contains a term 6, with S and a' having 4 Consider for example the set S = {c = d V Qc,g(c) / g(d) V Qc,a = bV Qc,g(a) £ g(b) V Qc,x = x}. If the rule applied only to units, it would not be possible to this /?-unsatisfiable set. s These examples are primarily to give an intuitive idea of how paramodulation works. A comparison of the length and complexity of paramodulation proofs against resolution proofs can be obtained by considering the proofs of the theorem from group theory to the effect that I 3 = e implies ((x, y), y) = e. The resolution proof is 136 steps long while the paramodulation proof is 47 steps long. These proofs appear in the appendix.
Collected Works of Larry Wos
88
a most general common instance a identical to a'[si/ui] and to 5[tj/u>j], form A' by replacing in A[tj/wj] some single occurrence of a (resulting from an occurrence of 6)c' by (3"{Si/ui\, and infer A' V B[s»/ujj. 7 From a superficial point of view, paramodulation might be described as 'a substitution rule for equality'. Indeed, the motivation given above for studying the rule has dwelt principally on that aspect of paramodulation. But to consider it as only substitution of equals for equals would be to make a mistake analogous to characterizing resolution as merely syllogistic inference akin to that employed by Davis and Putnam (1960). T h e property of maximum generality provided by paramodulation must not be overlooked if the process is to be fully understood. Example 1 1. o = b 2. Qa 3. .-. Qb Example 5 l . i = h(x) 2- Qg(y) 3- ••• Qh(g(y))
Example 2 1. a = b 2. Qx 3. .-. Qb
Example 3 1. a = b 2. Qx V Pa; 3. .-. QbV Pa
Example 6 1. a = b 2. Qf(g(h(j(a)))) 3..-. Qf(g(KJ(b))))
Example 4 1. a = 6 2. Qx V Px 3./.QaVPb
Example 7 1. f(xg(x)) = e 2. Pyf(g(y)z)z 3. .-. Fye S ( 5 (y))
Example 8. If x2 = e for all x in a group, the group is commutative. 1. f(ex) = x 2. f(xe) = x 3. f(xf(yz)) =-- f(f(xy)z) A. f(xx) = e 5. f{ab) = c 6. c / f(ba) 7. f{xe) = f(f(xy)y) 4 into 3 with (5: f(yz) 8.x = f(f(xy)y) 2 into 7 on f(xe) 9. a = f(cb) 5 into 8 on f(xy) 10. f(yf(yz)) = f(ez) 4 into 3 on f(xy) 1 into 10 on f(ez) ii- f(yf(yz)) = z 9 into 11 on f(yz) 12. f(ca) = b 13. c = /(6a) 12 into 8 on f{xy) 14. □ 13 resolved with 6 Figure 2 Consider the following example: 6 Without this restriction one could infer from a = b and Qxa V Px the clause Qab V Pa (a proper instance of the paramodulant Qxb V Px), resulting in a loss of generality. 7 Since every non-trivial immediate modulant (see Wos et at., 1967b) of a clause is a paramodulant, any clause obtained by demodulation can be obtained by repeated para modulation.
Paramodu/ation and Theorem-Proving
89
From f(xg(x)) = e V Qx and Pyf(g(y)z)z V Wz one can infer Pye9i9(y))VQo(y)V Wg(g(y)) by paramodulating with f(xg(x)) as a ' and f(g(y)z) as 5.
COMPLETENESS OF PARAMODULATION FOR BASIC G R O U P T H E O R Y Consider the following clauses from the first-order theory of groups: Al A2 A3 A4 A5 A6 A7 A8 A9 AlO All Al2 Al3 Al4
Pxyf(xy) Pexx Pg(x)xe Pxyu V Pyzv V Puzw V Pxvw Pxyz V Pxyu V z = u Z =fc U\I Pxyz V Pxyu z ^ t i V Pxzy V Pxuy z / u V Pzxy V P u x y x —x x ^ y Vy = x x ^ yS y ^ z\l x = z x ^ yV f{xz) = f{yz) x ^ yV f{zx) = f{zy) x / y V
closure left identity left inverse associativity (case 1) uniqueness of product substitution (3rd position) substitution (2nd position) substitution (1st position) reflexivity symmetry transitivity /-substitution (1st position) /-substitution (2nd position) ^-substitution
Let us define a basic set 5 of clauses of group theory to be a set over the vo cabulary of A1-A14 and such that S r- { A l , . . . , A5}. We then have the following completeness result for the special case of basic sets. Theorem: If S is a satisfiable, fully paramodulated, fully factored, basic set of clauses of group theory, then S is .R-satisfiable. Proof: Let M be a maximal model 8 of S. Suppose that a = fi and P*)b~a are both in M. By the maximality of M, there must be clauses A and B in S having instances A':a = f3V K and B'\ P-ySa V L with KnM =
8 The concept of maximal model is defined and the pertinent existence theorem proved in Wos and Robinson (1968a). For the present purpose a maximal model of S may be thought of as a model M such that for each positive literal 1 in M there is an instance C of some C in 5 with C" n M = {x}. 9 Robinson and Wos (1967c).
90
Collected Works of Larry Wos
COMPLETENESS OF PARAMODULATION FOR FUNCTIONALLY-REFLEXIVE SYSTEMS Paramodulation is intended to be utilized, along with resolution, for theoremproving in first-order theories with equality.10 We first give an algorithm for generating a refutation (of a finite set of clauses) employing paramodulation and resolution if such a refutation exists. Full Search Algorithm (FSA) : Let So be the set of all factors of the given set S of clauses.11 For odd i > 0 let Si be formed from Sj_i by adding all clauses that can be obtained by paramodulating two clauses in Si_i. For even i > 0 let Si be formed from Si-i by adding all factors of clauses that can be obtained by resolving two clauses in S,_i. Since each deduction from 5 is contained in Sn for some n, each refutation of S must be contained in Sn for some n. Each Sj is finite. If Sj contains Q , a refutation has been found, so stop. Otherwise form Sj+i. Now, to prove that paramodulation and resolution are complete for theoremproving in first-order theories with equality, we would like to show that FSA is a semi-decision procedure for fl-unsatisfiability. The difficult part is to show that, for fl-unsatisfiable sets of clauses, there exists a refutation, namely, that paramodulation plus resolution is /^-refutation complete. It will suffice to show that an unsatisfiable set can be deduced from an A-unsatisfiable set, since (due to the refutation-completeness of resolution) FSA will generate a refutation if it ever generates an unsatisfiable set. A functionally-reflexive system S is defined as one for which S h x\ = X\ and S I- f(x\,..., xn) = f{x\ ,•■-, xn) for every function letter / occurring in the vocabulary of S, n being the degree of / . There are h +1 such unit clauses, where h is the number of function letters in the vocabulary of S. For such systems refutation-completeness is proved in Wos and Robinson (1968c).12 From that result one can obtain the following corollary: If S is a finite functionally-reflexive set of clauses, FSA is a semidecision procedure for .ff-unsatisfiability. Even for theories that do not happen to be functionally reflexive, this result shows that adding the h + 1 functional-reflexivity unit clauses before applying FSA gives a general semi-decision procedure for .ft-unsatisfiability. FURTHER COMPLETENESS RESULTS FOR PARAMODULATION Since first-order theories are not usually functionally-reflexive when the only rules are resolution and paramodulation, and since adding the functionalThe earliest formulations of paramodulation were designed to operate without resolution and could be shown to subsume resolution as a special case. It is felt, however, that the processes can be better understood if the inference apparatus not involving equality is isolated from the apparatus for equality, even if this means that some of the completeness theorems cannot be stated in quite as pat a fashion. 1 Every clause is a factor of itself as in G. Robinson et al. (1964b). For further definitions of factoring and resolution see Wos et al. (1964a) and J. Robinson (1965). 12 A weaker version of this result was given in the earlier (1968b) paper.
Paramodulation
and
Theorem-Proving
91
reflexivity units to the theory may detract somewhat from proof-search effi ciency, one would wish to show that some weaker assumption than functionalrefiexivity will suffice for completeness. It seems that at least S h x = x will be needed. (Consider the case where S consists of {a ^ a } . S is .R-unsatisfiable but cannot be refuted without some sort of help from reflexivity.) This is not surprising, since the standard texts on logic that use the substitution rule or schema approach to equality consistently supply a separate reflexivity axiom. 1 3 But is simple reflexivity (x = x) enough? We think so, 14 although a proof of this is not yet available. To see where the difficulty lies in generalizing the proof given in Wos and Robinson (1968c) beyond the functionally-reflexive case, we examine the rela tion between deductions and refutations based on a given set 5 and those based on proper instances of clauses from S. Capturing Lemma}5: Let 5 be a fully paramodulated and fully resolved set of clauses such that S h x = x, and let A' and B' be instances of clauses A and B in S and let C be the result of paramodulating from a term a' in A' into an occurrence Jo of a term in B'. Then Strong subterm form: There is a clause C in S with C" as an instance. Restricted subterm form: If B has a term in the same position as that of do in B', then there is a clause C in S with C" as an instance. (Occurrences of terms in two literals are said to be in the same position if each is the ii-st argument of the i2-nd argument of . . . of the i n -th argument of its literal.) Argument form: If S is an argument of B' (as opposed to a proper subterm of an argument), then there is a clause C in S with C" as an instance. When the strong subterm form of the capturing lemma holds and S I- x = x, every maximal model (with respect to positive literals) of S is an ft-model, and since every satisfiabh: set S has a maximal model, it follows that either | I € 5 or S is /?-satisfiable. Thus the strong subterm form of the capturing lemma and simple reflexivity imply /^-refutation-completeness. The line of proof given for /^-refutation-completeness in functionally-reflexive systems in (1968c) depends (at least indirectly) on the strong subterm form, which happens to hold in such systems. 1 6 The following example will suffice to show however that the strong subterm form is not universally true:
13
See, e.g., Church (1956) or Quine (1963). In the two years that paramodulation has been under study, no counterexample has been found to the /{-refutation completeness of paramodulation and resolution for simply-reflexive systems. I5 The analogue of this capturing lemma for resolution alone plays a basic role in proving the refutation-completeness of resolution (see J. Robinson, 1965 and Slagle, 1967) and of set-of-support (Wos et al., 1965). 16 Alternatively, one can view the difficulty as resulting from the fact that it is not always possible to satisfy the hypotheses of the restricted subterm form. 14
Collected Works of Larry Wos
92
S: {x = x,a= b,b = a,a = a,b = b, Qxg(x), Qag(a), Qbg(b), Qag(b), A: a — b A': a = b B: Qxg(x) B': Qg(a)g(g(a)) C: Qg(b)g(g(a))
Qbg(a)}
S is fully paramodulated and (vacuously) fully resolved. A' and B' paramodulate on a into the first occurrence of a in B' to give C". But C" is an instance of no clause in S. (The restricted subterm form of the lemma is not violated since B has no term in the same position as the first occurrence of a in B'. Neither is the argument form of the lemma, since a is not an argument of B'.) Functionalreflexivity of S, if present, would dispose of the difficulty since, if g(x) = g(x) were in S, so would g(a) = g(b) be in 5 if it were fully paramodulated; and hence the result Qg(b)g(g(a)) of paramodulating g(a) = g(b) and Qxg(x) would be in S and serve as C. Weakening the strong subterm capturing lemma in a different fashion leads to the Refutation Capturing Lemma: If there exists a refutation of a set of in stances of clauses in a set S by means of paramodulation and resolution, then there exists a refutation of S itself by means of paramodulation and resolution. For functionally-reflexive S, this lemma may be proved by noting that the refutability of a set of instances of S and /^-soundness of paramodulation and resolution yield the .ft-unsatisfiability of S; so that the refutation-completeness of paramodulation and resolution for functionally-reflexive systems establishes the refutability of S itself. Given the refutation capturing lemma one could prove the following: General Refutation-Completeness: If S is a fully paramodulated and fully resolved .R-unsatisfiable set and if 5 I- x = x, then l~l £ 5. Corollary: FSA is a semi-decision procedure for .R-unsatisfiability for finite sets S of clauses such that 5 h x = x. Conversely, given general refutation-completeness, one can prove the refu tation capturing lemma (at least for systems S such that 5 H x = x). In view of this equivalence, proof of the refutation capturing lemma can be considered the most pressing unsolved problem in the theory of paramodulation. Alterna tively, one might seek a proof of general refutation-completeness based on the restricted subterm form of the capturing lemma, which holds even when the assumption of functional reflexivity is suppressed. Acknowledgement This work was supported by the US Atomic Energy Commission.
References Church, A. (1956) Introduction
to mathematical
logic I. Princeton.
Paramoduiation and
Theorem-proving
93
Darlington, J.L. (1968) Automatic theorem proving with equality substitu tions and mathematical induction. Machine Intelligence 3, pp. 113-27 (ed. Michie, D.). Edinburgh: Edinburgh University Press. Davis, M. & Putnam, H. (1960) A computing procedure for quantification the ory. J. Assn. Comput. Mach., 7, 201-15. Quine, W.V.O. (1963) Set theory and its logic. Cambridge, Mass: Harvard Uni versity Press. Robinson, J.A. (1965) A machine-oriented logic based on the resolution princi ple. J. Assn. Comput. Mach., 12, 23-41. Slagle, J.R. (1967) Automatic theorem proving with renamable and semantic resolution. J. Assn. Comput. Mach., 14, pp. 687-97. Wos, L., Carson, D. & Robinson, G. (1964a) The unit-preference strategy in the orem proving, AFIPS Conference Proceedings, 26, Washington D.C.: Spartan Books, 615-21. Robinson, G.A., Wos, L.T. & Carson, D. (1964b) Some theorem-proving strategies and their implementation. AMD Tech. Memo No. 72, Argonne National Laboratory. Wos, L., Robinson, G.A. & Carson, D.F. (1965) Efficiency and completeness of the set of support strategy in theorem proving. J. Assn. Comput. Mach., 12, 536-41. Robinson, G.A., Wos, L. & Shalla, L. (1967a) Two inference rules for firstorder predicate with equality. AMD Tech. Memo No. 142, Argonne National Laboratory. Wos, L., Robinson, G.A., Carson, D.F. & Shalla, L. (1967b) The concept of demodulation in theorem proving. J. Assn. Comput. Mach., 14, 698-709. Robinson, G. & Wos, L. (1967c) Dependence of equality axioms in elementary group theory. Comp. Group Tech. Memo No. 53, Stanford Linear Accelerator Center. Wos, L. & Robinson, G. (1968a), The maximal model theorem. Spring 1968 meeting of Assn. for Symbolic Logic. Abstract to appear in J. Symb. Logic. Robinson, G. & Wos., L. (1968b) Completeness of paramoduiation. Spring 1968 meeting of Assn. for Symbolic Logic. Abstract to appear in J. Symb. Logic. Wos, L. & Robinson, G. (1968c) Maximal models and refutation completeness (unpublished).
Collected Works of Larry Wos
94
APPENDIX
Paramodulation versus resolution Problem: x3 = e implies ((x, y),y) = e where (x,y) = xyx _ 1 y _ 1 Reference: Group Theory by Marshall Hall, page 322, 18.2.8. Refutation by Paramodulation 1. /(ex) = x 2. /(are) = x 3. /(
Paramodulation
and
Theorem-proving
95
33. f(f(f(f(ab)g(a))g(h(ab)))g(b)) * e, f(xe) /(/(/(o6)»(a))c)of32 34. f(f(f(f(ab)g(a))f(bf(af(g(b)g(a)))))g(b)) g{h(ab)) of 33 35. f(f(I(f(ab)f(aa))f(bf(af(g(b)g(a)))))g(b)) 36. f(f(f(f(f(ab)f(aa))b)f(af(g(b)g(a))))g(b)) f(f(f(ab)f(aa))f(bf(af(g(b)g(a))))) 37. f(f(f(f(f(f(ab)f(aa))b)a)f(g(b)g(a)))g(b)) f(f(f(f(ab)f(aa))b)f(af(g(b)g(a)))) 38. f(f(f(f(f(f(f(ab)a)a)b)a)f(g(b)g(a)))g(b)) f(f(ab)f(aa)) of 37 39. f(f(f(f(f(f(ab)a)f(ab))a)f(g(b)g(a)))g(b)) f(f(f(f(ab)a)a)b) of 38 40. f(f(f(f(f(ab)a)f(f(ab)a))f(g(b)g(a)))g(b)) f(f(f(f(ab)a)f(ab))a) of 39 41- f(f(f(f(ab)a)f(f(ab)a))f(f(g(b)g(a))g(b))) f(f(f(f(f(ab)a)f(f(ab)a))f(g(b)g(a)))g(b)) 42. f(f(f(f(ab)a)f(f(ab)a))f(g(f(ab)))g(b)) /( 5 (6)
of 2 into ± e,g(h(xy))
± e, g(x) of 17 into »(a) of 34 ft e,f(xf(yz)) of 5 into of 35 ± e,f(xf(yz)) of 5 into of 36 ji e,f(xf(yz)) of 5 into ji e,f(f(xy))z)
7 contradicts 47.
of 5 into
ft e,f(f(xy)z)
of 5 into
? e,f(f(xy)z) of 40 * e,f(g(y)g(x))
of 5 into of 23 into
ft e,g(x) of 17 into ft e,f(xf(yz))
of 5 into
ft e,f(f(xy)z)
of 5 into
e,f(xg(x))
of 4 into
/(6 5 (6))of45 47. f(f(f(f(ab)a)f(f(ab)a))f(f(ab)a)) f(f(f(f(ab)a)f(f(ab)a))f(f(f(ab)a)e))
of 28 into
ft e,f(xe)
of 2 into of 46
Collected Works of Larry Wos
96
Paramodulation versus resolution Problem: x3 = e implies ((x,y),y) = e. Refutation by Resolution 1. /(ex) = x 2. f(xe) = x 3. /(e(x)x) = e 4. f(xg(x)) = e 5. f(xf(yz)) = f{f(xy)z) 6. x = x l.x±y y~x 8. x ^ y y j^ z x = z 9. u / t » f{ux) = f(wx) 10. u j£ w f(xu) = f(xw) 11. u =fi w g(u) = g(w) 12. f{f{xx)x) = e 13. h{xy) = f(f(f(xy)g(x))g(y)) 14. h(h(ab)b) ^ e 15. i ^ }{ew) x = w, 1 and 82 16. f(f(xg(x))w) = f(ew), 4 and 9i 17. f(f(xy)z) ^ to f(xf(yz)) = w, 5 and 8! 18- f(xf(g(x)z)) = f(ez), 16 and 17x 19. /(x/(p(ar)«)) = 2, 18 and 15i 20. f(uf{yg(y))) = /(we), 4 and W, 21. f(ue) = f(uf(yg(y))), 20 and 7: 22. f{uf{yg{y))) ± z fine) = 2, 21 and 81 23. /(xe) = g(g(x)), 19 and 22L 24. x = /(xe), 2 and 7X 25. /(xe) ^ 2 x = 2, 24 and 8j 26. x = g{g(x)), 23 and 25! 27. f{f(f(uu)u)y) = f(ey), 12 and 9, 28. /(/(/(uu)u)y) = y, 27 and 15i 29. f(f(xx)f(xy)) = y, 28 and 17j 30. /(/(xx)e) = p(x), 29 and 22i 31. /(xx) = g(x), 30 and 25, 32. f(xe)=f(f(xy)g(y)), 5 and 22i 33. x = f(f(xy)g(y)), 32 and 25! 34. /(xz) = f(f(f(xy)g(y))z), 33 and 9j 35. f(f(f(xy)g(y))z) = f(xz), 34 and 7j 36. f(f(xy)f(g(y)z)) = f(xz), 35 and 17i 37. x 7^ f(ug(u)) x = e, 4 and 82 38. f(f(xy)f(g(y)g(x))) = e, 36 and 37, 39. e = f(f(xy)f(g(y)g(x))), 38 and 7i
Paramodulation
and
Theorem-proving
40. f(we) = f(wf(f(xy)f(g(y)g(x)))), 39 and 10, 41. u ^ f(xf(yz)) u = f(f(xy)z), 5 and 8 2 42. f(ue) = f(f(uf{xy))f(g(y)g(x))), 40 and 41i 43. u = f(f(uf(xy))f(g(y)g(x))), 42 and 25, 44. f{f{g(x)x)u) = f(eu), 3 and 9, 45. z ± f{f(g{x)x)u) z = f(eu), 44 and 8 2 46. ff(/(iy)) = f(ef(g(y)g(x)))1 43 and 45! 47. g(f(xy)) = /(ff(y)s(a:)), 46 and 15, 48. g(h(xy)) = g(f(f(f(xy)g(x))g(y))), 13 and 11, 49. u £ g{f{xy)) u - f(g(y)g{x)), 47 and 8 2 50. g(h(xy)) = f(g(g(y))g(f(f(xy)g(x)))), 48 and 49, 51. g(g{x)) = x, 26 and 7, 52. f{g{g(u))z) = f(uz), 51 and 9, 53. x ± f(g(g(u))z) - f(uz), 52 and 8 2 54. g(h(xy)) = f(yg(f(f(xy)g(x)))), 50 and 53, 55. f(zg(f(xy))) = f(zf(g(y)g(x))), 47 and 9, 56. u ± f(zg(f(xy))) u = f(zf(g(y)g(x))), 55 and 8 2 57. g(h(xy)) = f(yf(g(g(x))g(f(xy)))), 54 and 56, 58. f(yf(g(g(u))z)) - f(yf(uz)), 52 and 10, 59.15^ /(t//(ff(9(u))z)) x = f(yf(uz)), 58 and 8 2 60. g(h{xy)) = f(yf(xg(f{xy))))y 57 and 59, 61. f(uf(zg(f(xy)))) = f(uf(zf(g(y)g(x)))), 55 and 10, 62. u> ^ f(uf(zg(f(xy)))) w = f(uf(zf(g(y)g(x)))), 61 and 8 2 63. 9 (/i(xy)) = f(yf(xf(g(y)g(x)))), 60 and 62, 64. f(zg(h(xy))) = f(zf(yf(xf(g(y)g(x))))), 60 and 62, 65. f(wf(zg(h(xy)))) = f(wf(zf(yf(xf(g(y)g(x)))))), 64 and 10, 66. f(uf(wf(zg(h(xy))))) = f(uf(wf(zf(yf(xf(g(y)g(x))))))), 65 and 10, 67. f(uf(wf(zg(h(xy))))) = f(f(uw)f(zf(yf(xf(g(y)g(x)))))), 66 and 41, 68. nuf(wf(zg(h(xy))))) = nnf(uw)z)f(yf(xf(g(y)g(x))))), 67 and 41, 69. f(f(xy)z) = f(xf(yz)), 5 and 7, 70. f{xf(yz)) ^ u f(f{xy)z) = u, 69 and 8, 71. f(f(uw)f(zg(h(xy)))) = f(f(f(uw)z)f(yf(xf(g(y)g(x))))), 68 and 70, 72. f(nf(uw)z)g(h(xy))) = f(f(f(uw)z)f(yf(xf(g(y)g(x)))))), 71 and 70, 73. f{nnnxy)z)g{h{xy)))u) = f(f(f(f(xy)z)f(yf(xf(g(y)g(x)))))u), 72 and 9, 74. f(h(xy)z) = f(f(Hf(xy)g(x))g(y))z), 13 and 9, 75. u ± f(f(xy)z) u = f(xf{yz)), 69 and 8 2 76. f(h(xy)z) = f(f(f(xy)g(x))f(g(y)z)), 74 and 75, 77. /(uf(g(x)x)) = f(ue), 3 and 10, 78. z yt f(uf{g{x)x)) z = f{ue), 77 and 8 2 79. f(h(xy)y) = f(f(f(xy)g(x))e), 76 and 78, 80. u / f[xe) u = x, 2 and 8 2 81. f(h{xy)y) = f{f{xy)g{x)), 79 and 80, 82. f(f(h(xy)y)z) = f(f(f(xy)g(x))z), 81 and 9, 83. f(f(f(h(xy)y)z)w) = f(f(f(f(xy)g(x))z)w), 82 and 9, 84. h(h{ab)b) +y y / e, 14 and 8 2 85. f(f(f(h(ab)b)g(h(ab)))g(b)) + e, 13 and 84,
97
98
86. 87. 88. 89. 90. 91. 92. 93. 94. 95. 96. 97. 98. 99100. 101. 102. 103. 104. 105. 106. 107. 108. 109. HOHI112. 113114. 115116117. 118119. 120. 121. 122. 123. 124. 125. 126. 127. 128. 129. 130.
Collected Works of Larry Wos
f(f(f(h(ab)b)g(h(ab)))g(b)) ± y y ± e, 85 and 8 3 f(f(f(f(ab)g(a))g(h(ab)))g(b)) # e, 83 and 86! f{f(f(f(ab)b(a))b(h(ab)))g(b)) ±y y * e, 87 and 8 3 f(f(f(f(ab)g(a))f(bf(af(g(b)g(a))))g(b)) / e, 73 and 88! g{x) = f(xx), 31 and 7i /(u>s(x)) = f(wf(xx)), 90 and 10! f{uf(wg{x))) = f(uf(wf(xx))), 91 and 10, f(uf(wg(x))) = f(f(uw)f(xx)), 92 and 4 1 , / ( / H s ( i j ) = / ( / ( u w ) / ( i i j ) , 93 and 70! f(f(f{uw)g(x))y) = f(f(f(uw)f(xx))y), 94 and 9, f(f(f(f(uw)g(x))y)z) = f(f(f(f(uw)f(xx))y)z), 95 and 9, f(f(f(f(ab)g(a))f(bf(af(g(b)g(a)))))g(b)) ft y y * e, 89 and 8 3 f(f(f(f(ab)f(aa))f(bf(af(g(b)g(a)))))g(b)) ? e, 96 and 97, f(f(f(f(ab)f(aa))f(bf(af(g(b)g(a))))) ±y y ft e, 98 and 8 3 f(f(xf(yz))u) = f{f(f(xy)z)u), 5 and 9, f(f(f(f(f(ab)f(aa))b)f(af(g(b)g(a))))g(b)) ft e, 100 and 99i f(f(f(f(f(ab)f(aa))b)f(af(g(b)g(a))))g(b)) ±y y ± e, 101 and 8 3 f(f(f(f(f(f(ab)f(aa))b)a)f(g(b)g(a)))g(b)) ? e, 100 and 102, f(f(f(xf(yz))u)v) = f(f(f(f(xy)z)u)v), 100 and 9, f(f(l(f(xf(yz))u)v)w) = f(f(f(f(f(xy)z)u)v)w), 104 and 9, f(f(f(f(f(xf(yz))u)v)w)t) = f(f(f(f(f(f(xy)z)u)v)w)t), 105 and 9, f(f(f(f(f(f(ab)f(aa))b)a)f(g(b)g(a)))g(b)) jt y y + e , 103 and 8 3 f(f(f(f(f(f(f(ab)a)a)b)a)f(g(b)g(a)))g(b)) ± e, 106 and 107, f(f(f(f(f(xy)z)u)v)w) = f(f(f(f(xf(yz))u)v)w), 105 and 7, f(f(f(f(Hf(f(ab)a)a)b)a)f(g(b)g(a)))g(b)) ? y y fk e, 108 and 8 3 f(f(f(f(f(f(ab)a)f(ab))a)f(g(b)g(a)))g(b)) ± e, 109 and 110, f(f(f(f(xy)z)u)v) = f(f(f(xf(yz))u)v), 104 and 7, f(f(f(f(f(f(ab)a)f(ab))a)f(g(b)g(a)))g(b)) ±y y ± e, 111 and 8 3 f(f(f(f(f(ab)a)f(f(ab)a))f(g(b)g(a)))g(b)) ± e, 112 and 113, f(f(f(f(ab)a)f(f(ab)a))f(f(g(b)g(a))g(b)) ^ e, 114 and 70 2 f(f(f(f(ab)a)f(f(ab)a))f(f(g(b)g(a))g(b)) ^y y + e, 115 and 8 3 f(g(y)g(x))g(f(xy)), 47 and 7, /(/(
ParamoduJation and
131. 132. 133. 134. 135. 136.
Theorem-proving
99
f(zf(uf(y9(y)))) = f(zf(ue)), 20 and 10! f(f(f(f(ab)a)f(f(ab)a))f(f(f(ab)a)f(bg(b)))) ^y y ± e, 130 and 8 3 f(f(f(J(ab)a)f(f(ab)a))f(f(f(a)b)a)e)) ± e, 131 and 132! f{uf{xe)) = f(ux), 2 and 10i f(f(f(f(ab)a)f(f(ab)a))f(f(f(a)b)a)e)) jt y y * e, 133 and 8 3 f(f{f{f{ab)a)f{f(ab)a))f{f{ab)a)) ? e, 134 and 135i
12 contradicts 136
Notes added in proof 1. In this paper we intend fully resolved sets to be fully factored also. 2. The reader may wish to note that in subsequent work we reserve the term general for clauses or terms and use conservative instead of general for inference systems, in order to avoid possible confusion arising from some misleading connotations of general when used in connection with inference systems. 3. A critical difference between functional-reflexive systems defined here as well as in Wos and Robinson (1968c) and those treated in Robinson and Wos (1968b), is that only h + 1 functional-reflexivity unit clauses are required, where h is the number of function letters in the vocabulary of S\ whereas arbitrarily many instances of reflexivity may be required to satisfy the earlier, weaker completeness result.
Maximal Model Theorem by Lawrence Wos and George Robinaons
Abstract A clause is a set of atomic formulae (of the first order predicate calculus) and negations of atomic formulae—and is thought of as repre senting the disjunction of its members (literals). Each existential variable has been replaced by a Skolem function and each other variable is uni versally quantified over the clause in which it occurs. For any set <S of clauses, let P be the set of atoms over its Herbrand universe. For unde fined terms refer to J. A. Robinson, "A machine-oriented logic based on the resolution principle," Journal of the Association for Computing Ma chinery, 12 (1965), pp. 23-41. Where x' is the negation of a literal x, let N = {b'/beP}, and for W C P u N let W = {b'/beW}. If W C P,W U (P — W)' is an interpretation ofS. An interpretation of S is called a model of S if it has a non-empty intersection with each variable-free instance of each clause in S. Relative to each Q C P , there is a partial ordering of the set of interpretations and hence of the models of S: Mi < Q M 2 iff MI n [ Q ' u ( P - Q ) ] C M 2 n [ Q ' u ( P - Q)). M A X I M A L M O D E L T H E O R E M : If S has a model then, given any Q C P , 5
has a maximal model M relative to Q. Furthermore, for each literal b in M n [Q U (P — Q)'] there exists a clause in S having an instance D with D D M = {b}. Proof: Let T = Q U (P - Q)'; then Mi < Q M 2 iff Mi n V C M 2 n T'. Let { H a } Q C r be a non-empty, simply ordered (relative to Q) set of models of S. Then (U Q E rHa n T') U ( n a £ r - H a n T ) is a model of S and an upper bound for { H Q } Q r r - Hence by Zorn's lemma there is a maximal model M of S. Fur thermore, if there were an element b in M fl T that falsified the second part of the theorem, (M - {b}) U {b'} would be a model of <S strictly greater than M. Reprinted from the Spring 1968 meeting of the Association for Symbolic Logic, Journal of Symbolic Logic, Vol. 34, pp. 159-160 (1969). All rights reserved. This reproduction is by special permission for this publication only.
Maximai Model Theorem
101
(The proof makes no appeal to the properties that the members of P are atomic formulae and the clauses in <S are disjunctions, but does use x" = x.) It also follows that given, not a subset Q of P, but an interpretation T of S, there is a model M of <S maximal with respect to T, i.e., for which no model M* of S exists with M n T g M* D T. With Q = P, the maximal model theorem plays a central role in establish ing that certain paramodulation-based systems are semi-decision procedures for first-order predicate calculus with equality (See abstract following).
COMPLETENESS OF PARAMODULATION by George Robinson and Lawrence Wos
Abstract For terminology and for the maximal model theorem see preceding abstract. A finite set <S of clauses has a model M in the sense of the preceding abstract iff it has a model in the usual sense. If M satisfies S under the usual definition for first-order predicate calculus with equality, M will be called an R-model of <S and S termed R-satisfiable.
Paramodulation: Given clauses A and a' = (3' V B (or (3' = a1 V B) such that A contains a term 5 with 5 and a' having a most general common instance a identical to a'[sj/uj] identical to <5[tj/wj], where A' is obtained by replacing in A[tj/wj] some single occurrence of a (resulting from an occurrence of 6) by /?'[si/ui], infer A'VB[si/ui). THEOREM /: / / an R-unsatisfiable set S of clauses is closed under paramod ulation and contains all instances of x = x over the Herbrand universe H of S, then S is unsatisfiable. Proof: Suppose S is satisfiable. Let <S* be the set of all (variable-free) instances of members of <S over H and let P be the set of atoms of S". By the maximal model theorem there is a model M of S such that for each b in M n P there is a clause D in S* with D n M = {b}. From this it can be shown that the relation {(a,0)/(a = P)sM} is in fact reflexive, symmetric, transitive, and (with respect to all functions and predicates occurring in <S) substitutive. Hence M is an R-model of S, contradicting its R-unsatisfiability. THEOREM 2: Based upon paramodulation, taken together with resolution and the axiom schema a = a, one can construct a semi-decision procedure for firstorder predicate calculus with equality, i.e., a procedure which "yields a refutation for any finite set S iff S is R-unsatisfiable. Reprinted from the Spring 1968 meeting for Assn. for Symbolic Logic, Journal of Symbolic Logic, Vol. 34, p. 160 (1969). All rights reserved. This reproduction is by special permission for this publication only.
Completeness of Paramodulation
103
Proof: Adjoin to S all instances of x = x over the Herbrand universe of <S and close under paramodulation, obtaining a set S'. T, the closure of S' under resolution, can be effectively enumerated. If <S is R-satisfiable, then T is satisfiable since paramodulation and resolution are both sound. If S is Runsatisfiable, then by theorem 1, T must be unsatisfiable. Then since T is closed under resolution it must, by a theorem of J. A. Robinson in the paper cited in the preceding abstract, contain a pair of contradictory one-member clauses.
MAXIMAL MODELS AND REFUTATION COMPLETENESS: SEMIDECISION PROCEDURES IN AUTOMATIC THEOREM PROVING
Lawrence WOS Argonne National Laboratory Argonne, Illinois
George ROBINSON Stanford Linear Accelerator Stanford, California
§1. I n t r o d u c t i o n In recent years the idea of using electronic computers to search for proofs of theorems of quantification theory has drawn considerable attention. One of the more successful methods of attack on the problem has stemmed from the work of Quine [12], Gilmore [5], Davis and Putnam [4] and J. Alan Robinson [16]. This paper is concerned with a portion of the theory underlying an extension of this line of development to systems—first-order theories with equality—in which there is a distinguished relation symbol for equality. The field of mathematics upon which we have concentrated our computer experiments in order to study various properties of our procedure is first-order group theory. To say that a particular property is decidable for some class of statements means that there is a single uniform procedure which will correctly determine whether the property holds when presented with any given statement from the class. Church showed [2] that, for any fixed procedure, there exists a statement of first-order predicate calculus for which the procedure will not be able to answer correctly the question: is this statement a theorem? For group theory, the question of theoremhood is also known to be undecidable as proved by Tarski [17]. The situation is, however, far from hopeless for first-order theories at least. There do exist procedures which will, if presented with a set of first-order axioms for a theory and a first-order statement that happens to be a theorem thereof, correctly identify the statement as a theorem. Such a procedure is called a semidecision procedure for theoremhood. The basis for such a procedure is "Work performed in part under the auspices of the United States Atomic Energy Commission. Reprinted with permission from Word Problems; Decision Problems and the Burnside Problem in Group Theory, ed. W. W. Boone, F. B. Cannonito, and R. C. Lyndon, North Holland, New York, pp. 609-639 (1973).
Maximai Models and Refutation
Completeness
105
often a set of inference rules (rules for reasoning from the axioms of the theory to the statement whose theoremhood is in question), in which case it is natural to call the procedure a proof procedure since the procedure generates a proof of the chosen statement if it is a theorem. In order for a procedure to be of interest from the computational viewpoint, it must also be reasonably efficient. The indications are that the inference rules given in this paper may provide the basis for an efficient semidecision procedure for theoremhood not only for first-order group theory but for other first-order theories with equality as well. The reasons for expecting efficiency are: equality is treated as a special logical symbol distinguished from the relation symbols of the mathematical theory, the inferences deduced with the rules have a certain important property of generality that causes us to call the rules conservative, and finally a number of inferences which are ordinarily obtained immediately in more classical systems are not deducible with these rules. This last property of nondeducibility is referred to as the lack of deduction completeness. For example, not all theorems of the familiar first-order predicate calculus can be deduced from the proposed set of rules. Contrary to intuition, this is often an advantage computationally. The set, II, of inference rules to be studied in this paper consists of resolution, factoring, and paramodulation. The first two are generalizations of well known inference rules for the prepositional calculus. Paramodulation is a generalization of a substitution rule for equality. The formulation of resolution and factoring is essentially that of J. Robinson [16] while paramodulation originated with the present authors [13,15]. It is desirable that the underlying set of inference rules have certain logical properties related to semidecidability. The key property is that of ^-refutation completeness. A refutation is a proof of contradiction. It is proved herein that in the presence of functional reflexivity II is R-refutation complete, i.e., a refutation employing just the rules from II exists for any set of statements (each of which is in the appropriate logical form) which possesses no equality model. In other words, if one starts with a statement which should lead to a contradiction with the usual meaning of equality, II is strong enough to yield a contradiction in the presence of functional reflexivity. The general idea is as follows. To prove that a statement is a theorem of some first-order theory with equality, one proceeds by first denying the statement. Then this denial and the axioms of the theory in question are converted to a particular logical form which may be said to be, loosely speaking, a conjunction of statements each of which is a disjunction. The existential quantifiers have been replaced by Skolem functions and the remaining variables are considered to be universally quantified precisely over the entire conjunct in which they occur. The resulting statements are called clauses. A contradiction is deducible (using the rules of II) from the set of clauses if and only if the original statement was true in all equality models of the theory. The sufficiency requirement leads to a definition of .ft-refutation completeness. The necessity leads to a corresponding soundness concept.
106
Collected Works of Larry Wos
Several examples from first-order group theory are discussed in Appendix I, and refutations (within IT) for two of them are given. It is not within the scope of this paper to discuss the strategies which lead to a promising semidecision procedure. Intuitively, "strategy" may refer to the order in which the inference rules are applied or to certain constraints placed on their application. In order to have an efficient semidecision procedure, one needs, in addition to good inference rules, various strategies. The procedure used in Corollary 2 is not one which is recommended. One of the most successful approaches is that which allows only those inferences which are in part traceable to the special hypothesis of the theorem or to the denial of its conclusion. This strategy is a special case of the set of support strategy. The set of support strategy is known to be 72-refutation complete when coupled with II in the presence of functional reflexivity [21]. To illustrate the general approach, consider the theorem: if a;2 = e for all x in a group G, then G is commutative. In the notation of first-order pred icate calculus the axiom for the existence of an identity element (two-sided) is, (3y)(x)[Pyxx A Pxyx], where P denotes product. Replacing the existential quantifier by a Skolem function and then putting the results into the desired form (a set of clauses), one has the clauses Pexx and Pxex. Since the computer attempts to find contradiction from assuming the theorem false, one has, in ad dition to the clauses corresponding to the other axioms, the clauses Pxxe and Pabc and Pbac. The last two clauses correspond to the assumption that the group is not commutative, i.e., that there exists a pair of elements which do not commute. The system U uses no logical axioms nor does it contain any of the more familiar classical rules of inference such as universal instantiation. In the example above, the procedure would consist of applying the various rules of n , resolution, factoring, and paramodulation, in some order until a contradiction was found. Thus we are vitally interested in the property of /^-refutation completeness. The use of Herbrand models throughout the paper rather than the more familiar concrete models provides a convenient tool for proving the theorems underlying the theory of the approach discussed herein. The theorem of logic which permits use of Herbrand models states in effect that a set has an Herbrand model if and only if it has a concrete model. In Section 2 we give definitions of a number of concepts, such as interpre tation and model, which are necessary for our study. In Section 3 we prove the Maximal Model Theorem which states that, given a particular interpretation for a given satisfiable set of disjunctions, there is a model for that set of disjunc tions, whose set-theoretic intersection with the particular interpretation is as small as it can be without losing the property of modelhood. In Sections 4 and 5 we give the inference rules. In Section 6 we introduce the terms, refutation complete, deduction complete, and conservative and prove that the inference system (set of inference rules) n under study has the desired logical property of /^-refutation completeness for functionally reflexive sets. The usual axiom set
Maxima/ Models and Refutation
Completeness
107
for basic group theory [13] and also that for basic ring theory, for example, are functionally reflexive relative to II. Although many classical inference systems have the property of refutation completeness, they an: also deduction complete and not conservative. The sys tem, II, on the other hand, is conservative but not deduction complete. In the light of experience with existing computer programs, this seems to be advanta geous in using computers to search for proofs of theorems. §2. Definitions We shall deal with a language having as primitive symbols individual vari ables x\,X2,. ■ ■ ,xn,...; individual constants a i , a 2 , . . . , a „ , . . . ; predicate con stants (relation symbols) P}, Pf,..., P£,...; and function letters f{ , f'[,..., /^,.. (where superscripts indicate the number of arguments). (The equality predicate Pi will frequently be abbreviated to R.) The remaining primitive symbol is a bar for negation. Individual constants and variables are terms; a function letter / " applied to n terms t\,..., tn is also a term. A predicate letter P™ applied to n terms is an atomic formula or atom. A literal is an atom q or the negation q thereof. If q is an atom, the negation f of q is just taken to be q. The absolute value \h\ of a literal h is the atom q such that either h is q or h is q. A clause is a finite set of literals. Intuitively, one may view a clause as the disjunction of its literals, universally quantified (over the entire disjunction) on its individual variables. Also intuitively, existential quantification is (in effect) accomplished through the use of (Skolem) function letters. A ground clause (literal, term) is one that has no variables occurring in it. The result C9 of a substitution 9 = [ti/ui,..., tn/un] (where the U{ are all distinct) on a clause C (literal, term) is the clause (literal, term) obtained by replacing uniformly and simultaneously each occurrence (if any) of each variable Ui(i — 1 , . . . , n) by the corresponding term ti. Here the clause (literal, term) CO is called an instance of C. Suppose that a substitution 9 transform's S, some set of literals, into a set SO. Then if for all literals hi and /12 in SO, \hi\ — I/12I, we shall call 6 a unifier (or match) of S. The set S is said to be unifiable if such a 6 exists.* If 6 transforms all members of a set T o f terms into a single term, 6 is likewise called a unifier or match of T. The process of finding and applying a unifier or match is called unification or matching. If a substitution 9 can be obtained by composing two substitutions 9\ and 0 2 in that order, then 6 is an instance of #1. If one clause (literal, term, substitution) is an instance of a second and the second is also an instance of the first, then each is a variant of the other. A finite, non-empty set of clauses (literals, terms, substitutions) that have an instance in common have a most general common •When a finite set 5 of literals is to be unified, we do not usually find it particularly instructive to view that set as a clause, although it is not set-theoretically distinguishable from a clause.
108
Collected Works of Larry Wos
instance (not necessarily unique), i.e., one that itself has as instances all common instances of the originals. Similarly, if a finite, non-empty set S of literals (terms) is unifiable, then it has a most general unifier (match), i.e., a substitution 6 that unifies S and such that every unifier of S is an instance of 9. If a term t occurs as the ijt-th argument of the ik-i-si argument of . . . of the ii-st argument of a literal h, then the ordered fc-tuple (i\,..., i*) is called the position vector of that occurrence of t in h. Two terms are in the same position in their respective literals if they have the same position vectors. The Herbrand universe Hs of a set S of clauses (literals, terms) is the set of all ground terms that can be constructed from the symbols occurring in 5. Here if no individual constant occurs in S, Oi is to be added to the vocabulary. An Herbrand atom for a set 5 of clauses is a predicate letter Pp from S applied to n terms from H„. An interpretation I of S is a set of ground literals whose absolute values are all the Herbrand atoms for S, such that for each Herbrand atom j exactly one of j and j is in /. An interpretation / satisfies the ground clause C if at least one of the literals of C" is in /, i.e., if I !~\C ^ 0. The interpretation / satisfies the (possibly non-ground) clause C if it satisfies every ground instance of C (over the Herbrand universe under consideration); it satisfies the set S of clauses if it satisfies each clause in 5; it condemns the ground clause C if it contains the negation of every literal of C'\ it condemns a clause C if it condemns some ground instance of C (over the Herbrand universe under consideration); and it condemns the set S of clauses if it condemns some clause in S. When the empty set of literals is viewed as a clause false, it can be satisfied by no interpretation and is vacuously condemned by every interpretation. Note however that the same set-theoretic object 0, when viewed as a set of clauses, is vacuously satisfied by all interpretations. A model M of the set S of clauses is an interpretation of S that satisfies S\ it is an R-model of S if, in addition, the set {{t\,t2) \ Rt\t2 £ M} (i.e., the set {(*i> £2) I P\tit\ € M}) is an equality relation for the terms occurring in M, i.e., if each of the following is true for all terms s and t in Hs and all function letters
ft(i) Rtt € M. (ii') If the literal k E M and Rst G M and if h is obtained by replacing in k some one occurrence of s by an occurrence of t, then h £- M. It is often more convenient to replace (ii') by the condition (ii) If an atom k € M and Rst € M and if h is obtained, etc. since (i) and (ii) are equivalent to (i) and (ii'). The other familiar properties follows easily from (i) and (ii'): (iii) If Rst G M, then Rts € M.
Maximal Models and Refutation
Completeness
109
(iv) If Rst 6 M and Rtu 6 M, then Rsu <E M. (v) For all to,ti,.. then
,,tn
Rf(h ,...,tj-utj,---,
in / / s , if Rtjt0 € A/ and /occurs in some literal in M, tn)f(tu...,
*j_i,«o, . . . , « „ ) € M.
§3. T h e Maximal M o d e l T h e o r e m One can associate with each interpretation T of a set S of clauses a partial ordering relative to Tof the set of all interpretations of S, and hence of the set of models of S, given by: Afj < T M2 if and only if Mi n T D M2 f~l T. The maximal model theorem states that, given a set 5 of clauses possessing a model and an interpretation Tof S, among the models of S there exists one, say M, such that no other model of S has a strictly smaller set-theoretic intersection with T. Maximal m o d e l theorem. If a set S of clauses has a model, then, (fiven any interpretation T of S, S has a maximal model M0 relative to T. Proof. Let T" = {x \ x 6 T } , or equivalently the set of the negations of the literals in T. Then V is an interpretation of S, and V n T = 0. If we show that every simply ordered (relative to T) set of models of 5 has an upper bound which is itself a model, then an application of Zorn's lemma will suffice. Let the set {// (I } a eA be a simply ordered (relative to T) set of models of S. Let M = |J Q e A ( / / a n r ' ) u ( f | a 6 A ( / f a n T ) ) . M will be shown to be both an upper bound for {lla} and a model of S. That M is an upper bound (if it is an interpretation) follows from considering H0 for an arbitrary 0 in A and noting that Hp n V C \JQ{Ha n V) = M n V, since T n V is empty. Thus H0 n T C M n V, hence H0C\T D M O T and Hg ^T M. To see that M is an interpretation, consider an arbitrary literal b in T since every Herbrand atom is represented in T either by itself or its negation. If b is in Ha for all Q in A, then b is in f)a(Ha f~lT) so 6 is in M. If for some a, the literal b is not in Ha, then for that a,b is in // Q since each Ha is an interpretation. But b € T', so 6 e Ua(Ha n T') C Af. This shows that at least one of b and 6 is in M. To see that only one of b and 6 is in M assume that b is in M. Then since 6 is not in T' it cannot be in \Ja{Ha n T') and so must be in f~)a(Ha n T) and hence in fl Q Ha- But with 6 in every Ha, b cannot be in any Ha and hence not in \Ja(Ha n T') and hence not in M. To see that M is a model of S, consider some arbitrarily chosen ground in stance D of some clause in S.
110
Collected Works of Larry Wos
Case 1. D C 7". Let Hp be arbitrarily chosen. Since Hg is a model of S, HpHD is not empty and so contains some literal, say c. Since D is contained in T" by assumption, c is in T', so c € T" D //g C C/ Q (// a n f ) C M . Therefore, c € MnD. Case 2. D <£ T'. Then D ("IT = {ci,C2,.. • ,£*} for some finite A; > 0, since Z? has only a finite number of literals and since all literals of all ground instances of all clauses of S are in T U T'. If some Ci, say c, is in all Ha, then c is in f)a(Ha f~l T) C A/, and M n D i s not empty. Otherwise assume that for 1 ^ i ^ fc no Cj is in all 77Q. Therefore, for each Cj, there is an Ha, say .// a i , with c* £ / / Q i . But the Ha are models and hence interpretations, so c< € i / Q i for 1 < i ^ fc. Since c i , . . . , c j t are in T, c i , . . . , cjt are in T'. Since the family {Ha}ae\ is simply ordered relative to T, there is among Hai,..., Hak a largest (relative to T) / / Q j , say H. From the definition of < T > if a literal is in some Hai n T ' ( l < i ^ A:) then it is in HC\T'. Therefore, {c\,..., Cfc} C H C\T'. Since / / is a model and hence an interpre tation of 5, no C{ for 1 ^ i ^ /c is in H. But / / D Z> ^ 0 since // is a model of 5, so H C\ D contains some element a. Since no c< is in / / , o ^ Ci for each t. Therefore, a $T since T fl D = {cuc2,... ,ck}. So a is in T, and therefore a € H D T'. But / / n f c LU(#<* n T ' ) C M , so again M n / ) ^ . Since the cases for D are exhausted, and since D was arbitrarily chosen, for each ground instance D of a clause in S, M n D ^ 0. A/ is thus a model of S. The conditions for Zorn's Lemma being satisfied, there exists a maximal (relative to the ordering associated with T) model Ma of 5. Q.E.D. In a similar fashion one can, by applying the maximal model theorem to T', show that there exists a minimal model of 5 with respect to T. In a later section we apply the theorem to the case where T is the set of Herbrand atoms for S. In this case, the key point is that if M0 is a maximal model relative to T, for each atom A; in MQ we can find a ground instance D of a clause of S with D n MQ = {k}. This in turn allows us certain'applications of paramodulation, which we shall define in a later section. Corollary A . If S is a set of clauses, T an interpretation of S, and M a maximal (relative to T) model of S, then, for each literal b in MC\T, there exists a clause in S having a ground instance (over Hs) D vrith Df) M = {6}. Proof. Let S be a set of clauses, T be an arbitrary but fixed interpretation, and M be a maximal (relative to T) model of S. Assume by way of contradiction that there exists a literal 6 in M ("1 T falsifying the theorem. Since Mis a model of S we can conclude, therefore, that, for any ground instance (over Hs) C of any clause in S, (MDC)-{6} is not empty. Let M* be obtained from Mby replacing
Maximal Models and Refutation
Completeness
111
b by b. M*, therefore, has a non-empty intersection with all ground instances (over Hs) of all clauses in 5. For each Herbrand atom a, M* will still contain ex actly one of a and a. M* is, therefore, an interpretation of S and, hence, a model of S. Since b is in T by assumption and T is an interpretation, b is not in T. Therefore, M C\T contains M*HT as a proper subset. This contradicts the maximality of M, and the proof is complete. Corollary A and the maximal model theorem establish that there are models (the maximal models) which possess the intersection property (given in the conclusion of corollary A) upon which the proof of /^-refutation completeness rests. That this intersection property, however, does not characterize maximality can be seen from the following example. Let 5 = {A, B}, where 4 = {Pa, Qa] and B = {Pa,Qa}.hetT = {Pa,Qa}. Let M* = {Pa,Qa}. M* is not maximal relative to T, for the model M = {Pa,Qa} is such that M* (~)T = {Pa,Qa} contains M n T = 0 as a proper subset. M is itself a maximal model relative to T. M*, however, has the property that, for every literal b in M* fl T, there exists a clause in S one of whose ground instances intersects M* in exactly 6. This example shows that the property of maximality for models is not equivalent to the intersection property. Depending on S and T, one cannot be assured of the existence of a unique maximal model. In the example just given, M is the only maximal model. But, if one replaces S by S* = {A*, B*}, where A* = {Pa,Qa} and B* = {Pa,Qa}, there are two maximal models. Mi = {Pa,Qa} and Mi = {Pa,Qa} are both maximal models relative to T. By definition, a model M is maximal relative to T if and only if, whenever MHT contains M* n T for a model M*, Mn T = M* C\T. Using the definition of interpretation one can easily show that a model M is maximal relative to T if and only if, whenever M C\ T contains M* n T for a model A/*, M is equal to M* set-theoretically.
§4. Resolution and Factoring In this section we give a brief account of an inference rule called resolution. This rule may be viewed as a generalization of modus ponens and hypothetical syllogism. Definition (Resolution). If A and B are clauses (with no variables in com mon) with literals k and h respectively such that k and h are opposite in sign (i.e., exactly one of them is an atom) but |A:| and \h\ have a most gen eral common instance m, and if a and T are most general substitutions with m — \k\a — \h\r, then infer from (any variants A* and B* of) A and B the
112
clause C = (A — {k})o U (B — {h})r. is inferred by resolution [14,16].*
Collected Works of Larry Wos
C is called a resolvent of A* and B* and
E x a m p l e 1. Premisses {Pabc} and {Pxyz, Pyxz} yield by resolution {Pbac}. In this example resolution has the effect of first instantiating the second pre miss (which might be thought of as the commutative axiom in a group theory problem) so that one has two premisses to which modus ponens can be applied, and then applying modus ponens. The clauses which serve as premisses for the modus ponens applications are most general instances of the given premisses, most general with respect to permitting application of modus ponens. E x a m p l e 2. Premisses {Pax, Qx} and {Pyb, Qy} yield by resolution {Qa, Qb}. Syllogistic inference is not directly applicable to the given pair of clauses. The clause {Qa,Qb}, however, can be inferred by instantiation followed by a syllo gistic inference. By definition, resolution, in effect, seeks most general instances of the clauses which will permit syllogistic inference. Example 1 shows that resolution yields in the spirit of modus ponens an inference from pairs of premisses even though modus ponens does not apply directly to those premisses. Example 2 illustrates the corresponding relation ship to syllogistic inference. By placing no restriction on the (finite) number of literals in either premiss, resolution extends both modus ponens and syllogistic inference in yet another way. E x a m p l e 3. From {Nx, Px} and {Py, Qy} infer by resolution {Ny, Qy}This is the familiar categorical syllogism, all F are G, all G are H, so all F are H. Definition (Factoring). If A is a clause with literals k and h such that k and h have a most general common instance m, and if a is a most general substitu tion with ka — ha = m, then infer the clause A' = (A - {k})cr from A. A' is called an immediate factor of A. The factors of A are given by: A is a factor of A, and a immediate factor of a factor of A is a factor of A. E x a m p l e 4. From {Qax, Qyb, Quz} infer (among other clauses) as an imme diate factor {Qab, Quz}, which in turn has an immediate factor {Qab}.
*Note that the premisses A* and B* to which the rule of inference is applied, are not themselves subject to the restriction of having no variables in common. Given an arbitrary A* and B*, in practice, one need merely re-letter B* to obtain a variant B having no variable in common with A* before constructing the resolvent C from A* and B.
Maximal Models and Refutation
Completeness
113
§5. Paramodulation The concept of equality is ordinarily handled in first-order theories in one of two ways: 1) a set of explicit first-order axioms (or axiom schemata) is given for the equality predicate; 2) a substitution rule is supplied together with the axiom of refiexivity. It is in the context of the second approach that the inference rule paramodulation is to be understood. With the appropriate constraints on the variables in the terms s and t, one version of the substitution rule for equality permits inference of the formula p(t) from the formulae Rst (i.e., s = t) and p(s). Paramodulation [13, 15] extends this substitution rule by permitting inference from the formulae Rst and p(u) when the terms s and u, though not identical, have a common instance. (Since the only formulae of interest throughout this paper are clauses, paramodulation is defined only for clauses.) Definition of Paramodulation. Let A and B be clauses (with no variables in common) such that a literal Rst (or Rts) occurs in A and a term u occurs in (a particular position in) B. Further assume that s and u have a most general common instance s' — scr = ur where cr and r are most general substitutions such that scr = « r . Where B is obtained by replacing by to the occurrence of u r in the position in BT corresponding to the particular position of the occurrence of u in B, infer from any variants A* and B* of A and B respectively the clause C = B U {A - {Rst})a (or C = B U (A - {Rts})
114
Collected Works of Larry Wos
systems from {Qx} one could infer {Qa}, which could then have been used as one premiss together with {Rab} and the substitution rule to yield {Qb}. E x a m p l e 3. Premisses {Rab} and {Qx, Px} yield among others the clause {Qb, Pa} by paramodulation. Again in many systems {Qa, Pa} could have been inferred from {Qx,Px}, providing a premiss to which the substitution rule for equality would apply. E x a m p l e 4. Premisses {Rxh(x)} and {Qg(y)} yield by paramodulation {Qh(g(y))}. Note that the presence among the constants occurring in the set of clauses under consideration of the individual constants a and 6 does not lead by paramodulation to either the inference {Qh(g(a))} or {Qh(g{b))}. Paramod ulation (in effect) first finds most general instances of the two premisses which permit straightforward application of the substitution rule for equality and then makes the equality substitution. E x a m p l e 5. Consider the premisses {Rf(xg(x))e} and {Pyf(g(y)z)z}. For intuitive purposes think of P as product, / as product, and g as inverse. The functions / and g are frequently Skolem functions introduced in place of exis tential quantifiers. For this application of paramodulation let s be f(xg(x)) and u be f(g{y)z). A most general common instance of u and s is f(g{y)g(g{y)))The inference thus made is {Pyeg(g(y))}. Note that both premisses required non-trivial instantiation in order to apply the substitution rule. E x a m p l e 6. Premisses {Rf(xg(x))e,Qx} and {Pyf(g(y)z)z,Qz} yield by paramodulation with s and u as in Example 5 {Pyeg(g(y)),Qg(y), Qg(g(y))}. This example illustrates another way in which paramodulation extends the sub stitution rule, as both premisses in this example contain more than one literal. The substitution rule applies to pairs of formulae one of which is of the form {Rst}. The extension in the direction illustrated by Example 6 is needed for Rrefutation completeness as can be seen by examining the following set of clauses: {{Rab, Qc}, {Rg(a)g(b), Qc}, {Red, Qc}, {Rg(c)g(d), Qc}, {Rxx}}. A most crucial property of paramodulation was illustrated by Example 4. From a theorem-proving viewpoint it is important that the inference rules have the property of being conservative (see Section 6).
§6. R e f u t a t i o n C o m p l e t e n e s s A set S of clauses implies (R-implies) a clause C if no model (.R-model) of S condemns C, and S implies {R-implies) a set Tof clauses if it implies (Rimplies) each clause in T. We write S \= C, S \=R C, S \= T, S \^-R T respectively
Maximal Models and Refutation
Completeness
115
to express these relationships. If for clauses C and D, {C} ^= D, we also write C \= D and say that C implies D (and similarly for \=R). If A implies (/2-implies) B, then B is a consequence (R-consequence) of A. If S has no model (.ft-model), then S is unsatisfiable (R-unsatisfiable). A deduction D of a clause Cn from S in an inference system fi is a finite sequence of pairs (C,, Ji)i = 1, 2 , . . . , n where d is a clause and Ji is a "justifi cation" of Ci in terms of one of the rules of inference of Q and previous steps of D or in terms of membership of Ci in S. (By inference system we mean here nothing more than a set of rules of inference.) If such a deduction exists we write S l~n C„. Except when the justifications Ji are of particular interest [21], D will be identified with the sequence C\,Ci,..., Cn. A refutation of S in fi is a deduction of false from S in fi. Henceforth II will be the inference system whose rules of inference are paramodulation, resolution, and factoring and E will be that whose rules are just resolution and factoring. A system Q is deduction complete (R-deduction-complete) if for any set S of clauses and any clause C, S \-Q C whenever S \= C(S \-Q C if S | = R C). It is (R-) refutation complete if for any (R-) unsatisfiable S, S \~n false. The system E is well known to be refutation-complete [16]. (An adaptation to the present formalism of the simple but rather elegant proof in [16] is given in Appendix 1.) If E were deduction complete as well, one could easily prove (see next paragraph) that II is ^-refutation complete (in the presence of the usual reflexivity axiom). (More generally, any deduction complete system fi, when augmented by paramodulation, becomes /2-refutation complete in the presence of reflexivity.) Both E and II would then, however, be virtually worthless for automatic theorem proving algorithms of the type in use today! Let Q be any deduction complete system including the inference rule paramod ulation and let S be any .R-unsatisfiable set of clauses including {lixx}. Con sider the tautology {Rxy, Rxy}, a trivial logical consequence of S. Deduction completeness of $7 would give S \~n {Rxy, Rxy}. By paramodulating from this tautology into {Rxx}, one could show that S \-Q {Rxy, Ryx}. By paramod ulating from this clause into itself, one can deduce {Rxy, Rzy, Rxz}. Since {{Rxy, Ryx}, {Rxy, Rzy, Rxz}} \= {Rxy,Ryz,Rxz}, it follows by deduction completeness of f2 that S l-fj {Rxy, Ryz, Rxz}, completing the equivalence re lation properties for R. For the predicate substitution property, consider P? Xi .. .x/t ■ ■ ■ Xj, for arbitrary choice of i, j , and k. From the deduction complete ness of Q , S \~n {P{xi ...Xk-.-Xj, P f r r i . . .X* .. .Xj}. Paramodulating from sym metry into this clause on xjt in Pfx\.. .Xk ■ ■ -Xj, one could show that S l~n • {Rxj+i Xk, Pfx\ .. .Xj+i .. .Xj, P / x i .. .Xk ■ ■ Xj}. For the function substitution property, since {Rxx} (= {Rfl(xi .. .Xk ■ ■ ■ Xj)f'{x\ .. .Xk ■ ■ -Xj)}, deduction completeness of fl gives {Rxx} \~n {Rfl{x\ .. .Xk ■ ■ -Xj) / / ( x i . . .Xk ■ ■ -Xj). Paramodulating from symmetry into this clause on Xk would give {Rxx} ho, {Rxj+1Xk,Rfi(xi . ..Xj+i .. .Xj) x fl(xi ...xk...Xj)}. Hence S hSJ S U E
116
Collected Works of Larry Wos
where E is a set of equality axioms strong enough to guarantee that any model of S U E would also be an .ft-model of S. Suppose then, that S is /J-unsatisfiable and includes {Rxx}. S U E could then have no model; hence S U E (= false (vacuously). Again applying the hypothesis of deduction completeness of ft, one could show S U E ho. false and hence S ho. false. Since S was assumed only to be .ft-unsatisfiable and to include {Rxx}, this shows that fi is ^-refutation complete in the presence of {Rxx}. To assess the problems involved in proving refutation completeness of sys tems that, unlike the hypothetical fi above, are useful for (present techniques of) automatic theorem proving, one must take care to note that one of the principal reasons that the systems under study here are useful is that they are devoid of the familiar deduction-completeness properties of many of the customary formu lations of quantification theory, hypothesized for the system Q above. (So that, for example, the Godel completeness theorem fails to hold for E and II.) The simplest difference is that universal instantiation is not usually possible in E or n . For example, {Rxa} \= {Raa}, but {Raa} is not deducible from {Rxa} in either E or II. The property that makes systems such as E and II valuable for automatic theorem proving is that they are conservative in the following sense: Loosely speaking, an inference rule is called conservative if it does not allow a proper instance C of a clause C to be inferred from, say A and B, when C itself could have been inferred [13]. (A proper instance C of C is an instance for which C is not an instance of C . ) Resolution is a conservative inference rule. From {Pf(x),Qa} and {Py,Qy} one infers by resolution {Qf(x),Qa} and not, for example, {Qf(a),Qa}. The latter, of course, can be inferred by instantiation followed by a syllogistic infer ence. The instantiation involved therein is, however, not most general among those permitting syllogistic inference. Factoring is also a conservative inference rule, permitting, in effect, only the most general instantiations that allow appli cation of the equivalence of p V p V q with p V q. Pararnodulation, in effect, seeks instantiations that are most general among those that permit equality substitutions. In addition to extending substitution in the two ways already discussed, it is important that certain inferences are avoided. (See Example 4 in Section 5.) From a pair of premisses pararnodu lation yields an inference which could be made after some number (possibly zero) of applications of instantiation to either or both premisses, followed by an application of an equality substitution rule. It combines instantiation with equality substitution in a way such that the property of being conservative is present. Among the possible instantiations which permit application of equality substitution, pararnodulation, in effect, allows only the most general instantia tions. The intuitive comparison above of resolution and pararnodulation with syl logism (or modus ponens) and substitution, respectively, is intended as motiva tion for, not as a precise characterization of, resolution and pararnodulation. For the latter one must refer to the definitions. The intuitive discussion might, for
Maxima! Models and Refutation
Completeness
117
example lead one to take C = (Acr — {ko-})l)(Br — {hr}) as the resolvent instead of C = (A — {k}u U (B — {h})r as we intend in the present paper. If A = {Pa, Px} and B = {Pa, Qb}, we intend the resolvent obtained from choosing Px and Pa as focal literals to be C = {Pa, Qb}, not C = {Qb}. A set S of clauses is said to be functionally reflexive if {Rxx} is in S, and for each function letter fk occurring in S, {Rfl(x\ .. Xj)fl(xi.. -Xj)} is in S. S is said to be functionally reflexive relative to an inference system fi if 5 l- n {Rxx} and for each fj. occurring in S, S r- n {Rfk{x\.. .Xj)fk{xy .. .Xj)}. The principal result of this section is that the inference system II is /2-refutation complete for sets 5 that are functionally reflexive (or equivalently, for S func tionally reflexive relative to n ) . For deduction-complete systems il, the con dition that S be functionally reflexive relative to fi reduces to the condition that S (= {Rxx}. Fortunately for efficiency in automatic theorem proving, II is not deduction complete; consequently, the additional functional reflexivity properties are not so easily eliminated. (When paramodulation was first in troduced a few years ago, we conjectured that S l~n {Rxx} was sufficient for ^-refutation completeness of II. No counterexample has yet been discovered to this conjecture, but neither has a proof been given that the completeness theorem proved in this section can be replaced by the simpler and somewhat more attractive conjecture. An earlier, weaker version of the completeness the orem was proved in [15]. There it was required that 5 \~n {Rtt} for all terms t G Hs, a much stronger restriction since there are infinitely many such clauses Rtt, but there are only n + 1 functional-reflexivity clauses where n is the num ber of distinct function symbols occurring in S. Several systems, such as basic group theory [13], satisfy the hypothesis of the present completeness theorem (Corollary 1) but fail to satisfy the hypothesis of the completeness theorem in [15].)
L e m m a 1. Let A 6 S have a ground instance (over Hs)A' = AT such that in A and A' respectively the terms u* in the literal m* and u' in the literal m! = m*r are in the corresponding positions. Then there exists a factor E of A and a substitution /J. such that (1) A' = Efi is an instance of E, (2) E and A' have the same number of literals, and (3) there exists a literal m in E and a term u in m with mfi — m' and with u in m in the corresponding position to u' in m'. Proof. The substitution T induces a partition of the clause A given by j equivalent to k if and only if jr = kr, where j and k are literals in A. The sets Ai of literals of the partition are each unifiable. There exists, therefore, a most general single substitution 9 which simultaneously unifies each of the A,. Since T unifies each set A„ there exists a substitution fi with r = 9fi. Let E = A6. Let m = m*0, and let u = u*9. The clause E has the desired properties.
118
Collected Works of Larry Wos
L e m m a 2. Let A' and B' be respectively ground instances (over Hs) of A and B in S, and let C be a paramodulant of A' and B'. Further assume that the literal, Rs't', of paramodulation is in A' and that the term, u', of paramod ulation is in the literal m' of B'. Let the position of u' in ml be given by the vector (91,92,• • •, Qn)- Let the substitution p and the literal m* in B be such that Bp = B' and m* p = m'. Then if there exists a term u* in m* such that u* and u' are in the corresponding position respectively in m* and m', then there exists a clause C having C as an instance such that C is a paramodulant of some factors E and F of A and B respectively. Proof. From Lemma 1 we can conclude the existence of factors E and F of A and B respectively such that E and Fha.ve no variables in common, Ehas A' as an instance, E and A' have the same number of literals, F has B' as an instance, F and B' have the same number of literals, and F contains a literal m containing a term u with u in m and u' in m' corresponding positions. Furthermore, we can conclude the existence of substitutions r and 6 with A1 = ET, B' = FO, m' = mO, and u' = uO. E contains a literal Rst with Rstr = Rs't', where Rs't' is the literal of paramodulation in A'. Assume without loss of generality that s' is the argument involved in the inference by paramodulation of C. Then s and u have a common instance. Let A and p, be most general substi tutions such that sX = up. is a most general common instance of s and u. Let F be obtained from F/j. by replacing up, in the position (qa, 92,• • •, Qn) in rap. by (A. Let C = (E — {Rst})\ U F. C is a paramodulant of E and F having C" as an instance, and the proof is complete. L e m m a 3. Let S be a functionally reflexive set of clauses closed under both paramodulation and factoring. If A' and B' are respectively ground instances (over Hs) of A and B in S and if C is a paramodulant of A1 and B', then there exists a C in S having C as an instance. Proof. Assume into B'. Let Rs't' in B' contain the p be such that B'
without loss of generality that the paramodulation is from A' in A' be the literal of paramodulation, and let the literal m' term u' of paramodulation in the position (91, 92, • • •, Qn)- Let = Bp.
Case 1. There exists a literal TO* in B with m*p = m! and with m* containing a term u* in the position (91, 92, • • •, qn)- Lemma 2 applies to A, B, A', and B' to yield a clause C having C as an instance. C is in S since S is closed under both paramodulation and factoring. Case 2. No such m* exists in B. Let m in B be such that mp — m!. There exists, therefore, a term (a variable) x in m in the position (91, 92, • • •, 9k) with
Maximal Models and Refutation
Completeness
119
k < n. Thus there exist p = n — k functions fc such that p contains the element / I ( - - . / 2 ( . . . ( . . . / P ( - ■ ■ « ' ■ •
•))))/*•
Let G\, G2, •. ■, G p be the functional reflexivity axioms corresponding to /i> h, - ■ ■, fP- Gi are in S since S is functionally reflexive. A set containing G\,G2, ...,GP and B and closed under paramodulation contains a clause Bp with the following properties: Bp6 = B' for some substitu tion 0, Bp contains a literal trip with rtipO = m', and trip contains a term uv with Up in rrip and u' in m' in corresponding position. By applying the argument of Case 1 to A, Bp, A', and B', we can complete the proof. T H E O R E M 1. If a functionally reflexive set S is closed under paramodulation and factoring, and if S is R-unsatisfiable, then S is unsatisfiable. P r o o f . Assume by way of contradiction that 5 is satisfiable, and hence, has a model. Let P be the set of atoms over Hs- By the maximal model theorem S has a maximal model M relative to P. We shall show that M is an /i-model of S thus contradicting the .ft-unsatisfiability of 5. Since S is functionally reflexive, Rxx € S. For arbitrary t 6 Hs, therefore, Rtt € M since M is a model of S. Consider arbitrary s and t in Hs, and assume Rst in M. Let k and h be atoms (in P) such that h is obtained from k by replacing some one occurrence of s by t. Assume k G M. By Corollary A there exist ground clauses A' and B' such that A' n A/ = {#s<} and B' f\ M = {k}. Let 4 and £ in 5 be such that A' and B' are respectively instances of A and £?. Let C = (A' - {Rst}) U (B' - {fc}) U {h}. C is a paramodulant of A' and B'. By Lemma 3 we can conclude that there exists a C S S having C" as an instance. Since M is a model of S, the intersection of M and C" is not empty. This intersection, therefore, equals {h}, and so h G M. Thus M has been shown to be an .R-model, and a contradiction is reached. The proof is complete. The desired proof, in the presence of functional reflexivity, of the /J-refutation completeness of n follows as a corollary from Theorem 1. C O R O L L A R Y 1. For sets (consisting of clauses) functionally to II, II is R-refutalion complete.
reflexive relative
P r o o f . Let S be a functionally reflexive relative to II, /?-unsatisiiable set of clauses and let S* be its closure under paramodulation, resolution, and factoring. S* is therefore functionally reflexive. By Theorem 1,5* is unsatisfiable. By the Resolution Theorem (see Appendix 1), false must then be in S*. But every clause C in S* is the last line of a deduction D±,..., Dn of C from S in II with Dt € S* for i = 1 , . . . , n. Hence S* contains a refutation of S in II.
120
C O R O L L A R Y 2. tionally reflexive R-unsatisfiability.
Collected Works of Larry Wos
For finite or effectively enumerable sets S that are func relative to IT, there is a semi-decision procedure for
The proof of this corollary is a form of a well known argument, whose details are supplied for the reader who may be unfamiliar with the formal ism of paramodulation and resolution. The semidecision procedure exhibited in the proof is chosen to make the argument transparent. It is not recom mended as an efficient theorem-proving procedure; efficient procedures generally require a number of "strategies" for determining the sequence in which infer ences are to be made and for suppressing unwise applications of the rules of inference. P r o o f . Let S be a finite or effectively enumerable i?-unsatisfiable set of clauses functionally reflexive relative to IL Consider an effective enumeration C\, C2, ■ ■ ■ of 5. Let W° = 0. For i > 0, let W* = W^1 U {Ci} U Q\ where Ql is the set of all clauses C such that C is a paramodulant, resolvent, or factor of clauses in W'-1 and no lexically earlier variant of C h a s that property.* Each Wl is finite and can be effectively generated from Wl~l. For each clause C in the set S* defined in the proof of Corollary 1, \Jt H'' contains a variant of C. Hence false € U, W a n d thus is in some Wn. To complete the proof, note that for any clause D, S l~n D only if 5 \=R D, so that S \~n false only if S is i2-unsatisfiable. By examining the proofs of Theorem 1 and Corollaries 1 and 2, we can easily obtain parallel results about an inference system in which paramodulation is subject to the following constraint: allow paramodulation only when the term of paramodulation is contained in a positive literal. Thus, in the clause {Pb, Qb}, only the first occurrence of 6 would be admitted as a term of paramodulation. One can then prove, for example: if a functionally reflexive set S is closed under paramodulation (restricted by the constraint above) and factoring, and if S is /?-unsatisfiable, then S is unsatisfiable. The proof is identical to that given in Theorem 1. The parallel to Corollary 1 also holds when paramodulation is so constrained. If the semidecision procedure of Corollary 2 is modified by constraining paramodulation as above, the property of semidecidability is not lost.
*From any pair of clauses that have at least one non-ground resolvent, one can obtain infinitely many resolvents since any non-ground clause has infinitely many variants and any variant of a resolvent of A and B is also a resolvent of A and B. Hence the need to select a single representative in order that Q* and Wx remain finite. A similar situation exists for paramodulation and factoring.
Maximal Models and Refutation
Completeness
121
Appendix 1
Refutation Completeness Theorem for E. / / S is any unsatisfiable set of clauses, then S l-£ false. Proof. (Adapted from [16].) Let Y be the closure of S under resolution and factoring. Since for each clause C in Y, Y contains (all the steps of) a deduction of C from 5 in E, we need only show that false € Y. Consider an ordering O i , a 2 , . . . of the Herbrand atoms for 5. Let IQ = 0, and for j > 0, let Ij = Ij-iU {aj} if TjU {&j} condemns some clause in Y, otherwise let Ij = / , - i U {%}• Let / = (J. Ij. I is an interpretation of Y, but cannot be a model of V,"since it would then be a model of S, but S is unsatisfiable. Hence / condemns some clause C in Y, that is, for some ground instance C" of C, the negation of each literal of C is in /. Since there are only finitely many literals in C", C" must be condemned by Ij for some finite j . Let j be the smallest non-negative integer such that Ij condemns (some ground instance C" of) some clause C in Y. The following establishes that j = 0: Suppose that j > 0. Then 7j_i condemns no clause in Y while Ij condemns some clause C. It must be that Ij = 7y_i U {aj} since Ij — Ij-iU {aj} only if Ij-iU {aj} condemns no clause of Y, and by hypothesis Ij condemns C. But / j - i U {aj} must also condemn some (ground instance D' of some) clause D in Y, since otherwise Ij would be Ij-\ U {aj}- Ij-\ by hypothesis condemns neither C" nor D'. The literal a,j must therefore occur in C" and aj must occur in £>'. Hence there must be a set C* of literals contained in C w i t h a substitution a such that C*a = {a,} and (C - C*)a = C" — {a^} and a set D* C D with a substitution T such that D*T = {aj} and (D - D*)T = D' — {aj}. Let a* and r * be most general unifiers for C* and D* respectively. Then C\ = Co* and D\ = D T * are factors of C and D respectively and must thus be in Y. The factors C\ and D\ then resolve on the literals C*a* and D * T * to give a clause E also in Y. The clause E' = ( C - {a,}) U (D' - {aj}) is a ground instance of £. Since Ij-i U {a,} condemns C", 7j_i must condemn C — {aj}; and similarly since Ij-i U {a 3 } condemns Z?', Ij-\ must condemn D ' — {aj}. Hence Ij_\ must condemn E, contrary to hypothesis. Hence j : ^ 0, so j must be zero. Thus /<, = 0 condemns some clause C 0 in Y. But this is possible only if Co = false. Hence false € Y, completing the proof. To see that factoring is needed for refutation completeness one need only consider the example where 5 is composed of the clauses {Qa}, {Px, Py}, and {Pw, Pz}. Then the closure under resolution alone includes only variants of clauses in this unsatisfiable set S and of {Pu, Pt}, but does not include false, so no refutation can be obtained. Resolution is sometimes defined in such a way as to subsume factoring. While this appears to simplify a few definitions and theorems, it leads, we feel, to
122
Collected Works of Larry Wos
undesirable consequences when applied to automatic theorem proving. Hence we prefer the older formulation in terms of separate rules for resolution and factoring. Alternate Proof of the Maximal Model Theorem: Since the proof of the maximal model theorem appearing in Section 3 was first given [19], a number of other proofs have been found. The simplest we have been able to work out to date is obtained by adapting an idea found in the proof of Lindenbaum's Lemma that is given in [11]. Briefly, the alternative proof thus obtained runs as follows: Consider an enumeration ai,a2,... of the interpretation T. Let bj = a, if Su {{&i},..., {bj-i}, {«>}} is satisfiable, other wise let bj = aj. Let Q0 = 0 and for j > 0 let Qj = { { 6 i } , . . . , {bj}}. Let M = {bi, 62, • • •}• Then M is an interpretation, and furthermore if M is a model from the manner of construction, it must be a maximal one relative to T. To see that M is a model, suppose that it is not. Then, since M is an interpretation, it must be that Mcondemns some clause in S. Hence the set W = S u {{bi}, {b?}, ■ ■.} must be unsatisfiable. Some finite subset W of W must then be unsatisfiable. Without loss of generality let W be such that no proper subset of W is un satisfiable. Then let W'C\{{bi}, {b2}, ...} = {{67,}, • • • {bjk}} and let n be the largest subscript on b appearing therein. Now for j > 0,SUQj must be satisfi able if S U Qj-j is, since otherwise both S U Qj~\ U {aj} and S U Qj-i U {&j} would be unsatisfiable. Hence, since S is satisfiable, S U Qn must by induction be satisfiable, which contradicts the unsatisfiability of its subset W. Thus M condemns no clause in S and must be a model of S, hence a maximal one relative to T. The construction given in the proof of the Refutation Completeness theo rem for E can also be made to yield a maximal model. Failure to recognize the importance of closure of Y under resolution and factoring to the rnodelhood of / was, however, led to a number of spurious "constructive" proofs of the maximal model theorem. Indeed, if S is finite and the closure restriction is satisfied by S itself, / is a model, and an effective means of enumerating / is provided by the technique given in the refutation completeness proof for E. Luckham has successfully applied a similar technique [9] to a useful special case involving a finite set of ground clauses. It appears [10] that attempts to give a proof of the general Maximal Model theorem embodying an effective enumeration of the maximal model may be foredoomed by the existence in first-order logic of sen tences for which there exist no effectively enumerable models, hence no such maximal ones.
Maximal Models and Refutation Completeness
123
Appendix 2 In this section we list a number of theorems from group theory and some from ring theory whose proofs have been obtained by one of our theorem-proving programs. One should not draw conclusions from comparing the times given to obtain proof, since the times obtained were affected materially by the fact that a number of different programs were employed. We shall also include the proofs of two theorems from group theory to illustrate the inference rule, paramodulation. 1. In a group, if xy = e, then yx = e. The time required to obtain a proof was 815 milliseconds. 2. If xy = e and zy = e, x = z. 5.3 sec. 3. The right inverse of the right inverse of x = x. 326 milliseconds. 4. ( a ; - 1 ) - 1 = x. 998 milliseconds. Example 3 differs from example 4, obviously, by not treating inverse as known to be two sided. 5. A non-empty subset H of a group is a subgroup if and only if, for every x a n d y in H,xy~l is in H. The necessity was proved in 1.4 sec, assuming that identity and inverse of the subgroup were that of the group as a whole. The sufficiency was proved as a series of lemmas. That H contains e required 89 milliseconds to prove; for every x in H, H contains x - 1 , 222 milliseconds; H is closed under multiplication, 32 sec. 6. Exponent 2 implies commutativity. 8 sec. 7. The axioms of right identity and right inverse are dependent axioms. The proofs were obtained respectively in 2 seconds and 3 + seconds. 8. Exponent 2 implies commutativity, but using only those axioms sufficient to obtain a proof. 460 milliseconds. The addition of various lemmas, just as the presence of a full axiom set, can help or hurt the proof-search. In problems of some depth, lemmas will almost certainly be needed. 9. Subgroups of index 2 are normal. The theorem was proved by dividing it into two cases, as is often done in the standard proof. The proof for invariance with respect to elements of the subgroup was obtained in 4.9 sec, for elements outside the subgroup in 27.5 sec. 10. Boolean rings have characteristic 2. 41.7 sec. 11. Boolean rings are commutative, assuming the lemma of characteristic 2.
12+ min.
124
Collected Works of Larry Wos
12. If a set is closed under an associative operation, contains an element e with e 2 = e, and every element has (with respect to e) at least one left inverse and at most one right inverse, then the set is a group. A proof was obtained in 5.8 sec. Of the examples given, example 12 is clearly the most difficult, mathemat ically speaking. The theorem is not easy to prove for the average student of group theory. On the other hand, 18.2.8 on page 322 of [7] has not yet been provable by a computer. The lemma states that exponent 3 implies ((a, b), b) = e for all a and 6 in the group. The proof is shortened considerably (see appendix of [13]) by the addition of paramodulation to the most successful of the previous theoremproving systems. That previous system was based on resolution. We now give a proof, employing paramodulation, of the theorem that the axiom of right inverse is dependent on the set consisting of left identity, left inverse, and associativity. In the following, R is read as equals, / as product, g as inverse, and e as the left identity. Assume by way of contradiction that there exists an element a lacking a right inverse. The resulting clause is {Rf(ay)e}. Braces and commas will be omitted in the following. Proof. 1. 2. 3. 4. 5. 6. 789. 10. 11.
Rf(ex)x. Rf(g(x)x)e. Rf(xf(yz))f(f(xy)z). Rf(ay)e. Rf(f(ea)y)e, paramodulate 1 on x into 4 on a. Rf(f(f(g(w)w)a)y)e, 2 into 5 on first occurrence of e Rf(f(g(w)f(wa))y)e, 3 into 6 on f(f(g(w)w)a). Rf(f(g(g(a))e)y)e, 2 into 7 on f(wa). Rf(g(g(a))f(ey))e, 3 into 8 on f(f(g(g(a))e)y). Rf(g(g(a))y)e, 1 into 9 on f(ey). false, resolve 10 and 2.
Left identity Left inverse Associativity
For the 12th example, the following clauses were input to the theoremproving program, PG5 [20], and the proof which follows the input (in essence)
Maxima/ Models and Refutation
was 1. 2. 3. 4. 5. 6. 7. 8. 9.
obtained in 5.8 sec. Pxyf(xy). Peee. Pg(x)xe. Pxyu Pyzv Puzw Pxyu Pyzv Pxvw Pxye Pxze Ryz. Rxx Pxyu Pxyv Ruv. Rxy Ryz Rxz.
10. 11. 12. 13. 14. 15. 16.
Ruv Puxy Pvxy. Ruv Pxuy Pxvy. Ruv Pxyu Pxyv. Ruv Rf(ux)f{vx). Ruv Rf(xu)f(xv). Ruv Rg(u)g(v). Peaa
Completeness
125
Closure Left inverse Pxvw.) Puzw.j
Associativity Reflexivity Well-definedness Transitivity
Substitutivity of equals
e is not a left identity
Proof. 1. Peee. 2. Pxyu Pyzv Puzw Pxvw. 3. Pxye Pxze Ryz. 4. Ruv Pxyu Pxyv. 5. Peaa. 6. Pg(x)xe. 7. Pxyf(xy). 8. Rf(xy)v Pxyv, resolve clause 4 on second literal against clause 7. 9. Rf(ea)a,82 (i.e., second literal of clause 8) vs. 5. 10. Pyzv Pf(xy)zw Pxvw, 2\ vs. 7. 11. Pf(xe)ew Pxew, 10i vs. 1. 12. Pxef(f(xe)e). 111 vs. 7. 13. Pg(z)ye Ryz, 32 vs. 6. 14. Pg(a)f(ea)e, 132 vs. 9. 15. Pyzv Pezw Pg(y)vw, 2i vs. 6. 16. Pezw Pg(y)f(yz)w, 15i vs. 7.
17.
Pg(y)f(ye)e, i^ vs. l.
18. 19.
Rf{xe)x, 13i vs. 17. Pezv Pf{f(xe)e)zw Pxvw, 2X vs. 12. Pezv Pxzw Pxvw, demodulate [Reference 20] second literal of 19 with 18. Pxzw Pxf(ez)w, 19', vs. 7. Pg(x)f{ex)e, 20x vs. 6. false, 21 vs. 14.
20. 21. 22.
126
Collected Works of Larry Wos
PG5 gave as output only 1 thru 5, 9, 12, 14, and 21. The following proof is also of example 12 but employing paramodulation as an additional inference rule. Proof. 1. Rf(ee)e. 2. Rf(xf{yz))f(f(xy)z). 3. Rf(xy)e Rf(xz)e Ryz. 4. Rf(g(x)x)e. 5. Rf(ea)a. 6. Rf(g(z)y)e Ryz, resolve 32 vs. 4. 7. Rf(g(a)f(ea))e, resolve 62 and 5. 8. Rf(g(y)f(yz))f(ez), paramodulate 4 into 2 on f(xy). 9. Rf(g(y)f(ye))e, paramodulate 1 into 8 on f(ez). 10. Rf(ye)y, resolve 61 and 9. 11. Rf(xf(ez))f(xz), paramodulate 10 into 2 on f(xy). 12. Rf(g{x)f(ex))e, paramodulate 4 into 11 on f(xz). 13. false, resolve 7 and 12. Acknowledgements The authors are deeply indebted to W.F. Miller for his support and en couragement of the automatic theorem-proving effort over the years; to D.L. Luckham and C.C. Green; and most particularly to W.W. Boone for his ex tensive and invaluable assistance in the preparation and criticism of this paper. An important portion of the fundamental research underlying the results in this paper was supported by the Computer Science Department of the University of Wisconsin and the University of Wisconsin Computing Center during 1966-67. The current work is supported by the U.S. Atomic Energy Commission.
References [1] A. Church, Introduction to Mathematical Logic I, Princeton (1956). [2] A. Church, A note on the Entscheidungsproblem, J. Symb. Logic 1, (1936) 40-41, 101-102. [3] J. Darlington, Automatic theorem proving with equality substitutions and mathematical induction, in: D. Michie (ed.), Machine Intelligence (Edinburgh Univ. Press and Oliver and Boyd, 1968). [4] M. Davis and H. Putnam, A computing procedure for quantification theory, J. Assn. Comput. Mach. 7 (1960) 201-215.
Maximal Models and Refutation
Completeness
127
[5] P.C. Gilmore, A proof method for quantification theory: its justification and realization, IBM Journal (Jan. 1960) 28-35. [6] C. Green, Theorem-proving by Resolution as a Basis for Questionanswering Systems, in: B. Meltzer and D. Michie (eds.), Machine Intel ligence 4 (Edinburgh Univ. Press and American Elsevier, N.Y., 1969). [7] M. Hall, The Theory of Groups (Macmillan, New York, 1959), p. 322. [8] R. Kowalski and P. Hayes, Semantic trees in automatic theorem proving, in: B. Meltzer and D. Michie (eds.), Machine Intelligence 4 (Edinburgh Univ. Press and American Elsevier, N.Y., (1969). [9] D. Luckham, Some tree-paring strategies for theorem-proving, in: D. Michie (ed.), Machine Intelligence 3 (Edinburgh Univ. Press, 1968). [10] D. Luckham, Personal communication (1969). [11] E. Mendelson, Introduction to Mathematical Logic (Van Nostrand, 1964). [12] W. Quine, A proof procedure for quantification theory, J. Symb. Logic 20 (1955) 141-149. [13] G. Robinson and L. Wos, Paramodulation and theorem-proving in firstorder theories with equality, in: B. Meltzer and D. Michie (eds), Machine Intelligence 4 (Edinburgh Univ. Press and American Elsevier, N. Y., 1969). [14] G. Robinson, L. Wos and D. Carson, Some theorem-proving strategies and their implementation. AMD Tech. Memo No. 72, Argonne National Laboratory (1964). [15] G. Robinson and L. Wos, Completeness of paramodulation, J. Symb. Logic 34 (1969) 160 (abstract). [16] J.A. Robinson, A machine-oriented logic based on the resolution principle, J. Assn. Comput. Mach. 12 (1965) 23-41. 17] A. Tarski, A. Mostowski and R. Robinson, Undecidable theories (North Holland, Amsterdam, 1953). 18] L. Wos, D. Carson and G. Robinson, The unit-preference strategy in the orem proving, AFIPS Conference Proceedings 26 (Spartan Books, Wash ington, D.C., 1964) 615-621. [19] L. Wos and G. Robinson, The maximal model theorem, J. Symb. Logic 34 (1969) 159-160 (abstract). 20] L. Wos, G. Robinson, D. Carson and L. Shalla, The concept of demodula tion in theorem proving, J. Assn. Comput. Mach. 14 (1967) 698 709.
128
Collected Works of Larry Wos
[21] L. Wos and G. Robinson, Paramodulation and Set of Support, Sympo sium on Automatic Demonstration, Lecture Notes in Mathematics 145 (Springer, Berlin, 1970).
T. A. Standish, Editor
Programming Languages
A Theorem-Proving Language for Experimentation L. Henschen Northwestern University Ross Overbeek Northern Illinois University and L. Wos Argonne National Laboratory
Because of the large number of strategies and inference rules presently under consideration in automated theorem proving, there is a need for de veloping a language especially oriented toward automated theorem prov ing. This paper discusses some of the features and instructions of this language. The use of this language permits easy extension of automated theorem-proving programs to include new strategies and/or new infer ence rules. Such extendability will permit general experimentation with the various alternative systems. Key Words and Phrases: theorem proving, resolution, factoring, paramodulation, programming languages C R Categories: 3.60, 4.22, 5.21 Copyright © 1974, Association for Computing Machinery, Inc. General permission to republish, but not for profit, all or part of this material is granted provided that ACM's copyright notice is given and that reference is made to the publication, to its date of issue, and to the fact that reprinting privileges were granted by permission of the Association for Computing Machinery. Work performed under the auspices of the United States Atomic Energy Commission and supported in part by the National Science Foundation under grants GJ-32717 and GJ-35721. Authors' addresses: L. Henschen, Northwestern University, Evanston, IL 60201; R. Over beek, Northern Illinois University, DeKalb, IL 60115; L. Wos. Argonne National Laboratory, Argonne, IL 60439. Reprinted with permission from the Communications of the Association for Computing Machinery, Vol. 17, no. 6, pp. 308-314 (June 1974).
130
Collected Works of Larry Wos
1. Introduction When resolution was first introduced, resolution-based theorem-proving pro grams had to deal with only a few rules of inference. The main ones were binary resolution and factoring. These rules were usually applied in a fixed order, e.g. as in the unit preference strategy of Wos, et al. [6]. In addition, most of the early strategies had a minor effect on the question of when to do which operation. For example, the set-of-support strategy allows one to skip certain attempts at res olution but does not alter the order in which the memory is searched for clauses to operate on. Similar remarks hold for many other strategies such as tautology deletion, subsumption, demodulation, and merging. Thus it is not uncommon for theorem-proving programs to be written to handle only a limited number of inference rules in a fairly rigid order with possibly a limited set of options concerning strategies. As research tools, such programs have two disadvantages: (1) in order to add a new inference rule, in addition to the code for the new rule, major mod ification of the section of the program that controls the sequence of operations will be required; and (2) experiments comparing different strategies, comparing different orders for performing given operations, and comparing different rules of inference are difficult to perform. The need for such capabilities arises from the many new rules of inference being developed for special areas of application. Examples of these are paramodulation for equality [4], naming for higher-order logic [2], and the various rules for set theory developed by Slagle [5]. When new rules of inference are added to those already in the theorem-proving program, one is faced with the following question: in what order should the expanded set of rules be applied? For example, is it better to paramodulate first and then resolve, or to perform many resolutions and paramodulate only when resolution is blocked, etc.? In addition to the experiments arising from such questions, one would like to compare various existing strategies under various restrictions, es pecially for particular classes of problems. An example of such a class is the class of unsatisfiable sets of clauses in which no clause has more than one positive literal. For any member of this class it is known that both an input refutation without the use of factoring exists, and a unit refutation without the use of factoring exists in which the unit is always poistive [3]. One would like to com pare, both with and without factoring, input resolution, unit resolution, and positive-unit resolution for such problems. This paper contains a general description of one language of a class of lan guages which provides for inference rule adjunction and experimentation of the kind mentioned above. Instructions of this rather simple language basically spec ify both an operation or inference rule and lists of clauses to which the oper ation is applied. An interpreter reads these instructions one by one, sets up the internal addresses and flags, then transfers to the appropriate routine that executes the operation. Thus to add a new rule of inference, one merely has to write the routine that performs the operation and make a minor addition to
A Theorem-Proving
Language for
Experimentation
131
the interpreter. Such a program, then, might contain the operations resolution, factoring, paramodulation, and (higher-order) naming, as well as others, and the user could specify in what order he wants these operations performed by means of this new language. He could specify resolution, then naming, then res olution again, then paramodulation, etc., or specify some other order. With the language under discussion, strategies such as unit resolution and positive-unit resolution can be made available by specifying which instructions and clause lists are to be used. The reader might ask at this point if such a large program would be cum bersome or inefficient. It is the case that, for a given run on a given problem, routines that are not called for by the user's theorem-proving algorithm may be present in the memory. However, such routines will not be executed for the given problem, and their presence does not affect the execution of the other routines that are used. Moreover, the interpreter for the language can be very simple, giving a very small overhead. Thus, the efficiency of execution will be approximately the same as for programs with a fixed control section. Finally, the amount of memory required for the code for the unused routines and the interpreter is very small compared to the memory required to store large num bers of clauses. In addition, many of the basic routines are used by most or all operations and would be present in any event. Thus the memory requirements are not significantly greater, either. One major problem with implementing several rules of inference is the amount of memory needed to maintain restart information for each rule. In previous pro grams the amount of memory needed for restart information was dependent on the maximum number of clauses allowed. In Section 2, we give a method of han dling restart information using tables whose size is dependent on the square of the number of lists, giving a reduction factor in the size of the restart tables of approximately 100. Section 3 contains an outline of a language of the type under consideration being implemented by the authors, and Section 4 contains some examples of programs in this language. The authors would like to state at the outset that it is the concept of a theorem-proving language that is important, not the details of the language or its implementation. The major thrust of this paper is to promote the development of theorem-proving systems that will provide ad equate research tools for the development of useful theorem-proving algorithms. The basic ideas for this work developed out of a program, RW1, written by G. Robinson and L. Wos. The present paper is an extension and formalization of these ideas.
2. Restart Tables Restart information refers to the information needed by a program in order to resume some interrupted operation being performed with some clause or some list of clauses. For example, in the unit preference strategy, if the non-unit section
132
Collected Works of Larry Wos
generates a new clause, the program immediately returns to the unit section. Starting with this new clause, the program then generates all possible clauses within the unit section and within some given level bound. If no conflicting units are found, the program returns to the non-unit section, eventually continuing where it left off. Thus, the program must have a way of remembering which tasks had been done up to the point where the operation was interrupted. In early programs for resolution, the restart tables were quite large. A com mon arrangement was for the table to contain n*m/2 entries where n is the number of different lists of clauses and m is the maximum number of clauses al lowed. Then each clause C on list j had an entry for each list i, i < j , indicating the last clause on list i with which C was being resolved. If clauses containing as many as eight literals were allowed (i.e. 8 lists) and a maximum of 2000 clauses was allowed (not an exceptionally large number of clauses for some problems being tried today), the table would require 8000 entries. On an IBM 7094 with a 32K-word memory—then even packing two addresses per word—this would use one-eighth of the entire memory. On an IBM 360 series machine, the table would require 32000 bytes—a sizeable proportion of the memory. Since, when resolution was the main rule of inference, only one such table was needed, the problem was not so severe. However, in a program employing two or three rules, each using a table of the type described, the memory requirements for these tables and for clauses and code as well could not be met by many machines. In order to alleviate this problem, a method is given here for handling restart information which requires at most 2*n*n entries where n is the maximum number of lists. Then for the 8-clause lists mentioned above, such a table would require only 128 words or 512 bytes of memory. The size of the restart tables being made independent of the maximum number of clauses retainable allows the theorem-proving program to contain a number of such tables, and thus employ a number of inference rules, without taxing the memory available in most machines. The form and operation of the restart tables for binary operations will now be described in detail. Let n be the number of lists being used. Two n*n arrays are used, TOP and CURR. In addition, there are vectors, LISTS and LISTND, containing the pointers for the beginning and end of each list. In the following, no distinction will be made between the clause itself and any pointers to that clause. The basic idea is this: while the lists are continually expanding as new clauses are added, the method considers only a specified portion of each pair of lists at a time. For a pair, (i,j), of lists with i ^ j , TOP(i,j) contains the address of a clause on list i and TOP(j',i) contains the address of a clause on list j . Then the operation (resolution, paramodulation, etc.) is performed on each pair of clauses (k,m) from the two lists such that k < TOP(iJ) and m < TOP(j,i). CURR(ij) and CURR(j,i) hold information pertaining to k and m. CURR(i,j) and CVRR(j,i) are manipulated so that each pair not exceeding the limits in TOP is tried. When all such pairs are tried, the limits in TOP are adjusted. In order to avoid trying pairs more than once, this adjustment of the bounds in TOP is made by moving
A Theorem-Proving
Language for
Experimentation
133
one of TOP(t,j) and TOP(j,i) to the next clause on that list. Then this clause is used with each clause on the other list. The pair of bounds in TOP(i,j) and TOP(j,i) are moved in turn (unless one is already at the end of its list) so that all pairs are eventually tried. Example. Let the lists contain 3 and 5 elements respectively, numbered con secutively from 1 within each list. Then the sequence of pairs tried and the values of TOP(i,j) and TOP{j,i) would be: TOP(: ,j) 1
TOPfj.i) 1 1 2 2 3 4 5
Pairs (1,1) (2,1) (1,2), (3,1), (1,3), (1,4), (1,5),
tried
(2,2) (3,2) (2,3), (3,3) (2,4), (3,4) (2,5), (3,5)
When i = j , there is of course only one list to be considered. Here TOP(i,i) contains an upper bound as before. The operator, i.e. inference rule, is applied to each clause pair (TOP(i,i),m), with m on list i and m < TOP(i,i). CURR(i,i) holds the values of m. Figure 1 gives a flowchart for determining the next pair of clauses to try for a given pair of lists. The first test (TOP(i,j) = 0?) determines if any pair from the two lists has been tried. Once a pair has been used, both TOP(i,j) and TOP(j,i) will be nonzero. The second test (0URR(i,j) = 0?) is used to determine which TOP was incremented most recently. That one will be used with all clauses from the other list below its limit. Of course, the method would be useless unless all pairs are eventually tried. We therefore prove the following. THEOREM 1. / / the exit NOPAIR is taken in the flowchart for a pair of lists i and j , then every pair (k,m) with k from list i and m from list j will have been tried exactly once. PROOF. Let (k,m) be a pair. Assume i ^ j . Now, the exit NOPAIR is taken only after both TOP(i,j) and TOP(j,i) have reached the end of their respective lists. Since both of these start at 1, both k and m must have been the new TOP at one time. Suppose m becomes the new TOP(j,i) first. Then, at a later time, k is the new TOl'(iJ), and m < TOP(j,i). Since k is tried with each clause p < TOP(j,i), k is tried with m at least once. A similar remark applies if A: becomes the new TOP(iJ) before m becomes the new TOP(j',t). Finally, the pair (k,m) is tried only if one of k and m is the new TOP and the other is not greater than its corresponding TOP. This can happen only once. If i = j , the exit NOPAIR is taken when there are no more i-clauses. In this case, each i-clause m would have been the new TOP(i,i) once. While m is the new TOP(i,i), it will be used with each i-clause k, exactly once for each k < m. After m has been the new TOP(i,i), it will be used in turn with each clause k on the i-list, k > m, exactly once when k is the new TOP(i,i). This proves the theorem.
Collected Works of Larry Wos
(EXIT)
NOPAJR: Return with no pair of clauses
(EXIT)
TOPO, I) TOP(I. I) CURRd. I) 0 CURRO. I) I
I
Return Pur (1.1)
Interchange land)
TOP(l. I) TOM, I) CURRri. I) 0 CURRO. D 1
I
Return Pair (TOFU I) TOPO. I))
Return Pair (CURRC1.)). TOPO. 0) No
^
T CURR(I.J)
CURRO. J) 1
Figure 1. Flowchart for determining restart with T O P and CURR. If the program performs its operations on pairs of lists of clauses rather than on just one pair at a time, then the array CURR can be eliminated. In this modification the procedure for handling an operation receives a set of pointers for the lists i and j and operates on all pairs from the two lists which have not already been tried. The sets of pointers used are LI1-LI4 and LJ1-LJ4. LI1 points to the first clause of list i; LI2 points to the last clause of list i used with a clause from list j (i.e. TOP(i,j)); LI3 points to the next clause after LI2 on list i; and LI4 points to the last clause on list i. LJ1-LJ4 are defined similarly for list j . Assuming all pairs from the sublist LI1-LI2 and LJ1-LJ2 have been used, the procedure must then arrange to use all pairs from the three pairs of sublists LI1-LI2 and LJ3-LJ4, LI3-LI4 and LJ1-LJ2, and LI3-LI4 and LJ3-LJ4. In other words, the procedure must operate on all pairs from (1) old i and new j , (2) new
A Theorem-Proving
Language for
Experimentation
135
U3 U3 0 i.e„ no New I orJ No V LIl LI2 LI4
USTS(I) TOW. 1) LISTNtKI)
Ul U2 U4
LISTSO) TOP(J, I) LISTNIXJ)
Ul Ul L13 U3 LI4 U4
U2 0 LI2 0 LISTS
TOP(l. I) TOPU. I)
LI4 U4
Figure 2. Flowchart for loading LI1-LI4 and LJ1-LJ4 from TOP.
i and old j , and (3) new i and new j . In this scheme, the two values, TOP(i,j) and TOP(j?',i), are the last i-clause and the last j-clause operated on as a pair; in addition, every pair (k,m) has been tried where k < TOP(ij') and m < TOP(j,i). Figure 2 gives a flowchart for loading L11-LI4 and LJ1-LJ4. As before, one can easily show that no pair will be missed. Note that the procedure may generate many new clauses before exhausting all three sublists. Thus a strategy like unit preference, where the program returns to the unit section as soon as a single new clause is adjoined, cannot be implemented using the modified method. It must be handled using both TOP and CURR. However, the modified method can handle modified versions of such strategies. For example, in modified unit preference the program returns to the unit section only after all resolvents from the current pair of lists have been added. The preceding discussion is based on a binary operation. Of course each such operator would require its own restart table or tables. For a unary operator the
136
Collected Works of Larry Wos
restart table is simple: one vector of n elements is required to hold the pointer to the last clause used on each list. In general, a fc-ary operator requires a table of size nk elements, where n is the number of lists. While in theorem-proving, k is rarely greater than two, the method could be used in other applications.
3. The Language The basis for the following is a list organization of clause memory. Most theoremproving programs already maintain such a structure, although the types and number of lists vary. For example, in unit preference the lists are based on the number of literals in a clause. For unit resolution, as in Chang [I], there are three lists—positive units, negative units, and non-units. In an early paramodulation program at Argonne National Laboratory, there were eight lists. The factors for determining which list a clause belongs to in this program were: (1) positive equality units, (2) positive units which are not equality units, (3) negative units, and (4) non-units and, for each of these, the presence or absence of support. In the system to be described, the particular way in which clauses are assigned to lists is of secondary importance. The instructions operate on lists or pairs of lists with no particular regard to how the lists are defined. In fact, as an option, the instruction itself may specify a particular list on which new clauses are to be placed. In order to allow experimentation with different algorithms, and since the code for defining lists is usually quite simple, the authors suggest that the theorem prover contain several methods for defining lists. The user then specifies, as an input parameter, which of the available list assignment methods he wishes to use for a given problem. The language itself is interpretive and extremely simple. The description given here is based on the implementation currently being developed at Argonne National Laboratory in machine language on an IBM 360/195. We remark again that the particular details of the language are less important than the concept itself of a language which will allow extensive experimentation. Thus, many of the details and restrictions mentioned below may be altered or relaxed in other implementations. In addition to pointer lists, restart tables, and flags for various options, there are six variables labeled V0, V I , . . . , V5. V0 normally contains the length of the longest clause in memory, and VI and V2 normally contain the lengths of the shortest and longest new clause generated by the last rule of inference applied to lists of clauses. The format of the instructions is similar to that of SNOBOL statements. The format is: label
command
optional
operands
:S(label')F(label") optional
These fields are separated from each other by blanks. If the statement is unlabeled, the first column must be blank. The branching information is used
A Theorem-Proving
Language for
Experimentation
137
as follows: if the instruction succeeds, control is transferred to the instruction whose label is label'; if the statement fails, control is transferred to the instruc tion whose label is label". The description of when an instruction succeeds or fails will be given with the description of the individual instructions. The S and F branches may be specified in either order, and either one or both may be omitted. Unconditional transfer is indicated by :(label'). If a label for success or failure is not specified, control flows to next instruction in sequence on that condition. The instructions themselves fall into two classes; (1) rules of inference, and (2) clerical, arithmetic, tests, and miscellaneous. The instructions of the first class are the logical operations. The instructions being implemented at Argonne National Laboratory include RESOLVE, FACTOR, PARAMODULATE, and NAME. NAME is a rule of inference called into play when problems from higher-order logic are under consideration [2]. For such instructions, the operands consist of one, two, or three list indicators separated by commas. Each list indicator is either a constant or a variable. In the latter case, the lists to be used is given by the current value of the variable. For binary operators, the first two list in dicators specify the lists to be used for the operator. The third list indicator is optional; when present, it specifies the list on which new clauses generated by this instruction are to be placed. For example, the instruction RESOLVE 1,3,4 says to resolve clauses on list 1 with clauses on list 3 and place new resolvents on list 4. For unary operators, the first list indicator specifies the clauses to be operated on, and the optional second list indicator specifies the list on which newly generated clauses are to be placed. In either case, when the optional list is missing, new clauses are placed on a list determined by a standard assignment routine. The user indicates in the input which of these list assignment routines is to be used for the given problem. We are currently implementing the three assignment methods described at the beginning of this section. When interpreting these instructions, the interpreter first invokes a general purpose restart routine that returns the restart information and updates the restart tables. This routine receives the address of the table and a flag indicating a binary or unary operator. Thus, this one routine handles the restart operation for all inference rules. Of course, it is relatively easy to add new instructions since all that is required is to write the code to actually perform the operation and then add the instruction to the interpreter's repertoire. The code required by the additional instruction may be nominal since often the instruction will utilize already existing routines, such as unify and restart. In the usual approach, where a language of the type under discussion is not available, there would be the additional problem of modification to already existing code, especially the code for that part of the program which controls the sequence of logical operations. The second class of instructions contains instructions dealing with the vari ables, the condition of various options, and various clerical details. The following
Collected Works of Larry Wos
138
list contains a description of instructions used at Argonne. The reader will un doubtedly think of additional instructions useful in his own particular situation. 1. Integer arithmetic—assign, add, substract, one variable or constant to an other variable, etc.; instruction succeeds unless there is arithmetic overflow. 2. Test for a condition—conditions that can be tested for include tests on the value of a single variable, on the relation between values of a pair of variables, on the value of a flag, for the presence of clauses on some list; the instruction succeeds if the test condition is true. 3. Jump to a subroutine and return from a subroutine. 4. Delete clauses on one list which are subsumed by clauses on another list; this instruction fails if no clauses are deleted. 5. Turn an option or a flag on or off. 6. Print a list. 7. Append one list to another, or delete a list; these instructions also make appropriate modifications to restart tables. 8. Compress storage space. 9. Zero out the restart table for some operation. Instructions 5-9 always succeed. As before, new instructions can easily be added. As a final comment to this descriptive section, it is noted again that few details about the actual implementation have been given. For example, the im plementation of the authors treat each instruction of the language as if it were a machine instruction for a hypothetical theorem-proving computer. Other imple mentations might use the form of some higher-level language such as FORTRAN or ALGOL. In such an implementation, certain instructions would correspond to subroutines. For example, in a FORTRAN-based system, the instruction RESOLVE
V3,V4,V5
:S(LAB1)F(LAB2)
could be written as a subroutine call followed by a test: RESOLVE(V3,V4,V5,FLAG) IF(FLAG)1,1,2 where 1 is the statement number of the statement corresponding to LABl, and statement number 2 is similarly related to LAB2. Of course, arithmetic, test ing, and other instructions would be handled in the straightforward way for FORTRAN. The particular details are not relevant to the main theme of this work, which is to describe a method for providing users with a convenient means for performing theorem-proving experiments with a wide variety of algorithms.
4. Examples To illustrate the ease of writing algorithms in the language just described, four examples from automated theorem proving are given in this section. The reader should keep in mind that, for our implementation, the variable VO has a value
A Theorem-Proving
Language for Experimentation
139
equal to the number of literals in the longest clause present in memory. The variables VI and V2 are reset by each instruction of the first class to have val ues equal to the shortest and longest new clause respectively generated by the instruction. If the optional list for new clauses is omitted from an instruction of the first class, clauses generated by that instruction are assigned to lists by the particular standard assignment routine specified by the user in the input. Instructions of the first class succeed if new clauses are generated, TEST instruc tions succeed if the test condition in the operand field is true. If the branch for success (failure) is omitted, control flows to the next statement in sequence when the instruction succeeds (fails). Finally, it is assumed that options such as set of support, as well as deduction recovery when a refutation is found, are handled automatically by the basic routines. Example 1. Unit Preference [6]. The standard list assignment routine for this example is the one that assigns each clause with i literals to list i. LABEL UNIT
UNTIL NONUN NONUFAC
NONURES NONURES2 NONURES1
NONUCONT STOP
INSTRUCTION SET RESOLVE TEST SET SET SET TEST FACTOR TEST SET SET SET TEST RESOLVE TEST SET TEST SET SET SET STOP
OPERANDS V3 = l 1,V3 V3 = V0 V3 = V3 + 1 V3 = V1 V3 = 2 V3>V0 V3 V3>2 V3 = V3 + 1 V3 = V3 - 1 V4 = 2 V3>V0 V3,V4 V4 = V0 V5 = V4 + 1 V5
BRANCH S(UNTIL) S(NONUN) (UNIT) (UNIT) S(NONURES) S(UNTIL) S(NONURES) (NONUFAC)
S(NONURESl) S(UNTIL) S(STOP) (NONUCONT) (NONUFAC) (NONURES2)
Note that operations, such as search for an i and j clause that have not been tried yet, are handled automatically by the RESTART routine used by RESOLVE, FACTOR, etc.
Example 2. Unit Resolution [1]. Here the assignment of clauses to lists is determined as follows: list 1 consists of positive units; list 2 consists of negative units; list 3 consists of non-units; list 4 holds temporarily newly generated pos itive units; list 5 holds temporarily newly generated negative units; and list 6 holds temporarily newly generated temporary non-units. The flag NEWCLAUSE is turned on any time a new clause is added to any list. The program generates resolvents until some new units are generated, at which point the intermedi ate clauses are eliminated. (Note that this program does not represent Chang's
Collected Works of Larry Wos
140
algorithm precisely [1]. First, we do not concentrate on a single non-unit clause. Second, we do not implement the clause-dependent sets of support.) RESOLVE SETFLAG
START
SET LI L2 L3 L4
CHECK CHKUCONF
CONTIN
1,2
NEWCLAUSE = OFF V3=l
RESOLVE
1,3
SET
V3 = 2
RESOLVE
2,3
SET
V3 = 3
RESOLVE
1,6
SET
V3 = 4
RESOLVE TEST STOP TEST TEST RESOLVE RESOLVE RESOLVE MOVELIST MOVELIST DELETELIST COMPRESS TEST TEST TEST TEST
2,6
S(CHECK) S(CHECK) S(CHECK)
NEWCLAUSE = ON
S(CHECK) S(START)
LIST 4 EMPTY LIST 5 EMPTY
F(CHKUCONF) S(CONTIN)
1,5 4,5 2,4 4,1 5,2 6
V3=l V3 = 2 V3 = 3 V3 = 4
(START) S(L1) S{L2) S(L3) S(L4).
Henschen and Wos [3] have shown that positive-unit resolution is complete for sets of Horn clauses. The above program could be easily modified to do pos itive unit resolution. The program could also be modified so that intermediate non-unit clauses are not thrown away, providing an easy means for performing yet another experiment. Example 3. Paramodulation. Here the assignment of clauses to lists is as follows: list 1 consists of the positive equality units; list 2 consists of the other units; list 3 consists of the non-units. (This is a much simpler assignment than is currently US
SETFLAG PARAMODULATE PARA MODULATE RESOLVE RESOLVE RESOLVE TEST STOP
NEWCLAUSE = OFF 1,2 1,3 1,2 2,2 2,3 NEWCLAUSE = ON
:S(START)
As an alternative to this admittedly simple example, the following program per forms unit resolution and unit paramodulation, but paramodulates only when
A Theorem-Proving Language for
Experimentation
141
further resolution is blocked. START
SETFLAG RESOLVE RESOLVE RESOLVE RESOLVE TEST PARAMODULATE PARAMODULATE TEST STOP
NEWCLAUSE = OFF 2,2 2,3 1,3 1,2 NEWCLAUSE = ON 1,2 1,3 NEWCLAUSE|,=ON
:S(START) :S(START)
While these two programs may be overly simple, they do demonstrate the abil ity to perform different experiments easily. The translation from a statement of an algorithm to a program is quite simple. Because of the extendability of the language, experiments calling for special or unusual operations can also be performed. Example 4. Input Resolution. Assume the input clauses were placed on list 1. In addition, assume that the simplified method of handling restart information is used; that is, all pairs of clauses on the two specified lists are operated on by an instruction. Note that in this example the instructions themselves tell which list new clauses go on.
NEXT
RESOLVE STOP RESOLVE STOP
1,1,2
:S(NEXT)
1,2,2
-.S(NEXT)
5. Concluding Remarks The material of Section 2 concerning lists and restart tables is useful in that it allows implementation of several rules each requiring restart information. But it is the type of language and system of Section 3 that is of major importance, and not the particular implementation of such a system. An interpreter is suggested only because most programs of the size of the system proposed are assembled once and saved as object modules. If this approach is taken, a program in the new language would just be part of the input. The proposed system could instead be implemented just as well, for example, as a set of FORTRAN routines. The theorem-proving algorithm would then be a simple FORTRAN program. The ease and convenience of a system of the type proposed as a research tool is the most important aspect of this work. As seen by the examples, the language is very easy to use. In addition, such a language is extendable with theoretically no limit. An aspect that was not demonstrated, but may be very useful in prac tice, is the dynamic nature of strategies and options. For example, a program using demodulation may in fact fail to find a proof because a needed term was demodulated. In the proposed system, the user could arrange to generate some
142
Collected Works of Larry Wos
resolvents without demodulation. Finally, the system allows experimentation with a great many different theorem-proving algorithms using a variety of infer ence rules with relative ease. The user will also be able to specify virtually any combination of operations in any order. Thus, when a new strategy or heuristic is proposed, it can be tested and compared with other strategies. Experiments can be performed whose purpose is the testing of a program change intended to sharpen the efficiency of an algorithm. When an algorithm is found by expe rience to work well on a particular class of problems (even if the algorithm is not complete), it can be saved to be used again on problems of the same class. In the presence of new rules of inference, such experimental capability will be essential in developing effective theorem-proving algorithms. Received March 1973
References 1. Chang, C.L. The unit proof and the input proof in theorem proving. J. ACM, 17, 4 (Oct. 1970), 698-707. 2. Henschen, L.J. N-sorted logic for automatic theorem proving in higher-order logic. Proc. ACM '72 Conf., pp. 71-81. 3 . Henschen, L.J., and Wos, L. Unit refutations and horn sets. J. ACM (to appear). 4. Robinson, G., and Wos, L. Paramodulation and theorem proving in firstorder theories with equality. In Machine Intelligence, Vol. 4, B. Meltzer and D. Michie, Eds., American Elsevier, New York, 1969, pp. 135-0. 5. Slagle, J.R. An approach for finding C-linear complete inference systems. J. ACM 19, 3 (July 1972), 496-516. 6. Wos, L., Robinson, G., and Carson, D. Efficiency and completeness of the set of support strategy in theorem proving. J. ACM 12, 4 (Oct. 1965), 536-541.
Unit Refutations and Horn Sets L. H E N S C H E N Northwestern
University, Evanston,
Illinois
AND L. W O S Argonne National Laboratory, Argonne.
Illinois
A B S T R A C T . The key concepts for this automated theorem-proving paper are those of Horn set and strictly-unit refutation. A Horn set is a set of clauses such that none of its members contains more than one positive literal. A strictly-unit refutation is a proof by contradiction in which no step is justified by applying a rule of inference to a set of clauses all of which contain more than one literal. Horn sets occur in many fields of mathematics such as the theory of groups, rings, Moufang loops, and Henkin models. The usual translation into first-order predicate calculus of the axioms of these and many other fields yields a set of Horn clauses. The striking feature of the Horn property for finite sets of clauses is that its presence or absence can be determined by inspection. Thus, the determination of the applicability of the theorems and procedures of this paper is immediate. In Theorem 1 it is proved that, if S is an unsatisfiable Horn set, there exists a strictly-unit refutation of S employing binary resolution alone, thus eliminating the need for factoring; moreover, one of the immediate ancestors of each step of the refutation is in fact a positive unit clause. A theorem similar to Theorem 1 for paramodulation-based inference systems is proven in Theorem 3 but with the inclusion of factoring as an inference rule. In Section 3 two reduction proce dures are discussed. For the first, Chang's splitting, a rule is provided to guide both the choice of clauses and the way in which to split. The second reduction Copyright © 1974, Association for Computing Machinery, Inc. General permission to republish, but not for profit, all or part of this material is granted provided that ACM's copyright notice is given and that reference is made to the publication, to its date of issue, and to the fact that reprinting privileges were granted by permission of the Association for Computing Machinery. This work was performed under the auspices of the US Atomic Energy Commission and sup ported in part under NSF Grants GJ32717 and GU-3851. Authors' addresses: L. Henschen, Computer Sciences Department, Northwestern Evanston, IL 60201; L. Wos, Argonne National Laboratory, Argonne, IL 60439.
University,
Reprinted with permission from the Journal of the Association Vol. 21, no. 4, pp. 590-605 (October 1974).
Machinery,
for Computing
Collected Works of Larry Wos
144
procedure enables one to refute a Horn set by refuting but one of a correspond ing family of simpler subproblems. theorem-proving, resolution, paramodulation, fac toring, first-order logic, Horn set
KEY W O R D S A N D P H R A S E S :
CR CATEGORIES: 3.60, 5.21
1.
Introduction
One of the earliest strategies formulated and implemented to affect the proof search in automated theorem-proving programs was that of unit preference [16]. This strategy places extremely heavy emphasis on unit resolution [2, 16]. A unit resolution is one in which at least one of the clauses involved is a unit—contains but one literal. (Throughout this paper resolution means binary resolution, i.e. exactly one literal in each clause is unified or matched.) Many in the field of automated theorem-proving have devoted much effort and interest to the advan tages, properties, and implementation of techniques which give strong preference and often exclusion to unit inference (Chang [2], Luckham [9], Wos et al. [16]). This interest stems, in part, from the desire to produce shorter clauses (since proofs generally terminate when conflicting units are found), from the desire to avoid the proliferation of various literals, and from the desire to avoid the generation of both longer resolvents and a larger number of resolvents from a given pair of clauses. Some procedures have been devised with the intention of yielding, for any set S' of clauses, a corresponding family S of sets Si of clauses such that all St are unsatisfiable if and only if S' is, and such that there exists a unit refutation of each Si if and only if Si is unsatisfiable. (A unit refutation means that no inference rule is applied therein to a pair of nonunit clauses.) Two attempts at such a procedure are the tautology adjunction of Wos et al. [17] and the splitting theorem or transformation of Chang [3, 4]. For any such attempt, the difficult problem is determining whether or not the Si can be refuted when all nonunit inferences are excluded. More generally, one would like to have con ditions which, if satisfied, would guarantee that a given set of clauses can be refuted without recourse to nonunit inference. This paper gives in Theorem 1 a condition, namely, that of being a set of Horn clauses, under which a strictlyunit refutation (factoring is unnecessary) is guaranteed for unsatisfiable sets S. A Horn set or set of Horn clauses is a set in which no clause contains more than one positive literal. Theorem 1 shows, in fact, that a strictly-pasitoe-unit refuta tion exits for such sets. Similar results are also proven for paramodulation-based inference systems. It is shown herein that the converse of Theorem 1 although true on the ground level for minimally unsatisfiable sets is not true in general. Theorem 2 shows that if 5 is an unsatisfiable set of Horn clauses, there exists
Unit Refutations
and Horn Sets
145
an input refutation of S without factoring. Since, for finite sets S of clauses, one can decide by inspection whether or not S is a Horn set, Theorem 1 is quite useful for automated theorem-proving. The following remarks show not only in what way the theorem is of value but also illustrate an important difference be tween Theorem 1 and similar theorems concerning the existence of refutations possessing specific properties. One of the most undesirable theoretical properties of automated theoremproving programs, and of proof procedures in general, is that of semidecidability. Semidecidability means the following: given any (fixed) algorithm A and a pro gram based on A, there (always) exists a formula F such that no amount of time will be sufficient for the program to ascertain whether or not F is a theorem. For the subset of formulas which are in fact theorems, there are, of course, many algorithms such that the corresponding program would, given enough time and memory, eventually find a proof—correctly ascertain theoremhood. A difficulty similar to that of the undecidability of theoremhood occurs in connection with, for example, the interesting theorem, Theorem 2, of Chang [2]. The theorem states that, for any given set S of clauses containing its unit factors, a unit refutation exists if and only if an input refutation exists. Now if a program starts with a set S of clauses and searches for a unit proof, no amount of time is sufficient to guarantee in general the removal of either of the two relevant uncertainties. First, no amount of time is sufficient to establish whether or not the formula corresponds to a theorem. Second, even if the formula is known to correspond to a theorem, no amount of time is sufficient to establish whether or not a unit refutation exists. In dealing with the second instance of undecidabil ity, Theorem 1 has an important advantage, say, over Chang's theorem and the set of support theorem of Wos et al., for one can determine by inspection that Theorem 1 is applicable while such is not the case for the other two results. (The existence of an input proof is as undeterminable, in general, as the existence of a unit proof. Determining that S — T is satisfiable is often as difficult as the seeking of a refutation of S.) Either in seeking new proofs of known theorems or in the testing of new features of a program, knowledge of the existence of a unit refutation is often quite valuable. Another use to which Theorem 1 can be put is in connection with the split ting theorem of Chang [4]. According to Chang, splitting can materially improve proof search efficiency both with respect to time and memory. One would like to have a general rule to decide which clauses to split and a rule for deciding how to split them. One such rule would be: choose clauses and split them so that the resulting family of clause sets has the property that each member of the family is a Horn set. For each member of the family, one then need only search the unit section for a refutation. Horn sets occur in many fields of mathematics such as elementary group theory, ring theory, the theory of Moufang loops, Henkin models, and Boolean algebras. Thus the results of this paper are relevant to a number of automated theorem-proving experiments.
146
Collected Works of Larry Wos
2. Definitions, Theorems, and Corollaries In this section we prove an inclusion relation between the class of unsatisfiable clauses which have the Horn property and the class of strictli/-un\t refutable by binary resolution sets of clauses. Since factoring or its equivalent is no longer required for the refutation completeness of binary resolution based programs for Horn sets, we have a sharpening of the work of Kuehner [8] in which proofs of Lemma 1 and Theorem 4 can be found. (The Kuehner paper was not yet available and was unknown to the authors at the time this research was com pleted.) Perhaps more important than the theoretical aspects of the sharpening of Lemma 1 are its consequences for implementation and for possible improve ment in the efficiency of theorem-proving programs. In a similar way, Theo rem 2 is stronger than the corresponding statement for vine or input refutations in that, for many authors, the latter concepts include explicit factoring or im plicit factoring by permitting resolution to involve more than one literal from a clause. Definition. A set S of clauses has the Horn property if every clause in S contains at most one positive literal. Such an S is called a Horn set. A clause containing at most one positive literal is a Horn clause. (See Horn [7]; Slagle [15j calls a clause —L\ V . . . V — Ln V M with exactly one positive literal M an implication because it is equivalent to {L\ & . . .& Ln) —> M.) Definition. A unit refutation D\, D^,..., Dn of the set S of clauses with respect to the inference system fi is a refutation of 5" such that, if D, is obtained (justified) by application of a rule from fi other than factoring, then at least one of the parents of Di is a unit clause. If at least one parent for each such D{ is a positive unit, the refutation is a positive-unit refutation. A set S is (positive-) unit refutable with respect to fi if there exists a (positive-) unit refutation of S with respect to Q. If factoring does not occur, then we have, respectively, a strictly-unit refutation or a strictly-positive-unit refutation. Definition. An input refutation D\, D%,..., Dn of the set S of clauses with respect to the inference system fi is a refutation of S such that, if £>» is obtained (justified) by application of a rule from Q, then at least one of the parents of Di is a member of S or a factor of a member of S. If factoring does not occur, we have a strictly-input refutation. For finite sets of clauses, the property of being Horn is decidable and, in fact, is decidable by inspection. It will be seen in Section 3 that the existence of the simple test, inspection, is both significant and useful. When S itself is not Horn, there often exists a renaming of S which yields a set S' which is Horn. Since by the renaming theorem of Meltzer [10] S' is unsatisfiable if and only if S is, both the results of this section and the techniques of the next with the appropriate modifications can be applied to S' to yield information about S. Definition. A negative clause is a clause containing only negative literals. A positive clause is a clause containing only positive literals. A mixed clause is a clause containing both positive and negative literals. The empty clause is,
Unit Refutations
and Horn Sets
147
therefore, both a negative and positive clause. The results of this section are not to be viewed as an endorsement of strate gies emphasizing positive-unit refutation. For many problem domains such strate gies would concentrate on the axioms of the system regardless of the theorem under consideration. In such a strategy, the negation of the theorem (usually a negative clause) would often serve the sole purpose of terminating the proof search, thereby decreasing rather than increasing program efficiency. The re sults and proofs herein are to provide the necessary background for the more important practical considerations, such as the techniques of Section 3, which may stem from them. LEMMA 1. Let ft consist of the inference rules resolution and factoring. If S is an unsatisfiable Horn set, then there exists with respect to Cl (1) a positive-unit refutation of S, and (2) an input refutation of S. PROOF Let 5 be an unsatisfiable Horn set. For the first part of the lemma, apply J. A. Robinson's Pi-deduction theorem [13] and note that the only positive clauses at any level are the positive units. For the second part of the lemma, apply the set-of-support strategy, choosing as set of support the subset T of S consisting of the negative clauses. In this case, all supported clauses on any level are negative so that the positive literal in any resolution must come from a clause in S — T. The following example shows that Lemma 1 cannot be strengthened to guar antee the existence of a refutation D which is simultaneously (positive-) unit and input for an arbitrary Horn set. S — {r, —rq, -r s, -p —q -s,p
-q —s}.
The set of level 1 unit resolvents is UR1 - {q, s}. The set of level 2 unit resol vents is UR2 = {-p —s,p - s , - p —q,p -
Collected Works of Larry Wos
148
Pa Pb -PxQy QyAssume that Pa has T-support for some given T and that Pb does not. One justification of the inference producing the clause Qy results in the subdeduction having T-support while the other obvious justification yields a subdeduction without T-support. To see that the Ji are needed to test for the presence of factoring, consider the subdeduction Pab -Pxy -Pab.
- Pab
The third clause can be obtained by resolving the first two or by factoring the second. LEMMA 2. If D is a deduction with respect to ft of the clause A, iffl consists of the inference rules resolution and factoring, and if no clause in D contains more than one positive literal, then there exists a deduction E of a clause B such that E employs resolution alone and B subsumes A. PROOF. Because of the nature of this proof, it has been placed in Ap pendix A. Of course, factoring cannot be eliminated in general. The difficulty is that some refutations involve resolutions where both literals of resolution are fac tored; this situation cannot occur when all the clauses are Horn. THEOREM \. If S is an unsatisfiable Horn set, and if ft' consists solely of resolution, then there exists a strictly-positive-unit refutation with respect to ft'. PROOF. Lot ft' and S satisfy the hypotheses of this theorem. Let ft consist of the inference rules, resolution and factoring. In the proof of Part 1 of Lemma 1, a positive-unit refutation D\ with respect to ft was shown to exist. Since all clauses deducible from a Horn set by any combination of factoring and resolving are themselves Horn clauses, all elements of D\ are Horn clauses. Since D\, the empty clause, and ft all satisfy the hypotheses of Lemma 2, we can apply the procedure in the proof of that lemma. Let E be the deduction obtained by the procedure. In order to see that E is a strictly-positive-unit refutation, first note that none of the positive units in D\ can arise by factoring since all clauses in S and all clauses deducible from S with the rules in ft are Horn. There are two classes of resolutions that occur in E: those between pairs of clauses which subsume their counterpart in D\, and those in subdeductions whose purpose is to remove extra literals. For the first class, since the elements of E can be seen to be Horn clauses, since the clause in E containing the positive literal of resolution subsumes its correspondent in D\, and since the correspondent is a positive unit, these resolutions must be positive-unit resolutions. For the second class, the clauses containing the positive literal of resolution are, for a given
Unit Refutations
and Horn Sets
149
subdeduction, identical and in fact all correspond to a clause in D\ containing a positive literal of resolution. By the argument given for the first class, these clauses must all be positive units. So E is a strictly-positive-unit deduction. That £ is a refutation follows from the fact that D\ is a refutation, the only clause which subsumes the empty clause is the empty clause, and the conclusion of Lemma 2. The proof is complete. THEOREM 2. / / S ts an unsatisfiable Horn set and fi' consists solely of reso lution, then there exists a strictly-input refutation with respect to fi'. PROOF. Let 5 and fi' satisfy the hypotheses of this theorem, and let 0, consist of resolution and factoring. Lemma 1 can be applied to S and il to yield an input refutation D2 with respect to fi. All clauses in Di are Horn clauses since all clauses inferred with respect to il from a Horn set are themselves Horn. As in the proof of Lemma 1, Di has the additional valuable property that the only clauses therein containing positive literals are clauses in 5 — T or factors of clauses in S — T. Because the hypotheses of Lemma 2 are satisfied, we can apply the procedure used for the proof of that lemma. The deduction E yielded by the procedure has in place of factors of input clauses the corresponding input clauses themselves. Each subdeduction in E, whose purpose is to remove superfluous literals in order to yield a clause subsuming its correspondent in Di, utilizes a sequence of resolutions all involving a common clause. Each of these common clauses contains a positive literal. Since the only clauses in D2 containing a positive literal are from S — T or are factors of such, and since in E the factors in question have been replaced by the original clauses from S — T, the above-mentioned common clauses are from S — T. Thus the only clauses in E containing a positive literal are from S — T. Since all resolutions require such a clause, E is a strictly-input deduction. Since Di is a deduction of the empty clause, and since E is a deduction of a clause subsuming that clause, £ is a refutation. Since factoring does not occur in E, the proof is complete. Remark. Of course, if a Horn set contains no positive units, by Theorem 1 it is satisfiable. For finite unsatisfiable sets S of clauses, Theorems 1 and 2 have a distinct advantage over similar results such as Chang's theorem [2] on the equivalence of input and unit proofs and the set-of-support theorem of Wos et al. [17]. For such an S the theorems respectively state: 1. If S is Horn, S is strictly-positive-unit refutable; 2. If S is input refutable and contains its unit factors, S is unit refutable; and 3. If T C S such that S - T is satisfiable, 5 is T-support refutable. The advantage consists in the fact that in the first of these three the hypothesis is verifiable by inspection, while in the second and, to a lesser extent, the third verification of the hypothesis is often as difficult as the central problem of de termining theoremhood. For example, the difficulty of establishing the existence
150
Collected Works of Larry
Wos
of an input refutation is equal to that in general of establishing the existence of a unit refutation. Knowledge as to the satisfiability of S - T, on the other hand, may be lacking for new fields of mathematics under study or when S — T corresponds to the data base in a question-answering problem. It is perhaps natural to attempt to generalize the concept of Horn set to t h a t of being Horn relative to an interpretation. A clause A would be Horn relative to an interpretation / if the intersection of each ground instance of A with / contains at most one element. Unfortunately, Theorem 1 no longer holds for this generalization since, for the following example, factoring is necessary to obtain the refutation. Let S consist of the two clauses Pa, x Px, a and —Pa, x —Px, a, and let / consist of Pa, a. Before stating Theorem 3 we remind the reader of the meaning of Runsatisfiability, paramodulation, and functional reflexive axioms [18]. A set S of clauses is /J-unsatisfiable if the set S', obtained by adjoining to S the clauses cor responding to the appropriate equality axioms for S, is unsatisfiable. Paramod ulation is the inference rule for "built-in equality" yielding inferences in a single step which are equivalent to applying universal instantiation followed by equal ity substitution. The functional reflexive axioms for a set S are the unit clauses Rf(xi,X2,-..,xn),f(xi,X2,-.,xn) for every n-ary function for n > 1 occur ring in S. The unit factors of S are the unit clauses which can be obtained by factoring completely the clauses in S. THEOREM 3. If S is an R-unsatisfiable set of Horn clauses containing Rx,x and its functional reflexive axioms, and if ft consists of the inference rules of paramodulation, resolution, and factoring, then there exists an input refutation D\ and a unit refutation Z>2PROOF. Let S and ft satisfy the hypotheses, and let T be the set of negative clauses of S. As in the proof of Part (2) of Lemma 1, every 'i'-supported reso lution is an input resolution. Similarly, since all positive equality literals occur in clauses in S — T, every T-supported paramodulation is an input paramodu lation. To see that S — T is i?-satisfiable, consider a domain of one object and the interpretation over that domain consisting of all (positive) Herbrand atoms as the /?-model. By the set-of-support theorem for ft in Wos and Robinson [18], there is a T-supported refutation D\ with respect to ft. This refutation, by the remarks above, must be an input refutation. Since factoring is present in ft, by Theorem 2 of Chang and Slagle [5], the existence of D\ implies the existence of a unit refutation Di with respect to ft, which completes the proof. It is desirable to extend Theorem 3 as Lemma 1 was extended. The corre spondents of Theorems 1 and 2 could be proved with the aid of the analogues of Lemma 2 and .1. A. Robinson's Pi-deduction theorem for the inference system consisting of paramodulation, resolution, and factoring, if such analogues could be proved. Theorems 1-3 give the major theoretical results of this paper. However, to illustrate some of the difficulty in attempting to prove results about Horn sets, we show that the converse of Theorem 1 for minimally unsatisfiable sets is only
Unit Refutations
and Horn Sets
151
true in general in the ground case. Thus properties of Horn sets often do not lift. Definition. A set S of clauses is minimally unsatisfiable if S is unsatisfiable and no proper subset of S is unsatisfiable. THEOREM 4. Let S be a set of clauses which is minimally unsatisfiable and ground. If there is a positive-unit refutation of S, then S is a Horn set. PROOF. The proof proceeds by induction on the number n of atoms occur ring in S. Case 1. n = 1. In this case, S consists of exactly two clauses, p and —p. The theorem is obviously true in this case. Case 2. Assume by induction that the theorem is true for all i such that 1 < i < n, and assume that S has exactly n + 1 atoms. If 5 has a positive-unit refutation P , then 5 must contain at least one positive unit, say u. Since S is minimally unsatisfiable, the clauses of 5 must be u, — u B\,..., — u Bp, C\,..., Cq, where all occurrences of u and —u are shown explicitly. Let S' be the set of clauses B\,..., Bp, C\,..., Cq. Then S' is also unsatisfiable and has a positive-unit refutation as can be seen by the following. Consider the refutation P and the occurrences of u in P . Form the deduction P ' from P by deleting the occurrences of the unit u and deleting the literal -u from the remaining clauses of P . P' is a refutation of S'. Furthermore, it is easy to see that P' must also be a positive-unit refutation since each resolution step in P ' also occurs in P . Finally, S' is minimally unsatisfiable. For, if some proper subset, say T ' , of S' is unsatisfiable then the set T formed by returning — u to the appropriate clauses of T' and adding the unit u would be an unsatisfiable proper subset of S, con tradicting the minimal unsatisfiability of S. Now by the induction hypothesis, S' is a Horn set. In particular then, each Bi is a Horn clause, and so — u Bi is also a Horn clause. Since the unit clause u is Horn, 5 is a Horn set. C O R O L L A R Y 1. If S is a minimally unsatisfiable, unit refutable set of ground clauses, then there exists a set S' such that S' is a renaming of S and S' is a Horn set. PROOF. An induction proof similar to the proof of Theorem 4 will suffice. Remark. From Corollary 1 and Theorem 1, if a ground set S is unit refutable, there is a renaming which is positive-unit refutable. Note that the induction step of the proof of Theorem 4 fails if P includes paramodulation steps. For, if u is an equality unit, it is not necessary for u to interact only with literals - u in other clauses. Moreover, in the set of clauses inferable from S by paramodulation, the number of atoms may be preserved or increased. Consider, for example, the set of clauses, {Rab, Rbc, Pa, -Pc}, which contains four atoms. Upon paramodulating Rab into Pa we get Pb, an entirely new atom. T h a t Corollary 1 does not hold for P-unsatisfiable ground sets and inference systems containing both paramodulation and resolution can be seen from the following example: S = {Rab, Rbc, Pa Pb Pc, -Pa-Pb
-Pc}.
Collected Works of Larry Wos
152
S is minimally ft-unsatisfiable and has the following unit refutation:
ftofc Pa Pb Pc
-Pa
-Pb
-Pc^ Rob
HbcPbPr
V false
No renaming can transform S into a set of Horn clauses. In fact, when equality is present, one cannot arbitrarily rename literals without possibly violating the meaning of equality. The difficulty lies in the fact that different literals may express the same fact in the presence of equality. In the above example, it is asserted that a = b = c ; thus the three literals Pa, Pb, and Pc are actually logically equivalent. Then it would be inconsistent with the meaning of equality to rename Pa to —Pa without also renaming Pb and Pc to be negative. Thus the technique indicated in Kuehner [8] would not be applicable to sets of clauses involving equality. We now show by example that neither of the conditions on S of Theorem 4 can be relaxed in general. Consider the following set S of clauses which is not minimally unsatisfiable: {p, q, —p —q,p q, —p q,p —
-Qy Px
Py
-Pa
3. Qa 4. -Qb The following is a positive-unit refutation of S: 5. From 3 and 1 -Qy
Pa Py
6. From 3 and 5 Pa 7. From 6 and 2 Qb 7 and 4 are conflicting units.
Unit Refutations
and Horn Sets
153
This set of clauses is minimally unsatisfiable. However, no renaming of 5 is a Horn set. The reason that properties concerning Horn sets do not in general lift is that two positive literals in a clause with variables may map onto the same literal in a ground instance of the clause. To see this suppose S is a minimally unsatisfiable non-Horn set of clauses with a positive-unit refutation P. The set of substitutions used in P often yields a minimally unsatisfiable set S' of ground instances of clauses in S. Let P' be the refutation of 5 ' corresponding to P. P' must also be positive-unit, and, when S' is in fact minimally unsatisfiable, by Theorem 4 S" is Horn. Now the only way for a non-Horn clause C in S to have an instance C" which is Horn is for C to contain two or more positive literals that map onto the one positive literal of C". For the above example the ground instances determined by P are 1. -Qa
Pa
2. Qb
-Pa
3. Qa 4.
-Qb
This ground set is a Horn set. However, no renaming of the original set S is Horn. This kind of situation can prevent theorems about Horn sets from being lifted from ground sets to nonground sets.
3. Horn Sets and Strategies Whenever introducing a new rule of inference, strategy, or problem domain restriction, A, it is generally profitable to study the compatibility of A with already existing strategies. In this connection we consider some of the more widely used strategies. Luckham [9] discusses three refinements of resolution, Ri, R2, R%(1) R\ is resolution with respect to an interpretation M; resolvents of A and B are generated only if one of A and B is not satisfied in M (Luckham uses the term model in place of interpretation); (2) H2 is resolution with merging; a resolvent C of A and B is generated only if (a) one of A and B is an input clause, or (b) C is a resolvent of AX and Bp and one of AX and Bj3 is a merge; (3) /?3 is resolution relative to ancestry filter; a resolvent C of A and B is generated only if one of A and B is an input clause or is in the deduction tree of the other. (The reader should take note of the fact that for Luckham resolution admits the possibility of unifying more than one literal from each clause, i.e., factoring
154
Collected Works of Larry Wos
is implicit.) Luckham showed that both R\ D R2 and R\ n R3 are not refutation complete. However, when the problem domain is restricted to the class of unsatisfiable Horn sets and the interpretation M is the set of (positive) Herbrand atoms, the intersection of all three strategies is refutation complete. To see this, first recall that it was shown in the proof of Theorem 2 that, if S is an unsatisfiable Horn set, there exists an input refutation of S in which every resolution step has a negative clause as one ancestor. Since each of the negative clauses in this input refutation is not satisfied in the interpretation M consisting of the (positive) Herbrand atoms, with respect to the given M, R\ n R2C1R3 is refuta tion complete for the domain of Horn sets. Two comments are relevant for this combination of strategies. First, it is not claimed that, even for the restricted problem domain of Horn sets, the combination is in general refutation complete, for the interpretation cannot be arbitrarily chosen. Second, if all clauses in a subset T of a Horn set S are negative, any T-supported refutation of S using resolution alone will automatically satisfy the conditions for the interpretation M and strategy combination of R\, R2, and R3. We now turn our attention to the main topic of this section, unit resolution. In this section, binary resolution will be the main inference rule underlying the discussion. Theorems 1 and 2 obviate the need to consider factoring for Horn sets. Section 2 gives a sufficient condition for the existence of a positive-unit refutation—a condition whose presence can, for finite sets, be tested for by inspection. For any Horn set S, the subset T of all positive units is a valid set of support since, by definition, no clause in S — T can be a positive clause. Now if positive-unit resolution is used, the effect is stronger than that of just straightforward set of support corresponding to the above choice of T. It has been noted that set of support is essentially a level 1 strategy, that is, the sharp reduction in clause generation is at level 1. That this in turn leads to further reduction at higher levels is not denied, but, since the retained level 1 clauses are all T-supported and therefore allowed to resolve with all clauses, the effect beyond level 1 is relatively less dramatic. If A is a mixed clause with T-support on level 1, then resolution of A with all clauses B must be attempted in the usual set-of-support strategy, while, with unit resolution, B must be a unit clause. If A is a negative clause with T-support, with the usual set-of-support strategy resolution is attempted for A and all B, while, with positive-unit reso lution, B must be a positive unit clause. So, a level 1 clause may be prevented from resolving with many other clauses even though it has T-support. Thus positive-unit resolution is a restriction of T-supported resolution, where T is the set of positive unit clauses. The effect of this restricted set of support is equally felt at all levels and not just at level 1. The authors are not expressing any opinion concerning the relative merit of positive-unit resolution versus the usual set of support approach with regard to program efficiency. Actual exper imentation with a theorem-proving program is the only way to see whether a useful combination of the two strategies exists.
Unit Refutations
and Horn Sets
155
Although the positive-unit T-support strategy for the above choice of T is refutation complete for the problem domain of Horn sets, the replacement of T by a proper subset of itself may result in incompleteness. For example, let S = {—p q — u, —p —q —u,p -r,r,u} and let T be replaced by T" = {u}. S is unsatisfiable while S—T' is satisfiable. There is, of course, a T'-supported refuta tion, but it requires the resolution of two nonunit clauses. With the added restric tion that resolutions must be positive-unit resolutions, the only T'-supported clauses deducible are — p q and - p -q. For sets that do not satisfy the Horn property, one can often apply the splitting techniques of Chang to derive subproblems which do satisfy the Horn property. In splitting one starts with a set of clauses Su{A}, where A = C U D. From this problem, two subproblems are generated—S U {C} and S U {£>}. If refutations for both of these subproblems can be derived and in a consistent way, then one can show that the original problem also has a refutation (see Chang [4]). For the refutations to be consistent the substitutions that are applied to the variables that are common to C and D must themselves be unifiable. The lack of consistency in the refutations of the subproblems and/or the lack of the carryover of unsatisfiability to the subproblems is generally traceable to the requirement of more than one ground instance of the split clause for a refutation of the original problem. This situation can lead to the necessity of an additional instance of the split clause being present in one or both of the subproblems, and hence possible further splitting. The original goal of splitting was to eliminate long clauses since these may take many steps to reduce and also yield many intermediate clauses which pollute the search space. However, our work suggests that an alternate goal in splitting is to transform a set of non-Horn clauses into subsets of clauses which are Horn. For example, if S contains one clause C with two positive literals and no other clause contains more than one positive literal, then one could split C into two subclauses each containing one positive literal. Then each of the two subproblems would satisfy the Horn condition. In this way a problem which may not have a unit refutation can be transformed into subproblems each of which may have a positive-unit refutation. The possibility of such a reduction gives a rule, previously lacking, for deciding which clauses to split and how to split them. Since many theorem-proving programs do rely solely on unit resolution, this technique may prove valuable. Example. If a subgroup H of a group G has index 2, then H is a normal subgroup, i.e. xyx~l € H for any x € G and y € H. T h e authors know of no unit refutation for this theorem. However, by splitting into Horn subproblems we obtain a problem set, each member of which has a positive-unit refutation. (Since this example is hand computed and is only intended to be illustrative, the authors make no claim about program efficiency. Only a number of ex periments with theorem-proving programs can ascertain the value of any tech nique.) The clauses for the negation of this theorem are in Appendix B. If we rename the predicate O to — 0 , the only non-Horn clause is the correspondent of 23, - O x — Oy — Px,y,z Oz. (Note: We do not actually perform the renaming in
Collected Works of Larry
156
Wos
the following. However, if we had done the renaming, then the correspondents of Ob and Ox Oy Oi(x, y), for example, would be negative while the correspondent of — Od would be a positive unit.) T h e non-Horn clause is split into two clauses -Ox -Px,y,z Oz and -Oy. The first of these yields the following positive-unit refutation relative to the renaming. 23' 31 32 33 34
split portion of 23 -Ox -Px,y,z Oz 29 and 23' -Oa Od 30 and 31 -Oa 32 and 23' -Ox -Px,y,a 2 and 33 -Oe 34 and 21 are conflicting units.
Note again that the clauses — Oa, —Oe, and -Od correspond to positive units when O is renamed to —O. In the above refutation, the two constants c and o were used in 23' for y. If we were using constrained variables as in Chang [3], we would now have to find refutations of — Oy that were compatible with each of these substitutions. But, clearly the only such refutations will correspond to refutations of —Oc and — Oa, respectively. Thus, we must find refutations of each of these. For —Oc it is necessary to again include a copy of the split clause. This time 23 is split into -Oy —Px,y,z Oz and —Ox leading to the following refutation:
23" 31 32 33 34 35 36 37 38 39 40 41 42
split portion of 23 —Oy —Px,y,z Oz subcase hypothesis -Oc -Og(a) Oc 28 and 23" -Og(a) 31 and 32 -Oa 33 and 22 Ox Px,i(x,d),d 30 and 26 34 and 35 Pa,i(a,d),d 29 and 19 — Pa,x,d Rx,c 36 and 37 Ri(a,d),c 31 and 24 —Ox —Rx,c -Oi{a,d) 38 and 39 30 and 25 Ox Oi{x,d) 34 and 41 Oi(a,d) 42 arid 40 are conflicting units.
In this refutation, 2 3 " was used once with 6 being substituted for x. Thus, we would have to find a refutation for the subcase —Ob of the subcase —Oc. This sub-subcase is trivial since axiom 27 is the unit Ob. The next subcase is the refutation of —Oa. This case also requires a copy of 23, which is split into -Oy —Px,y,z Oz and —Ox.
Unit Refutations
23" 31 32 33 34 35 36 38 39 40 41 42 43 44 45 46 47 48
and Horn Sets
157
split portic>n of 23 -Oy -Px,y,z Oz subcase hypothesis -Oa 30 and 26 Ox Px,i(x,d),d 31 and 32 Pa,i(a,d),d 29 and 19 -Pa,x,d Rx,c Ri(a,d),c 33 and 34 28 and 6 -Px,b,u -Pu,g(a),w Px,c,w 4 and 36 -Pe,g(a),x Pg(b),c,x Pg(b),c,g(a) 2 and 38 39 and 23" -Oc Og(a) 31 and 24 -Ox —Rx,a -Og(g(a)) 18 and 41 42 and 22 -Og(a) 43 and 40 -Oc 44 and 24 —Ox —Rx,c 35 and 45 -Oi(a,d) 46 and 25 OaOd 31 and 47 Od 30 and 48 are conflicting units.
In this refutation, 2 3 " was used with g(b) being substituted for x. Thus, we have the final sub-subcase for the two units —Oa and — Og(b). This has the following refutation: 31 32 33
subcase hypothesis —Oa subcase hypothesis —Og(b) 32 and 22 -Ob 33 and 27 are conflicting units.
An examination of the —Oc and —Oa cases above indicates that use of common subgoals from the different subcases may improve performance of a program. For example, in the - Oc case the clause -Oa is generated. When in the — Oa case —Oc is generated, a program could recognize that this subproblem had, in effect, already been solved. The reader may notice that in each subproblem only one clause which would become negative by renaming O to —O was required for each refutation. This is a general property of unsatisfiable Horn sets and leads to a different type of reduction technique. In the splitting reduction, one starts with a problem S and produces a set of subproblems S i , . . . , S* each of which must be solved. In addition, the solutions to the subproblems must be compatible. We now give a method by which some Horn sets may be reduced to a set of subproblems in such a way that the original set is unsatisfiable if and only if at least one of the subproblems is unsatisfiable. We first prove the following theorem. THEOREM 5. Let S be an (R-) unsatisfiable set of Horn clauses (containing its unit factors). If S contains more than one negative clause, S is not minimally
Collected Works of Larry Wos
158
(R-) unsatisfiable. P R O O F Let T be the set of negative clauses of S. By previous theorems, there is a T'-supported input refutation C
fl.
\Y
C,
8,
c
a.
y V
where each Bx is an input clause or a factor of an input clause and C G T or C is a factor of a clause in T. Now the first positive literal of resolution or paramodulation is contained in Bo and is not present in C\. Since all other literals in So ar>d C a r e negative, C\ is also negative. Similarly, each Cj is negative. Since both resolution and paramodulation require a positive literal, each Bi must come from S — T. Thus no clause of T other than C, or the clause of which C is a factor, is necessary to complete a refutation, which completes the proof. Theorem 5 leads to the following reduction technique. Let S = S L> {Ci,..., Cfc}, where the C{, 1 < i < k, are the negative clauses of S. The reduction produces k subproblems S' U {C,}, 1 < i < k. By Theorem 5, if S is (R-) unsat isfiable, then one of the subproblems is (R-) unsatisfiable. Conversely, since each subproblem is contained in the original set of clauses, the (R-) unsatisfiability of any one of them implies the (R-) unsatisfiability of S. Thus in applying this technique, it is necessary to refute only one of the subproblems. This technique would no doubt be more valuable for programs which do not emphasize the role of positive unit clauses. Of course, the two techniques for reduction can be used together. One may start with a non-Horn set of clauses and apply the first reduction technique to produce Horn subproblems. Then the technique based on Theorem 5 for negative clauses can be applied to each individual subproblem. We make a final comment concerning the emphasis on units. By the above theorem, only one negative clause is needed for a positive-unit refutation of a set of Horn clauses. Those refutations not employing paramodulation give rise to corresponding refutations based on hyperresolution. Each hyperresolvent, except the empty clause, is a positive unit obtained by starting with a mixed clause and stripping away the negative literals with positive units. Thus the emphasis is on positive units, and not just units. Now if units convey relatively more information than clauses with more than one literal, then, intuitively, positive units will convey even more useful information than just units. For suppose a property (or predicate) P is defined; in general it is more important or useful to
Unit Refutations
and Horn Sets
159
know that certain objects satisfy this property than to know that they do not satisfy the property. When paramodulation is used in addition to resolution, positive equality units play a special role.
4. An Additional Remark The undecidability of theoremhood arises from the possibility of the generation of an infinite sequence of clauses. There are essentially two ways in which reso lution can produce an unending sequence of clauses, by producing clauses with increasing numbers of literals and by producing clauses with longer terms. This follows from the fact that, given a bound on the number of literals in a clause and a bound on the length of the terms, there are only a finite number of clauses (except for alphabetic variants) deducible by resolution from a given finite set of clauses. Now consider the class of Horn sets. The theorems of Section 2 allow the elimination of the first of the above problems for this class. For neither unit resolution nor unit paramodulation can produce a clause longer than the longest ancestor. While it is well known that the satisfiability of Horn sets is undecidable (see Reynolds [11] or Hermes [6]), the above remarks naturally raise the question of whether or not the second problem, term length, can also in some way be at least controlled or analyzed. The existence of a very special kind of refutation for any given unsatisfiable Horn set, namely a positive-unit refutation without factoring, provides one possible means of analysis of term structure needed for a refutation. Two examples will illustrate the kind of process we have in mind. Example 1. Consider the set of clauses Pa -Px Qig(x) -Qix Pg(g(x))
Rx g(g(a)) -R\x R2g(x) -R2x Rl9{x)
-Px-R^x
From the clauses on the left, we can produce units of the form Pg3n(a) for any n > 0 while the clauses on the right produce units of the form R\g2m(a) for arbitrary m > 1. For these to resolve with — Px —R\x to produce the empty clause, we must have 3n = 2m for some n and m. We do have equality for n = 2 and m = 3 and so we know that there is a refutation without actually performing all the resolutions. The idea of the analysis is this: We know the deductions start with positive units and produce positive units by peeling off the negative literals from mixed clauses. These new positive units will have different term structures. They can be used again to produce still newer positive units, but with essentially the same mixed clauses as before. Thus, while the term structure is changing, there will be a definite pattern to the change. By identifying each of these patterns, we can possibly determine if a set of positive units will ever have terms unifiable with all the terms of all of the negative literals of some negative clause. The following example shows how such an analysis can be used to establish satisfiability:
Collected Works of Larry Wos
160 Example 2. Pa -Px Qg(x) —Qx Pg(x)
R\g{a) -RlX R2g(x) -R2X R\g{x)
-Px
-Rix
The clauses on the left produce units of the form Pg2n(a) while those on the right produce units of the form Rig2m+1(a). Thus the empty clause can never be produced. It should be pointed out that we did not give a bound on the term length. Of course, these examples are very simple. In more complex examples the patterns would be much more numerous and complex. In that event, one might be simply forced to submit the problem to a theorem-proving program. More over, when the splitting technique of Chang is used to produce Horn subproblems which can be analyzed as above, it may still be necessary to generate the refu tations in order to examine their consistency. In such cases, the kind of analysis above may be useful as a heuristic in guiding the theorem-proving process.
5. Summary For a finite set S of clauses, a quick perusal of the clauses therein will establish either the presence or the absence of the Horn property—that no clause contain more than one positive literal. If S is not a Horn set, with very little additional effort one can examine all of the predicate renamings in search of one which would map S into a Horn set. If 5 is or a renaming of S yields a Horn set, the theorems of Section 2 and the techniques of Sections 3 and 4 can be applied. Such is often the case since the clauses corresponding to the axioms of a number of fields of mathematics are Horn clauses. For example, the axioms of groups, rings, Henkin models, and Boolean algebras under the usual translation into first-order predicate calculus will have as correspondents sets of Horn clauses. Many theorems of mathematics can, therefore, be proven in the unit section of a theorem-proving program. Theorem 1 establishes that for Horn sets, positiveunit binary resolution without the need of factoring is sufficient for refutation completeness. Theorem 3 guarantees the existence of a unit refutation for any .ft-unsatisfiable Horn set when the inference system consists of paramodulation, binary resolution, and factoring. In Section 3 two reduction procedures are discussed, the splitting procedure of Chang and the proper subset reduction procedure originated by the authors. The first procedure is provided with a rule, previously lacking, to guide the choice of clauses to split and to direct the splitting itself. The second procedure enables one to reduce a given problem, when the corresponding set of clauses is Horn, to a set of simpler subproblems in such a way that one need refute but one of the subproblems to establish unsatisfiability of the original problem. Since, for many applications and experiments in automated theorem-proving,
Unit Refutations
and Horn Sets
161
the corresponding set of clauses is itself Horn or is reducible to a set of Horn clauses, and since the Horn property can be tested for so simply, the results of this paper should provide valuable information and techniques for the field of automated theorem-proving.
Appendix A LEMMA 2. If D is a deduction with respect to Q of a clause A, if il consists of the inference rules resolution and factoring, and if no clause in D contains more than one positive literal, then there exists a deduction E of a clause B such that E employs resolution alone and B subsumes A. PROOF. Assume that D, A, and fi satisfy the hypotheses. If factoring is not present in D, then let E = D and B = A. Otherwise let D = D\,Di,.. .,Dn and consider the following inductive construction of a deduction E: 1. S e t Jfc= 1;
2. If the justification of Dk is that it is an input clause, let Ek = Dk', the lit eral in Ek corresponding to a literal M i n Dk is that same literal M; go to step 5; 3. If the justification of Dk is that it is a factor of Dj with j < k, then Ek = Ej\ the set of literals in Ek corresponding to a literal L in Dk is the set M = Mi U . . . U Mm of literals in Ek (= Ej) such that M, is the set of literals in Ej corresponding to a literal L< € Dj and Li is mapped onto L by 8 where DjO = Dk\ go to step 5; 4. If the justification of Dk is that it is a resolvent of Di and Dj with i, j < k, then possibly perform a sequence of resolutions; assume without loss of generality that the negative literal of resolution M occurs in D{; let M' = {M\,..., Mm} be the set of literals in Ei corresponding to M; if M' is empty, let Ek = Ex; then the correspondence of literals between Ek and Dk is the same as between Ei and Di\ otherwise let K be the positive literal of resolution in Dj and K' the corresponding literal in Ej (there can be only one); let F\ be the resolvent of Ei and E} on Mi and K', F2 the resolvent of F\ and Ej on the descendant of Mi and K',..., Fp the resolvent of F p _i and Ej on the descendant of Mm and K'; Ek is F p ; the set of literals in Ek corresponding to a literal L in Dk are those literals descended from LQ U L\ U . . . U L p where LQ is the set of literals in Ei corresponding to V in D, and V is mapped onto L in the resolution if Di and Dj and for each q, 1 < q < p, Lq is the set of literals in E3 corresponding to a literal L" in Dj where L" is mapped onto L in the resolution of Dt and Dj; there are p sets L\,..., Lp because there are p resolutions each using Ej, and thus, each possibly introducing alphabetic variants of the literals in question; go to step 5; 5. If k = n, stop; otherwise set k = k + 1 and go to step 2.
Collected Works of Larry Wos
162
In review, if Dk is an input clause, then Ek is that same input clause. If Dk is a factor of Dj, Ek is Ej. (While Ej may or may not equal Dj, Ek clearly will not equal Dk-) If Dk is a resolvent of Di and Dj, the corresponding Ei and Ej are resolved to produce, depending on the number of literals in Ei corresponding to the negative literal of resolution in Di, a one-step subdeduction or to begin a p-step subdeduction with p > 1. The extra literals may be present (i.e. p > 1) because a factor step was eliminated or because at an earlier stage another resolution in D required more than one corresponding resolution in E. Clearly, E does not involve the inference rule of factoring. Also, as is the case in all deductions involving only resolution starting with Horn clauses, no Ek contains more than one positive literal. In fact, Ek contains 1 or 0 positive literals depending on whether Dk contains 1 or 0 positive literals, respectively. Finally, note that the sets of literals in Ek corresponding to two distinct literals in Dk are disjoint. Lemma 2 will now be proved by showing that the conclusion holds for each Ek and Dk- When A: = 1, step 2 must apply; thus E\ = D\ and the conclusion holds trivially. For k > 1, assume the result holds for 1 < i < k — 1. If step 2 or step 3 applies or if step 4 applies and no resolution is produced, the result is again trivial. So assume Dk is the resolvent of Di and Dj and E contains one or more corresponding resolutions. Let the negative literal of resolution in D be M occurring in Di and the positive literal of resolution in D be K occurring in Dj. Then Dk = ((Di - M) U (Dj - k))d where 6 is the MGU of M and -K. By the induction assumption there exist (most general) substitutions a* and Q_, such that Eiax Q Di and EJOCJ C Dj. Let M' be the set of literals in Ei corre sponding to M and K' the literal in Ej corresponding to K. Let Ejx,..., Ejp be the p copies of Ej with variables separated used for the p resolutions in E with K'm the copy of K' in Ejm. Let o.jm be the substitution corresponding to o.j such that Ejmctjm C Dj. Then 0 = o^ U ((Jm=i ajm) ls a most general substitution such that Et0 C Dt and Ejm0 C Dj, 1 < m < p. The p resolu tions given in step 4 eliminate all the literals in M'. Clearly 00 is a unifier of the set of atoms occurring in M' and the atoms K'm so that the sequence of resolutions prescribed in step 4 is admissible. Let S be an MGU of this set so that 06 = 6X for some A. The clause Ek obtained by the sequence of resolutions satisfies
EkC((Et-M')i:(
U (Ejm - K'm)))5.
Then, EkX C {{Ei - M') U ( U {Eu
-
K'm)))5\
m=l
= {{Ei - A/') u ( U {Ejn - K'm)))09 C ((Dt - M) U (Dj - K))8 = Dk.
Unit Refutations
and Horn Sets
163
By induction, the lemma is proved. It would appear that the conclusion could be strengthened to read "BA = A for some substitution" by sharpening the procedure in step 4.
Appendix B The following is the list of clauses expressing the negation of the theorem in the example in Section 3. THEOREM. / / o subgroup H of a group G has index 2, then xyx~l any x £ G and y € H.
£ H JOT
REFERENCES (Note. References [1, 12, 14] are not cited in the text.) 1. ALLEN, J., AND LUCKHAM, D. An interactive theorem-proving program. In Machine Intelligence, Vol. 5, B. Meltzer and D. Michie, Eds., American Elsevier, New York, 1970, pp. 321-336. 2. C H A N G , C. L. The unit proof and the input proof in theorem proving. J. ACM17,4 (Oct. 1970), 698-707. 3. C H A N G , C. L. Theorem proving with variable-constrained resolution. Inform. Sci. 4 (1972). 217-231. 4. CHANG, C. L. The decomposition principle for theorem proving systems. Proc. Tenth Annual Allerton Conference on Circuit and System Theory, U. of Illinois, Oct. 1972, pp. 20-28. 5. C H A N G , C. L., AND SLAGLE, J. R. Completeness of linear refutation for theories with equality. J. ACM 18, 1 (Jan. 1971), 126-136. 6. H E R M E S , H. Enumerability, New York, 1965.
Decidability,
Countability.
Springer-Verlag,
7. HORN, A. On sentences which are true of direct unions of algebras. J. Sym bolic Logic / 5 (1951), 14-21. 8. KUEHNER, D. Some special purpose resolution systems. In Machine In telligence, Vol. 7, B. Meltzer and D. Michie, Eds., American Elsevier, New York, 1972, pp. 117-128. 9. LUCKHAM, D. Refinement theorems in resolution theory. Proc. IRIA Sym posium on Automatic Demonstration, Springer-Verlag, New York, 1970, pp. 163-190.
164
Collected Works of Larry Wos
10. MELTZER, B . Theorem proving for computers: Some results on resolution and renaming. Computer J. 8 (1966), 341-343. 11. REYNOLDS, J . C. Transformational systems and the algebraic structure of atomic formulas. In Machine Intelligence, Vol. 5, B. Meltzer and D. Michie, Eds., American Elsevier, New York, 1970, pp. 135-152. 12. ROBINSON, G., AND W O S , L. Paramodulation in first-order theories with equality. In Machine Intelligence, Vol. 4, B. Meltzer and D. Michie, Eds., American Elsevier, New York, 1969, pp. 135-150. 13. ROBINSON, J . A. Automatic deduction with hyper-resolution. Internal. Computer Math. 1 (1965), 227-234.
J.
14. SLAGLE, J . R. Heuristic search programs. In Theoretical Approaches to Non-Numerical Problem Solving, R. B. Banerji and M. D. Mesarovic, Eds., Springer-Verlag, New York, 1970, pp. 246-273. 15. SLAGLE, J . R., AND KONIVER, D. Finding resolution proofs using dupli cate goals in A N D / O R trees. Inform. Sci. 4 (1971), 313-342. 16. W o s , L., C A R S O N , D . F . , AND R O B I N S O N , G . A. T h e unit preference
strategy in theorem proving. Proc. AFIPS 1964 F J C C , Vol. 26, P t . 1, Spartan Books, New York, pp. 615-621. 17. W o s , L., R O B I N S O N , G. A., AND C A R S O N , D. F . Efficiency and com
pleteness of the set of support strategy in theorem proving. J. ACM 12, 4 (Oct. 1965), 536-541. 18. W o s , L., AND ROBINSON, G. Paramodulation and set of support. Proc. IRIA Symposium on Automatic Demonstration, Springer-Verlag, New York, 1968, pp. 276-310.
Unit Refutations
and Horn Sets
165
The clauses for the negation are (R is the equality predicate)
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30.
Pxyf{xy) Pexx Pxex Pg(x)xe Pxg(x)e —Pxyu -Pyzv —Puzw Pxvui] n o r> r> f — Pxyu —Pyzv -Pxvw Puzw) Rxx — Rxy Ryx — Rxy -Ryz Rxz — Pxyu —Pxyv Ruv — Ruv —Pxyu Pxyv — Ruv —Pxuy Pxvy — Ruv —Puxy Pvxy • — Ruv Rf(xu)f(xv) -Ruv Rf(uy)f(vy) -Ruv Rg(u)g(v) Rg{g(x))x — Pxuy —Pxvy Ruv — Puxy —Pvxy Ruv Oe -Ox Og{x) —Ox —Oy —Pxyz O.z —Ox —Rxy Oy — Ruv Ri(xu)i(xv) — Ruv Ri(ux)i(vx) Ox Oy Oi(xy) f Ox Oy Pxi(xy)yj Ob Pbg(a)c Pacd -Od
RECEIVED FEBRUARY
1973
(closure) (left identity) (right identity) (left inverse) (right inverse) , . . .x . (associativity) (reflexivity of =) (symmetry of =) (transitivity of =) (product well defined)
(substitution for =)
(left cancellation) (right cancellation)
(subgroup has index 2
Problems and Experiments for and with Automated Theorem-Proving Programs JOHN D. McCHAREN, ROSS A. OVERBEEK, AND LAWRENCE T. WOS
Abstract—The two objectives of this paper are 1) to give a large and varied problem set, complete clause sets for use in testing automated theorem-proving programs and 2) the presentation of a number of experiments with an existing program under a variety of conditions. The problems range from quite trivial to quite difficult, including some for which a refutation was not obtained. The statements of a problem without the full list of corresponding clauses would be of only cursory value when viewed from either of the objectives of this paper. The problems are taken from the usually studied algebraic systems, Tarskian geometry, Henkin models, and from Wang's suggested test cases, among others. Among those included herein, the following are of added interest because of their difficulty, especially from the viewpoint of automated theorem proving. 1) In group theory x3 = e implies the cummutator ((x,y),y) = e. The proof is rather longer than that of the usually cited test problems for theoremproving programs. The problem is even somewhat challenging for the in dividual unaided by the computer. 2) Using the Tarski axioms for plane geometry, the relation of betweenness can be shown to be symmetric. This axiom set is quite nonintuitive. The problems taken from this field provide an interesting test for programs because, among other considerations, they use six place functions in the corresponding clause sets. The experiments compare the inference rules of UR-resolution, hyperresolution, paramodulation, taken separately, and in combination. Presented herein are examples employing the set of support strategy, various complexity schemes Manuscript received September 22, 1975; revised February 27, 1976. Reprinted, with permission, from the IEEE Transactions on Computers, Vol. C-25, no. 8, pp. 773-782 (August 1976). The authors are with the Division of Computer Science, Department of Mathematical Sciences, Northern Illinois University, DeKalb, IL.
Problems and Experiments—Automated
Theorem-Proving
Programs
167
(C-sets), inclusion of lemmas, various demodulation approaches, and various clause representations. The program was developed at Northern Illinois University and the experi ments are from its use at the Argonne National Laboratory on an IBM 370/195. Time for the experiments, number of clauses generated, number of clauses re tained, percentage of successful unifications, and some of the parameters govern ing each experiment are given together with the actual set of clauses employed therein. Index Terms—Clause sets, resolution, theorem-proving, UR resolution. INTRODUCTION Experimentation with and evaluation of an automated theorem-proving pro gram require a varied problem set. A member of such a problem set cannot be specified by simply "stating the problem" under consideration. The actual clauses corresponding to the axioms of the underlying theory together with those for the denial of the theorem in question must be given. It is well known that the omission of one of the two 4-clauses, for example, corresponding to the usual formulation of associativity of addition in ring theory can materially impede the performance of a theorem-proving program. It is, however, the other side of this issue which is of concern here. Experiments conducted with abbreviated or with minimal clause sets yield little information about the value of a new strategy or a new inference rule and, unfortunately, are in fact often misleading. Because of these considerations a large and varied problem set has been assembled, many of which are presented herein, in addition to the usual mathematical formulation, in a clause formulation. Although some automated theorem-proving procedures are tailored for a specific field of mathematics, much effort is devoted to the development of pro cedures which have value for a wide variety of mathematical problems. In this regard problems are given, among others, from various fields of algebra, Tarskian geometry, category theory, and program verification. But perhaps the most im portant dimension of the problem set given herein is its breadth of difficulty. Too often in the literature one encounters solutions to quite trivial problems as evidence for the worth of a new idea, and even more so, seldom does one find therein examples on which the cited effort failed. Included among the examples are the often-cited easy problems, some problems which the authors consider quite difficult but solvable by the program described here, and some quite dif ficult which were not provable with the just-mentioned program. Many experiments, including some that failed, are given here. In addition to the clauses characterizing a problem, the values for some of the input pa rameters governing the approach taken and various statistics resulting from the corresponding experiments are presented. Although one of the four standard ap proaches, described in a later section, was chosen for most of the experiments,
168
Collected Works of Larry Wos
some, but not all, of the harder theorems were proven with a nonstandard approach. Such examples definitely have an ad hoc flavor. It is not known at this time whether the ad hoc designation is correct or whether a standard ap proach can be developed to deal with such examples. Nor is it yet clear how the choice of the standard approach is to be made. The experiments are offered not only as evidence of the potential power of the program but also for the purpose of comparative evaluation. Although it might be somewhat difficult to directly use the time taken to obtain a proof because of the difference in computer speeds, the values associated with clauses generated, and with clauses retained do provide a basis for comparison.
BRIEF DESCRIPTION OF T H E PROGRAM The program referenced in this paper has a variety of features which enhance its performance. Although a detailed description of these features is available elsewhere [3], a summary will be presented here. Because most of these features were necessary to obtain proofs of the more difficult problems, and because many reported implementations lack one or more of these features, it is hoped that this summary will prove useful to those designing new programs, as well as those with existing programs. 1) Only one copy of a literal or term (other than a variable) is maintained. All clauses containing a given literal will contain references to the same copy of that literal. Each literal will reference all clauses that contain it, and each argument of a literal/term will refer back to the containing literal/term. The advantages which accrue to such a representation are substantial. One of the most significant is that once a unification of two literals has been established, an entire set of resolvents has been calculated. In the case of pararnodulation or demodulation a similar situation exists when two terms have been unified. 2) A set of lists, referred to as FPA lists, is maintained such that each list identifies all literals which a) have a designated sign, b) have a designated predicate symbol, and c) have a designated symbol occurring as the initial symbol in a specified argument. For example, a list will be kept for all negative literals that have P as the predicate symbol and have g as the first symbol in the second argument. A reserved symbol will be used to indicate the presence of any variable (rather than a specific variable symbol). To illustrate the use of these lists, suppose that the program must determine which literals of opposite; sign might unify with Q(a,g(f(x,c))). First, the union of the following two FPA lists is formed: a) the FPA list of all negative literals with Q as the predicate symbol and a as the first symbol in the first argument;
Problems and Experiments—Automated
Theorem-Proving Programs
169
b) the FPA list of all negative literals with Q as the predicate symbol and any variable symbol as the first symbol in the first argument. Next, a similar union is formed for the second argument. The inter section of the two resulting lists gives a set of literals which can be tested with the complete unification algorithm. Since it is critical that FPA lists can be referenced rapidly, a rather natural key is associated with each list, and a hash table of pointers to the list headers is maintained. By using the approach of FPA lists to prescreen literals before attempting complete unifications, the program normally is successful on at least 50 percent of attempting unifications (although on some problems in which the level of nested functions is quite high, the percent of success is much less). 3) The use of demodulation appears to be necessary to avoid an excessive number of essentially (semantically) identical clauses. Most previous the orem proving programs that utilize demodulation would simply read as input a fixed set of demodulators along with the statement of the prob lem. This may be referred to as static demodulation. However, a significant advantage can be gained by adding demodulators as positive unit equality clauses are produced. Thus, if /(o,6) = c is deduced at some point in the run, the demodulator /(o,6) =*• c might beneficially be added to the set of demodulators. This ability to add demodulators as the corresponding equalities are detected will be called dynamic demodulation. For many of the problems in the set presented herein, the use of dynamic demodulation was essential (in the sense that the program would not have obtained a proof, otherwise). The implemen tation of dynamic demodulation required solutions to several problems: a) Cycles of the form tI => t2 =►•••=*• h must be avoided. To prevent this a total ordering of all terms is defined and a term can only be demodulated to "simpler" terms. b) Since the number of active demodulators can become quite large, some means of rapidly selecting relevant demodulators to use against a given term had to be developed. The selected approach is described in detail elsewhere [1]. c) When a new demodulator is added, clauses already existing should be demodulated. To efficiently accomplish this, FPA lists correspond ing to arguments of terms were introduced (these lists are useful in
Collected Works of Larry Wos
170
implementing paramodulation, as well). Once a set of terms which can be demodulated has been determined, the program can rapidly trace back to the affected clauses. d) Once the equality
U =t2 has been generated, some means must exist for determining whether or not t\ => <2 should be added as a demodulator. In the current program the demodulator will be added if the difference in complexity of t\ and <2 exceeds a specified input parameter. 4) Subsumption was used on all problems. Any generated clause which was subsumed by an existing clause was not added to the clause space. Further, if any previously existing clause was subsumed by a generated clause, it was removed from the clause space. While proofs of the simple problems could probably have been obtained without these features, on the more demanding problems the use of subsumption was essential. For techniques of implementing a relatively efficient subsumption algorithm the reader is referred to [3]. Restricted subsumption tests, such as unit subsumption, have been widely used. However, for problems that do not formulate nat urally as Horn sets, the general test appears warranted and is, in fact, not prohibitively slow. 5) Previous work has illustrated the advantages of establishing a measure of the "complexity" of terms and setting a bound on the complexity of allowable terms. In some cases the straightforward approach of limiting the number of symbols in a term proved inadequate. Therefore, the current program contains a mechanism for specifying more precise measures. Not only were clauses containing terms above a certain complexity rejected, the theorem prover was biased to process clauses in an order related to the complexity of the terms contained in each clause. For a more detailed discussion see [1], [3]. 6) For a theorem prover to be able to process a clause space composed of thousands of clauses, the cost of the basic operations must not be a linear (or worse) function of the number of clauses in the space. One such ba sic operation is to determine whether a designated literal, term, or clause already exists. To deal with this problem efficiently a hash table is main tained. The key of an entry is a literal or a term, and each entry contains a pointer to the corresponding entity (the key itself need not be kept in the table entry, since the pointer to the literal or term is included). Thus, the time to determine whether a given literal or term already exists or not will remain relatively constant. 7) The theorem prover contains a variety of parameters which affact its per formance. Although a comprehensive list is well beyond the scope of this paper, the following are particularly worth nothing:
Problems and Experiments—Automated
Theorem-Proving Programs
171
a) A variety of parameters are used to evaluate the complexity of a term. For example, ground terms may or may not be emphasized. Further, a constant which represents a function of other symbols may either be treated as a more complex term than those of which it is a function, or it may be assigned an identical complexity. For example, if P(o,6,c) identifies c as the product of a and b, then c may be either considered as more complex or of equal (or even less) complexity (depending on input parameters). Of the wide variety of complexities which could be specified to the program, one of the following four were used on most of the problems in the included set: i) complexity of a term = (number of function and variable symbols that occur in the term) ii) complexity of a term = ( # of function symbols) 4- 2*(number of variable symbols) (Let each function symbol be assigned an "intrinsic" complex ity as discussed above.) iii) complexity of a term = (the sum of the complexities associated with the function symbols) + l*(number of variable symbols) iv) complexity of a term = (the sum of the complexities associated with the function symbols) 4- 2* (number of variable symbols) As mentioned in the Introduction, work is in progress to identify whether or not the more specialized complexity measures that were required on some of the harder problems can be generalized. A variety of options govern the performance of subsumption, factor ing, and "qualification" (see Winkers results on qualified hyperresolution [4]). In all of the problems standard settings were employed for these parameters. The authors intend to investigate the effects of altering these parameters. A flag can be set to cause the generation of
to automatically result in immediate generation of t2 = t\. 8) The program currently supports binary resolution, unit resolution, hyperresolution, and UR resolution (a UR-resolvent is a unit clause derived by matching unit clauses against literals in a nucleus; for a more precise def inition see [1]), paramodulation, and factoring. In this set of experiments only hyperresolution, UR resolution, paramodulation, and factoring were employed.
Collected Works of Larry Wos
172
NOTES ON T H E PROBLEMS 1) Problems in group theory. These problems are standard and have appeared in the literature. 2) Proving the isomorphism of two groups. These two problems are included because they illustrate the difficulties introduced by case analysis. 3) Problems in ring theory. Again these are standard. Note that the lemma "Boolean rings have characteristic zero" is not included in the third prob lem. 4) Problems in Boolean algebras. This axiomization and these problems were taken from Chapter 2 of Boolean Algebra and Its Applications by J. Eldon Whitesitt. 5) Problems in Henkin models. These problems were supplied in private cor respondence with D. Luckham. 6) Problems in category theory. This axiomization was taken from Chapter 1 of Theory of Categories by B. Mitchell. 7) Problems in elementary geometry. These axioms for elementary geometry were given in "What is elementary geometry" by A. Tarski (Symposium of the Axiomatic Method). Note that the weakened form of the continuity axiom is used. 8) Problems in elementary set theory. These problems are interesting be cause, although they are simple problems for a mathematician, they prove to be difficult for the program. Some progress on these problems is reported in "An Evaluation of an Implementation of Qualified Hyper-Resolution" by S. K. Winker (presented at the IEEE Workshop on Automated TheoremProving, June 1975). 9) Wang's Problems. Solutions to EXQ2 and EXQ3 have still not been suc cessfully obtained. 10) SAM's Lemma. 11) Program verification problems [1]. These problems were contributed by E. McCharen. 12) Program Verification Problems [11]. These seven problems were contributed by G. Ernst in a private correspondence. 13) Limit Theorems. These three problems were contributed by W. W. Bledsoe in a private correspondence. Proofs of the first two theorems have been obtained using qualified hyperresolution, along with qualified binary resolution. The details of these experiments, however, are not presented in this paper. A. AXIOMS FOR A GROUP (I) CL CL CL CL CL
P(X,Y,F(X,Y» CLOSURE PROPERTY P(E,X,X) EXISTENCE OF AN IDENTITY P(X,E,X) P(G(X),X,E) EXISTENCE OF AN INVERSE P(X,0(X),E) CL -P(X,Y,U) -P(Y,Z,V) -P(X,V,W) PttJ.Z.V) ASSOCIATIVE PROPERTY
Problems and Experiments—Automated Theorem-Proving Progr
CL CL CL CL CL CL CL CL CL CL CL
-P(X,Y,U) -P(Y,Z,V> -P(U,Z,V) P(X,V,U) -P(X,Y,Z) -P(X,Y,W) EQUAL(Z.W) THE OPERATION IS WELL DEFINED EQUAL(X,X) EQUALITY AXIOMS -EQUAL(X.Y) EQUAL(Y.X) -EQUAL(X.Y) -EQUAL(Y.Z) EQUAL(X,Z) -EQUAL(X.Y) EQUAL(FU.W) ,F(Y,W)) EQUALITY SUBSTITUTION AXIOMS -EQUAL(X.Y) EQUAL(F(W,X) ,F(W,Y)) -EQUAL(X.Y) EQUAL(C(X),G(Y)) -EQUAL(X,Y) -P(X,W,Z) P(Y,W,Z) -EQUAL(X.Y) -P(W,X,Z) P(W,Y,Z) -EQUAL(X.Y) -P(W,Z,X) P(W,Z,Y)
TKEOREH Gl. IF X»»2 - X FOR ALL X IN A GROUP G, THEN G IS ABELIAN. CL P(X,X,E) X HAS ORDER 2 CL P(A,B,C) DENIAL OF THE THEOREM CL -P(B,A,C) THEOREM G2. THE INVERSE OF EACH ELEMENT IN A GROUP IS UNIQUE. CL P(A,B,C) DENIAL OF THE THEOREM CL P(B.A.E) CL P(A,C,E) CL P(C,A,E) CL -EqUAL(B.C) THEOREM G3. THE AXIOMS MAY BE WEAKENED BY ASSUMING THAT E IS JUST A LEFT IDENTITY AND THAT LEFT INVERSES EXIST. E IS A RIGHT IDENTITY. (THE AXIOMS P(X,E,X) AND P(X,G(X),E) SHOULD BE DELETED.) CL -P(A,E,A) DENIAL OF THE THEOREM THEOREM G4. THE AXIOMS MAY BE WEAKENED BY ASSUMING THAT E IS JUST A LEFT IDENTITY AND THAT LEFT INVERSES EXIST. EACH ELEMENT HAS A RICHT INVERSE. (THE AXIOMS P(X,E,X) AND P(X,G(X),E) SHOULD BE DELETED.) CL -P(A,Y,E) DENIAL OF THE THEOREM THEOREM GS. THE AXIOMS HAY BE WEAKENED BY ASSUMING THAT E IS JUST A LEFT IDENTITY AND THAT LEFT INVERSES EXIST. EACH ELEMENT HAS A RIGHT IDENTITY. (THE AXIOMS P(X,E,X) AND P(X,G(X),E) SHOULD %% BE DELETED.) CL -P(K(Y),Y,K(Y)) DENIAL OF THE THEOREM THEOREM G6. IF X * - > • 3 - E FOR ALL X IN A GROUP C. THEN ((X,Y),Y) - E. X CUBED IS EQUAL TO X CL -P(X,X,Y) P(X,Y,E) CL -P(X,X,Y) P(Y,X,E) DENIAL OF THE THEOREM CL P(A,B,C) CL P(C,G(A),D) CL P(D,G(B),H) CL P(H,B,J) CL P(J,G(H),K) CL -P(K,G(B),E) THE CL CL CL CL CL CL
FOLLOWING IDENTITIES MAY BE ESTABLISHED, EQUAL(FU.E) ,X) EQUAL(F(E,X>,X) EQUAL(F(G(X),X),E) EQUAL(F(X,G(X)),E) EQUAL(G(G(X)),X) EQUAL(G(E),E)
THEOREM G7. SUBGROUPS OF INDEX 2 ARE NORMAL. CL 0(E) DENIAL OF THE THEOREM CL -0(X) 0(C(X)) CL -O(X) -O(Y) -P(X,Y,Z) O(Z) CL -EQUAL(X.Y) -O(X) 0(Y)
Collected Works of Larry Wos
174
CL -EQUAL(X.Y) CL -EQUAL(X.Y) CL O(X) 0(Y) CL OCX) O(Y) CL 0(B) CL P(B,C(A),C) CL P(A,C,D) CL -0(D)
EQUAL(KU,X).I(W,Y)) EQUAL(I(X.W),I(Y.W)) 0(l(X,Y)) P(X,I(X,Y),Y)
******************************************************************* B. AXIOMS FOR A GROUP (II) THE FOLLOWING ARE THE USUAL AXIOMS OF A GROUP WITH AN ADDITIONAL ARGUMENT IN THE USUAL PREDICATES AND FUNCTIONS TO IDENTIFY THE GROUP. CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL a CL CL CL CL
-EL(X.XG) -EL(Y.XG) P(XG,X,Y,F(XG,X,Y)) CLOSURE PROPERTY -EL(X.XG) -EL(Y.XG) EL(F(XG,X,Y),XG) -P(XG,X,Y,Z) -P(XG,X,Y,W) EQUAL(W.Z) THE OPERATION IS WELL DEFINED EL(E(XG),XG) EXISTENCE OF AN IDENTITY P(XG,X,E(XG),X) P(XG,E(XG),X,X) -EL(X.XG) EL(G(XG,X),XG) EXISTENCE OF INVERSES P(XG,X,C(XG,X),E(XG)) P(XG,G(XG,X),X,E(XG)) -P(XG,X,Y,XY) -P(XG,Y,Z,YZ) -P(XG,XY,Z,XYZ) ASSOCIATIVE PROPERTY P(XG,X,XY,XYZ) -P(XG,X,Y,XY) -PCXG.Y.Z.YZ) -P(XG,X,YZ,XYZ) P(XG,XY,Z,XYZ) EQUAL(X.X) EQUALITY AXIOMS -EQUAL(X,Y) EQUAL(Y.X) -EQUAL(X.Y) -EQUAL(Y.Z) EQUAL(X.Z) -EQUAL(XG.YG) -P(XG,X,Y,Z) P(YG,X,Y,Z) EQUALITY SUBSTITUTION AXIOMS -EQUAL(X.Y) -P(XG,X,Z,W) P(XG,Y,Z,W) -EQUAL(X.Y) -P(XG,W,X,Z) P(XG,W,Y,Z) -EQUAL(X.Y) -P(XG,W,Z,X) P(XG,W,Z,Y) -EQUAL(XG.YG) EQUAL(F(XG,X,Y),F(YG,X,Y)) -EQUAL(X.Y) EQUAL(F(XG,X,Z), F(XG,Y,Z) -EQUAL(X.Y) F.QUAL(F(XG,Z,X) ,F(XG,Z,Y) -EQUALCXG.YG) EQUAL(G(XG,X),G(YG,X)) -EQUAL(X.Y) EQUAL(G(XG,X),G(XG,Y)) -EQUAL(XG.YG) -EL(X.XG) EL(X,YG) -EQUALCX.Y) -EL(X.XG) EL(Y,XG) -EQUAL(XG,Y C) EQUAL(E(XG),E(YG))
THEOREM G8. THE GROUPS OF ORDER 2 DEFINED BELOW ARE ISOMORPHIC. CL EL(A,G1) DEFINITION OF THE TWO GROUPS CL EL(B,G1) CL EL(C1,G2) CL EL(C2,G2) CL -EL(X,G1) EQUAL(X.A) EQUAL(X.B) CL - E L ( X , G 2 )
EQUAL(X,C1)
CL
P(G1,A,A,A)
CL CL
P(G1,A,B,B) P(G1,B,A,B)
CL
P(G1,B,B,A)
CL CL CL
P(G2,C1,C1,C1) P(G2,C1,C2,C2) P(G2,C2,C1,C2)
CL
P(G2,C2,C2,C1)
CL CL CL CL CL
EQUAL(K(A),C1) EQUAL(K(B),C2) EL(D1,G1) EL(D2,G1) EL(D3,G1)
EQUALCX.C2)
DEFINITION OF A FUNCTION K DENIAL THAT K IS AN ISOMORPHISM
Problems and Experiments—Automated Theorem-Proving Programs
175
CL P(G1,D1,D2,D3) CL -P(G2,K(DD,K(D2),K(D3)> THEOREM G9. THE GROUPS OF ORDER 3 DEFINED BELOW ARE ISOHORPHIC. CL EL(A, 01) EL(B, C D EL(C, C D EL(C1,G2) CL EL(C2,G2) CL EL(C3,G2) CL -EL(X,CD EQUALU.A) EQUAL <X,B> EQUAL(X.C) a -ELU.C2) EQUAL(X,CD EQUAL(X,C2) EQUAL(X,C3) CL P(G1,A,A,A) P(G1,A,B,B) CL P(G1,B,A,B) CL P(G1.A,C,C) CL P(G1,C,A,C) P(G1,B,B,C) CL P(G1,B,C,A) CL P(G1,C,B,A) CL P(G1,C,C,B) CL P(G2.C1,C1,CD CL P(G2,C1,C2,C2) CL P(G2,C2,C1,C2) P(G2,C1,C3,C3) CL P(G2,C3,C1,C3) P(G2,C2,C2,C3) CL P(G2,C2,C3,CD CL P)
a a a
a
a
a a
******************************************************************* C. AXIOMS FOR A RING EXISTENCE OF AN ADDITIVE IDENTITY
CL CL CL CL CL CL CL CL CL CL CL
S(E,X,X) StX.E.X) S(X,Y,J(X,Y)) P(X,Y,F(X,Y)) S(G(X),X,E) S(X,G(X),E) -S(X,Y,VO) -S(Y,Z,V) -S(X.Y.VO) -S(Y,Z,V) -PCX.Y.VO) -P(Y,Z,V) -P(X,Y,VO) -P(Y,Z,V) -S(X,Y,Z) S(Y,X,Z)
CL CL CL CL CL CL CL CL CL CL CL CL
-P(X,Y,V1) -P(X,Z,¥2) -SCY.Z.V3) -P(X,Y,VD •-P(X.Z,V2) -S(Y.Z,V3) -P(Y,X,V1) -P(Z,X,V2) -S(Y,Z.V3) -P(Y,X,V1) -P(Z,X,V2) -StY,Z.V3) EQUAL(X.X) -EQUAL(X.Y) EQUAHY, X) -EQUAL(X,Y) -EQUAL(Y,Z) EQUAL(X .Z) -EQUAL(X,Y> -SU.W.Z) S(Y.W,Z) EQUALITY SUBSTITUTION AXIOMS -EQUAL(X,Y) -S(W,X,Z) S(W,Y,Z) -EQUAL(X.Y) -S(W,Z,X) S(VI,Z,Y) -EQUALCX.Y) -PCX.W.Z) P(Y,¥,Z) -EQUAL(X,Y) -PCW.X.Z) P(W,Y,Z)
CLOSURE PROPERTY EXISTENCE OF INVERSES -S(X,V,W) -S(VO,Z,U) -P(X,V,W) -P(VO.Z.W)
S(VO,Z,W) ASSOCIATIVE PROPERTY S(X,V,W) P(VO,Z,W) P(X,V,W) COMMUTATIVE PROPERTY DISTRIBUTIVE PROPERTY -P(X,V3,V4) S(V1,V2,V4) -S(V1,V2,V4) P(X,V3,V4) -S(V3,X,V4) S(V1,V2,V4) -S(V1,V2,V4) P(V3,X,V4) EQUALITY AXIOMS
Collected Works of Larry Wos
176
CL CL CL CL CL CL CL CL
-EOUAL(X.Y) -P(W,Z,X) P(W.Z.Y) -EQUAL(X,Y) EQUAL(C(X).C(Y)) -EQUAL(X,Y) EQUAL(F(X,W>,F(Y,V)) -EQUAL(X,Y) EQUAL{F(W,X>,F(W,Y)) -EQUAL(X.Y) EQUAL(J(X,W).J(Y,W)) -EQUAL(X.Y) EQUAL(J(W,X),J(W.Y)) -S(X.Y.W) - S(X.Y.Z) EQUAL(U,Z) -P(X,Y,V) -P(X.Y.Z) EQUAL(W,Z)
ESTABLISHED LEMMAS CL -S(X,Y,Z) -S(X,W,Z) CL -S(X.Y.Z) -S(W,Y,Z)
EQUAL(Y.W) EQUAL(X.W)
THEOREM Rl. X » 0 - 0 CL -P(A,E,E) THEOREM R2. <-X) » (-Y) - I • Y CL P(A.B.C) CL P(G(A).G(B),D) CL -EQUAL(C,D)
THE OPERATIONS ARE WELL DEFINED
CANCELLATION LAWS
DENIAL OF THE THEOREM
DENIAL OF THE THEOREM
THEOREM R3. IF X • X - X FOR ALL X, THEN THE RING IS COMMUTATIVE. CL PCX.X.X) DENIAL OF THE THEOREM CL P(A.B.C) CL -P(B,A,C)
******************************************************************* D. AXIOMS FOR A BOOLEAN ALGEBRA CL
SUM(X,Y,F1(X.Y))
CL
PROD(X,Y,F2(X,Y))
CL -SUH(X,Y,V3) CL -PR0D(X,Y,V3) CL
SUM(X.CI.X)
CL
SUM(C1,X,X)
CL
PR0D(X,C2,X)
CL
PR0D(C2.X,X)
CL CL CL CL CL CL a. CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL a CL CL
SUM(Y.X,V3)
CLOSURE PROPERTY COMMUTATIVE PROPERTY
PR0D(Y,X,V3)
EXISTENCE OF IDENTITIES
DISTRIBUTIVE PROPERTY -PROD(X,Y,Vl) -PR0D(X,Z.V2) -SUH(Y,Z,V3) -PR0D(I,V3,V4) SUM(V1,V2,V4) -PROD(X,Y,Vl) -PR0D(X,Z,V2) -SUM(Y.Z,V3) -SUM(V1,V2,V4) PR0D(V,V3.V4) -PROD(Y.Z.Vl) -PR0D(Z,X,V2) -SUM(Y,Z,V3) -PR0D(V3.X.V4) SUM(V1,V2,V4) -PR0D(Y,X,V1) -PR0D(Z,X,V2) -SUM(Y,Z,V3) -SUM(V1,V2,V4) PR0D(V3,X,V4) -SUM(X,Y,V1) • SUM(X,Z,V2) -PR0D(Y,Z,V3) -SUM(X,V3,V4) PR0D(V1.V2.V4) -SUM(X,Y,VU ■ SUM(X,Z,V2) -PR0D(Y.Z,V3) -PROD(Vl.V2.V4) SUM(X,V3,V4) -SUH(Y,X,VI) • Stm(Z,X,V2) -PR0D(Y,Z,V3) -SUM(V3,X,V4) PR0D(Vl,V2,V4) -SUM(Y,X,VO ■ SUM(Z,X,V2) -PR0D(Y,Z,V3) -PR0D(V1,V2,V4) SUM(V3.X,V4) EXISTENCE OF COMPLEMENTS SUM(X,F3(X),C2) SUM(F3(X),X,C2) PR0D(X,F3(X),C1) PR0D(F3(X),X,C1) -SUM(X,Y,U) -SUM(X,Y,V) EQUAL(U.V) THE OPERATIONS ARE WELL DEFINED -PROD(X.Y.U) -PROD(X,Y,V) EQUAL(U.V) EQUALU.X) EQUALITY AXIOMS -EQUAL(X,Y) EQUAL(Y.X) -EQUAL(X.Y) -EQUAL(Y.Z) EQUAL(X.Z) -EQUAL(X,Y) -SUM(X.V1,V2) SUM(Y,V1,V2) EQUALITY SUBSTITUTION AXIOMS -EQUAL(X,Y) -SUM(V1,X,V2) SUH(V1.Y,V2) -EQUAL(X,Y) -SUM(V1,V2,X) SUM(V1,V2.Y) -EQUAL(X,Y) -PR0D(X,V1,V2) PR0D(Y,V1,V2) -EQUAL(X.Y) -PR0D(V1,X.V2) PR0D(V1,Y,V2) -EQUAL(X,Y) -PR0D(V1,V2,X) PR0D(V1,V2.Y) -EQUAL(X.Y) EQUAL(F1(I.V1),F1(Y.V1)) -EQUAL(X.Y) EQUAL(F1(V1.X),F1(V1,Y)) -EQUAL(X.Y) EQUAL(F2(X,V1) ,F2(Y,VD)
Problems and Experiments—Automated Theorem-Proving Programs CL -EQUALU.Y) CL -EQUALU.Y)
177
EQUAL
THEOREM B l . X + (Y + Z) - (X + Y) + Z CL SUM(C4,C5,CT) CL SUM(C3,C7,C8) a SUH(C3,C4,C9) CL SUM(C9,C5,C10) CL -EQUAL(C8,C10) THEOREM B2. X ♦ X - X AND X • X - X. CL -SUK(C3,C3,C3) -PR0D(C3,C3,C3)
DENIAL OF THE THEOREM
DENIAL OF THE THEOREM
THEOREM B3. X <■ C2 - C2 AND X » Cl - Cl. CL -SUM(C3,C2,C2) -PR0D(C3,C1,C1) DENIAL OF THE THEOREM THEOREM B4. X ♦ (X • Y) - X AND X • ( X + Y) - X. CL -SUM(C3,F2(C3,C4),C3) -PR0D(C3,F1(C3,C4),C4) DENIAL OF THE THEOREM THEOREM B5. X + C2 - C2. CL -SUM(C3,C2,C2)
DENIAL OF THE THEOREM
THEOREM B6. X • Cl - Cl. CL -PR0D(C3,C1,C1)
DENIAL OF THE THEOREM
THEOREM BT. THE COMPLEMENT OF ZERO IS THE IDENTITY. CL -EQUAL(F3(C1) ,C2) DENIAL OF THE THEOREM THEOREM B8.-(-X) - X. (-X IS THE COMPLEMENT OF X.) CL -EQUAL(F3(F3(A)),A) DENIAL OF THE THEOREM THE REMAININC THEOREMS IN BOOLEAN ALGEBRAS WERE OBTAINED IN A NESTED MANNER I.E., EACH THEOREM IS ASSUMED AS A LEMMA IN ALL OF THE SUCCEEDING THEOREMS. CL CL CL CL CL CL CL CL CL CL CL CL CL
SUM(X,X,X) ESTABLISHED LEMMAS PROD(X.X.X) SUM(X,C2,C2) PROD(X.Cl.Cl) -PROD(X,Y,Z) SUM(X,Z,X) -SUM(X,Y,Z) PROD(X,Z,X) SUM(X,F2(X,Y,X) PROD(X,Fl(X,Y),X) -SUH(X,Y,XY) -SUM(Y,Z,YZ) -SUM(X.YZ.XYZ) SUM(XY,Z,XYZ) -SUM(X,Y,XY) -SUM(Y,Z,YZ) -SUM(XY,Z,IYZ) SUM(X,YZ,XYZ) -PROD(X,Y,XY) -PROD(Y,Z,YZ) -PROD(X,YZ,XYZ) PROD(XY,Z,XYZ) -PROD(X.Y.XY) -PR0D(Y,Z,YZ) -PROD(XY,Z,XYZ) PROD(X,YZ,XYZ) -EgUAL(F3(F3(C3)),C3) DENIAL OF THE THEOREM
THEOREM B9. FOR ALL X, THE COMPLEMENT OF X IS UNIQUE. CL EQUAL(F3(F3(X)),X) ADDITIONAL LEMMA CL SUM(C3,C4,C2) DENIAL OF THE THEOREM CL SUM(C3,C5,C2) CL PR0D(C3,C4,C1) CL PR0D(C3,C5,C1) CL -EQUAL(C4,C5) THEOREM BIO.-CX + Y) • (-X) ♦ (-Y). CL -SUM(X,Y,C2) -SUM(X,Z,C2) -J>ROD(X,Y,Cl) ADDITIONAL LEMMA PR0D(X,Z,C1)EQUAL(Y,Z) CL SUM(C3,C4,C5) DENIAL OF THE THEOREM CL PR0D(F3(C3),F3(C4),C6) CL -EQUAL(F3(C5),C6)
******************************************************************* E. HENKIN MODELS
Collected Works of Larry Wos
178
THE FOLLOWING AXIOMS CHARACTERIZE HENKIN MODELS. IN THE FOLLOWING E IS THE ZERO, AND D IS THE IDENTITY. PU,Y,Z) MEANS X/Y - Z, AND LE MEANS LESS THAN OR EQUAL. CL CL CL CL
-LE(X,Y) PtX.Y.E) -P(X,Y,E) LE(X.Y) -PCX.Y.Z) LE(Z.X) -PCX,Y,VI) -P(Y,Z,V2) -P(X,Z,V3) -P(V3,V2,V4> -P(V1,Z,VS) LE(V4,V5) CL LE(E,X) a -LE(X.Y) -LE(Y.X) EQUAL(X.Y)
a a CL CL a CL CL CL CL CL CL CL CL
LE<X,D)
DEFINITION OF LESS THAN OR EQUAL X/Y <- X (X/Y)/(Y/Z) <- (X/Y)/Z 0<-X X <- Y AND Y<-X — > X - Y X <- 1 CLOSURE PROPERTY THE OPERATION IS WELL DEFINED EQUALITY AXIOMS
P(X,Y,F(X,Y)) -P(X.Y.Z) -P(X,Y,W) EQUAL(Z.W) EQUALCX.X) -EQUAL(X,Y) EQUAL(Y.X) -EQUAL(X.Y) -EQUALCY.Z) EQUAL U,Z) EQUALITY SUBSTITUTION AXIOMS -EQUALU.Y) -P(X,W,Z) P(Y.W.Z) -EQUAL(X,Y) -P(W,X,Z) P(W,Y,Z) -EQUAL(X,Y) -P(W,Z,X) P(W.Z.Y) -EQUAL(X,Y) LE(X,Z) LE(Y,Z) -EQUAL(X.Y) -LE(Z,X) LE(Z.Y) -EQUALU.Y) EQUAL(F(X,W),F(Y,W)) -EQUAL(X.Y) EQUAL(F(W,X),F(W,Y))
THE FOLLOWING SET OF THEOREMS WERE OBTAINED IN A NESTED MANNER I.E., EACH THEOREM ASSUMES THE PREVIOUS THEOREMS AS LEMMAS. EACH PROBLEM INCLUDES THE STATEMENT OF THE THEOREM WHICH IMMEDIATELY PRECEDED IT, AND THIS WAS ASSUMED IN THE SUCCEEDING THEOREMS. THEOREM HI. X/l - 0.
a -P(A,D,E)
DENIAL OF THE THEOREM
THEOREM H2. 0/X - X. CL P(X,D,E) CL -P(E,A,E)
ADDITIONAL LEMMA DENIAL OF THE THEOREM
THEOREM H3. X/X CL P(E,X,E) CL -P(A,A,E)
0. ADDITION LEMMA DENIAL OF THE THEOREM
THEOREM H4. X/0
a. P(X,X,E)
ADDITIONAL LEMMA DENIAL OF THE THEOREM
CL -P(A,E,A) THEOREM H5. THE RELATION LESS THAN CL P(X,E,X) CL LE(A.Al) CL LECA1.A2) CL -LEU.A2) THEOREM H6. X/Y <-Z CL -LEU.Y) -LE(Y,Z) CL P(A,B,C1) CL LE
> X/Z < — Y " LE(X,Z)
THEOREH H7. X <- Y > X/Y <- Z/X. CL -P(X,Y,W1) -LE(Wl.Z) -P(X,Z,W2) CL LE(A.B) CL P(C1,B,B1) CL P(C1,A,A1) CL -LE(B1,A1)
EQUAL IS TRANSITIVE. ADDITIONAL LEMMA DENIAL OF THE THEOREM
ADDITIONAL LEMMA DENIAL OF THE THEOREH
LE(W2,Y) ADDITIONAL LEMMA DENIAL OF THE THEOREM
Problems and Experiments—Automated Theorem-Proving Programs
179
THEOREM H8. X <- Y > X/Z <- Y/Z. CL -LE(X.Y) -P(Z,Y,V1> -P(Z,X,W2) LE<W1,W2) ADDITIONAL LEMMA CL LE(A,B) DENIAL OF THE THEOREM CL P(A,C1,A1) CL P(B,C1,BD CL -LE(Al.Bl) THEOREM H9. FOR ANY X, LET X' BE DEFINED AS I/X. THEN X' - X"'. CL -LE(X,Y) -P(X,Z,W1) -P(Y,Z,W2) LE(W1,W2) ADDITIONAL LEMMA CL P(D,A,B) DENIAL OF THE THEOREM CL P(D,B.BD CL P(D,B1,B2) CL -EQUAL(B,B2) THEOREM H10. X' - X'/(l/x'). CL -P(D,X,Y1) -P(D,Y1,Y2) -P(D,Y2,Y3) CL P(D,A,B) CL P(D,B,B1) CL P(B,B1,B2) CL -EQUAL(B,B2)
EQUAL(Y1,Y3) ADDITIONAL LEMMA DENIAL OF THE THEOREM
THEOREM Hll. DEFINE THE OPERATION k ON THE SET OF Z'. WHERE Z'Z - 1/Z, BY X' * Y* - X'U/Y'). THE OPERATION IS COMMUTATIVE. a -P(D,X,Y1) -P(D,Y1,Y2) -P(Y1,Y2,Y3) EQUAL(Y1,Y3) ADDITIONAL LEMMA CL P(D,A,A1) DENIAL OF THE THEOREM CL P(D,B,B1) CL P(D,B1,B2) CL PCA1,B2,C1) CL P(D,A1,A2) CL P(B1,A2,C2) CL -EQUAL(C1,C2)
*****************;*****#*******#************************************ F. CATEGORY THEORY AXIOMS CL CL CL CL CL CL CL CL CL a CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL
-DEF(X.Y) P(X,Y,F(X,Y)) COMPOSITION IS CLOSED WHEN DEFINED -P(X,Y,Z) DEF(X.Y) -P(X,Y,XY) -DEF(XY.Z) DEF(Y.Z) ASSOCIATIVITY PROPERTY -P(X,Y,XY) -P(Y,Z,YZ) -DEF(XY.Z) DEF(X.YZ) -P(X,Y,XY) -P(XY,Z,XYZ) -P(Y,Z,YZ) P(X.YZ,XYZ) -P(Y,Z,YZ) -DEF(X.YZ) DEF(X.Y) -P(Y,Z,YZ) -P(X,Y,XY) -DEF(X.YZ) DEF(XY.Z) -P(Y,Z,YZ) -P(X.YZ.XYZ) -P(X,Y,XY) P(XY,Z,XYZ) -DEF(X.Y) -DEF(Y.Z) -IDENT(Y) DEF(X.Z)- SPECIAL AXIOM IDENT(DOMU)) PROPERTIES OF DOMCX) AND RGE(X) IDENT(RCE(X)) DEF(X,DOM(X)) DEF(ROE(X),X) P(X,DOM(X),X) P(RCE(X),X,X) -DEF(X.Y) -IDENT(X) P(X,Y,Y) DEFINITION OF THE IDENTITY PREDICATE -DEF(X.Y) -IDENT(Y) PCX.Y.X) EQUAL(X.X) EQUALITY AXIOMS -EQUAL(X.Y) EQUAL(Y.X) -EQUAL(X.Y) -EQUAL(Y.Z) EQUAL(X.Z) -EQUAL(X.Y) -P(X,Z,W) P(Y.Z.W) EQUALITY SUBSTITUTION AXIOMS -EQUAL(X.Y) -P(Z,X,W) P(Z,Y,W) -EQUAL(X.Y) -P(Z,W,X) P(Z,W,Y) -EQUAL(X.Y) EQUAL(DOM(X) ,DOM(Y)) -EQUAL(X.Y) EQUAL(RCE(X) ,RGE(Y)) -EQUAL(X.Y) -IDENT(X) IDENT(Y)) -EQUAL(X.Y) -DEF(X.Z) DEFCY.Z)
Collected Works of Larry Wos
180
CL CL CL CL
-EQUAL(X,Y) -DEF(Z,X) DEF(2,Y) -EQUAL(X.Y) EQUAL(F(Z,X),F(Z,Y)) -EQUAL(X.Y) EQUAL(F(X,Z),F(Y,Z)) -P(X,Y,Z) -P(X,Y,W) EQUAL(Z,V)
COMPOSITION IS WELL DEFINED
THEOREM Cl. IF XY IS A MONOHORPHISM, THEN Y IS A MONOMORPHISM. CL P(A,B,C) DENIAL OF THE THEOREM CL -P(C,X,W) -P(C.Y.W) EQUAL(X.Y) CL P(B,A2,D) CL P(B,A1,D) CL -EQUAL(A2,A1) THEOREM C2. IF X AND Y ARE MONOMORPHISMS AND XY IS DEFINED, THEN XY IS A HONOMORPHISH. CL -P(A,X,W) -P(A,V,W) EQUAL(X.Y) DENIAL OF THE THEOREM CL -P(B,X,W) -P(B,Y,W) EQUAL(I,Y) CL P(A,B,C) CL P(C,A2,D) CL P(C,A1,D) CL -EqUAL(A2,Al) THEOREM C3. IF XY IS AN EPINORPHISM, THEN X IS AN EPIMORPHISM. CL P(A,B,C) DENIAL OF THE THEOREM CL -P(X,C,W) -P(Y,C,U) EQUALU.Y) CL P(A2,A,D) CL P(A1,A,D) CL -E0UAL(A2,A1) THEOREM C4. IF X AND Y ARE EPIMORPHISMS AND XY IS DEFINED, THEN XY IS All EPIMORPHISM. CL -P(X,A,W) -P(Y.A.W) EQUAL(X.Y) DENIAL OF THE THEOREM CL -P(X,B,W) -P(Y,B,W) EQUALCX.Y) CL P(A,B,C) CL P(A2,C,D) CL P(A1,C,D) CL -EQUAL(A2,A1) THEOREM CS. DOM(X) IS THE UNIQUE IDENTITY I SUCH THAT XI IS DEFINED. CL DEF(A.Q) DENIAL OF THE THEOREM CL IDENT(Q) CL -EQUAL(DOM(A),Q) THEOREM C6. ROE(X) IS THE UNIQUE IDENTITY J SUCH THAT JX IS DEFINED. CL DEF(J.A) DENIAL OF THE THEOREM CL IDENT(J) CL -EQUAL(RCE(A),J) THEOREM C7. IF DOM(X) - RGE(Y), THEN XY IS DEFINED. CL EQUAL(DON(A),ROE(B)) DENIAL OF THE THEOREM CL -DEF(A.B) THEOREM C8. IF XY IS DEFINED THEN DOM(X) - RGE(Y). CL DEF(A.B) DENIAL OF THE THEOREM
CL -EQUAL(DOM(A),RS(B))
*^t******************tt**
*******************************************
G. TARSKI'S AXIOMS FOR CEOMETRY IN THE FOLLOWING B(X.Y.Z) MEANS THE POINT Y IS BETWEEN X AND Z, AND L(W,X,Y,Z) MEANS THAN THE DISTANCE FROM W TO X IS THE SAME AS THAT FROM Y TO Z.
Problems and Experiments—Automated Theorem-Proving Progr
CL -B(X,Y,X) EQUALCX.Y) IDENTITY AXIOM FOR BETVEENNESS CL -B(X,Y,V) -B(Y,Z,V) B(X,Y,Z) TRANSITIVITY AXIOM FOR BETVEENNESS CL -B(X,Y,Z) -B(X,Y,V) EQUAL(X.Y) CONNECTIVITY AXIOM FOR BETVEENNESS BCX.Z.V) B(X.V,Z) CL LCX.Y.Y.X) REFLEXIVITY AXIOM FOR EQUIDISTANCE CL -L(X,Y,Z,Z) EQUAL(X.Y) IDENTITY AXIOM FOR EQUIDISTANCE CL -L(X,Y,Z,V) -L(X,Y,V2,V) L(Z,V,V2,V) TRANSITIVITY AXIOM FOR EQUIDISTANCE CL -BCX.V.V) -B(Y,V,Z) B(X,F1CV.X,Y,Z,V),Y) PASCH'S AXIOM CL -BCX.V.V) -B(Y,V,Z) B(Z,W,F1(V,X,Y,Z,V)) CL -B(X,V,V) -B(Y,V,Z) EQUALCX.V) B(X,Z,F2(V,X,Y,Z,V)) EUCLID'S AXIOM CL -B(X,V,V) -BCY.V.Z) EQUALCX.V) B(X.Y,F3(W,X,Y.Z,V)) a -BCX.V.W) -B(Y,V,Z) EQUAL(X,V) B(F2(V,X,Y,Z,V) ,V,F3(W,X,Y,Z,V)) CL -L(X,Y,X1,Y1) -L(Y,Z,Y1,Z1) -L(X,V,X1,V1) FIVE SEGMENT AXIOM -L(Y,V,Y1,V1) -B(X,Y,Z) -B(X1,Y1,Z1) EQUAL(X.Y) L(Z,V,Z1,V1) CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL a CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL
B(X,Y,F4(X,Y,W,V)) SEGMENT CONSTRUCTION AXIOM L(Y,F4(X,Y,V,V),W,V) -B(C1,C2,C3) LOVER DIMENSION AXIOM -B(C2,C3,C1) -B(C3,C1,C2) -LCX.V.X.V) -LCY.V.Y.V) -L(Z,V,Z,V) UPPER DIMENSION AXIOM EQUAL(V,V) B(X,Y,Z) B(Y,Z,X) B(Z,X Y) -LCV.X.V.Xl) -L(V,Z,V.Z1) B(V,X,Z) CONTINUITY AXIOM -B(X,Y,Z) L(V,Y,V,FS(X,Y,Z,X1,Z1,V)) -L(V,X,V,X1) -L(V,Z,V,Z1) -B(V,X,Z) -B(X,Y,Z) BCX1,F5(X,Y,Z,X1,Z1,V),Z1) EQUALCX.X) EQUALITY AXIOMS -EQUALCX.Y) EQUAL(Y.X) EQUALITY SUBSTITUTION AXIOMS -EQUAL(X,Y) -B(X.W.Z) B(Y,W,Z) -EQUALCX.Y) -B(W,X,Z) BCV.Y.Z) -EQUAL(X.Y) -B(V,Z,X) B(V.Z.Y) -EQUAL(X.Y) -L(X,V,V,Z) L(Y,V.V,Z) -EQUALCX.Y) -L(V,X,V,Z) LCV.Y.V.Z) -EQUALCX.Y) -L(V,V,X,Z) L(V.V.Y.Z) -EQUALCX.Y) -L(V,V,Z,X) L(V,V,Y,Z) -EQUALCX.Y) EQUAL(F1(X,V1.V2 ,V3,V4) ,F1(Y,V1,V2,V3,V4)) -EQUALCX.Y) EQUAL(FHV1 ,X,V2,V3,V4) ,F1(V1.Y,V2,V3,V4)) -EQUALCX.Y) EQUALCF1CV1 ,V2,X,V3,V4) ,F1(V1 ,V2,Y,V3,V4)) -EQUAL(X.Y) EQUALCF:(V1,V2,V3,X,V4) ,F1(V1,V2,V3,Y,V4>) -EQUAL(X,Y) EQUAL(F1(V1,V2,V3,V4,X) ,F1(V1,V2,V3,V4,Y)) -EQUAL(X.Y) EQUAL(F2(X ) V1,V2,V3.V4),F2(Y.V1,V2,V3,V4)) -EQUAL(X.Y) EqUAL(F2(Vl,X,V2,V3,V4),F2(V1,Y,V2,V3,V4)) -EQUALCX.Y) EQUAL(F2(V1,V2,X,V3,V4) ,F2 Y,V2,V3,V4,VS)) -EQUALCX.Y) EQUALCF5CV1 ,V2,X ,V3,V4,VS) ,F5CV1,V2,Y,V3,V4,VS)) -EQUALCX.Y) EQUALCF5CV1,V2.V3,X.V4,V5) ,F5CV1 ,V2,V3,Y,V4 ( V5)) -EqUALCX.Y) EQUAL(F5(V1.V2,V3,V4.X,V5),F5CV1,V2,V3,V4,Y,VS)) -EQUALCX.Y) EQUAL(F5CV1,V2.V3,V4,VS,X) .F5CVI ,V2,V3,V4,V5,Y))
THEOREM T l . BETVEENNESS IS A SYMMETRIC RELATION. DENIAL OF THE THEOREM CL BCA.B.C) CL -BCC.B.A)
182
Collected Works of Larry Wos
THEOREM T2. FOR ALL X AND T, X IS BETWEEN X AND Y. CL -B(C,C,D) DENIAL OF THE THEOREM THEOREM T3. FOR ALL X AND Y, Y IS BETWEEN X AND Y. CL -B(X,D,D) DENIAL OF THE THEOREM THEOREM T4. EVERY LINE SEGMENT HAS A MIDPOINT. CL -EQUALU.D) DENIAL OF THE THEOREM CL -B(A,X,D) -L(A,X,D,X) THEOREM TS. FOR EACH SEGMENT THERE EXISTS AN ISOCELES TRIANGLE WITH THAT SEGMENT AS ITS BASE. CL -EQUAL(A,D) DENIAL OF THE THEOREM CL -LU.X.D.X) B(A,X,D) THEOREM T6. FOR ANY 3 DISTINCT POINTS Y,X, AND Z, IF Y IS BETWEEN X AND Z, THEN Z IS NOT BETWEEN X AND Y, AND X IS NOT BETWEEN Y AND Z. CL -EQUALU.C) DENIAL OF THE THEOREM CL -EQUAL(C,D) CL -EqUAL(C.D) CL BU,C,D) CL B(C,A,D) B(A,D,C) THEOREM T7. GIVEN 2 DISTINCT POINTS Y AND Z AND 2 POINTS W AND X ON THE LINE Y2 AND TO THE LEFT OF Y, THEN EITHER W IS BETWEEN X AND Y OR X IS BETVEEN W AND Y. CL -EQUALU.C) DENIAL OF THE THEOREM CL B(D,A,C) CL B(E,A,C) CL -B(D,E,A) CL -B(E,D,A) THEOREM TO. IF THE POINTS Y AND W ARE BETVEEN X AND Z, AND IF THE POINT X2 IS BETVEEN Y AND W, THEN X2 IS BETWEEN X AND Z. CL B(A,C,E) DENIAL OF THE THEOREM CL B(A,D,E) CL -B(C,AO,D) CL -B(A,AO,E) THEOREM T9. IF THE POINTS Y AND W ARE BETVEEN X AND Z, THEN EITHER Y IS BETVEEN X AND V OR V IS BETVEEN X AND Y. CL B(A,C,E) DENIAL OF THE THEOREM CL B(A,D,E) CL -B(A,C,D) CL -B(A,D,C) DEFINITION OF COLINEARITY IS DEFINED BY THE FOLLOWING 4 CLAUSES CL -C(X,Y,Z) B(X,Y,Z) B(Y,X,Z) B(X,Z,Y) CL -B(X,Y,Z) C(X,Y.Z) CL -B(Y,X,Z) C(X,Y,Z) CL -B(X,Z,Y) C(X,Y,Z) THEOREM TIO. THE COLINEARITY OF 3 POINTS X, Y, AND Z IMPLIES THEIR COLINEARITY WHEN TAKEN IN ANY ORDER. CL CU,D,E) DENIAL OF THE THEOREM CL -C(A.E.D) -C(D.A.E) -C(D,E,A) -C(E,A,D) -C(E,D,A) THEOREM Til. THE THREE POINTS Cl, C2, AND C3 OF THE AXIOM SET ARE NOT COLINEAR. CL C(C1.C2,C3) DENIAL OF THE THEOREM THEOREM T12. GIVEN 3 DISTINCT AND COLINEAR POINTS X, Y, AND Z, AND A FOURTH POINT W COLINEAR WITH X AND Y, THEN V IS COLINEAR WITH X AND Z AND COLINEAR WITH Y AND Z.
Problems and Experiments—Automated Theorem-Proving Programs
CL CL CL CL CL CL
183
-EQUAUA.D) -EQUAL(A.E) -EQUAL(D,E) CU.D.E) C(A,D,AO) -C(A.E.AO) C(D,E.AO)
THEOREH T13. GIVEN TWO DISTINCT POINTS X AND Y AND THREE POINTS Zl, AND Z3 WHICH ARE COL I NEAR WITH X AND Y, THEN Zl, Z2, AND Z3 ARE COLINEAR. DENIAL OF THE THEOREM CL ■EQUAL (D,E) CL C(D,E,A1) CL C(D,E,A2) CL C(D,E,A3) CL C(A1,A2,A3)
******************************************************************* H. ELEMENTARY SET THEORY IN THE FOLLOWING EQ(XS,YS) REPRESENTS EqUALITY OF SETS, EQE(X.Y) REPRESENTS EQUALITY OF ELEMENTS. DIFEL(XS.YX) REPRESENTS AN ELEMENT IN XS BUT NOT IN YS. CL -EL(X,EMPTY) CL -INCL(XS.YS) -EL(X.XS) EL(X,YS) CL INCL(XS.YS) EL(DIFEL(XS,YS,XS) CL INCL(XS,YS) -EL(DIFEL(XS,YS,YS) CL EL(X.XS) ELU,COKP(XS>) CL -EL(X.IS) -EL(X,COHP(XS)) CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL
a CL CL CL CL CL CL CL
DEFINITION OF THE EMPTY SET AXIOMS OF INCLUSION
AXIOMS OF COMPLEMENTATION
-ELL(X.XS) EL(X,UN1(XS,YS)) AXIOMS OF UNION -EL(X.YS) EL(X.UNKXS.YS)) -EL(X,UNI(XS,YS) EL(X.XS) EL(X.YS) -EL(X.XS) -EL(X.YS) EL(X,INT(XS,YS) AXIOMS OF INTERSECTION -EL(X,INT(XS,YS)) EL(X,XS)) -EL(X,INT(XS,YS)) EL(X,YX) SET EQUALITY AXIOMS -EqUXS.YX) INCL(XS.YS) -EQ(XS.YS) INCL(YS.XS) INCL(XS.YS) -INCL(YS.XS) EQ(XS,YS) EQUALITY AXIOMS EQ(XS.XS) -Eq(XS,YS) EQ(YS,XS) -EQ(XS.YS) -EQ(YS.ZS) EQ(XS,ZS) EQE(X,X) -EQE(X.Y) EQE(Y.X) -EQECX.Y) -EQE(Y.Z) EQE(X.Z) EQUALITY SUBSTITUTION AXIOMS -EQE(X.Y) -EL(X.XS) EL(Y,XS) -EQ(XS.YS) -EL(X.XS) EL(X,YS) -EQ(XS.XP) -INCL(XS.YS) INCL(XP,YS) -EQ(YS.YP) -INCL(XS.YS) INCL(XS.YP) EQE(DIFEl(XS,YS),DIFEL(XP,YS)) -Eq(YS.XP) EQE(DIFEL(XS,YS),DIFEL(XS,YP)) -EQ(YS.YP) EQ(COMP(XS),COMP(XP)) -EQ(XS.XP) EQ(UNKXS.YS) .UNKXP.YS)) -EQ(XS.XP) EQ(UNICXS.YS) .UNKXS.YP)) -EQ(YS,YP) EQCINT(XS.YS) .INT(XP.YS)) -EQ(XS.XP) EQUNT(XS.YS) ,INT(XS.YP)) -EQ(YS.YP)
THEOREM SI. THE COMPLEMENT OF THE COMPLEMENT OF A SET IS THAT SET CL -EQ(COMP(COMP(AS)),AS) DENIAL OF THE THEOREM THEOREM S2. THE INTERSECTION OF SETS IS COMMUTATIVE. CL -EQ(INT(AS.BS),INT(BS,AS>) DENIAL OF THE THEOREH THEOREM S3. THE UNION OF SETS IS COMMUTATIVE. CL -EQ(UNI(AS,BS,UNI(BS,AS)) DENIAL OF THE THEOREM
Collected Works of Larry Wos
184
THEOREM S4. IF A AND B ARE CONTAINED IN C THEN THE UNION OF A AND B IS ALSO. CL INCL(AS,CS) DENIAL OF THE THEOREM CL IHCL(AS,CS) CL -INCL(UNI(AS,BS).CS)
******************************************************************* I. WANC'S PROBLEMS THIS PROBLEM IS EXQ1 PROPOSED BY WANC a -R(M,B) CL -R(B,K) CL -R(K,M) CL R(Y.M) -P(Y,M) -R(F(Y),M) CL R(Y.M) -P(Y,M) -R(F(Y).Y) CL R(Y,M) -P(Y,M) P(Y,F(Y)) CL R(Y,M) -P(Y,M) P(F(Y),Y) CL R(Y,H) P(Y,M) R(V1,M) R(V1,Y) -P(Y,V1) -P(V1,Y) CL R(Y.B) P(Y,B) -R(C(Y).B) a R(Y,B) P(Y,B) -R(G(Y),Y) CL R(Y,B) P(Y,B) P(Y,G(Y)) CL R(Y,B) P(Y,B) P(0(Y),Y) CL R(Y,B) -P(Y.B) R(V,B) R(V,Y) -P(V,V) -P(V,Y) CL R(Y,K) -R(Y,M) P(Y,K) a R(Y,K) -R(Y,B) P(Y,K) CL R(Y,K) R(Y,M) R(Y,B) -P(Y,K) CL Rtt.X) EQUALITY AXIOMS CL -R(X,Y> R(Y,X> CL -R(X.Y) -R(Y,Z) RU,Z> CL -R(X.Y) -P(X,Z) P(Y,Z) EQUALITY SUBSTITUTION AXIOMS CL -R(X,Y) -P(Z,X) P(Z,Y) CL -R(X,Y) R(F(X).F(Y)) CL -R(X.Y) R(G(X).G(Y)) THIS PROBLEM IS EXQ2 PROPOSED BY WANG CL -R(M.B) CL R(B,K) R(M.K) CL R(Y,J) -R(Y.K) P(Y,J) a R(Y.J) R(Y,K) -P(Y,J) CL R(Y,M) -P(Y,M) -R(F(Y),M) CL R(Y,M) -P(Y,M) -R(F(Y),Y) a R(Y,M) -P(Y,M) P(Y,F(Y)) CL R(Y,M) -P(Y,M) P(F(Y),Y) CL R(Y,M) P(Y,M) R(V1.M) R(V1.Y) -P(Y,V1) -P(V1,Y) CL R(Y,B) P(Y,B) -R(G(Y),B) CL R(Y,B) P(Y,B) -R(G(Y),Y) a R(Y,B) P(Y,B) P(Y,G(Y)) CL R(Y,B) P(Y,B) P(G(Y),Y) CL R(Y,B) -P(Y,B) R(V,B) R(V,Y) -P(Y,V) -P(V.Y) CL R(Y,K) -R(Y,M) P(Y,K) CL R(Y,K) -R(Y,B) P(Y.K) CL R(Y,K) R(Y,H) R(Y,B) -P(Y.K) CL R(X,X) EQUALITY AXIOMS CL -R(X,Y) R(Y,X) CL -R<X,Y) -R(Y,Z) R(X.Z) CL -R(X,Y) -P(X,Z) P(Y,Z) EQUALITY SUBSTITUTION AXIOMS a -R(X,Y) -P(Z,X) P(Z.Y) CL -R(X,Y) R(F(X),F(Y)) a -R(X,Y) R(C(X).G(Y)) THIS PROBLEM IS EXQ3 PROPOSED BY WANG CL -R(H,B) CL R(Y,J) -R(Y,K) P(Y,J) CL R(Y,J) R(Y,K) -P(Y,J)
Problems and Experiments—Automated Theorem-Proving Programs
R(Y,M) R(Y,H) R(Y,M) R(Y,M) R(Y,M) R(Y,B) R(Y,B) R(Y,B) R(Y,B) R(Y,B) R(Y,K) R(Y,K) R(Y,K) R(X,Y) R(X,Y) R(X,Y) a -R(X,Y) CL -R(X,Y) CL -R(X,Y) CL -R(X,Y)
-P(Y,M) -P(Y,H) -P(Y,H) -P(Y,H) P(Y,M) P(Y,B) P(Y,B) P(Y,B) P(Y,B) -P(Y,B) -R(Y,M) -R(Y,B) R(Y,H)
185
-R(F(Y),M) -R(F(Y),Y) P(Y,F(Y)) P(FCY),Y) R(V1,M) R(V1,Y) -P(Y.Vl) -P(V1,Y) -R(G(Y),B) -R(G(Y).Y) P(Y,G(Y)) P(G(Y),Y) R(V,B) R(V,Y) -P(Y,V) -P(V.Y) P(Y.K) P(Y,K) R(Y,B) -P(Y,K) EQUALITY AXIOMS
R(Y,X) R(X,Z) -R(Y,Z) P(Y,Z) -P(X,Z) PCZ.Y) -P(Z,X) R(F(X).F(Y)) R(G(X),G(Y))
EQUALITY SUBSTITUTION AXIOMS
******************************************************************* J. AXIOMS FOR A MODULAR LATTICE
a
MAX(CONE,X,<:OKE) MAX(X,X,X) MAX(CZERO,X MIN (CZERO, X.CZERO) MIN(X,X,X) MINCCONE.X,:0 MIN(Y,Z,X) -MIN(X,Y,Z) MAX(Y.X.Z) -MAX(X,Y,Z) MAX(X,Z,X) -MIN(X,Y,Z) HINU.Z.X) -HAX(X,Y,Z) -MIN(X,Y,XY) -HIN(Y,Z.YZ) -MIN(X,Y,XY) -MIN(Y.Z,YZ) -MAX(X,Y,XY) -MAX(Y,Z,YX) -MAX(X,Y,XY) -MAX(Y,Z,YZ) -MIN(X,Z,X) -MAX(X,Y,X1) -MIN(X,Z,X) MAX(X,Y,X1) -MIN(X,Z,Z) -MAX(Y,Z,Y1) CL -MIN(X,Z,Z) -MAX(Y,Z,Y1)
CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL
,x>
a
-HIN(X,YZ,XYZ) MIN(XY,Z,XYZ) -MIN(XY,Z,XYZ) MIN<X,YZ,XYZ) -MAX(X,YZ,XYZ) MAX(XY,Z,XYZ) -MAX(XY,Z,XYZ) MAX(X,YZ,XYZ) -HIN(Y,Z,Y1) -MIN(Z,X1,Z1) -MIN(Y,Z,Y1) -MAX(X,Y1,Z1) -MIN(X,Y,X1) -HIN(X,YI,Z1) -MIN(X,Y,X1) -MAX(Z,X1,Z1)
HAX(X,Y1,,Z1) MIN(Z,X1,,Z1) MAX(Z,X1,,Z1) MIN(X,Y1,,ZD
SAM'S LEMMA. LET L BE A MODULAR LATTICE WITH 0 AND 1. SUPPOSE THAT A AND B ARE ELEMENTS OF L SUCH THAT AVB AND A»B BOTH HAVE COMPLEMENTS, THEN ((A V B)' V ((A t B)' t B)) k ((A V B)' V ((A It B)' * A) - (A V B)' CL CL CL CL CL CL CL CL CL CL
MIN(A,B,C) MAX (D,C,CONE) MIN(B,D,E) MINU.E, CZERO) MAX(B,A2,B2) MAX(A,B2,C0NE) MAX(A,B,C2) MIN(A2,C2,CZERO) MIN(D,A,D2) MAX(A2,D2,E2) MIN(D,B,A3) CL MAX(A2,A3,B3) CL -MIN(B3,E2,A2)
a.
*******************************************************************
Collected Works of Larry Wos
186
K. PROGRAM VERIFICATION (I) THE FOLLOWING SETS OF CLAUSES AROSE IN A NATURAL MANNER FROM WORK DONE IN PROGRAM VERIFICATION. THEOREM PV1. CL -QKX.Y.Z) -LE(X.Y) Q2(X,Y.Z) CL -Q1(X,Y,Z) LE(X.Y) Q3(X,Y.Z) CL -Q2(X,Y,Z) Q4(X,Y.Y) CL -Q3(X,Y,Z) Q4(X,Y,X)
a CL CL CL CL CL a
AXIOMS
LE(X,X) -LE(X,Y) -LE(Y,X) EQUAL(X,Y) -LE(X.Y) -LE(Y,Z) LE(X,Z) LE(X,Y) LE(Y,X) LE(X,Y) -EQUAL U.Y) -EQUAL(X.Y) -LE(X.Z) LE(Y,Z) -EQUAL(X.Y) -LE(Z,X) LE(Z,Y)
CL qi(A,B,C) DENIAL OF THE THEOREM CL -Q4(A,B,W) -LE(A,W) -LE(B,W) -LE(W,A) CL -Q4(A,B,W) -LE(A.W) -LE(B,W) -LE(W.B) THE REMAINING THEOREMS HAVE THE FOLLOWING SET OF AXIOMS IN COMMON CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL
a CL CL CL CL CL CL CL CL CL CL
-QKVJ.VT.VX) Q2(VJ,E(VX,1),VX) -Q2(VJ,VT,VX) Q3(S(1),VT.V -Q3(VJ,VT,VX) -LE(VJ.N) q4(VJ,VT,VX) -Q3(VJ,VT,VX) LE(VJ.N) Q7(VJ,VT,VX) -Q4(VJ,VT,VX) -D(VJ) LE(E(VX.VJ),VT) Q6(VJ.VT,VX) -Q4(VJ,VT,VX) D(VJ) LE(E(VX,VJ),VT) Q5(VJ,VT,VX) -Q5(VJ,VT,VX) D(VJ) 06(VJ,E(VX.VJ),VX) -Q6CVJ.VT.VX) Q3CSCVJ) ,VT,VX) LE(l.N) -LEC1.X) -LE(X,N) D(X) -D(X) LE(l.X) -D(X) LE(1,N) -EQUAL(X,Y) EQUAL(S(X),S(Y)) -LE(X.Y) LE(S(X),S(Y)) -LE(S(X),X) D(l) D(N) LECX.S(X)) -UBCWI.X.Y.Z) LE(W1,W2) UB(W2,X.Y,Z) -UB(W,X,Y,Z1) EQUAL(S(Z1).Z2) -D(Z2) -LE(E(X,Z2),W) UB(W.X,Y,Z2) LECX.X) -LECX.Y) -LE(Y.X) EQUAL(X,Y) -LE(X.Y) -LE(Y.Z) LE(X.Z) LE(X,Y) -EqUALCX.Y) -EQUAL(X.Y) -LE(X,Z) LE(Y,Z) -EQUAL(X.Y) -LE(Z,Y) LE(Z,Y) EQUAL (X.X) -EqUAL(X.Y) EqUAL(Y.X) -EQUALU.Y) •EQUAL(Y.Z) EQUAL(X.Z)
THEOREM PV2. CL QUJ.T.EX) CL LE(l.N) a -03(S(1).VT,EX) -EQUAL(E(EX,1),VT) THEOREM PV3. CL -QKVJ.VT.VX) -LE(M,N) CL -QKVJ.VT.VX) -LE(M.N) CL -QKVJ.VT.VX) -LE(M.N)
DENIAL OF THE THEOREM
Q3(S(M),F(M.VJ,VT,VX),VX) UB(F(M,VJ,VT,VX),VX,1,H) LE(C(M,VJ,VT,VX),M)
DENIAL OF THE THEOREM
Problems and Experiments—Automated Theorem-Proving Programs
187
CL -qiCVJ.VT.VX) -LECH.N) EQUALCECVX.GCM.VJ.VT.VX)) .FCH.VJ.VT.VX) CL QUJ.T.EX) CL LEC1.H) CL LE(SCH).N) CL -Q3(S(S(M)).VT,EX) -UB(VT.EX,1,S(M) THEOREM PV4. CL -Q1CVJ.VT.VX) -LE(M,K) Q3CSCM) ,F(M,VJ,VT,VX) ,VX) DENIAL OF THE THEOREM CL -QUVJ.VT.VX) -LE(M,N) UBCFCM.VJ.VT.VX) ,VX,1,M) CL -Q1CVJ.VT.VX) -LE(M,N) LEU.CCM.VJ.VT.VX)) CL -QKVJ.VT.VX) -LE(H,N) LECGCM.VJ.VT.VX),M) a -qiCVJ.VT.VX) -LECM.N) EQUALCECVX.CCM.VJ.VT.VX)) .FCN.VJ.VT.VX)) CL QI(J.T.EX) CL LE(1,H) CL LECSCM),N) CL -Q3(S(S(M)).VT,EX) -LEC1.VK) -LE(VK,S(M)) -EqUAL(E(EX,VK) ,VT)
******************************************************************* L. PROGRAM VERIFICATION CL CL CL CL CL CL CL CL CL CL CL
EQUALCPDCS(X)),X) EQUAL(S(PD(X)),X) -EQUAL(PD(X),PD(Y)) EQUALCX.Y) -EQUAL(S(X),S(Y)) EQUALCX.Y) -EQUAL(X.Y) E0UAL(PD(X) ,PD(Y)) -EQUALCX.Y) EQUALCSCX) ,SCY)) -EQUALCX.Y) EQUALCACX),A(Y)) LT(PDCX).X) LTCX.SCX)) -LT(X.Y) -LTCY.Z) LTCX.Z) LT(X.Y) LTCY.X) EQUALCX.Y)
a
-LTCX.X)
CL CL CL CL
-LTCX.Y) -LT(Y.X) -EQUALCX.Y) -LTCX.Z) LT(Y.Z) -EQUALCX.Y) -LTCZ.X) LTCZ.Y) EQUALCX.X)
(II)
THEOREM E l . CL -LTCN.J) DENIAL OF THE THEOREM CL LT(K.J) CL -LTCK.I) CL LT(I.N) CL LT(ACJ).ACK)) a LTCX.I) -LTCX.J) -LTCACX),ACK)) a -LTCONE.I) LTCX.I) LTCN.X) -LTCACX) .ACPDCD)) CL -LTCONE.X) -LTCX.I) -LTCACX).ACPDCX))) CL -LTCQ.D CL -LTCJ.Q) a LTCACQ),ACJ)) THEOREM E2. CL -LTCN.J) DENIAL OF THE THEOREM CL LTCK.J) CL -LT(K.I) CL LTCI.N) CL LTCACJ).A(K)) a LTCX.I) -LTCX.J) -LTCA(X).ACK)) CL -LTCONE.I) LTCX.I) LTCN.X) -LTCACX) .A(PDCD)) CL -LTCONE.X) -LTCX.I) -LTCACX).ACPDCX))) CL LTCJ.I) THEOREM E3. CL -LTCN.J) CL LTCK.J)
DENIAL OF THE THEOREM
Collected Works of Larry Wos
188
CL -LT(K,I) CL LT(I,K) CL -LT CL LT(X.L) -LT(X.(S(M)) -LT(A(X),A(K)) CL -LT(OHE.L) LT(X.L) LTCN.X) -LT(A(I),A(PD(L))) a -LTCONE.X) -LTCX.L) -LT(A(X),A(PD(I))) THEOREM ES. CL -LT(N.M) DENIAL OF THE THEOREM CL LT
a CL CL CL CL CL CL CL CL
DENIAL OF THE THEOREM
LT(I.N) -LT(N.M) LT(I,M) -LT(I.ONE) -EQUAL(K.M) LT(A(M).A(K)) -LT(ONE.X) -LT(I,I) -LT(A(X),A(PD(X))) -LT(ONE.X) LTCX.I) LTCN.X) -LTCACX).ACPDCI))) LTCX.I) -LTCX.SCN)) -LTCACX),ACK))
THEOREM E7. CL -LT(N.L) CL LTCONE.L) CL
DENIAL OF THE THEOREM
LTCACL).A(PDCL)))
CL -LTCONE.N) LTCX.N) LTCN.X) -LTCACX),ACPDCN))) CL -LTCONE.X) -LTCX.N) -LTCACX).ACPDCX)))
H. LIMIT THEOREMS CL CL CL CL a CL CL CL CL
EQUALCSUMCX.CW.X) ECJUALCSUM(CO,X),X) -LTCX.X) -LTCX.Y) -LTCY.Z) LTCX.Z) -LT(CO.X) -LTCCO.Y) LTCC0.F1CX.Y)) -LTCCO.X) -LTCCO.Y) LTCF1CX.Y),1) -LTCCO.X) -LTCCO.Y) LTCF1CI.Y),Y) -LTCX.HCXA)) -LTCY.HCXA)) LTCSUMCX.Y),XA) -LTCCO.IA) LTCCO.HCXA))
AXIOM 1 AXIOM 2
AXIOM 3 AXIOM 7
Problems and Experiments—Automated Theorem-Proving Programs
THEOREM BL1. CL -LT(CO.X) LT(C0,FP3t(X)) CL -LT(CO.X) -LTCABS(SUMCY,MIHUS(A))),FP31(X)) LT(ABS(SUM(F(Y), MINUS (L1))),X) a -LT(CO.X) LT(C0,FP32(X)) C L -LT(CO.X)
189
DENIAL OF THE THEOREM
-LT(ABS(SUM(Y,MINUS(A))),FP32(X))
L T ( A B S ( S U M ( C ( Y ) . M I N U S ( L 2 ) ) ) ,X) CL
LT(CO,B)
C L -LT(CO.X)
LT(ABS(SUM(FP33(X),MINUS(A))),X)
CL -LT(CO.X) -LT(SUM(ABS(SUN(F(FP33(X)),MINUS(L1))),ABS(SUJI(G(FP33(X)),MINUS(L2))))>B) CL -LT(SUM(ABS(X),ABS(Y)),XA) LT(ABS(SUM(X,Y)),XA) AXIOM 4 THEOREM BL2. CL -LT(CO.X) LT(C0,FP3t(X)) DENIAL OF THE THEOREM CL -LT(CO.X) -LT(ABS(SUM(Y,MINUS(A))),FP31(X)) LT(ABS(SUM(F(Y).MINUS(LI))),X) CL -LT(CO.X) LT(C0,FP32(X)) CL -LT(CO.X) -LT(ABS(SUM(Y,MINUS(A))),FP32(X)) LT(ABS(SUM(G(Y) .MINUS(L2))) ,X) CL LT(CO.B) CL -LT(CO,X) LT(ABS(SUM(FP33(X), MINUS(A))),X) CL -LT(CO.X) -LT(ABS(SUH(SUM(F(FP33(X)),MINUS(L1)),SUM(G(FP33(X)),NINUS(L2)))),B) CL CL CL CL CL CL CL a CL CL CL CL CL CL CL CL CL CL CL CL CL
-EQUAL(X.Y) -LT(X,Z) LT(Y,Z) EQUALITY -EQUAL(X.Y) -LT(Z,X) LT(Z,Y) -EQUAL(X.Y) EQUAL(ABS(X) ,ABS(Y)) -EQUALtt.Y) EQUAL(SUM(X,Z),SUM(Y.Z)) -EQUAL(X.Y) EQUAL (SUM (Z,X) ,SUM(Z,Y)) -EQUAL(X.Y) EQUAL(MINUS(X).MINUS(Y)) -EQUAL(X.Y) EQUALOUX) ,H(Y)) -EQUAL(X.Y) EgUAL(F(X),F(Y)) -EQUAL(X.Y) EQUAL(G(X),C(Y)) -EQUAL(X.Y) EQUALCFP31(X),FP31(Y)) -EQUAL(X.Y) EQUAL(FP32(X) ,FP32(Y)) -EQUAL(X.Y) EQUAL(FP33(X),FP33(Y)) -EQUAL(X.Y) EQUAL(F1(X,Z),F1(Y,Z)) -EQUAL(X,Y) EQUAL(F1(Z,X> ,F1(Z,Y)) EQUAL(X.X) EQUALITY -EQUAL(X.Y) EQUAL(Y.X) -EQUAL(X,Y) -EQUAL(Y,Z) EqUAL(X.Z) EQUAL(SUM(SUM(X,Y),Z),SUM(X,SUH(Y,Z))) EQUAL(SUM(X,Y),SUM(Y,X)) -LT(CO.XA) LT(CO,(H(XA)) EQUAL(MINUS(SUH(X,Y)),SUM(HINUS(X,MINUS(Y)))
SUBSTITUTION AXIOMS
AXIOMS
AXIOM 5 AXIOM 6 AXIOM 8
THEOREM 8L3. CL -LT(CO.X) LT(C0,FP31(X)) CL -LT(CO.X) -LT(ABS(SUM(Y,NINUS(A))),FP31(I)) LT(ABS(SUM(F(Y),MINUS(LI))),X) CL -LT(CO.X) LT(CO,FP32(X)) CL -LTCCO.X) -LT(ABS(SUM(Y,MINUS(A))),FP32(X)) LT(ABS(SUM(G(Y) ,MI.1US(L2))) ,X) CL LT(CO,B) CL -LT(CO.X) LT(ABS(SUM(FP33(X),MINUS(A))),X) CL -LT(CO.X) -LT(ABS(SUM(SUM(F(FP33(X)),G(FP33(X))).MINUS(SUM(L1,L2))))(B)
******************************************************************* N. GROUP AXIOMS (EQUALITY FORMULATION) CL
EQUAL(F(E,X),X)
EXISTENCE OF AN IDENTITY
Collected Works of Larry Wos
190
CL CL CL CL CL
EQUAL(F(X,E).X) EQUALCF(G(X),X),E) EQUAL(F(X,G(X)>,E) EQUAL(F(F(X,Y),Z),FCX.F(Y,Z))) EQUALCX.X)
EXISTENCE OF INVERSES ASSOCIATIVE PROPERTY
THEOREM GP1. IF X»«2 - E FOR ALL X, THEN THE GROUP IS COMMUTATIVE. CL EQUAL(F(X,X),E) DENIAL OF THE THEOREM CL EQUAL(F(A,B),C) CL -EQUAL(F(B,A).C) THEOREM GP2. ALL SUBGROUPS OF INDEX TWO ARE NORMAL. CL EQUAL(F(E,I).I) ESTABLISHED LEMMAS CL EQUAL(F(X.E).X) CL EQUALCFCG(X),X),E) CL EQUAL(F(X,((X)),E) CL EQUAL(G(C(X)),X) CL EQUAL(G(E)),E) CL 0(E) DENIAL OF THE THEOREM CL -OCX) OCGCX)) CL -OCX) -O(Y) -EQUALCFCX,Y).Z) 0(Z) CL OCX) OCY) OCKX.Y)) CL OCX) OCY) EQUALCFCX.I(X,Y)),Y) CL 0(B) CL EQUALCFCB,GCA)).C) CL EQUALCFCA.O.D) CL -OCD)
******************************************************************* 0. HENKIN MODELS (EQUALITY FORMULATION) THE FOLLOWING WERE OBTAINED IN A NESTED MANNER AS IN THE PREVIOUS FORMULATION OF HENKIN MODELS. CL -LECX.Y) EQUAL(FCX,Y),E) CL -EQUALCF(X,Y),E) LECX.Y) CL LECFCX,Y),X) CL LECFCFCX,Z),FCY,Z)),FCFCX,Y),Z))
a
LECE.X)
CL -LECX.Y) -LECY.X) EQUALCX.Y) CL LECX.D) CL EQUALCX.X) THEOREM HP1. X/l - 0. CL -EQUAL(F(A,D),E)
DENIAL OF THE THEOREM
THEOREM HP2. 0/X - 0 FOR ALL X. CL EQUALCFCX,D),E) CL -EQUAL(F(E,A),E)
ADDITIONAL LEMMA DENIAL OF THE THEOREM
THEOREM HPS. X/X - 0 FOR ALL X. CL EQUALCFCE,X),E) CL -EQUALCF(A,A),E)
ADDITIONAL LEMMA DENIAL OF THE THEOREM
THEOREM HP4. X/0 - X FOR ALL X. CL EQUAL(FCX,X),E) CL -EQUALCF(A,E),A)
ADDITIONAL LEMMA DENIAL OF THE THEOREM
THEOREM HPS. THE LESS THAN OR EQUAL REUTION IS TRANSITIVE. CL EQUALCF(X,E),X) ADDITIONAL LEMMA CL L E U , A D DENIAL OF THE THEOREM CL LECA1.A2) CL -LECA.A2)
Problems and Experiments—Automated
Theorem-Proving
Programs
191
THEOREM HP6. IF X/Y <- Z, THEN X/Z <- Y FOR ALL X, Y, AND Z. CL -LE(X,Y) -LE(Y,Z) LE(X.Z) ADDITIONAL LEMMA CL EQBAL(F(A,B),CU DENIAL OF THE THEOREM CL LE(Ci.Al) CL EQUAL(F(A,A1),C2) CL -LE(C2,B) THEOREM HP7. IF X <- Y, THEN Z/Y <- Z/X FOR ALL X, Y, AND Z a -LE(F(X,Y),Z) LE(F(X,Z).Y) ADDITIONAL LEMMA CL LE(A.B) DENIAL OF THE THEOREM CL EQUALCFfCl.BhBl) CL EQUAL(F(C1.A),A1) CL -LE(B1,A1) THEOREM HP8. IF X <- Y, THEN X/Z <- Y/Z FOR ALL X, Y, AND Z. CL -LE(X.Y) LE(F(Z.Y),F(Z,X)) ADDITIONAL LEMMA CL LE(A,B) DENIAL OF THE THEOREM CL EQUAL(F(A,C1),A1) CL EQUAL(F(B,C1),B1) CL -LE(Al.Bl) THEOREM HP9. FOR ANY X, LET X' BE DEFINED AS 1/X. THEN X' - X'" FOR ALL X. CL -LE(X,Y) LE(F(X,Z), F(Y,Z)) ADDITIONAL LEMMA CL -EQUAL(F(D,A),F(D,F(D,F(D,A)))) DENIAL OF THE THEOREM THEOREM HPIO. FOR ANY X', WHERE X' - 1/X, X' - X'/(l/X'). CL EQUAL(F(D,X),F(D,F(D,F(D,X)))) ADDITIONAL LEMMA CL EQUAL(F(D,A),B) DENIAL OF THE THEOREM CL EQUAL(F(D,B),B1) CL EQUAL(F(B,B1),B2) CL EQUAL(B,B2) THEOREM HP11. THE OPERATOR A IS DIFINED ON THE SET OF Z', WHERE Z' - 1/Z, AS X' A Y' - X'/U/Y'). k IS A COMMUTATIVE OPERATION. CL EQUAL(F(D,X),F(F(D,X).F(D.F(D.X))))ADDITIONAL LEMMA CL EQUAL(F(D,A),A1) DENIAL OF THE THEOREM CL EQUAL(F(D,B),B1) CL EgUAL(F(D,Bl),B2) CL EQUAL(F(AI,B2),C1) CL EQUAL(F
RESULTS The following statistics report the results of early experiments using the program upon problems presented in the previous section. Note the following: 1) The number of successful and unsuccessful unifications are presented. These values include all calls to the unification module. In particular the uses of unification during subsumption and demodulation tests are included. 2) As mentioned in a previous section four standard complexity measures have been employed, as well as nonstandard measures. The four standard types are as follows:
192
Collected Works of Larry Wos
a) complexity of a term = (number of function and variable symbols that occur in the term) b) complexity of a term = (number of function symbols + 2* (number of variable symbols) (Let each function symbol be assigned an "intrinsic" complexity as discussed above.) c) complexity of a term = (the sum of the complexities associated with the function symbols) + 1* (number of variable symbols) d) complexity of a term = (the sum of the complexities associated with the function symbols) + 2* (number of variable symbols) Most of the runs utilized the first measure. Hence, unless otherwise specified, that measure is assumed. CONCLUSION The problems presented in this paper range from the very trivial to the quite difficult. This varied problem set should prove useful both to those with existing programs and those currently developing programs. The presence of problems for which no proof has yet been obtained by a program provides specific goals at which to aim in the future. The results from the experiments cited herein permit comparison and evaluation of the presented program with other automated theorem-proving programs. It appears that the program discussed here is substantially more powerful than other such resolution-based programs cited in the literature. PROBLEM
Gl SI C2 G2 G3 G3 G4 GS GS G6 G7 Rl R2 R3 Bl B2 B3 B4 BS B6 B7 HI
INFERENCE
UR HYPER
UR HYPER
UR HYPER
UR UR HYPER HYPER HYPER HYPER HYPER HYPER
UR UR UR UR UR UR RE HYPER
SET OF -CONC -CONC -CONC -CONC EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING -CONC EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING
CLAUSES
270 350 44 220 173 371 86 394 370 21522 31071 2299 15600 31436 40263 42416 38833 42416 4395 4395 1804
24
CLAUSES
CLAUSES
39 39 19 44
0 0 0 0
61 85 45 94 84 539
17 36 11 40 36 343
1981
1767
351 890
.219
1178 1692 1141 1622 1141
778 781 699 23
589 918 933 842 835 842 551 SSI 82 0
TIME 1.01 SEC. 1.03 SEC. .97 SEC. .92 SEC. 1.93 SEC. 1.97 SEC. S.48 SEC. 2.15 SEC. 2.44 SEC. 54.28 SEC. 2 HIN. 16.86 SEC. 9.83 SEC. 45.08 SEC. 2 HIN.. 5.26 SEC. 2 HIN.. 57.19 SEC. 1 HIN,. 0.S9 SEC. NO PROOF (4 HIN.) 56.97 SEC. 28.53 SEC. 27.49 SEC. 16.20 SEC. 2.42 SEC.
Problems and Experiments—Automated Theorem-Proving Programs
HI H2 H3
UR UR UR
-CONC -CONC -CONC
H4 H4 H5 H6
UR HYPER HYPER HYPER
EVERYTHING EVERYTHING EVERYTHING EVERYTHING
H7 H8 H9 H10
UR UR UR UR
-CONC -CONC -CONC -CONC
Hll Cl C2 C3 C4 Tl T2 T3 SI S2
HYPER HYPER HYPER HYPER HYPER HYPER HYPER HYPER HYPER HYPER
EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING EVERYTHING
15579 3858 7156 7369 7042 25144 11201 140 348 2429
862 394 665 706 650 109 84 66 169 835
256 210 532 581 515 11 4 0
S3
HYPER
EVERYTHING
2076
735
60
EXQ1 EXQ2 SAM'S LEMMA
HYPER HYPER HYPER
EVERYTHING EVERYTHING EVERYTHING
14608 46931 22105
588 2192 292
469 1515 0
PV1 PV2 PV3 PV4
• •U It H EVERYTHING ••U k H EVERYTHING ••U k H EVERYTHING
108 134 10071 1169
28 44 521 175
6 0 56 16
El E2 E3 E4 ES E6 E7 HP1 HP2
•»U k H -CONC • «U k H -CONC ••U * H -CONC • «U t H -CONC • »U k H -CONC • «U k H -CONC <«U k H -CONC -CONC -CONC
750 65 342 130 133 483 191 10 11
279 45 148 63 64 181 84 11 12
118 0 49 0 0 22 36 0 0
« U k H EVERYTHING
21 22 1024
22 23 202
0 0 8
6608 4198 2996 16858
282 85 343 406
31 43 96 105
73S1 377 696 960
1147 195 235 310
468 32 50 68
62
HP3 HP4
EVERYTHING EVERYTHING
54 295
26 45
0 0
HP5 HP6 HP7 HP8 HP9
-CONC -CONC -CONC -CONC EVERYTHING -CONC -CONC
47 840 303 525 463 1143 4720
26 211 117 166 105 307 1157
0 6 6 10 8 25 89
HP 10 HP11
PROBLEM Gl Gl G2 G2 G3
INFERENCE UR HYPER UR HYPER UR
SUCCESSFUL UNIFICATION 709 701 643 463 715
UNSUCCESSFUL
*"t
UNIFICATION 121 134 42 41 186
85X 84X 942 92X 79X
2.79 SEC. 2.52 SEC. 5.11 SEC. 23.52 11.91 11.97 41.39
SEC. SEC. SEC. SEC.
34.17 5.95 5.21 6.85
SEC. SEC. SEC. SEC.
39.13 SEC. 22.28 SEC. 20.82 SEC. 22.75 SEC. 20.32 SEC. 2 MIN. 3.17 SEC. 1 MIN. 14.04 SEC. 2.7 SEC. 4.26 SEC. OUT OF 240K OF CORE AT 43.51 SEC OUT OF 240 K OF CORE AT 41 SEC. 1 MIN. 21.27 SEC. NO PROOF (9 MIN.) 30.00 SEC. 2.5 2.09 26.13 3.77
SEC. SEC. SEC. SEC.
4.95 1.48 2.73 2.01 2.88 3.12 3.22 1.99 1.61
SEC. SEC. SEC. SEC. SEC. SEC. SEC. SEC. SEC.
2.81 SEC. 2.35 SEC. 1.65 3.43 3.64 2.94 3.00 5.17 57.68
COMPLEXITY
SEC. SEC. SEC. SEC. SEC. SEC. SEC.
193
Collected Works of Larry Wos
194
C3 G4 GS G5 G6 G7
HYPER
Rl R2 R3 Bl B2 B3 B4 B5 B6 B7 HI HI H2 H3
HYPER HYPER HYPER
1526 1071 60067 155936
337 90 385 312
76% SIX 80%
124888 5766
33% 97%
TYPE 3 TYPE 2
8564 77695 225902 288648 58382 273988 211510 228571 28714 13762
3764 16336 175738 124807 47457 311628 75392 17566 17657 12940
70% 82X 56X 70X 55X 47% 74X 60X 62X 62X
•NONSTAND •NON STAND •NONSTAND TYPE 3
20 6 6
0 0 0
100X 10OX 100X
3260
2544
82X
78725 25559 36671 103514
38737 10094 7953 80418
67X 72X 60X S6X
1077
im
384
UR HYPER HYPER HYPER
UR UK UR UR UR UR RE HYPER
UR UR UR
H4 H4 HS H6
HYPER HYPER HYPER
H7 H8 H9 H10
UR UR UR UR
99628 4969 6139 9798
Hll Cl C2 C3 C4 Tl T2 T3 SI S2 S3
HYPER HYPER HYPER HYPER HYPER HYPER HYPER HYPER HYPER HYPER HYPER HYPER HYPER HYPER
100380 33284 33615 34185 33220 76309 43402
EXQI EXQ2 SAM'S LEMMA
UR
PV1 PV2 PV3 PV4
••U •«U •*U ••U
k * * A
H H H H
El E2 E3 E4 E5 E6 E7 HP1 HP2
•»W ••U »»U •*U ••0 ••U ••U
A A A A A * A
H H H H H H H
HP3 HP4
230S3 1087 1589 2600 54669 11498 11654 11725 11474 299711 169214
3
126
3178 50949 40955 139726 843992 77156
3325 66936 53325 7962 57321 44967
338 213
52 49
36880 2691
10687 1162
4007
660 36 244 73 72 363 133 1 2
228 1371
604 605 2399
863 4 5 197 1053
45 994
78V.
82X 79X 79X 65X 73X 74% 75X 75X 20X 20X 71% 49X 76X 43X 95X 63X 88X 81X 78X 69X 86X 86V,
85% 89% 89X 87X 87X 80X 29% 81% SIX
•NONSTAND •NONSTAND •NONSTAND
Problems and Experiments—Automated
HPS HP6 HP7 HPS HP9 HP10 HP11
117
Theorem-Proving
91
56X
2573
457.
768
526
1607 1721 3848 17580
1610 3348 7004 103290
40% 50X 34X 35X 141
2103
•NONSTAND MEANS NONSTANDARD
»» U * H MEANS UR AND HYPER
Programs
195
•••X - PERCENT SUCCESSFUL
REFERENCES [1] J. McCharen, R. A. Overbeek, and L. Wos, "Complexity and related en hancements for automated theorem proving programs," Comput. Math. Appl., to be published. [2] J. A. Robinson, "Automated deduction with hyper-resolution," Int. J. Ass. Comput. Math., Vol. 12, pp. 23-41, 1965. [3] R. A. Overbeek, "An implementation of hyper-resolution," Comput. Appl., Vol. 1, pp. 201-214, 1975.
Math.
[4] S. K. Winker, "An evaluation of an implementation of qualified hyperresolution," presented at the IEEE Workshop on Automated Theorem Proving, June 1975. [5] L. Wos, G. A. Robinson, D. F. Carson, and L. Shalla, "The concept of demodulation in theorem proving," J. Ass. Comput. Math., Vol. 14, pp. 698-709, 1967. J o h n D . McCharen was born on October 8, 1941. He received the B.S. degree from Southwestern at Memphis, Memphis, TN, in 1963, and the Ph.D degree from Louisiana State University, Baton Rouge, LA, in 1969. He served one year as Assistant Professor at Louisiana State University before joining the Department of Mathematical Sciences at Northern Illinois University, DeKalb, in 1970. He joined the Computer-Science Division of the Department of Math ematical Sciences at Northern Illinois University in 1973, where he is presently an Assistant Professor. R o s s A. Overbeek was born on May 16, 1949. He received the B.Ph. degree from Grand Valley State College, Grand Rapids, MI in 1970 and the M.S. and Ph.D. degrees from the Pennsylvania State University, University Park, in 1970 and 1971, respectively. Since 1971 he has been a member of the faculty of the Department of Mathematical Sciences at Northern Illinois University, De Kalb, where he is now an Associate Professor of computer science. His research interests include automated theorem proving and program verification. He has coauthored texts in Cobol and assembler language programming.
196
Collected Works of Larry Wos
Lawrence A. Wos was born on July 13, 1930. He received the B.A. and M.S. degrees from the University of Chicago, Chicago, IL, in 1950 and 1954, re spectively. He received the Ph.D. degree from the University of Illinois, Urbana, in 1957. Since 1957 he has been at Argonne National Laboratories, Argonne, IL, where he is presently an Associate Mathematician. His major publications have been in automated theorem proving.
COMPLEXITY AND RELATED ENHANCEMENTS FOR AUTOMATED THEOREM-PROVING PROGRAMS R.
OVERBEEK,
J.
MCCHAREN
and L. Wos*
Department of Mathematics, Computer Science, Northern Illinois University, Dekalb, Illinois 60115, U.S.A. Communicated by E.Y. Rodin (Received April 1975; and in revised form August 1975) Abstract—In this paper some enhancements for automated theorem-proving programs, techniques which can be combined with the various well known in ference rules which are employed in such programs, are given. Proofs of some of the more difficult problems previously sought by use of automated theorem proving were obtained by a program utilizing these enhancements. Among those proven in less than 3 min were: 1. x 3 = e implies ((x,y),y)
= e.
2. Boolean rings are commutative. 3. Subgroups of index 2 are normal (without case analysis). The most powerful enhancement is that of ordering generated clauses with a heuristic which assigns an integral value to each term that occurs in any clause. The heuristic is designed to favor those clauses containing less "complex" terms. By changing input parameter values the values assigned to terms can be varied to any desired extent which in turn can sharply affect the proof search. Another enhancement is that of dynamic adjunction of demodulators including as a subcase the previous approach which has demodulators occurring only as input clauses. Methods are given for rapidly selecting the possible set of demodulators for use with a generated clause and for controlling the adjunction to reflect potential importance of the demodulator. "Argonne National Laboratory, Argonne, Illinois, U.S.A. Reprinted with permission from Computers and Mathematics with Applications, Vol. 2, pp. 1-16 (1976).
Collected Works of Larry Wos
198
1. INTRODUCTION Many of the algorithms found in the literature on automated theorem prov ing are of interest and often useful, but are seldom sufficient in themselves since a straightforward implementation of such algorithms often yields a program in capable of finding proofs for moderately difficult theorems. In order to find such proofs, it is generally necessary to add various enhancements, which may ini tially seem ad hoc, to the algorithm. In this paper several such enhancements, usable in conjunction with the various well known approaches, will be given in detail. The techniques discussed herein were discovered in the process of imple menting a number of the better known algorithms. A program utilizing these enhancements and the inference rules (occasionally employed simultaneously) of hyper-resolution and UR-resolution, the latter discussed in Section 5, has found proofs for a number of theorems which were previously considered quite difficult from the viewpoint of automated theorem proving. Among the theorems proven with this program are the following: (1) Let G be a group of exponent 3; i.e. for all x, x3 = e, the identity. For any pair a; and y, let h(x, y) be the commutator of x and y, h(x, y) = xyx~1y~l. Then for all x and yh{h(x, y),y) = e. (2) If R is a Boolean ring (x2 = x for all x), then R is commutative. This proof was obtained without the lemma, usually included as an input clause, that R has characteristic 2 (x + x = 0 for all x). (3) Subgroups of index 2 are normal. This proof was obtained without the usual case analysis approach; i.e. was obtained without breaking the prob lem into two subproblems. (4) Suppose that a Boolean algebra is defined as a set B together with two binary operations (+) and (.) such that P I The operations (+) and (.) are commutative. P2 There exist in B distinct identity elements 0 and 1 relative to the operations (+) and (.) respectively. P3 Each operation is distributive over the other. P4 For every a in B there exists an element o' in B such that a + a' = 1
and
a. a' = 0
Suppose further that the following identities have been proven: For all a, b in B a+a= a a + l = l a + ( a . 6) = a
a .a= a a.0=0 a . (a + b) = a
Automated Theorem-Proving
THEOREM.
Programs
199
The operator (+) is associative.
(5) Using the axioms, given by Tarski[3] for plane geometry, one can show that the relation "betweeness" is symmetric. Since the number of lemmas which are included in the formulation of prob lems such as the above critically determine their relative difficulty, the clauses which were used as input to the programs are included in Appendix A. A careful re-evaluation of the features in the program and the performance of the program on the previous set of problems led the authors to the following conclusions: (a) With respect to clause generation, clause retention and most importantly the time required to obtain a proof, this program compares favorably with other reported implementations. (b) The program would not have successfully obtained proofs of most of the problems mentioned above had not the techniques presented in the follow ing sections been included. (c) Either the exact methods described below or variants of these methods could be profitably employed in conjunction with most strategies which have been proposed to date. (d) By considering these techniques, others may see generalizations or im provements which could significantly affect the development of automated theorem provers.
2. COMPLEXITY OF TERMS A variety of authors have utilized some measure of the "complexity" of terms and restricted the use of terms exceeding some specified degree of complexity. Examples of these measures, which have been tried with varying amounts of success, are as follows: (1) Complexity of a term is equal to the number, excluding parentheses and commas, of symbols therein. (2) Integers can be associated with each symbol. In this case the complex ity of a term is determined by summing the integers associated with the symbols that occur in the term. For example, suppose that the following associations were used: a 1 b 3 9 1 / 2 any variable 1 With measure 2 the complexity of f(g(a), g(x)) would be one less than that of g(f{a, b)), while with measure 1 g(f(a, b)) would have less complexity.
200
Collected Works of Larry Wos
(3) The complexity of a term can be measured by the maximum depth of nest ing of the function symbols that occur in the term. In this case f{g{a), g(x)) is of the same complexity as g(f(a, b)), but f{f{g{x), y), z) would be more complex than / ( / ( a , b), f(x, d)). (4) The complexity of terms is measured indirectly by counting the number of symbols excluding parentheses and commas occurring in a literal. The motivation for employing some measure of term complexity is rather obvious. If the set of allowable terms is not restricted in some manner, the sets of generated clauses and retained clauses may become so large that the clause space gets saturated and/or the time required to complete the proof search becomes prohibitive. Since the degree of complexity of all terms occurring in a given refutation is bounded, the corresponding restriction of the allowable term sets can result in a sharp reduction in the number of extraneous clauses, while still permitting the proof search to be successful. In most cases that have been studied, some such restriction is absolutely necessary to obtain the desired proof. On the other hand the choice of an overly restrictive bound may result in the derivation of a proof substantially longer than necessary or may even cause the proof search to terminate unsuccessfully. The effectiveness of a measure of complexity is determined by how well it can be used to circumscribe the terms required in a proof. The more difficult it is to describe the syntax of "interesting" or "potentially valuable" terms, the more difficult it will be to define the appropriate measure of complexity of terms. A restriction based on the appropriate choice of the four given measures works well for most of the theorems cited in the literature. The mathematical difficulty of most such problems could honestly be classed only as trivial. As theorem provers are applied to increasingly demanding problems, these measures will have to be generalized into more appropriate measures. For example, in certain ring theory problems it may be important to have the proof search concentrate heavily on terms which simultaneously contain the function symbols for the operators of addition and multiplication rather than on those terms which contain only one of those two function symbols. Since, in order to achieve this emphasis, the con text in which a symbol occurs must be taken into account, none of the previous four measures of complexity would suffice. The following definitions are used to describe the measure implemented in the program under discussion. Definition. Any term which is neither a constant nor a variable will be re ferred to as a composite term. Definition. Let t = f(t\, £2, <3> • • • > *n) be a composite term. Then / is the major function symbol of t. Definition. If t is the composite term f(t\, t?, ( 3 , . . . , tn), the ith argument of t is tt. Definition. A c-pattern can be formed by the following rules:
Automated Theorem-Proving
Programs
201
(1) A constant symbol is a c-pattern. (2) A function symbol of degree n > 0 followed by n "arguments" inclosed by parentheses and separated by commas is a c-pattern. The "arguments" in this case must be either c-patterns or integers. (3) Any c-pattern can always be constructed by repeated application of the previous two rules. Definition. A c-pair is an ordered pair. The first element of the pair must be c-pattern and the second element must be an integer. Definition. A c-set is an ordered set of c-pairs. Instead of giving the precise algorithms for obtaining the complexity of a term, let us consider some specific examples. In each of these examples let S be a c-set composed of the following c-pairs. 1. («, 1) 2. (b, 2) 3- (fl(l).l) 4- (/(
202
Collected Works of Larry Wos
3. THE BASIC ALGORITHM Algorithm 1, which follows, is the underlying algorithm of strategy and flow for the program under discussion. For this algorithm let h{C) be a function which assigns to any clause C a non-negative integer. Algorithm 1. This algorithm takes as input an ordered set of clauses S = {C\, Ci, Cz, ■■■, Cn} and attempts to establish the unsatisfiability of S by uti lizing some inference rule I (such as hyper-resolution, unit-resolution, etc.). The following variables are used: LIST 1. This variable is an ordered list of clauses. The list is ordered on a field in each clause which will be referred to as the KEY of the clause. Whether clauses with equal values are entered on a first-in first-out or first-in last-out basis is determined by an input parameter. LIST 2. This variable is an ordered list of clauses. This list has the property that all clauses which can be inferred by the inference rule I from clauses in the list have already been generated. G LIST. This variable is also an ordered list of clauses. It roughly corre sponds to the set of clauses which have been generated, but not yet added to LIST 1. D LIST 1. This variable is a list of clauses which are to be deleted because they were subsumed by clauses which were added at a later point in time. D LIST 2. This variable is a list of clauses which are in either LIST 1 or LIST 2, but can be further demodulated. DEMOD-SET. This variable represents the set of demodulators. The struc ture of this variable will be discussed in the next section. Originally all lists are empty, the DEMOD-SET contains no demodulators. Step 1. Add C i , C 2 , . . . , C n to G LIST. Set the KEY field in each clause to 0. Go to Step 5. Step 2. If LIST 1 is empty, stop (no proof has been derived). Else, move the first clause in LIST 1 to the end of LIST 2. Step 3. Generate the set of clauses which can be inferred from the clauses in LIST 2 using the inference rule I subject to the restriction that one of the parent clauses must be the clause just moved to LIST 2. As o.ach such clause is generated perform the following actions: (a) Demodulate the clause using the demodulators in DEMOD-SET. This process is described in the next section. (b) If the clause violates some restriction such as too many literals, the oc currence of an excessively complex term, etc. terminate; processing of the clause. (c) If the clause is subsumed by a clause in LIST 1, LIST 2, or G LIST, terminate processing of the clause. (d) If the clause is the null clause, stop. If the clause is a unit clause and can be unified with a unit clause of the opposite sign in LIST 1, LIST 2, or G LIST, stop (a proof has been completed).
Automated Theorem-Proving Programs
203
(e) If any clause in LIST 1, LIST 2, or G LIST is subsumed by this clause, note the subsumed clause in D LIST. (f) Add the clause to G LIST. (g) Set the KEY field in the clause to the value which results from applying h to the clause. Step 4. Delete any clause noted in D LIST from the list containing the clause. Reset D LIST to the null list. Step 5. For each positive unit equality clause in G LIST that should be used as a demodulator, perform the following actions: (a) Add the corresponding demodulator to DEMOD-SET. (b) For any clause in LIST 1, LIST 2, or G LIST which can be demodulated by the added demodulator note the clause in D LIST 2. Step 6. Add the clauses in G LIST to LIST 1. For each clause use the KEY field to determine where in LIST 1 the clause should be inserted. Reset G LIST to the null list. Step 7. For each clause noted in D LIST 2 perform the following actions: (a) Create the demodulant of the clause. Set the KEY field in the demodulant to the value in the KEY field of the demodulated clause. (b) Add the demodulant to G LIST. (c) Delete the demodulated clause from the list containing it. Step 8. Reset D LIST 2 to the null list. If G LIST is empty, go to Step 2. Else, go to Step 5. The function h, from which the value of the KEY field of each clause is obtained, strongly affects the performance of the program. For the results cited in this paper h assigned to each clause C (the number of literals in C minus 1) x K 4- (the maximum of the complexities of the composite terms of C). K is an input parameter and generally is set to 1. The purpose of K is to take into account in the function h the number of literals of C for each clause C. For a more detailed discussion of how the set of clauses generated in Step 3 can be determined efficiently when hyper-resolution is used as the inference rule the reader is referred to [2]. The algorithms and data structures presented in that paper have been generalized in a natural way and are part of the present imple mentation under discussion. Programs have been written implementing positive hyper-resolution, negative hyper-resolution, Pl-resolution, unit resolution and UR-resolution.
204
Collected Works of Larry Wos
4. DEMODULATION The advantages of demodulation have been adequately covered elsewhere [4]. There are several aspects, however, of this implementation which are worth commenting on: (a) Given a clause C and a set W of demodulators, there may be several (final) distinct demodulants of C. As currently implemented, only one of these demodulants will be generated. Such an approach, although com mon, is questionable; in the future the authors intend to implement the more general approach. The reader should note that Algorithm 1 must be modified if all demodulants of a given clause are to be generated. (b) In most implementations the set of demodulators is given as input and is not altered during the execution of the program. This is not true of this implementation. With more difficult problems, a significant advantage can be gained by adding demodulators as appropriate positive unit equality clauses are deduced. For example, one criterion, now present in the pro gram, for adjoining a clause of the demodulator list is: adjoin the equality clause C if and only if the difference in the term complexity occurring in the two arguments of the literal of C is greater than or equal to the value of some input parameter. By setting this input parameter to a very large positive integer and by inputting some possibly empty set of demodulators one can have the present program perform with respect to demodulation as the previous implementations cited in the literature have. If the input parameter is set to 0, it is possible for a term t to be a demodulant of itself. For example, if F{x,y)> F(y,x) is a demodulator, F(g(a),b)
- > F(b,g(a))
- >
F(g(a),b)
To prevent this phenomenon the following restrictions on demodulation are used: (1) For t to be replaced by t', the complexity of t must be at least as great as that of t'. (2) If t and t' are of equal complexity, an arbitrary but fixed ordering of terms will be used to determine whether or not t can be replaced. (c) Because the number of demodulators in the set W can increase to a rela tively large number, a means of rapidly selecting a subset of W that could be used to demodulate a term t was implemented. The process can be described as follows: (1) Let a — >0 be a new demodulator, where a = f(ti,t2,h,.. Associate with a the following ordered n + 1-tuple: (/, a i , a 2 . . . a „ )
.tn).
Automated Theorem-Proving
205
Programs
where e the 3-tuple (/, V, g) would be associated. The n + 1-tuple associated with a term will be called the d-key of the term.
(2) For each demodulator a = >/3, add the d-key of a to a "demodula tion" tree. Thus, for the set of demodulators do di
d2 d3 di
d5
demodulator f(x,e) = > x /(e, x) = > X f{x,g(x)) = > e f(g{x), x) = > e f(f(x,y),g(y)) = >x g{g{x)) = > x f(x,g(f(y,x))) = >y
d-key (f.V'.e) (f,e,V) (f,V,g) if,9,V) (f,f,9) (9,9) (f,V',g)
the tree, would be created.
Figure 1.
The set of demodulators represented by a given branch is attached to the appropriate leaf, and the resulting tree is converted to a binary tree. The result for the previous example would be
Collected Works of Larry Wos
206
1
g
f
g
(d 4 )
V* (<J3)
'
•
V*
V*
e• (do)
*i g (d 5 )
—»g (d 2 .d 6 )
Figure 2. (3) Given any term t with its associated d (/, V*,g), and the resulting set of demodulators is {di,d.2,d6). The use of such a "screening" technique to reduce the number of required uni fication attempts can dramatically reduce the time required to demodulate a term or clause.
5. UR-RESOLUTION When hyper-resolution is used as an inference rule on a problem which for mulates as a Horn set, only positive unit clauses are generated. The fact that only unit clauses are generated appears beneficial. However, in those problems in which the clauses contradicting the theorem contain a negative unit clause, the negative unit clause cannot be utilized until the last step of the proof. This inability to exploit the denial of the theorem until the last step of the proof is a serious drawback of hyper-resolution. In order to retain the positive effect of generating only unit clauses and to allow the use of negative unit clauses, an inference rule yielding unit resolvents (similar to one discussed by Chang [1]), Unit-Resulting (UR) resolution, was defined and implemented. Definition. Suppose that the ordered set of (possibly non-unique) clauses {N,E1,E2,...Ei-1,Ei+1,...Eq} satisfy the following conditions:
Automated Theorem-Proving
207
Programs
(i) No two clauses in the set contain occurrences of the same variable. (ii) Each of the clauses jE/t, 1 < k < qtk ^ i is a unit clause. (iii) The clause N contains q literals, which may be ordered and referred to as {Li,L2,L3,...Lq). (iv) There exists a most general substitution a such that a unifies the literal in Efc with L* (except that the signs must be opposite), 1 < k < q, k ^ i. Then the unit clause
{Lia} is called the UR-resolvent of the ordered set of clauses. It is convenient to rep resent the UR-resolvent as (N,E1,E2,...Ei_ul,Ei+1,...Eq), since it is then clear which literal in N is matched. Example. Consider the clauses N = {-P(V0, VI, V2), - P ( V 1 , V3, V4), - P ( V 0 , V4, V5), P(V2, V3, V5)} A = {P(V0, V0, E)}
B = {P(E, V0, V0)}
which arise typically from the axioms of an associative multiplicative system with an identity. The clause {P(E, E, E)} is a UR-resolvent represented an
(N,A,A,B,l). UR-resolution has been successfully implemented. The results of this imple mentation are given in a later section. It is only proper to note that authors in the past have considered inference procedures in which unit clauses are inferred by a sequence of unit resolutions. It should be stressed that in the implementa tion of UR-resolution it was not implemented as a sequence of unit resolutions. Rather, the program proceeds by extending a substitution until all of the per tinent literals are unified. Only then is the substitution applied to a literal, creating the UR-resolvent. It is essentially the same distinction that exists be tween viewing hyper-resolution as a positive inference rule and viewing it as producing a resolvent by a sequence of PI resolutions.
6. SCHEMATA In many instances it will be the case that UR-resolution will produce a clause that is already in the clause space, a clause which demodulates to a clause in the clause space, or having some other property which would preclude it from being added to the clause space. It is desirable to classify those clashes which give rise to resolvents which should not be added to the clause space. For example suppose the clause space contains the following clauses: W = {-P(V0, VI, V2), - P ( V 1 , V3, V4), - P ( V 0 , V4, V5), P(V2, V3, V5)} A = {P(V0, V0, E)}
B = {P(V0, E, V0)}
C = {P(E, V0, V0)}
Collected Works of Larry Wos
208
Then the UR-resolvent (N,B,C,A,l) is A, and the UR-resolvent (N,B,C, B, I) is B. In fact if X is any unit clause in the clause space, the UR-resolvent {N, B, C, X, I) is X. Thus, there is no need to form the resolvents of the form (N, B, C, X, I). In order to describe such a family of clashes the following con cepts have proven useful. Definition. A schema is an ordered set S = {A0, Au A2,...
i4i_i, I, Ai+U
...An}
where (i) AQ is a clause containing n literals, and (ii) Aic, 1 < k < n, k ^ i is either a clause or a variable. Thus, if A and B are clauses, each of the following ordered sets is a schema. (a) (b) (c) (d)
{A,B,l} {A,1,X} {A,X,l,X,B} {A,X,1,Y,B}
Here the symbols X and Y are used to denote distinct variables. The concept of a schema facilitates the description of families of UR-resolvents as described below. Definition. A schema S = (Ao, Ai,..., Aq) is said to match the UR-resolvent (N,EU... Ei-U I, Ei+i, ...Eq) providing. (i) AQ = N and n = q (ii) there is an assignment of values to the variables of S such that for each Akl < k < q,k ^ i, Ak = Ek i.e. if Ak is a clause, Ak — Ek', and if Ak is a variable the value of the variable Ak is EkExample. Consider the clauses: N ={-P(V0, VI, V2),-P(V1, V3, V4),-P(V0, V4, V5), P(V2, V3, V5)} A = {P(V0, V0, E)} B = {P(V0, E, V0)} The clause {P(E, E, E)} obtained by clashing A against the first and second literals of N and B against the third literal of TV is a resolvent represented by {N, A, A, B, I). This UR-resolvent matches each of the schemata (a) {N,A,A,B,1} (b) {N,X,X,B,l} (c) {N,X,X,Y, 1} (d) {N,X,Y,B,I} but not the schema
Automated
Theorem-Proving
Programs
209
(e) {N, X, B, X, 1} The theorem proving program has the capability of accepting a set of schema as input. In this case only UR-resolvents which match no schema are formed. By a judicious selection of the set of input schema a significant reduction in the number of generated clauses can be obtained for some problems.
7. The Implementation of UR-Resolution UR-resolution has been successfully implemented. Generally it seems that for this type of theorem, the schemata may be used to reduce the number of generated clauses by 5 to 20%. As there are no known necessary and sufficient conditions for selecting schemata as input to the theorem-prover, a representa tive set of the schemata used for theorem 4 are discussed here. (A) Consider the following clauses: C7 = { - P R O D ( V 0 , VI, V2),-PROD(V0, V3, V4),-SUM(V1, V3, V5), -SUM(V2, V4, V6), PROD(V0, V5, V6)} C31 = { PROD(V0, 0, 0)}
C4 = {SUM(V0, 0, V0)}
If C4 is used to remove the third and fourth literals of C7, and C31 used to remove the second literal the resulting clause is {-PROD(V0, VI, V2), PROD(V0, VI, V2)}. As this is a tautology it suggests the two schemata {C7, I, C31, C4, C4, X} and {C7, X, C31, C4. C4, 1} to be used as input to the theorem prover. Indeed if A is any unit clause such that (C7, A, C31, C4, C4, I) or (C7, I, C4, C4, A) is a UR-resolvent, the resolvent is A. (B) Consider the clause C8 = { -SUM(V0, VI, V2), -SUM(V0, V3, V4), - P R O D ( V l , V3, V5), -SUM(V(), V5, V6), PROD(V2, V4, V6)} C29 = { PROD(V0, V0, V0)}. If C29 is used to remove the third literal, the resulting clause is {-SUM(V0, VI, V2), - SUM(V0, VI, V6), -SUM(V0, VI, V6), PROD(V2, V4, V6)} . It is easily seen that any clause A that matches against the first three literals may be used to form the UR-resolvent (C8; A, A, C29, A, I). The resolvent
Collected Works of Larry Wos
210
if {P(t, t, t)} where t is the third argument of A. But this is subsumed by the axiom C 2 9 = {P(V0, VO, VO)}, so the schema {C8, X, X, C29, X, 1} should be used to prevent such clashes. (C) Consider the clause C6 = {-PROD(V0, VI, V2), - P R O D ( V 0 , V3, V4), - S U M ( V 1 , V3, V5), - P R O D ( V 0 , V5, V6), SUM(V2, V4, V6)}. and the derived clauses C40 = {PROD(V0, VI, F2(V1, VO)} C42 = {PROD(l, VO, VO)} If C40 is used to remove the first and second literals, and C42 used to remove the fourth literal the clause {-SUM(V1, V3, V5), SUM(F1(V1, 1), F2(V3, 1), V5)} is obtained. If A = SUM(tl, t3, t5) is used to clash against the first literal of this clause, the clause SUM(F2(£1, 1), F2(t3, 1), t5) is obtained. Since this clause demodulates to A, the schema (C6; C40, C40, X, C42,1) is used to prevent such clashes. (D) Finally if clause C42 is used to remove the first and second literals of C7, the clause {-SUM(V1, V3, V5), - S U M ( V 1 , V3, V6), P R O D ( l , V5, V6)} is obtained. If A and B are any clauses such that (C7, C42, C42, A, B, I) is a UR-resolvent, the resolvent is of the form P R O D ( l , (5, t6), where t5 is the third term of A, and (6 is the third term of B. However, this resolvent will be obtained from the clauses C12 = {-SUM(V0, VI, V2), -SUM(V0, VI, V3), EQUAL(V2, V3)} and C20 = {-EQUAL(V0, VI), - P R O D ( V 2 , V3, VO), PROD(V2, V3, VI)} as follows. The UR-resolvent {C12, A, B, I) is C = {EQUAL (i5, <6)} then the clash (C20, C, C40, I) is {P(l, <5, <6)}. Since there is no reason to generate the clause twice, the schema {C7, C42, C42, X, Y, 1} was added to prevent one derivation of this clause. In summary the schemata presented above are used to curtail the generation of UR-resolvents that (i) are already in the clause space, or (ii) demodulate to a clause in the clause space or (iii) may be derived by another series of inferences. In both theorems each schema was added for one of these reasons.
Complexity
and Related
Enhancements
211
REFERENCES 1. C. L. Chang, The unit proof and the input proof in theorem proving. JACM, 17, 689-707. 2. R. A. Overbeek, An implementation of hyper-resolution, Comp. Maths, with Appls., 1, 201-214 (1975). 3. A. Tarski, What is Elementary Geometry?, Symposium on the Axiomatic Method. 4. L. Wos, G. A. Robinson, F. Carson and L. Shalla, The Concept of Demod ulation in Theorem-proving, JACM, 14(4), 698-709 (1967).
APPENDIX A THE FOLLOWING ARE GROUP AXIOMS . . . . THE 0PERATI0K • IS CLOSED CL
....
PU,Y,F(X,Y)) . . . . E IS A LEFT AND RIGHT IDENTITY
CL CL
....
P(E,X,X) P(X,E,X) . . . . G(X) IS A LEFT AND RIGHT INVERSE . . . .
a CL
P(G(X),X,E) P(X,G(X),E) . . . . THE OPERATION » IS ASSOCIATIVE
....
CL -P(X,Y,V0) -P(Y,Z,V) -P(V0,Z,V) P(X,V,W) CL -PU.Y.VO) -P(Y.Z.V) -P(X,V,W) P(V0,Z,W) . . . . THE OPERATION * IS WELL DEFINED
....
CL -P(X,Y,Z) -P(X,Y,W) EQUAL(Z.W) EQUALITY AXIOMS CL EQUALU.X) CL -EQUAL(X,Y) -EQUAL(Y.Z) CL -EQUAL(X,Y) EQUAL(Y,X)
EQUAL(X,Z)
EQUALITY SUBSTITUTION AXIOMS CL CL CL CL CL CL
-EQUALU.Y) FJQUAL(G(X),G(Y)) -EQUAL(X.Y) EQUALCF(X.W) ,F(Y,W» -EQUAL<X,Y) EQUAL(F(W,X) ,F(W,Y)) -EQUAL(X.Y) -P(X,W,Z) P(Y,W,Z) -EQUAL(X.Y) -P(W,X,Z) P(W,Y,Z) -EQUAL(X.Y) -P(W,Z,X) P(W,Z,Y)
THEOREM 1 SPECIAL HYPOTHESIS ....
X CUBED EQUALS THE IDENTITY E . . . .
Collected Works of Larry Wos
212
CL -P(X.X.Y) P(X,Y,E) CL -PCX.X.Y) P(Y,X,E) THE NEGATION OF THE THEOREM ....
<(X,Y),Y) -E . . . .
CL
PCA.B.C)
CL CL CL CL
P(C,G(A),D) P(D,G(B),H) P(H,B,J) P(J,G(H),K)
CL -P(K,G(B).E) THEOREM 2 THE FOLLOWING ARE RING UIOHS . . . . E IS AN ADDITIVE IDENTITY CL CL
. . . . THE SUM IS CLOSED CL
SCX.Y.JCX.Y))
CL
P(X,Y,F(X,Y))
....
.... CL CL
....
SCE.X.X) SCX,E,JO
PRODUCT IS CLOSED
....
....
G(X) IS THE LEFT AND RIGHT ADDITIVE INVERSE . .
S(G(X),X,E) S(X,G(X),E) ....
ADDITION IS ASSOCIATIVE
....
CL -SCX.Y.VO) -S(Y,Z.V) -SCX.V.W) S(VO,Z,W) CL -SCX.Y.VO) -S(Y,Z,V) -S(VO,Z,W) S(X.V.W) . . . . MULTIPLICATION IS ASSOCIATIVE
....
CL -P(X,Y,VO) -P(Y,Z,V) -P(X,V,W) P(V0,Z,W) CL -PCX.Y.VO) -P(Y,Z,V) -P(VO,Z,W) PCX.V.W) ....
ADDITION IS COMMUTATIVE
....
CL -S(X,Y,Z) S(Y,X,Z) ....
MULTIPLICATION DISTRIBUTES OVER ADDITION
CL -P(VO,Vl,V2) -P(V0,V5,VS) CL -P(VO,Vl,V2) -S(V2,V4,V6) CL -P(V0,V1,V2) -P(V5,V1,V6) CL -P(V0,V1,V2) -S(V2,V4,V6)
-PCV0.V3.V4) SCV2.V4.V6) -P(V0,V3,V4) P(V0,VS,V6) -PCV3.V1.V4) S(V2,V4.V6) -PCV3.V1.V4) PCV5.V1.V6)
EQUALITY AXIOMS CL
EQUAL (X, X)
-S(V1,V3,V5) -SCV1.V3.V5) -S(V0,V3,V5) -S(V0,V3,V5)
....
Complexity and Related Enhancements
CL -EQUALU.Y) EQUAL (Y,X) CL -EQUALCX.Y) -EQUALCY.Z) EqUAL(X.Z) - EQUALITY SUBSTITUTION AXIOMS CL CL CL CL CL CL CL CL CL CL CL
-EQUAL(X,Y) -EQUAL(X.Y) -EQUALCX.Y) -EQUALCX.Y) -EQUAL(X.Y) -EQUALCX.Y) -EQUAL(X.Y) -EQUAL(X,Y) -EQUAL(X,Y) -EQUAL(X,Y) -EQUAL(X,Y) ....
-S(X,W,Z) S(Y,W,Z) -S(W,X,Z) S(W,Y,Z) -SCW.Z.X) S(W,Z,Y) -P(X,W,Z) P(Y.W,Z) -P(W,X,Z) PCW.Y.Z) -PCW.Z.X) P(W,Z,Y) EQUAL (G(X).GCY)) EQUAL(F(X W).FCY,W)) EQUAL(F(W X),F(W,Y)) EQUALCJCX.U),J(Y,W)) EQUAL<J(W X),J(W,Y))
SUM AND PRODUCT ARE WELL DEFINED
CL -S(X,Y,U) -S(X,Y,Z) CL -PCX.Y.W) -P(X,Y,Z)
EQUALCW.Z) EQUALCW.Z)
LEHMAS PROVED ....
CANCELLATION LAWS
CL -S(X,Y,Z) -S(X,W,Z) CL -S(X,Y,Z) -SCW.Y.Z)
....
EQUAL (Y,W) EQUAL(X.W)
THE NEGATION OF THE THEOREM - X « 2 - X -> COMMUTATIVITY CL P(X,X,X) CL P(A,B,C) CL -P(B,A,C) THEOREH 3 LEMHAS PROVED ESTABLISHED IDENTITIES CL CL CL CL CL CL
EQUAL(F(X,E),X) EQUAL(F(E,X),X) EQUAL(F(C(X),X),E) EQUAL (F(X,G(X)),E) EQUAL(G(G(X)),X) EQUAL(GCE),E) THE NEGATION
OF THE THEOREH -
-
THE FOLLOWING CLAUSES DENY THAT SUBGROUPS OF INDEX 2 ARE NORMAL CL
0(E)
CL -OCX) CL -OCX)
O(GU)) - 0 ( Y ) -PCX.Y.Z)
0(Z)
CL -EQUALCX.Y) -OCX) OCY) CL -EQUAL ( X , Y ) EQUALCI ( W , X ) , I (W,Y)) CL -EQUALCX.Y) EQUALCI(X,W),ICY,W)) CL OCX) OCY) OCICX.Y)) CL OCX) OCY) PCX,I(X,Y),Y) CL OCB) CL P C B , G C A ) , C )
Collected Works of Larry Wos
214
CL CL
P(A.C.D) -0(D)
THEOREM 4 A BOOLEAN ALGEBRA IS DEFINED TO BE A SET (B) TOGETHER WITH TWO BINARY OPERATIONS (♦),(.) SATISFYING THE FOLLOWING AXIOMS . . . . DEFINITION OF THE SUM AND PRODUCTS . . . . PREFIXES AND FUNCTIONS . . . . CL CL
....
SUM(X,Y,F1(X,Y)) PR0D(X,Y,F2(X.Y)) . . . . PI) . . . . . . . . THE OPERATIONS (+) AND (.) ARE COMMUTATIVE
....
CL -SUH(X,Y,V3) SUM(Y,X,V3) CL -PR0D(X,Y,Y3) PR0D(Y,X,V3) . . . . CL CL CL CL
. . . .
. . . .
. . . .
P2) . . . . THERE EXISTS IN (B) IDENTITY ELEMENTS (C1.C2) . . . . RELATIVE TO THE OPERATIONS (♦) AND (.) . . . . RESPECTIVELY . . . .
SUH(X,C1,X) SUM(C1,X,X) PR0DU,C2,X) PR0D(C2,X,X) . . . . P3) . . . . . . . . EACH OPERATION DISTRIBUTES OVER THE OTHER . . . . . . . . X . (Y ♦ Z) - (X, Y) + (X . Z) (Y ♦ Z) . X - (Y . X) ♦ (Z . X) .
CL -PRODU.Y.Vl) SUM(V1,V2,V4) CL -PR0D(X,Y,V1) PR0D(X,V3,V4) CL -PR0D(Y,X,V1) SUH(V1,V2,V4) CL -PR0D(Y,X,V1) PR0D(V3.X,V4)
-PR0D(X,Z,V2)
-SUM(Y,Z,V3)
-PR0D(X,V3,V4)
-PR0D(X,Z,V2)
-SUM(Y,Z,V3)
-PR0D(V1,V2,V4)
-PR0D(Z,X,V2) -SUM(Y,Z,V3)
-PR0D(V3,X,V4)
-PR0D(Z,X,V2)
-SUM(V1,V2,V4)
-SUM(Y,Z,V3)
. . . . X + (Y . Z) - (X ♦ Y) . (X ♦ Z) (Y . Z) ♦ X CL -SUM(X,Y,V1) -SUM(X,Z,V2) -PR0D(Y.Z,V3) PR0D(V1,V2,V4) CL -SUM(X,Y,V1) -SUM(X,Z,V2) -PR0D(Y,Z,V3) SUM(X,V3,V4) CL -SUM(Y,X,V1) -SUK(Z,X,V2) -PR0D(Y,Z,V3) PR0D(V1,V2,V4) CL -SUM(Y,X,V1) -SUM(Z,X,V2) -PR0D(Y,Z,V3) SUK(V3,X,V4) . . . . . CL CL CL CL
P4) . . . . FOR EVERY ELEMENT THERE EXISTS -(X) X + -tX) - C2 AND X . -(X) - Cl AND
SUH(X,F3(X),C2) SUM(F3(X),X,C2) PR0D(X,F3(X),C1) PR0D(F3(X),X,C1)
(Y ♦ X) . (Y * Z)
-SUM(X,V3,V4) -PR0D(V1,V2,V4) -SUM(V3,X,V4) -PR0DCV1,V2,V4)
(X) IN A BOOLEAN ALCEBRA SUCH THAT: . . . . -(X) . X - Cl . . . . -(X) ♦ X - Cl . . . .
....
Complexity and Related Enhancements
. . . .
THE OPERATIONS
CL - S U H { X , Y , V 3 >
( + ) AND ( . )
-SUHCX.Y.V4)
CL - P R 0 D C X . Y . V 3 )
ARE WELL DEFINED
.
.
EQUALCV3.V4)
-PR0D(X,Y,V4)
EQUALCV3.V4)
EQUALITY AXIOMS CL
EQUAL(X,X)
CL -EQUALCX.Y) CL -EQUALCX.Y)
EQUALCY.X) -EQUAL(Y,V1)
EQUAL(X.Vl)
EQUALITY SUBSTITUTION
AXIOMS
CL -EQUALCX.Y) CL - E Q U A L U . Y )
-SUM(X,V1,V2) -SUM(V1,X,V2)
SUHCY.V1.V2) SUMCV1.Y.V2)
CL -EQUALCX.Y)
-SUM(V1,V2,X)
SUM(V1,V2,Y)
CL -EQUALCX.Y) CL -EQUALCX.Y) CL -EqUALCX.Y)
-PR0D(X,V1,V2) -PR0D(V1,X,V2) -PROD(VI,V2,X)
CL CL CL CL CL
-EQUALCX.Y) -EQUALCX.Y) -EQUALCX.Y) -EQUALCX.Y) -EQUALCX.Y)
PROD(Y.Vl,V2) PR0D(V1,Y,V2) PR0D(V1,V2,Y)
EQUALCFl(X.Vl) . F 1 C Y . V 1 ) ) EQUALCFl(Vl.X).Fl(Vl.Y)) EQUALCF2CX.V1) . F 2 C Y . V 1 ) ) EQUALCF2CV1.X) , F 2 ( V 1 , Y ) ) EQUAL(F3CX),F3(Y))
LEMMAS PROVED . . . . . . . .
THE THEOREM PROVER HAS PREVIOUSLY GIVEN PROOFS FOR THE FOLLOWING IDENTITIES . . . . FOR ELEMENTS X . Y IN A BOOLEAN ALGEBRA ( B ) : X + X - X AND X . X - X . . . .
CL
SUMCX.X.X)
CL
PRODCX.X.X)
CL
SUMCX.C2.C2)
CL
PRODCX.C1.C1)
CL
SUMCX.F2CX,Y)I)
CL
PROD(X.FlCX,Y),X)
X ♦ (X . Y) - X
AND
X .
(X * Y) - X
THE NEGATION OF THE THEOREM . CL
. . . X ♦ CY ♦ Z) - CX ♦ Y) + Z . . . .
SUMCC4.C5.C7)
CL
SUMCC3.C7.C3)
CL
SUHCC3.C4.C9)
CL
SUM
CC9.C5.C10)
CL -EQUALCC8.C10) THEOREM 5 THIS PROBLEM DEALS WITH TARSKI'S AXIOMATIZATION OF ELEMENTARY GEOMETRY. THE PROBLEM IS TO SHOW THAT IF THE POINT A LIES BETWEEN POINTS B AND C.THEN A MUST LIE BETWEEN C AND B THE MEANINGS OF THE FUNCTIONS AND PREDICATES ARE AS FOLLOWS: C1.C2.C3 ARE INTRODUCED AS SKOLEH FUNCTIONS IN THE CONVERTED FORM OF THE "LOWER DIMENSION" (All).
Collected Works of Larry Wos
216
Fl IS A SKOLEM FUNCTION INTRODUCED IN THE CONVERTED FORM OF "PASCH'S AXIOM" (A7). F2 AND F3 ARE SKOLEM FUNCTIONS INTRODUCED INTO THE CONVERTED FORK OF "EUCLID'S AXIOM" (A8). F4 IS A SKOLEM FUNCTION INTRODUCED IN THE CONVERTED FORM OF THE 'AXIOM OF SEGMENT CONSTRUCTION" (AlO). F6 IS A SKOLEH FUNCTION INTRODUCED INTO THE CONVERTED FORM OF THE WEAKENED "ELEMENTARY CONTINUITY AXIOMS" (A13'). A.B.AND C ARE THE POINTS MENTIONED IN THE STATEMENT OF THE PROBLEM. BCX.Y.Z) IS TRUE IFF Y LIES BETWEEN X AND Z. L(X1,Y1,X2,Y2) IS TRUE IFF XI IS THE SAME DISTANCE FROM Yl THAT X2 IS FROM Y2. NOTE THAT THE WEAKENED FORM OF AXIOM A13 (A13') IS USED. . . . . Al . . . . CL -B(X,Y,I) EQUALCX.Y) ....
A2 . . . .
CL -B(X,Y,V) -B(Y.Z.V) BCX.Y.Z) . . . .
A3 . . .
.
CL -B(X,Y,Z) -B(X,Y,V) EQUALCX.Y) B(X,Z,V) . . . . CL
A4 . . .
B(X,V,Z)
.
L(X.Y,Y,X) . . . .
A5 . . .
.
CL -L(X.Y,Z,Z) EQUALCX.Y) . . . .
A6 . . .
.
CL -L(X,Y,Z.V) -L(X,Y,V2,W) . . . .
A7 . . .
CL -B(X,W,V) -B(Y,V,Z) CL -B(X,W,V) -B(Y,V,Z) . . . .
AS . . .
B(X,F1(W,X.Y,Z,V),Y) BCZ.W.FICW.X.Y.Z.V))
.
CL -B(X,V,W) -B(Y,V,Z) CL -BCX.V.W) -BCY.V.Z) CL -B(X,V,W) -B(Y,V,Z) . . . .
A9 . . .
L(Z,V,V2,W)
.
EQUALCX.V) EQUALCX.V) EQUALCX.V)
B(X > Z,F2(W,X,Y,Z.V)) B(X,Y,F3(W,X,Y,Z,V)) BCF2CW.X.Y.Z.V),W,F3CW,X,Y,Z,V))
.
CL -LCX.Y.X1.Y1) -LCY.Z.Y1.Z1) -LCX.V.X1.V1) -LCY.V.Y1.V1) -BCX.Y.Z) -BCX1.Y1.Z1) EQUALCX.Y) LCZ.V.Z1.V1) . . . . CL CL
AlO . . .
.
BCX,Y,F4(X,Y,W,V)) LCY.F4CX,Y,W,V),W.V) . . . .
All . . .
.
Complexity and Related Enhancements
CL
-BCC1.C2.C3)
CL - B C C 2 . C 3 . C 1 ) CL - B C C 3 . C 1 . C 2 ) .
.
.
.
A12
CL - L C X . W . X . V ) BCY.Z.X) . . . .
-LCY.W.Y.V)
-L(Z.W.Z.V)
A13
. . . .
EQUALITY AXIOHS
CL EQUALCX.X) CL -EQUALCX.Y) CL -EQUALCX.Y)
EQUALCY.X) -EQUAL(Y,Z)
-EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y; -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EQUALCX.Y -EqUALCX.Y -EQUALCX.Y! -EQUALCX.Y -EQUAL(X -EQUAL (X -EQUALCX -EQUALCX -EQUALCX
-BCX.Y.Z)
EQUALCX.Z) AXIOMS
-
-BCX.W.Z) BCY.W.Z) -BCU.X.Z) BCW.Y.Z) -BCW.Z.X) BCW.Z.Y) -LCX.V.K.Z) LCY.V.W.Z) -LCV.X.W.Z) LCV.Y.W.Z) -LCV.W.X.Z) LCV.W.Y.Z) -LCV.W.Z.X) LCV.W.Y.Z) EQUAL(F1CX,V1.V2.V3.V4).F1CY,V1,V2,V3,V4)) EQUAL(F1(V1.X,V2,V3.V4),F1CV1,Y,V2,V3,V4)) EQUALCF1CV1,V2,X,V3,V4),F1CV1,V2,Y,V3,V4)) EQUAL(F1CV1,V2,V3,X,V4),F1CV1,V2,V3,Y,V4)) EQUAL(F1(V1,V2,V3,V4,X),F1CV1,V2,V3,V4,Y)) EQUALCF2CX.V1,V2,V3,V4>,F2CY,V1,V2,V3,V4)) EqUALCF2CVl,X,V2,V3,V4),F2CVl.Y,V2,V3,V4)) EQUAL(F2CV1,V2,X,V3,V4),F2CV1,V2,Y,V3,V4)) EQUAL(F2(V1,V2,V3,X,V4).F2CVI,V2,V3,Y,V4)) EQUALCF2(V1,V2,V3,V4,X),F2CV1,V2,V3,V4,Y)) EQUALCF3CX,V1,V2,V3,V4),F3CY,V1,V2,V3,V4)) EQUAL(F3CV1,X,V2.V3,V4),F3CV1,Y,V2.V3,V4)) EQUAL(F3CV1,V2,X,V3,V4),F3CV1,V2,Y,V3,V4)) EQUALCF3CV1,V2,V3,X,V4),F3CV1,V2,V3,Y,V4)) EQUAL(F3CV1,V2,V3,V4,X),F3CVI,V2,V3,V4,Y)) EQUAHF4CX,V1,V2,V3),F4(Y,V1,V2,V3)) EQUAL{F4CV1,X,V2,V3),F4CV1,Y,V2,V3)) EQUALCF4CV1,V2,X,V3),F4CV1,V2,Y,V3)) EQUALCF4CV1,V2,V3,X),F4CV1,V2,V3.Y)) EQUAL(FSCX,V1,V2,V3,V4,V5),F5CY,V1,V2,V3,V4,V5)) EQUAL(FSCV1,X,V2,V3,V4,V5),F5CV1,Y,V2,V3,V4,VS)) EQUAL(F5CVI,V2,X,V3,V4,VS),FSCV1,V2,Y.V3.V4,V5)) EQUALCF5CV1,V2,V3,X>V4,VS),FSCV1,V2,V3,Y,V4,V5)) EQUALCF5CV11V2,¥3.V4,X,VS),F5(V1,V2,V3,V4,Y.V5)) EQUAL(F5(V1,V2,V3,V4,V5.X),F5(V1,V2,V3.V4,V5,Y))
- - THE NEGATION OF THE THEOREM CL BCA.B.C) CL -BCC.B.A)
-BCX.Y.Z)
. . . .
EQUALITY SUBSTITUTION a CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL CL a CL CL CL CL
BCX.Y.Z)
'
CL - L C V . X . V . X 1 ) - L C V . Z . V . Z 1 ) - B ( V . X . Z ) LCV,Y,V.F5CX,Y,Z,X1.Z1,V)) CL - L C V . X . V . X l ) - L C V . Z . V . Z 1 ) - B C V . X . Z ) BCX1,FSCX,Y,Z,X1,Z1,V),Z1) . . . .
EQUALCU.V)
BCZ.X.Y)
Collected Works of Larry Wos
218
Appendix B Th«or«a 1. CPU t i n * - 1 B I B . 9 Bftc. C-5«ts 1. 2. 3. 4. 5. 6. 7. 8. 9. 10.
(F(l.l).l) (G(D,1)
Thaoram 2 . CPU t i n * - 3 mln. 14 s a c . C-sats 1. 2. 3. 4. 5. 6. 7. 8.
(F(0,F(0,0)),99) (F(F(0,0),0),99) (G(l),l,l) (F(l.l),l) (J(l,l),l)
Tnaoram 3 . CPU tima - 1 mln. 45 s a c . C-ssts 1. 2. 3. 4. 5. 6. 7. 8.
(A,l) (B.l) (C.l)
Thaoram 4 . CPU tima - 6 Din. 26 s a c . C-sats 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. U. 12. 13. 14.
(F2U,0,1> (Fl(l,l),l) (F3(l,l),l) (Cll.l) (C10.5) (C9,3) (C8,5) (C7,3) CC6.1) (CS.l) (C4.1) (C3,l) (C2,l) (Cl.l)
Thaoram S. CPU t i s i s - 0 mill. 38 s a c . C-sets
Complexity and Related Enhancements
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.
(F5<1,1. (F4U.1, (F3U.1, (F2(l,l, (FlU.l, (C.l) (B.l) (A.l) (C3,l) (C2.1) (Cl,l)
l,l,l,l),l) 1,1),1) 1,1,1),D 1,1,D,1) 1,1.1),!)
AN UNNATURAL ATTACK ON THE STRUCTURE PROBLEM FOR THE FREE JORDAN RING ON 3 LETTERS: AN APPLICATION OF QUAD ARITHMETIC B. T. Smith and L. T. Wos
Abstract We introduce herein a method which yields answers to certain questions con cerning the free Jordan ring, denoted by TZ, on 3 letters—ques tions which wore, until now, open. Among others, we answer the question of dimensionality for each of a number of the interesting subspaces of 7£. We also give the dimension of the kernel for these subspaces, and explicitly present the kernel element for the subspace of degree type (3,3,2). The method by which this information is obtained departs sharply from the natural approach which is based on the consideration of (in many cases very large) systems of linear equations. Rather, our approach rests on two algorithms which avoid much of the arithmetic difficulty inherent in processing linear equa tions. Of greater significance, however, is the fact that, even with the aid of a high-speed digital computer, the large systems of equations encountered in studying certain subspaces require so much time and memory that the prob lem becomes intractable. The subspace of type (3,3,3), for example, requires for the natural treatment the processing of a system of 5118 equations in 2391 variables—a truly awesome matrix. Of special interest is a new arithmetic employed by one of the two algo rithms which, together with the underlying data structure, makes the problem tractable. This arithmetic, called "quad arithmetic", and the identity on which it is based are first described in this paper. Were it not for quad arithmetic, the cost of coping with the redundancy encountered in the study of many of the interesting subspaces of 72. would be prohibitive. The remaining topic of major importance is the aforementioned data struc ture. The data structure is an indispensable feature of the computer program Reprinted from Computers in Nonassociative Rings and Algebras, ed. Robert E. Beck and Bernard Kolman, Academic Press, New York, pp. 41-138 (1977). Published with permission from Adacemic Press, Inc., Orlando, Florida.
An Application of Quad
Arithmetic
221
from which our results are obtained. Through its use the program totally avoids the lengthy and cumbersome symbolic manipulation inherent in a strightforward treatment of the free Jordan ring on 3 letters. Moreover, a data structure similar to that described in this paper may well prove useful to those contemplating an attack on problems in other nonassociative algebras, especially should that attack entail the use of the digital computer.
1. Introduction Determination of the structure of the free Jordan ring on 3 letters has defied mathematical analysis. The elements of this ring are finite sums of finite strings of letters which, under multiplication, satisfy commutativity but not associativ ity. These finite letter strings, together with their grouping symbols, are called monomials and are essential to what follows. The elements of the ring satisfy the linearized Jordan identity. This identity does not apply to monomials of degree less than 4, where the degree of a monomial is the number of occurrences of letters therein. In this paper we present the results of a study of this free Jordan ring— a study conducted with the aid of a high-speed digital computer. On the one hand, therefore, certain sections such as Sections 4 to 6 of the paper will be primarily of interest to the mathematician. Here will be found answers to certain previously unanswered questions concerning the existence and independence of kernel elements, for example. It is here that a new identity, relating instances of the linearized Jordan identity, is introduced and proven—an identity which has a profound effect on the ease with which the results are obtained. On the other hand, Sections 2 and 3 will be of primary interest to the com puter scientist. In Section 2 the discussion centers on the data structure which treats monomials (finite strings of letters) as integers thereby totally avoiding the corresponding symbolic manipulation. Section 3 contains the algorithms which enable the program to circumvent much of the difficulty inherent in dealing with large systems of linear equations. One such system, for example, encountered in this study corresponds to a 5118x2391 matrix, where the matrix is far from being sparse. As a problem in linear equations, this system is virtually beyond consideration because of the time and/or space requirements. With the algo rithms of Section 3, however, this system yields its information in five minutes of time and two million bytes of memory on an IBM 370/195. Sections 2.3 and 2.4 are of general interest. In Section 2.3, certain canonicalizations and a natural approach to investigating the dimension of subspaces of the free Jordan ring on 3 letters are described. In Section 2.4, an overview of the approach upon which the work described in the present paper rests is given. The organization of this paper is chosen with two objectives in mind. First, in order to permit one to skip over certain sections of the paper, an attempt is made to make portions of the paper self-contained. One who is interested in
222
Collected Works of Larry Wos
the formal mathematics underlying this effort can therefore, with the exceptions of Sections 2.3 and 2.4, omit reading Sections 2 and 3. On the other hand, if one is chiefly interested in the use of the digital computer in solving problems in abstract algebra and furthermore solving them in a surprisingly efficient manner, Sections 2 and 3 will be of primary concern. The second objective of the paper is that of describing our attack on the structure problem with sufficient detail that one can apply a similar approach to problems in other algebras, especially those which are nonassociative. With this in mind, we begin in Section 2 with a brief review of the problem (set of subproblems) to be solved. In each case, the object is to find the dimension of a subspace generated by all monomials of a given degree type (i, j , k), where the degree type (i, j , k) of a monomial m gives respectively the number of occurrences of a, of b, and of c in m. In order to understand the attendant difficulties, we turn to a discussion of the natural approach to solving the subproblems. Then, to begin the presentation of the method which avoids these difficulties, we start with the data structure. The data structure is a realization of a function, called a closing function, which maps monomials to positive integers and thus permits symbolic manipulation to be replaced by operations on the integers. Closing functions are informally but fully described. In the next section, Section 3, we give two algorithms which enable the pro gram to extract the information contained in the systems of linear equations— the systems arising from using the natural approach—but without dealing di rectly with those systems. Since the systems which yield answers to previously open questions are very large, it is essential that their use be circumvented. The first algorithm provides the mechanism for generating appropriate equa tions, to be considered singly, from which the relevant data is extracted. The second algorithm is even more important in that through its use so-called redun dant equations are discarded without ever being generated. Since the redundant equations, those which are linear combinations of ones already examined, occur approximately two-thirds of the time in the systems corresponding to interesting subproblems, the removal of such equations contributes markedly to solvability. The second algorithm is based on "quad arithmetic" which in turn owes its existence to the identity denoted by EoSection 4 contains the formal treatment of closing functions and their prop erties. Here also one finds the proofs of the lemmas of Section 2 which give the crucial characteristics of these functions. Quad arithmetic and the identity Eo are the focus of attention in Section 5. A quad is an ordered set of 4 positive integers which are images under a partic ular choice of a closing function of 4 chosen monomials. The quads can be partitioned into classes such that the members of a class generate a finitedimensional vector space over the rationals. The defining characteristic for each class of quads is the analogue of the concept of degree type for monomials. Just as the linearized Jordan identity establishes various relations among the monomials in the class of those of some given degree type, so also do vari-
An Application of Quad
Arithmetic
223
ous identities establish relations among the quads. The set of identities, the most powerful of which is denoted by Eo, determines the dimension of each of the vector spaces of quads. Since the quads of a given class are in one-toone correspondence with the equations for the same degree type obtained by substitution into the linearized Jordan identity, and since such a set of equa tions can contain an inordinate number of redundant (as defined earlier) equa tions, we prefer to work when possible with the quads rather than with the equations themselves. The reasons for this preference are first, an impressive gain in efficiency, and second, the total avoidance of arithmetic problems. The mechanism of computing with the quads rather than with the corresponding equations (instances of the linearized Jordan identity) is "quad arithmetic". Because of this arithmetic certain quads can be directly added or directly mul tiplied by a scalar to yield other quads. For each vector space of quads, em ployment of the arithmetic yields a set of quads which contains a basis for the space and contains in addition a few unneeded quads—unneeded in that they are linearly dependent. The linear dependence of these unneeded quads is established by a corresponding substitution into the linearized Jordan iden tity. The significance of these quad bases for the structure problem of the free Jordan ring on 3 letters lies in the relation each bears to a corresponding sub system of linear equations. The complement of each such subsystem consists entirely of redundant equations. Therefore, quad arithmetic plays an essential role in the obtainment of the results presented herein concerning the; free Jor dan ring, for this arithmetic provides the means for efficiently discarding the redundant equations- -those equations that comprise approximately two-thirds of the set remaining after canonicalization. Section 5 concludes with the proof of the identity Eo—the identity upon which quad arithmetic mainly rests. Finally, the results obtained thus far through the application of the approach described herein are given in Section 6. They include the dimension of each subspace of the free Jordan ring through degree 9. We also give the dimension of the kernel in each such subspace and, for the subspace of degree type (3,3,2), present the kernel element. We then discuss here the choice of basis in certain subspaces. Because in many of the subproblems the basis can be chosen in a consistent manner, we are led to making certain conjectures. We conclude this section with some open questions arising directly from this effort.
2. Problem Specification, Closing Functions, and the Data Structure The tone of this entire section is rather informal. We begin in Section 2.1 by giving all of the properties and concepts for the free Jordan ring on 3 letters which are employed in the remainder of the paper. We then in Section 2.2
Collected Works of Larry Wos
224
specify the problem, which for us is a set of subproblems, to be solved. There exists a natural approach to solving all such problems, but the approach is, for the interesting cases, virtually unmanageable. To understand the inherent difficulties which therefore led us to the formulation of the method presented here, we discuss in Section 2.3 the natural approach. We discuss there various canonicalizations. This is immediately followed in Section 2.4 by an overview of the approach by which we obtain solutions to the various subproblems—a method which contrasts sharply with the natural one. We then turn in Section 2.5 to a description of the data structure upon which our approach rests. Since the properties of the data structure reflect those of certain special functions called "closing functions", we discuss in Section 2.6 quite informally but in detail closing functions and their basic properties. After giving in Section 2.7 examples of the various basic properties, we state without proof in Section 2.8 a number of lemmas and corollaries for closing functions whose proofs appear in Section 4. These results establish for the functions in question the presence of certain additional valuable properties. These additional properties are captured by the data structure and affect the time required to obtain the solution to the various subproblems in a number of ways. We conclude this section with Section 2.9 which discusses the impact on program efficiency of employing a data structure based on closing functions.
2.1. The Free Jordan Ring on 3 Letters The first concept of importance is that of monomial. A monomial is a finite string of letters, from among a, b and c, and appropriately paired grouping symbols. Some examples are: a b ((ba)a)a
c ba ((aa)b)a
ab cc ((aa)a)b
(cc)b (ba)(aa).
The more relevant basic laws are those of commutativity and associativity of addition, commutativity of multiplication, and distributivity. Multiplication is not associative. The object of study is the free Jordan ring Tt on 3 letters, a, b, and c. The elements of 11 are all finite sums of monomials with rational coefficients. The crucial property of "R. is that its elements satisfy the Jordan identity. The form of this identity that is used throughout the paper is the linearized Jordan identity. The linearized Jordan identity, often denoted by LJI throughout the remainder of this paper, is given by ((yz)w)x + ((xz)w)y + ((xy)w)z = (wx)(yz) + (wy)(xz) + (wz)(xy),
where w, x, y, and z take on values from the Jordan ring TZ. Associated with each monomial are its degree and degree type. The degree d(m) of the monomial m equals the number of symbols in m which are letters.
An Application of Quad
Arithmetic
225
The degree type dt(m) of m is a triple of integers (i, j , k), where i is the number of a's occurring in m, j the number of b's, and k the number of c's. Therefore, if a monomial has degree type (i,j,k) for some i, j , and k, its degree is i+j+k. In particular, the last four monomials in the earlier list of monomials all have degree type (3,1,0) and all have degree 4. We can now define the subsets S(i,j,k) of Tl which give rise to the set of subproblems described in Section 2.2. For each triple (i, j , k) of integers, S(i, j , k) is the set of all monomials in 72. of degree type (i, j , k). For each S(i, j , k) there exists a vector space V(i,j,k) over the rationals consisting of all finite sums of elements from S(i, j , k) with rational coefficients. For the study of the V(i, j , k), we find it convenient to have all computation take place within the integers. There is no loss in generality by doing this, for any relation with rational co efficients among monomials can trivially be transformed into a corresponding relation with integral coefficients. Conversely, any relation with integral coeffi cients expressing a multiple of a given monomial m in terms of other monomials can be converted to a relation with rational coefficients expressing m itself in terms of other monomials by simply dividing by the coefficient of m.
2.2. The Specific Set of Problems to be Solved Since each of the V(i, j , k) is a vector space, we can ask of any V(i, j , k): What is its dimension? Were it not for the linearized Jordan identity, the answer would be quite quickly obtained as follows. Let V(i,j,k) be some given vector space in TL. Then by definition there exists an S(i,j, k) such that the elements of S(i,j, k) span V(i, j , k), that is, all elements of V(i, j , k) are expressible as linear combina tions of elements from S(i, j , k) with rational coefficients. Choose any monomial m in S(i,j,k), and remove from S(i,j,k) all monomials m' such that m' = m under commutativity of multiplication but where m' is, of course, not m itself. Since it is trivial to decide for any two distinct monomials whether one can be obtained from the other by repeated applications of commutativity, and since S(i,j,k) is finite, one immediately finds a subset U(i,j,k) of S(i,j,k) such that the elements of U(i,j,k) are linearly independent. We thus would have, if the LJI were not present, the dimension of V(i, j , k) equal to the number of elements in U(i, j , k) and as a bonus would also have a basis for V(i, j , k), namely, U(i, j , k) itself. For a number of subspaces V(i, j , k), however, the linearized Jordan identity transforms the problem of determining dimension from the very straightforward to the very difficult. There are two reasons for this. First, the linear dependencies established by the identity are not the trivial type discussed in the previous paragraph. Second, even with canonicalization, the number of monomials that must be considered in the search for a basis may be large. In the dimension problem for V(3,3,2), for example, there remain 3157 monomials after discarding monomials by use of canonicalization for commutativity of multiplication. When
226
Collected Works of Larry Wos
this number is further reduced by canonicalization for distributivity as discussed in Section 2.5, there remain 732 monomials. Almost two-thirds of these are found to be linearly dependent, the dependency being directly traceable to the LJI. This example, V(3,3,2), suggests the need for departing from the natural approach, which is described in the next section. Quite specifically, the subproblems to be solved in this paper are: For each vector space V(i, j , k) as defined above of the free Jordan ring Tl on 3 letters such that i+j+k < 9, find both its dimension and a basis for it. In addition we are to find, for certain sets of subspaces, bases which exhibit a uniform structure. Finally, for convenience, we require all basis elements to be individual monomials rather than non-unary sums.
2.3. Canonicalization and the Natural Approach for Finding Bases In this section we solve the basis problem for the very small vector space V(3,l ,0) as an illustration of the natural approach described here. The basis is obtained with the application of a natural and straightforward approach. The approach is described in sufficient detail to illustrate the role of the LJI and, more impor tantly, to provide the framework for the discussion of the difficulties inherent in finding bases for interesting subspaces such as V(3,3,2). Utilization of this natural approach yields a rectangular matrix of simultaneous linear equations from which a basis is extracted by using standard techniques for Gaussian elim ination. The natural approach is more than adequate for subspaces of 72. through de gree 6. The largest such subspace requires, after various rather obvious but vital canonicalizations described later in this subsection, the solution of 87 simultane ous linear equations in 96 unknowns. For certain subspaces of degree 7, however, the method is merely acceptable and requires access to a large digital computer such as the IBM 370/195. In addition, for reasons of stability, fixed point, as opposed to floating point, arithmetic must be employed for these large degree 7 cases. Consider, for example, the vector space of degree 7 of type (3,2,2). Even after the size of the system has been reduced through canonicalization, one is confronted with a 326x248 matrix. The approach itself, which we apply in the last half of this subsection to V(3,l,0), can be divided into three steps. First, by means of substitution into the linearized Jordan identity, generate the full set of simultaneous linear equa tions relevant to the subspace under study. Second, eliminate from the matrix yielded by the first step those equations which are linearly dependent on those remaining. Perform the elimination so that this step not only yields a matrix of full rank but also one which is upper triangular. Third, where r is the rank of the matrix of step 2, apply standard Gaussian elimination to yield a matrix whose first r x r submatrix is diagonal. This last matrix expresses r dependent monomials solely in terms of the remaining monomials which, of course, are
An Application of Quad
Arithmetic
227
therefore a basis. There are certain tacit assumptions present in this three-step description of the natural approach. To begin with, one does not apply the approach until certain canonicalizations of the type alluded to earlier have been applied. The first canonicalization is that with respect to commutativity of multiplication. As was the case in Section 2.2 when passing from S(i, j , k) to U(i, j , k), all monomials but one which are equal under some number of applications of commutativity are discarded. Since another of the assumptions is that the approach is applied to individual monomials rather than to sums of monomials, the unknowns or variables of the equations of step 1 are monomials no two of which are triv ially equal—equal simply by application of commutativity of multiplication. An equation from step 1 may, of course, contain two monomials which are equal, but such non-trivial equality will only be established by recourse to the LJI. The second canonicalization is with respect to the linearized Jordan identity. This form of the identity, ((yz)w)x + ((xz)w)y + ((xy)w)z = (wx)(yz) + (wy)(xz) + (wz)(xy) possesses much symmetry. In particular, the identity is completely symmetric in x, y, and z. If not appropriately constrained, this symmetry will yield in step 1 many duplicate equations. For example, assume that four monomials are selected such that no two are identical. Among the possible assignments to be followed by substitution into the LJI, assume that the first monomial is to be substituted for w. There are six ways the remaining three monomials can be assigned to x, y, and z, each of which yields a linear equation. Because the LJI is symmetric in x, y, and z, all six equations become identical after canonicalization with respect to commutativity of multiplication and application of commutativity of addition. Thus, it is important to constrain the substitution into the LJI in step 1, and thus be in a position to interpret "the full set of equations" to mean that the obviously duplicate equations have been discarded. One canonicalization rule which avoids these duplicate equations is based on a well-ordering of the monomials. The rule requires that the substitution be admissible if and only if the monomial being substituted for x is greater than or equal to that being substituted for y and that for y is greater than or equal to that for z. Finally, canonicalization with respect to distributivity is also assumed. It is not relevant to the example below, but examples of it are given in Sections 2.5 and 2.9.2. Briefly, this canonicalization imposes two constraints. First, only those monomials which are, recursively, products of basis monomials are admissible for assignment to w, x, y and z in substitution into the LJI. Second, all variables appearing in linear equations yielded by step 1 must be, recursively, products of basis monomials. This second constraint is illustrated in Section 2.9.2. It forces substitution into partial products during the computation of the summands of the LJI.
Collected Works of Larry Wos
228
We are at last ready to apply the natural approach to the vector space V(3,l,0). The only elements of V(3,l,0) that need concern us are the individual monomials therein—the elements of S(3,1,0)—because, of course, by finding a basis for S(3,l,0), we have a basis for V(3,l,0) since V(3,l,0) consists of finite sums of elements from S(3,l,0). There are twenty elements in S(3,l,0), sixteen of which are discarded by canonicalization with respect to commutativity. This leaves us with the set U(3,l,0), a set of monomials no two of which are provably equal by simply applying commutativity of multiplication. Let us say that the monomials which remain are: mi = (ba)(aa)
m2 = ((ba)a)a
m 3 = ((aa)b)a
1114 = ((aa)a)b.
Now to prepare the way for step 1 to generate (without trivial duplication) the linear equation set, we order the monomials relevant to substitution into the LJI. We choose an ordering such that the monomial b is greater than the monomial a. This permits canonicalization with respect to x, y, and z in the LJI by limiting the possible assignments to x, y, and z that we will now make in step 1—limiting the assignments by the requirement that the values for x, y, and z form a non-increasing sequence. S T E P 1. Generate the appropriate set of equations. First, find all subsets, each of which consists of four monomials, that lead to a substitution into the LJI relevant to U(3,l,0). A set is acceptable if a count of the occurrences of a in the four monomials yields the number 3, while that of b's and c's respectively yields 1 and 0. The only admissible set for typo (3,1,0) consists of the monomials b, a, a, and a. Second, for each admissible set, find all assignments of the monomials therein to w, x, y, and z within the constraint that the assignment to x is greater than or equal to that for y is greater than or equal to that for z. There are then the two assignments: b for w with a for x, y, and z; and, b for x with a for w, y, and z. Now generate, for each assignment, the corresponding linear equation coming from the LJI, taking care to canonicalize where necessary. Canonicalization is necessitated by the requirement that each linear equation must mention only elements from U(3,l,0). For example, the summand (wy)(xz) in the linear equation corresponding to the second assignment evaluates to (aa)(ba) which must be canonicalized immediately to (ba)(aa). For the four monomials mi, m2, ni3, nu given above, the first assignment leads to the equation - 3 ( m i ) + 3(m 3 ) = 0, while the second assignment leads to the equation - 3 ( m i ) + 2 ( m 2 ) + m 4 = 0. The monomials of U(3,l,0) are assigned variable numbers vi, V2, V3 and V4, and commutativity of addition is applied where necessary. We then have
An Application of Quad
Arithmetic
229
the matrix which step 1 is intended to yield. For this example, let m p be v p for p = 1,2,3,4. Then the resulting matrix of coefficients is -3 0 3 0 - 3 2 0 1 Note that the substitution into the LJI corresponding to any admissible as signment always yields with appropriate canonicalization a linear equation all of whose unknowns are in the subspace under consideration. This follows from the fact that each summand of the linearized Jordan identity mentions each of w, x, y, and z and each with exponent 1. S T E P 2. Produce an upper triangular matrix of full rank. Application of standard matrix methods to the matrix of step 1 yields "-1 0 1 0' 0 - 2 3 - 1 ' The matrix obtained in this step expresses the dependency relations, but not necessarily solely in terms of basis elements. S T E P 3. Diagonalize the first r x r submatrix of the matrix of step 2, where f is its rank. This has already occurred accidentally in step 2. The three-step natural approach has thus obtained for V(3,l,0) the basis consisting of the two individual monomials, namely, ((aa)b)a and ((aa)a)b. The corresponding dependency relations are: (ba)(aa) = ((aa)b)a and 2((ba)a)a = 3((aa)b)a - ((aa)a)b. The equations for the remaining elements of S(3,l,0) are obviously obtained with commutativity, while those for an element in V(3,l,0) employ appropriate substitution. Note that in this case the linear equations from step 1 do contain pairs of distinct but equal monomials, but that the equality comes from the LJI. Summing up: S(3,l,0) contains twenty elements; the dimension of V(3,l,0) would be 4, the number of elements in U(3,l,0), were it not for the LJI; the correct dimension of V(3,l,0) as a vector space in the free Jordan ring on 3 letters is 2. Certain remarks concerning application of the natural approach to the struc ture problem can now be more easily put. First of all, the matrices of linear equa tions become prohibitively large even with the utilization of the three types of
230
Collected Works of Larry Wos
canonicalization, that with respect to commutativity, that with respect to sym metry in the LJI, and that with respect to distributivity. From step 1, the matrix for V(2,2,2) is 87x96; for V(3,2,2), 326x248; for V(4,2,2), 1011 x568; for V(3,3,2), 1266x732; and for V(3,3,3), 5118x2391. Even with access to a large computer such as the IBM 370/195, some of these matrices require much more memory than is available on a computer of this type. Secondly, there are the questions of time and arithmetic stability in step 2. Such large systems of linear equations require much time to yield a matrix of full rank which is also upper triangular. For arithmetic stability, fixed point, as opposed to floating point, arithmetic would be of great assistance but would most likely be overwhelmed in the interesting subspaces in that large integers will still occur. Some of the inherent difficulties in the second step come from the surpris ingly numerous occurrences of redundant equations. Recall that a redundant equation is one which is linearly dependent on the others. This redundancy is clearly not caused by the symmetry in the LJI, for that has been removed by canonicalization. Among the equations for the space V(2,2,2), there are 39 which are linearly dependent on the remaining and so are redundant by defini tion. In V(3,2,2) there are 186 such; in V(4,2,2), 659; in V(3,3,2), 815; and in V(3,3,3), 3573. The natural approach confronts this redundancy directly, which is a mistake. The foregoing demonstrates in part the reason the structure problem has remained so unyielding. It also clearly delineates the difficulties which the "in verted" approach of the next section circumvents.
2.4. An Overview of the Unnatural or Inverted Approach In this section we give a brief account of the key points in our approach to the problem of finding bases for subspaces of the free Jordan ring on 3 letters. The approach is designed to totally avoid certain of the inherent difficulties in the natural approach and greatly reduce the others. We shall refer to this new approach either as "inverted" or "unnatural". One reason for doing so is that the "inverted" approach starts with a set of monomials, chooses a member of that set for analysis, and then seeks an equation based on that analysis which relates the monomial under consideration to the remaining monomials. The nat ural approach, on the other hand, starts with an equation set, performs various matrix operations on the set, and then finds monomials with appropriate prop erties by examining each resultant equation. The "unnatural" approach relies heavily on an arithmetic, "quad arithmetic", employing ordered quadruples of integers and in the main shuns the more familiar matrix methods on which the natural approach rests. These quadruples or quads correspond to instances of the linearized Jordan identity. Quad arithmetic manipulates these quads rather than the instances of the LJI (for reasons of efficiency) with the object of find ing redundant equations. Finally, the "unnatural" approach discards symbolic
An Application of Quad
Arithmetic
231
manipulation in favor of the use of "closing functions", discussed informally in Section 2.6 and formally in Section 4. Thus the monomials are not treated with their natural representation. The inverted approach consists of five major steps. As was the case with the natural approach, here also is the assumption of canonicalization with respect to commutativity of multiplication, of canonicalization with respect to x, y, z symmetry in the LJI, and of canonicalization with respect to distributivity. Only individual monomials rather than sums are considered throughout the inverted approach. The series of steps is applied to one chosen vector space V(i, j , k) at a time. S T E P 1. Select an ordered monomial set. The monomial set, N(i,j,k), selected at this point is intended to be the complement, loosely speaking, in V(i, j , k) of a basis B(i, j , k). The selection of N(i,j, k) can be left to a subprocedure within the inverted approach—a subprocedure based on a conjecture concerning the structure possessed by the basis of various V(i,j,k). On the other hand, prior to calling the inverted approach, N(i, j , k) can be selected by the mathematician to reflect some different conjecture and then presented as input to the approach. S T E P 2. Generate the appropriate equation. A monomial m N(i,j,k) of step 1 is selected, according to the ordering of step 1, and analyzed to yield four submonomials mi to m^. The monomials mi to 1114 have the property that their product, taken in the right order and with the proper association, is precisely identical to m. Consistent with the statement that symbolic ma nipulation is discarded, the analysis is not of m but rather of an integer denoted by g(m). Also, four integers g(mi) to g(m4) are found rather than four monomials mi to 1TI4. From g(mi) to g(m4) one forms two ordered sets, called quads, each of which consists of four integers. The quads, denoted by q and q', are each a reordering of g(mi) to g(m4). The choice of the reorder ing depends directly on how the m p are multiplied and associated to yield m identically, but without having any recourse to the symbolic expressions of m and of m p . Briefly, q and q' correspond to assignments for w, x, y, z in the LJI. (The details are found in Section 3.2.) The object of this step, the equation appropriate to the choice of m, is generated by substitution into the LJI. The equation is not a single substitution instance of the LJI—does not correspond to a substitution for w, x. y, z—but rather is the difference of two substitution instances and corresponds to q—q'. These differences which correspond to q - q ' for some q and q' are preferred to single substitution in stances of the LJI because they reflect a conjecture concerning the structure of certain classes of the V(i, j , k).
232
Collected Works of Larry Wos
S T E P 3 . Discard redundant equations but without recourse to equation generation. This step depends completely on quad arithmetic. With a re stricted form of that arithmetic, linear equations are solved, where possible, one at a time. The coefficients in each equation are integers, and the variables or unknowns are quads. This arithmetic is the mechanism for adding and/or multiplying by integers various sets of quads. Each time one of these linear equations is successfully solved, a quad, and hence a substitution instance of the LJI, is discarded as redundant—linearly dependent on quads already processed. The redundant instances, quads, discarded by this step require no substitution into the LJI. For example, as an instance of the identity Eo we have the quad (6,1,1,1) is equal to 3 times the difference of the quads (4,2,2,1) and (1,4,2,2). Using the table at the beginning of Section 2.5, this translates to the statement that the equation obtained from the respective substitution into the LJI of bb, a, a, a for w, x, y, z is equal to 3 times that equation obtained from the substitution of aa, b, b, a for w, x, y, z minus 3 times that equation obtained from the substitution of a, aa, b, b. S T E P 4. Generate the remaining equations to test for full rank. The con cern at this point is for those quads which have not yet been accounted for by steps 2 and 3. In other words, there may still exist substitution in stances of the LJI which have neither been used to give a relation for a monomial from N(i,j,k) nor shown to be linearly dependent on quads al ready processed. In this step all quads, relevant to the V(i, j , k) under study, which have not yet appeared in steps 2 or 3 are generated. Each such quad is considered in turn by deriving the corresponding substitution instance of the LJI. It is here that we allow for the possibility that N(i, j , k) may not be the complement of a basis. At the conclusion of this step we have in effect the upper triangular matrix of full rank similar to that of step 2 in the natural approach. S T E P 5. Diagonalize the matrix of step 4. The full rank matrix, yielded by step 4, because of the properties exhibited in Section 3 of the inverted approach, contains a large submatrix which is already diagonalized. This step is accomplished essentially by standard Gaussian elimination on the set of relations, coming from step 4, among the monomials. The result is the same as that from step 3 of the natural approach, namely, a set of relations expressing dependent monomials solely in terms of basis monomials. In the case where N(i,j, k) is actually the complement of a basis, there •will be a one-to-one correspondence between the relations yielded here and the ele ments of N(i, j , k). Each element of N(i, j , k) will then appear in exactly one relation. The "unnatural" approach employs a data structure, to be described in the
An Application of Quad
Arithmetic
233
next section, which is a realization of a "closing function". In Section 2.8, closing functions are shown to have certain valuable properties. These properties are utilized in steps 2 to 5 of the unnatural approach to further reduce the time and space requirements for the study of certain V(i,j,k). The key property is that of "closure" with respect to particular subgroups of S3, the group of all permutations on three letters; see Sections 2.6, 2.8 and 2.9.
2.5. The Data Structure: Avoidance of Symbolic Manipulation We now come to the data structure whose primary function is the represen tation of individual monomials. The nature of the representation perhaps best justifies terming our approach "unnatural". The choice of data structure is moti vated by the wish to totally avoid symbolic manipulation and its problems. The monomials are, therefore, represented by integers rather than by their natural symbolic expressions- sequences of letters and appropriately paired grouping symbols. We begin immediately with an example, taken from the data structure, in which the first 27 monomials of interest are represented (Table 1). Examination of the example suggests certain questions concerning: the well-ordering of mono mials, canonicalization, domain and range, specific uses of such a data structure, additional properties as yet not illustrated, and finally the abstract mathemat ical entity of which it is an example. In this section we shall answer these questions but not precisely in the order they occur. The data structure consists of cells, one for each monomial represented therein. Each cell contains explicitly the degree d(m) of the monomial m being represented, the degree type dt(m) of m, an integral equivalent of the first factor mf of m, an integral equivalent of the second factor m s of m, and a triple whose components reflect the status (basis or non-basis) of m. In addition, each cell contains implicitly the monomial m itself and the representation of m in the form of an integer greater than 0. Thus the example of the first 27 monomials of interest is not completely faithful to the data structure in that no explicit mention of the monomials or their integral representation is ever present in the cells. The example also fails to illustrate the triple reflecting monomial status. These cells form an arrary in which the index of a given cell is the integral value assigned to or representing the corresponding monomial m. These indices are the values g(m) for some closing function g. The monomial m itself can only be obtained by recursive use of mf and m s and by use of the terminal conditions that 1 represents a, 2 represents b, and 3 represents c. Here a, b, and c are the monomials and not the single letters. The implicit information contained in the data structure is explicitly given in the 27-monomial example to provide transparent illustrations for use in the following detailed discussion of the data structure.
Collected Works of Larry Wos
234
Table 1 m
g(m)
d(m)
dt(m)
g(mf)
g(m s )
a b c aa ba bb ca cb cc
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
1 1 1 2 2 2 2 2 2 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3
1,0,0 0,1,0 0,0,1 2,0,0 1,1,0 0,2,0 1,0,1 0,1,1 0,0,2 3,0,0 2,1,0 2,1,0 1,2,0 1,2,0 0,3,0 2,0,1 2,0,1 1,1,1 1,1,1 1,1,1 0,2,1 0,2,1 1,0,2 1,0,2 0,1,2 0,1,2 0,0,3
1 2 2 3 3 3 4 5 4 5 6 6 7 4 8 7 5 8 6 7 9 8 9 9
1 1 2 1 2 3 1 1 2 2 1 2 1 3 1 2 3 2 3 3 1 3 2 3
(aa)a (ba)a (aa)b (ba)b (bb)a
(bb)b (ca)a (aa)c (cb)a (ca)b (ba)c (cb)b (bb)c (ca)c (cc)a (cb)c (cc)b (cc)c
We begin by representing the monomials a, b, and c respectively by 1, 2, and 3. This beginning appears innocent enough but in fact already partially determines for reasons of consistency the choice of an ordering of the mono mials. Recalling that the degree d(m") of the monomial m" is the number of occurrences of letters in m", the first property of the ordering is that which requires m to be less than m' when d(m) is less than d(m'). For convenience we rewrite this property as, d(m) < d(m') implies g(m) < g(m'). Here g(m"), for a monomial m", obviously denotes the positive integer representing m", and we say g maps m" to g(m"). The second property of the ordering extends the ordering from monomials of different degrees to those of the same degree but different degree types. The
An Application of Quad
Arithmetic
235
degree type of a monomial is a triple of integers giving respectively the number of occurrences of a, b, and c therein. Let m and m' be such that d(m) = d(m'). Let dt(m) = (ij,k), and dt(m') = (i'.j'.k'). If k < k', then g(m) < g(m'). and the matter is settled. If k = k' and j < j ' , then g(m) < g(m'). This property may seem needlessly complicated but is in fact a natural extension of mapping respectively a, b, and c to 1, 2, and 3. It should also be noted that the obvious generalization of this property to cover monomials with d(m) ^ d(m') does not achieve the objective of property 1. Such a move would, for example, have monomials of type (5,0,0) placed earlier in the ordering than those of type (2,1,1). The preferred ordering more easily permits interruption and resumption of the study of the vector spaces V(i, j , k) at arbitrarily selected points. As expected, the third property of the ordering extends it to differentiate between monomials of the same degree type—monomials of degree type (i, j , k) with i > j > k. But here the rule is rather far from straightforward, for it does not apply to all types (i,j,k). The important effects of restricting its scope do not emerge until Section 2.9, which discusses efficiencies of the data structure. Assume that m and in' are both of type (i,j,k) with i > j > k. Let mf and m s denote respectively the first and second factors of m, and m'{ and m^ denote respectively those of m'. Then m = mf m s and m' = mjm^. Since multiplication is commutative, we make one further assumption to have the ordering well-defined. Assume that mf and m'f are such that g(mf) > g(m s ) and g(mf) > g(m,). When g(m s ) < g(m s ), we require g(m) < g(m'). When g(m s ) = g(m£) but g(mf) < g(mj-), we also require g(m) < g(m'). Examination of the 27-monomial example shows that the extension to all (i,j,k) of this third ordering property is already violated in type (1,2,0). The monomials (ba)b and (bb)a are respectively mapped under g to 13 and 14 which is contrary to an extension of property 3. Since their second factors are respec tively mapped to 2 and 1, it would have been necessary to map (ba)b and (bb)a respectively to 14 and 13. By choosing to retain property 3 as given (that is, not having property 3 extend to all (i,j,k)), we exchange total uniformity of the ordering for that preserving "permutation image". For example, if one takes the monomials 11 and 12 of type (2,1,0), applies the permutation ab to each, and then applies commutativity of multiplication, one obtains the monomials of type (1, 2,0) and in the desired order and respectively mapped to 13 and 14 as is the case. Summarizing, the order of the monomials whose degree type (i', j ' , k') fails to satisfy i' > j ' > k' is completely determined by the monomials whose degree type (i, j , k) does satisfy (i > j > k), where (i', j ' , k') is a permutation of (i,j,k). This last application of commutativity for "permutation image" and the proviso in the definition of property 3 that first factors be represented by larger (>) integers than second factors are both examples of canonicalization with respect to commutativity of multiplication. This observation leads naturally
236
Collected Works of Larry Wos
to the general question of canonicalization which in turn brings to mind the corresponding discussion in Sections 2.2 and 2.3. There U(i, j , k) was selected to canonicalize for commutativity of multiplication also. As one may have already suspected from aglance at the sets of type (1,1,0) and (2,1,0) in the 27-monomial example, canonicalization is immediately realized with the data structure, at least as far as commutativity of multiplication is concerned. And, of course, canonicalization of distributivity is realized just as simply by use of the data structure. To illustrate the data structure's role in automating distributivity, we present ten additional cells.
m ((ba)a)a ((aa)b)a ((aa)a)b (ba)(aa) («aa)b)a)a (((aa)a)b)a (((aa)a)a)b ((ba)a)(aa) ((aa)b)(aa) ((aa)a)(ba)
g(m)
d(m)
dt(m)
g(mf)
g(m s )
30 31 32 33 105 106 107 108 109 110
4 4 4 4 5 5 5 5 5 5
3,1,0 3,1,0 3,1,0 3,1,0 4,1,0 4,1,0 4,1,0 4,1,0 4,1,0 4,1,0
11 12 10 5 31 32 28 11 12 10
1 1 2 4 1 1 2 4 4 5
Monomial Status coef. ptr. length-1
2 0 0 1 0 0 0 1 1 1
3 0 0 2 0 0 0 24 25 28
1 0 0 0 0 0 0 0 2 0
The first point to be made is that these monomials are the full sets of types (3,1,0) and (4,1,0) that are to be represented as integers. Contained in this remark is the implication that additional canonicalization is taking place, that for distributivity. To aid understanding here, we make the second point, namely, bases have already been chosen in both V(3,l,0) and V ( 4 , l , 0 ) . The choice in V(3,l,0) immediately restricts the possible choices in V(4,1,0), when the unnat ural approach is employed, because of the manner in which the data structure handles distributivity. The rule for canonicalization of distributivity is: a monomial m = irifms is mapped to a positive integer if and only if both mf and m s are basis monomials in their respective subspaces. This rule is implemented in the data structure with the convention that, a zero occurs in the column labeled coefficient if and only if the correspond ing monomial is a basis element. Thus, in this example, ((ba)a)a and (ba)(aa) are not basis monomials while ((aa)b)a and ((aa)a)b are. Then we have, with the canonicalization rule for distributivity, the monomials (((ba)a)a)a and ((ba(aa))a are not represented in type (4,1,0) and so, of course, are not eli gible for consideration in the search for the basis of V ( 4 , l , 0 ) . On the other
An Application of Quad
Arithmetic
237
hand, the monomials (((aa)b)a)a and (((aa)a)b)a must be mapped and are, therefore, eligible. In general, the representative for a monomial is chosen by selecting the next available integer. We can now answer the question of domain and range for g. The domain is a proper subset of the monomials in the free Jordan ring on 3 letters and is equal to the union of subsets denoted by R(i, j , k). The R(i, j , k) are denned iteratively by the following. Let R ( l , 0,0) consist of the single monomial, a, R(0,1,0) con sist of b, and R(0,0,1) consist of c. Let g respectively map a, b, and c to 1, 2, and 3. Then R(i, j , k) with i + j + k > l is the set of monomials m = mfm s such that 1) both mf and m s are basis monomials in their respective subspaces, and 2) g(m f ) > g(m s ). The range of g is clearly the positive integers. If the study being undertaken is that of all V(i,j,k) with 1 < i+j+k < p for some positive integer p, then the R(i,j,k) are generated and considered in the order dictated by the three ordering properties. Bases are chosen for i+j+k > 4 by employment of the un natural (inverted) approach. Within the restrictions commensurate with both canonicalization for commutativity and for distributivity, the well-ordered sub set of monomials is mapped into the positive integers by choosing the earliest available integer. The mapping is one-to-one. The domain and range of g comprise the implicit information contained in the data structure and discussed in the definition thereof. There is, however, explicit information therein which enables one, by iteration, to correctly decide which monomials will be in the domain of g. Recall that a 0 in the coefficient column states that the corresponding monomial is a basis element. The domain of g, therefore, is obtained by taking the union of Si and S2, where Si consists of all monomials m = m'm" with m' and m" having a zero in the coefficient field and S2 consists, of course, of the monomials a, b, and c. On the other hand, if the coefficient field of some monomial m contains a nonzero integer u, we know that m has a coefficient of u in the relation which expresses m solely in terms of basis monomials. If such is the case, and if dt(m) = (ij,k) with i > j > k, the pointer field contains the relative address of the equation for m, where the equations are retained in an array, and the length-1 field gives 1 less than the number of basis monomials with nonzero coefficients in the equation for m. The pointer field has a quite different interpretation for monomials with de gree type (i', j ' , k') which fails to satisfy i' > j ' > k'. If m' is such a monomial, its pointer field will contain the value — g(m) for that monomial m with, af ter canonicalization with respect to commutativity, m' = t(m), where t is the appropriate permutation on 3 letters and dt(m) = (i,j,k) with i > j > k. For example, R(3,l,2) contains the monomial m' = ((cc)a)((aa)b). If the permutation be is applied to m', one obtains m" = ((bb)a)((aa)c), which is not admissible for the domain g since g(m") is strictly less than g(m"). However,
238
Collected Works of Larry Wos
there does exist a monomial m in the domain of g such that m and m" are provably equal by simply applying commutativity of multiplication. The mono mial m is, of course, ((aa)c)((bb)a) and is the desired m with t{m) = m' (after canonicalization with respect to commutativity). The monomial m is mapped under g to 543, and so the pointer field of m' contains —543. Therefore, the data structure through the use of the pointers permits a most valuable move, namely, equations are retained for dependent monomials m if and only if dt(m) = (i j , k ) with i > j > k. As will be discussed in Section 2.9.6, the equation expressing any dependent monomial m' in terms of basis monomials is readily and inexpensively obtained even when dt(m') fails to satisfy i' > j ' > k'. The mechanism which makes the obtainment so inexpensive is based on the permutation image property—that property which was chosen in preference to the extension of the third ordering property to cover all triples (i, j , k). Before turning to the last of the questions posed for this section, we dis cuss certain conventions which stem from the foregoing material and which are useful throughout the remainder of the paper. First, there is a very strong em phasis and reliance on the sets R(i,j,k) with i > j > k. These will be called "canonical" sets (or "canonical" subsets), and their degree types will be termed "canonical". Second, when referring to some monomial m, there will usually be present the tacit assumption that m is a member of some R(i,j,k), not nec essarily canonical. In other words, we are almost exclusively concerned with monomials which obey the rules of canonicalization for both commutativity of multiplication and of distributivity. Thus, if we say that m' = t(m) for some permutation t, we assume that both m' and m are recursively products of basis monomials and that g(m[) > g(m,) and g(mf) > g(m s ). The only exceptions are the monomials a, b, and c and they present no problems. Third, in the discussion of pointers for noncanonical R(i,j,k), an ambiguity exists for the choice of t. If, for example, m' is such that dt(m') =(1,2,1), there are two pos sible choices of t, the permutations ab and abc. When such ambiguity occurs, we always choose the transposition. An ambiguity can only occur between a transposition and a 3-cycle and only when at least two of i',j', k' are equal. Fourth, and last, we often identify a monomial m with its representation g(m) and will, for example, refer to the monomial 30 to mean the monomial ((ba)a)a. Here also there is the possibility of ambiguity, for the choice of bases, cou pled with the properties of closing functions, completely determines the do main and range of g. More precisely, two choices of bases correspond to two functions g. This remark will be amplified in the next section, Section 2.6. At any rate, we will avoid ambiguity by writing, for example, R(i,j,k) (gi) where necessary. Finally, we come to the last of the questions for this section—of what math ematical entity is the data structure a realization? The answer is that the data structure is the realization of some "closing function" g, which will be infor mally discussed in Section 2.6. The entries therein will vary depending on the choice of g. However, the number of cells dedicated to the type (i,j,k), for some
An Application of Quad
Arithmetic
239
given (i,j,k), is a constant—is independent of the choice of closing function. This number is a function solely of the dimension of each of certain subspaces occuring earlier in the ordering determined by properties 1 and 2. Put differ ently, the members of certain R(i,j,k) are function of the choice of the closing function, but their number is not. The R(i,j,k), and hence the data structure, have certain interesting and valuable properties still to come. The discussion in the next section will provide the background for the emergence in the form of lemmas and corollaries in Section 2.8. An alternate and formal treatment of the material in Sections 2.6 and 2.8 is found in Section 4.
2.6. Closing Functions: An Informal Presentation In this section we informally define "closing functions" in a piecemeal fashion. The formal definition is given in Section 4. As the properties are encountered, the elementary consequences thereof are discussed here also. A closing function is a one-to-one mapping from a subset of monomials in the free Jordan ring K on 3 letters to the positive integers. Briefly, closing functions choose a set of monomials, well-order that set, and canonicalize the members of the set with respect to both commutativity of multiplication and distributivity. Such a function, denoted by g, by definition maps the monomials a, b, and c re spectively to 1, 2, and 3. In addition to the exclusion of sums of monomials from the domain of closing functions, a large fraction of the individual monomials is excluded from the domain of g. The exclusion of these individual monomials is the result of two properties. First of all, if m is a monomial of degree greater than or equal to 2 such that g is undefined on at least one of the two factors of m, then m is excluded from the domain of g. Even when g is defined on both factors mf and m s , g will be undefined on their product m if g(mf) < g(m s ). As a consequence, one can easily prove by induction on the degree of the two monomials the following: If g is defined on m and m', and if m' can be obtained from m by some number of applications of commutativity of multiplication, then m and m' are precisely identical. The second property for the exclusion of monomials can be thought of as designed with the: following objective in mind. The domain of a closing function must not, for example, contain the monomials m = (((aa)a)a)b and m' = ((((bb)b)b)b)((aa)(aa)). The point of this exclusion is that mf and m, are linearly dependent monomials, from a simple application of the LJI, and hence no basis in the type (4,0,0) exists containing both mf and m,. We there fore define B(i, j , k) (g), for a given (i, j , k), to be the set of monomials m in the domain of g such that dt(m) = (i,j,k) and such that there exists an m' in the domain of g with m and m f identical as monomials or an m" therein with m and m" identical. For a function g to be a closing function, al] B(i, j , k) (g) must be bases in their respective V(i, j , k). We also require that, if g is defined on m, g is defined on both mf and m s . We further require of g that, if m and
240
Collected Works of Larry Wos
m' are respectively members of B(i, j , k) and B(i', j ' , k') with g(m) > g(m'), g be defined on their product mm'. The latter requirement is needed to guarantee that all R(i,j, k) (g) are non-empty, where R(i,j, k) (g) is the set of monomials m in the domain of g with dt(m) = (i,j,k). Each V(i,j,k), therefore, is rep resented in the domain of g by a subset containing a basis B(i,j,k) for that V(i,j,k). This discussion of the B(i,j,k) brings us back to the remark in Section 2.5 concerning the possible ambiguity of identifying a monomial with its represen tation, its image under g. To discuss both the question of ambiguity and the determination of the image, we require a thorough understanding of the addi tional axioms, those of ordering, of closing functions. These axioms in conjunc tion with those already given will show that: There exist monomials m, through degree 4, such that g is defined on m for all closing functions g, and such that gi(m) = g2(m) for any two closing functions gi and g2; there exist monomials m and closing functions gi and g2 such that m is in the domain of gi but not in the domain of g2; and, there exist monomials m and closing functions gi and g2 such that m is in the domain of both gi and g2 but gi(m) ^ g2(m). The first of these three results is, of course, a direct consequence of the fact that the LJI does not apply until degree 4. The first ordering axiom for closing functions g requires g(m) < g(m') when d(m) < d(m')- Where dt(m) = (i,j,k) and dt(m') = (i',j',k') with d(m) = d(m'), the second requires g(m) < g(m') when either k < k' or k = k' and j < j ' . Where dt(m) = dt(m') = (i, j , k) with i > j > k, the third requires g(m) < g(m') when either g(m 8 ) < g(m£) or g(m s ) = g(m 8 ) with g(m f ) < g(m^). The fourth and last ordering axiom for closing functions must be discussed in greater detail. This property is the "permutation image" property of Section 2.5. It states that the mapping of monomials in noncanonical sets to the positive integers is an induced mapping—completely determined by the mapping in the appropriate canonical set. To elaborate, let m and m' be in R(i,j,k) with i > j > k and be such that g(m) < g(m'). Let t be a permutation, if such exists, on 3 letters such that the degree type of t(m) is noncanonical. If t t and t2 are two such with ti ^ t2, and if the degree type of ti(m) equals that of t2(m), let t be the transposition in the set consisting of t i and t2- (One can very quickly prove that, in such a case, exactly one of ti and t2 is a transposition.) If such a t exists, this fourth axiom first requires the existence of a monomial m" in the domain of g such that t(m) is obtainable from m " by simply applying commutativity of multiplication some number of times. Similarly, therefore,there must exist an m " ' for m'. The axiom then requires g(m") < g ( m " ' ) . We choose for convenience to refer to such m" and m " ' as t(m) and t(m') for a correctly chosen t and thereby tacitly assume canonicalization. The fourth ordering axiom, therefore, permits the existence of monomials t(m) and t(m') in noncanonical R(i,j,k)(g) such that g(t(m)) < g(t(m')) even with g(t(m) 8 ) > g(t(m') s ). Such monomials t(m) must, of course, satisfy the two exclusion prop erties for domains of closing functions. We therefore have g(t(m)f) > g(t(m) s )
An Application of Quad
Arithmetic
241
and t(m)f and t(m) s are members of some B(i, j , k) (g). Thus, if g(m!) < g(m 2 ) < . . . < g(m p ) are the images under some closing function g for mi,m2, • • .,rn p of R(i, j , k) with i > j > k, then g(t(mi)) < g(t(m 2 )) < . . . < g(t(m p })), where t(m u ), for u = 1, 2 , . . . , p, are in a noncanonical set and t is a permutation on 3 letters chosen by the rule which prefers transpositions. Before turning to the consequences of the axioms, we present one last axiom. For a function g to be a closing function, there must exist for any positive integer p a monomial m such that g(m) = p. We are now ready to discuss the elementary consequences of the ordering axioms. The surprising ones are left to Section 2.8 with the proofs in Section 4. Earlier in this section we mentioned a set of monomials on which all closing functions are defined. That set includes, among others, all monomials listed in the 27-monomial example found at the beginning of Section 2.5. The remaining members are found in the union of R(i,j,k) with i + j + k = 4. In fact all closing functions are identical in their domain and range through degree 4. Although Section 2.7 contains a number of illustrations directly relevant to a proof of this statement, we shall touch briefly on the essence of the proof here. By definition, all closing functions map a, b, and c to 1, 2, and 3. The monomials of degree 2 must come next, and first among those must come the one of type (2,0,0), namely, aa. The image of aa must be 4 by the last given axiom. Next for consideration, because of the ordering axioms, are those of type (1,1,0). But ba must be mapped and ab must not by the exclusion rules. The permutation image axiom of ordering first has a meaningful effect at type (1,2,0). Skipping ahead, one finds that the choice of closing function g has no effect through degree 4 because the linearized Jordan identity does not apply until degree 4. At degree 5, however, the choice matters, for there exist closing functions gi and g2 with B(4,0,0)(gi) ^ B(4,0,0)(g 2 ), for example. (We should be more pedantic perhaps and say initial segments of closing functions, for there is a certain relevant question of existence to be discussed in Section 6.) Just choose ((aa)a)a in one basis, and (aa)(aa) in the other. Since the dimension of V(4,0,0) is 1, (((aa)a)a)b will be in the domain of gi and not in the domain of g2, while ((aa)(aa))b behaves conversely. The monomials will both be mapped to 103 respectively by gi and g 2 . As a different example, there exist closing functions gi and g 2 with gi(m) = 105 and g 2 (m) = 106, where m = (((aa)b)a)a. The former occurs when mono mials 31 and 32 of the second table of Section 2.5 are chosen as the basis in R(3,l,0), and the latter occurs when 30 and 31 are chosen as basis. The choice of the particular closing function g has a marked effect on the magnitude of the coefficients which occur in the equations expressing depen dencies in the various R(i,j,k). From the computational point of view, a poor choice of g, in fact, may prevent one from finding a basis for a given R(i, j , k).
242
Collected Works of Larry Wos
2.7. Detailed Illustrations of Closing Functions The sole purpose of this section is to provide greater familiarity with closing functions. For the properties of Section 2.6, and hence in effect for those of Section 2.5, we employ the notation p 0 , p i , . . . , pi- The formally defined prop erties po, p i , . . . , P7 are given in Section 4. By PQ we denote the axiom that closing functions map a, b, and c to 1, 2, and 3; pi to p 3 are the ordering axioms; p 4 is in effect the requirement that g(mf) > g(m s ); p 5 is the requirement that B(i,j,k)(g) be basis, that g be defined on each product of two basis monomials, and that g defined on a monomial implies that g is defined on its factors; p 6 is the permutation image axiom; and pi is the requirement that g _ 1 ( p ) exist. Consider the following lexically ordered set of monomials. mi = a ni2 = b 1113 = aa m5 = ba ni6 = bb 017 = (aa)a ms = a(aa) 1119 = (aa)b mn=(ba)a mi2=((aa)a)a mi3=(aa)(aa) m15=((aa)b)a mi6=((ab)a)a mi7=((ba)a)a
1114 = ab mio=(ab)a mi4=((aa)a)b m i 8 = (ba)(aa).
By the numbered steps given here, we show how the domain is determined and how the monomials are ordered. The monomials mj to mis are considered in order. 1) By PQ, g(mi) = 1 and g(m 2 ) = 2. 2) By p 4 and p£, g is defined on 1113. 3) Therefore, since a and b are basis monomials, p'& suggests m 4 for the domain of g. But p 4 excludes it. 4) On the other hand, p 4 s permits g to be defined on ms, and p'5 requires it. Commutativity yields m 4 from ms, so the equivalence class under commutativity of which m 4 is a member is represented in g. But p'5 forces many such classes to be totally unrepresented in that it requires elements to be recursively products of basis elements. Therefore, for a particular choice of g, there will exist equivalences under commutativity which are unrepresented in the domain of g. 5) By pi, g(m 3 ) < g(m 5 ). 6) By p 4 and p'5, g is defined on m 6 , and by p 2 , g(m 5 ) < g(m 6 ). 7) Since it can be shown that g(m3) = 4, p 4 and p 5 will cause g to be defined on m7, but p 4 excludes mg. By p i , g(me) < g(m7). 8) By p 4 , P5, and pi, g is defined on mg with g(m7) < g(mg). 9) Since mio has m 4 as its first factor, and since 3) excluded m 4 , p 4 excludes mio10) By p 4 and p'5> g is defined on ran through m 1 5 . By p'3, g ( m n ) < g(m 9 ) because the second factor of m n is mapped to an integer smaller than that for the second factor of mg.
An Application of Quad
Arithmetic
243
11) While p\ gives g(mg) < g(mi2), it is p 3 which shows that g(mi2) < g(mi3) as in 10). Then p'2 gives g(mi 3 ) < g(mi 4 ) and g(mi 3 ) < g(mi 5 ), but g(mi 5 ) < g(m 14 ) from p 3 as in 10). 12) Since mio is the first factor of mi6, and since 9) excluded mio, g is not defined on mi613) We can apply 2), 4), and 10) with p 4 and P5 to establish that g is defined on mi7 and m 18 . By p 3 , g(mi 7 ) < g(mi 8 ) and g(mi 4 ) < g(mi 8 ). We use p 2 to show g(mi 3 ) < g(m 1 7 ). It is p 3 that gives g(m 1 7 ) < g(m 1 5 ), but using the argument in 10) on first instead of second factors. To find the specific integers which are the images under g, it would be nec essary to apply in effect p 7 to continually choose the next available integer. The sets must be considered in the order dictated by p[ and p 2 . Within each set, the monomials must be filtered with p 4 and P5 and ordered with p 3 and p 6 , depending on whether the set is canonical or noncanonical.
2.8. Closure of Bases In this section we are at last ready for the interesting and important properties of closing functions which were alluded to earlier. Without these properties, the results for the interesting subspaces of the free Jordan ring TZ on 3 letters would not have been obtained. The key property to be studied is that of "closed basis". Before giving the definition, we must introduce additional concepts. Let g be some given closing function. Recall that R(i,j,k)(g) is the set of monomials m in 72. on which g is define and for which dt(m)=(i, j , k). Now defined T(i, j , k) to be the set of permutations t on 3 letters such that, for m with dt(m) = (i, j , k), dt(t(m)) = (i,j,k). For example, T(2,1,1) and T(5,2,2) are equal and consist of the transposi tion be and the identity; T(3,2,1) consists of the identity alone; and T(2,2,2) equals S3, the group of permutations on 3 letters. All T(i,j,k) are subgroups of S3. We then define a basis B(i,j,k)(g) or R(i,j,k)(g) to be closed when, for all t in T(i,j,k), the monomial m is a member of B(i,j,k) (g) if and only if (the canonicalization with respect to commutativity of) t(m) is a member of B(i, j , k)(g). We imply here, of course, that B(i, j , k) (g) is a subset of R(i, j , k)(g). We often omit the notation (g) when no confusion arises. The parenthetical qualifier is present for correctness of definition, but it shall be dropped from now on. It recalls the fact that canonicalization of monomials is assumed but does not connote that the closing function g has an effect on the choice of canonicalized monomial. In fact one can easily show, because of the ordering axioms, that only one representative under commutativity of multipli cation can ever be mapped regardless of the closing function under considera tion. The B(i, j , k) of the definition turn out to be, of course, the B(i, j , k) (g) of Section 2.6. There they were used to canonicalize with respect to distributivity. We now return to the main discussion.
Collected Works of Larry Wos
244
The first observation to be made is that, from the very general viewpoint, not all bases are closed, even for the early subspaces. In fact, even if sums of monomials are barred from consideration, there exists for V(2,2,0) a basis which is not closed. Let B'(2,2,0) be the basis consisting of mi = ((bb)a)a
m 2 = ((ba)b)a
m 3 = (bb)(aa)
rrui = (ba)(ba).
(This basis will prove useful later in this section.) The only permutation to consider is ab. Although ab applied to m3 and applied to 1114 present no essential problem since canonicalization with respect to commutativity yields rci3 and 1114 themselves, ab of mi and ab of m 2 cannot be helped by such canonicalization. In other words, there do not exist in B'(2,2,0) monomials which are commutative variants of either ab of mi or ab of m 2 . A more interesting example is that of partial closure. Even with canonical ization for commutativity, there exist examples of individual monomial bases for V(2,2,2) which are closed under ab but not under all of S3 = T(2,2,2). This brings us to an obvious but useful remark. Remark 1. If a basis is closed under at least two different transpositions, then it is closed under all of S3. We come now to the first major result, Lemma 1, for closing functions. From this lemma we shall see that one has less freedom in constructing a (partial) realization of a closing function than is apparent. Put another way, the sets of ordered pairs, monomials each with its integral image, which correspond to the domain-range of some closing function are fewer than one might expect. L e m m a 1. Let g be any closing function. Then R(i,j,k) (g) is not empty for all (i,j,k) with i+j+k > 0. More importantly, if R(i,j,k), for some (i,j,k), is such that i > j > k, and if B(i, j , k) (g) is that set defined in Section 4 by ps(g), then B(i, j , k) (g) is closed and a basis for R(i, j , k) (g). This lemma shows that an attack on the problem of finding bases for the subspaces of 1Z. which employs a data structure of the type described in Sec tion 2.5 is subject to the powerful constraint of closure. Closed bases must be chosen at each step as one considers the subproblems of the V(i, j , k) in the order given in Section 2.5. Failure to do so prevents the continuation of the partially developed structure in a manner consistent with the desire of realizing some closing function. To see how the continuation is prevented and glimpse the disastrous conse quences, assume that the non-closed basis B'(2,2,0) cited earlier in this section is chosen as the basis in type (2,2,0). By the distributivity rule in Section 2.5, the monomial m i b must be assigned a positive integer. But by the permutation im age property— by using the pointer field in the data structure for m i b of degree
An Application of Quad
Arithmetic
245
type (2,3,0)—we would have to find the monomial equal to ab applied to mib. But this is just ab(mi)a, which implies by the distributivity rule that ab(mi) is a basis monomial. In fact, as was pointed out, no commutative variant of ab(mi) is in B'(2,2,0). One might conjecture that a reasonable countermove would be to adjoin the needed missing monomials to the domain of definition—have present in the data structure, for example, ab(mi)a. Unfortunately, by the time the subproblem of V(3,3,2) comes up, the number of such forced adjunctions prop agated into the (3,3,2) space is roughly the number which are naturally found there as the result of the use of closing functions. Resuming the discussion of closing function properties and their consequences, we have Lemma 2 which shows how well noncanonical sets reflect canonical ones. Lemma 2. Let g be any closing function, and R(i, j , k)(g) for some (i, j , k) be such that i > j > k. Iiet B(i, j , k)(g) be the basis of R(i, j , k)(g). If t is in S3 with t(R(i, j , k)(g)) noncanonical and equal to R(i', j ' , k')(g), then the canonicalization with respect to commutativity of t(B(i, j , k) (g)) is a basis of R(i', j ' , k') (g) and in fact equals B(i', j ' , k')(g). We then have the expected lemma, Lemma 3, concerning T(i, j , k). It states that in effect T(i,j,k) maps R(i,j,k) to itself. Lemma 3. Let g be any closing function, and consider R(i,j,k,)(g) for some (i,j,k). If m is in R(i,j,k)(g) and t is a permutation on 3 letters such that t(m) and m have the same degree type, then the canonicalization with respect to commutativity of t(m) is a member of R(i, j , k)(g). Now we have the result, Corollary 1, which couples Lemmas 1 and 2 and thereby shows that closing functions, and hence the data structure, behave uniformly for all (i, j , k). Corollary 1. all(i,j,k).
The bases B(i, j , k)(g) are closed for all closing functions g and
Thus one must choose closed bases for the noncanonical sets if one hopes to have a data structure which is in effect a closing function and, therefore, avoids the consideration of many unnecessary monomials. Finally, we have the closure result for non-bases—a result which is important in the application of the inverted approach. Corollary 2. The set of non-basis monomials in R(i,j,k)(g) is closed for all (i,j,k) and all closing functions g.
246
Collected Works of Larry Wos
The lemmas and corollaries of this section establish properties for closing functions whose absence would have prevented the completion of the study upon which this paper is based. In this study we employ the initial segment through degree 9 of a closing function. We have in fact made other studies through degree 9 with a number of distinct closing functions (that is, the corresponding initial segment) and also studies based on non-closed bases which are, of course, equivalent to partial abandonment of closing functions. The employment, for example, of B'(2,2,0) was quite unsatisfactory. The efficiencies resulting from the use of closing functions are quite startling and occur in a number of areas, which takes us to the next section.
2.9. Efficiencies of the Data Structure Up to this point, we have described many important properties of the data structure. Now in this section, we describe how these properties lead to effi cient processes for solving the basis and dimension problem for each subspace V(i, j , k) of TZ. Recall that, although the study is of the free Jordan ring 72. over the rationals, all computation proceeds with integral values. For example, all coefficients of dependent monomials and equations are retained as integers. 2.9.1. Monomial R e p r e s e n t a t i o n Each monomial m is represented in the data structure implicitly as the integer g(m) rather than as a letter string with grouping symbols where g(m) is the index of the cell in the data structure characterizing m. This representation has two major advantges: first, it saves storage space as the cell for each monomial contains two fixed length integers rather than a variable length string consisting of n letters and 2(n — 2) grouping symbols for a monomial of degree n; second, the monomials are well-ordered by their integer representation thus greatly fa cilitating monomial comparisons used throughout the process of, for example, canonicalization for commutativity. 2.9.2. Canonicalization of M o n o m i a l s The data structure permits us to work with the smaller subsets R(i, j , k) rather than the full monomial subsets S(i,j,k), thus achieving a substantial saving in space. For example, the subset S(5,l,l) contains 5544 monomials whereas the subset R(5,l,l) in which all the commutative and distributive variants are re moved contains only 55 monomials. By noting that the corresponding reduction for the degree type (4,1,1) is from 1260 to 34 monomials, the import of deal ing with R(i,j,k) instead of S(i,j,k) becomes evident. Indeed, fewer monomials result in a marked saving in time since the time required to determine the di mension of the spaces is approximately proportional to the square of the number
An Application of Quad
Arithmetic
247
of monomials present. The next major advantage that the data structure provides is to efficiently avoid the generation of commutative and distributive variants of monomials. In fact, such variants do not exist in our representation, and thus there is no price paid to work with the smaller subsets R(i,j,k). This is accomplished in two ways and is best illustrated by an example of generating an instance of the LJI in the subset R(4,l,0). Consider the subset R(4,l,0) and the instance of the LJI where a is sub stituted for w, y, and z, and ba for x. From Section 2.5, we see that our data structure assigns 1 and 5 respectively for the monomials a and ba, and in terms of these integers, the LJI becomes (1, 5,1,1): ( ( 1 . 1 ) . 1). 5 + ((5 . 1 ) . 1). 1 + ((5 . 1 ) . 1). 1 = ( 1 . 5 ) . (1.1) + ( 1 . 1 ) . ( 5 . 1 ) + ( 1 . 1 ) . (5 .1) where . represents product in the ring. The goal is to express the equation in terms of monomials in R(4,l,0). First, commutative variants are never formed since at each ring product, the first factor of each product is required to be an integer not less than the integer representing the second factor. Hence, the factor 1. 5 in the fourth term of (1,5,1,1) is changed to 5 .1 before beginning the search for its integer representation in the table given in Section 2.5. Similarly, the first and second factors of the fifth term ( 1 . 1 ) . (5 .1) are 4 and 11 respectively, but their product is determined by searching for 11.4, instead of 4.11, in the second table of Section 2.5. Second, the distributive variants are never formed, since each product representing a dependent monomial is replaced by its expression in terms of basis monomials. This is illustrated by the second and third terms ( ( 5 . 1 ) . 1). 1 of (1,5,1,1). Here, the first table in Section 2.5 shows 5 . 1 is 11, and the second table of Section 2.5 shows 11.1 is 30. By consulting the second table of Section 2.5, monomial 30 is seen to be dependent since its coefficient field is nonzero. The expansion of 30 in terms of basis monomials 31 and 32 in R(3,l,0) is 2(30) = 3(31)-(32), where the integers 2 and 3 preceding monomials 30 and 31 are elements of the ring of coefficients and not images under g of b and c respectively. Thus, in place of the two monomials ((5 . 1 ) . 1). 1 we have the expression 3(31.1)-(32.1). Consequently, in this fashion, the distributive variant (30.1) is never formed. Summarizing, the avoidance of commutative variants is accomplished simply by integer comparison, and that for distributivity is accomplished by flag-testing coupled with replacement of single monomials by monomial expressions. The variants are never formed thus obviating the need for search processes to discard them.
248
Collected Works of Larry Wos
2.9.3. Canonicalization in t h e Selection of Instances of t h e LJI In a similar fashion to the canonicalization of monomials, the data structure is instrumental in providing efficient techniques for the canonicalization in the selections of instances of the LJI. This canonicalization circumvents two kinds of unnecessary duplication of equations resulting from instances of the LJI; first, that duplication caused by the symmetry in x, y, and z of the LJI; and second, that duplication caused by substitution of non-basis monomials for w, x, y, and z in the LJI. This symmetry in the LJI produces equational duplication in the following fashion. If given any assignment, say qi, to w and any three values CJ2, q3, q.j, the same equation is generated for all assignments of q2, q3, and q4 to x, y, and z. This can readily be proven by application of commutativity of multiplication and addition to the terms of the LJI. Since the monomials are well-ordered by the data structure, the duplicate equations are easily avoided by insisting that the integer representations of the assignments to x, y, and z form a nonincreasing sequence, that is, x > y > z. This dispenses with the first kind of duplication. The second kind of duplication is not simply that which occurs in identical equations. Because the LJI is linear in each of its arguments w, x, y, and z, assignments of non-basis monomials to any of w, x, y, or z will produce equations which are just linear combinations of those equations obtained from instances of the LJI in which only basis monomials are assigned to w, x, y, and z. Hence, from the point of view of equation manipulation, the equations generated from nonbasis monomial substitution duplicate information about monomial dependency in the Jordan ring—information already available from using basis monomial substitution. Again, using the data structure, we can readily prevent duplicates from being generated by insisting that only basis monomials be assigned to w, x, y, and z. Therefore, for any R(i,j,k), we are only concerned with sets of four values (qii 12) q3i q-Oi called quads. Furthermore, we are only interested in quads that are termed canonical, that is, q2 > q3 > q4 and q i , q2, q3, q4 are images of basis monomials. 2.9.4. Generation of all Quads, Canonical and Relevant t o a G i v e n R(i,j,k) The above two canonicalizations and the data structure now provide an efficient process for generating the assignments to w, x, y, and z for instances of the LJI relevant to a specific subset R(i,j,k). An instance of the LJI is relevant to R(i,j,k) if and only if the coordinatewise sum of the degree types of the assignments to w, x, y, and z is (i,j,k). The procedure for selecting the quads 9. = (cli)Ci2)q3>cJ4) which are both canonical and relevant to R(i,j,k), for a given (i,j,k), is as follows.
An Application of Quad
Arithmetic
249
Select the largest value in the data structure whose degree type is coordinatewise less than or equal to (i, j , k), whose coefficient field is zero, and whose degree is i+j+k—3. A zero in the coefficient field states that the value corresponds to a basis monomial. The requirement that the degree equals i + j + k - 3 leaves room for the three remaining values to be chosen. Assign the selected values to qi. For q2, choose the largest possible value such that its degree type plus that of qi is coordinatewise less than or equal to (i,j,k), such that the coefficient field is zero, and such that the degree of the chosen Cj2 plus that of the chosen qi leaves room for the selection of both q3 and q,». Thus, i+j+k-d(qi)—d(q2) > 2. Similarly, select the largest possible q3 but with the added constraint q3 be less than or equal to q2, and then select the largest possible q4 but with the constraint that q4 is less than or equal to q3. At this point a quad q has been found which is both relevant to (i,j,k) and canonical. Additional quads to be retained are found by keeping the values for qi, q2, and q3, but finding the next smaller value for q4 other than that just utilized. The "new" q4 must, of course, satisfy the three requirements given above. One finds all possible values for q4 in this way which combine with the given qi, q2, and q3- Then one replaces q3 by the next smallest appropriate value for q3, and resumes the finding of all appropriate values for q4. When the available values for q3 are exhausted, one proceeds in a similar fashion with q2- Finally, one chooses a "new" and smaller qi, and applies the procedure just given starting with a "new" q 2 . In the procedure just given, extensive use is made of degree type field, the coefficient field, and the well-ordering of the monomials. In this manner, the data structure provides a very efficient method for selecting the relevant and canonical quads for given R(i, j , k). The set of instances of the LJI which corre spond to such a selected set of quads contains all of the information required to determine both the basis of R(i, j , k) and the corresponding dependency relations therein. At this point, we give a simple example of this algorithm for the subset R(2,2,0). Clearly, the largest value admissible for w is the largest degree 1 vari able, whose degree type is coordinatewise less than or equal to (2,2,0), namely 2, which is the image of b. This is because monomials of degree 2 or larger do not leave room for assignments to x, y, and z, and because the assignment of 3 = g(c) is clearly inadmissible since the degree type of c is (0,0,1). Since the algorithm requires q2 > q3 > q4, the assignment of 2 to w has only the single completion, that which assigns 2, 1, 1 to x, y, z. In other words, once b is assigned to w, the only assignment to x, y, and z consistent with the de mands of being canonical and being relevant is that of b, a, a. The next, and last, choice for w is 1. This choice can also be completed to a canonical quad relevant to R(2,2,0) in only one way, namely, by assigning 2, 1, and 1 to x, y, and z. Note that as in the canonicalization of the monomials, the duplicate variants of the instances of the LJI are never generated and hence expensive computa-
250
tional sifting processes are not required equations.
Collected Works of Larry Wos
to filter out the unnecessary
2.9.5. Monomial Searching Inherent in the generation of the LJI from the specific composite assignment qi, q2, q3i and q4 to w, x, y, and z is the need to search in the data structure for the integer representations for products, such as q4q2. In general, this would be a time consuming process but for the fact that the data structure has certain ordering properties, especially those which order monomials within given degree types (i,j,k). Recall that, if (i,j,k) is canonical, i > j > k, the ordering of the monomials is determined first by the value assigned to the second factor, and second, within equal second factors, by the value assigned to the first factor. On the other hand, if (i, j , k) is noncanonical, the ordering is completely determined by the permutation image property of Section 2.5, which forces the order to depend completely on that of the appropriate canonical set. The search for the product q4q2, where q4 and q2 are basis monomials in their respective spaces, proceeds as follows. First, because of the requirement that the first factor be greater than or equal to the second factor, it may be necessary to replace q4q2 by q2q4- Now assume q4 > q2- Next the degree types of q2 and q4 are added coordinatewise to determine the degree type of the product. If the degree type of the product is canonical, then a search process which is faster than linear is used to find q4q2- This search takes advantage of the fact that the monomials in canonical sets are ordered first by their second factor and for equal second factors, then by their first factor. We use the Fibonacci search [3] to find the product q4q2The first and second factors of monomials in noncanonical sets are not or dered in this simple manner which thus requires a more complicated search pro cedure. Here, we take advantage of the permutation image property that gives the ordering of monomials in noncanonical sets in terms of the corresponding canonical set. Using the degree type field of the product q4q2, the correct trans formation t in S3 that maps the corresponding canonical set to the noncanonical set containing q4q2 is determined. As noted in Section 2.5, when there is a choice of transformations, the transposition is taken in preference to the three-cycle. Next, using the degree type fields of the data structure and certain transfor mation tables for basis monomials in canonical sets, the factors q4 and q2 are mapped by t _ 1 without the need for a search of the type just described. Then a search as given above is made for the product t~ l (q4)t _ 1 (q2) in the canonical set. Suppose this product is found to be the p-th monomial in the canonical set. Then the product q4q2 is the p-th monomial in the noncanonical set. Element searches are an integral part of any computational approach to solv ing the basis problem. For instance, collection of like terms from the substitution into the LJI for w, x, y, and z requires a search procedure to identify identical terms. Our data structure provides a well-ordering to the monomials so that
An Application of Quad
Arithmetic
251
search processes, faster than linear, can be readily implemented. 2.9.6. G e n e r a t i o n of E q u a t i o n s The data structure is instrumental in several ways in providing efficient pro cedures for generating equations. First, it provides a natural indexing for the monomials. When an instance of the linearized Jordan identity is formed, the coefficients of a particular monomial in an equation can be saved and coeffi cients of like terms can be collected just by using the g-image of the monomial as an index. This rapid indexing procedure is particularly important as often hundreds of monomials can be generated from one term in the LJI. Secondly, the data structure is so designed that equations for dependent monomials in a noncanonical set are efficiently derived from the equations for the corresponding dependent monomials in the canonical set, hence requiring that only the equations for the dependent monomials in the canonical sets be retained. To illustrate this procedure, suppose the equation for a monomial m' in a noncanonical set is desired and m' is the permutation image of m in the corresponding canonical set. (In fact, the pointer field for m' is set to - g ( m ) to indicate this correspondence.) If the equation for m is n
u g(m) = ^
Up g ( b p )
P=i
where the b p are basis monomials in the subspace containing m, then the equa tion for m' is just n
» g(m') = Yl
u
p(g(bp) + d )'
P=I
where d = g ( m ' ) - g ( m ) . In other words, the equations for noncanonical monomials are obtained sim ply by translating the monomial indices in the equations for the corresponding canonical monomials. This technique is valid, since for all p, the p-th monomial in the noncanonical set is the permutation image of the p-th monomial in its corresponding canonical set. The third way, relevant to equation generation, in which the data structure provides an efficient technique for solving the basis problem applies to canonical sets R(i, j , k) for which at least two of i, j , and k are equal and nonzero. For such sets, it turns out that the effort in determining a basis can be substantially reduced—by nearly a factor of two when just two of the i, j , k are equal and nonzero and nearly a factor of six for sets where all three of i, j , k are equal. This saving is obtained by taking advantage of two facts: first, whenever e is a valid equation in, for example, the canonical subset R(i,i,k), then e' equal to ab(e) is also a valid equation in R(i,i,k) and is usually independent of e; and secondly,
Collected Works of Larry Wos
252
much less effort is required to derive e' as ab(e) than to derive it from its LJI or linear combination of instances of the LJI. For example, in some cases, ab(e) is e itself, after canonicalization. We consider an example in R(2,2,0) to illustrate the technique. Let q(mi,m2,m3,m4) be an instance of the LJI in which m p for p = 1,2,3,4 are substituted for w, x, y, and z respectively. The instance q(a,b,b,a) can be rear ranged to make dependent the monomial ((ba)a)b as follows: q(a,b,b,a):
2((ba)a)b = (bb)(aa) + 2(ba)(ba) - ((bb)a)a.
Applying the transformation ab to the above equation, and canonicalizing with respect to commutativity, we obtain the relation expressing the dependency of the monomial ((ba)b)a as follows: 2((ba)b)a = (bb)(aa) +2(ba)(ba) - ((aa)b)b. This same equation, on the other hand, is easily shown to come from the in stance q(b,b,a,a) which is just the canonicalization of ab of the previous instance q(a,b,b,a). This discussion of the efficiencies of the data structure leads naturally to the description of the two main algorithms, which is the topic of the next section.
3. The Basic Algorithms In this section we give two basic algorithms which are employed by the inverted approach—that approach outlined in Section 2.4 and used to obtain the results given in Section 6.1. For this discussion, we will need certain concepts which are formally treated in Sections 4 and 5, but we will not require such rigor at this time. To begin with, for a given (i, j , k), R(i, j , k) is the set of individual monomials which is the focus of attention for both algorithms. The monomials of this set are all of degree type (i, j , k), and it is assumed that i > j > k. Each monomial m = mfm 9 in R(i,j,k) is recursively the product of basis elements in already chosen bases, which automates the canonicalization of distributivity. Since there do not exist in R(i, j , k) two distinct monomials which can be shown to be equal by application of commutativity of multiplication, and since we are employing the data structure of Section 2.5 with the corresponding properties of closing functions g of Section 2.6, commutativity of multiplication is also automated. For every monomial m under consideration, we thus have g(mf) > g(m s ), where g is the particular closing function currently being employed. Although not all of the preceding sets are needed in the search for a basis in the subspace under consideration, the sets are still considered in the order dictated by properties Pi(g) and P2(g) in Section 4. For example, as will be illustrated in Algorithm 1, the monomial and basis information for the subspace of type (4,1,0) is irrelevant
An Application of Quad
Arithmetic
253
to the study of R(3,2,l). On the other hand, for our approach we must have the complete information for R(3,l,0), R(2,2,0), R ( 2 , l , l ) , R(3,2,0), R(3,l,l), and R(2,2,l) to study R(3,2,l). We also need the information for, say R(l,2,l), but this is obtained from R(2,l,l), as illustrated in Section 2.9, by property P6(g) of Section 4. We therefore have bases B(i',j', k')(g) for all subsets earlier than R(i, j , k), and we also have the relations expressing the dependent monomials in terms of members from B(i',j',k')(g). Next we assume that the R(i,j,k) under consideration is partitioned into two sets. The first set, N(i,j,k), will be the complement of a basis if all goes well. The second set R(i, j , k)-N(i,j, k) hopefully is a basis but, even if it is, may be rejected because of certain additional requirements. The most important of these is that R(i, j , k ) - N ( i , j , k) be closed and also consist of two subsets of monomials, each of which must contain a specified number of elements in order that the efficiencies of Section 2.9 be available. This specification, in terms of "paired" and "fixed" monomials as defined in Section 3.1, reflects the spirit of the last conjecture given in Section 6.2. Finally, to complete the setting for the presentation of the two algorithms, we briefly discuss the quads of Section 5. A quad is an ordered set of four positive integers which correspond under the chosen function g, to four monomials. The ordering of q = (qi,q2,q3iq4) gives an assignment to w, x, y, z respectively for a substitution into the linearized Jordan identity. Quads correspond to instances of the LJI. We are only concerned with quads which are both canonical and relevant to R(i,j,k)(g). A quad is canonical if and only if all of qi to q4 are images under g of basis monomials mi tom4 relative to g and q2 > q;i > q<|. To be relevant, where q,, = g(m p ), for p = 1,2,3,4, a quad q = (qi,q2,q3>q4) must be such that the coordinatewise sum of the degree types of m p equals (i, j , k). In a similar way, we define q(mi,m2,m3,m4) to be the instance that one obtains by substituting into the LJI mi for w, ni2 for x, m3 for y, and 1114 for z. (In Section 5, we use a similar notation, but at that point, q(mi,m2,m3,m 4 ) is the expression, ((m 3 m4)mi)m2 + ((m 2 m4)mi)m3 + ((m2m 3 )mi)m4 (mim 2 )(m 3 m4) - (m 1 m 3 )(m2m4) - (mim4)(m2m 3 ).)
3.1. Selection of N(i,j,k) As stated in step 1 of Section 2.4, the set X(i, j , k) is an ordered set of monomials in R(i,j,k), selected to be the complement of an expected basis of R(i,j,k). It is not just the set N(i, j , k) that is important here, but the order of the monomials in N(i, j , k) is also crucial. The order is so chosen that the instances of the LJI, selected by Algorithm 1, provide without much computational effort equations which make each monomial in N(i, j , k) in turn dependent upon both monomials occurring later in the ordering of N(i,j,k) and upon monomials expected to be basis elements. The essential property of the equational system generated by
254
Collected Works of Larry Wos
Algorithm 1, being used here, is that the matrix representing the equational system is nearly upper triangular. For those subsets R(i,j,k) such that no two of i, j , and k are equal, the preferred order for the monomials in the corresponding N(i,j,k) is that which is monotonically decreasing with respect to g. In other words, regardless of the particular choice of such an N(i, j , k), the monomials m p therein are ordered so that g(mi) > g(m2) > . . . > g(m u ) where g is the closing function currently being used and m p is the p-th member in N(i,j,k). This ordering is also that which is preferred for the subsets of degree type (i,0,0). On the other hand, when at least two of the i, j , and k are equal and nonzero, the situation is more complex and requires the following digression. Let T(i, j , k) be the subgroup of transformations in S3 which maps the degree type (i,j,k) into itself. For example, T(2,2,0) for the subspace of type (2,2,0) consists of the identity and the transposition ab; for the subspace of type (3,1,1), the identity and the transposition be; for the subspace of type (2,2,2), all of S3. Now we partition each R(i, j , k) into classes such that each class is closed under all of T(i, j , k). Thus, a given subset C of a given R(i, j , k) is such a closed class of monomials when, for every t in T(i, j , k), the canonicalization of t(m) is in C if and only if m is in c. Each class C is then either termed "paired" or "fixed". A class is termed paired if and only if the number of monomials in C equals the number of transformations in T(i, j , k), and termed fixed if and only if the number of monomials in C is half the number of transformations in T(i, j , k). A monomial m is paired or fixed depending upon the status of the class of which it is a member. We take as the representative of each class of monomials the monomial with the smallest g-image. As an example of fixed and paired classes, we consider the subset R(2,l,l). In R ( 2 , l , l ) , there are 9 monomials whose g-images are 50 to 58. The monomials and their g-images are listed below. g(m)
m
50 51 52 53 54 55 56 57 58
((cb)a)a ((ca)b)a ((ba)c)a ((ca)a)b ((aa)c)b ((ba)a)c ((aa)b)c (cb)(aa)
MM
g(mi
18 19 20 16 17 11 12 8 7
Since the T(2,l,l) consists of the identity and be, each paired class consists of two monomials. There are three such classes, namely, (51,52), (53,55), (54,56). The representatives of these paired classes are respectively 51, 53, and 54. There
An Application of Quad
Arithmetic
255
are three fixed classes, consisting respectively of 50, 57, and 58. In this case, 50, 57, and 58 are the corresponding representatives. On the other hand, the paired classes of R(2,2,2) consist of six monomials each, while the fixed classes consist of three each. There are 11 paired and 10 fixed classes in R(2,2,2). Now, we are able to specify the preferred ordering of the monomials in N(i, j , k) when at least two of i, j , and k are equal and nonzero. First, N(i, j , k) is required to consist of complete classes C, with paired classes appearing first and fixed classes following. Next, the representative of each class is followed imme diately by the remaining members of that class. Finally, based upon the values under g, the representatives are listed in descending order. Thus, for example, if N(2,l,l) consists of (ca)(ba), ((ca)b)a, and ((ba)c)a, the preferred ordering for N ( 2 , l , l ) i s (51,52,58). The preferred ordering is not enforced by the computer program, but it is the ordering most often used. In addition, it is the default ordering for the default N(i, j , k) when N(i, j , k) is not specified. However, for subsets with fixed classes of monomials, the computer program forces complete classes into N(i, j , k), thereby biasing the choice of basis towards one which is closed—towards a basis which is the union of paired and fixed classes. We conclude this section by extending the concepts of paired and fixed. An equation e relating monomials of R(i,j,k) is termed paired when the set of equations obtained by applying the various t in T(i, j , k) to e consists, after canonicalization, of p distinct members where p is the number of elements in T(i, j , k). Note that if t(e) is —e, it is considered a distinct member but, of course, represents the same relation among the monomials. Equation e is termed fixed when the set of t(e) consists of p-=-2 distinct members after canonicalization. For subsets R(i, j , k) such that at least two of i, j , and k are equal and nonzero, one can show that a monomial (or an instance of the LJI) is fixed if and only if there is a transposition t in T(i, j , k) under which the monomial (or an instance of the LJI) is fixed.
3.2. Algorithm 1: Selection of Equations Expressing Monomial Dependency Algorithm 1 is basically a heuristic procedure which given a monomial m from an ordered set of monomials N(i,j,k), selects an instance of the LJI or more usually a difference of two instances of the LJI to express the dependency of the monomial m of N(i, j , k). The use of the selected instance(s) is restricted first, to control the magnitude of the integers in the equations expressing monomial dependency, and second, to obey the requirement (when appropriate) that the basis be closed. As the algorithm proceeds, the restrictions controlling the mag nitudes of the integers present in acceptable equations is gradually relaxed until they are limited only by the integer representations for the digital computer. For the discussion in this section, we recall in Section 2.9.6 that the mono mial dependencies for noncanonical spaces are derived from the corresponding canonical spaces. Therefore, the discussion of Algorithm 1 is limited to sets of
Collected Works of Larry Wos
256
degree type (i, j , k) with i > j > k. Next, recall that for such sets, the monomials are ordered under g by the images of the second factors. This fact is used to establish certain properties of this algorithm. Given a monomial in N(i,j,k), Algorithm 1 selects an instance (or a difference of instances) of the LJI by parsing the monomial m into four factors. The factors are assigned to the arguments w, x, y, and z of the LJI in such a manner that one of the six terms in the resulting equation is m itself. There exist several ways of parsing m and assigning the corresponding factors to w, x, y, and z, but only the simplest and most frequently used will be described here. The choice between the two preferred methods of parsing the monomial depends on the degree of the second factor m 8 of m. The first choice applies to monomials m with d(m s ) > 2. Define mSf and m ^ to be the first and second factors respectively of m s , and m8ff and msf8 to be the first and second factors respectively of m8f. Then we have for the monomial m, m = mf((mSffmSf8)mM). Now we form the difference of instances q(m ss ,mf,m s ff,m 8 f 8 ) - q(mf,m ss ,m s ff,m s f 8 ). The first instance is, of course, chosen so that the monomial in appears as its first term, and the second instance is chosen to force, for a particular subset of monomials, the corresponding submatrix of dependency equations to be diago nal. For this difference, first note that the right sides of the two instances cancel, for the right side of the LJI is symmetric in all of w, x, y, and z. This leaves six summands, one of which yields the term m itself. Next, all monomials m' of R(i,j,k) which are produced by the remaining five summands are such that the degree d(m s ) is less than d(m 8 ). Hence, the monomial m must be present with a nonzero coefficient in the equation corresponding to the difference under consideration. Finally, the submatrix, mentioned above, corresponds to that set of monomials m such that d(m s ) equals 3. This last statement implies that there is a preference for bases containing monomials with second factor of degree 1. The second choice applies to monomials m with d(m s ) < 2, but with d(mf) > 2. These monomials m are parsed in the same way as those above but with m s and mf interchanged, yielding a difference of the form q(mk,m8,mfff,mffs) -
q(ms,mfs,mfrf,mffs).
Here, the first term in the first instance yields m in the factored form m = ((mffrmfrs)mfs)ms. However, other terms in either instance may also yield m causing it to can cel out of the resulting equation. Indeed, the entire equation is zero when m 8 equals mfs.
An Application of Quad
Arithmetic
257
The rationale behind the preferred ordering in N(i, j , k) can now be seen by analyzing the first choice for parsing in the presence of the preferred ordering for N(i, j , k). Since all the monomials in the equation selected for m have second factors whose degree is less than that for m except for m itself, then the only monomials present in (m)'s equation are further down in the ordering. This as sumes the monomials in R(i,j,k)-N(i,j,k) are ordered after those of N(i,j,k). Hence, if we examine the rectangular coefficient matrix representing the equa tions developed by the first choice, it is upper triangular with nonzero diagonal elements. Hence, the equations selected by the first choice are independent of each other. In addition, they represent, in the spaces of degree 8 or more, the majority of the equations expressing the dependencies among the monomials ofR(i,j,k). The nice upper triangular property possessed by the equational system also holds for sets N(i,j,k) with at least two of i, j , and k nonzero. But, in solving the basis problem for such an R(i, j , k), there are three additional requirements which in part affect the use of equations obtained from Algorithm 1. First, the status (fixed or paired as defined in Section 3.1) of the monomial and equation must match, which will be discussed later in the form of an example. Second, the set of dependent monomials, prior to the application of parsing, must be closed. Third, the set of equations (quads) which have been considered (classed as used quads) must be closed. The closure for quads is analogous to the concepts of closure for monomials. The motivation for these requirements is twofold. There is the desire to have the upper triangular coefficient matrix exhibit the char acteristics possessed by the diagonal coefficient matrix. Simultaneously, these additional requirements are most useful in promoting better behavior of the intermediate arithmetic. The second choice of parsing, that for monomials m with d(m 5 ) < 2 and d(irif) > 2, does not yield in general equations whose coefficient matrix has this nice upper triangular property possessed by the first choice for parsing. Indeed, it often yields equations that contain monomials occurring earlier than m in N(i,j,k) whose second factor has degree exceeding 2 and which must be replaced by substitution to determine whether the equation is independent of those already used to make monomials dependent. If, after substitution, the resulting equation is nonzero, then it is independent of those previously used equations and may be used to make m dependent, providing that m still remains and certain additional properties, such as monomial singularity, discussed below hold. On the other hand, if the resultihg equation is nonzero but cannot be used to make m dependent, then it may be used to establish dependency of some other monomial therein. However, this need to substitute for dependent monomials may have two unfavorable side effects; first, the substitution process may increase the magnitude of the coefficients in the equation to such an extent that later substitution using this equation yields integers so large that they cannot be tolerated by the digital computer; and secondly, the monomial in question either may vanish after substitution, or may fail to have its status
Collected Works of Larry Wos
258
(paired or fixed) match that of the resulting equation. Because of the first unfavorable aspect of substitution, we reject the use of the resulting equation, when the maximum coefficient in magnitude in the equation exceeds a threshold. The rejected instances, those corresponding to this offensive equation, will eventually be re-examined either by Algorithm 2 described in the next section, by a parsing of another monomial in N(i,j,k), or by again parsing m with Algorithm 1. The first two of these possibilities obvi ate the need for considering the rejected equation because of linear dependency among the equations. Should the rejected instance be re-examined, the result ing equation, because further monomials may have been made dependent, may yield a completely different equation with smaller coefficients, including the zero equation, thereby avoiding the integer representation problem. In addition, to retard the growth of the coefficients, we insist that the coef ficient of the dependent monomial be a power of 2. Experience shows that this restriction greatly reduces the magnitude of the coefficients in the intermedi ate calculations. We can prove that this power of 2 restriction propagates at least with regard to the first choice for parsing. In addition this restriction has theoretical significance, as discussed in Section 6. Partly related to the second unfavorable aspect of substitution, we now dis cuss both the problem of monomial singularity and the requirement of statusmatching for <:quations and monomials. Suppose e is an equation in a space where t is the only nontrivial transformation in the set T(i,j,k), and suppose further that the paired classes (mi.mj) and (raj.m^) and the fixed class m3 appear in e in the following way; e : mi + m[ + m2 — 4(m 2 ) + 013 = 0. The equation e is paired since t(e) : mi + m'j - 4(m 2 ) + m 2 + m 3 = 0 is not identical to e. Now consider, to cope with the problem of singularity, the possibility of taking a linear combination of e and t(e) that yields an equation for mi in which m^ is not present. Since the 2 x 2 coefficient matrix "l 1" 1 1 for the pair (mi,m'j) in the pair of equations e and t(e) is singular, such a combination cannot exist. On the other hand, the combination e + 4t(e) yields an equation for m 2 in which m 2 is not present, since the coefficient matrix 1 -4
-4" 1
for the pair (m 2 , m 2 ) in the pair of equations e and t(e) is nonsingular. To illustrate the status-matching requirement, one might consider using e to make mi dependent, regardless of the presence of m^. Then t(e) could be
An Application of Quad
Arithmetic
259
used to make m2 dependent. But then the set of dependent monomials at this point is not closed which violates one of the three additional requirements given above. Another possibility is that of using the paired equation e to make dependent the fixed monomial m.v The earlier objection now applies, namely, closing the quad space fails to utilize the information in t(e). Summarizing, if the coefficient matrix for a class of monomials in a class of equations of the same status is nonsingular, then we can readily make that class of monomials dependent upon the remaining monomials in the equations by taking linear combinations of these equations. The computer program that implements Algorithm 1 uses choices of parsing other than those above and which are briefly described here. Monomials of degree 4 when both factors have degree 2 are parsed in such a manner that they occur in the term of the form (wx)(yz) in the instance q(w,x,y,z). Secondly, certain monomials are parsed in a manner which yields an instance of the LJI which does not directly mention them, but instead requires the utilization of information from earlier spaces. These latter choices of parsing are designed to reduce the amount of substitution in the space under study, thereby further diminishing the aforementioned difficulties with large integers. Empirically, we have discovered that the number of fixed and paired classes of monomials in a closed basis B(i,j,k) is independent of the particular choice of the closed basis. Additionally, the number of fixed and paired classes in the closed basis matches those numbers of fixed and paired classes of symmetric elements in the corresponding special Jordan subspace, whenever the fret: Jordan subspace is isomorphic to the special Jordan subspace. Whenever the subspaces are not isomorphic these counts do not match but are only different by one or two in the counts of each class. Consequently, we further restrict Algorithm 1 by limiting the number of paired and fixed classes that can be made dependent. We now summarize the four restrictions upon the use of an equation e to make a monomial m dependent, thereby giving the properties required after substitution—those properties promised in the discussion of the second choice of parsing. First, the status (fixed or paired) of the monomial and equation must match. Second, the largest coefficient in magnitude must not exceed some threshold. Third, the coefficient of the monomial must be a power of two. Fourth and last, the submatrix of the class of monomials in the equation must be nonsingular. These restrictions or the choice of N(i, j , k) may lead to the existence of lin early independent equations which must be considered before the dimension of the subspace V(i,j,k) can be correctly determined. There are two quite distinct ways to cope with these equations. First, with the intention of insisting that the complement of N(i,j,k) be made a basis, the various restrictions are pro gressively relaxed. For example, several passes through N(i, j , k) are made, each time increasing the threshold for permissible coefficient size. Second, when all else fails, the program is permitted to make dependent monomials which are not
260
Collected Works of Larry Wos
members of N(i, j , k). In all cases, however, both the nonsingularity requirement and the powerful requirement of closure are never relaxed. Algorithm 1 has one final task, that of continually invoking Algorithm 2, which is presented in the next section. Each time Algorithm 1 either uses a quad to make a monomial dependent or considers a quad whose correspond ing equation becomes identically zero after substitution, an attempt is made to determine additionally quads which have therefore become linearly depen dent. The mechanism for determining such linear dependence is accomplished by Algorithm 2 which employs quad arithmetic.
3.3. Algorithm 2: Completing the Quad Space Given a quad (or a certain kind of quad difference), Algorithm 2 determines the quads (or quad differences) that are newly made linearly dependent. Although other identities are employed by Algorithm 2, the primary source of linear de pendence is the identity Eo of Section 5. Algorithm 2 is called whenever a quad or quad difference is added to the "used quads list". A quad or quad differ ence is added to the used quads list when and only when either the quad or quad difference yields an equation used for monomial dependency or the quad or quad difference yields a zero equation. A quad or quad difference yields a zero equation either because it becomes identically zero during the attempt to make a monomial dependent or because it has been shown to be linearly dependent through the use of Algorithm 2. The adjunction of a single element to the used quads list may yield, by Algo rithm 2, a number of candidate sets S for quad arithmetic. As a result, Algorithm 2 processes each element added to the used quads list to thereby generate addi tional quads and quad differences as members of candidate sets S. To illustrate how these other quads are generated, consider the following example. Suppose the difference (6,4,1,1)—(4,6,1,1) is on the used quads list, and that we are in the process of adding to that list the quad difference (4,6,1,1)—(1,6,4,1). By transitivity of addition, the difference (6,4,1,1)—(1,6,4,1) is also available for processing by quad arithmetic, since (6,4,1,1)-(1,6,4,1) = ((6,4,1,1)-(4,6,1,1)) + ((4,6,1,1)-(1,6,4,1)). If in addition the quad (1,6,4,1) is already on the used quads list, then, again by transitivity, the quad (4,6,1,1) is now also available, since (4,6,1,1) = ((4,6,1,1)-(1,6,4,1)) + (1,6,4,1). In this way, Algorithm 2 applies the property of transitivity of addition of quads to each element added to the used quads list, and possibly yields, when used in conjunction with those elements previously appearing on the used quads list, quads or quad differences for the application of quad arithmetic. Also any quad
An Application of Quad
Arithmetic
261
or quad difference thus shown to be transitively related to ones already on the list are adjoined to the used quads list. Similarly, if q and q' are on the list, and if the elements of q' are a permutation of those of q, then q—q' is also placed on the list. Algorithm 2 processes in turn each quad or quad difference in the following way. If a quad difference is under consideration, let S denote the set of quads including sign therein. Otherwise, let S be the set consisting of the single quad under study. Using quad arithmetic, various sets S* which complete S are gen erated. Briefly, as discussed in Section 5, the set S*, containing S, completes the set S if and only if the set S* is the set of signed quads appearing in a particular instance of Eo. For each completion S*, the program considers the correspond ing instance of Eo and determines the number of quads or quad differences therein that are not yet on the used quads list. When that number is exactly one, the missing quad or quad difference is known to be linearly dependent and is therefore added to the used quads list. Quad arithmetic is the process whereby, for a given set S, various sets S* are determined. This arithmetic process is accomplished by using the data structure as follows. First, if S consists of the quad (q,q2,q3,q4) where g(m) = q and d(m) > 1, and if q = qfq s , then one set S* consists of the canonicalizations of the seven quads (q,q2,q3,q4), (q2q3,q4,qf,qs), -(q4,q2q3,qf,q»), (q2q4,q3,qf,q s ), -(q3,q2q4,qf,q s ), (q3q4,q2,qf,qs)< - (q2.q3q4,qf,q s )-
If all of q2q3, q2q4, and q3q4 correspond to basis monomials, S* is determined. On the other hand, if any of the products, such as q 2 q3 represent dependent monomials, the corresponding quad (q2q3>q4,qf,qs) is replaced by the set of quads obtained by replacing q 2 q3 with g(b p ) for each basis monomial b p in the replacement expression for q2q3- For example, if the product n
u(q2q3) = J2
P=i
U
P g ( b p)'
then the quad (q2q3,q4iqf,qs) is replaced by the set of n quads (g(b p ), q4,qf,qa) for p = 1, 2 , . . . , n. The coefficients u and u p are ignored since the presence or ab sence of elements in the used quads list is of concern. The quad -(q4,q2q3.qf ,qs) must also be replaced by its corresponding set of quads, but the sign must be propagated throughout the replacement set. Further, if d(m) > 3, then other sets S* are generated by determining all those dependent monomials m' in the space of degree type dt(m) which have the basis monomial m in the equation expressing m' in terms of basis monomials. For example, if the non-basis mono mial m' is expressed in terms of the basis monomial m (and possibly other
Collected Works of Larry Wos
262
monomials), then S* consists of the canonicalizations of the seven quads (g(m') ,q 2 ,q3 ,q4), (q2q3 ,q4 ,g(nif) ,g(m,)), - (q4.q2q3,g(mj),g(m^)), (q2q4,q3,g(nif),g(nO), - (q3,q2q4,g(mf),g(ms)), (q3q4,q2,g(mf),g(m^)), - (q2,q3q4,g(mf),g(m0, where m' = mfm£. Again, if any products represent dependent monomials, the corresponding quad is replaced by an appropriate set of quads as described above. Finally, if d(m) = 1, we choose not to form a completion set S*. When S consists of a difference, say (q,q2,q3,q4) and — (q2,q,q3,q4), it may be treated in one of several ways depending upon the degrees of q and q 2 . If q and q 2 have degree 1, no set S* is sought. Since the approach to treating the second quad is the same as that for the first, we describe the completion of S to S*, focusing upon the first quad of the difference. If d(m) > 1 where g(m) = q, and if q = qfq,,, then one set S* consists of the canonicalizations of the seven quads (q3q4,q2,qf,qs), (q2qf,q s ,q3,q4), -(q s ,q2qf,q3,q4),
(q2qa,qf,q3,q4), -(qf,q2q s ,q3,q4), (qfq»,q2,q3,q4), - (q2,qfqs,q3,q4)Again, if any products represent dependent monomials, the corresponding quad is replaced by an appropriate set of quads as illustrated above. Further, if d(m) > 3, other sets S* are generated by determining all those dependent monomials m' in the space of degree type dt(m) which have the basis monomial m in their equation. Finally, if d(m) = 1, we then focus attention on the second quad of the difference, and proceed as above. This completes the description of the implemented version of quad arithmetic. Whenever quad arithmetic yields an S* with just one quad or quad difference that is not on the used quads list, it is added to the list. It and its derivatives, arising from transitivity, are made available to be analyzed by the quad arith metic algorithm. This repetitive process can often cascade to yield from one addition to the used quads list hundreds of other quads without resorting to the expansion of a single instance of the LJI. Consequently, hundreds of equational redundancies can be eliminated in this most efficient manner. However, the selection processes of Algorithm 1 together with the continuous application of Algorithm 2 may not deal with all the relevant quads in a given space R(i,j,k). When not all the quads have been considered in this fashion, those sets S* with just two quads or quad differences absent from the used quads list are visited one at a time. For such sets S*, the equation corresponding to one of the two unused elements is developed. As before, if the resulting equation is independent of those already expressing monomial dependency, it can be used to express another monomial dependency not yet developed and is then added
An Application of Quad
Arithmetic
263
to the used quads list. On the other hand, if it is zero thus showing that it is dependent upon the previous equations, it still is added to the used quads list, and Algorithm 2 proceeds to determine those sets S* with just one element absent from the used quads list. Clearly, there always exists one such S* since the S* just visited which caused the development of an equation will be selected by Algorithm 2. The process continues with all the sets S* with just two elements absent from the used quads list. We have never applied the technique just given to an S* with three or more absent from the used quads list. Such an S* would require the development of two equations resulting from substitution into the LJI.
4. Closing Functions: The Formal Presentation In this section we give a formal treatment of closing functions and their proper ties. We begin with the basic axioms, and then prove a number of lemmas and corollaries which establish the relation between closing functions and "closed" bases, which will be denned in this section. The choice of a closed basis at each step of an iterative approach to the structure problem for the free Jordan ring on 3 letters has a profound effect on the ease with which information is ob tained. Each closing function can be said to both well-order the monomials in its domain of definition and canonicalize each of these monomials. In this treatment we shall use notation and terminology consistent with the earlier material, but we shall attempt to make this section self-contained. In this regard we begin the formalization of the subject matter of Sections 2.5 to 2.8 with the following notation and basic concepts. Let 72 denote the free Jordan ring on 3 letters. The elements of 72 are finite sums of monomials with rational coefficients. Monomials are defined as finite sequences of letters with appropriate grouping symbols, and the choice here, of course, is from among a, b, and c. The ring 72 is a commutative and nonassociative ring whose elements satisfy the Jordan identity. Of the various forms of this identity, we prefer the linear form given by ((yz)w)x + ((xz)w)y + ((xy)w)z = (wx)(yz) + (wy)(xz) 4- (wz)(xy), and we denote it by LJI. It is not all of 72, however, which directly concerns us in this section, for the focus of attention hen: is a particular class of functions defined only for certain individual monomials. We therefore need certain concepts defined for monomials alone. Definition. The degree type dt(m) of the monomial m is a triple of integers (i, j , k) which respectively give the number of occurrences in m of a, b, and c.
264
Collected Works of Larry Wos
Definition. as i+j+k.
The degree d(m) of a monomial m of degree type (i, j , k) is defined
The monomials in TZ can then be neatly partitioned into sets consisting of all monomials of the same degree. Each of these sets can in turn be partitioned into subsets S(i, j , k), where S(i, j , k) consists of all monomials m with dt(m) = (ij,k). For each S(i, j , k), there exists a vector space V(i, j , k) consisting of all finite sums of elements from S(i,j,k) with rational coefficients. Then K equals the span of V(i,j,k) for all (i,j,k) with i+j+k > 0 . Even without the LJI, each of the V(i,j,k) is, of course, finite-dimensional, and the dimension is obviously in general less than that of its generating set S(i, j , k) because of commutativity of multiplication. This brings us to the next important concept for the class of functions to be studied, namely, that of com mutative variant. Definition. The monomials m and m' are commutative variants of each other if and only if m' can be obtained from m by some number of applications of commutativity of multiplication. We therefore consider m to be, for example, a commutative variant of itself. This concept is used in various ways to restrict the domain of each function of the class in question. We employ therein the obvious concepts of first and second factors of a monomial m. Definition. The first and second factors of a monomial m, respectively de noted by mf and m s , are those monomials such that m = mfm s . The monomials a, b, and c, of course, do not possess first and second factors. This definition is well-posed because multiplication is non associative. Finally, we need certain definitions which center on the (i,j,k) triples. Definition. A triple (i,j,k) is called canonical if and only if i > j > k, and noncanonical if and only if it fails to satisfy this relation. We also say that a monomial m with dt(m) = (i,j, k) has canonical type if and only if i > j > k. A set S(i,j,k) can also be said to have canonical type. Canonical sets occur in the axiom p6, which is a symmetry axiom for the class of functions herein. The (i, j , k) triples also play an important role for certain distinguished sub groups of S3, the full set of permutations on 3 letters. In this connection, we identify the permutation ab with the permutation 12, abc with 123, and the like.
An Application of Quad
Arithmetic
265
Definition. We define T(i, j , k) to be the set of t in S3 which preserve degree type. Therefore, T(i, j , k) is the set of t in S3 such that t((i, j , k)) = (i, j , k). Thus, for example, T ( 2 , l , l ) = T(5,2,2) is the set consisting of the transposi tion be and the identity; T(3,2,l) is just the identity; and, T(2,2,2) is S3 itself. The subgroups T(i,j,k) do not come into use directly until we give the set of lemmas and corollaries. We can at last turn to the definition of the functions of primary interest. The class of functions upon which we now concentrate consists of all closing functions, where a closing function g is defined as any function which satisfies the following eight axioms. These axioms are not assumed to be an independent set of axioms. The first of the eight, po, can be viewed essentially as initialization; the next three as ordering; the next two restrict the domain of definition and in effect canonicalize; p6 is an important type of symmetry; and P7 states that g _ 1 is defined on the positive integers. Obviously, in view of Po,P7 is merely present for parallelism with respect to the discussion in Sections 2.5 to 2.8. Po(g). The function g is a one-to-one mapping from a subset of the individual monomials in TZ onto the positive integers such that g(a) = l,g(b) — 2, and g(c) = 3. Pi(g). If g is defined on the monomials m and m' with d(m) < d(ni'), then g(m) < g(m'). P2(g). If g is defined on m and m' with d(m) = d(m'), and if dt(m) = (i,j,k) and dt(m') = (i'j',k'), then g(m) < g(m') when either k < k', or k = k' with j<j'. P3(g). If m and m' are monomials of canonical type on which g is defined, if dt(m) = dt(m'), and if g is defined on both the first and second factors of both m and m', then g(m) < g(m') when either g(m s ) < glm,), or g(m 5 ) = g(mg) with g(m f ) < g(mj). P g(m s ). The next property Ps(g) is a canonicalization for distributivity. It is a formalization of the requirement that the monomials in the domain in g are recursively products of basis monomials relative to g. Ps(g). Let B(i,j,k)(g) be that set of monomials m on which g is defined such that dt(m) = (i,j,k), and such that there exists either an mi on which g is defined with mLf identical to m or an m2 on which g is defined with m2S identical to m. We first require that, for any (i, j , k) such that B(i, j , k)(g) is not empty, B(i,j,k)(g) be precisely a basis for V(i,j,k) (with respect to the LJI).
266
Collected Works of Larry Wos
We then require that, if m and m' are respectively members of B(i, j , k)(g) and B(i',j',k')(g) with g(m) > g(m'), g be defined on mm'. We further require that g defined on m with d(m) > 1 implies g is defined on mf and on m s . P6(g). Let mi and ni2 be monomials of canonical type on which g is defined such that dt(mi) = dt(iri2) and such that g(mi) < g(iri2). With transpositions considered simpler than 3-cycles, let t be the simplest permutation on 3 letters such that, for a given noncanonical triple (i',j',k'),t(mi) and t(m2) have degree type (i'j',k'). We require of g that there exist monomials mi and m 2 such that g is defined on both m'j and m 2 , such that m'j is a commutative variant of t(mi) and m 2 of t(m2), and such that g(mi) < g(m 2 ). We also require that, when g is defined on a noncanonical m', there exists a canonical m on which g is defined such that t(m) is a commutative variant of m', where t is the simplest possible permutation. P7(g). For every positive integer p, there exists a monomial m on which g is defined such that g(m) = p. Certain elementary facts can be easily deduced concerning closing functions. Axiom po, for example, can be extended to cover the first 102 monomials in the well-ordering. The axiom states that all closing functions agree on the monomials a, b, and c. This agreement actually extends from the monomial a which is mapped to 1 to (cc)(cc) which is mapped to 102 under any function g satisfying Po to p7. All eight axioms contribute to the fact that the domains, ranges, and orderings of such g are identical. Section 2.7 contains some of the details. But at and beyond degree 5, separation can and does occur simply because the LJI applies to the monomials of degree 4. On the other hand, P4 forces certain monomials to be in the domain of no function g. For example, b(ba) and (bb)(cc) are mapped by no closing function. There are still other monomials, (((aa)b)a)b for example, for which there exist functions gi and g 2 satisfying po to D7 such that gi and g 2 are defined on this m but with gi(m) / g2(m). Turning to more significant properties of closing functions, we make the following definition.
Definition. For a given (i,j,k) and a given function g satisfying po to P7, R{i,j,k)(g) is the set of monomials m on which g is defined and for which dt(m) = (i,j,k). One can first show easily that, for all (i,j,k) and all closing functions g, R(i,j,k)(g) is fully canonicalized with respect to commutativity of multiplica tion. That is, there do not exist monomials mi and m2 with mi ^ m 2 but with ni2 a commutative variant of mi such that mi and 1112 are simultaneously mem bers of some R(i,j,k)(g) for some g. In fact one can prove the stronger claim:
An Application of Quad
Arithmetic
267
If gi and g2 satisfy p 0 to P7, and if mi and m2 are such that gi is defined on mi and g2 on m2, and if ni2 is a commutative variant of mi, then mi = m2. In addition to the canonicalization for commutativity, the R(i,j,k)(g) realize canonicalization for distributivity. For that discussion we need the following definition. Definition. Let g be a given function for which po to P7 hold. Then R(i'j',k')(g) is said to be g-contained in R(i, j , k)(g) if and only if i' < i and j ' < j and k' < k and at least one of the three inequalities is strict. Now within any given R(i,j,k)(g) for some given closing function g, there are three possible sources of linear dependence among the monomials therein. Commutativity of multiplication is eliminated as a source by the previous re marks. Linear dependence coming from relations among monomials in some R(i'j',k')(g) which is g-contained in R(i,j,k)(g) is eliminated by ps(g). Thus the only source for relations among the members of R(i, j , k)(g) is the linearized Jordan identity applied directly to R(i,j,k)(g). In other words, one need ex amine only instances of the LJI arising from substitution of basis elements for w, x, y, z—elements from B(i',j',k')(g) for relevant (i'j'.k'). To be relevant, the R(i',j',k')(g) must each be g-contained in R(i, j . k)(g). The four monomials being substituted for w, x, y, z must be such that the coordinatewise sum of their de gree types equal (i, j , k). Finally, to maintain all within the domain of the given g, relations among monomials in the g-contained sets must often be applied during the evaluation of an instance of the LJI. For example, the first summand contains the partial product yz which may evaluate to a monomial which is not a member of the corresponding B(i'j',k')(g). This necessitates a replace ment of that monomial by its equivalent expression involving only members from the corresponding B(i',j',k')(g). The discussion of this paragraph taken as a whole shows that canonicalization with respect to distributivity is present in R(>,j,k)(g). The focus of attention now shifts from the R(i,j, k) to the B(i, j , k ) and the powerful property of closure. Definition. A subset Bi of R(i,j,k)(g) is closed when, for all t in T(i,j,k), the monomial m is a member of Bi if and only if a commutative variant of t(m) is a member of Bi. Some familiarity with this concept can be gained by examination of Sec tion 2.8. The concept of closure can be localized in the obvious way to that of closure with respect to some particular element of T(i,j,k). In this connection we prove the following useful remark. Remark 1. If a set Bi is closed under at least two different transposition, then Bi is closed under S3, the group of all permutations on 3 letters.
268
Collected Works of Larry Wos
Proof. Merely note that any two distinct transpositions generate S3, and ap ply Remark 2. R e m a r k 2. Let g be any given closing function, and m be any given mono mial on which g is defined. Let t i , t2, and t3 be members of S3 with tit2 = t3. It is not assumed that dt(m) = dt(t p (m)) for any p. If m' in R(i'j',k')(g) is a commutative variant of t3(m), and if m" in R(i"j",k")(g) is a commutative variant of t2(m), then m' is a commutative variant of ti(m"). Proof. Note that it is canonicalization with respect to P4(g) which is under consideration. Also note that t(mi) = t(mif)t(mi 8 ) for any mi and any permu tation t. One is required to apply commutativity of multiplication some number of times to recursively satisfy p,j(g). The proof is by induction on the number of letters in m. The axioms po, P5, and P6 are the key. We now state and prove the most important result for closing functions, the lemma of closed bases for canonical sets. Recall that ps(g) requires that the B(i,j,k)(g) be bases respectively for V(i,j,k). Therefore, each B(i,j,k)(g) is a basis for R(i, j , k)(g), which permits us to call the B(i,j, k)(g) bases relative to g. L e m m a 1. Let g be any given closing function. Then R(i, j , k)(g) is not empty for all (i,j,k) with i+j+k > 0. More importantly, if R(i,j,k)(g) is such that i > j > k, and if B(i,j,k)(g) is that set defined in ps(g), then B(i,j,k)(g) is closed and a basis for R(i, j , k)(g). Proof. For the first half of the lemma, assume by way of contradiction that R(i,j,k) is empty with i+j+k > 0 but that no earlier, within the ordering dictated by pi to p 3 , R(i',j',k') is empty. By p 0 , R(i,j,k) is of degree at least 2. Assume without loss of generality that i > 0. Then R(i—l,j,k) is defined and not empty since R(i,j,k) is assumed to be the earliest empty set contradicting the lemma and, by pi, R(i—l,j,k) is earlier in the ordering. Let m be a basis monomial in the basis underlying g in R(i—l,j,k). The monomial a is a basis monomial in (1,0,0). By one of pi to P3, g(m) > g(a). Thus the monomial ma satisfies the restriction of P4. Therefore, by ps, g must be defined on ma, which contradicts the assumption that R(i,j,k)(g) is empty. For the second half of the the lemma, assume again by way of contradiction that there exists an R(i,j,k)(g) falsifying the second part of the lemma. For the type (i,0,0), the argument is trivial in that the only relevant permutation is the identity. Without loss of generality assume that i = j > k. Then the basis relevant to g for this R(i,j,k) is not closed. By Remark 1, there must exist a transposition, therefore, under which the basis is not closed. Assume without loss of generality that the transposition is ab. There then exists a monomial m such that m is in the non-closed basis of this R(i, j , k) while the canonicalization
An Application of Quad
Arithmetic
269
with respect to P4 of ab applied to m is not in the basis. Let t denote the transposition ab. By ps, g must be defined on the monomial mb. By p6, g is defined on the canonicalization with respect to p4 of t(mb), which is equal to the canonicalization of t(m) multiplied on the right by the monomial a. By ps, the canonicalization of t(m) must be in the basis of R(i,j,k)(g) upon which g rests, which is a contradiction. Lemma 1 can be extended to include the sets of noncanonical type. To do so, we must first prove Lemma 2 which exhibits the control P6(g) exercises over those noncanonical sets. By definition, p6 already forces an order on the elements of each noncanonical R(i',j',k')(g) determined by that in the appropriate canon ical R(i,j,k)(g), which is why those noncanonical sets are called permutation images of the canonical. L e m m a 2. Let g be any closing function, and let R(i,j,k)(g) be given such that R(i, j , k)(g) is canonical. If t in S 3 is such that t(R(i, j , k)(g)) = R(i',j',k')(g) is noncanonical, then the canonicalization with respect to commutativity of t(B(i, j , k)(g)) is a basis for R(i',j',k')(g) and in fact is equal to B(i',j',k')(g). Proof. If (i,j,k) = (1,0,0), po is sufficient to establish the result. So assume the degree of m is greater than 1 for m in B(i,j,k). By ps, the monomials ma are in the domain of definition of g in R(i+l,j,k). These monomials are obviously canonicalized with respect to P4 since all m in B(i, j , k) are. Let t be a permutation on 3 letters with t(R(i, j , k)(g)) = R(i',j',k')(g) and with i' > j ' > k' false. Then by P6 the canonicalization of t(ma) for m in B(i, j , k) must be in the domain of definition of g in R(i'j',k'). For any such ma, the canonicalization of t(ma) is just the product of the canonicalization of t(m) with t(a). Now ps then implies that the canonicalization of t(m) is in the basis relevant to g of R(i'j',k'). Thus the images under t of the basis monomials of R(i, j , k) are basis monomials of R(i',j',k'). Since R(i,j,k) and R(i',j',k') are isomorphic and thus have the same dimension, the proof is complete. Before presenting the extension of Lemma 1, we give Lemma 3 which estab lishes a type of closure for all R(i, j , k)(g). L e m m a 3. Let g be any closing function, and let R(i,j,k)(g) be given for some (i,j,k). If m is in R(i,j,k)(g) and t is in S 3 with dt(m) = d t ( t ( m ) ) , then the canonicalization with respect to commutativity of t(m) is in R(i,j, k)(g). Proof. If m has degree 1, there is nothing to prove. Assume by way of con tradiction that the lemma is false, and let, therefore, R(i, j , k) be the earliest set with respect to the ordering corresponding to g which contradicts the lemma.
Assume that m is in R(i, j , k)(g), that the canonicalization with respect to P4 of
270
Collected Works of Larry Wos
t(m) is not in R(i,j,k) but has degree type (i,j,k), and that the degree of m is greater than 1. Let m = mfm s , the product of its first and second components. The canonicalization of t{m) is either the product of the canonicalization of t(mf) multiplied on the right by the canonicalization of t(m.s) or the product taken in the other order. Assume without loss of generality that it is the former. By ps, mf and m s are in their respective bases relevant to g. Case 1. The monomial mf has degree type (i',j',k') with at least two of i', j ' , and k' equal, and t(mf) also has degree type (i'j',k'). By pi, R(i',j',k') is earlier in the ordering dictated by g than is R(i, j , k). Therefore, by the assumption that R(i,j,k) is the earliest set contradicting the lemma, the canonicalization with respect to P4 of t(irif) must be in R(i'j',k'). Of course, i' > j ' > k' may be true or false. In either case, since the product of two permutations on 3 letters is also one, we can apply Lemma 1 or Lemma 2 to conclude that the canonicalization of t(mf) with respect to p4 is a basis monomial. Case 2. The monomial mf has degree type (i' j ' , k ' ) , but t(irif) does not. No assumption is made for this case about inequalities among i', j ' , and k'. If i' > j ' > k', then Lemma 2 requires the canonicalization of t(mf) to be a basis element. If it is not the case that i' > j ' > k', then let ti be a permutation on 3 letters such that the degree type of ti(m f ) = (i",j",k") with i" > j " > k". The canonicalization of ti(mf) can be seen to be a basis element by noting two facts. First, all permutations on 3 letters are one-to-one on the set of all monomials. Second, no R(i,j,k)(g) of any closing function g can contain more than one representative of an equivalence class of commutative variants of a given mono mial. Now again we have the proof that the canonicalization of t(mf) is a basis monomial from Lemma 2 and the fact that the product of two permutations on 3 letters is also one, which completes Case 2. In a similar manner, we conclude that the canonicalization with respect to P4 of t(m s ) is a basis monomial. Therefore, by ps, the product of the canonicalizations of t(mf) and of t(m s ) is in R(i, j , k). But this contradicts the assumption on m, and the proof is complete. We now extend Lemma 1 to establish the uniform existence of closed bases. Corollary 1. all(i,j,k).
The bases B(i,j,k)(g) are closed for all closing functions g and
P r o o f . Let g be some given closing function. If (i, j , k) is sucli that no two of i, j , and k are equal, then the identity is the only relevant permutation to consider for closure, and there is nothing to prove. If i > j > k with at least two of i, j , and k equal, Lemma 1 completes the proof. The last case is that for which exactly two of i, j , and k are equal, but i > j > k is false. Assume, therefore, without loss of generality that i < j = k. There then exists an R(i',j',k')(g) with i' = j ' > k' such that t'(R(i',j',k')) = R(i, j , k), where t' is the transposition ac. By Lemma 2, the basis B(i,j,k)(g) consists of the canonicalizations of t'(m'),
An Application of Quad
Arithmetic
271
where m' is in B(i',j',k')(g). Now let m be a basis monomial in B(i,j,k). We must show for closure that the canonicalization with respect to P4 of t(m) is in B{i, j , k), where t is the transposition be. All other permutations on 3 letters other than the identity are excluded from T(i, j , k) since they fail to map R(i, j , k) to a set with the degree type (i,j,k). By Lemma 2, there is a basis monomial m' in R(i',j',k') such that, after canonicalization with respect to p4, t'(m') is m. After noting that t t ' is the 3-cycle abc, we apply Remark 2 and find that the canonicalization of t(m) is that monomial obtained by the canonicalization of t3(m'), where t3 is abc. Now let t" be the transposition ab, and note that t3 = t't" in preparation for a second application of Remark 2. We thus obtain the fact that the canonicalization of t(m) is the monomial obtained from the canonicalization oft' applied to the canonicalization of t"(m'). But, by Lemma 1, the canonicalization of t"(m') is in B(i'j',k')(g). Therefore, by Lemma 2, the canonicalization of t' applied to the canonicalization of t"(m') is in B(i,j,k). Since m was arbitrarily chosen, the proof is complete. Finally, we have the result which is explicitly used in the inverted approach of Section 2.4—our approach to obtaining basis information for subspaces of the free Jordan ring on 3 letters. Corollary 2. For any given closing function g and any given (i, j , k), the set of monomials in R(i, j,k)(g)—B(i, j , k)(g) is closed under T(i,j,k). Proof. Note that t _ 1 is t itself when t is a transposition, and t _ 1 is tt when t is a 3-cycle. The proof is one by contradiction. Assume m is in R(i,j,k)(g) and is non-basis, while the canonicalization of t(m) is a basis monomial, where t is some permutation such that the degree type of t(R(i,j,k)) is (i,j,k). Now apply Corollary 1, Lemma 3, and Remark 2 to obtain the fact that m itself is in B(i, j , k), which is the contradiction.
5. Quad Arithmetic and the Identity E0 In this section we give an introduction to quad arithmetic—an arithmetic which plays an essential role in our attack on the structure problem for the free Jordan ring on 3 letters. The arithmetic is based on a surprisingly powerful identity, whose validity is proven in this section, which establishes relations among certain instances of the linearized Jordan identity. Recall that the approach herein to the structure problem takes the form of a set of subproblems, each of which requires the finding of a basis for a given V(i, j , k), where V(i, j , k) is the space spanned by the set of all monomials in TZ of type (i,j,k). In this inverted or unnatural approach, for which an overview is found in Section 2.4 and a detailed account in Section 3, each subproblem of V(i,j,k) is replaced by one for R(i,j,k)(g) for some closing function g. Although this replacement avoids, through reliance on closing functions and their properties, a number of the difficulties which may be
272
Collected Works of Larry Wos
encountered in basis finding, there still remains the serious problem of equational redundancy. Quad arithmetic is the mechanism which virtually eliminates the seriousness of this problem. Before turning to the treatment of quad arithmetic, the problem of redun dancy as it affects basis finding must be clearly understood. In the previous section, following the definition of "g-contained", one sees that all of the linear dependency among the monomials of R(i,j,k)(g), for some given (i,j,k) and some given g, can be found by examining a restricted set of instances of the LJI. For the given R(i,j,k)(g), one need only consider instances arising from the substitution of basis elements m i , m2, 1113, 014 respectively for w, x, y, z, where the coordinatewise sum of dt(m p ) with p = 1,2,3,4 equals (i,j,k), and where each of mi to m4 is a member of some B(i',j', k')(g). The implicit assumption here is, of course, that g is not actually a closing function but is in fact an initial segment of one. Thus, bases for R(i', j ' , k')(g) have been found for the sets g-contained in R(i,j,k)(g) having properties consistent with those required by closing functions. The object of the game, therefore, is to extend g, by finding an appropriate B(i, j , k)(g), in a fashion consistent with po to P7. The finding of a suitable B(i,j,k)(g), one which is a closed subset of R(i, j , k)(g), is made substantially easier by the elimination through P4 and ps both of commutative variants and of two important classes of redundant equa tions. A redundant equation is one which is linearly dependent on others present in the system—one whose contained information thus duplicates information available elsewhere. The first class to be eliminated is the set corresponding to instances of the LJI coming from a substitution for w, x, y, z in which not all of the m p are basis monomials relative to g. The second class consists of the relations coming from the g-contained sets which could then be appropriately multiplied by some monomial to make them possibly relevant to R(i, j , k)(g). In addition to this canonicalization for commutativity and distributivity, one further canonicalization, that for symmetry in the LJI, can be made to thus eliminate another class of redundant equations. This redundancy is illustrated by taking mi to n u as one set of four monomials to be respectively substituted for w, x, y, z in the LJI, and taking as a different set mi with m 2 to m 4 , where m 2 to m 4 are simply a permutation of ni2 to 1114. The corresponding two instances of the LJI yield identical linear equations after application of commutativity of addition and multiplication. This redundancy, coming from the symmetry in x, y, and z in the LJI, can be immediately eliminated by an ordering of monomials such as that which occurs with the use of closing functions or initial segments of closing functions. Unfortunately, even after elimination of the various types of redundancy de scribed above, there is still present much linear dependence among the remaining linear equations corresponding to the instances of the LJI, at least for the in teresting R(i,j,k)(g). In other words, for those interesting R(i,j,k), the matrix of remaining instances of the LJI is far from full rank. It is this phenomenon
An Application of Quad
Arithmetic
273
which motivates the interest in quad arithmetic. In this connection, we shall continue to refer to the unneeded equations as redundant equations to avoid conflict with the phrase "linearly dependent" occurring in the discussion of de pendency among members of R(i, j , k)(g). It is through quad arithmetic that the vast majority of these remaining redundant equations are identified and thus eliminated from consideration and without recourse either to substitution into the LJI or to any of the techniques for matrix manipulation. We now turn to the main discussion of quad arithmetic. For the remainder of this section let g denote either a closing function or an initial segment thereof. Definition. For a given closing function g or an initial segment of a closing function g, a quad q(g) is an ordered set (qi,q2,q3,q4) of four positive integers such that there exists four monomials mi to ni4 in the domain of g with respec tively q p = g(m p ), for p = 1,2,3,4. Put differently, a quad q(g) is an ordered set of four ordered pairs r n i , g ( m i ) , . . . ,ni4,g(m4). Definition. The degree type dt(q(g)) is the coordinatewise sum of dt(m p ) for p = 1,2,3,4, where q(g) = (qi,q2,q3,Q4) and g(m p ) = q p with p = 1,2,3,4. Definition. A quad q(g) = (qi,q2,q3,q4) is canonical if and only if both Q2 > q3 > q4 and m p for p = 1,2,3,4 is a member of some B(i', j ' , k')(g). Definition. The set QR(i, j , k)(g) for some (i, j , k) and some g consists of all q(g) such that q(g) is both canonical and of degree type (i, j , k). For each function g, there exists a companion function g* which maps the set of quads q(g) into the set of instances of the LJI. The function g* maps q(g) to the substitution instance of the LJI corresponding to the substitution of mi for w, ni2 for x, 1113 for y, and 1114 for z, where m p with p = 1,2,3,4 is such that g(m p ) = q p with q(g) = (qi,q2,q3iq4)- The mapping g* is clearly oneto-one. (Note that an instance of the LJI is not simply the equation obtained therein but is instead the equation coupled with its history. Thus, for example, an interchange of the values to be substituted for y and z yields two distinct instances of the LJI, when the values are unequal, even though the same linear equation is produced.) The most significant property immediately obtainable for g* is that g* maps QR(i,j, k)(g), for any given (i,j, k) and any given g, to that set of instances of the LJI which determine the dependency relations among the monomials of R-(i>J)k)(g)—those instances which remain after the elimination of the various classes of trivially redundant equations. As we remarked earlier, there exist among the equations corresponding to these remaining instances a large number of relations. Many of these relations are instances of a single identity Eo. The identity Eo can be said to act on instances of the LJI in a manner similar to that of the LJI itself on monomials.
Collected Works of Larry Wos
274
To understand the use of the identity Eo, first note that the simplest appli cation of the LJI can be generally described as follows. The LJI yields relations among the individual monomials where the monomials in any such relation pos sess certain characteristics in common. Before any additional substitution, the monomials in such a relation number six. They all have the same degree type. Their first and second factors are each determined by the assignment respec tively to w, to x, to y, and to z. For this simple application, one can summarize by stating that the linearized Jordan identity is an identity in four variables which relates six individual monomials. In the same spirit, Eo can be described as an identity in five variables which relates seven instances of the LJI. All seven instances have the same degree type, which makes Eo potentially useful in iden tifying occurrences of redundancy among sets of equations yielded by the LJI and being considered for a given R(i, j , k)(g). In general let q(mi,m2,m3,m4) be the expression, ((m 3 m4)nii)m2 + ((m2m4)mi)m 3 + ((m2m 3 )mi)m4 - (mim2)(m 3 m4) - ( m i m 3 ) ( m 2 m 4 ) - (mim4)(m 2 m 3 ), where mi, m2, m 3 , and n u are four given monomials. Clearly, q(mi,m2,m 3 ,m4) is closely related to an instance of the LJI, and in fact, by setting q(mi,m2,m 3 ,m4) equal to zero, one obtains that instance which is yielded by substituting mi for w, iri2 for x, m 3 for y, and 1114 for z. We therefore, as in Section 3, often identify the expression q(mi,m2,m 3 ,m4) with the corresponding instance of the LJI. The identity Eo is: q(m u m v ,m x ,m y ,m 2 ) = q(m y m z ,m x ,m u ,m v ) - q(m x ,m y m z ,m u ,m v ) 4q(m x m z ,m y ,m u ,m v ) - q(m y ,m x m z ,m u ,m v ) 4q(m x m y ,m z ,m u ,m v ) - q(m z ,m x m y ,m u ,m v ). First note that in Eo no assumption is made concerning the basis status of any of the arguments of any of the q's therein. Next note that the left side of the identity corresponds to an instance of the LJI in which the monomial to be substituted for w has degree greater than or equal to 2. Then note that the six expressions on the right of Eo naturally group into three differences. Each difference has the property that the two expressions therein have three terms in common but opposite in sign, which therefore cancel. These common terms occur because of the symmetry in w, x, y, and z on the right side of the LJI. These remarks now bring us to the proof of EoProof.
The left side of Eo evaluates to ((m y m z )(m u m v ))m x + ((m x m z )(m u m v ))m y + ((m x m y )(m u m v ))m z ((m u m v )m x )(m y m z ) - ((m u m v )m y )(m x m z ) - ((m u m v )m z )(m x m y ).
An Application of Quad
Arithmetic
275
Denote this expression by E(qo). In a similar manner, each of the six expres sions on the right side can be evaluated. After applying commutativity of both addition and multiplication, cancelling like terms, and collecting, the right side evaluates to E(q 0 ) + m u E(q 1 ) + m v E(q 2 ), where E(qi) and E(q2) denote expressions which we will show evaluate to 0. The first expression on the right side of Eo contributes to E(qi) the term (m v m x )(m y m z ) and to E(q 2 ) the term (m u m x )(m y m 2 ). The second expression on the right contributes — (((m y m z )m v )m x ) to E(qi) and -(((m y nij)m u )m x ) to E(q2). By completing the computation for the contributions to E(qi) from the third through the sixth expressions on the right side of Eo, we find that E(qi) is identical to the expression — q(m v ,m x ,m y ,m z ). Thus E(qi) is zero since subtracting the left side from the right of an instance of the LJI is zero. Simi larly, E(q2) equals zero since the right side minus the left side of the equation corresponding to — q(m u ,m x ,m y ,m z ) equals zero. The proof is complete. The value of Eo depends on both the ease of application and the frequency with which it establishes redundancy among equations. To apply Eo, one need merely factor certain monomials and multiply certain monomials. The frequency question, on the other hand, is more complex to answer in that it depends on the particular choice within R(i,j,k)(g) of the set N(i,j,k)(g)—that set whose complement in R(i,j,k)(g) will hopefully turn out to be a basis—and on the approach employed to finding the dependency relations among the members of R('.j.k)(g). The identity Eo very frequently yields information for us because of the use of Algorithm 1, given in Section 3, and because of the characteristics we often impose on the choice of basis (see Section 6). The identity Eo is in fact the basis for the quad arithmetic employed in Algorithm 2, also found in Section 3. Quad arithmetic modulo both the identity Eo and the function g is that procedure which finds, for any given set S of signed quads q(g), all sets S* such that S is contained in S* and such that the elements of S* all occur in a single instance of Eo and with the correct sign. If, for example, Si consists of the quads 4,2,2,1 and —(1,4,2,2), then S2 will complete Si to an instance of Eo by adjoining the quad (6,1,1,1). Quad arithmetic finds that S2 is an S* for Si and is the only such set. If the set S of quads for consideration contains too many members, for example, quad arithmetic yields no S* of the appropriate type. Thus, if the quad difference (4,2,2,1)-(1,4,2,2) is used to yield a dependency relation in R(3,2,0), then the quad (6,1,1,1) is redundant—the equation corresponding to the instance of the LJI will yield no additional information, where the instance is the correspondent of q(bb,a,a,a). Here the function g* comes into play. This last example is made more understandable by use of the table at the beginning of Section 2.5 and by examination of the algorithms of Section 3. This last example typifies the ideal outcome for the application of quad
276
Collected Works of Larry Wos
arithmetic. When a set S* completes S by the adjunction of a single quad or a single quad difference, and when all of S has already been accounted for as used, then the adjunction to S can be marked as redundant. Quads or differences may be termed used, for example, either by yielding an equation expressing monomial dependency or by being marked as redundant by a previous application of quad arithmetic. What can and does often happen is that a quad difference yields a dependency relation among monomials, which causes some other quad to be now known to be redundant by quad arithmetic, which in turn marks yet a new quad as redundant, . . . , which cascades for as many as 200 quads before coming to a halt. Thus g*, quad arithmetic, Eo, Algorithms 1 and 2, and the preferred class of bases combine to find the nontrivial occurrences of redundant equations en countered in finding bases for R(i, j , k)(g). The choice of the function g and of the identities upon which quad arithmetic is based can and do have a sharp effect on its usefulness.
6. Dimension, the Kernel, Conjectures, and Open Questions In this section we present the results obtained by use of the inverted or unnatural approach outlined in Section 2.4. That approach, based on the closing functions of Section 4 and quad arithmetic of Section 5, yielded answers to various open questions with surprising ease when compared to a straightforward approach. Although the results are given in terms of concepts appearing earlier in the paper, we shall supply at appropriate points a brief but hopefully adequate hint to convey the corresponding meaning in more familiar terms. One can therefore glean from this section alone the facts concerning the free Jordan ring 72. on 3 letters—the facts obtained by the study upon which this paper is based. On the other hand, if the intention is to apply the techniques herein to problems in other algebras by, for example, designing a computer program similar to that employed here, one must concentrate on Sections 2 and 3.
6.1. Results: Dimension, Bases, and the Kernel We begin with Table 2 which, for all subspaces of degree less than or equal to 9 of H, gives the dimension, the rank, the number of equations including those which are nontrivially redundant, the dimension of the kernel, and the time required to obtain the information. An equation is considered nontrivially re dundant if it cannot be discarded either by canonicalization for commutativity of multiplication, or by canonicalization for distributivity, or by canonicaliza tion for the symmetry in the LJI with respect to x, y, and z. To fully utilize this table, we recall the following. The subspaces of TZ. which are of natural concern are V(i, j , k), where V(i, j , k) consists of all finite sums with rational coefficients
An Application of Quad
Arithmetic
111
of all individual monomials of degree type (i, j , k). Each V(i, j , k) is studied by instead studying R(i,j,k)(g) for some closing function g. Each R(i,j,k)(g) is a subset of the corresponding V(i,j,k) consisting of individual monomials of de gree type (i, j , k) for which canonicalization both with respect to commutativity of multiplication and to distributivity have been applied. The dependency of R(i,j,k)(g) on a given closing function g reflects the fact that bases have al ready been chosen for so-called earlier subspaces. In particular, the elements of a given R(i,j,k)(g) are recursively products of monomials from already chosen bases. Since a basis for a given R(i, j , k)(g) is clearly one for the corresponding V(i,j,k), the dimension given in the table is that for either. Next under discussion is the column labeled rank. On the one hand, for a given (i,j,k), the rank plus the dimension gives the number of elements in R(i,j,k)(g). Although the functions g automate the various types of canoni calization, the particular choice therein has no effect on the cardinality of the R(i, j , k). On the other hand, the rank gives the number of linearly independent equations which must be found within the subspace under study—the equations expressing the dependent monomials solely in terms of the independent basis monomials. These equations are used to solve the basis problem for later spaces. For example, an iterative approach to the problem in which R(3,3,2) is the cur rent target relies on, among others, the dependency relations from R(3,2,2), R(3,2,l), and R(2,l,l). When the rank is considered in conjunction with the next object of discussion, the number of equation (quads), the seriousness of the problem of nontrivial equational redundancy becomes evident. An equation is nontrivially redundant if two properties hold for it. First, it must remain after the discarding of equations because of canonicalization for commutativity of multiplication, or canonicalization for distributivity, or canon icalization for symmetry in x, y, and z in the linearized Jordan identity. Second, it must be linearly dependent on others which remain after the canonicalizations just given. The number of remaining equations including those which are nontrivially redundant is that which is given in the table. This number, there fore, gives the number of quads, or equivalently the number of instances of the LJI, which must be considered in seeking a basis for a given R(i,j,k)(g). The relevant instances of the LJI are just those which are obtained by substitution for w, x, y, and z of only basis monomials whose degree types are commen surate with (i,j,k) and, of course, exluding those yielding obviously duplicate equations because of the x, y, z symmetry. Thus, from the viewpoint of linear algebra, the matrix from which the dependency relations among monomials are to be obtained is a q x p matrix, where q is the equational number in the table and p the sum there of the dimension and rank. For the next table entry, kernel dimension, recall the fact that there is a homomorphic mapping from the free Jordan ring 72. to the special Jordan ring. The kernel is that set of elements which is mapped to 0. It is well-known [2] that, if at least one of (i,j,k) is less than or equal to 1, then the subspace V(i,j, k) is mapped isomorphically to the corresponding subspace in the special Jordan
278
Collected Works of Larry Wos Table 2
Degree Type
(1,0,0) (2,0,0) (1,1,0) (3,0,0) (2.1.0) (1.1.1) (4,0,0) (3,1,0) (2.2.0) (2.1.1) (5,0,0) (4,1,0) (3.2.0) (3.1.1) (2,2,1) (6,0,0) (5,1,0) (4,2,0) (3.3.0) (4.1.1) (3.2.1) (2.2.2) (7,0,0) (6,1,0) (5,2,0) (4.3.0) (5.1.1) (4,2,1) (3.3.1) (3.2.2)
Dimension
1 1 1 1 2 3 1 2 4 6 1 3 6 10 16 1 3 9 10 15 30 48 1 4 12 19 21 54 70 108
Rank
0 0 0 0 0 0 1 2 2 3 1 3 5 8 11 2 6 12 15 19 34 48 2 8 20 30 34 76 96 140
Number of Equation (Quads)
Kernel Dimension
0 0 0 0 0 0 1 2 2 3 2 5 8 12 16 4 13 24 29 39 64 87 7 25 56 80 93 189 232 326
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Time (Sec.)
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 1 1 3 3 6
(8,0,0)
1
3
11
0
0
(7,1,0) (6,2,0) (5,3,0) (4.4.0)
4 16 28 38
12 34 60 73
46 118 196 232
0 0 0 0
0 1 2 4
201 480 713
0 0 0
2 8 18
(6.1.1) (5,2,1) (4,3,1)
28 84 140
58 154 240
(continued)
An Application of Quad
279
Arithmetic
Table 2 (continued) Degree Type
Dimension
(4,2,2) (3,3,2) (9,0,0) (8,1,0) (7,2,0) (6,3,0) (5,4,0) (7,1,1) (6,2,1) (5,3,1) (4,4,1) (5,2,2) (4,3,2) (3,3,3)
216 281 1 5 20 44 66 36 128 252 318 384 638 846
Rank
352 451 3 15 50 102 146 88 274 508 626 750 1193 1545
Number of Equation (Quads)
Kernel Dimension
Time (Sec.)
1011 1266
0 1 0 0 0 0 0 0 0 0 0 0 2 6
60 115 0 1 2 6 9 4 21 79 94 139 810 291
16 75 221 420 576 382 1063 1850 2224 2654 4037 5118
ring, and hence the dimension of the kernel in R(i,j,k) equals 0 when at least one of the triple is less than or equal to 1. The dimension in R(i, j , k)(g) of the kernel is the number of linearly independent elements which span the kernel therein. The elements are clearly sums of monomials. The final entry gives the time in seconds on an IBM 370/195 required by the program to find a basis for the subspace under study. A glance at Table 2 shows that the subspace of type (3,3,2) is the earliest which is not isomorphically mappable to the special Jordan ring. But, in view of Glennie's identity of degree 8 [1], what is new and interesting is the fact that the kernel in type (3,3,2) has dimension 1. Of added interest is the dimension of the kernel at type (4,3,2) and type (3,3,3). In type (4,3,2), two independent kernel elements exist—the one, of course, is a direct descendant of the kernel element from type (3,3,2) while the other is "new". In type (3,3,3) there are three new kernel elements in addition to the three which are descended from (3,3,2) and its permutation images of type (3,2,3) and of type (2,3,3). The representation of, say, the (3,3,2) kernel element, of course, depends on the choice of bases in a number of subspaces. Our preference among closing functions g, and hence among bases, has the (3,3,2) kernel element in the form a i ( m i - m i ) + a 2 ( m 2 - m 2 ) + . . . + 334(11134-11134), where m p and m' with p = 1,2,.. .,34 are individual monomials in B(3,3,2)(g) with nip equal to the transposition ab applied to mp. The coefficients a i , a 2 , . . . ,as
280
Collected Works of Larry Wos
equal 1; a6,a7,..., ai$ equal 2; ai 9 ,a 2 o, • • • ,a3o equal 4; a3i,a32,a33 equal 8; and a34 equal 12. The monomial are: mi m3 m5 m6 m8 m10 mi2 mi4 mi6 mis m19 m2i m23 m25 m27 m29 m3i m33 m34
= = = = = = = = = = = = = = = = = = =
((((bb)(aa))(cc))b)a (((((aa)a)b)(bb))c)c (((((bb)b)a)c)c)(aa) (((((aa)c)c)(bb))b)a (((((aa)c)c)(ba))b)b ((((bb)(aa))(cb))a)c (((((bb)c)a)c)b)(aa) (((((cc)a)a)b)a)(bb) ((((cc)(aa))b)a)(bb) ((((cc)(aa))b)b)(ba) ((((((cb)a)a)b)b)a)c ((((((ba)a)c)b)b)a)c ((((((bb)c)a)a)b)a)c ((((((aa)b)b)c)b)a)c (((((ca)(bb))b)a)a)c (((((aa)b)b)(ca))b)c ((((((cb)a)a)b)a)b)c {((((bb)(aa))c)b)a)c (((((cb)(aa))b)a)b)c
m 2 = (((((bb)a)b)(aa))c)c m 4 = (((((aa)b)a)c)c)(bb) m7 m9 "ii. m13 m15 m17
= = = = = =
((((cc)(bb))(aa))a)b ((((cc)(bb))(ba))a)a (((((cc)b)a)b)b)(aa) ((((cb)(aa))c)a)(bb) (((((bb)c)c)a)b)(aa) (((((bb)c)c)a)a)(ba)
m20 m22 m24 m26 m28 m30 m32
= = = = = = =
((((((ca)a)b)b)b)a)c (((((ca)(bb))a)a)b)c ((((((bb)a)c)a)b)a)c (((((ba)(ba))c)a)b)c (((((bb)a)a)(ca))b)c ((((ba)(ba))(cb))a)c ((((((bb)a)a)c)b)a)c
The choice of bases has an impressive effect on the accompanying arith metic. A poor choice, for example, in R(3,3,2) is accompanied by such badly behaved arithmetic, such as the occurence of huge coefficients, that one is pre vented from obtaining the apporpriate dimension and kernel information. Even with a good choice for a basis, during the intermediate computation the in tegers can be as large as 10 6 . The choice of basis also has a marked effect on the density of the final system of equations, where the density is the per centage of nonzero coefficients occurring in the set of relations which express dependent monomials solely in terms of basis monomials. In the space of type (3,3,2), for example, the density varies from 43 to 83 per cent. Fortunately, den sity and coefficient size are highly correlated. We therefore choose bases with both smaller density and smaller maximum coefficient. There is an additional arithmetic property which governs our choice and is discussed in the next sec tion in the first conjecture. These arithmetic properties clearly affect solvability but do not in general shed light on the structure of the Jordan ring %. There are, however, certain properties which are very exciting from the viewpoint of structure. The first property relevant to the structure of 7£ can be found with cer tain choices of basis. There exists a set of bases B(i,j,k) for the subspaces
An Application of Quad
Arithmetic
281
of TZ through degree 9 such that all of the dependency relations are of the form um = U i b i + u 2 b 2 + . . .+u n Dn, where u is a power of 2 and the b p with p = 1,2,.. .,n are members of some B(i,j,k). Thus, for any (i,j,k) with i + j + k < 9 , there exists an r x ( r + d ) matrix of linear equations whose leftmost r x r submatrix is a diagonal matrix with pow ers of 2 on the diagonal. In such a matrix, d is the dimension of the subspace in question and r the number of dependent monomials—the number of monomi als outside the basis which remain after canonicalization with respect to both commutativity and distributivity. The existence of these power of 2 systems establishes an important result for the free Jordan ring on 3 letters over a field of characteristics p ^ 2. Recall that, although the information was obtained by restricting the computation to the integers, the discussion to this point has been over the rationals as coefficients. Although the entire effort, which rests upon the use of closing functions, is for characteristic 0, we now know that the subspaces of degree less than or equal to 9 of the free Jordan ring on 3 letters over a field of characteristic p ^ 2 have the same dimension as those over a field of characteristic 0. For the next property of interest, we turn to the contrasting behavior of the subspaces of TL of even and odd degree. For each subspace of odd degree less than or euql to 9 which is isomorphic to its correspondent in the special Jordan ring, there exists a basis consisting of individual monomials m = mfm s such that all m s are of degree 1. There are certain subspaces of even degree which also have such a basis, for example, those of type (5,1,0) and (7,1,0). On the other hand, no such basis exists for the space of type (2,2,0) even though there are precisely four monomials with m s of degree 1 therein, and V(2,2,0) has dimension 4. Linear dependence is, of course, the obstacle. In fact many of the even degree subspaces do not have such a basis, among which appear to be those of type (4,2,0), (3,3,0), (2,2,2), and (4,2,2). (An exhaustive analysis has not yet been conducted for these spaces.) The extension of the basis property to odd degree subspaces not isomorphically mapped to the special Jordan ring also fails. There are simply not enough individual monomials m with m s of degree 1 to match the dimension of either V(4,3,2) or V(3,3,3), where in has the appropriate degree type. We next come to the property of TZ which relates the structure problem to the study of closing functions. For this discussion, recall the fact that the set T(i, j , k) consists fo those permutations on 3 letters which preserve degree type. Thus, T(3,3,2) consists of the identity and the transposition ab, T(4,3,2) of the identity alone, and T(3,3,3) of all of S 3 . Then recall that a basis B(i,j,k) of individual monomials is closed when, for all t in T(i, j , k ) , m is a member of B(i, j , k ) if and only if m' is, where in' and t(m) can be shown to be equal by simply applying commutativity of multiplication. The property of 7Z under discussion states that, for every subspace of 1Z of degree less than or equal to 9, there exists
282
Collected Works of Larry Wos
a closed basis. In terms of closing functions, we have the stronger statement that there exists a function g for which each B(i,j,k)(g) with i+j+k < 9 is a closed basis of R(i,j,k)(g), where g is an initial segment of a closing function. Although the function g is not itself a closing function in that it is not defined for all (i,j,k), g possesses the key properties of automating canonicalization of both commutativity and distributivity, well-ordering the appropriate set of monomials, and mapping that set into the positive integers. There are many choices for such mappings g into the positive integers, each of which yields, in view of the results of Section 4, a set of closed bases. Among the choices, there are a number which are consistent with the previous two properties. There are, for example, functions g which are initial segments through degree 9 of closing functions such that 1) the B(i,j, k)(g) with i + j + k < 9 are closed; 2) where the mapping from the free ring to the special Jordan ring is an isomorphism, for all m = mfm s in all B(i,j,k)(g) with (i+j+k) odd, m, has degree 1; and 3) the coefficient of the dependent monomial is a power of 2 for every rela tion expressing dependency in R(i, j,k)(g) in terms solely of members of B(i,j,k)(g). This composite result naturally leads to a number of questions and conjec tures, which brings us to the final section of the paper.
6.2. Conjectures and Open Questions Proofs of or answers to the following should contribute to the solution of the puzzle of the general structure of the free Jordan ring 72. on 3 letters. Each of the following is a natural item for consideration, especially since the unnatural or inverted approach has brought us this far. Recall that the inverted approach rests heavily on the use of closing functions which in turn forces bases to be closed. 1. For all (i, j , k), we conjecture the existence of a set of bases B(i, j , k) con sisting of individual monomials such that when the coefficients are restricted to the integers, all of the corresponding dependency relations for monomials which are canonicalized for both commutativity of multiplication and for distributivity are power of 2 relations. In other words, all relations are of the form pm = . . . , where p is a power of 2, m represents its class of commutative variants, m is recursively a product of basis monomials from the B(i, j , k) in question, m is not a member of any of the B(i,j,k), and the monomials to the right of the equality symbol are all members of a given B(i, j , k) for that relation. 1'. We conjecture that the dimension of each subspace of TZ consisting of finite sums of monomials of degree type (i,j,k), given (i,j,k), with rational coefficients is unchanged by the replacement of the field of rationals by a field of characteristic p ^ 2.
An Application of Quad
Arithmetic
283
2. For all (i, j , k), we conjecture that there exists a set of bases B(i, j , k) such that each B(i,j,k) is closed with respect to the subgroup of permutations on 3 letters consisting of those t with t((i,j,k)) = (i,j,k), those which are degree type preserving. 3. For all (i, j , k), we conjecture that there exist a closing function—a function g which satisfies properties po to p7 of Section 4. In fact we suspect that any of the initial segments gi which were employed during the investigation of 72 can be extended through any given (i, j , k) in a manner consistent with the demands of closing functions. If this is true, the inverted approach with the corresponding data structure of Section 2 can be used to study any given subspace of 72. 4. Where i > 2, are all subspace of type (i,2,2) isomorphic to their corre spondent in the special Jordan ring? We know from Table 2 that those of type (2,2,2), (3,2,2), (4,2,2), and (5,2,2) are mapped isomorphically. The dimension of V(5,2,2) was previously unknown. 5. For all subspaces of 72 which are of odd degree and which map isomor phically to the special Jordan ring, we conjecture that the set of canonicalized monomials m therein with m s of degree 1 forms a basis. Here, as expected, we mean canonicalized for both commutativity and for distributivity. In effect we are referring to the monomials m in some R(i, j , k)(g) such that the degree of m s equals 1. An even stronger conjecture appears to be true, namely, if the bases B(i, j , k)(g) have been chosen for all subspaces up to and including degree di for some initial segment g of a closing function, and if di is an even integer, then for each R(i',j',k')(g) with i'+j'+k' = d i + 1 which maps isomorphically to the special Jordan ring one obtains a basis by simply multiplying on the right by a or by b or by c those monomials that are both basis monomials relative to g and which are of degree dj. For example, if R(i',j',0)(g) is such a subspace, then xxxx multiplies by a the members of B(i' - 1, j',0)(g), and by b the members of B(i',j' - l,0)(g), and obtains a basis for R(i'j',0). We come now to the last conjecture which, as with 3 above, relates the study of closing functions to the structure problem for 72. Note that, by ap plying the results of Section 4, a proof of the third conjecture would yield a proof of the second. In particular, Corollary 1 of Section 4 states that all bases B(i,j,k)(g) relative to a closing function g are closed. Closed bases appear to force a connection of a quite special type between 72 and the special Jordan ring. This connection is given in 6 below. In this regard, first recall that a monomial m is fixed if and only if there exists a transposition t such hat t(m) and m can be shown to be equal with the application of commutativity. (An equivalent form of this concept is found in Section 3.1.) This definition can be extended in a natural way to the symmetric elements of the special Jordan ring. Some examples of symmetric elements are, abc+cba, acb+bca, aabb+bbaa, and aabbab+babbaa. The monomial (bb)(aa) is fixed, and it is fixed under ab. The first three symmetric elements are also fixed, but the last is not. If one applies to
284
Collected Works of Larry Wos
each of the first three respectively the transpositions ac, ab, and ab, one simply obtains the same three elements if commutativity of addition is applied. For the fourth symmetric element, one applies ab, and obtains after canonicalization for commutativity of addition the symmetric element abaabb+bbaaba. Since ab is the only possible transposition which can possibly fix the fourth symmetric element, that symmetric element is said to be paired. Similarly, the monomial ((aa)b)b is a paired monomial. Finally, we recall the fact that the symmetric elements of a given degree type are a basis for the corresponding subspace of the special Jordan ring, which brings us to the conjecture. 6. If B(i,j,k) is a closed basis consisting of individual monomials for the subspace V(i, j , k) of TZ, and if V(i, j , k) is isomorphic to the corresponding subspace of the special Jordan ring, then we conjecture that the number of fixed and paired monomials in B(i, j , k) must be the same as that in the basis of sym metric elements for the correspondent of V(i, j , k). For clarity here, consider the subspace for the symmetric elements of type (2,2,2). The symmetric element aabbcc+ccbbaa is fixed under ac and not under ab or be. It is, however, classed as fixed. The paired elements are those which are not fixed under any transposi tion. The symmetric elements of type (2,2,2) are partitioned into the fixed and paired classes with 18 fixed and 30 paired. The closed bases which have been studied for R(2,2,2)(g), and hence for V(2,2,2), are such that each consists of 18 fixed and 30 paired monomials. In conclusion, since there exist many functions g through degree 9 which behave like closing functions and which, therefore, yield closed bases, it appears that there exist functions which can be extended through degree di in a manner consistent with properties po to P7 for any arbitrarily chosen positive integer di. Further, it appears that, among the sets of closed bases, there exist many which simultaneously satisfy where meaningful the conjectures above. For example, there appear to be many which match the fixed and paired count property of 6 and at the same time satisfy the power of 2 property of the first conjecture and the requirement for bases of the appropriate subset of the set of odd degree subspaces of 5.
Acknowledgments We wish to thank Dr. J. Marshall Osborn of the Mathematics Department of the University of Wisconsin for this suggestion of studying the free Jordan ring on 3 letters with the aid of a computer. We wish to to thank him also for his assistance with certain technical details of the paper. We then wish to thank in chronological order the following individuals for various contribu tions. Mr. William J. Snow programmed the first version of the approach taken herein, and it was partly at his instigation that symbolic representation was
An Unnatural Attack on the Structure
Problem
285
replaced by integral representation. Dr. Joseph H. Mayne provided us with a useful formula for evaluating determinants related to the regular representation of S3. Mr. Michael Tubin programmed a number of the subroutines contained in the present system and in general contributed to program efficiency. Mr. Robert Veroff designed and implemented the programs which were instrumen tal in obtaining the results for the kernel. Mr. Joseph Glover contributed to the technique for choosing uniformly structured bases. We wish also to thank Miss Judy Beumer for the preparation of this lengthy manuscript. This work was performed under the auspices of the U.S. Energy Research and Development Administration.
References [1] C. M. Glennie, Some identities valid in special Jordan algebras but not valid in all Jordan algebras, Pacific Journal of Mathematics, Volume 16, Number 1, 1966. [2] N. Jacobson, Structure and representations of Jordan algebras, Amer ican Mathematical Society Colloquium Publications, Volume 39, 1968, pp. 40-49. [3] D. E. Knuth, The art of computer programming, volume 3, sorting and searching, Addison-Wesley, 1973. Applied Mathematics Division Argonne National Laboratory Argonne, Illinois 60489
AUTOMATED GENERATION OF MODELS A N D COUNTEREXAMPLES A N D ITS APPLICATION TO O P E N QUESTIONS IN T E R N A R Y BOOLEAN ALGEBRA*
Steve Winker Research Associate Northern Illinois University DeKalb, IL 60115
L. Wos Applied Mathematics Division Argonne National Laboratory Argonne, IL 60439
Abstract The thrust of this paper is: first, to answer certain previously unanswered questions in the filed of Ternary Boolean algebra; second, to describe the method, utilizing an automated theorem-proving program as an invaluable aid, by which these answers were obtained; and third, to informally give the characteristics of those problems to which the method can be successfully applied. The approach under study begins with known facts in the form of axioms and lemmas of the field being investigated, Finds by means of certain specified inference rules new facts, and Continues to reason from the expanding set of facts until the problem at hand is solved or the procedure is Interrupted. The solution often takes the form of a finite model or of a counterexample to the underlying Conjecture. The model and/or counterexample is generated with the aid of an already ex isting automated theorem-proving procedure and without any recourse to any additional programming.
1. I n t r o d u c t i o n In this paper we give a procedure which in part complements the ongoing effort of using computers to find mathematical proofs. The procedure is used to automatedly generate finite models of various mathematical theories and/or Finite counterexamples to conjectures (for more details refer to a paper submit ted for publication 8 ). The ability to thus generate models and counterexamples "Work performed under the auspices of the U.S. department of Energy and NSF grant MCS77-0273. Reprinted, with permission, from the Proceedings of the Eighth International Symposium on Multiple-Valued Logic, Rosemont, 111, May 1978, IEEE (NY, NY) and ACM (NY, NY), pp. 251-256.
Automated
Generation of Models and
Counterexamples
287
when combined with an automated theorem-proving program provides one with the more effective attack on Certain open questions in mathematics and logic. We invite the submission for consideration of such open questions as those an swered in section 2 and Of those informally classified in section 4. Such new problems are of value in the development, extension, and refinement of the Ap proach under discussion, and there is, of course, the carrot that some of them may be thus solved. This in fact was the case for those problems in the filed of Ternary Boolean algebra which were considered And treated with the procedure under investigation. The organization of the paper is as follows. In section 2, Ternary Boolean algebras are defined, the previously open questions are stated, and answers Are given including certain key models and lemmas. In section 3, the procedure for generating models is discussed. It is here we give both the language in which the problems must be stated and the underlying inference rules which generate additional facts and permit validation of the models. Finally, in section 4 we discuss the kinds of problems and fields of mathematics which are most amenable to the approach of section 3. We conclude the section with the following summary. The proofs of the vari ous lemmas and the models and counterexamples given here were obtained with extensive use of an automated theorem-proving program 5>6.9.10. No additional programming was required to obtain our results, nor would Any be necessary to attack similar open questions. Since, in addition to model generation, the Approach herein can be used for deductive reasoning, it may be of use in areas other than mathematics.
2. Ternary Boolean Algebras: T h e Solution t o S o m e O p e n Questions A Ternary Boolean algebra 4 is a set S together with a Ternary function f and a unary function g which, for all elements in S, satisfy: (1) f(f(v,w,x),y,f(v,w,z)) = f(v,w,f(x,y,z)) (2) f(y,x,x) = x (3) f(x,y,g(y)) = x (4) f(x,x,y) = x and (5) f(g(y),y,x) = x. On natural question to be asked is: Of the five axioms defining a Ternary
288
Collected Works of Larry Wos
Boolean algebra, which (if any) among them are dependent on the remaining? Chinthayamma 3 announced in 1969 without proof that axioms 4 and 5 were dependent on the subset consisting of 1, 2, and 3. This left open the question of which of the remaining proper subsets of the five axiom set are strong enough to define a Ternary Boolean algebra. Then, for each subset, U, which is too weak, one can ask: What are the more interesting properties of U, ad what is the cardinality of the smallest model which satisfied U and simultaneously fails to satisfy the remaining of the five axioms which define a Ternary Boolean algebra? The answer to the foregoing can be thus summarized. The most important fats, obtained with the procedure discussed in section 3, are the following. Let T be the set if the five defining axioms, Ui be obtained from T by the omission of axiom 1, U2 by the omission of axiom 2, And U3 by the omission of axiom 3. There are models, exhibited later in this section, showing that each of Ui, U2, and U3 is insufficient to define a Ternary Boolean algebra. Equivalently, axioms 1, 2, and 3 are each independent of the remaining four axioms in T. Next, one can show that in U2, f(g(g(x)),x,y) = g(g(x)) for all x and y. In U3, f(x,g(x),y) = y for all x and y. Axioms 1 and 4 together imply that f(x,y,x) = x. In T, g(g(x)) = x and finally, from axioms 4 and 5 one can show that, if there exists an element a in the set under consideration such that g(a) = a, then the set consists of just a. Since the establishment of assertions of the type just given reduces the work required to generate the appropriate models, we turn to their proof. The last of the assertions can be seen from x = f(g(a),a,x) = f(z,a,x) = a for any x. That f(x,y.x) = x in the presence of 1 and 4 can be seen by simply setting v = w in 1. Next, we see that g(g(x)) = x when all of T is present by setting in axiom 1, w = x, v = g(g(x)), y = z = g(x), and applying 2 and 3. (It should be noted that the program employed by the procedure section 3 does not find this and similar proofs by considering all or various substitutions in to the various axioms. Instead, selection s from the axioms ad derived facts are made and presented to the inference rules which then in turn make a deduction with an emphasis on generality. Then a subprocedure is invoked which compares the "new" result with those already retained. The procedure will purge, for example, a deduction D' in factor of D, regardless of which is newer, when D is more general than D'. Returning to the assertions to be proved, we have U2 implies f(g(g(x)),x,y) = g(g(x)). In axiom 1, just set x = y = g(w), and v = g(g(w)), and apply 3, 4, and 5 to get an alphabetic variant of the desired result. f
Finally, the following six-step proof shows that one can prove from U3, (x,g(x),y) = y.
Automated
Generation of Models and
Counterexamples
289
Proof. f(f(v,g(v,g(v),x),x,v) = f(v,g(v),x) from the substitution into axiom 1, respectively for v,w,x,y.z of v,g((v),x,x,v, and from applications of f(x,y,x) = x and axiom 4. f(f(v,g(v),x)v,x) = f(v,g{v),x) from the substitution into axiom 1 respectively of f(v„g(v),x),x,v,v,x, and applications of the previous step and of axiom 2 and axiom 4. f(f(v,w,g(w)),w,v) = v from substitution into axiom 1 of v,w,g(w),w,v, and applications of f(x,y,x) = x and axiom 5. f(w,g(w),f(v,w,g(w))) = f(v,w,g(w)) from the substitution into axiom 1 of v,w,w,g(w),g(w), and ap plications of axiom 2. f(f(v,g(v),x),x,f(x,v,g(v))) = f(v,g(v),x) from the substi tution into axiom 1 of v,g(v),x,x,f(x,v,g(v)), and applications of axiom 4 and of the previous step. Finally, f(v,g(v),w) = w from the substitution of axiom 1 of f(v,g(v),w),w,f(w,v,g(v)),v,w, and applications of axiom 2 and steps 3, 5, and 2, which completes the proof. Thus we have completed the proofs of the various assertions given above, and we can now turn to the direct consideration of the question of axiom dependence for Ternary Boolean algebras. As stated earlier, the facts are that axioms 4 and 5 are dependent on the remaining three, but none of axioms 1, 2, or 3 is dependent on the other four. Ekjuivalently, the only subsets of the given set of five axioms defining a Ternary Boolean algebra which are strong enough for the definition are those subsets which contain at least axioms 1, 2, and 3. First, to see that axiom 1 is independent of the others, merely consider the three-element model, consisting of a, b, and c, with g(g(g(x))) = x, g(a) = b, g(b) = c, f(a,b,a) = b, f(b,c,b) =c, f(c,a,c) = c, and all of the triples satisfying axioms 2 through 5. The substitution into axiom 1 respectively for v,w,x,y,z of a,b,c,c,a respectively yields a = b, which shows that axiom 1 does not hold. Next we establish the independence of axiom 2. Consider the model consist ing of the three elements, a, b, and c uch that g(g(g(x))) = x for all x, g(x) not equal x for all x, g(a) = b, f(x,x,y) = x for all x and y, f(g(y),y,x) = x for all x and y, And f(g(g(x)),x,y) = g(g(x)) for all x and y. First note that g(b) = c and g(c) = a. Then, by a tedious examination of all triples, one can verify that axioms 1, 3, 4, and 5 hold. The violations of axiom 2 are three instances of f(g(g(x)),x,y = g(g(x)), namely, f(z,b,b) = a and f(b,c,c) = b and f(c,a,a) = c. (Before turning to the final dependency question and then to the question of minimal counterexamples, we make the following observations which are impor tant to the understanding of the procedure by which the results were obtained.) The procedure of section 3 does the tedious checking of the various triples re quired to validate the proposed model. One phase of the process is the check for consistency. For example, in the just-given model one could evaluate f(a,a,b) with axiom 4 or with axiom 3. In both choices the same value must be obtained. Also note that the model is not presented to the procedure by means of precisely those equalities given in the previous paragraph, but rather by a set which in cludes the axioms to be satisfied. The other equalities are derived and used to
290
Collected Works of Larry Wos
narrow the search for the desired model or counterexample. Now to establish the independence of axiom 3, just replace in the previous three-element model the requirement of f(g(f(x)),x,y) = g(g(x)) with the re quirement of f(x,g(x),y) = y. Axiom 2 will now hold since, for example, f(a,b,b) = b by the new equality. On the other hand, axiom 3 is now violated for the value of three triples has changed. The three violations are f(a,b,c) =c, f(b,c,a) = a, and f(c,a,b) = b from the new equality. (For the interest of the reader, axioms 4 and 5 may be proved from axioms 1, 2, and 3 as follows. The proof that g(g(x)) = x depends only on axioms 1, 2, and 3. Substitute g(g(x)) = x in axiom 1 and apply 2, 3, and g(g(x)) = x to yield 4. Substitute x,g(y),g(y)),g(g(y)) in 1 and apply 2, 3, and g(g(x)) = x to yield 5.) The final question, that of minimality for the counterexamples to axiom dependency, an be settled with the following argument. For two-element models, either there exists an x with g(x) = x, or g interchanges a and b. The first possibility is eliminated by a earlier remark, i.e., the presence of axioms 4 and 5 would force then a = b to be true. For the second possibility, axiom 5 forces f(b,a,a) = a and f(a,b,b) = b, which says that axiom 2 holds. Also in this case, axiom 5 forces f(z,b,a) = a and f(b,b,a) = b, while axiom 4 forces f(z,a,b) = a and f(b,b,a) =b, which says that axiom 3 holds. A similar analysis shows that axiom 1 also holds in this case. So the smallest counterexample to the dependence of 1, 2, or 3 consists of three elements. Returning to the discussion of the models themselves, we illustrate a some what different use of the procedure of section 3. The problem for consideration is the generation, if such exists, of an asymmetric three-element model of U2. The specific objective is that of determining whether or not any three-element models exist satisfying axioms 1, 3, 4, and 5, violating axiom 2, and with g not an onto mapping. There are two such models. In each we have g(g(g(x))) = g(x), g(») = b, g(b) = c, g(c) = b, f(x,x,y) = x, f(g(y),y,x = x, and f(x,y,x) = x And f(g(g(x)),x,y = g(g(x)); also f(a,c,c) = a (substitute a,c,b,a,c in axiom 1 and apply 3, 4, and 5). They differ in that in one, f(z,b,b) = b while in the other f(z,b,b) = a. In both the violations of axiom 2 are f(c,a,a) = c and f(a,c,c) = a. Examination of the various substitutions shows that axiom 1 holds for both models. When the problem for the previous paragraph is replaced by the correspond ing one for U3, we find that there is by one asymmetric model of 1, 2, 4, and 5 violating axiom 3. The model is quite like that which was just given except that axiom 3 is replaced by axiom 2, f(g(g(x)),x,y) = g(g(x)) is replaced by f(x,g(x),y) = y, f(a,c,b) = b, and f(c,a,b) = b. The last two equalities are, of course, the violations of axiom 3.
Automated Generation of Models and Counterexamples
291
The above models are the only three-element models of U2 and U3 violating axioms 2 and 3, respectively. First, observe that there are only two possibilities for the effect of g on three elements: the "symmetric" and the "asymmetric" pos sibilities given above (g(x) cannot be x for any x as noted previously). Secondly, the possibilities for values of f not given above are eliminated by contradictions to axiom 1 which were found by use of the program.
3. The Main Procedure for Generating Models
Since the presentation in subsections 3.1 to 3.6 is brief and somewhat intu itive. we have included an example in 3.7 to aid one's understanding of the basic procedure and of the various underlying concepts. The example illustrates the iterative nature of our procedure. Its development in part parallels the mathe matical treatment of section 2, and illustrates the method employed to obtain one of the asymmetric models of U2 given there. 3.1 Overview The main objective is the development and implementation of a more com plete procedure for attacking open questions in mathematics and logic. It is important, in the treatment of such questions, to have a procedure for gen erating models and counterexamples. Such a procedure, based on an existing automated theorem-proving program, is the focus of attention in this section. For the side of the problem concerned with finding proofs for "true" theorems, there exist computer programs in various stages of development whose objective is that of proof finding. The proofs so obtained are usually ones by contradic tion. In general, one begins with a set of statements, some of which correspond to axioms and lemmas while others correspond to the denial of the theorem to be proved, and continually applies rules of inference until the unsatisfiability of the set of statements is established. What is missing from such programs is an automated treatment of the other side of the problem, namely, the estab lishment with the aid of the computer that a desired result does not hold. Put. differently, when the given set of statements is satisfiable, one would like to have a procedure which generates a counterexample to the purported theorem. Al though the fundamental theorems for the first-order predicate calculus prevent us from having a decision procedure, we have been able to establish that certain results are non-theorem and thus answer certain previously open questions as those of section 2. With the object of automatedly generating models, we turn to a brief de scription of the various components.
292
Collected Worts of Larry Wos
3.2 The Language The chosen language, employing the clause representation,2 is one which is closely related to the extended first-order predicate calculus.2 The equality sym bol (predicate) is thus treated as a special symbol with its meaning "built-in." All variables and all given and inferred statements are (implicitly) assumed to be universally quantified. The existentials have been replaced by skolem functions,2 functions of the appropriate universally quantified variables on which the ex istentials depend. The ensemble of statements is (implicitly) assumed to be in conjunctive normal form - there is an implicit "and" between pairs of statements, and implicit "or" between the elements of each statement. 3.3 The Inference Rules Although the procedure has access to a number of inference rules, the two most frequently employed are respectively generalizations of equality substitu tion and of modus ponens. The first rule, called paramodulation, 9 takes clauses (statements) in pairs and attempts to substitute from one into the other. A substitution occurs if and only if a common domain of definition can be found for on e of the arguments of the "from" clause and for a term in the "into" clause. The "from" clauses must be the correspondent of some given statement on the term into which the substitution takes place. For further clarification and also to see that we are employing a generalization of equality substitution, note that paramodulation in one inference step takes the pair of statements (clauses), finds when possible a most general replacement of the variables (universal in stantiation) in both which will permit a straightforward application of equality substitution, and applies an equality substitution rule to the instantiated pair. As for the other main rule, called hyperresolution,7 the following cursory de scription may suffice. The rule takes a set, Ql, Q2, ..., Qn, of positive assertions, an "if-then" statement of the form Q'i & Q' 2 & Q V —► R; finds (where possible) a most general variable replacement to simultaneously apply to the Q/ and Q'j which permits a modus ponens type inference, and then makes that inference form the thus instantiated clauses. There is the additional requirement that R be positive. 3.4 Usage No programming is required of the individual who intends to use the proce dure as an aid in answering questions. What is required is the preparation of the problem in one of two forms. The procedure itself accepts problems in the clause forms discussed in 3.2 Recall that one is therefore using a conjunctive normal form in which the variables that appear are implicitly universally quan-
Automated Generation of Models and Counterexamples
293
tified, the existentials have been Replaced by appropriate skolem functions, and an implicit "and" occurs between clauses while an implicit "or" occurs between the literals of a clause. For example, the clause equivalent of that axiom which states that the nonzero elements of a filed possess a multiplicative inverse con sists of the two clauses, EQUAL(X,0) EQUAL(F,H(X),X),l) and EQUAL(X,0) EQUAL(F(X,H{X)),1), where F denotes product and H inverse and 1 the mul tiplicative identity. (There are other valid clause encodings of this axiom.) The scope of universal quantification is just that single clause, i.e., an occurrence of the variable "X" in two clauses does not mean the "same" variable. So one can submit the problem directly to the main procedure by encoding it in clause form. On the other hand, if one finds such an encoding difficult or inconvenient, one can instead choose to represent the problem in the first-order predicate calculus. There is no requirement, in such a choice, of using prenex form and no restriction on the use of the various boolean connectives. The availability to the user of the first-order representation is due to the existence of a system, called TAMPR,1 designed and implemented at Argonne National Laboratory. RAMPR, although designed for program transformations of a different type, will take the problem in its first-order form and produce the clauses with appropriate replacement of existentials by function. 3.5 The Procedure Itself We choose to slant our description toward the informal and intuitive. The procedure can be said to be divided into a number of phases from which the user can choose any or all. There is the lemma generation or fact finding, the counterexample and/or model building, the validation of the computed coun terexample and/or model. Thus, despite the bias that may exist when consid ering t a particular open question, the procedure may succeed in proving the corresponding purported theorem or may instead generate a counterexample. It is the second of these alternatives (in the closely related area of generating models for consistent axiom systems) on which we concentrate. The approach is at present one of iteration in which one begins with a set of statements which may include axioms, lemmas, and various conjectures about the definition or structure of the sought-after counterexample or model. (Throughout the rest of this subsection we make no distinction between "coun terexample" and "model.") One then makes a series of computer runs with the intention of appropriately adding to and/or deleting from the original input set. Additions are either lemmas which were not already present of "promising" extensions to the definition of a model. The validity of any of the former can be established by examining its proof tree to show that only already-proven theorems are relied upon, while validity of various of the latter may remain in
294
Collected Works of L&rry Wos
question until the model is completed because of reliance on other conjectured conditions. (The derivation information is included in the computer output oi each run.) Deletions, on the other hand, are usually the result of detecting in consistency in the conditions defining the model. Inconsistency is signalled by the deduction of "contradiction" by the program. Such deletions often cause a fair amount of backtracking because of the corresponding necessity of making new conjectures about the structure of the model, and this may in turn require duplication of earlier runs but with, of course, the new conjectures. Thus the additions and deletions made by the user in earlier runs in part determine the nature of later runs. One of the nice features of our procedure is that these computer experi ments are accomplished with the aid of an existing automated theorem-proving program and require no additional programming. Each experiment or run is terminated either by exceeding memory or time, or by having made all possible new inferences, or deducing contradiction. The second termination condition occurs either when the model has been both successfully completed and validated or when the model is partially spec ified by no inconsistencies exist therein. One can differentiate between the two cases by simply examining the computer output. The third termination con dition signals model inconsistency or proof of the theorem thus answering the open question under study. Examination of the proof is sufficient to determine which is the case. Finally, the first termination condition can occur with any use in any phase of the procedure. For each of the phases of the procedure (listed at the beginning of this sub section), the following remarks in general hold. Lemmas are found through use of the inference rule, paramodulation, which is a generalization of equality sub stitution (see 3.3). New information is checked against that already present, and the more general fact is retained and the less general purged. Both the building and validation of the model are accomplished through application of hyperresolution, a modus ponens-like rule discussed also in 3.3. The rejection of the model being developed is through a combination of inferences from paramod ulation and from hyper-resolution. And finally, the proofs of theorems may be obtained from various inference rules, but paramodulation is often the most successful. 3.6 Applications The procedure under investigation has been used to generate the multi plication table for various semi groups, for successfully searching for models establishing the correctness of certain conjectures, to generate counterexamples and thereby refute various possible axiom dependencies as in section 2, and for
Automated Generation of Models and
Counterexamples
295
finding proofs for various theorems as also given in section 2. All models and axiom sets considered so far have been of small cardinality. 3.7 A n E x a m p l e of Our P r o c e d u r e Some of the automated theorem prover runs made in searching for one model of U2 are listed below to indicate the degree of our reliance on the computer. As might be expected, the search includes tests which appear inconclusive or unnecessary in retrospect. 1. Paramodulation runs proved TBA axioms 4 and 5 from axioms 1, 2, and 3, and incidentally derived g(g(x)) = x from axioms 1, 2, and 3. 2. A paramodulation run attempting to prove axiom 2 from axioms 1, 3, 4, and 5 proved neither axiom 2 nor g(g(x)) = x. Incidentally, f(x,y,x) = x was derived. The failure to prove axiom 2 motivated the search for a counterex ample. The fact that g(g(x)) = x was not derived suggested that a model violating g(g(x)) = x be attempted. Such a model would necessarily violate axiom 2. It could be based on one generator (an a for which g(g(a)) ^ a) rather than two (an a and b for which f(b,a,a) ^ a), possibly requiring fewer elements, fewer defining relations, and less computer time for verification,
3. Paramodulation run seeking consequences of axioms 1, 3, 4, and 5, in con junction with g(g(g(x))) = g(x), g(f(x,y,z)) = f(g(x),g(y), g(z)), and f(x.y.z) = f(x,z,y). Axiom 2 was not proved, but the last equality with axioms 3 and 5 yielded g(g(x)) = x. Because a model with g(g(a)) / a was being sought, the last equality was not used for subsequent models. The possibility that g(g(g(x))) = g(x) might imply g(g(x)) = x was not tested at this time.
4. A paramodulation run deriving consequences of axioms 1, 3, 4, and 5, in conjunction with g(f(x,y,z)) = f(g(x),g(y),g(z)) and f(a,x,g(g(a))) = a, derived no undesirable consequences. The latter equality was suggested by an examination of the proof of g(g(a)) = a from axioms 1, 2, and 3. This proof used the instance of
296
Collected Works of Larry Wos axiom 2, f(a,g(g,a)),g(g(a))) = g(g(a)); if this term had the value a instead, g(g(a)) = a would not be proven. f(a,x,g(g(a))) = a gener alizes the second argument of f.
5. Partial-model run in which values for f(a,c,c), f(c,a,a), and f(a,b,b) had not yet been determined. (Here b and c refer not to generators but to g(a) and g(g(a))-) 6. Partial-model runs in which the value for f(a,c,c) had not yet been determined. 7. Model validation run verifying the first asymmetric model of section 2.
4. Requirements for New Problems The submission of problems for consideration by the procedure described in this paper is most welcome. To be admissible, such problems must be representable in the first-order predicate calculus. If the object is the generation of a counterexample or model, there is the assumption that one of small finite cardinality will suffice. On the other hand, if the object is the finding of a proof for a purported theorem, we only require a statement of the theorem and a set of axioms characterizing the field from which the theorem is taken. In addition, we find value in having a list of the important lemmas of the field. Among those areas whose open questions may be most amenable to attack with the automated procedure are the theory of semi groups, elementary group theory, ring theory, the theory of Ternary Boolean algebras, Boolean algebra, and Tarskian geometry. For the type of question, one might consider, for ex ample, questions concerned with the equivalence of axiom systems, questions about the existence of certain mappings, and questions of axiom dependency. On the other hand, phrases such as "for all integers n" and "for all functions f" strongly suggest the lack of an appropriate mechanism to handle the question. We conclude by remarking that consideration of open questions and problem s of the type just discussed should, when subjected to treatment by computer programs of the type underlying this paper, lead to the alternation of the solu tion of some problems followed by the development of more successful automated procedures followed by the solution to others ....
Automated Generation of Models and
Counterexamples
297
References 1. Boyle, J. and Matz, M., Automating Multiple Program Realization, Pro ceedings of the Symposium on Computer Software Engineering, Polytech nic Press, New York, 1976, pp. 421-456. 2. Chang, C. L. and Lee, R. C. T., Symbolic Logic and Mechanical Proving, Academic Press, New York, 1973.
Theorem
3. Chinthayamma, Sets of independent axioms for a ternary Boolean algebra (preliminary report), Notices of the Amer. Math. Soc, Vol. 16, No. 4, June 1969, p. 654. 4. Grau, A. A., Ternary Boolean Algebra, Bulletin of Amer. Math. Soc, Vol. 16, No. 4, June 1969, p. 654. 5. McCharen, J. D., Overbeek, R. A., and Wos, L., Problems and Experi ments for and with Automated Theorem-Proving programs, IEEE Trans actions on Computers, Vol. C-25, No. 8, August 1976, pp. 773-782. 6. Overbeek, R. A., An implementation of hyper-resolution, Comput. AppL, Vol. 1, 1975, pp. 201-214. 7. Robinson, J. A., Automatic Deduction with Hyper-resolution, tional Journal of Computer Math., Vol, 1, 1965, pp. 227-234.
Math. Interna
8. Winker, Steve, Generation and Validation of Finite Models and counterex amples using an Automated Theorem Prover, submitted for publication. 9. Wos, L. and Robinson, G. A., Paramodulation and Set of Support, Proc. IRIA Symposium on Automatic Demonstration, Versailles, France (1968), Springer-Verlag, 1970, pp. 276-310. 10. Wos, L., Robinson, G. a., Carson, D. F., and Shalla, L., The concept of demodulation in Theorem proving, J. Assn. Comput. Mach., Vol. 14, 1967, pp. 698-709.
HYPERPARAMODULATION: A REFINEMENT OF PARAMODULATION*
by L. Wos, Argonne National Laboratory, Argonne, IL R. Overbeek, Northern Illinois University, Dekalb, IL L. Henschen, Northwestern University, Evanston, IL
Abstract A refinement of paramodulation, called hyperparamodulation, is the focus of attention in this paper. Clauses obtained by the use of this inference rule are, in effect, the result of a sequence of paramodulations into one common nucleus. Among the interesting properties of hyperparamodulation are: first, clauses are chosen from among the input and designated as nuclei or "into" clauses for paramodulation; second, terms in the nucleus are starred to restrict the domain of generalized equality substitution; third, total control is thus iteratively estab lished over all possible targets for paramodulation during the entire run of the theorem-proving program; and fourth, application of demodulation is suspended until the hyperparamodulant is completed. In contrast to these four properties which are reminiscent of the spirit of hyper-resolution, the following differences exist: first, the nucleus and the starred terms therein, which are analogous to negative literals, are determined by the user rather than by syntax; second, nu clei are not restricted to being mixed clauses; and third, while hyper-resolution *This work was funded by the Applied Mathematical Sciences Program of the Office of Energy Research, U. S. Department of Energy and supported in part by the National Science Foundation under grants MCS-7903870 and MCS-7913252. Reprinted, with permission from Springer-Verlag, from the Proceedings of the Fifth Conference on Automated Deduction, Vol. 87, Lecture Notes in Computer Science, ed. Robert Kowalski and Wolfgang Bibel, Springer-Verlag, New York, pp. 208-219 (July 1980).
Jfyperparamoduiation; A Refinement of
Paramodulation
299
requires inferred clauses to be positive, no corresponding requirement exists for clauses inferred by hyperparamodulation. To illustrate the value of this refinement of paramodulation, we have chosen certain conjectures which arose during the study of Robbins algebra. A Robbins algebra is a set on which the functions o and n are defined such that o is both commutative and associative and such that for all x and y the following identity n(o(n(o(x,y)),n(o(x,n(y))))) = x holds. One may think of o as union and n as complement. The main interest in such algebras arises from the following open question: if S is a Robbins algebra, is S necessarily a Boolean algebra? The study of this open question entailed heavy use of an automated theorem-proving program to examine various con jectures. Certain computer proofs therein were obtained only after recourse to hyperparamodulation. (These lemmas were actually obtained prior to the work reported on here by Winker and Wos using a non-standard theorem-proving approach developed by Winker.)
S e c t i o n 1. I n t r o d u c t i o n In this paper we discuss the inference rule, hyperparamodulation, which is a refinement of paramodulation. We give some detail concerning its implemen tation, the motivation for its formulation, and the way it is used. We make comparisons of it to both paramodulation and hyper-resolution in terms of its properties and effectiveness. Since hyperparamodulation requires the user to select from among the input clauses those into which so-called equality substi tution is permitted, a heuristic is provided for making that choice. Similarly, since the user also designates within the chosen input clauses which terms are admissible for replacement, we suggest a heuristic for that purpose also. We then turn in Section 4 to an example from algebra, specifically from Robbins algebra, for a detailed examination of the kind of proof most suited to the use of hyperparamodulation. Since this proof itself, the study from which it is taken, and the set of experiments underlying this paper all implicitly reflect certain views of the authors, we make those views explicit in Section 2. We also discuss there certain additional procedures and their effect on program and user complexity. Although this study is a very preliminary study, the evidence appears to be of some significance. We believe that the appropriate purpose of workshops is to encourage the dissemination of such studies and experience. We welcome any evidence even remotely germane to any position taken herein.
Collected Works of Larry Wos
300
Section 2. Tacit Assumptions
2.1. The Program as a Research Tool One use of the automated theorem-proving program implemented at both Argonne National Laboratory and Northern Illinois University is that of at tacking open questions in mathematics. An example of this is provided by our study of Robbins algebra. In attempting to answer the open question given in Section 4, a number of conjectures were made about possible lemmas. Each was submitted to the theorem-proving program with the proviso that no special programming features be added or employed, but also with the proviso that the user could adjust any or all of various input parameters to reflect his preference. We note first that, in most cases, the program did generate a proof using hyperparamodulation. Second, it was not necessary to change parameter settings from the defaults for any of the lemmas tried. Most significantly, the program was not able to get proofs using paramodulation alone. A number of these con jectures are still open, and in particular, the main question is still unanswered. No attempt was made to have the program produce a counter-example to any conjecture, although this capability is available in part. At this point, it is natural for three questions to be asked. Was all of the research done with computer runs? If a proof was not found, wasn't one then in a quandary? If one can set various parameters at will, doesn't that give the set of experiments an ad hoc flavor? Aside from the user making the conjectures about lemmas, the answer to the first question is, essentially, yes. If a proof was obtained from the first attempt, it was catalogued, and the next conjecture was tackled. If no proof was found, various parameters were changed to permit a wider and somewhat different search. In addition, sometimes lemmas the user judged worthwhile and which were found in previous runs were added. In most cases, but a few failures were sufficient to table the conjecture. Occasionally, some results obtained by hand were adjoined, somewhat in the spirit of using suggestions made by some other mathematician. As for the second question, tabling of a conjecture leaves one no worse off than when the conjecture was made. Put another way, if a colleague fails to make any helpful suggestion, one still continues to seek his assistance with new conjectures. As for the third, and perhaps most important, question, it should be noted that the various parameters have reasonable default values, and these were suf ficient for most proofs generated. The user of the program is not required to
Hyperparamoduiation: A Refinement
of
Paramodulation
301
have special knowledge about the problem or about the proof search in order to use the system. On the other hand, we must emphasize the belief that the user should be provided with the opportunity to use any intuition, special knowledge, or previous experience in the area under study. Any such advantage should be convertible easily into some biased use of the theorem-proving program. The various input parameters in part provide such a mechanism. We believe more and more that flexible and efficient theorem provers are becoming useful tools. We cite our own experience with Robbins algebra, our success in answering the axiom dependence questions in ternary Boolean alge bra [5], and the success in answering the previously open question concerning finite semigroups and involutions [6]. None of these required any additional pro gramming. One might suspect a major reason for the achievements lies in our familiarity with the program and its use. As evidence to the contrary we cite the use to which our program was put by non-theorem-proving people to help design circuits in 3 valued logic [7]. Finally, in order to provide a flexible research tool for developing deductive techniques, we are at present willing to accept both an increase in complexity of the program and an increase in complexity of its use in exchange for the ability to imitate various types of reasoning under various restrictions and relaxations of different constraints. We would, of course, prefer a fully automated system, and we welcome any advance toward such.
2.2. Representation Among the decisions to be made for the representation of problems in clause form, the most important one is that of choosing between emphasis and deemphasis of equality. Is it, for example, better to represent commutativity with -P(x,y,z) P(y,x,z) or with EQUAL(f(x,y),f(y,x))
?
For a variety of reasons, we clearly prefer an emphasis on equality. This of course presents us with various inherent problems such as the control of paramodulation. This inference rule in itself gives no hint for making good choices of clauses either as "from" or "into" operands. Similarly, it supplies no information to di rect the choice of terms within the "into" clause to replace. Not nearly enough control is provided, for example, by the restrictions: block paramodulation from or into any argument which is itself a variable. We prefer that the mathemati cian, using intuition and/or knowledge of the field under study, be in a position to exercise much control over the set of generalized equality substitutions. (Re-
Collected Works of Larry Wos
302
call that the unification performed in completing a paramodulation may force nontrivial instantiation on both the "from" and the "into" clause, which ex plains the recurrent phrase, "generalized equality substitution".) The inference rule given in Section 3 in part provides some of the missing control mechanism. In using it, one makes actual choices of possible into clauses and possible terms therein. Here again we are aware of adding complexity to both the program and its use. But, as will be seen in Section 4, the imitation of a valuable type of reasoning is now automated. The following overly simplified summary lists some of the factors contribut ing to our preference for equality representations in spite of their complications. First, both the relevance and effectiveness of demodulation is heightened. This statement holds when demodulation is used to simplify or to canonicalize. Sec ond, since the non-equality representation incurs artificial argument boundaries, redunancy of information results. For example, if one has appropriate demod ulators to cause, among other things, right association, then the deduced fact that (a(b(cd))) = k will be retained in but one way in the equality represen tation. On the other hand, with the other often- used representation one will find P(a,f(b,f(c,d)),k) and P(f(a,b),f(c,d),k) and P(f(a,f(b,c)),d,k) and the like. Third, the ability to attack a particular subterm immediately rather than building up to it by passing through various equality substitution axioms (as is required when using equality axioms instead of paramodulation) should, in our opinion, contribute to efficiency. And fourth, examination of the clauses produced during a run of the theorem-proving program is greatly facilitated be cause terms and formulas are easier and more natural to read. This is especially important in experimentation when one is trying to get the program to find a particular kind of proof. To conclude this section, we first remark that the effort has obviously concen trated on equational systems. So no light is shed here on those problems which do not benefit from an equality representation. This concentration, in turn, im plies for us the rejection of the use of inference rules such as hyper-resolution and UR-resolution [1,2,3] for problems dominated by equality. Much more ex perimentation in this regard would be valuable. But one should keep in mind, when experimenting, that techniques that are useful for inferences in one repre sentation do not necessarily carry over to another. Conversely, certain problems will benefit from a particular representation, and this will strongly influence the choice of inference rule, last, comparisons between clause representation
Hyperparamodulation:
A Refinement
of
Paramodulation
303
coupled with so-called resolution-based systems and other representations with inferential procedures, such as natural deduction, should be made continually. Problems of the type cited in Section 4 are but one class on which comparison should occur. In this manner, we may be able to determine which techniques are effective and to which types of problems they apply.
2.3. Canonicalization Because of our experiments, we are convinced of the need of canonicalization, especially in word problems, which are essentially equational in nature. For us, canonicalization is accomplished through demodulation. The most common and most successful set is exemplified by: o(x,y) = o(y,x) o(x,o(y,z) = o(y,o(x,z)) o(o(x,y),z) = o(x,o(y,z)) where the function, o, can be thought of as union. Here, demodulators are used to rewrite terms when the rewritten version is "simpler" in a predefined lexical ordering of all terms. The middle demodulator deserves special note. It "cycles" terms and has proven extremely effective and efficient in the generation of canonical forms [4]. The user has control over the lexical ordering except, for the present, that variables are assumed to be the earliest lexical class. We are painfully aware of the problems attendant to the use of canonical ization. For us, the marked gain in efficiency is sufficient compensation. Often, proofs would not be found if canonicalization were avoided. Rather than an ap proach based on the study of complete reductions, we have chosen to stay with our approach for reasons we cannot include here because of space limitations. This entails the addition of certain clauses in the input which are indicated by the user not to be canonicalized. For example, given that n(a) is lexically earlier than the constant, a, and given also that o(n(a),a) = n(a), we would probably adjoin o(a,n(a)) = n(a) o(n(a),o(a,x)) = o(n(a),x) o(a,o(n(a),x)) = o(n(a),x) to the input. (Such additions in part cope with certain refutation completeness problems.)
Collected Works of Larry Wos
304
Here again we are cognisant of a possible ad hoc flavor to our approach. However, we believe we are developing a set of procedures and rules to help users decide among the various choices. See Section 3.5 for a sample of some of these rules.
Section 3. Hyperparamodulation
3.1. Motivation for Its Formulation For certain domains of reasoning, hyper-resolution is clearly superior to binary resolution. For comparison below we make the following points. First, hyper-resolution prevents many sets of clauses from interacting directly because of the positive-negative requirements. Next, a hyper-resolvent is often a more significant lemma or fact than a binary resolvent is. Third, if the hyper-resolvent is calculated by clashing away all the negative literals in one unification, then demodulation is not applicable until the hyper-resolvent is formed. In contrast, in a sequence of PI steps, if demodulation were allowed after each step, cer tain paths of reasoning would be appreciably modified, and often the desired hyper-resolvent would not be generated. Fourth, no new nuclei are generated during the run. Fifth, the target literals (the negative literals of the nuclei) are all known at the start. On the other hand, one might note the following disadvantages. Negative clauses have no value to the proof search other than termination. So some of the denial of a purported theorem is of no use in the proof search. Next, the rule is syntactically rather than semantically oriented. Finally, we note that certain problems heavily involving the notion of equality suffer greatly, in our opinion, from the problems mentioned in Section 2.2 when hyper-resolution is used. So, with the foregoing in mind, and with the knowledge that paramodulation removes some of the stated disadvantages, it was natural to seek an inference rule which combined the good properties of paramodulation and of hyper-resolution. Such a rule would, intuitively, require the following: a single nucleus or "into" clause; a set of satellites or "from" clauses as correspondents to the positive clauses in a hyper-resolution; and a set of terms or subterms within the nucleus as correspondents of the negative literals. Then, just as hyper-resolution can be accomplished by an appropriate sequence of PI inferences, the inference yielded by the new rule could be obtained by a sequence of paramodulations.
Hyperparamodulation: A Refinement of Paramodulation
305
3.2. Formal Definition of Hyperparamodulation We begin this section with an example and comments to illustrate certain complications in the definition below. Consider the clause EQUAL(f(a,f(b,f(c,d))),k) and let EQUAL(f(c,d),cl) EQUAL(f(b,cl),bl) EQUAL(f(a,bl),al)
also be given. Then there is but one sequence of paramodulations which yields EQUAL(al,k) as an inference. The corresponding ordering problem does not exist in hyper-resolution. Now consider paramodulation from a clause EQUAL(r,s) into a clause C(r') where r' is the term chosen to be replaced. Let u be the MGU of r and r'. Then unlike resolution, terms in the paramodulant (C(s))u are not necessarily instances of terms in C(r'). Those terms t(r') that contain the chosen r' are transformed to (t(s))u. Thus, in the above example, after the first paramodula tion we have EQUAL(f(a,f(b,cl)),k). Here, cl is not an instance of f(c,d), and f(b,cl) is not an instance of f(b,f(c,d)), etc. Thus, in the second paramodula tion of that example, we must identify the into term of paramodulation as the transform of f(b,f(c,d)). In general, the transform of a term w = t(r') containing the chosen r' is (t(s))u; the transform of a term w not containing the chosen r' is just (w)u. A term w which is itself contained in the chosen r' in general will not have a corresponding transform. In order to facilitate the definition, we therefore identify terms by position vectors. The position vector pl,p2,...,pm identifies the term occurring in literal pl + 1, and within that literal occurring in argument position p2+l, etc. Thus, a in the clause EQUAL(f(a,f(b,f(c.d))),k) has position vector 0,0,0 because it occurs in the first literal, in the first argument position of that literal, in the first argument position of that term. The important point here is that the position vector of the transform of a term t in a paramodulant is the same as the position vector of t itself (unless t
Collected Works of Larry Wos
306
disappears altogether because it was a subterm of the chosen r'). For example, in paramodulating EQUAL(f(c,d),cl) into EQUAL(f(a,f(b,f(c,d))),k), f(c,d) is transformed into cl, both of which have position vector 0,0,1,1 in their respective clauses. The term d with position vector 0,0,1,1,1 has no transform. DEFINITION. Hyperparamodulation: Let al, a2, ..., ak be a set of posi tive equality unit clauses, and let n be a clause. Let t l , t2, ..., tk be k distinct (at least as far as position) terms in n. Further, assume that, for all i j with 1 j= i j j j= k, ti does not contain tj as a subterm. Now let cl be n. Define c2 to be the paramodulant, if such exists, of al with cl into tl, and let vl be the corresponding transformation of terms in cl. Then define c3 to be the paramod ulant, if such exists, of a2 with c2 into vl(t2), and let v2 be the corresponding transformation of terms in c2. In general, define c(i+l) to be the paramodulant, if such exists, of ai with ci into the (compound) transform of ti. Then c(k+l) is called a hyperparamodulant. Equivalently, c(k+l) is said to be inferred by hyperparamodulation from al, a2, ..., ak and n. The clause, n, is called the nucleus, and the ai are the satellites. To illustrate the necessity of ordering the terms and the corresponding satel lites, consider first the example at the beginning of this section. There is only one correspondance of satellites to position vectors in the nucleus that yields a hyperparamodulant. Moreover, the sequence of steps must be carried out in the order inside out. For example, EQUAL(f(b,cl),c2) cannot be applied to f(b,f(c,d)) until after EQUAL(f(c,d),cl) has been used to "prepare the way". Now consider the two satellites
and
Al: A2:
EQUAL(f(a,b),f(c,d)) EQUAL(f(f(x,y),z),f(f(x,z),f(y,z)))
and the nucleus P(f(f(x,y),z)) with chosen terms tl:f(x,y) and t2:f(f(x,y),z). When the sequence of paramodulations is Al into t l followed by A2 into v(t2), the result is P(f(f(c,z),f(d,z))). If A2 is used into t2 first, the result is P(f(f(c,d),f(y,b))). These examples illustrate why all the positions in the nucleus and their corresponding satellites must be chosen at the outset and fixed and why the paramodulations must be done in a particular order. We do note that the fun damental requirement is that the terms be processed inside out. Thus, one could partition the ti into smaller classes, each of which consists of an argument of a predicate or literal of the nucleus together with those of its subterms among the ti. Then the classes could be processed in any order, but within a class the inside-out rule must be observed. In fact, any ordering of the terms which obeys the partial order determined by containment is acceptable. Because there is no straightforward syntactic way to determine allowable nuclei and the terms therein for paramodulation, we also make the following
.Hyperparamodulation: A Refinement of Paramodulation
307
definition. DEFINITION. A hyperparamodulation proof procedure is a proof procedure in which 1. the rules of inference are hyperparamodulation and possibly resolution or some refinement of resolution, 2. a method is given for determining which clauses are nuclei and which are satellites, and which are the chosen into terms, and 3. a method is given for choosing the order in which clauses are used in making new inferences. One can relax various restrictions in the above definition in the obvious way, for example, to allow non-unit satellites (although we have not needed to do this for our problem sets). There is also ample flexibility in the definition of a hyperparamodulation proof procedure for exploring heuristics for selecting nuclei, into terms, etc. Finally space considerations preclude a discussion of questions concerning the effect of using hyperparamodulation with the choice of set of support, of various paramodulation strategies and the role of complete reductions. 3.3. Implementation and Use Our hyperparamodulation proof procedure is based on the NIUTP system implemented at Argonne National Laboratory and Northern Illinois University [1,2,3]. The nuclei are chosen by the user from among the input clauses by at taching the dummy literal NUC(C) to each nucleus. Nuclei are those clauses that contain the NUC(C) literal, and satellites those clauses without the NUC(C) lit eral. (Note, this requires us to include two copies of a clause that we want to be used as both a nucleus and a satellite, one with NUC(C) and one without.) The user also specifies by position vectors the terms that are to be paramodulated in each nucleus. These terms are said to be starred. Clauses are ordered for hyper paramodulation on the basis of weights assigned to the terms [2]. The program also makes extensive use of demodulation and canonicalization and performs both forward and backward subsumption on all satellites. Finally, new equality units that pass certain weight tests are dynamically added as demodulators and are used immediately to demodulate all existing clauses. As discussed in Section 3.2, a hyperparamodulant must be calculated as the last in a sequence of paramodulants. Our program automatically chooses the terms in the nuclei in the inside-out order, regardless of how the user or-
308
Collected Works of Larry Wos
dered the position vectors in the input. Within a given position-vector level, terms are chosen left to right so as to avoid redundant paths. When a starred term is paramodulated by its corresponding satellite, the star is removed. The program will also at times paramodulate into starred terms which themselves contain starred subterms. In this case, the stars on the subterms are removed automatically. This corresponds to the situation in which the subterms had been associated with reflexive axioms (or in which the corresponding negative literals in a hyper-resolution system had been resolved away with closure). It is necessary for our program to handle this situation specially because 1. we do not include functional reflexive axioms in our input and 2. we do not allow paramodulation from a variable so that EQUAL(x,x) cannot be used for this purpose. When one paramodulation step is completed, two things may happen. First, if the result has no remaining starred terms, the clause is demodulated and canonicalized and tested for retention in the clause space. The NUC(C) literal is removed, and if the clause is kept, it becomes a satellite. If the new clause has starred terms, it is called an intermediate nucleus. In this case, two clauses are formed. The first is the intermediate nucleus itself. This is kept on a spe cial list unless subsumed by some other intermediate nucleus. No demodulation or canonicalization is performed on intermediate nuclei. Second, a satellite is formed by deleting the NUC(C) literal and all remaining stars. As above, this corresponds to using closure on these terms. This satellite is then filtered through the normal tests for clause retention. Once a starred term has been paramodulated, no more paramodulation can be done into that term or any of its subterms. For this reason it is necessary, in some cases, to include in the input various commuted and associated versions of some clauses. For example, suppose we had a satellite EQUAL(f(a,b),c) which we wanted to use with a starred term f(x,y), but with the constant a going in for y instead of x. With regular paramodulation we might be able to accomplish this by using commutativity into f(x,y) first. However, in hyperparamodulation such a step would remove the star, and the second step using f(a,b) would not be allowed. This is somewhat of an inconvenience because it adds another choice for the user. Our experience is that, on the whole, the benefits of hyperparamod ulation far outweigh this and other inconveniences. 3.4. Comparison of Properties For space considerations we limit ourselves to a brief comparison of hyper paramodulation to hyper-resolution and paramodulation. While hyper-resolution requires the nucleus to be a mixed clause and the inferred clauses to be positive, hyperparamodulation allows any clause to be a nucleus, and therefore places no
Hyperparamodulation: A Refinement of
309
Paramodulation
such restriction on the inferred. Satellites for the former must be positive clauses, while in our experiments satellites have been positive units because our problems have been expressable as sets of equality units. In both, demodulation is sus pended until the inference has been completed, thus avoiding blocking of certain potentially valuable paths. Hyperparamodulation easily allows for bidirectional search by including the denial of the theorem as a nucleus. This can lead to valuable negative inferences in a proof attempt. In contrast, hyper-resolution gains little from the denial of the theorem and is limited to forward reasoning. As for paramodulation, its control is certainly a problem. For example, many are familiar with the explosion that can result from the generation of more and more positive equalities from the initial set of units. Little is known about strate gies to screen and order the from and/or into candidates. Similarly, one knows little to do to direct the search profitably through the ensemble of terms and subterms which are admissible as into terms. In contrast, hyperparamodulation certainly attacks this question in that, for example, satellites are not allowed to interact. For which types of proof this is beneficial remains to be determined. And, of course, the user makes the decisions which affect the into space. Al though such decision is arbitrary, we can shed some light on it and do so in the next subsection. We make a few additional brief remarks about our hyperparamodulation experiments. In the sample problems from Robbins algebra, roughly 1/3 of the kept clauses in the paramodulation runs were from inferences in which the into clause did not correspond to a nucleus in the hyper runs. For these particular problems, those clauses do not correspond to steps in any proofs we know of, and so in this case anyway, they appear to be extraneous. The problem is even worse because considerable processor time is spent in attempted paramodulations with these clauses in which either the inference fails or the result is subsumed, i.e., redundant. These two factors keep the paramodulation program from generating enough useful clauses within the given resources. For example, we list statistics from two sample runs- one hyperparamodulation run and one paramodulation run with two different time limits: RULE hyper para para
TIME 25 sec 25 sec 110 sec
SUCC. UNIF. 11,769 13,181 42,628
UNSUCC. UNIF. 27,349 65,093 272,192
GEN. 1857 1118 3133
KEPT 510 280 574
PROOF yes no no
Note particularly the number of unsuccessful unifications and the ratio of kept to generated clauses. We also make the following observations about our (admitedly limited , so far) experiments. When canonicalization was not used, large numbers of com-
310
Collected Works of Larry Wos
muted and associated versions of a clause were kept in the clause space (as many as 5 or 6 versions of the same clause). When canonicalization was used in paramodulation runs, many of the inferences actually in the hyperparamodulation proof were blocked. For example, a very early step in that proof is to gener ate B(A(AA))=B by first getting Bx=A(Bx) from associativity and BA=B, and then using another generated equality, B(AA)=B, and finally canonicalizing. However, with paramodulation, the intermediate step Bx=A(Bx) itself is canonicalized and demodulated to Bx=Bx and deleted by subsumption. Paramodu lation does find some of these blocked inferences by other deductive paths, but either cannot get them all or at least does not get them before time or memory runs out. Finally, we note that the hyperparamodulation proof contained 32 steps—23 hyperparamodulants and 9 demodulations by generated demodula tors. There were 490 new clauses added to memory when the proof was found, giving a penetrance of .065. This is still quite low, but significantly higher than normally found for paramodulation proofs. Finally, we obtained proofs by hyperparamodulation even when we varied many of our paramaters that control features like weighting, number of variables allowed in a clause, and others. In fact, the run times and other statistics were remarkably close for different runs of the same problem. 3.5. Heuristics of Choice The extensive user control of the into and from roles that hyperparamodu lation provides for generalized equality substitution captures well our position that programs should be flexible tools for theorem-proving research. However, we understand that this capability can be a disadvantage for a user not famil iar with the peculiarities of equality in theorem proving. We therefore supply a technique by which users can chose both the nuclei and into terms as well as the satellites. Recall that one motivation for the formulation of hyperparamodulation was that of borrowing the good properties of hyper-resolution. This fact leads one to surmise that, from among the input clauses, a reasonable choice for nuclei is the set of clauses which, though now written as equalities, correspond to the nuclei of hyper-resolution. For example, in the non-equality representation, as sociativity, commutativity, and distributivity are hyper-resolution nuclei. The equality counterparts to such clauses would then be chosen as nuclei for hyper paramodulation. For those hyper-resolution nuclei which are themselves equality substitution axioms (and hence are not present in the equality representation), we simply remark that paramodulation in part already automates their rolebut only in part, especially when refined to hyperparamodulation. Finally, our experience indicates that certain axioms generally should not be used as nuclei.
Hyperparamodulation: A Refinement of Paramodulation
311
Commutativity is the major one of these. As for the terms which eventually get starred, we suggest those terms which are the correspondents to the negative literals of the hyper-resolution nuclei. We would, for example, star f(x,y), f(y,z), f(f(x,y),z), and f(x,f(y,z)) in the clause EQUAL(f(f(x,y),z),f(x,f(y,z))) representing associativity. The implicit underly ing map from the non-equality representation to the equality representation maps both clauses for associativity to the single given clause. Thus, each of the four terms above corresponds to a negative literal. Closure is mapped to refiexivity, which itself has additional roles. This observation explains an earlier dis cussion of certain satellites not being the analogue of Pl-resolvents. It also gives the theoretical justification for the programmed convention of automatically removing stars on subterms of a term just used in the hyperparamodulation. (Detailed consideration of this mapping and of various choices of nuclei and starred terms therein can provide information about refutation completeness and about compatibility with set of support.) Note that such choices dictated by a consideration of hyper-resolution will not, however, cause the program to behave precisely as if hyper-resolution itself were the inference rule. Here the earlier discussion of representation and its effect on the value of demodulation becomes quite relevant. Nor, obviously, will a hyperparamodulation run behave like one using paramodulation.
Section 4. A Detailed Example
The following example is taken from Robbins algebra and is but one of the conjectures which arose during our study of that algebra. The study is still in progress. It was motivated by considering the following open question: does Robbins imply Boolean, that is, if S is a set satisfying the Robbins axioms given below, is S a Boolean algebra? For finite S, the answer is known to be yes. For the following axioms, think of o as union and n as complement. Robbins axioms o(x,y) = o(y,x) commutativity o(o(x,y),z) = o(x,o(y,z)) associativity n(o(n(o(x,y)),n(o(x,n(y))))) = x key property, axiom 3. We also used EQUAL(o(x,o(y,z)),o(y,o(x,z))), which is deducible from the first
312
Collected Works of Larry Wos
two axioms. This clause is a valuable demodulator, for it contributes sharply to efficiency when using canonicalization. This open question was ideal for us. First, solving any open question, espe cially one discussed and not solved by Tarski, would be a coup. Second, heavy use of a theorem-proving program leading to the answering of such a question would be a sharp rebutal to the various cynics. And third, hyperparamodulation, already under study, appeared to provide an excellent implementation of the kind of reasoning we wished to employ in our attack on this problem. (The results of the Robbins study are being prepared for journal submission.) And so we asked, "How much behavior found in Boolean algebra is exhibited by a Robbins algebra?" In particular, let a be some arbitrarily chosen fixed element. Assume that o(a,n(a)) = n(a). Can one then prove, for example, that n(n(a)) = a? This result is in fact provable, and a mathematician's proof might go as follows. First, note that o(a,o(n(a),x)) = o(n(a),x). Second, substitution of a for x and also for y in the third and key axiom yields n(o(n(n(a)),n(o(a,a)))) = a. Third, substitution of n(n(a)) for x and o(a,a) for y in axiom 3 yields n(o(a,n(o(a,o(a,n(n(a))))))) = n(n(a)). Fourth, with o(a,o(a,a)) for x and n(a) for y, axiom 3 gives n(o(n(n(a)),n(o(a,o(a,o(a,n(n(a)))))))) = o(a,o(a,a)). Fifth, a for x with o(n(a),n(n(a))) for y gives n(o(n(o(a,n(o(n(a),n(n(a)))))),n(o(n(a),n (n(a)))))) = a. Sixth, a for x and o(a,o(a,n(n(a)))) for y gives o(a,o(a,a)) = a. Seventh, o(a,o(a,o(a,a))) for x and a for y yields n(o(n(a),n(n(a)))) = o(a,a). And last, by applying the seventh and sixth to the fifth, one has n(n(a)) = a. With this mathematical proof at hand, we cite but two instances of hyperparamodulation taken from a computer run attempting to prove the conjecture under discussion. In fact, all of the steps above correspond to hyperparamodulants; however space considerations require this brevity. In our run the nuclei were associativity and axiom 3. All terms therein were starred except those which consisted of a single variable. To focus attention on n(a) and also to force an appropriate lexical ordering, the clause EQUAL(n(a),b) was input giving a name to n(a) with a low lexical value. The first application of hyperparamodulation to be cited is that which derived the equivalent of the second identity above but, of course, in clause form, namely EQUAL(n(o(n(n(a)),n(o(a,a)))),a). This was accomplished by paramodulating into axiom 3 first into n(y), and then into o(x,n(y)) positionally of the corresponding transformed intermediate nucleus. As discussed in Section 3.3, at this point a satellite and an interme diate nucleus was formed. The satellite, when demodulated, gave the desired result. The second instance of hyperparamodulation cited here used satellites which were the clause equivalent of the seventh and sixth steps above and in that order, and illustrates how the added term b comes into play. Again the nucleus of hyperparamodulation was axiom 3 and with the starred terms n(y)
J/yperparamoduiation: A Refinement
of
Paramodulation
313
and o(x,n(y)). The resulting satellite, after much demodulation for both simpli fication and canonical ization, was EQUAL(n(b),a), which completed the proof since -EQUAL(n(b),a) was input. Briefly, this style of proof consisted of repeated substitution into axiom 3 and associativity, mostly into axiom 3. So hyperparamodulation was ideally suited. We tried, as an example of a different kind of problem, to prove the problem of ten referred to as "the commutator problem" in automated theorem proving. It states that, in a group, if the cube of x is e (the identity) for all x, then ((x,y),y) = e for all x and y, where (x,y) is the commutator of x and y. While the cited example from Robbins algebra was successfully proved with hyperparamodula tion but unproved with various attempts with paramodulation, the group theory example was proved with both. However, paramodulation yielded a proof in but one sixth the time that hyperparamodulation took, 2 seconds versus 12. The Robbins proof was obtained in 22 seconds. The difference in the two proofs, the Robbins proof and the commutator proof, is that the latter involved significant interaction of generated lemmas by way of full paramodulation of satellites into other satellites.
S e c t i o n 5. C o n c l u s i o n s
Hyperparamodulation seems most effective on word problem type theoremssi— that is, theorems whose proofs consist mostly of substitution into key axioms with only limited interaction between lemmas. The substitution is accomplished by hyperparamodulation and the limited interaction between lemmas is accom plished by dynamic addition of demodulators. Of course, one does not know ahead of time if a particular conjecture is of this type; however, we have found that theorems with small axiom sets and only 1 or 2 complex identities generally seem to work well with hyperparamodulation when the nuclei are restricted to those complex identities. Hyperparamodulation allows one to affect the proof search rather differently than other rules now in use. Its dependencey on user direction appears to us at present to be an overall advantage. We also feel its non-dependence on various parameter settings is a significant indication that the rule itself is effective.
References 1. McCharen, J., Overbeek, R., and Wos, L., "Problems and Experiments for and with Automated Theorem-Proving Programs," IEEE Transactions on Computers, Vol. C-25, No. 8(1976), pp. 773-782.
314
Collected Works of Larry Wos
2. McCharen, J., Overbeek, R., and Wos, L., "Complexity and Related En hancements for Automated Theorem-Proving Programs," Computers and Mathematics with Applications, Vol. 2(1976), pp. 1-16. 3. Overbeek, R., "An Implementation of Hyper-Resolution," Computers and Mathematics with Applications, Vol. 1(1975), pp.201-214. 4. Veroff, R-, Canonicalization and Demodulation, to appear as an Argonne National Laboratory technical report. 5. Winker, S., and Wos, L., "Automated Generation of Models and Coun terexamples and its Application to Open Questions in Ternary Boolean Algebra," Proc. Eight Int. Symposium on Multiple-Valued Logic, Rosemont, Illinois, 1978, pp. 251-256. 6. Winker, S., Wos, L., and Lusk, E., "Semigroups, Antiautomorphisms, and Involutions: A Computer Solution to an Open Question," to be submitted. 7. Wojciechowski, W., and Wojcik, A., "Multiple-Valued Logic Design by Theorem Proving," Proc. Ninth Int. Symposium on Multiple-Valued Logic, Bathe, England, 1979, pp. 196-199.
Semigroups, Antiautomorphisms, and Involutions: A Computer Solution to an Open Problem, I* By S. K. Winker, L. Wos and E. L. Lusk
Abstract. An antiautomorphism H of a semigroup 5 is a 1-1 map ping of 5 onto itself such that H{xy) = H(y)H(x) for all x, y in S. An antiautomorphism H is an involution if H2(x) = x for all x in 5. In this paper the following question is answered: Does there exist a finite semigroup with an antiautomorphism but no involu tion? This question, suggested by I. Kaplansky, was answered in the affirmative with the aid of an automated theorem-proving program. More precisely, there are exactly four such semigroups of order seven and none of smaller order. The program was a completely general one, and did not calculate the solution directly, but rather rendered invaluable assistance to the mathematicians investigating the ques tion by helping to generate and examine various models. A detailed discussion of the approach is presented, with the intention of demon strating the usefulness of a theorem prover in carrying out certain types of mathematical research. 1. Introduction. This paper has three objectives. The first is to present an answer to an open question concerning antiautomorphisms of finite semigroups. The second is to describe some functions of a general-purpose automated the orem prover and show how it was used in the investigation of this question. Finally, we wish to solicit other significant questions of a similar nature. Indeed, Received June 9, 19801 revised January 28, 1981 and March 13, 1981. 1980 Mathematics Subject Classification. Primary 20M05, 20M15; Secondary 03B35. Key words and phrases. Finite semigroups, involutions, antiautomorphisms, automated theorem-proving. 'This work was supported in part by the Applied Mathematical Sciences Research Program (KC-04-02) of the Office of Energy Research of the U.S. Department of Energy under Contract W-31-109-Eng-38 (Argonne National Laboratory, Argonne, IL 60439) and in part by NSP grant #MCS79-03870 (Northern Illinois University, DeKalb, IL 60115). Reprinted from Mathematics of Computation, Vol. 37, no. 156, pp. 533-545 (October 1981) by permission of the American Mathematical Society.
316
Collected Works of Larry Wos
since no additional programming was required for the attack on this problem, those who understand the techniques presented here should be able to use our theorem-proving system for their own purposes. Since the paper is addressed to groups with widely differing backgrounds, it is written at an elementary level throughout. 1.1. The Results. There is a finite semigroup which supports an antiautomorphism but no involution. All necessary definitions are given in Section 2.1, one such semigroup is given in Section 2.2, and a small example (order 7) is given in Section 2.3. The theorem-proving techniques used in the discovery of this example are described in detail in this paper. There are exactly four semigroups of order 7 having the above property and no smaller semigroups with this property. The techniques used in arriving at this result are very different from those used in the first part of the investigation and will be described in a later paper. 1.2 The Theorem Prover. The theorem prover used here is a general-purpose resolution-based program developed over the past eight years at Northern Illi nois University and Argonne National Laboratory. Nothing was added to the program to orient it towards this particular problem, nor towards algebra in general. Rather, a collection of nonstandard input statements was prepared which caused the program to generate and check models instead of deriving a contradiction from the input, which is how it has traditionally been used. Particular use was made of the program's capabilities for dealing with equal ity. Some fundamental theorem-proving concepts are presented in Section 3 for those unfamiliar with automated theorem proving, and the technique used to cause the theorem prover to generate and check models is described in detail in Section 4. 1.3. Solicitation of Problems. Theorem-proving technology has advanced slowly over the last fifteen years, but has now reached the state of being able to do more than simple exercises. The authors believe that for a limited class of problems theorem provers can be of real use to mathematicians and other researchers whose calculations are algebraic and logical rather than numerical. The project described here is offered as an example of such use. Several in vestigations of a similar nature are currently under way, and more problems which might yield to computer-aided attack are solicited. Some success on such problems in a field different from the one described here is described in [6]. 2. The Main Result. In this section, we present the relevant definitions, some lemmas, and the technique used to find the desired semigroup. We will describe which parts of the process were assisted by the theorem prover but will defer to a later section the discussion of exactly how it was used. 2.1 Definitions and Lemmas. Definition. A semigroup S is a nonempty set together with an associative binary operation S x S —> S. Definition. An automorphism K of a semigroup 5 is a 1-1 map of S onto S
Semigroups,
Antiautomorphisms,
and
Involutions
317
such t h a t for all x , y in S, K(x)K(y) = K(xy). An antiautomorphism H of S is a 1-1 m a p of S onto S such that for all x,y in S, H(xy) = H(y)H(x). An antiautomorphism is nontrivial if it is not an automorphism. Definition. A (nontrivial) involution J of a semigroup S is a (nontrivial) antiautomorphism of S such that J 2 = 1, the identity map. Remark. It is easy to see that if H is a (nontrivial) antiautomorphism, then Hk is an automorphism for even k and a (nontrivial) antiautomorphism for odd k. Since the identity map is an automorphism, the order of a nontrivial antiautomorphism must always be even. Furthermore, if H has order 2n, then Hn is either a nontrivial involution or an automorphism of order 2 depending on whether n is odd or even. This observation motivates the following question, communicated to us by I. Kaplansky. Question. Does there exist a finite semigroup which has a nontrivial antiau tomorphism but no nontrivial involution? Note that if such a semigroup exists then by the remark above the order of the antiautomorphism must be a multiple of four. 2.2. Techniques for Solution. Since we are attempting not only to answer the question but also to demonstrate how the theorem prover was used in the investigation, we present here a relatively detailed account of our approach to investigating the question. Suppose that the answer to the question is yes, and that H is the antiauto morphism. Since the order of H is a multiple of 4, the semigroup contains distinct elements B,C,D, and E such that H(B) = C,H(C) = D, and H{D) = E. If H has order 4, then such elements exist with H(E) = B. We begin my making a number of assumptions about the desired semigroup S and its antiautomorphism H. We do this not without loss of generality but as a first move. The first assumption is that H has order 4. (Fortunately, a solu tion to the problem can be found with this condition. If this had not happened, the technique outlined here could still have been used, but more computer time would have been required.) We assume further that S is generated by the ele ments B, C, D, and E which cycle under H. Finally, we need to introduce relations which will make the semigroup finite. One particularly straightforward way to do this is to assume that all products of more than a certain number of elements are identical. This has the addi tional benefit of making it unnecessary for the theorem prover to deal with terms beyond a specified complexity. In this investigation it was assumed that all products of four or more elements were identical. It turned out that this allowed sufficient complexity for the desired example to be found within the limits imposed by this restriction. The assumptions above provide us with a semigroup of order 85 which sup ports a nontrivial antiautomorphism. Unfortunately, involutions abound. For example, one can construct a nontrivial involution by extending the mapping which exchanges two of the gener ators and leaves the others fixed. The plan of attack on the problem, then, is to
318
Collected Works of Larry Wos
adjoin to the current set of relations which define S (those that make all prod ucts of four or more elements identical) more relations, so chosen as to block the existence of an involution while preserving the existence of an antiautomorphism. By adjoining relations to S we are forming a quotient semigroup S', consist ing of the equivalence classes of elements of S under the relations. The antiautomorphism H on S can be defined on the quotient semigroup as follows. Let p : 5 —► 5 ' be the natural projection of 5 onto S'. Define H'(p(x)) = P(H(x)). This makes sense as long as it is true that for all x and y in S,p(x) = p(y) implies p(H(x)) =p(H(y)). The computer helps most in examining the consequences of adding a given relation. The first type of consequence, as described in the preceding paragraph, is that the addition of a relation R requires that the relations H(R), H2(R), and H3(R) be added as well. (For example, adding the relation BC = CDD requires addition of DC = EED,DE = EBB, and BE = CCB.) This is done auto matically by the theorem prover, as will be explained below. Secondly, adding a relation may force the addition of yet more relations to keep the operation in S well-defined. For example, adding BB = DD forces us to add EBB = EDD, etc. The theorem prover automatically provided these additional relations. Fi nally, once a set of relations was chosen, the theorem prover automatically tested the resulting semigroup for the presence of involution. The selection of a set of relations can either be automated or left to the in vestigator. In order to provide some insight into the first solution of the problem, we present here some observations which led us to the right choice of relations. Even in this phase, the theorem prover provided moral support in that the effects of any choice could always be easily and reliably checked. Let us consider the original semigroup S of order 85 and what relations to add in order to block the existence of involutions. Each possible involution falls into at least one of the following three classes: (i) those which interchange at least two of the generators, (ii) those which interchange a generator with a non-generator, (iii) those which fix all four generators. We can block involutions of the second class by avoiding the addition of relations which allow a generator to be written as a product. To see this, suppose that J is an involution which interchanges, say, B with CD. Then B = J2(B) = J(CD) = J(D)J(C), and B has been written as a product. Consider next an involution J of the third class. The presence, for some X and Y, of the relation BBX = DDY requires the addition of the relation J(X)BB = J(Y)DD. Thus if we can find a relation of the form BBX = DDY, which does not yield one of the form ZBB = WDD when all required relations are added, this will block involutions of the third class. Similarly one can examine the consequences of the existence of an involution of the first class in the presence of some proposed relation by considering the various possible interchanges between two generators.
Semigroups, Antiautomorphisms, and Involutions
319
Such considerations can greatly narrow the search for the desired relations. The theorem prover assists by automatically generating the set of relations implied by a given choice, and by checking for involutions. The exact technique by which the theorem prover is made to do this is described in Section 4. Let R be the relation BBC = DDE. Then since H2{R) = R, the only additional relation which must be added is H(R), namely DCC = BEE. As noted above, there cannot be any involutions of the second or third class. To see that there cannot be any of the first class, observe that any exchange of generators will introduce more relations. This establishes the existence of a finite semigroup S (of order 83) which has an antiautomorphism (inherited from the antiautomorphism H of 5) but no nontrivial involutions. The computer-assisted search for a smaller example will be described in the next section. 2.3. The Solution of Order 7. The search for smaller examples of semigroups having the desired property consisted of adding relations to this semigroup of order 83. The theorem prover facilitated experimentation by quickly and accu rately calculating the consequence of adding any set of relations. Thus experi ence was gained which led eventually to the following set of relations: (1) All products of three or more elements are equal to BD. (2) BD = CE = EC = CB (3) BB = DD = BC Other equalities were derived by the theorem prover from these, in accordance with the considerations described above. The elements of the resulting semigroup are represented by the equiva lence classes of B, C, D, E, BD, BB, BE. If we name these equivalence classes a, b, c, d, e, f, and g respectively, the multiplication table of the semigroup is as follows: a b c d e / 9 a b c
d e / 9
/ e e e e e e
f
9 9 e e e e
e e
9 e
f
f
e e e e
9 e e e
e e e e e e e
e e e e e e e
e e e e e e e
The antiautomorphism h acts as follows: h(a) = b h{b) = c h(c) = d h{d) = a h{e) = e h(f) = g
Ms) = / 3. An Introduction to Automated Theorem Proving. In this section we describe in some detail how the theorem prover was used in the investigation The three additional semigroups of order seven of the desired type are found in the Appendix.
Collected Works of Larry Wos
320
described in Section 2. We begin by giving a brief informal overview of standard terminology and techniques, intended for the reader who Ls totally unfamiliar with automated theorem proving. A more formal and complete treatment may be found in [1]. Then we will show how these techniques and some non-standard ones were used to extend sets of relations and check for the presence of involu tions. A theorem prover is a program which accepts as input statements in the first-order predicate calculus. Its output consists of statements in the first order predicate calculus which are derivable from the input statements by means of one or more standard inference rules (such as modus ponens). Several formalisms and inference systems have been developed. The one on which the theorem prover used here is based is called resolution. 3.1. Normal Forms. For our purposes any statement in first-order predicate calculus can be replaced by a conjunction of disjunctions, in which each disjunc tion has the property that all variables are universally quantified. For example, the statement VX3Y(P(X, Y) -» Q{X)) becomes (yX)(-P(X, F(X))vQ(X)). The function F which chooses a Y for each X is called a Skolem function. A statement which consists of such a conjunction of disjunctions is said to be in normal form. T h e disjunctions themselves are called clauses, and the disjuncts are its literals. We consider a list of clauses to represent the conjunction of those clauses, and we omit the universal quantifiers and the disjunction symbols from the representation, since they are redundant. Hence the statement above can be represented as a clause as follows: CL
-P(X,F(X))
Q(X) .
We prefix clauses by "CL" in order to distinguish them from other expressions. In the next section, we describe how new clauses are derived from existing ones. 3.2 Resolution and Hyperresolution. Two literals are said to be unifiable if they have a common instance; that is, if there are substitutions for the variables of each which make them identical. T h e scope of a variable is exactly the clause in which it occurs. Suppose we have two clauses of the form CL CL
-LI L3
L2
and suppose that LI and L3 are unifiable. Then modus ponens allows us to derive the clause CL L2, with the same substitution applied to the variables of L2 which was applied to those in L\ in order to unify it with L3. More generally, any two clauses containing unifiable literals of opposite sign can be used to derive a third clause consisting of all the literals in both clauses except the two matching ones, with the appropriate substitutions applied. Such a derivation is called a clash of the two clauses. For example, the clauses CL CL
-P(F(X),A) Q(X) P(F(B),Y) R(Y),
Semigroups,
Antiautomorphisms,
and
Involutions
321
in which X and Y represent variables, can be clashed to derive CL
Q(B)
R(A).
The inference rule described above (clashing pairs of clauses containing com plementary literals) is called binary resolution. A different inference rule, which replaces particular sequences of binary resolutions by a single derivation, is called hyperresolution. It functions as follows. A clause containing both positive and negative literals is clashed against a set of clauses containing all positive literals until all of its negative literals are gone. For example, from the clauses CL CL CL
-P(X.Y.Z) P(A,B,Y) QCX.Y.C),
-q(X,Y,Z) RCA),
S(X,Y,Z),
the clause CL S(A, B, C)R(A) is derived. Hyperresolution becomes a very natural and intuitive inference rule, par ticularly in the case where the positive clauses contain only one literal, if one notices that the clause CL
-LI
-L2
L3
is equivalent to (LI A L2) —» L3. Thus hyperresolution is the process of deriving the conclusion of an inference, given all of the hypotheses. For example, the statement that if X and Y are both elements of S then so is their product F{X, Y) can be represented by the clause CL
-EL(X.S)
-EL(Y,S)
EL(F(X,Y),S) .
Then from CL EL(A, S) and CL EL(B, S) hyperresolution derives CL
EL(F(A,B),S).
3.3. Demodulation. The equality predicate plays a special role in the the orem prover, used in this investigation. Whenever a clause of the form CL EQUAL(T1, T2) was derived in this problem, it was added to a list of rewrite rules called demodulators. (One has the option with our program of treating none, some, or all new equalities as demodulators.) Demodulation is the process of replacing the t e r m T l by the term T1 in any derived clause if EQU AL(Tl,T2) is a demodulator. Furthermore, if TV can be obtained from T l by a substitution for some of TVs variables (i.e. TV is an instance of T l ) and T2' is obtained from T2 by applying the same substitution, then we may replace T l ' by T 2 ' in any derived clause. Newly derived demodulators are also applied to existing clauses. Multiple demodulators can be applied in a single step. A variety of techniques exist to prevent looping. Finally, all terms are assigned a measure of complexity and tie-breaking rules exist so that there is a canonical way of ordering the arguments of equalities so that "simpler" terms always occur on the right. As an example, consider the following set of clauses.
Collected Works of Larry Wos
322
(1) (2) (3) (4)
CL CL CL CL
EQUAL(F(A),B) EQUAL(G(X),F(X)) -P(Y) Q(Y) P(G(A))
(demodulator) (demodulator)
The clause CL Q(B), the result of clashing (3) against (4) and applying first (2) and then (1) as demodulators, is derived by the theorem prover in a single step. 3.4. Subsumption. When a clause is derived which is a logically weaker state ment than a clause which already exists, in most cases the new clause is immedi ately deleted. For example, if CL P(VQ, VI, V2, V2) is an existing clause and CL P(A, B, C, C) is derived, it is immediately deleted, although CL P(A, B, C, D) would not be deleted. The new clause is said to be subsumed by the old clause. Old clauses may also be subsumed by new clauses. 3.5 Standard Use of an Automated Theorem Prover. The theorem-proving program used in the present investigation [3,4,5] was originally designed to find proofs of theorems. This is accomplished by providing as input clauses a set of axioms for a particular domain and a set of clauses representing the negation of the statement of the theorem to be proved. Derivation by the theorem prover of the empty clause then signals a contradiction, since the empty clause results from clashing CL P with CL —P. The derivation history of the empty clause then provides a proof of the theorem. One major point of this paper is to show how such a theorem prover can be used, without any new programming, in a completely different way. In investi gating the existence of semigroups with certain properties, the theorem prover was used more as an algebraic and logical calculator. This change of use was accomplished merely by using special types of input clauses, so that the required calculations could be accomplished through hyperresolution and demodulation. The following section describes how this was done. 4. Use of the Theorem Prover in Investigating Semigroups. In this section we demonstrate in considerable detail exactly how the standard theoremproving concepts described in the preceding section were used in the investiga tion described in Section 2. It is to be emphasized that no new programming specific to this problem was done. An existing theorem-proving program was used, with input clauses specially designed for this investigation. It is hoped that this will serve as an example of non-standard use of a theorem prover which will inspire other uses of existing theorem-proving programs by researchers outside the theorem-proving community. Recall from Section 2 that in the investigation described there the theorem prover was used to examine the consequences of adding various relations to a semigroup with four generators, cyclicly permuted by an antiautomorphism H, made finite by the relations equating all products of four or more elements. In the following sections, we describe (i) the input clauses which describe the basic semigroup S, the antiautomor-
Semigroups, Antiautomorphisms, and Involutions
323
phism H, and the further relations to be added to define a new semigroup, (ii) the input clauses which cause new relations forced by the fact that mul tiplication must be well defined in the new semigroup, (iii) the input clauses which cause new relations forced by the fact that H must be well defined in the new semigroup, (iv) the input clauses which cause the theorem prover to check for the pres ence of antiautomorphisms of order two. 4.1. Defining the Original Semigroup with Clauses. In what follows, vari ables (assumed to be all universally quantified, as explained in Section 3.1) are represented by the symbols VO, VI, V2,... . Multiplication in the semigroup is represented by the function F, so that F(V0, VI) represents the product of VO and VI. The generators of the semigroup are represented by B,C,D, and E. The antiautomorphism which permutes the generators is represented by H. The first clause represents associativity. It becomes a demodulator which canonicalizes products by associating them to the right. 1
CL
EqUAL(F(F(V0,Vl),V2),F(V0,F(Vl,V2)))
The next clause says that all products of four or more elements are equal to
BBBB. 2 CL
EQUAL(F(V0,F(V1,F(V2,V3))),F(B,F(B>F(B,B))))
Next we describe the action of H on the generators and extend it to products. 3 CL EQUAL(H(B),C) 4 CL EQUAL(H(C),D) 5 CL EQUAL(H(D),E) 6 CL EqUAL(H(E),B) 7 CL EqUAL(H(F(VO,Vl)),F(H(Vl),H(VO))) All of these become demodulators. 4.2. Multiplication is Well Defined. The existence of one relation implies others, since multiplication is well defined. For example, the relation BB = CC implies the relation BBD = CCD. This was handled in the following way. All equalities of products were represented by equalities with a variable concatenated to the product on each side of the equality. For example BB = CC is represented by the clause CL
EQUAL(F(B,F(B,VO)),F(C,F(C,V0))).
Thus although the relation BBD = CCD is not explicitly derived, if the term BBD occurs in any derived clause, it will immediately be demodulated by the above clause to CCD. Similarly, if DBB occurs, since it will be represented as F(D, F(B, F(B, VO))), the demodulator will apply. When it is desired to remove this formal variable (see 4.3 and 4.4), the following clauses are used. The function REMVAR stands for "remove variable."
Collected Works of Larry
324
8 9
CL CL
Wos
EQUAL(REMVAR(F(V0,V1)),V0) EQUAL(REMVAR(F(V0,F(V1,V2)),F(V0,REMVAR(F(V1,V2))))
The theorem prover prevents clause 8 from demodulating clause 9, and in situ ation where both demodulators may apply, applies clause 9 first. There is also a more subtle way in which a given set of relations may force the addition of more relations because multiplication is well-defined. For example, the relations AB = D and BC = E imply both that ABC = DC and ABC = AE. The technique described in the preceding paragraph does not add this relation, either implicitly or explicitly. The following clauses are used to add relations which are forced in this way, essentially by transitivity of equality. 10 11 12 13
CL -EQUAL(VO.Vl) -EQUAL(V0,V2) EqUAL(Vl,V2) CL -EQUAL(F(V0,VI),V2) -EQUAL(VI,V3) EQUAL(F(V0,V3),V2 CL -EQUAL(F(V0,F(V1.V2)),V3) -EQUAL(V2,V4) EQUAL(F(V0,F(V1,V4)),V3) CL -EQUAL(F(V0,F(VI,F(V2,V3))),V4) I -EQUAL(V3,V5) I EQUAL(F(V0,F(V1,F(V2,V5))),V4)
To see exactly how these clauses work, consider how AB — D and BC = E derive AE = DC. The relations AB = D and BC = E will be input as CL
EQUAL(F(A,F(B,V0)),F(D,V0))
CL
EQUAL(F(B,F(C,V0)),F(E,V0)),
and
respectively. Hyperresolution will clash these against the first two literals in clause 11 substituting F(C, VO) for VO in the first of these and with the following substitutions for the variables in clause 11: VO VI V2 V3
= = = =
A F(B,F(C,V0)) F(D,F(C,V0)) F(E,V0).
The resulting clause is CL
EQUAL(F(A,F(E,V0)),F(D,F(C,VO))),
as desired. 4.3 The Effect of H in Adding Relations. Recall that we are trying to modify the semigroup S, which has an antiautomorphism H, by adding relations to S in such a way t h a t the semigroup thus formed still has a well-defined antiauto morphism inherited from H. This means that for each relation added, its image under H must also be added. For example, since H(B) = C and H(C) — D, the relation BB = BC forces the relation CC = DC. In order to accomplish this, only one more clause is needed:
Semigroups,
14
Antiautomorphisms,
CL
and
Involutions
325
-EqUAL(F(V0,Vl),V2) EqUAL(F(H(REMVAR(Vl)), F(H(VO),V3)),F(H(REMVAR(V2)),V3)).
Thus from BB = BC, which is represented by CL
EQUAL(F(B,F(B,VO)),F(B,F(C,V0)))
we get, using clause 14 CL
EQUAL(F(H(REMVAR(F(B,V0))),F(H(B),V1). F(H(REMVAR(F(B,F(C,V0))),V1),
which demodulates, using clauses 8 and 9, to CL
EQUAL(F(H(B),F(H(B),V1))),F(H(F(B,C)),V1),
which demodulates, using clauses 7, 3 and 1, to CL
EQUAL(F(C,F(C,V0)),F(F(D,C),V0)),
which demodulates, using clause 1, to CL
EQUAL(F(C,F(C,VO)),F(D,F(C,VO))),
as desired. 4.4 Checking for Involutions. So far we have shown how t o represent relations and how the theorem prover automatically adds relations which are implied by these relations. In this section we describe those clauses input t o t h e theorem prover t o cause it t o check for the presence of an involution in t h e semigroup t h a t results from adding these relations to t h e original semigroup S. It is in this situation t h a t subsumption will be used. In Section 2.2 we discussed how one may narrow the search for involutions by considering only those which permute the generators. Therefore, one may check for involutions by checking the permutations of the generators which have order 2. There are nine such permutations. (BC)(D)(E) (BDXCKE) (BE)(C)(D)
(B)(CD)(E) (B)(CE)(D) (B)(C)(DE)
(BC) (DE) (BD) (CE) (BE)(CD)
These are checked, in order, in a single theorem-proving run, but it will suffice to demonstrate what clauses are input to check for the presence of one involution. To input the involution to be checked, the clause CL
PERM(X,Y,Z,W)
is input, where X, Y, Z, and W represent the images of the generators B, C, D, and E under the involution. For example, to check for the presence of the invo lution (BC)(D)(E), we use the clause
Collected Works of Larry Wos
326 CL
PERM(C,B,D,E)
In order to cause the input of a PERM clause to automatically generate a collection of demodulators corresponding to specifying the values of the involu tion J on the generators, we introduce the following clauses. 15
CL
16 17 18 19
CL CL CL CL
-PERM(V0,V1,V2,V3) -PERMSEL(V0,V1,V2.V3,V4,V5) EQUAL(J(V4),V5) PERMSEL(V0,V1,V2,V3,B,V0) PERMSEL(V0,V1,V2,V3,C,V1) PERMSEL(V0,V1,V2,V3,D,V2) PERMSEL(V0,V1,V2,V3,E,V3)
Thus, for example, input of the clause CL
PERM(C,B,D,E)
will cause generation of the clauses CL CL CL CL
EQUAL(J(B),C) EQUAL(J(C),B) EQUAL(J(D),D) EQUAL(J(E).E).
The clause which says J is an antiautomorphism is 20
CL
EQUAL(J(F(V0,V1)),F(J(V1),J(V0)))
In order for permutation of the generators of the original semigroup S to give rise to an involution on the new semigroup, it must remain well defined in the presence of all the relations being added. T h a t is, if XY = Z then J(Y)J(X) — J(Z). This statement is represented by the clause 21
CL
-EQUAL(F(V0,V1),V2) EQUAL(F(F(J(REMVAR(V1)), J(V0)),V3),F(J(REMVAR(V2)),V3))
T h e various relations are clashed against the first literal in clause 21. If an involution is inheritable to the new semigroup, the two arguments of the second literal must be identical, after all demodulators are implied. If this happens, the resulting clause will be subsumed by the input clause. 22
EQUAL(V0.V0).
Therefore we can tell whether the new semigroup supports an involution inherited from S by seeing whether any clauses are generated from clause 21. If at least one clause is generated (and not subsumed) from clause 21 for each of the nine input PERM clauses, then the resulting semigroup has no involution. If a clause is generated by clause 21 and kept, then the generated clause describes the contradiction which blocks the existence of the proposed involution.
Semigroups,
Antiautomorphisms,
and
Involutions
327
The reader may recognize at this point that difficulties associated with the word problem need to be dealt with, since we are relying on the generated set of demodulators to reduce equal expressions to identical expressions. In fact, our set of demodulators forms a complete set of reductions [2] and so all equal expressions will indeed be reduced to identical ones. The demodula tors have the finite termination property since the universe of terms for this problem was well-ordered by our program and when a demodulator is ap plied, the resulting term is less than the original term in the well ordering. They have the unique termination property since they apply to one another. If EQUAL(A, B) and EQUAL(A, C) both occur, then the first demodulates the second to EQUAL(B,C), deleting EQUAL(A,C) but maintaining its effect, since the term A will now demodulate first to B and then to C. Therefore it is impossible for a term to demodulate to two different terms. For example, consider the example of order 7 which was found. The input relations were: BC = BB, DD = BB, and all products of three or more elements equal to BD, as well as to CE, EC, and CB. This semigroup is described by entering the following clauses: CL CL CL CL CL CL
EQUAL(F(B,F(C,VO)),F(B,F(B,V0))) EQUAL(F(D,F(D ( VO)),F(B,F(B,VO))) EQUAL(F(C,F(E,VO)),F(B,F(D,VO))) EQUAL(F(E,F(C,VO)),F(B,F(D,VO))) EQUAL(F(C,F(B,VO)),F(B,F(D,VO))) EQUAL(F(V0 > F(V1,F(V2,V3))),F(B,F(D,V3)))
The methods of Sections 4.2 and 4.3 cause many other relations (demodulators) to be generated, among them 101
CL
EQUAL(F(C,F(D,V0)),F(B,F(D,V0)))
The involution (BC)(D)(E) CL
is considered by entering the clause
PEREM(C,B,D,E),
which produces a set of demodulators as described above. When clause 101 is clashed against clause 21 the result is CL
EqUAL(F(F(J(REMVAR(F(D,V0))),J(C)),V3), F(J(REMVAR(F(B,F(D,VO)))),V3).
This is then immediately simplified, using all available demodulators, to 126
CL
EQUAL(F(B,F(D,V0)) I F(B,F(E,V0))).
This clause is a new relation, and hence represents a contradiction. The exact nature of the contradiction is as follows. The relation CD = BD (CL 101) is a consequence of the input relations. Applying J to both sides gives us BD = BE (CL 126), which is false in the semigroup being considered. The other possible
Collected Works of Larry Wos
328
involutions are eliminated similarly. In fact, clauses can be constructed which cause the theorem prover to loop through the possible involutions in one run. C o n c l u s i o n . T h e mathematical results contained here are of interest in their own right. Moreover, we have attempted to show by example how one might use a general purpose theorem-proving program as a tool in mathematical research. A p p e n d i x . There are exactly four semigroups of order seven which support an antiautomorphism but no involution. One is given in Section 2.3 above. The remaining are: a b c d e f 9 a e f f 9 e e e 6 e e e 9 e e e c / 9 e f e e e e e e d e 9 e e e e e e e e e e e e e e e e e / e e e 9 e e e e
a 6 c d e
f 9
a b c d e
f 9
a
b
c
d
/ e / e e e e
f
f
9
9 9 9 e a e
e e e e e
9 e e e
a
b
/ e 9 e e e e
f
c 9 e
d 9
9 9
f
e e e.
f
a f
f
f f
e e e e
9 e e e
e e e e e e e e
f
e e e e e e e e
f
e e e e e e e
e e e e e e e
9 e e e e e e e 9 e e e e e e e
For all three semigroups, the antiautomorphism acts as follows: h(a) = b, h(b) c, h{c) = d, h(d) = a, h{e) = e, h(f) = g, h(g) = f.
Applied Mathematics Division Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439
Semigroups,
Antiautomorphisms,
and
Involutions
329
Applied Mathematics Division Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 Computer Science Division Northern Illinois University DeKalb, Illinois 60115
1. C. L. CHANG & R C. T. LEE, Symbolic Logic and Mechanical Theorem Proving, Academic Press, New York, 1973. 2. D. E. KNUTH & P. B. BENDIX, "Simple word problems in universal algebras," Computational Problems in Abstract Algebras (J. Leech, Ed.), Pergamon Press, New York, 1970, pp. 263-297. 3. J. D. MCCHAREN, R. A. OVERBEEK, and L. Wos, "Complexity and related
enhancements for automated theorem-proving programs," Comput. Math, with Appl., v. 2, 1976, pp. 1-16. 4. J. D. MCCHAREN, R. A. OVERBEEK, & L. Wos, "Problems and experiments for
and with automated theorem-proving programs," IEEE Trans. Comput, v. C-25, No. 8, 1976, pp. 773-782. 5. R. A. OVERBEEK, "An implementation of hyper-resolution," Comput. Math. with Appl, v. 1, 1975, pp. 201-214. 6. S. WINKER & L. Wos, Automated Generation of Models and Counterexamples and Its Application to Open Questions in Ternary Boolean Algebra, Proc. 8th Internat. Sympos. on Multiple-Valued Logic, Rosemont, Illinois, May 1978, IEEE, N.Y. and ACM, New York, pp. 251 256.
♦785-68-15 L. WOS, Argonne National Laboratory, Argonne, Illinois 60439. Solving Open Questions in Mathematics with an Automated Theorem Proving Program. Recent advances in automated theorem proving techniques have made possible the use of theorem-proving programs in attacking open questions in several areas of mathematics. Some questions answered include: 1. Does there exist a finite semigroup which simultaneously possesses a nontrivial antiautomorphism while possessing no involution? 2. If such a semigroup exists, what is the smallest one? 3. Do the 5 axioms for a ternary Boolean algebra form an independent set? 4. In the equivalential calculus, are any or all of the formulas, BXO, XAK, XCB, and XHN, strong enough to be a shortest single axiom for that calculus? 5. What axioms can be adjoined to those for Robbins algebras to ensure that such an algebra is Boolean? The answers were obtained by having the theorem-proving program generate models, search for counter-examples, and find proofs. No special features or additional programming was required. Additional open problems of any of the types cited here are being sought. (Received February 9, 1981) (Author intro duced by Professor Woodrow W. Bledsoe)
Reprinted from Abstracts of the AMS, Vol. 2, no. 3, p. 336 (April 1981) by permission of the American Mathematical Society.
An Automated Reasoning System by L. WOS and S. K. WINKER Argonne National Laboratory Argonne, Illinois and E. L. LUSK Northern Illinois University DeKalb, Illinois
ABSTRACT This paper is an introduction to an automated reasoning program developed at Northern Illinois University and Argonne National Laboratory over the past nine years. Recently the program has reached the stage where it can be considered a useful research tool in a variety of disciplines. It has solved open problems in mathematics and participated in the design of new electronic circuits. Here we describe the general types of capabilities provided to the user by the program and give examples of how they are currently being used in diverse areas of investigation. INTRODUCTION In this paper we survey various uses of an existing automated reasoning system. Rather than describe its internal organization or theoretical foundation, which has been presented elsewhere, we concentrate here on how it appears to a user who has no need to understand the internals of the system. The program, developed over the past nine years at Northern Illinois Uni versity and Argonne National Laboratory, has gradually grown from a tool for studying the automated reasoning process itself into a program which is being used as an intelligent colleague on research projects in several areas. We begin by giving in the next two sections an overview of the system and those features of the control language by which the user tailors the program Reprinted from Proceedings of the AFIPS National Computer Conference, pp. 697-702 (May 1981). Published with permission from AFIPS Press, copyright 1981.
332
Collected Works of Larry Wos
to the problem he wishes to study. Then we give some examples of problems successfully solved using the system. These are presented not so much for their content, which has in some cases been published elsewhere, as to demonstrate what kinds of reasoning tasks the program is capable of, so that the reader may determine whether or not he faces tasks which are similar enough that a program such as this one may be of genuine use. We present examples of how the program has been used to approach prob lems in circuit design, program verification and debugging, formal logic, and abstract algebra. These are intended to illustrate concrete instances of general reasoning tasks, such as conjecture formulation and testing, automatic genera tion of counterexamples, formula classification, case analysis, and finding alter nate -solutions to problems. Finally we speculate on how the system and its relatives and descendants might be used in the future. OVERVIEW OF T H E SYSTEM In this section we present an informal summary of some of the systems salient features as they appear to the user. History The system being described here was originally developed for the purpose of investigating algorithms for automated deduction. The classical test problems for such programs are known mathematical theorems, and programs like ours are often called automated theorem provers. It is the contention of this paper that such a label is far too narrow. Known mathematical theorems provided a good starting point for develop ment of the program. Their proofs were well understood, and could be used to pinpoint methods of reasoning to be incorporated into the system. The tech niques so developed, however, have become powerful enough to be of real use in attacking a wide variety of problems, both in and out of mathematics, a num ber of whose solutions were not known ahead of time. For example, some open problems in mathematics have been solved and some original research in circuit design has been completed using the system. It has thus become a genuine rea soning tool for research in several areas, some of which are described in detail below. A user community is just beginning to develop, consisting of people who use the program in research investigations, without knowledge of or even interest in the internal workings of the program. The developers hope that this community will continue to expand to include an even greater number of researchers.
An Automated Reasoning
Representation
of
System
333
Information
Like most computer programs, this system has a rather formal input lan guage. Preprocessors exist for converting a variety of other forms into the format suitable for input to the system. A logician would say that the input language has the expressive power of the first-order predicate calculus with equality. W h a t this means to the user is that most problems can be readily represented. Rules of Inference There are a number of ways in which the program can be instructed to reason. They can be specified by the user either singly or in various combinations to suit the problem at hand. We give some examples. One rule concentrates on "if-then" statements. It derives the conclusion of such a statement once all of the conditions are established. Two other rules involve a preference for simple facts. For example, the state ment that A is a larger number than B would be treated by the system as a simple item of information, whereas the statement that if A is odd and B is even then their product is even is a complex one. The first of these inference rules reasons from simple facts in the sense that at each step at least one of the facts used in the derivation must be simple. T h e other rule reasons toward simple facts in the sense that the conclusion of each inference must be simple, no matter how complex the antecedents might be. Another inference rule, which is useful in the presence of many facts which assert the equality of certain expressions, either conditionally or unconditionally, is a generalized form of equality substitution. Finally, the program can solve a problem by case analysis, which means that the problem can be broken into subproblems, each of which is attacked with a possibly different combination of inference rules. Strategies of Attack One can think of the inference rules as small-scale strategies. There are also a variety of mechanisms for specifying large-scale strategies. These guide the overall attack on the problem by specifying such things as the order in which certain facts are examined for consequences, which inference rules will be applied to which combinations of facts, and what derived information will be retained for further use or discarded as useless. For example, most problems consist of general background information about the field being studied together with some specific statements which describe the particular problem or situation being investigated. Sometimes it is worthwhile to reason from the background information to derive still more general information; other times it is best to focus entirely on the problem at hand. The user can specify that new information is to be derived only when it is at least in part
334
Collected Works of Larry Wos
based on a selected subset of the input statements. There is much flexibility in information management. In particular, the user may define various pools of facts which can be used as he specifies. For example, facts from one pool can be selected to see if they generate any new information when used with facts from another pool, and the results placed into a third pool. The input language is used to control the use of each of these pools during the course of the run. A third component of an attack strategy is the determination of what sorts of information to keep and what to discard. The number of facts which can be deduced in a given situation is potentially quite large, and can contain many irrelevant and redundant facts. Therefore some filtering mechanism is essential, both as a criterion for forgetting a fact altogether, and for remembering it but using it only as a last resort. The mechanism used in our system provides con siderable flexibility in this regard. For example, one can penalize or prefer a class of objects, or even statements having a very particular form. This mechanism will be discussed in detail in the next section. EVALUATION A N D TRANSFORMATION OF INFORMATION In this section we discuss two of the main subsystems of the reasoning system. The first is a technique for specifying the value of various items of information. The second is a mechanism for transforming derived facts in various ways prior to measuring their value. These two features used together are surprisingly flex ible and powerful, and have been used in many ways that were unforeseen at the time of their implementation. Some of these specific applications will be given in detail below. Assigning Values to Terms The language used for both input to and output from the program consists entirely of user-defined expressions which contain function and predicate sym bols, variables, and constants. A flexible format exists for assigning values to various patterns of expressions. Thus each term has an integer associated with it, called its weight. The simplest valuation scheme gives each symbol the same value. This makes complex expressions "heavier" than simple ones. In several different ways dis cussed below, the program prefers lighter terms and facts about them to heavier ones. Thus the scheme of assigning to each symbol the same value causes the program to prefer facts about simple expressions to facts about complex ones. This is often a useful way to begin, since it corresponds to our intuition that we are on the right track in working on a problem when it seems to be getting simpler instead of more complicated. However, the valuation scheme chosen can be used to prefer or penalize ex pressions based on far different measures than symbolic complexity. For example,
An Automated
Reasoning
System
335
one could prefer facts about multiplication over those about addition, causing the product of four operands to be "lighter" than the sum of three operands. In circuit design, specific gates or combinations of gates can be preferred. In algebra problems, a standard direction of association can be specified. The weighting mechanism can recognize arbitrarily complex patterns of symbols. For example, logical expressions whose rightmost major subexpression contains no repeated variables can be preferred over those not having this property. There are three major ways in which the program prefers light terms to heavy ones. First, expressions and facts about them which are deemed too heavy are simply discarded. One must be careful, of course, not to set the weight limit for retained facts too low, or valuable information will be lost. Second, the program uses weight to select at each step which facts to derive further information from, using light ones before heavy ones. This has the effect of causing the program to press forward along lines of inquiry which it can measure as valuable, ignoring at least temporarily facts which it considers less valuable. Thus selection of a weighting scheme supplies the program with a type of intuition about promising lines of reasoning. Thirdly, when two expressions carry the same information, their weights are used to determine which representation of the information they contain should be used, as we describe in the next section. Thus the simplest weighting scheme causes the program to simplify formulas, while more elaborate weighting schemes trigger more subtle transformations of information. Transforming
Information
Whenever a fact of the form that one expression is equal to another is either input or derived during the run, the two expressions are weighed according to the user's weighting scheme. If one term is preferable to the other by a wide enough margin (where "wide enough" is user-supplied), then this fact assumes a special status, that of demodulator. What this means is that all instances of the less preferred form of the expression are immediately replaced by the more preferred form, and from that point on only the preferred version of derived facts is kept. This dynamic rewriting process, called demodulation, has a surprising variety of uses. Perhaps its most common use is in simplifying expressions, but it can also be used to analyze and classify formulas, to rewrite terms in a canonical form, to transform information from one notation to another, and to cause information which has served its purpose to be deleted. Some illustrations of its use are given in the next few sections. E X A M P L E S OF C U R R E N T U S E OF T H E S Y S T E M In this section we describe some of the specific ways in which the system is currently being used. It is hoped that these cases will illustrate the general usefulness of the program and suggest to the reader how it might be applicable
336
Collected Works of Larry Wos
to his own current problems, whatever they may be. Circuit Design Multi-valued logics present an interesting class of circuit design problems. A particular group of researchers has been recently interested in designing circuits for a four-valued logic (inputs and outputs of circuits could take on four different values), and wanted to utilize T-gates in the construction of these circuits. A T-gate in four-valued logic is a five-input, one-output gate in which one of the inputs is used to select which of the other four inputs will be used as the output value. It was known how to design such circuits, but more efficient circuits than those then known were being sought. Our system was used to investigate this problem. It must be emphasized that no new programming was done to obtain the solution. Rather, the researchers involved learned how to describe the design process as a set of reasoning tasks, expressed in the input language of the system. First, the table of input-output conditions of the desired circuit had to be described. This was relatively straightforward. Next, this table had to be de composed to produce the various tables which result from choosing each of the target circuit's inputs as selector inputs for T-gates. This task was carried out by describing the decomposition rules to the system as "if-then" statements, so that it would "infer" the decomposition tables from the original specification. The system was directed to generate and examine alternate decompositions through its mechanism for case analysis. Elementary subcircuits (such as constant or identity functions) were recognized through the use of demodulation. Finally, a weighting scheme was specified which directed the system to prefer T-gate circuits meeting certain efficiency criteria. This project originated as an experiment in using a general purpose reasoning system rather than a special purpose program for carrying out real circuit design tasks. The experiment was a success in that new circuits were discovered which utilized T-gates and had efficiency properties superior to those appearing at that time in the literature. Program Verification Program verification is the process of proving that a program is correct by a logical argument instead of by exhaustive testing. There is currently much research in this area, and a number of experimental systems are in operation. We describe here some of the applications of our system to this area. Our experiments have been with programs written in FORTRAN, accompa nied by statements (expressed in first-order logic) about the program. We have available to us a program transformation system which converts the FORTRAN code, together with assertions bearing on how the program is expected to be have, into a collection of statements which says, in our system's input language,
An Automated Reasoning
System
337
that the FORTRAN code does what the assertions say it does. The system is then asked to prove that this collection of statements is true. Alternatively, the system can find a counterexample, that is, can pinpoint the case in which the program fails to meet its specifications. The application of our system to program verification is still in experimental stages in the sense that the complexity level of the programs that can be verified directly from the FORTRAN code, without hints from the user, is very low. For example, the system can verify a FORTRAN program to find the maximum element of a vector. The conditional and unconditional transitions within the program are represented as statements of the form "If one is at statement N in the program and such and such a condition holds, then this action is taken on the program variables and control is passed to statement M." A case analysis mechanism explores the various paths through the program. A related application of the same reasoning system is symbolic execution of programs. T h e system can be made to generate a collection of test data for the program of whatever kind desired and automatically step through the program with each set of data. The results can be automatically compared with the expected results supplied by the user and exceptions noted. This too is in the early development stag*:. The following is a very simple example which is quite easy for both t h e system and for a human, but which illustrates the kind of activity which can be carried out using the system. Consider the following algorithm for sorting the integers from 1 to N. Sup pose A is the array of integers to be sorted. Then for I from 1 to N, if A(I) is not equal to I, exchange A(I) and A(A(I)). If one tries this algorithm on the vector (2,4,1,3), one might get the mistaken impression that it is correct. The reasoning system examined the algorithm, coded in FORTRAN, and correctly discovered that it does not correctly sort the vector (3,4,2,1). Formal Logic A logician introduced us to the field of equivalential calculus, a logical system in which the "truth" of formulas can be determined syntactically, and for which there is a single inference rule, called condensed detachment, for deriving one formula from two others. A family of interesting questions arises in considering which of the true formulas are "single axioms" in the sense that all other true formulas are derivable from them by the rule of condensed detachment. The first task we undertook was to shorten a known proof that a particular formula implied a known single axiom and thus was itself a single axiom. Our reasoning system was used to do a number of subtasks associated with trying to find a shorter proof. First, condensed detachment had to be simulated. Since it is a special form of one of the system's built-in inference rules, this was easy. Next we studied the structure of the existing proof. One could see that terms with a specific structure were used predominantly but not exclusively in the proof. The demodulation and weighting mechanisms described above allowed
338
Collected Works of Larry Wos
the system to classify formulas and prefer those of certain classes. The control we had over various pools of facts allowed us to bring other terms into the proof search periodically. The result was a proof of twenty-one steps as opposed to the forty-four step proof appearing in the literature. Since the system had proved so useful in approaching this problem, we were inspired to try some of the open questions in the area. There were seven for mulas about which it was unknown whether or not they were single axioms. These formulas were relatively complex, and applying the rule of condensed de tachment to them by hand was extremely difficult. (We were not at all familiar with equivalential calculus and so had to make the system into a substitute for intuition.) We selected one of the seven formulas and attempted to prove or disprove that it was a single axiom for the equivalential calculus. What made this endeavor significant as an application of our automated reasoning system was the irregular, changing set of uses we found for it. We made various conjectures along the way, and used the system to prove or disprove the conjectures. The conjectures themselves were suggested to us by the output of the system. Examination of the formulas derived from another single axiom candidate led us first to conjecture that the formulas derivable from the formula being considered would all follow a certain pattern. The system quickly proved this conjecture false. Several iterations of this type were performed. As the patterns being investi gated became more complex, demodulators were introduced to have the system itself examine its own output for these patterns. Eventually, a new notation was introduced for expressing derived formulas and the demodulation feature of the system was used to write the formulas in this notation. More than once, a disproof of a conjecture by the system was accompanied by the exact informa tion needed to make the next, better, conjecture. This activity eventually led to a proof that all formulas derivable from the candidate single axiom contain a certain subtle pattern. Since there are "true" formulas in the equivalential calculus which do not contain this pattern, the given formula cannot be a single axiom. Several more open problems of this nature were done, each in a slightly different way but in all cases relying heavily on the automated reasoning system for generating and testing conjectures. Mathematics The system has been used to solve several open problems in mathematics. We give here an example from abstract algebra. We were asked whether our system might be of use in answering the following question: Does there exist a finite semigroup which supports an antiautomorphism but no involution? This question was answered positively by the system, which exhibited a semigroup of order eighty-three with the desired property. An exhaustive search through all semigroups, starting with those of small order, would have been inordinately ex-
An Automated Reasoning System
339
pensive, and the system did not do this. Rather, it examined the consequences of adding relations to a given semigroup, testing whether a given antiautomorphism remained well-defined and whether any involutions could be found. There was thus substantial interaction between the researchers, who proposed the relations, and the system, which checked the effects of adding them to the semigroup being constructed. Eventually it was proved, with much interaction of this kind with the system, that the smallest semigroup with this property had order seven, and that there were exactly four semigroups of order seven with this property. Thus the system behaved like a mathematical colleague in eventually helping the researchers arrive at a complete answer to the question. The model generation facility of the system was also used to solve an open question in the theory of ternary Boolean algebra. Since this capability can be used to find counterexamples to conjectures, it forms a valuable complement to the system's ability to prove theorems. FUTURE USES OF A N AUTOMATED REASONING SYSTEM Here we consider some of the areas in which we expect that continued re search and development in automated reasoning will have a significant impact. Program Verification Perhaps the most significant area, and one currently attracting the most re search effort, is program verification. An ultimate goal would be to have signifi cant programs certified correct without human intervention (except in supplying the statements which assert the purpose of the program). This is a very difficult problem, and several more modest goals are being pursued. One is to allow a user to guide the reasoning system through a proof of correctness, decomposing the task and having the system verify a series of small steps of the program. Another is to verify properties of the program that are easier to prove than its overall correctness. An example of such a property might be: "The variable I only takes on values between 1 and 100." Yet another goal short of the ultimate one is to have the system verify an abstract form of the program or one written in some special purpose language which is easier to work with than a production language. On the other hand, the model generation facility of the system described here can be used to find a bug in a program when a correctness proof is eluding the user. Often a counterexample is just what is needed to pinpoint the error. Automated Expression Generalization One of the traditional components of the theorem-proving system is a mech anism for finding the most general common instance of two expressions. By varying the input language we have directed our system on occasion to do the
340
Collected Works of Lemry Wos
opposite; that is, to find the least general expression of which two given expres sions are instances. This ability to generalize could be used in the case where the expressions represented programs to find an algorithm which generalizes specific known cases. Results of such a technique could be used in code optimization and modularization. Mathematics The system we describe here has the potential for becoming a genuine math ematical calculator. Numerical calculators are of course now familiar, but many problems in mathematics involve extensive calculations with non-numerical ob jects. This is particularly true in abstract algebra and topology. A mathemati cian may describe as a "calculation" any sequence of inferences which can be defined by an algorithm. Of course a special purpose program can be written to carry out such a computation, but this is time- consuming. By contrast, the al lowable inferences and their sequencing can be described to a general reasoning system, and the desired calculations carried out without any new programming. It was in this way that the semigroups described above were discovered. More generally, the system provides a way to easily examine the conse quences of adding or removing facts to those defining a situation being studied. Examination of such consequences by the researcher may be of use in forming conjectures to be tested by further use of the sytem. Circuit Design Circuit design promises to be a fertile field for application of automated rea soning systems, using techniques originally developed for applications in abstract algebra. It is possible to weight various alternative constructions and thus cause the system to evaluate circuits according to very flexible user-supplied criteria as it generates a family of designs which meets a certain specification. Process Control One potential area in which very little has been done is the application of general reasoning systems to the control of complex physical processes. Again, the key step is to abstract the control logic to an inference system; that is, physical consequences of situations are specified by modeling them as logical consequences. Programming these systems from scratch can be very difficult, since a very complex system with many interacting components can hide the interdependencies among certain actions and results. An automated reasoning system can be used to define very clearly the actions to be taken when certain conditions arise and to apply those rules in unforeseen situations, all without any new programming.
An Automated Reasoning System
341
CONCLUSION We have tried to convey, principally by example, the usefulness of a system such as ours, in which reasoning tasks, rather than numerical computations, are automated. In order to use the system for these tasks, one need not understand the internals of the system, but only learn the input language. By means of this language, our general-purpose program can be tailored to a specific problem area so that it behaves much like a special purpose program. It is this ability to tune the system that has made possible the success of the program as a tool in such diverse areas. REFERENCES 1. McCharen, J. D., R. A. Overbeek, and L. Wos. "Problems and Experi ments for and with Automated Theorem-Proving Programs." IEEE Trans actions on Computers, Vol. C-25, No. 8, August 1976, pp. 773-782. 2. McCharen, J. D., R. A. Overbeek, and L. Wos. "Complexity and Related Enhancements for Automated Theorem-Proving Programs." Computers and Mathematics with Applications 2 (1976), pp. 1-16. 3. Overbeek, Ross A. "An Implementation of Hyper-Resolution." Computers and Mathematics with Applications, Vol. 1 (1975), Pergamon Press, pp. 201-214. 4. Overbeek, R. A., and E. L. Lusk. "Data Structures and Control Archi tecture for Implementation of Theorem-Proving Programs." In W. Bibel and R. Kowalski (Ed.) 5th Conference on Automated Deduction, Berlin: Springer-Verlag, 1980, pp. 232-249. 5. Winker, S. K., and L. Wos. "Automated Generation of Models and Coun terexamples and its Application of Open Questions in Ternary Boolean Algebra." Proceedings of the Eighth International Symposium on MultipleValued Logics, Rosemont, Illinois, pp. 251-256. 6. Winker, S. K. "Generation and Verification of Finite Models and Coun terexamples Using an Automated Theorem Prover Answering Two Open Questions." Proceedings of the Fourth Annual Workshop on Automated Deduction, Austin, Texas, pp. 7-13. 7. Winker, S. K., and J. Berman. "Finite Basis and Related Results for an Upper Bound Algebra" (Abstract), Notices of the American Mathematical Society, vol. 26 (August 1979), p. A-427. 8. Winker, S. K., L. Wos, and E. L. Lusk. "Semigroups, Antiautomorphisms, and Involutions: A Computer Solution to an Open Problem, I." (to appear)
342
Collected Works of Larry Wos
9. Wojciechowski, W., and A. S. Wojcik. "Multiple Valued Logic Design by Theorem Proving." Proceedings of the Ninth International Symposium on Multiple-Valued Logic, Bath, England, 1979. 10. Boyle, J. "Program Adaptation and Program Transformation." In R. Ebert, J. Lugger, L. Goedcke (Ed.) Practice in Software Adaptation and Mainte nance. Amsterdam: North Holland Publishing Company, 1980. 11. Manna, Z. Mathematical Theory of Computation. New York: McGraw-Hill, 1974.
Solving Open Questions with an Automated Theorem-Proving Program* by L. Wos Argonne National Laboratory Argonne, Illinois 60439
Abstract The primary objective of this paper is to demonstrate the feasibility of using an automated theorem-proving program as an automated reasoning assistant. Such usage is not merely a matter of conjecture. As evidence, we cite a number of open questions which were solved with the aid of a theorem- proving program. Although all of the examples are taken from studies employing the single program, AURA [19] (which was developed jointly at Argonne National Labo ratory and Northern Illinois University), the nature of the various investigations shows that much of the success also could have been achieved with a number of theorem-proving programs. In view of this fact, one can now correctly state that the field of automated theorem proving has reached an important goal. A theorem-proving program can now be used as an aid to ongoing research in a number of unrelated fields. The open questions are taken from studies of ternary boolean algebra, finite semigroups, equivalential calculus, and the design of digital circuits. Despite the variety of successes, no doubt there still exist many who are very skeptical of the value of automating any form of deep reasoning. "This work was supported by the Applied Mathematical Sciences Research Program (KC04-02) of the Office of Energy Research of the U. S. Department of Energy under contract W-31-109-ENG-38. Reprinted, with permission of Springer-Verlag, from Proceedings of the Sixth Conference on Automated Deduction, Vol. 138, Lecture Notes in Computer Science, ed. D. W. Loveland, Springer-Verlag, New York, pp. 1-31 (June 1982).
344
Collected Works of Larry Wos
It is the nature of this skepticism which brings us to the second objective of the paper. The secondary objective is t h a t of dispelling, at least in part, some of the resistance to such automation. To do this, we discuss two myths which form the basis for the inaccurate evaluation of both the usefulness and the potential of automated theorem proving. Rejection of the two myths removes an important obstacle to assigning to an automated theorem-proving program its proper role—the role of colleague and assistant.
1
Introduction
There is one question which has been repeatedly asked of those in automated theorem proving. When will automated theorem-proving programs prove new theorems? The question is a natural one and exceedingly reasonable. The name of the field itself evokes the image of answering open questions. Fortunately, the field can now say that programs can and have answered various previously unanswered questions. In this paper we shall briefly discuss some of the open questions which were solved with the assistance of an automated theorem-proving program. These questions are taken from ternary boolean algebra [21], finite semigroups [22], formal logic [26], and circuit design [20,24]. In solving them, the program was used in a variety of ways. Taken together, the uses suggest that the program be haves like a colleague. Colleagues sometimes provide the necessary information to complete a task, sometimes give but a clue to solving the problem, and some times fail completely. The program is equally valuable and equally frustrating. However, the material covered here shows that such a program can be used as an aid to reasoning—a reasoning assistant. It may well serve as the complement to the numerical calculator. We shall be content with a brief account of the methodology employed in solving the various problems since the details can be found elsewhere. The dis cussion will, however, be sufficient to illustrate the interplay which may occur between the program and the researcher. This cooperation is quite similar to that which is required when working with a consultant or colleague. We shall concentrate on our work rather than presenting a survey of the field in general. In Section 2, we shall cover the achievements to date. In Section 3, we shall give the methods and techniques used to obtain the results. In Section 4, we shall explore certain myths that have interfered with the acceptance of the field as a whole. In Section 5, we shall discuss the current work and the future intentions. Although all of the open questions cited here were solved by relying on a single theorem-proving program, much of the methodology which was employed
Solving Open Questions with an Automated Theorem-Proving Program
345
to obtain the solutions is available to the field as a whole. The following vital fact should be kept in mind throughout the entire reading of this paper. No additional programming was required to solve the open questions cited here. Thus, although each area of investigation required both the mapping of the problem into appropriate clauses and the formulation of an overall strategy of attack, all of the research was conducted with a standard theorem-proving program. The program, AURA [19], is that which has been developed jointly at Argonne National Laboratory and Northern Illinois University.
2
Open Questions Answered with t h e Aid of an A u t o m a t e d Theorem-proving P r o g r a m
In this section we catalogue the various open questions which have been an swered. In the next section we give a brief discussion of the theorem- proving methodology employed in obtaining the solutions. 2.1. Ternary Boolean Algebra A ternary boolean algebra is a nonempty set satisfying the following 5 ax ioms: 1) f(f(v,w,x),y,f(v,w,z)) = f(v,w,f(x,y,z)) 2) f(y,x,x) = x 3) f(x,y,g(y)) = x 4) f(x,x,y) = x 5) f(g(y),y,x) = x where the function, f, acts as a so-called "product" and the function, g, acts as a so-called "inverse". Which (if any) of these 5 axioms is independent of the remaining set of 4? Axioms 4 and 5 had been known to be dependent, and proofs had been obtained by various theorem-proving programs such as that of Allen and Luckham [1] and
346
Collected Works of Larry Wos
that of G. Robinson and Wos [unpublished]. There remained the corresponding questions for each of 1, 2, and 3. A methodology was formulated [21] which established the independence of each of the 3. While the dependencies could be established by the standard use of a theoremproving program in its capacity for finding a proof, the independencies relied on a quite different usage. The program was made to find models—models of various sets of 4 axioms which failed to satisfy the fifth. These 3 models were very small, each consisting of but three elements. The models in effect took the form of a table in which one could check that the necessary "products" and "inverses" held or failed as dictated respectively by those axioms to be satisfied and violated. The significance was in the new usage, namely, that of having automated theorem-proving programs find models and counterexamples. This powerful methodology, formulated by S. Winker [23], was essential to answering the next question to be discussed. Before turning to the problem covered next, we briefly answer one obvious question. The question is: Why not extract the desired models from a prooffinding run. The objection to this approach centers around the fact that many of the questions to be answered are of a second-order nature. Although one could use a standard trick to then map the second-order question to a firstorder question, there still exists the serious problem of obtaining a completed run—a run which obtains the required proof. The nature of the model might require an extremely, and perhaps prohibitively, long run. Thus, we suggest an attack which directly seeks a model when that is the objective. 2.2. Finite Semigroups I. Kaplansky brought the following (then) open question to our attention. Does there exist a finite semigroup which simultaneously admits of a nontrivial antiautomorphism while admitting of no nontrivial involutions? An antiautomorphism is a mapping, h, such that 1. h is one to one; 2. h is onto; 3. h(xy) = h(y)h(x). The mapping is nontrivial if it is not the identity mapping. A nontrivial invo lution is an antiautomorphism, different from the identity, whose square is the identity. Here again we have the same dichotomy as occurred with the ternary boolean
Solving Open Questions with an Automated Theorem-Proving Program
347
algebra questions. If the presence of such an antiautomorphism implies the pres ence of such an involution, a standard proof search is the method of attack. However, if this is not the case because of the existence of a semigroup of the desired type, then a model or counterexample must be found. The model gen erating capability was the method which we chose first to employ, and it was successfully applied. In this application, it was imperative that the program not attempt to exam ine the various finite semigroups starting with the smallest. There are entirely too many to consider even of order 6. It was also important to avoid considera tion of commutative semigroups, for only nontrivial answers were being sought. The approach, the details of which are given in Section 3.2, yielded a semigroup of order 83. With this answer in hand, the next natural question to be asked was that of minimality. Again it was desirable and, more importantly, possible to avoid a saturation approach. The minimal semigroup of the type being sought has order 7. Finally, there arose the question of the number of such minimal semigroups. The program found that there are exactly four, which of course required the ability to test for isomorphism.
Collected Works of Larry Wos
348 2.3. Logical Design of Digital Circuits 2.3.1. Design
How can an automated theorem-proving program be made to design circuits? Can it then be asked to find ones which are more efficient than the existing ones? The field of interest was 4-valued logic, and the technology which was of inter est consisted of the employment of T-gates. The T-gate is a basic component for multi-valued logic as well as for 2-valued logic. In 2-valued logic it is the familiar multiplexor. There existed digital circuits employing these T-gates which were quite satisfactory and even thought to be minimal. W. Wojciechowski suggested that an automated theorem-proving program might be used in attempting to find more efficient digital circuits. In most of the cases that were studied, suitable encoding of the problems [24] for the program resulted in obtaining more efficient digital circuits than were known. Two important points thus emerged. First, a new application for theorem-proving programs was found. The problems required an encoding of various input/output tables and axioms to describe the desired behavior of components. Second, a member not of the field of automated theorem-proving chose to use such a program in preference to writing a special-purpose program. 2.3.2. Hazards One property to be avoided in the design of circuits is that of the presence of hazards. A hazard is a condition in which some signal arrives at some point sooner than expected and also sooner than desired. The presence of a hazard can, for example, cause all signals to be simultaneously 1, which may be specif ically prohibited. The problem, suggested by A. Wojcik, was that of having the program detect hazards. S. Winker was able to implement [20] a sophisticated hazard-detection algebra [2]. He was able to then present this problem to the program and have it successfully detect hazards when presented with a circuit containing one. There then arose the question of validation of the absence of such conditions. Again S. Winker was successful in devising a method [20] to have the program make such a validation. These applications extend both the use of the standard input language for theorem-proving programs and the corresponding methodology. They also strongly demonstrate versatility. One obvious goal for such a system is that of
Solving Open Questions with an Automated
Theorem-Proving
Program
349
practical application. The examples so far have been essentially only theoreti cal. However, just as has now been demonstrated in mathematics and logic, the circuit design studies may also pass from the theoretical to the applied. The difficulty of the size of circuits to be studied might at first appear to be insur mountable, but the examples cited next from formal logic may in part dispel this fear.
2.4. Formal Logic We now come to the perhaps most interesting and certainly the hardest questions we have as yet solved with the program. The questions concern the possible existence of "new" or additional shortest single axioms for the equivalential calculus [6,16]. The elements of that calculus are the expressions which can be recursively well-formed from the variables, x, y, z, w, ..., and the 2-place function E. (The function, E, can be thought of as "equivalent".) The theorems of the calculus are just those formulas in which each variable therein occurs an even number of times [3]. The standard inference rules consist of a substitution rule and a rule of detachment. However, often studies are instead conducted by means of the inference rule called condensed detachment. Definition. For the 2 formulas E(A,B) and A, detachment is that inference rule which yields the formula B. Definition. For the 2 formulas E(A,B) and A' which are assumed to have no variables in common, condensed detachment is that inference rule which yields the formula B", where B" is that which is obtained from detaching E(A",B") and A", and where E(A",B") and A" are respectively obtained from E(A,B) and A' by the most general possible substitution whose application forces A and A' to become identical. Thus condensed detachment, when it applies, takes two formulas and re names their variables so that they have no variables in common, then seeks the most general substitution that can be found whose application will per mit a detachment, and finally applies detachment to the pair of formulas af ter the substitution has been made. For example, the condensed detachment of E(E(E(x,x),z),z) with E(E(x,y),E(y,x)) yields E(x,x) and also yields E(x,E(E(y,y),x)), depending on the order in which the premisses are considered. In the equivalential calculus, there are 630 formulas in which each variable occurs exactly twice and in which five E's occur. Each of these 630 formulas, therefore, has length eleven, where length is the symbol count. Then; are for-
350
Collected Works of Larry Wos
mulas of length 11 which are strong enough to serve as a single axiom for the entire calculus, and thus all theorems are deducible from such a formula. When we began our study, there were seven of the 630 formulas which had not yet been classified with regard to the status of being a single axiom. The conjecture [4] existed that none of the seven was strong enough. A typical method for showing that some given formula of a calculus is too weak to be a single axiom for that calculus is the following. Find a model which satisfies the formula in question but which also fails to satisfy some known axiom of the calculus. If one finds such a model, then the given formula is too weak to be a single axiom since one of the theorems of the calculus—one of its axioms-is provably not implied by the given formula. Employment of this standard approach might force one to examine many models which fail to have the desired properties. Because of the number of models which were found to be useless, and more importantly because we had begun to formulate a "new" powerful methodology, we chose to abandon consideration of models altogether. We formulated a method, completely implementable within current theoremproving technology, which allows the examination of the entire set of theorems deducible from certain of the formulas. For those formulas which turned out to be inadequate with regard to being a single axiom, the method for establishing such inadequacy is the following. For such a formula, find a characterization of all theorems deducible from it by condensed detachment. Then, by recourse to the characterization, show that some known axiom of the equivalential calculus cannot be so characterized and thus must be absent from the theorems yielded by the formula under study. Finally, conclude that the formula is therefore too weak to be a single axiom for the calculus. Perhaps more interesting than establishing the various inadequacies and certainly surprising, in view of the conjecture, is the fact that we found proofs which establish that two of the formulas are in fact (new) shortest single axioms. Each of the two proofs in question is extremely long and complex if phrased in terms of condensed detachment. Yet we found a representation which per mitted the program to generate each. Since the proofs were not in terms of a straightforward application of condensed detachment, we then formulated a method to convert them to such. The conversions were also done with the au tomated theorem-proving program. This action was taken to yield information in the form preferred by the logician. To illustrate the difficulty and complexity of the study, note that one of the proofs consists of 162 condensed detachment steps. Among those steps, some are of length greater than or equal to 95—the number of symbols excluding commas and grouping symbols—while one step is of length 103. This proof would appear to be out of reach of a special-purpose program employing a standard approach.
Solving Open Questions with an Automated Theorem-Proving Program
3
351
Methodology
The organization of this section parallels that of the previous section. We con centrate here on the methodology from the viewpoint of automated theorem proving, beginning with the parallel of Section 2.1. 3.1. Ternary Boolean Algebra The study of ternary boolean algebra led directly to the extension of the use of automated theorem-proving programs. Before this study, they had been almost solely used for the task of proof finding. With the completion of the study, the ability to directly find models and counterexamples had been added. A model or counterexample often takes the form of a set of clauses which, for example, can be translated into a table giving relations among the various elements. Examination of the table shows which "products" and which "inverses" hold or fail. The method employed illustrates the cooperation that can occur between the researcher and the program. The first action which was taken was that of seeking a proof of, for example, the dependence of axiom 2 on the remaining set of four. As is now well-known, this failed because axiom 2 is independent of the remaining. In order to show that axiom 2 is an independent axiom, we sought a model which simultaneously satisfies each of axioms 1, 3, 4, and 5, while violating 2. Nonunit clauses are input and used to ensure that axioms 1, 3, 4, and 5 are satisfied. A glance at the Appendix reveals the mechanism being employed and also shows that the run looks identical to one in which a proof rather than a model is being sought. These nonunit clauses were used as nuclei for a run employing hyper-resolution [12,18]. (Recall that a nucleus for hyper- resolution is a nonunit clause containing some negative literals, while the positive clauses required by the inference rule are called satellites.) We began the model search with a guess at the number of elements that might suffice. We guessed three was enough. Since an early run had found that the lemma, g(g(x)) = x, holds for all x when axioms 1 through 3 are present, it was sufficient to force the lemma to fail for some element of the proposed model. This violation is sufficient to allow axiom 2 not to hold. Next, a partial model was conjectured. The program was given some guesses at the so-called products and so-called inverses. The nuclei are used to force certain relations to hold. For example, with
Collected Works of Larry Wos
352
-q(x) -q(y) EQUAL(f(x,x,y),x) as the nucleus corresponding to axiom 4, f(a,a,a) = a must hold, where a is one of the elements of the partial model. The predicate, Q, means "is an element of the proposed model". We therefore added to the input the units Q(a) Q(b) Q(c) so that tests could be applied to the proposed model. By using hyper- resolution, the given nucleus was used to test all appropriate triples against the fourth axiom. Similar nuclei were input corresponding to the remaining axioms to be satisfied. Demodulators, which respectively express the "products" and "inverses" oc curring in the partial model under development, were input and/or adjoined while the run was already under way. These demodulators, or rewrite rules, are automatically applied to the clauses yielded by hyper-resolution. If at any time a clause is generated which is not an instance of EQUAL(x,x), and if the nucleus occurring in its history is the correspondent of one of the axioms to be satisfied, we have two possibilities. First, we may have found another relation on the way to completing the model. Second, we may have violated the assumed distinct ness of the given elements comprising the model. If the former occurs, we adjoin the new relation and proceed further with the goal of completing the model. If the latter occurs, we must replace some given relation(s) with the valuable knowledge that the particular choices made so far will not enable us to complete a model of the desired type. An example of such an occurrence is the derivation of EQUAL(b,a), which is unacceptable since we are assuming that b and a are distinct elements. At that point, the program must back up and try a different value for one or more products and/or one or more inverses. By iterating with this procedure, the program did find a model of the desired type which showed that axiom 2 was an independent axiom. Finally, to see which triple violated axiom 2, a nucleus of the form, -q(x) -Q(y) EQUAL(f(y,x,x),x), was adjoined. If we are successful in finding a model of the desired type, which means that all products and all inverses have been determined, there must exist a triple which will not demodulate to an instance of reflexivity. That triple will
Solving Open Questions with an Automated Theorem-Proving Program
353
be found when hyper-resolution uses this last nucleus and performs the various substitutions including the interesting one. 3.2. Finite Semigroups Although a number of questions were eventually answered in the investiga tion, we began with the following question. Does there exist a finite semigroup which simultaneously admits of a nontrivial antiautomorphism while admitting of no nontrivial involutions? The first task was the selection of the branch to explore. We could have the program attempt to prove a theorem stating that no such semigroup exists, or we could attempt to refute such a theorem by finding a counterexample in the form of a model. We chose, fortunately, to concentrate on the second alternative. As will be seen, the theorem-proving program was used as an assistant. The following is an outline of the approach which was taken. 1. Concentrate on reasonably large semigroups. Larger structures allow more possibilities for such a simultaneous existence. 2. Choose a representation of semigroups which permits consideration of fairly large ones. 3. Conduct some experiments with the program to find some conditions which force finiteness on the structure. 4. Since the presence of an antiautomorphism and/or an involution depends on a certain type of symmetry, impose much symmetry on the structure to allow for the former. Then interfere sufficiently with that symmetry to block the latter. Adherence to the first point allows enough room to impose somewhat odd behavior on the semigroup. Obviously, if the semigroup were very small, its structure would be very limited. However, largeness can present a problem of representation. One can in general choose between two methods of representation. One can either give a set of triples which encode the multiplication table, or one can give a set of generators and relations which determine the entire structure of the semigroup. The employment of generators and relations is well-known to the mathematician. With its use, one gets a compact notation which permits
354
Collected Works of Larry Wos
the easier study of large structures. (The models one might hope to extract from a proof-finding run would not be in terms of generators.) The elements are the "words" expressed in terms of the generators. Multiplication is simply concatenation. Demodulators are used to encode the relations and to perform the multiplications, see Appendix. An argument, conducted by hand, shows that the demodulators perform their intended task. We decided to have four generators because of certain math ematical considerations. For example, since we wish to avoid commutativity of the structure, any nontrivial antiautomorphism must have even order. Next, it must not have order 2 since we are desirous of blocking involutions. Then, with four generators, we could consider an antiautomorphism which cycled the generators. Finally, the program must not be given the task of examining the awesome number of large semigroups. Experiments with the program showed what was needed to guarantee finiteness. By adding a relation which forces all words of length greater than or equal to n, for some n, to be identical, finiteness is achieved. Early failures produced the semigroup of order 1 and a well-known one of order 8, both of which proved useless. Experiments led to the imposition of the relation which forces all elements of length greater than or equal to four to be identical. The resulting semigroup, generated by the four generators and constrained by this one relation, was found by the program to have order 85. However, symmetry abounds. Not only do antiautomorphisms exist, but also do many involutions. The mapping, h, which maps b to c, c to d, d to e, and e to b, where b, c, d, and e are the generators, is the antiautomorphism on which we concentrated. The mapping, j , which interchanges b and c while leaving fixed both d and e is an example of an involution which we needed to block. To attempt to block such involutions, we added a relation which would at least in part destroy some of the symmetry in this semigroup of order 85. When the program was given that relation, be = de, it found it inadequate. Involutions still existed which said that the symmetry had not been sufficiently marred. However, the relation, bbc = dde, was sufficient. The program was then required to explore the consequences of this addition. It found that the only other relation which was implied was dec = bee. This was found by continual reference to the assumed presence of the mapping, h. Of course, the program continues to check for associativity, for example. Af ter all, we are seeking a semigroup. The program also continues to check for the viability of the antiautomorphism, h, and the avoidance of various involu tions. The result of this researcher/program exchange was the discovery of a
Solving Open Questions with an Automated Theorem-Proving Program
355
semigroup of order 83 of the desired type. We then turned to the related questions of minimality. We found by heavy use of the program that there exists a semigroup of the desired type of order 7. There are in fact four such which are not isomorphic. The tests for isomorphism were also conducted by the automated theorem-proving program. At no time did we examine these questions by means of saturation. There are a myriad of semigroups even of order 6. The important point to continually keep in mind is the role of the program. It is an aid to reasoning and can be assigned many and varied tasks of a logical nature. 3.3. Electronic Circuitry 3.3.1. Design The object in this study was that of designing various digital circuits. We decided to emulate the approach taken by engineers. The engineer begins with a set of specifications for the digital circuit and a set of possible components to be used. The characteristics of the components are known. He often then replaces the original problem with a set of smaller and more manageable subproblems. The idea is that of giving specifications for the subcircuits, and then of using the components to combine the subcircuits into the circuit being sought. The program was given the specifications in a straightforward manner, namely, in the form of an input/output table. It was then told how to decompose this table into useful subtables, each representing a subcircuit. It was told how to recognize very small circuits which were immediately constructible. Finally, us ing the basic components, it was told how subcircuits were to be combined into the larger circuit. The basic component of interest is the T-gate. The program was then assigned the task of finding interesting and efficient digital circuits. The task took the form of finding a proof that some digital circuit of the required type exists. Since a number of classes of subcircuit were not of interest, demodulators were used to have these subcircuits, upon discovery, transformed to "junk". Such a transformation thus prevents the uninteresting subcircuits from interacting with the interesting ones. Since the goal was that of examining a number of solutions, different circuits of the desired type, the program was instructed not to stop after a (single) proof had been found. Thus a single run yielded a number of circuits of interest.
Collected Works of Larry Wos
356
The digital circuits were extracted from the "proofs" thus obtained. Most of the digital circuits found were better than those extant in the literature at the time. We offer the following brief explanation for our choice of method for find ing the circuit models. We were able to seek them with a proof-finding run rather than with a direct model search because of both the given information and the nature of the problem. We were, for example, able to rely on various decompositions into subcircuits. 3.3.2. Hazards A hazard is a condition in which some signal arrives at some point in time sooner than expected and also sooner than desired. To detect the presence of such a condition, one needs to evaluate the consequences which may occur, over time, as the input changes. There is an algebra, called Fantauzzi hazard algebra [2], which studies the consequences at discrete points in time of changes in the input to the circuit. The two questions of interest concern the presence and/or the absence of hazards for a given circuit. Since the number of situations to be considered is a small finite number, at least in the cases we examined, the program employed an exhaustive approach. The determination of the presence or absence was simply made by inspecting the output of the program upon completion of the run, see Appendix. The run terminates when no inferences are left to be made. A case analysis technique is employed to consider the various changes which are of interest—the changes of the input to the circuit. Circuits possessing and circuits free of hazards were examined and correctly classified [20]. 3.4. Formal Logic The problem which created our interest in formal logic was that of finding a shorter proof for a known theorem. The theorem in question establishes that a particular formula, XGK [14], from the equivalential calculus is a single axiom for the calculus. As was explained in Section 2.4, the often used rule of inference is condensed detachment. An examination of that rule reveals that it is quite similar to UR-resolution [9] and also to hyper-resolution. (In UR-resolution, the nucleus is a nonunit clause, the satellites are unit clauses, and the required inference is a unit clause.) We found a proof [26] which is but half as long as the published one. It was found by having the program weight [10,26] certain
Solving Open Questions with an Automated Theorem-Proving
Program
357
formulas in such a way which caused some to be much preferred while others were totally avoided [26]. During this investigation, we found that demodulators could be written which would correctly classify formulas according to various syntactic proper ties. Other demodulators were found which counted the number of occurrences of the symbol, E, in each parent and in the resulting inference. Because of our success in finding the shorter proof, and because of the discovery of new and nonstandard applications of demodulation, we turned to certain open questions. We first considered the formula, XBB, and attempted to examine those for mulas which it yielded by application of condensed detachment. Although this formula was already known to be too weak to be a single axiom for the calcu lus, its study nevertheless proved valuable. The program found longer and ever longer clauses. This immediately led to the conjecture that this ever-increasing in length property held for all formulas obtainable by starting with XBB and repeatedly applying condensed detachment. If this were the case, we could char acterize all the theorems implied by the formula under study. It proved to be the case. The proof was obtained by hand, but the conjecture resulted directly from the examination of one run with the automated theorem-proving program. We then applied the conjecture to other formulas—ones which had not yet been classified as to being single axioms. The program yielded the fact that the conjecture of ever-increasing length did not hold for those formulas. The demodulators for counting symbol occurrences, mentioned above, were in part employed. The reading of the resulting clauses was quite cumbersome in view of their similarity and complexity. We thus introduced a demodulator to transform them into a more readable form. We also decided to first concentrate on the formula, XAK. In the next run, all kept clauses were rewritten, where the rewrite rule was in the form of a demodulator—a demodulator designed to promote readabil ity. W h a t resulted was the startling fact that all kept clauses shared a single subexpression, up to alphabetic variance. We thus conjectured that all formu las implied by the now under study formula, XAK, had this property. If this were provable, then all theorems deducible by condensed detachment from XAK would contain this marvelous subexpression, and we would know that the for mula was inadequate with respect to being a single axiom for the equivalential calculus. The inadequacy follows from the fact that there are known theorems in the calculus which do not contain this particular subexpression. Since condensed detachment yields an infinite set of formulas to be studied, we had the program conduct its examination in terms of schemata rather than in terms of individual formulas. The program was then used to examine the possible schemata, forms for theorems, so deducible from XAK. We quickly concluded
Collected Works of Larry Wos
358
that an induction argument, relying on a case analysis study, might suffice to pin down the possible forms. The induction is on the length of the most general common instance of two unifiable expressions. Although the actual induction was not by means of the program itself, the needed cases were examined by it. Again the program proved invaluable and performed as a colleague. We had a somewhat natural but, as it turned out, naive notion as to the nature of the case analysis. It turned out to be somewhat subtler than expected. The program runs showed that the original plan for the case analysis would continually yield new cases to be considered. An examination of the output in fact suggested the true nature of the case analysis. Since the details are to be found elsewhere [26], we are content with the following summary. Use of the program led to various conjectures, refuted oth ers, suggested notation, and pointed the way to the correct case analysis that was needed. With this much assistance, we could hardly fail. We were able to correctly classify each of the (at the time) remaining seven formulas. Five were found to be inadequate, while two were found to in fact be shortest single axioms for the calculus. One more success with the program was to occur. The proofs of the existence of the two additional shortest single axioms were obtained in a nonstandard notation. The notation was oriented towards the schemata we had employed throughout. The logician might well be uninterested in this form of proof. We therefore had the program translate each of the two proofs into the standard form of proof, that which employs condensed detachment. As has been mentioned in Section 2.4, the resulting proofs are extremely long and extremely complex. The longest proof consists of 162 steps of con densed detachment. The most complex step in that proof contains 103 symbols, exclusive of commas and grouping symbols. A straightforward use of an auto mated theorem-proving program would have probably failed very badly. But a straightforward attack by the logician would also probably have met with disas ter. This entire study is a graphic example of our viewpoint that an automated theorem-proving program can be treated and used as a valuable automated reasoning assistant.
4
Myths and Responses
Two myths exist in regard to automated theorem proving. It is the first myth, the 0/1 myth, which is the more significant. Its essence is the belief that such programs must either solve all problems or be classed as useless, which is the explanation for the 0/1 designation. This myth demands that work on a given
Solving Open Questions with an Automated
Theorem-Proving
Program
359
problem must, for example, yield a proof or result in the designation of failure. Adherence t o the myth would mean that one merely looks at the last line of a run to see if the empty clause has been found. If not, then discard the run and term it useless. One would not, therefore, examine the clauses themselves to glean the possible gems contained therein. The second myth says that special-purpose programs are in the main prefer able to general-purpose. We deal first with the 0/1 myth. This 0/1 view, which is often hidden, may take the following form. For example, if a (known) theorem is submitted to an automated theorem-proving program, and if the program then fails to find a proof, the conclusion is drawn that the program is essentially useless. Such a reaction is the parallel to the following: if a colleague is asked to help with some research, and if he has nothing to contribute after some time, then he would also be classed as useless. Of course, this is not what is done. By way of expansion and also to see that the 0/1 myth does not apply to automated theorem proving, consider first what is expected of a colleague and then what may be expected of an automated theorem-proving program. A colleague might have the following properties: 1. He is in general willing to assist in the investigation of virtually any ques tion. In many cases, he unfortunately requires an inordinate amount of tutorial discussion to give some needed and missing background. In those situa- tions, he often contributes nothing significant. 2. In some few areas, he has demonstrated unusual research ability. He has, for example, solved a number of open questions. He has also provided information which has allowed others to solve some open questions. Such an associate is clearly considered of value. An automated theoremproving program also now has those same two properties, and thus should be similarly considered. The presence of the first property is not surprising in that obviously much work is often necessary to prepare a problem for the program. The presence of the second property, on the other hand, is that which is inter esting. As has been seen in the previous two sections, the program has been used to solve a number of open questions and thus has been used as a research aid and not just as a logical calculator. In attempting to solve these questions, we saw the complete spectrum of results. In formal logic, for example, a straightfor ward use of condensed detachment was shown to be pointless. However, as with a consultant, we proceeded with an alternate approach. Even then we met with various failures but also with various successes. Had we adhered to the 0/1 myth, our first attempts would have caused us to abandon the problem entirely. But
Collected Works of Larry Wos
360
the myth is not applied to a colleague, and, as evidenced by the eventual results of the study of formal logic, it should not be applied to automated theoremproving programs. When consulting an associate, three obvious outcomes may occur. 1. He may solve the problem completely on his own. 2. He may instead supply some hints or some missing information which is intended to make the problem easier. 3. He may totally fail. It is, of course, the third case which is of concern. Failure may consist of misunderstanding of the problem, of having no intuition on which to rely, or perhaps of even being obtuse. In any event, one does not write off the associate. One instead hopes that the next consultation will be more fruitful. In other words, the 0/1 myth is not applied. We treat the use of the theorem-proving program similarly. The crucial point here is the expectation which is present. In using the program as an aid or research assistant, one can expect results which range from complete success to total failure. If a criticism of the field were made, it might, at least implicitly, rest on the 0/1 myth. Various obstacles might be cited as evidence of the difficulty of achieving any substantial results. Obstacles such as complexity of proof, diffi culty of representation in the first-order predicate calculus, and the inability to apply intuition are but a few which are in fact often cited. The proof that these obstacles are insurmountable rests on the evidence of failure of the theoremproving program to complete some assigned task. Failure to complete a proof, for example, is extremely common for theorem-proving programs, but such fail ure is also very common even for the expert. One can, therefore, take either of two views in judging usefulness. 1. The designation of usefulness is applied to a colleague or a theorem-proving program when either can contribute sig- nificantly to the solution of prob lems from a limited but interesting class. 2. The designation is applied to either only when there exists the ability to approach almost any problem with at least competence, if not actual brilliance. The second of these views is reminiscent of that same 0/1 myth. It is of course the first view which we take and which we believe we have demonstrated as applicable to automated theorem-proving as a whole. The successful refutation
Solving Open Questions with an Automated
Theorem-Proving
Program
361
of the conjecture which existed for the equivalential calculus is a case in point. In view of the nature and difficulty of the proofs which comprise the refutation of the conjecture, it seems clear that the conjecture was a reasonable one. One could not reasonably expect an individual to guess that a proof of the type found by the program existed, especially in view of its length and complexity. The point which is becoming increasingly clear is that automated theoremproving programs can be treated as colleagues. With such a program, one can, for example, make conjectures, test conjectures, and find holes in proposed meth ods of proof. Each of these activities is reminiscent of that which a colleague performs. We now turn to the second myth—special-purpose programs are preferable to general-purpose. Of course the burden of refuting this myth lies with those advocating general-purpose programs. The arguments we give are in terms of ease of maintenance, variety of use, and convenience. Our claim to the first of these three properties would fall short if it were not for the fact that new modules are not needed for attempts in new areas. All of the problems which we cited were solved without recourse to additional pro gramming. We found that the standard procedures available to those in the field could be adapted to the required tasks. This does not imply that, for example, no new inference rules are needed. The formulation of such a new rule might require programming, and perhaps extensive programming. This possibility is but one of the reasons for the development of a new automated theorem-proving program, which is briefly discussed in Section 5. As for the second property, variety, the problems which were solved with an automated theorem-proving program range from circuit design to formal logic. The tasks range from finding more interesting models than existed to gener ating very long and complex proofs. The examples given from circuit design were in the context of efficiency, detection of hazards, and validation of the absence of such conditions. From abstract mathematics, we discussed problems of finding semigroups which adrrut of certain mappings while lacking others. In that connection, we discussed solving the corresponding problem of minimality but without recourse to examination of the myriad of undesirable semigroups. Finally from formal logic, we examined questions of the existence of new short est single axioms. This investigation required a flexible approach, case analysis, induction, and a representation which avoids the awesome consideration of mil lions of formulas. As for convenience, we state categorically that much is still needed. Famil iarity with the language required by the program in order to input a problem is but one of the difficulties. It is often at least cumbersome to learn to speak clearly in the language consisting of clauses. Then, since our system has innu-
Collected Works of Larry Wos
362
merable options and possible parameter settings, its use is further complicated. However, the second problem is somewhat reduced by the existence of a trans lator [7]—a program written by E. Lusk-which allows reasonable direction of the theorem-proving program by fairly understandable conventions. Examination of the work presented earlier focuses some doubt on the choice which favors special-purpose programs. The examples from formal logic at least suggest the difficulty of writing a special-purpose program for considering the questions that were answered. If a special-purpose program were written em bodying the techniques preseented earlier, the effort might be formidable. A direct attack on the open questions would have been perhaps impossible. The reason for this suspected impossibility lies with the very large number of for mulas which would be examined were condensed detachment employed.
5
Now
The natural question to ask is: where are we now? We are presently seeking more open questions. We wish to find those which require the finding of models and counterexamples, but also we wish to have those which require the finding of a proof. We are studying the feasibility of extending the studies of circuit design with the possible eventual application to industrial needs. In fact, the intention is that of eventually having a large group of users from various fields and with very divergent interests and purposes. The latest application is concerned with the validation of the design of nu clear plants. The case analysis techniques are but one example of that which can be brought to bear. We have a small partially completed interactive theoremproving program written in Pascal. A demonstration of its possible use in the examination of the specifications for a plant has been given. In order to facilitate the use of theorem-proving programs by a wide range of individuals, we are presently concentrating on the development and implemen tation of a new automated theorem-proving program. The program, written in Pascal, will be portable and will allow great flexibility. For example, one need not concentrate on the clause form for representing information. Also, one can conduct almost immediately new experiments either in the nature of "pure" theorem proving or in the nature of new application. The user of the new sys tem will, therefore, be able to shape the program and its properties and its application to his wishes. The notion is that the new automated theorem-proving program will be accessible to many in research. Being written in Pascal will make its structure and properties available for inspection and for change. In short, it may well
Solving Open Questions with an Automated Theorem-Proving
Program
363
serve as a research tool for various fields of study.
6
Conclusions
The field has now demonstrated the ability to contribute to research in var ious areas. Open questions in both mathematics and formal logic have been answered with the use of an automated theorem-proving program. However, the applications are not limited to those of research. There is some real evidence that practical use is possible. The success with digital circuit design and the detection of hazards is an example. Two extremely important points must be made. First, the results which have been cited here are in the main within reach of many automated theorem- prov ing programs. The techniques and methodology which led to these successes are accessible to the field as a whole. Second, all of the results presented here were obtained without any modification to the already existing automated theoremproving program. In view of these two facts, it seems reasonable to conjecture that the field of automated theorem proving has entered a new phase. That phase might be described as the merging of contemplated eventual goals with the realization of some of those same goals. There are of course still many of the same problems to solve. For example, too little is known about the interrelation of the representation of informa tion, the choice of inference rules, and the use of strategy. However, automated theorem-proving programs can now often be treated as a colleague—an auto mated reasoning assistant. Colleagues are asked to help with, among others, the formulation, testing, proof, and refutation of conjectures. A theorem-proving program can be asked for the same kind of help. Although the program often totally fails, occasionally it obtains startling results. Even many of those runs which run out of time and/or memory contain very useful information. The user/program exchange method of investigation often proves profitable. More open questions are needed. The attempts at solving such questions lead to the knowledge of the shortcomings of the present systems. The solving of any such question leads eventually to the submission of more open questions. This ongoing dialogue will, and already has in part, place the automated theoremproving program in its proper role—the role of automated reasoning assistant.
References [1] Allen, J. and Luckham, D., "An interactive theorem-proving program," Ma-
Collected Works of Larry Wos
364
chine Intelligence, Vol. 5(1970), Meltzer and Michie (eds), American Elsevier, New York, pp. 321-336. [2] Fantauzzi, G., "An algebraic model for the analysis of logic circuits," IEEE Transactions on Computers, Vol. C-23, No. 6, June 1974, pp. 576-581. [3] Kalman, J., "A shortest single axiom for the classical equivalential calculus," Notre Dame Journal of Formal Logic, Vol. 19, No. 1, January 1978, pp. 141— 144. [4] Kalman, J., private communication. [5] Lukasiewicz, J., "Der Aquivalenzenkalkul," Collectanea Logica, Vol. 1 (1939), pp. 145-169. English translation in [McCall], pp. 88-115 and in [Lukasiewicz/Borkowski], pp. 250-277. [6] Lukasiewicz, J., Jan Lukasiewicz: Selected Works, ed. by L. Borkowski, North-Holland Publishing Co., Amsterdam (1970). [7] Lusk, E., "Input translator for the environmental theorem prover - user's guide," to be published as an Argonne National Laboratory technical report. [8] McCall, S., Polish Logic, 1920-1939, Clarendon Press, Oxford (1967). [9] McCharen, J., Overbeek, R. and Wos, L., "Problems and experiments for and with automated theorem proving programs," IEEE Transactions on Computers, Vol. C-25(1976), pp. 773-782. [10] McCharen, J., Overbeek, R. and Wos, L., "Complexity and related enhance ments for automated theorem-proving programs," Computers and Mathe matics with Applications, Vol. 2(1976), pp. 1-16. [11] Meridith, C , "Single axioms for the systems (C,N), (C.O) and (A,N) of the two-valued propositional calculus," The Journal of Computing Systems, i, No. 3 (July 1953), pp. 155-64. [12] Overbeek, R., "An implementation of hyper-resolution," Computers and Mathematics with Applications, Vol. 1(1975), pp. 201-214. [13] Peterson, J., "Shortest single axioms for the equivalential calculus," Notre Dame Journal of Formal Logic, Vol. 17(1976), pp. 267-271. [14] Peterson, J., "The possible shortest single axioms for EC-tautologies," Auckland University Department of Mathematics Report Series No. 105, 1977. [15] Peterson, J., "An automatic theorem prover for substitution and detach ment systems," Notre Dame Journal of Formal Logic, Vol. XIX, Jan. 1978, pp 119-122.
Solving Open Questions with an Automated Theorem-Proving Program
365
[16] Peterson, J., "Single axioms for the classical equivalential calculus," Auck land University Department of Mathematics Report Series No. 78. [17] Prior, A. N., Formal Logic, Second Edition, Oxford, 1962, Clarendon Press. [18] Robinson, J., "Automatic deduction with hyper-resolution," International Journal of Computer Mathematics, Vol. 1(1965), pp. 227-234. [19] Smith, B., "Reference manual for the environmental theorem prover," to be published as an Argonne National Laboratory technical report. [20] Winker, S., Private Communication. [21] Winker, S. and Wos, L., "Automated generation of models and counter ex amples and its application to open questions in ternary Boolean algebra," Proc. of the Eighth International Symposium on Multiple-valued Logic, Rosemont, Illinois, 1978, IEEE and ACM Publ., pp. 251-256. [22] Winker, S., Wos, L. and Lusk, E., "Semigroups, antiautomorphisms, and involutions: a computer solution to an open problem, I," Mathematics of Computation, Vol. 37 (1981), pp. 533-545. [23] Winker, S., "Generation and verification of finite models and counterexam ples using an automated theorem prover answering two open questions," to appear in J. ACM. [24] Wojciechowski, W. and Wojcik, A., "Multiple-valued logic design by the orem proving," Proc. of the Ninth International Symposium on Multiplevalued Logic, Bath, England, 1979. [25] Wos, L., Robinson, G., Carson, D. and Shalla, L., "The concept of demod ulation in theorem proving," J. ACM, Vol. 14(1967), pp. 698-704. [26] Wos, L., Winker, S., Veroff, R., Smith, B. and Henschen, L., "Questions concerning possible shortest single axioms in equivalential calculus: an ap plication of automated theorem proving to infinite domains," in preparation.
Collected Works of L&rry Wos
366 APPENDIX
We illustrate here the use of an automated theorem-proving program in three diverse areas of application. The three areas are those of ternary Boolean algebra [21,23], finite semigroups [22], and the design of digital logic circuits [20]. We begin by discussing certain aspects common to all three applications. First, in none of the three areas do we seek the proof by contradiction normally associated with the use of theorem-proving programs. Rather we seek various kinds of models: mathematical models and counterexamples, or (in the case of circuit design) situations in which a physical system may fail to perform as desired. Second, the clauses used in generating models are essentially indistinguishable in form from those used to seek proof by contradiction. We emphasize that no reprogramming is needed to generate the models presented here. We do not even set a switch specifying model generation as opposed to proof search. Rather the same inference rules and parameter options serve for both purposes. In particular, the runs are so similar that glancing at the parameter settings does not allow one to differentiate between the two objectives. We turn now to the two mathematical studies, that for ternary Boolean algebra and that for finite semigroups. In each study an open question in math ematics was answered by discovery of an appropriate model [21,22]. Of course we did not know the models beforehand. Since we knew almost nothing about the desired models, we had to conduct an iterated search for them by making heavy use of the theorem prover. Each run exhibited here represents the culmination of such a search. Two methods for the presentation of a model to the theorem prover will be illustrated. The first method involves the use of explicit tables which give the action of various functions upon the elements of the model. This method will be applied to the study of ternary Boolean algebra. The second method implicitly defines the action of the various functions by means of generators and relations. This second method will be applied to the study of finite semigroups. Ternary Boolean Algebra In the first study, that of ternary Boolean algebra, we present the results of two theorem-prover runs. The first run establishes the consistency of one particular model. The second run shows that another proposed model fails to satisfy one of the required axioms. The input for the first run is as follows.
Solving Open Questions with an Automated Theorem-Proving Program
367
* Each line beginning with the character * is a comment. * We omit from this example those lines of input which give * program parameter settings. * * The following input clauses list the elements of a * proposed model. *; CL Q(a) ; CL Q(g(a)) ; * g(a) was abbreviated as b in section 3.1. ; CL Q(g(g(a))) ; * g(g(a)) was abbreviated as c in section 3.1. ; * The following clauses state that these three elements are * distinct. *; CL -EQUALCgCx),x); CL -EQUAL(g(g(a)),a); * The following demodulator defines the action of the * one-place function g upon the three elements. * g of a is g(a) and g of g(a) is g(g(a)). * only the action of g on g(g(a)) remains to be defined. *; CL EQUAL(g(g(g(a))).g(a)) ; * The following demodulators define the action of the * three-place function f upon the three elements. *; CL EQUAL(f(x,y,g(y)),x) ; CL EQUALCfCx,x,y),x) ; CL EQUAL(f(g(x),x,y),y) ; CL EQUAL(f(x,y,x),x) ; CL EQUALCf(x,g(g(y)),g(y)),x) ; CL EQUALCf(g(y),g(g(y)),x),x) ; CL EQUALCfCa,gCgCa)),gCgCa))),a) ; CL EQUAL(fCg(gCa)),a,a),gCgCa))) ; CL EQUALCfCa,gCa),gCa)),gCa)) ; * The following clause subsumes and deletes * any trivial equalities which may be derived. *; CL EqUALCx.x) ; * The remaining clauses are all nonunits.
Collected Works of Larry Wos
368
* Each serves as a nucleus for the inference rule of * hyperresolution. *; * The following nucleus checks that the given set of elements * is closed under the action of the function g. *; CL -Q(x) Q(g(x)) ; * The following nucleus checks that the given set of elements * is closed under the action of the function f. *; CL -Q(x) -Q(y) -Q(z) Q(f(x,y,z)) ; * The following nucleus checks that axiom 1 for ternary * Boolean algebra (see Section 2.1) is satisfied for all * ordered quintuples which can be formed using the three * elements given above. *; CL -Q(v) -Q(w) -Q(x) -q(y) -Q(z) EQUAL(f(f(v,w,x),y,f(v)w,z)),f(v,w,f(x,y,z))) ; * The following three nuclei check that axioms 3, 4, and 5 * for ternary Boolean algebra are satisfied for all ordered * pairs which can be formed using the three elements given * above. *; CL -Q(x) -Q(y) EQUAL(f(x,y,g(y)),x) ; CL -Q(x) -Q(y) EQUAL(f(x,x,y),x) ; CL -Q(x) -q(y) EQUAL(f(g(x),x,y),y) ; When this entire set of clauses is submitted to the theorem prover, no inferred clauses are added to the clause space. Rather, every inferred clause is demodu lated, subsumed, and deleted. The fact that no clauses in the predicate Q are added indicates that the input demodulators do in fact give complete function tables for the functions f and g. The fact that no new equality clauses are added indicates that axioms 1, 3, 4, and 5, which were checked by means of nuclei, are in fact satisfied in the model. Axiom 2 is falsified by the function table entry CL EQUAL(f(a,g(g(a)) ( g(g(a))),a) among others. Thus we have a model in which axioms 1, 3, 4, and 5 are satisfied but axiom 2 is not. Hence axiom 2 is independent of the remaining four. Our second run in ternary Boolean algebra is a slight modification of the
Solving Open Questions with an Automated
Theorem-Proving
Program
369
first. We replace the clause CL E Q U A L ( f ( a , g ( a ) , g ( a ) ) , g ( a ) ) by the clause CL E Q U A L ( f ( a , g ( a ) , g ( a ) ) , g ( g ( a ) ) ) in the input to the theorem prover. This alters the function table for f in just one position. The theorem prover now gives the following output. 23 19 1 2 2 1 1 EQUAL(g(g(a)),a); DEMODULATORS: 15 10 14 24 23 5 CONTRADICTION;
9
10
This indicates that the axioms checked are not satisfied in all instances. Rather, in a particular instance, one of the axioms (axiom 1) would force g(g(a))=a, contrary to the input condition that a and g(g(a)) are to be distinct. The reader may note that this second run could be regarded either as a model seeking run which failed, or as a run which successfully proves by contradiction that g(g(a))=a follows from the remaining conditions.
Finite Semigroups
We turn next to the second mathematical study, that of finite semi- groups. We present the results of two theorem-prover runs. One develops, from the presentation of a semigroup in terms of generators and relations, a fuller set of relations. A particular antiautomorphism is built into this semigroup. The other run shows that a certain mapping of the generators fails to induce an involution of the entire semigroup. The first run is the culmination of a series of experiments which sought a semigroup with the desired combination of properties. It develops from the given minimal set of relations a set of demodulators sufficient for making (if desired) an element list and a product table. Two inference rules are used. Paramodulation is used to examine interactions among the axioms and the relations. Hyperresolution is used, in conjunction with a particular nucleus clause, to im pose the desired antiautomorphism upon the relations of the semigroup. The input to the theorem prover is as follows. * The f o l l o w i n g c l a u s e subsumes any t r i v i a l
equalities
Collected Works of Larry Wos
* which may be generated. *; CL EQUAL(x.x); * * The following clause states that the product * operation in the semigroup is associative. *; CL EQUAL(f(f(x,y),z),f(x,f(y,z))); * * The following three clauses equate all products * of four or more elements in the semigroup to the same * element 1. *; CL EqUAL(f(x,f(y,f(z,w))),l); CL EQUAL(f(l,x),l); CL EQUAL(f(x,l),D; * * The following relation is introduced to reduce the * amount of symmetry present in the semigroup. * Elimination of symmetry can eliminate possible involutions. *; CL EQUAL(f(d,f(d,e)),f(b,f(b,c))); * * The following nucleus applies the antiautomorphism h to * all relations. »; CL -EqUAL(f(x,y),z) EQUAL(f(h(y),h(x)),h(z)); * * The following demodulators calculate the image of a term * under the antiautomorphism h. *; CL EqUAL(h(f(x,y)),f(h(y),h(x))); CL EqUAL(h(b),c); CL EqUAL(h(c),d); CL EqUAL(h(d),e); CL EQUAL(h(e),b); CL EQUAL(h(l),l); The output of this semigroup-seeking run yields but a single additional equalnamely, 14 7 6 EQUAL(f(d,f(c,c)),f(b,f(e,e))); DEMODULATORS: 8 12 11 11 2
8
8
10
9
Solving Open Questions with an Automated
DEMODULATORS:
9
Theorem-Proving
Program
371
2
In addition a message is printed indicating that no more inferences can be made using the selected inference rules. T h e presence of this message indicates that the set of demodulators has been fully developed as desired. With the aid of these demodulators a list of the distinct elements and the values of various products of the elements could now be obtained as detailed in [23]. The second run shows that a particular involution — that which interchanges b and d and also interchanges c and e — is not present in the semigroup. We provide the following input. * Subsumption of t r i v i a l e q u a l i t i e s *; CL EQUAL(x,x); * * Associativity *; CL EQUAL(f(f(x,y),z),f(x,f(y,z))); * * Demodulators defining the product operation in the semigroup. * The last one of this set was obtained in the preceding run. *; CL EQUAL(f(x,f(y,f(z,w))),l); CL EqUAL(f(l,x),l); CL EqUAL(f(x,l),l); CL EQUAL(f(d,f(d,e)),f(b,f(b,c))); CL EQUAL(f(d,f(c,c)),f(b,f(e,e))); * * The following nucleus applies a possible involution j * to all of the above equalities. *; CL -EQUAL(f(x,y),z) EQUAL(f(j(y),j(x)),j(z)); * * The following demodulators define a particular involution * j by giving a mapping of the generators and a rule for * extending the mapping to the remaining elements. *; CL EQUAL(j(f(x,y)),f(j(y),j(x))); CL EQUAL(j(b),d); CL EQUAL(j(d),b); CL EQUAL(j(c),e); CL EQUAL(j(e),c); CL EQUAL(j(l),l);
Collected Works of Larry Wos
372 The output yields two additional equalities.
15 8 6 EQUAL(f(e,f(d,d)),f(c,f(b,b))); DEMODULATORS: 9 13 11 11 2 DEMODULATORS: 10 2 16 8 7 EQUAL(f(e,f(e,b)),f(c,f(c,d))); DEMODULATORS: 9 12 12 11 2 DEMODULATORS: 10 2
9
9
12
10
9
9
13
13
Their presence in the run proves that the given mapping J of the generators cannot be extended consistently to an involution of the entire semigroup, for such an extension would require that these additional derived equalities hold. But these equalities do not hold in the semigroup on which we are focusing. This fact follows from a simple argument based on its order. Thus we establish that the involution under investigation is not present in this semigroup. Compa rable theorem-prover runs can be made to refute the existence of other possible involutions by defining each in terms of its action on the generators. Digital Circuit Design We turn finally to the study of digital circuit design. Our example [20] con cerns the detection of possible hazards in a binary logic circuit. The term "haz ard" refers to certain unsatisfactory behavior of a circuit during a change in the input to the circuit. We use nuclei and demodulators to generate various possible time-dependent inputs and to simulate the response of the circuit. We begin with a classification of possible time-dependent signals given by Fantauzzi (2j. The classes are as follows: both t and f denote steady, unchanging signals; tf denotes a smooth transition from the t state to the f state; t*t denotes a signal which is steady except for a transient change to f and back; t*f denotes a transition from t to f which is not smooth, but instead wavers between f and t before settling to f; ft, f*f, and f*t are defined analogously. We assume that the only admissible input signals are t, f, tf, or ft. The admis sible output signals, however, are permitted to include the other four signals, thus allowing for the possible presence of a hazard. We supply the following information to the theorem prover.
Solving Open Questions with an Automated Theorem-Proving Program
* We give the effects of combining signals * through the use of standard logic components. * We encode the t a b l e s given by Fantauzzi [ 2 ] . *
and
I f
ft
f*f f*t t
tf
t * t t*f
f f f f f f f * f I f ft f*f f*t f t f*f f*t f*f * ft I f f*f f*f f*f f*f f*f f*f f*f * f*f I f f*t f*f f*t f*t f*f f*t f*f * f*t I f ft f*f f*t t tf t * t t*f * t I f f*f f*f f*f tf tf t*f t*f * tf I f f*t f*f f*t t * t t*f t * t t*f * t*t I f f*f f*f f*f t*f t*f t*f t*f * t*f | f *; CL EQUAL(and(f,x),f); CL EQUAL(and(x,f),f); CL EqUAL(and(t,x),x); CL EQUAL(and(x,t),x); CL EQUAL(and(ft,ft),ft); CL EQUAL(and(ft,f*f),f*f); CL EQUAL(and(ft.f*t),f*t); CL EQUAL(and(ft.tf),f*f); * * (and similar clauses, omitted here because of * space considerations) * f t f*f f*t t tf t * t t*f * * not tf t * t t*f f f t f*f f*t * *; CL EQUAL(not(f),t); CL EQUAL(not(ft),tf); * (and so f o r t h ) . * * Definition of "nand" logical function * of one, two, and three arguments. CL CL CL * * *
EQUAL(nandl(x),not(x)); EQUAL(nand2(x,y),not(and(x,y))); EQUAL(nand3(x,y,z),not(and(x,and(y,z)))); We input demodulators which will evaluate the output of a p a r t i c u l a r c i r c u i t given a set of time-dependent
373
Collected Works of Larry Wos
374
* * * * * * * * *
inputs. We assume in this example that there are three input wires named a, b, and c. We assume further that nand gates, represented by the functions nandgl, nandg2, nandg3, are used. The function "ipt" will be used to encode the signals input to the three wires a, b, and c. For example ipt(t,f ,ft) represents inputs of t for a, f for b, and ft (transition f to t, no hazard) for c.
* * * *; CL CL
The function "eval" evaluates the output obtained from a given circuit (first argument) with a given input (second argument).
CL
EQUAL(eval(nandgl(x),vipt),nandl(eval(x,vipt))); EqUAL(eval(nandg2(x,y),vipt),nand2(eval(x,vipt), eval(y.vipt))); EQUAL(eval(nandg3(x,y,z),vipt), nand3(eval(x,vipt),eval(y,vipt),eval(z,vipt))); EQUAL(eval(a,ipt(xa,xb,xc)),xa); EQUAL(eval(b,ipt(xa,xb,xc)),xb); EQUAL(eval(c,ipt(xa.xb.xc)),xc);
CL CL CL * * We test all possible non-hazard inputs. * * We exhibit first a table of the circuit for fixed inputs, * and then a table for one-step transitions. * The outputs under one-step transitions may be examined for * the presence of hazards. *; * List of all possible steady inputs ; CL INPUT(f,fixed); CL INPUT(t,fixed); * List of all possible non-hazard transition inputs ; CL INPUT(ft,transition); CL INPUT(tf.transition); * Nucleus to generate list of outputs for fixed inputs ; CL -CIRCUIT(w) -INPUT(x.fixed) -INPUT(y.fixed) -INPUT(z,fixed) 10(input,a,x.b.y.c.z,output,eval(w,ipt(x.y.z))); * Nuclei to generate list of outputs for two fixed inputs and * one transition input ; CL -CIRCUIT(w) -INPUT(x,transition) -INPUT(y,fixed)
Solving Open Questions with an Automated Theorem-Proving Program
375
-INPUT(z,fixed) IQ(input,a,x,b,y,c,z,output,eval(w,ipt(x,y,z))); CL -CIRCUIT(w) -INPUT(x,fixed) -INPUT(y,transition) -INPUT(z,fixed) IOC input.a.x.b.y.c.z,output,eval(w,ipt(x,y,z))); CL -CIRCUIT(v) -INPUT(x,fixed) -INPUT(y,fixed) -INPUT(z.transition) 10(input,a,x,b,y,c,z,output,eval(w,ipt(x,y,z))); * * Circuit to test *; CL CIRCUIT(nandg2(nandg2(a,b),nandg2(nandgl(a),c)));
Among the clauses derived by the theorem prover is the following. 78 63 66 60 59 59 I 0 ( i n p u t , a , f t , b , t , c , t . o u t p u t , t * t ) ; This clause states that input signals of ft to the "a" wire and t to both the b and c wires produce the undesirable "hazard" behavior t*t in the output. By means of similar runs, one may test various alternative designs in searching for a design free of hazards. This concludes the Appendix.
PROCEDURE IMPLEMENTATION THROUGH DEMODULATION AND RELATED TRICKS S. K. Winker and L. Wos* Argonne National Laboratory Argonne, Illinois 60439
Abstract In writing a computer program, the programmer often uses procedures or subroutines to carry out frequently-occurring subsidiary tasks. These tasks range from simple bookkeeping and updating to the seeking of the generalization of two given formulas. Problems that one wishes to solve with the assistance of an automated theorem-proving program likewise of ten involve subsidiary tasks and the corresponding need for procedures (or their equivalent) to accomplish them. It is reasonable to conjecture that employment of procedures either requires the use of external programs or requires substantial modification of the existing theorem- proving program itself. In this paper we give examples that show that neither is the case. Demodulation is the key to implementing the procedures that accomplish such frequently-occurring tasks. We give here sets of demodulators for accomplishing a wide variety of tasks. The most complex given demodulator set enables the program to find the least general subsumer of two given unit clauses. We also consider questions of counting and classifying, bookkeeping and updating, and cleanup after case analysis. Finally, we give a set of demodulators for coping with set-theory in an efficient and natural way. The material presented here is but a sample of the additional possibili ties for the use of demodulation. Since it was not known how to accomplish some of the cited tasks purely within the context of automated theorem proving, the examples given here may lead to an expanded use of auto mated theorem-proving programs in general. Thus, although the use of "This work was supported in part by the Applied Mathematical Sciences Research Program (KC-04-02) of the Office of Energy Research of the U.S. Department of Energy under Contract W-31-109-Eng-38 (Argonne National Laboratory, Argonne, IL 60439) and in part by NSF grant MCS79-03870 (Northern Illinois University, DeKalb, IL 60115). Reprinted with permission from Proceedings of the Sixth Conference on Automated De duction, Vol. 138, Lecture Notes in Computer Science, ed. D. W. Loveland, Springer-Verlag, New York, pp. 109-131 (June 1982).
Procedure Implementation
through Demodulation
and Related Tricks
377
demodulation for both simplification and canonicalization demonstrates its value, it turns out that demodulation is even more powerful than was realized.
1
Introduction
Demodulation [24] plays an important role in automated theorem proving. There are many examples of problems in the literature [8,17,18,19,21,26] whose proofs would not have been obtained without the heavy use of demodulation. Demod ulation is used most often to simplify clauses, but it also is valuable in its use for canonicaliza- tion [16]. In this paper, we present a number of applications that are quite distinct from these two familiar uses. The applications cited here arise from the desire to solve a problem that frequently occurs with the use of automated theorem-proving programs—but to solve it strictly within the context of automated theorem proving. The problem is that of getting the theorem-proving program to accomplish various subsidiary tasks that, in standard programming, would be handled by means of some pro cedure or subroutine. These tasks, which arise while attempting to solve some larger problem, vary from the counting of the occurrences of some symbol within a formula to finding the generalization of two given unit statements. It is rea sonable to conjecture that employment of procedures to accomplish subsidiary tasks either requires the use of external programs or requires substantial mod ification of the existing theorem-proving program itself. The examples given here illustrate that neither is the case. We show how the procedures needed t o accomplish such tasks can be implemented by means of demodulation. The cor responding sets of demodulators may at first appear somewhat unnatural. The sets do, however, accomplish the tasks in question easily and without disrupting the main search being conducted by the program. A natural question that can be asked is: Why employ demodulation to ac complish the various tasks to be discussed? After all, there are two immediately obvious alternatives, that of additional programming and that of reliance on in ference mechanisms. As for the first alternative, we wish to avoid the necessity of additional programming. The adjunction of code to carry out some task burdens the user with debugging, for example. In addition, such code often has the dis advantage of only being useful for just the task at hand. Demodulation, on the other hand, is a common feature of many existing automated theorem-proving programs. Employment of it thus avoids the need for additional programming. In addition, as will be seen from the examples to be given, one merely replaces one set of demodulators by another set when the required task changes. As for the second alternative, reliance on an inference mechanism does not in gen eral provide the desired control over the scheduling of subsidiary tasks. If the scheduling is not properly handled, the program can be so diverted from the main objective that it is unable to complete the required work. By relegating the
Collected Works of Larry Wos
378
lesser tasks to demodulation, one prevents such interruptions from occurring. In fact the tasks are accomplished almost as asides. We give sets of demodulators for accomplishing a number of unrelated tasks. The tasks include: 1. finding the least general subsumer of two given unit expressions; 2. classifying expressions according to some classification scheme; 3. counting the occurrences of some given symbol within expressions; 4. bookkeeping of various types; 5. cleaning up after case analysis; and 6. treating set-theory in an efficient and natural fashion. Employment of sets of demodulators to handle tasks of the type just cited allows an automated theorem-proving program to conduct the main inquiry without hazardous diversion. Such sets of demodulators act as subroutines and provide the corresponding control over scheduling. With the exception of certain built-in functions for arithmetic, the approach underlying this work relies on standard theorem-proving techniques. It is the combination of certain notation, uses of such functions as the "list" function, and the nonstandard employment of demodulation that causes us to view some of what we present as "tricks". Although the tricks vary widely in complexity, taken as a whole they suggest the possibilities for having an automated theoremproving program rather easily implement diverse procedures. We suspect that these examples will readily suggest the solutions to comparable problems with the use of an automated theorem-proving program—solutions that employ de modulation rather than relying directly on some inference rule.
2
Demodulation: Treatment and Discussion
Before turning to the heart of the paper, we give both a brief account of the treatment accorded to demodulation within our program and the answer to the following obvious but necessary question. In the examination of the notation employed in the various examples included in this paper, it is natural to ask: How does the information get mapped into the required form? The choice of method for producing the required notation depends on the purpose at hand. One can merely input the information in the required form, or one can arrange for the program to transform the information as needed. The former is sufficient when, for example, the sole purpose of the run is to obtain some counts of some symbol occurrence as in 5.2. The latter is required, on the other hand, when the task is but one of many to be performed during a long and complex run. Such might be the case if the task were that of finding the least general subsumer of various pairs of unit clauses. In this case, the input is expanded to include nuclei
Procedure Implementation through Demodulation and Related Tricks
379
for transforming the information from one form to another and back. With this small but important point out of the way, we can turn to the general treatment of demodulation within our program. As is typical of virtually any feature of our system [5,6,8,9,10,15,25], there exist various parameters that permit many choices for the use of demodulation. For example, one can prevent any demodulation whatsoever even though many equality units are present. But one can instead cause each input equality unit and each generated equality unit to be adjoined and treated as a potential demodulator. Next, one has the option of having or blocking the back demodulation of clauses. Back demodulation is simply the demodulation of already retained clauses by "newly" adjoined demodulators. One can also select some subset of clauses and place them on a protected list—protected from back demodulation. Next, one can choose between two rather different algorithms for the appli cation of demodulators. The algorithm that is used in the examples cited here consists of applying demodulators in the order in which they occur in the clause space. One can choose, instead, to have the demodulators applied by a "best fit" criterion [9]. With this latter algorithm, the program chooses to apply that demodulator that most nearly matches the term being demodulated. The various features just cited can be used in combination and can be turned on and off repeatedly throughout the run. Demodulation is applied from the innermost term toward the outer. It is applied otherwise in a left to right fashion. Only one path of demodulation is considered, which is in contrast to the Allen and Luckham approach [1] of generating the full set of demodulants. In choosing the form in which to store a generated equality and in deciding whether or not to apply certain demodulators, certain lexical conventions are observed for tiebreaking and ordering. Upon generation, each clause is immediately treated with the available demodulators before any other process is applied. If a term is successfully demodulated, all of its arguments are revisited for demodulation and the term itself is again considered for further demodulation. If demodulation or back demodulation is successfully applied to a clause, the demodulated or back demodulated version is retained while the undemodulated version is purged. Certain built-in constraints prevent looping from occurring. At this point, one might well ask for some justification for this set of built-in choices. Among others, the following two comments are especially relevant to the material contained in this paper. First, back demodulation must be avoidable in order to prevent interference with certain given equalities which occur in certain examples given later. If this were not the case, then less control of the implementation of various procedures would exist. On the other hand, back demodulation must be available both for canonicalization of kept clauses and for the deletion of certain clauses that are only relevant to particular subcases of a case analysis. Second, the one path treatment is vital to such packages as that for counting which is given below. For example, the second demodulator in the set for counting is applied only if the first does not. If multiple path
Collected Works of Larry Wos
380
demodulation were allowed with this set of demodulators for counting, then a number of demodulants would result. They would yield counts ranging from 0 to the correct count, which of course defeats the purpose of the set. In addition, we feel the combinatorics of multi-path demodulation is in general to be avoided. The expanded use of demodulation has led us to extend the first-order pred icate calculus to include the integers. We chose to do this in preference to either the cumbersome use of the successor function or to the use of various axioms for arithmetic. This in turn led us to add certain built-in functions to the pro gram. Such built-in functions are always preceded by "$". An example of such is $SUM. When, for example, $SUM(1,5) occurs, it demodulates to 6. (The only example occurring in this paper of such special functions is with the counting demodulators.)
3
Bookkeeping, U p d a t i n g , and Scheduling 3.1. The problem Set
In various investigations, one often is forced to do a fair amount of book keeping and updating. In solving puzzles, for example, a common occurrence is that of making some list of possibilities and crossing off elements of the list with the appropriate designation of "good" or "bad". As an example, consider the following incomplete description of a puzzle. There are four people who hold eight jobs between them. Each holds exactly two jobs. The object of the puzzle is to determine who holds which jobs. Information is given that enables one to pair off certain people with certain jobs. More importantly, information is given that allows certain pairings to be eliminated thereby eventually leading to the appropriate coupling. This puzzle solving by the process of elimination is a common element in much of reasoning. With pencil and paper, the corresponding bookkeeping pro cedure is obvious. With a program written with the specific purpose of solving the puzzle, a procedure is written to continually update the database. How ever, with a theorem-proving program, it may not be obvious how to encode a corresponding procedure, especially if efficiency is required. Of course, such updating can be accomplished through the usual means of inference. This approach, however, often interferes with the main train of thought, for it often inadequately handles the scheduling of the various subtasks. It can have the side-effect of causing the program to get lost, at least for a while. Thus it is desirable to have the program not leave the main line of inquiry but rather handle such bookkeeping chores as asides. To achieve this end, a set of demodulators can be written, to be used in con junction with certain "list" clauses, that allows the program to concentrate on the main search essentially uninterrupted. This use of demodulation permits the assigning of a high priority to the updating of information and thus, among oth-
Procedure Implementation
through Demodulation
and Related Tricks
381
ers, solve each of the subproblems presented by the four people in a convenient fashion. In addition, since a problem of this nature does not naturally contain a "contradiction" to be sought, the approach to be given has the advantage that the program will stop as soon as all four subproblems have been solved. 3.2. Bookkeeping Demodulators There are three kinds of lists used in working this puzzle: a list of the possible jobs which a given person might hold; a list of the people who might hold a given job; and a list of the people whose jobs have not yet been determined. An example of the first type of list is the following. POSSJOBS(L(PJ(R,chef),L(PJ(R,guard),L(PJ(R,nurse),L(PJ(R,pol), L(PJ(R,pwr),L(PJ(R,tchr),L(PJ(R,tel),PJ(R,cwtr))))))))). The interpretations of the various symbols are as follows. The predicate POSSJOBS identifies this list as one of the first type: possible jobs for a given person. The person (R for Roberta) and the various jobs appear within the single argu ment of this predicate. The two-place function L may be referred to as a "listing function". Its sole purpose is to collect a number of subterms together into one large term. T h e subterms are items on the list. The large term is the whole list. Each subterm PJ(person job) is one item on the list, one possible job for Roberta. The function PJ takes as its two arguments a person and a possible job which that person might hold. The jobs, in some cases abbreviated, are: chef, guard, nurse, police officer, professional wrestler, teacher, telephone operator, and waiter. (Names beginning with V-Z are avoided since our program reserves such names for names of variables.) There will be one list of possible jobs kept for each of the four people. A natural question to now ask is: Why repeat Roberta throughout such a list? The answer is that such repetition permits the removal of the appropriate single piece of information from Roberta's list. If each item named only a job, then the demodulators that follow would not select only the entry desired but would instead attack all the lists indiscriminately. The procedure for "crossing off' items begins with EQUAL(L(crossed,x),x) EQUAL(L(x,crossed),x) which apply when the way has been prepared. To prepare the way, we do the following. Whenever a possibility is to be crossed off the list, we force the program to derive a demodulator of the following form
EQUAL(PJ(R,pwr),crossed) which, if applied, crosses off the possibility that Roberta is the wrestler. But, in order that this demodulator be considered for application, the user must have
382
Collected Works of Larry Wos
the program parameters set to ask for back demodulation. The feature of "back demodulation", when selected by the user, enables the theorem prover to detect that t h e new demodulator EQUAL(PJ(R,pwr).crossed) could in fact be applied to the already existing clause POSSJOBS(L(PJ(R,chef),L(PJ(R,guard),L(PJ(R,nurse),L(PJ(R,pol), L(PJ(R,pwr),L(PJ(R,tchr),L(PJ(R,tel),PJ(R,cwtr))))))))). The theorem prover then applies the new demodulator, obtaining POSSJOBS(L(PJ(R,chef),L(PJ(R,guard),L(PJ(R,nurse),L(PJ(R,pol), L(crossed,L(PJ(R,tchr),L(PJ(R,tel),PJ(R,cwtr))))))))) in which the possibility PJ(R,pwr) ("Roberta might be a professional wrestler") has been crossed off. But the theorem prover does not stop here in its demodula tion effort. Rather it demodulates the clause as far as possible before considering it for retention. The input demodulator EQUAL(L(crossed,x),x) is now applied, yielding POSSJOBS(L(PJ(R,chef),L(PJ(R,guard),L(PJ(R,nurse),L(PJ(R,pol), L(PJ(R,tchr),L(PJ(R,tel).PJ(R,cwtr)))))))). The effect of this latter demodulator is to "clean up" the list, making it clearer that only seven possibilities remain. Eventually only two jobs remain on the list. The program easily detects this fact and uses it to make other needed inferences. The use of these demodulators enables the program to purge the outdated list in favor of the updated information. T h e crossing-off process just described has the following advantages over a standard process relying on some inference mechanism. 1. The crossing-off takes place immediately rather than awaiting a turn in a long queue of possible inferences. 2. T h e crossing-off method is similar to what a person might do by hand. 3. The proof is shortened as compared with a standard first-order predicate calculus formulation in which the crossing-off would require several infer ence steps involving Skolem functions. 4. Readability of the proof is correspondingly improved. 5. T h e scheduling is easier to control as compared with the complex task of assigning high priority to the several steps of a complex inference sequence.
Procedure Implementation
through Demodulation
and Related Tricks
383
For the second type of "list", we employ the same functions as in the first list—that which holds the person fixed and varies the possible jobs. But, since we now intend to list the people who might hold a particular job, we use the predicate, POSSPPL, and vary the people who might hold a job while holding the job fixed. Eight such lists are maintained, one for each of the eight jobs. For example: POSSPPL(L(PJ(R.pwr),L(PJ(S,pwr),L(PJ(T,pwr),PJ(CV,pwr))))), which lists the four people who might hold the job of professional wrestler. Observe that the same demodulator discussed previously, EQUAL(PJ(R.pwr).crossed), serves also to cross Roberta off the professional wrestler list. We turn finally to the third type of list-the list of people whose jobs remain to be determined. This list initially has the form STILLTODO(L(JOBSOF(R),L(JOBSOF(S),L(J0BSOF(T),JOBSOF(CV))))). When the two jobs of Roberta (R) have been determined, we derive the clause EQUAL(JOBSOF(R).crossed). Back demodulation then yields, in the manner discussed previously, the clause STILLTODO(L(crossed,L(JOBSOF(S),L(JOBSOF(T),JOBSOF(CV))))) which immediately demodulates as before to
STILLTODO(L(JOBSOF(S),L(J0BS0F(T),JOBSOF(CV)))). When the jobs for Steve, Thelma, and Vince have also been determined, this list attains the form STILLTODO(crossed) meaning that all four subproblems have been crossed off. The following clause is input to stop the run by contradiction: -STILLTODO(crossed). The contradiction is detected immediately and ends the run. This is of course preferable to having the program continue in tangential directions for awhile before realizing that it's already done.
Collected Works of Larry Wos
384
4
Classification of Formulas 4.1. Problem Description
The area on which we concentrate is the equivalential calculus [3,4,7], a field of formal logic. This field is concerned with the abstract study of the notion of equivalence. Its elements are the wffs that can be composed from a 2-place function, E, and the variables, x, y, z,.... There are single formulas in the calculus which are so strong that they can serve as single axioms [2,3,11]. For example, all of the theorems of the calculus are deducible from the single formula, XGK = E(x,E(E(y,E(z,x)),E(z,y))). A commonly used rule of inference in the calculus is that of condensed detachment [12]. Condensed detachment behaves rather like hyper-resolution [10,14] or like a restricted form of UR-resolution [8,9]. The first problem to be solved in our study of equivalential calculus [26] was that of finding a shorter proof than that which existed [2]—a proof that a par ticular formula is a single axiom for the calculus. By examining the given proof as well as others of the type existing in the literature, a classification of formu las was arrived at. The notion was that employment of the classification would strongly aid the theorem-proving program when it was assigned the problem of finding a shorter proof. Briefly, the idea was that of discarding clauses of certain classes while emphasizing the use of clauses of certain other classes. The following is a brief description of the classification. Designate those formulas that are of the form, E(x,t), to be of class 1, where x is some variable and t is some expression. Designate the formulas of the form, E(s,y), which are not of class 1 to be of class 2, where s is an expression and y is a variable. (We wish the classes to be disjoint, so we force E(x,x), for example, to be of class 1 and not of class 2.) Class 3 formulas have the form, E(E(x,y),t). Class 4 formulas have the form, E(s,E(x,y)). The definitions of classes 5, 6, and so on proceed similarly. Of course, no assumption is made in classes 3 and 4 of distinctness of variables. We continue to impose the requirement that the classes be disjoint. The task is that of having the theorem-proving program implement a proce dure to correctly classify each formula as it is generated. The generated clauses that are of an undesirable class would then be immediately discarded. The task is accomplishable through demodulation. 4.2. Classification Demodulators Keep in mind that the only expressions that can occur during the investi gation into the equivalential calculus are of the form E(s,t) for terms, s and t. Further, such terms can only be some variable or some expression of the form, E(q,r), and so on. (In a typical theorem-proving run, we would ordinarily enclose each such formula in the unary predicate, P, and thus the symbol, E, is treated as a function symbol.)
Procedure Implementation
through Demodulation
and Related Tricks
385
For each term and subterm of each generated clause, we must be able to determine its status—that of being a variable or not a variable—in order to correctly classify the clause. We also must be able to assign the class number according to the scheme presented above which, among others, assigns class 1 to those expressions whose leftmost argument of the major function symbol is a variable. In order to easily deal with the two subtasks, we have the program generate the formulas in the following fashion. Rather than having a formula simply reside in some unary predicate, we instead use a binary predicate that contains the particular formula in question twice. Thus, for example, if E(x,x) is the formula found next in the search, the program is made to generate the clause q(E(x,x),CLASS(E(x,x))). The second occurrence of the formula occurs as the argument of the function, CLASS. Thus, upon generation, the second argument is immediately demodu lated to the appropriate class number of the contained formula. For the first subtask, that of separating variables from nonvariables, we have but two demodulators. These demodulators, which are applicable only after the way has been prepared (see below), are: EQUAL(IFVAR(E(x,y)).false), which applies when the term is not a variable, and EQUAL(IFVAR(x),true), which applies when the term is a variable. The function, IFVAR, means "if its argument is a variable". It may seem that, at least intuitively, the two demod ulators are in the wrong order. However, it is vital that these be applied in the order given so that the correct status will be found. After all, the second applies to all formulas. So if the order were reversed, terms that are not variables would be classed as variables. If we permitted multiple path demodulation, the fact that a term was not a variable would be assigned both "true" and "false". If the first demodulator does not apply, then the formula (or subformula) being demodulated must not have the form, E(s,t). Hence it must be a variable. Be cause of the limited forms the formulas can take, one of the two demodulators must always apply. The following are used for the other subtask, that of assigning the correct class number. Here we shall assume that those formulas that are not in the union of classes 1 to 4 are to be assigned class number 5. We begin with EQUAL(CLASS(E(x,y)),EVAL(IFVAR(x),IFVAR(y),E(x,y))) where the 3-place function, EVAL, will with help return the class number. But EVAL also holds the formula in question. The two previous demodulators will
Collected Works of Larry Wos
386
now apply to test the two arguments of the (sub)formula under study. To proceed further with the task of assigning the correct class number, we need demodula tors to use the information yielded by the two demodulators for the function, IFVAR. We have EQUAL(EVAL(true,v,w),1), which applies when the wff should be assigned the class number of 1; EQUAL(EVAL(false,true,w),2), which applies when the class number is 2; EQUAL(EVAL(false,false,E(E(xl,x2),E(yl,y2))), EVAL2(AND(IFVAR(xl),IFVAR(x2)),AND(IFVAR(yl),IFVAR(y2)))), which applies when the class number is greater than 2. For those wffs that are not of class 1 or 2, we need to process them further. We therefore have demodulators to use the information yielded by the last demodulator, and we have EQUAL(AND(true,x),x) EQUAL(AND(false.x).false) EQUAL(EVAL2(true,v),3),
which assigns the class number of 3 for the wffs whose first argument is an E of two variables, (and of course not of class 1 or 2); EQUAL(EVAL2(false,true),4),
which assigns class 4 for the wffs whose second argument is an E of two variables; and EQUAL(EVAL2(false,false),5), which assigns class 5 to the remaining wffs. Notice that the requirement of demodulating inside out is important, for the EVAL demodulators are applied only after those for IFVAR.
5
Counting Symbol Occurrences 5.1. A Counting Problem
The next area of investigation [26] concerned the status, with respect to being a single axiom, of various formulas of the calculus. With respect to each of the corresponding (at the time) open questions, we sought to prove or disprove that the formula was too weak. During the investigation, it was conjectured that certain relations held between the parents of an inference and the inference
Procedure Implementation through Demodulation and Related Tricks
387
itself. The relations were in terms of the number of occurrences of the function, E, occurring therein. If the conjecture could be shown to hold, then each of the (at the time) unclassified formulas would be proved too weak to be a single axiom for the equivalential calculus. Since we wished to avoid writing a special-purpose program to generate formulas and count symbol occurrences, we were left with two choices. On the one hand, we could of course take the output of a standard theorem-proving run and make the various counts by hand. But this is tedious and rather prone to error. On the other hand, we could attempt to devise a way for the theoremproving program itself to make the appropriate counts during the actual run. The task was that of finding a set of demodulators, if such exists, which en codes a procedure for both counting the appropriate symbol occurrences within a formula and then planting the count in the formula. 5.2. Counting Demodulators Were we just studying the set of inferences yielded from some starting for mula, we would have the program merely generate each such inference and use the one-place predicate, P, to hold the corresponding formula. However, to pre pare the way for the application of the counting demodulators, we instead have the program generate Q(f,C0UNT(f)) for each new formula, f. (This clause is quite similar to that occurring in the classification of formulas, but the function CLASS is replaced with COUNT because of the task under discussion.) Then, by means of the following demod ulators, COUNT of an expression will demodulate to the count of the number of E's occurring therein. EQUAL(COUNT(E(x,y)),$SUM($SUM(COUNT(x),C0UNT(y)),1)), which applies when the expression is not a variable; and EQUAL(COUNT(x),0), which applies when the expression is a variable. Recall that the function, $SUM, is a built-in function for arithmetic. When its two arguments are both integers, it demodulates to their sum. The second of the two given demodulators is applied only when the first fails to apply. This occurs only when the term being demodulated is a variable. If they were interchanged, then terms that were not variables would be given counts of 0. Notice that the first demodulator is recursive in the function, COUNT. Ac cess to recursion of this type is often needed in procedures or subroutines in standard programming. By this use of recursion, we need only prefix the entire formula under study by the one occurrence of COUNT, thus avoiding the ne cessity of placing COUNT in front of each of the subterms. In a certain sense,
Collected Works of Larry Wos
388
the demodulation then works from outside in, for the recursion propagates the COUNT function appropriately to the various subterms.
6
Least Common Generalization 6.1. Problem Description
A common problem that occurs in mathematics is that of generalizing a result or set of results. A related problem in automated theorem proving is that of finding a clause, if one exists, that is the least common generalization of two given clauses. (Note that this is precisely the opposite of the heart of automated theorem proving, namely, unification [13].) Given two unit clauses, for example, one might wish to know what clause, if any, is the least general subsumer of the two given clauses. Given P(a,a) and P(x,a), the desired clause is P(x,a). Given P(a,y) and P(x,b), P(x,y) is the desired clause. However, with P(a,a) and P(b,b), one wishes P(x,x) and not P(x,y). In view of the frequent use of subsumption [13], the value of such a general ization clause is clear. Its presence might materially reduce the size of the clause space retained during a proof search. The reason for wanting the "least" general subsumer is simply that the least generalization might be provable while a more general result might not. Employment of a procedure for generalization could be of substantial value as an editing strategy. A more grandiose objective is the following. By means of this procedure for generalization, one may be able to find the general form of some sought after algorithm. Having seen the form for n = 1 and n = 2 and n = 3, the theoremproving program might be able to find the least general form that captures the three given instances. 6.2. Least Common Generalization Demodulators The demodulators for obtaining the least common generalization will be the most complex set of demodulators presented in this paper. Therefore the reader may wish merely to skim these, then study the demodulators for counting and for bookkeeping in detail, and then return to the present complex set. The demodulators to be given will demodulate any term of the form FIMLFORM(LEASTCOMGEN("s","t","varlist")) to a term which is the least common generalization of the two arguments "s" and "t". The third argument, "varlist", will be assumed to be a list of distinct variables, for example, L(vl,L(v2,L(v3,L(v4,end)))).
Procedure Implementation
through Demodulation
and Related Tricks
389
Note the use of the constant "end" to end the list. This convention will be followed throughout this section. The number of variables on the list, "varlist", must be at least the number required to find the least common generalization. If the list contains too few variables, a term containing the function, "ERROR", will be derived in place of the sought after generalization. We divide the main problem into the following four tasks: 1. If "s" and "t" are identical terms, then return this term as the least com mon generalization. 2. If "s" and "t" are not identical but have the same major function symbol, then do the following. (a) Pair off the corresponding arguments. (b) Find the least common generalization of each pair. (c) Recombine the generalizations of the arguments within the common major function symbol. 3. If neither 1 nor 2 applies to the pair s,t, then the appropriate generalization is a variable. 4. When the processing is complete, return the final form of the generaliza tion with all temporary information removed. Note that the very nature of the tasks may result in recursion. For example, the accomplishment of b under 2 may call for the accomplishment of 1. The first task, that of a trivial generalization, is accomplished with the de modulator EQUAL(LEASTCOMGEN(x,x,varlist),G0TLCG(x,varlist)). The result is returned along with the list of available variables within the func tion GOTLCG. The second task, that of processing two terms with the same major function symbol, is accomplished as follows. We first pair off the corresponding argu ments. We have EQUAL(LEASTC0MGEN(P(xl,x2),P(yl,y2),varlist), EVALl(ARGLIST(P(xl,x2),P(yl,y2)),varlist,P(end,end))). The function EVAL1 receives three arguments: a list of pairs of arguments, the list of variables, and the function name P with dummy arguments. One such demodulator must be supplied for each function that might occur in the expressions being generalized. For each such function a demodulator must also be supplied to create the argument list: EQUAL(ARGLIST(P(xl,x2),P(yl,y2)), L(PAIR(xl,yl),L(PAIR(x2,y2),end))).
390
Collected Works of Larry Wos
Corresponding arguments are paired and the "end" convention is followed. We next find the least common generalization of each argument pair. We keep a list of pairs "to do" and a list of generalizations "done". T h e "done" list is initially the empty list, represented by the constant "end". We have EQUAL(EVALl(xtodo,varlist,wfunc), EVAL2(xtodo,end,varlist,wfunc)). We next take one pair from the "to do" list and find its least common general ization. We have EQUAL(EVAL2(L(PAIR(xi,yi),xtodo),xdone,varlist,wfunc), EVAL3(LEASTCOMGEN(xi.yi,varlist).xtodo,xdone,wfunc)). Once the generalization has been obtained we place it on the "done" list. We have EQUAL(EVAL3(G0TLCG(zi,varlist),xtodo,xdone,wfunc), EVAL2(xtodo,L(zi,xdone).varlist,wfunc)). We repeat these operations until we reach the end of the "to do" list. At this point we plug the generalized arguments back into the common major function (P in this case), getting EQUAL(EVAL2(end,L(z2,L(zl,end)),varlist,P(end,end)), G0TLCG(P(zl,z2).varlist)). One such demodulator must be supplied for each function that appears in the expressions being generalized. Note t h a t the list of generalized arguments L(z2,L(zl,end)) actually appears in reversed order. The order is corrected in the GOTLCG term. This concludes the second task. (Note that the following demodulator would not accomplish the desired re sult in all cases. EQUAL(LEASTC0MGEN(P(xl,x2),P(yl,y2).varlist), P(LEASTCOMGEN(xl,yl,varlist),LEASTCOMGEN(x2,y2, varlist))) . T h e reason is as follows. The first LEASTCOMGEN operation may reserve one or more variables in the "varlist". The varlist thus altered must then be passed to the second LEASTCOMGEN operation. The demodulator just given uses the original form rather than the altered form in the second operation.) We proceed now to the third task, that of generalizing two unrelated terms to yield a variable. We would simply choose one variable from the "varlist" if it weren't for the following consideration. In generalizing the pair of expressions P(a,a) and P(b,b), the generalization of the pair a,b is requested twice: once in the first argument position, and once in the second. We wish to return the same
Procedure Implementation
through Demodulation
and Related Tricks
391
variable both times the request is made. In order to do this we keep a list of the requests t h a t have been made already as well as a list of variables. On the first request we simply choose the first variable from the "varlist" and record the request: EQUAL(LEASTCOMGEN(xi.yi,L(var,varlist)), GOTLCG(var,REQSVARS(L(REQ(xi,yi,var),end).varlist))). The function REQSVARS contains both the list of requests and the list of variables still available. On a subsequent request we first check whether an identical request was made previously. We have EQUAL(LEASTCOMGEN(xi,yi,REqSVARS(zreqs,varli s t ) ) , EVAL4(L00KUP(xi,yi,zreqs),xi,yi.REQSVARS(zreqs, varlist))). Here is how we look up a request. (Note that again the order of the demodulators is vital to obtaining the correct information.) We check whether the request matches the first entry in the request list: EQUAL(LOOKUP(xi,yi,L(REQ(xi,yi,var),zreqs)), GOTVAR(var)). If the first entry match<:s, we return the corresponding variable. Otherwise we search further in the list: EQUAL(LOOKUP(xi,yi,L(REQ(xj,yj,var),zreqs)), LOOKUP(xi.yi,zreqs)). If we reach the end of the list without finding a match, we return the constant "nomatch": EQUAL(LOOKUP(xi,yi,end).nomatch). We now make use of the information (variable or "nomatch") thus obtained. If the present request merely duplicates a previous request, then the corresponding variable is the desired generalization: EQUAL(EVAL4(G0TVAR(var),xi.yi,REQSVARS(zreqs,varlist)), GOTLCG(var.REQSVARS(zreqs.varlist))). If the request is new, on the other hand, we generalize it to yield a new variable and add the new request to the list: EQUAL(EVAL4(nomatch,xi,yi,REQSVARS(zreqs,L(var,varlist))), GOTLCG(var,REqSVARS(L(REq(xi,yi,var),zreqs),varlist))). If no variable is available we signal the error:
Collected Works of Larry Wos
392
EQUAL(EVAL4(nomatch,xi,yi,REqSVARS(zreqs,end)), ERROR(outofvars,nomat ch,xi,yi,REQSVARS(zreqs,end))). This completes the third task. The fourth task, that of returning the final generalization without the tem porary lists attached, is easily accomplished. We have EQUAL(FINALFORM(GOTLCG(z,varlist)),z). By recourse to the demodulators just given, the program will find the least common generalization of two terms if such exists.
7
Case Analysis 7.1. The Basic Problem
In conducting a case analysis with a theorem-proving program [18,20], it is desirable to purge the clause space of those clauses that are only relevant to the subcase under study when that subcase has been completed. Again, with a standard program, the procedure for doing such is obvious. But for theorem proving, perhaps it is not. Since the clauses relevant to one particular subcase can be harmful if applied to another subcase, the trick is to demodulate the "useless" clauses to some harmless constant and then, by subsumption, discard them. We give below the approach. However, before presenting the demodulators, we comment that this ap proach can also be used when the object is that of seeking a number of distinct solutions to a problem. Such is the goal when, for example, one is seeking to design a number of different digital circuits with certain common properties [21]. Thus the "purging" demodulators are more useful than might have been apparent. 7.2. Purging Demodulators For many problems requiring case analysis, we can make the following as sumptions. We assume first that only unit clauses will be derived during the run. This should not be surprising since we emphasize units so heavily in much of our work [22]. Second, we assume that each derived unit is in fact a positive unit. Third, we assume that the problem to be solved does not involve the equal ity predicate. The equality predicate will be used only for the encoding of the purging demodulators. Means of circumventing certain of these restrictions will be briefly discussed later. At the moment, coping with the relaxation of the last restriction still poses a serious problem and may well be an area for profitable research.
Procedure Implementation
through Demodulation
and Related Tricks
393
The use of purging demodulators presents three tasks. The first task is that of recording within each derived clause the case to which it applies. The second task is that of deriving, for those clauses t h a t are to be purged at the completion of a case, a demodulator that appropriately transforms all clauses related to t h a t case. The third task is that of providing the mechanism to remove the transformed clauses by subsumption. We begin with the problem of recording case information within a derived clause. To do this we include a "case code" as one of the arguments of the clause. For example, the clause P(a,b,c,CASE(L(3,L(l,2)))) can be used to state that a relation holds among a, b, and c within the case 3.1.2. The argument CASE(L(3,L(1,2))) is the case code. There are many alternate ways to encode case codes, such as, SUBCASE(3,1,2). But the given encoding has certain advantages. For example, the use of the "list" function avoids the necessity of including a set of "subcase" functions—a set that includes functions with 1, 2, ..., arguments. Two restrictions, discussed later, must be observed in encoding case codes. For reasons of space we omit the discussion of the tricks used to place a case code in a derived clause. For the second task, that of deriving a purging demodulator, we force the program to derive the demodulator EQUAL(CASE(L(3,L(1,2))),junk). Then all clauses relevant to the case designated by the case code, CASE(L(3,L(1,2))), will be subject to back demodulation by means of this demodulator. For exam ple, the clause P(a,b,c,CASE(L(3,L(l,2)))) is back demodulated to P(a,b,c,junk). For the third and final task, that of removing the transformed clauses by subsumption, we include in the input the clause, P(x,y,z,junk).
Collected Works of Larry Wos
394
When a case has been completed, the program will thus delete the then unneeded clauses. For each predicate that is to receive similar treatment, a corresponding subsumer clause is included in the input. We specify in the input that these particular subsumer clauses are not to participate in inferences. We now give the two restrictions, mentioned earlier, upon the encoding of case codes. The first restriction is that no case code term may appear in any clause other than as a case code. Adherence to this requirement prevents the purging demodulator from transforming clauses not directly germane to the case at hand. The second restriction is that no case code may appear as a subterm of another case code. If violated, the purging that occurs at the completion of a case would incorrectly affect other cases. In the example given, all case codes are enclosed in the function, CASE, in order to satisfy these two restrictions. We close this section by briefly discussing actions that can be taken that permit relaxation of the given assumptions. For example, if negative units are derived during various subcases, and if one wishes to have access to a parallel treatment to that already given, the clause, -P(x,y,z,junk), can be included in the input. Such a clause will then subsume those unneeded clauses after the appropriate back demodulation occurs following the completion of a case. Note that it would then be necessary to instruct the program not to recognize the unit conflict between this clause and P(x,y,z,junk). Alternatively, we could use another predicate, NOTP, to encode the negation of P in a positive unit and thus avoid the problem of negative units. We would then give the relationship between the two predicates by inputing appropriate nuclei. If the assumption that all derived clauses within the case analysis are units does not hold, one need only include a case code in at least one literal of each derived nonunit. The purging demodulator and the subsuming units given above then suffice to purge such nonunit clauses. Finally, if one does not assume that all derived equalities will be purging demodulators, we simply remark that no excellent solution is known. One could have recourse to an "equality" predicate that allows a third argument for the case code, but this could interfere with certain built-in features. This situation presents an area for potentially valuable research.
8
Set-Theory 8.1. The Objective
Much effort has been devoted to handling set-theory problems in a natural and efficient manner with an automated theorem-proving program. The main
Procedure Implementation
through Demodulation
and Related Tricks
395
focus is that of illustrating the potential value of some new strategy a n d / o r inference rule. Many are acquainted with the disappointing tediousness with which such problems are solved with standard theorem-proving approaches. Here we present a notation and a set of demodulators that enable many trivial examples to be dispatched trivially by the program. 8.2. Set-Theory Demodulators We use the predicate EQUALLOG to denote logical equivalence of its two arguments. Since our program treats all predicates that begin with the letters, EQUAL, as an equality predicate, positive units in EQUALLOG may become demodulators. We have in particular -EQUALLOG(true,false). The function IFF denotes the result—true or false—of testing its two arguments for logical equivalence. The following demodulators encode standard properties of the logical connectives AND, OR, NOT, IM (implication) and IFF. EQUALLOG(AND(x,true),x) EQUALLOG(AND(x,false).false) EqUALL0G(AND(true,x),x) EQUALLOG(AND(false.x).false) EQUALLOG(OR(x,true).true) EQUALLOG(OR(x,false),x) EQUALLOG(OR(true,x).true) EQUALLOG(OR(false.x),x) EQUALLOG(NOT(true).false) EQUALLOG(NOT(false).true) EQUALL0G(N0T(N0T(x)),x) EQUALLOG(AND(x,x).x) EQUALL0G(0R(x,x),x) EQUALLOG(IM(true,x),x) EQUALLOG(IM(false.x).true) EQUALLOG(IM(x,true).true) EqUALLOG(IM(x,false),NOT(x)) EQUALLOG(IM(x,x),x) EqUALLOG(IM(x,y),OR(NOT(x),y)) EQUALLOG(IFF(x,true),x) EQUALLOG(IFF(true.x),x) EQUALLOG(IFF(x,false),NOT(x)) EQUALLOG(IFF(false,x),NOT(x)) EQUALLOG(IFF(x.x).true) EQUALLOG(IFF(x,NOT(x)).false) EQUALLOG(IFF(NOT(x),x).false)
396
Collected Works of Larry Wos
EQUALLOG(IFF(x,y),AND(IM(x,y),IM(y,x))) EQUALLOG(NOT(QR(x,y)),AND(NOT(x),NOT(y))) EqUALLOG(NOT(AND(x,y)),OR(NOT(x),NOT(y))) EQUALLOG(AND(x,y),AND(y,x)) EQUALLOG(AND(x,AND(y,z)),AND(y,AND(x,z))) EQUALLOG(OR(x,y),OR(y,x)) EQUALLOG(OR(x,OR(y,z)),OR(y,OR(x,z))) EQUALLOG(AND(AND(x,y),z),AND(x,AND(y,z))) EQUALLOG(OR(OR(x,y),z),OR(x,OR(y,z))) EqUALLOG(OR(AND(x,y),z),AND(OR(x,z),OR(y,z))) EQUALLOG(OR(x,AND(y,z)),AND(OR(x,y),OR(x,z))). For the concepts of union and intersection and the like, the function symbols U, I, CO, IFEQSET, IFELOF, and D are introduced to encode the standard axioms of set theory. IFELOF is that function that returns true if the first argument is an element of the second and false otherwise. The following demodulators define U, I, and CO (union, intersection, and complement within an assumed universe) in terms of IFELOF. EQUALLOG(IFELOF(x,U(y,z)),OR(IFELOF(x,y).IFELOF(x,z))) EQUALLOG(IFELOF(x,I(y,z)),AND(IFELOF(x,y),IFELOF(x,z))) EQUALLOG(IFELOF(x,CO(y)),NOT(IFELOF(x,y))). IFEQSET is that function that returns true if its two arguments are equal sets and false otherwise. It is defined in terms of the function IFELOF through the use of the Skolem function D: -EQUALLOG(IFEqSET(x,y).false) EQUALLOG(IFF(IFELOF(D(x,y),x),IFELOF(D(x,y),y)).false), which says that, given two sets which are not identical, there exists an element in one but absent from the other. The following clause denies the theorem that union distributes over inter section: EQUALLOG(IFEQSET(U(a.I(b,c)),I(U(a,b),U(a,c))).false). We place just this clause in the set of support [23]. A single resolution with the preceding nucleus yields a clause that demodulates to EQUALLOG(true,false). Proof by unit conflict is thus obtained in a single resolution step, through the extensive use of demodulation. Similar one-step proofs can be obtained for other theorems of this type.
Procedure Implementation through Demodulation and Related Tricks
9
397
Conclusions
In this paper we have given a number of uses of demodulation outside the fa miliar ones of simplification and canonicalization. These uses range from simple bookkeeping and straightforward counting to the finding of the least general subsumer of two given terms. By relegating such subsidiary tasks to demodulation, the program is free to concentrate on its main assigned task. Thus, the problem of the scheduling of the various subsidiary tasks and subtasks that occur during the attempt to solve some complex problem is at least in part solved. Although each of the tasks discussed here could have been handled by means of additional programming, such a move defeats one of the main goals of the field. The goal in question is that of providing a general-purpose program that can be used to solve many and diverse problems and without burdening the user with additional programming. The given examples demonstrate the power of both the general input language of automated theorem proving and also that of the procedure of demodulation. In particular, the set of demodulators given to cope with problems of set theory shows how naturally such problems can be solved. This approach presents a sharp contrast to that so often quoted in earlier attempts with theorem-proving programs. The notion is that the material contained herein is but a fragment of that which can be done with demodulation. By demonstrating the ability to replace the standard subroutine with a corresponding set of demodulators, we hope fully have provided a needed aid to the use of various existing theorem-proving programs.
References [1] Allen, J. and Luckham, D., "An interactive theorem-proving program," Ma chine Intelligence, Vol. 5(1970), Meltzer and Michie (eds), American Elsevier, New York, pp. 321-336. [2] Kalman, J., "A shortest single axiom for the classical equivalential calculus," Notre Dame Journal of Formal Logic, Vol. 19, No. 1, January 1978, pp. 141— 144. [3] Lukasiewicz, J., "Der Aquivalenzenkalkul," Collectanea Logica, Vol. 1 (1939), pp. 145-169. English translation in [McCallj, pp. 88-115 and in [Lukasiewicz/ Borkowski], pp. 250 277. [4] Lukasiewicz, J., Jan Lukasiewicz: Selected Works, ed. by L. Borkowski, North-Holland Publishing Co., Amsterdam (1970). [5] Lusk, E., and Overbeek, R., "Data structures and control architecture for implementation of theorem-proving programs," 5th Conference on Auto-
398
Collected Works of Larry Wos mated Deduction, Vol. 87, Lecture Notes in Computer Science, ed. W. Bibel and R. Kowalski, Springer-Verlag, Berlin, 1980, pp. 232-249.
[6] Lusk, E., "Input translator for the environmental theorem prover - user's guide," to be published as an Argonne National Laboratory technical report. [7] McCall, S., Polish Logic, 1920-1939, Clarendon Press, Oxford (1967). [8] McCharen, J., Overbeek, R. and Wos, L., "Problems and experiments for and with automated theorem proving programs," IEEE Transactions on Computers, Vol. C-25(1976), pp. 773-782. [9] McCharen, J., Overbeek, R. and Wos, L., "Complexity and related enhance ments for automated theorem-proving programs," Computers and Mathe matics with Applications, Vol. 2(1976), pp. 1-16. [10] Overbeek, R., "An implementation of hyper-resolution," Computers and Mathematics with Applications, Vol. 1(1975), pp. 201-214. [11] Peterson, J., "Shortest single axioms for the equivalential calculus," Notre Dame Journal of Formal Logic, Vol. 17(1976), pp. 267-271. [12] Peterson, J., "An automatic theorem prover for substitution and detach ment systems," Notre Dame Journal of Formal Logic, Vol. XIX, Jan. 1978, pp. 119-122. [13] Robinson, J., "A machine-oriented logic based on the resolution principle," J. ACM, Vol. 12(1965), pp. 23-41. [14] Robinson, J., "Automatic deduction with hyper-resolution," International Journal of Computer Mathematics, Vol. 1(1965), pp. 227-234. [15] Smith, B., "Reference manual for the environmental theorem prover," to be published as an Argonne National Laboratory technical report. [16] Veroff, R., "Canonicalization and demodulation," Argonne National Labo ratory, Technical Report ANL-81-6, Argonne, Illinois, February 1981. [17] Winker, S. and Wos, L., "Automated generation of models and counterex amples and its application to open questions in ternary Boolean algebra," Proc. of the Eighth International Symposium on Multiple-valued Logic, Rosemont, Illinois, 1978, IEEE and ACM Publ., pp. 251-256. [18] Winker, S., Wos, L. and Lusk, E., "Semigroups, antiautomorphisms, and involu- tions: a computer solution to an open problem, I," Mathematics of Computation, Vol. 37 (1981), pp. 533-545. [19] Winker, S., "Generation and verification of finite models and counterexam ples using an automated theorem prover answering two open questions," to appear in J. ACM. [20] Winker, S., Wos, L. and Lusk, E., "Semigroups, antiautomorphisms, and involu- tions: a computer solution to an open problem, II," in preparation.
Procedure Implementation
through Demodulation
and Related Tricks
399
[21] Wojciechowski, W. and Wojcik, A., "Multiple-valued logic design by the orem proving," Proc. of the Ninth International Symposium on Multiplevalued Logic, Bath, England, 1979. [22] Wos, L., Carson, D. and Robinson, G., "The unit preference strategy in the orem proving," Proc. of the Fall Joint Computer Conference, 1964, Thomp son Book Company, New York, pp. 615-621. [23] Wos, L., Carson, D and Robinson, G., "Efficiency and completeness of the set- of-support strategy in theorem proving," J. ACM, Vol. 12(1965), pp. 536-541. [24] Wos, L., Robinson, G., Carson, D. and Shalla, L., "The concept of demod ulation in theorem proving," J. ACM, Vol. 14(1967), pp. 698-709. [25] Wos, L., Winker, S., and Lusk, E., "An automated reasoning system," AFIPS Conference Proceedings, Vol. 50 (1981), National Computer Confer ence (Chicago, 111., 1981), AFIPS Press, pp. 697-702. [26] Wos, L., Winker, S., Veroff, R., Smith, B. and Henschen, L., "Questions concerning possible shortest single axioms in equivalential calculus: an ap plication of automated theorem proving to infinite domains," submitted to the Notre Dame Journal of Formal Logic.
Automated Theorem Proving 1965-1970 L. Wos, L. Henschen
This work was supported in part by the Applied Mathematical Sciences Research Program (KC-04-02) of the Office of Energy Research of the U. S. Department of Energy under contract W-31-109-ENG-38 (Argonne National Laboratory, Argonne, Illinois, 60439) and in part by the National Science Foundation un der grant number MCS-7913252 (Northwestern University, Evanston, Illinois, 60201).
1
Introduction
In this article we give a critical history of automated theorem proving from 1965 through 1970. By evaluating the contributions of the period, we provide a guide to a study of the field during its development. In order to differentiate between that work which turned out to be significant and that which had lesser impact, we occasionally rely of necessity on developments occurring after 1970. Since we confine our attention to automated theorem proving, certain work in logic occurring in the period in question is ignored. For example, various studies on decidability and complexity are excluded from comment because they are not directly germane. In addition to providing a critique, we have the secondary objective of giving a tutorial. We provide sufficient information and definition to permit one to read this article with minimal recourse to the literature. In this regard we often replace the very rigorous treatment of a concept by a more intuitive description. We shall begin with a general background and quickly progress to a discus sion of the difficulties inherent in seeking the objective of the field. The goal of automated theorem proving is the design and implementation of computer pro grams whose essential purpose is that of finding proofs. Although in 1965 each of the theorems whose proof was sought was from some field of mathematics, by 1970 the focus of attention had broadened to include program verification and question- answering. The theorem-proving methods studied generally involved establishing a proof by contradiction. Reprinted with permission from Classical Papers on Computational Logic, Vol. 2, ed. by Jorg Siekmann and Graham Wrightson, Springer-Verlag, New York, pp. 1-24 (1983).
Automated Theorem Proving 1965-1970
2 2.1
401
Overview Historical background
By 1960 the attempt to employ the digital computer to solve problems whose solution required logical thought was well under way. There were and continue to be two basic approaches to the question. One approach was based on an attempt to study and simulate human reasoning [25]. The other approach was based on purely logical foundations such as the work of Herbrand [13,14] and Skolem [34]. While both approaches continued to be studied, the "logical" rather than the "human" approach was to receive by far more attention and was to achieve the greater success. The chief source of problems to be solved was mathematics. The "logical" approach, still in vogue today, consists briefly of the following. Choose a problem say, for example, a proposed theorem of abstract group theory. A favorite of the time was: in a group, if x 2 = e for all x, then the group is commutative. Next, assume the conjecture is not a theorem, for recall that proof by contradiction is the preferred method. One thus assumes the existence of a group in which x2 = e but in which at least two elements fail to commute. Then, represent this denial with a set of statements from the first-order predicate calculus. Put the statements into a normal form, usually conjunctive normal form. Replace existentials with Skolem functions [6,34). And finally apply some "reasoning" technique in search of a contradiction. A promising technique in 1960 was that of Herbrand instantiation [6,7]. Briefly, the process consists of generating ever-expanding sets of variable-free formulas and testing each set for truth-functional unsatisfiability (that is, testing that the formulas yield false for every assignment of truth values to the Boolean variables therein). These sets are obtained by substituting, in increasing order of complexity, terms from the Herbrand Universe [6,7,14], into the Skolemized formula representing the problem under study. The justification for this approach, which couples truth-functional analysis with Herbrand saturation, is contained in the result: the formula under study represents the denial of a theorem if and only if one of the variable-free sets is truth-functionally unsatisfiable [13,14]. Thus, for theorems a finite search will yield a proof while for non-theorems the process in general does not terminate. Computer programs employing the technique were totally disappointing. There were two undesirable properties of the basic idea. First, the sets of variable-free formulas grew very rapidly, which in turn caused the truth-functional analysis to be cumbersome. Second, there was a uniform lack of generality in that a program had to deal with many instances of a fact rather than with the general fact itself. In response to this disappointment, preliminary notions of unification were considered. But still no real progress was made until the notion of unification evolved to the very powerful inference rule of resolution [31]. This inference rule, formulated by J. A. Robinson, generalized both modus ponens and syllogism. It
Collected Works of Larry Wos
402
totally changed the course of automated theorem proving. The study of various aspects of resolution completely dominated the field between 1965 and 1970. Certain variants of this inference rule and various restrictions of its application are still vital to the field.
2.2
Resolution: its impact, advantages, and problems
Between 1967 and 1970 there appeared about ninety papers and reports on auto mated theorem proving of which more than sixty are concerned with resolution in some aspect. About twenty-five are on strategies and refutation completeness; about ten deal with equality but treated in a fashion which can be traced to the definition of resolution; about twenty-five are on applications to other areas than mathematics; of the remaining, several are on implementation often in cluding detail about the corresponding program. (The topics of "strategy" and "refutation completeness" are covered in later sections.) The excitement engendered by Robinson's discovery of resolution caused some researchers in the field to feel that the problems of automated theorem proving were essentially solved. After all, this new inference rule had the prop erty of maximizing the generality of the inferences yielded by it. Also, the prob lem of truth-functional analysis was eliminated. And finally, it was thought that the size of the set of inferences to be examined in search of a proof was sufficiently reduced to permit the computer to easily complete the task. Robinson himself suggested in his early paper that coupling resolution with level saturation was a possible but inefficient approach [31]. Level saturation means generating the immediate descendants of the input clauses pairwise and giving them a level 1 designation. Then one considers this new expanded set pairwise and generates its immediate descendants with level 2 designation. One iterates in this fashion and generates the clauses of level 3, level 4,... . Any suggestion of exhaustive and unrestricted application of resolution was doomed to fail. Too much of mathematics requires some examination of clauses of rather high level. In addition, the size of the various levels grows much too rapidly. Nevertheless, it would eventually be shown that resolution could be restricted and become very useful (see Section 8).
2.3
Inherent problems of the field
The obvious question is, why didn't the effort put forth between 1965 and 1970 result in a computer program which was effective in most situations? For that matter, why are we still having trouble? The answer is simply that there are many too many clauses which can be generated while in search of a proof. There are various sources for this abundance of generated clauses. First, any given clause has the potential of being generated again and again. This can occur either when the order in which a fixed set of ancestors considered for resolution is varied, or when distinct sets of ancestors imply the same clause.
Automated Theorem Proving 1965-1970
403
Second, many clauses get generated even though they are logically weaker than, and hence subsumable [31] by, clauses already present. Third, some clauses get generated despite having no further use because they are dead-end clauses, that is, their remaining literals have been instantiated in such a fashion that they are prohibited from participation. Fourth, often very many clauses are generated even though they are irrelevant to the theorem under study. And fifth, a number of clauses get generated because the program is in effect exploring several possible proofs simultaneously. This classification of extra clauses naturally led to certain responses designed to diminish the difficulty. The questions of redundancy and irrelevancy received the most attention. It was and is believed that computers are sufficiently fast and large that, if the generated clause set were sharply reduced, many questions could be solved by an automated theorem-proving program.
3 3.1
Techniques: Inference Rules, Representations, and Strategies General discussion
Having seen that the straightforward application of resolution generates too many clauses, researchers turned their attention to three potential solutions to the problem—strategies for applying inference rules, more powerful inference rules, and more effective ways of representing problems. Valuable contributions were made in all three areas between 1965 and 1970. The first problem to be investigated concerned the way resolution was ap plied. The concept of strategy for resolution was introduced by Wos in 1964 [43]. Initial proposals for strategies centered on controlling the order in which clauses were chosen for resolution and on avoiding the resolution of some pairs of clauses altogether. The rules for a given strategy were stated in terms of simple properties of the clauses such as number of literals, level, etc. We discuss the work done in this aTea more fully in Section 3.3. The next area to receive attention involved consideration of the rule of infer ence itself. Individual resolution steps are relatively small deductions and take no account of the symbols involved. Proposals were made to counter both of these objections. In the one case, it was suggested that several restricted resolu tion steps could be combined into a single and more mathematically significant step. In the other case, resolution-type rules (i.e., rules based on unification of terms and combination of clauses to yield new clauses) were formulated to take advantage of the meaning of certain relations such as equality, set-containment, and the like. We describe these activities in more detail in Section 3.2. Finally, toward the end of the period, thought was given to the question of how problems should be represented. The work on equality-based rules of infer ence versus equality axioms was one of the considerations in this regard [15,30].
Collected Works of Larry Wos
404
Also, there were preliminary considerations of abandoning resolution altogether in favor of the so-called natural deduction systems, although this work was not published until later [2,3,24]. These systems left the formula to be proved in its unnegated, un-Skolemized form, presenting yet another representation issue. An important but not often considered point arose, namely, that the connec tion between representation and inference rule could not be ignored. Indeed, it was realized that all three areas—inference rule, strategy, and representation— were strongly interconnected. Much effort would be devoted later to the issue of problem representation and the representation of knowledge in general and the implications thereof. However, because the majority of such contributions were made after 1970, we will not discuss this area further.
3.2
Inference rules
In this section we discuss inference rules, while in the next section we discuss strategies which can be applied to them. An inference rule says how sets of symbols are to be manipulated, that is, matched and combined. A strategy, on the other hand, dictates control over such manipulation, where such control may either prohibit or order this manipulation. In the spirit of this distinction between inference rule and strategy, we place certain concepts in the section on strategies although historically they were treated as inference rules. Such an example is provided by "unit resolution" (see Section 3.3 for the definition of unit) which is treated in the literature as an inference rule. Unit resolution should more properly be thought of as the " unit strategy" applied to resolution. Resolution as defined by J. A. Robinson [31] takes two clauses and, by fo cusing on a subset of literals in each, yields at most one consequent for that choice of subset. (In various implementations of resolution, a single literal of focus was chosen in each hypothesis, and the additional inference rule of factor ing [43] was employed.) To reduce the number of generated clauses, Robinson introduced Pl-resolution and hyper-resolution [32]. The former requires one of its two hypotheses to be free of any negation symbols. The latter allows the presence of any number of hypotheses or parent clauses. Of the n parents, n-1 (the satellites) must be free of negation symbols while the remaining parent (the nucleus) is required to contain n-1 negative literals with its other literals being positive. Hyper-resolution can be accomplished by a sequence: of Pl-resolutions. (To treat hyper-resolution in this fashion is very inefficient; Overbeek [27] later avoided this problem by doing unifications "simultaneously".) Since only the final inference of the sequence of Pl-steps is kept, the set of retained clauses is theoretically sharply reduced. Other types of derived rules were proposed with the same view—to make larger individual deductive steps and thereby reduce the search space. Among these are negative hyper-resolution [35], in which the roles of positive and negative are interchanged, and (later) UR resolution [22], in which the notions of unit and non-unit play the roles of satellite and nucleus respectively. A disadvantage of some of these rules is that they do not always
Automated Theorem Proving 1965-1970
405
combine well with one of the more successful strategies, namely, set of support [44]. Still they were and are useful and powerful. However, exhaustive applica tion of hyper-resolution still has the same problem as resolution with saturation, namely, the examination and development of too much of the underlying theory. In response to a comment by J. A. Robinson [33] about the need to treat equality and other relations of mathematics specially, L. Wos and G. Robinson introduced paramodulation as an inference rule in 1968 [30]. This rule generalizes the substitution property of equality. With its use all of the usual equality axioms except reflexivity can in general be discarded. (This rule can be said to work on the term level while variants of resolution work at the literal level.) Many problems have a more concise and natural statement in terms of equality. For example, the axiom of left identity can either be written as P(e,x,x) or as EQUAL(f(e,x),x), where P and f both stand for product. Of more interest is the axiom of associativity which in the P-representation becomes two clauses, each of which contains four literals; with equality, it is represented as a single unit clause. When such equality-based problems are represented with the equality predicate and paramodulation is used instead of resolution, the proofs generally are much shorter and more natural. Just as resolution first appeared to solve the difficulties of theorem proving, so also did each new inference rule give that impression to some in the field. After all, much shorter proofs were obtained for some theorems. An example is the benchmark problem in group theory in which the object is to prove that a particular commutator relation holds when x 3 = e is present. The resolution proof was 136 steps long, while that with paramodulation was but 47 steps in length [30]. Unfortunately, again it was discovered that mathematics would not yield that easily. Although the various new inference rules in general yield fewer inferences than resolution, they all still generate too many clauses in the search for a proof. And thus the importance and need for strategies to control and order the application of inference rules was reinforced. It also became clear that some action must be taken to deal with the onslaught of clauses still present even when using effective strategic restrictions.
3.3
Strategies
One can identify four classes of automated theorem-proving strategy, classified according to the aspect of the basic problem being attacked. The basic question is simply: how can a proof be found within reasonable time and reasonable memory? Although today it's quite likely that the availability of cheap memory leaves just the problem of time, during the 1965-1970 period both memory and time were of concern. The four aspects of the problem lead to the following four questions: 1. Where should the theorem-proving program search next?
Collected Works of Larry Wos
406
2. What part, if any, of the search space can be ignored? 3. Is canonicalization of new information possible? 4. How can the generated information be pruned? 3.3.1
Guiding strategies
To deal with the first of the four questions, "selection" strategies were formu lated. Such a strategy dictates, for example, which pair of clauses to choose next on which to focus attention. The idea is to get to the proof sooner by reordering the generation of possible inferences. No attempt is made to reduce the size of the search space. The first such strategy was given by Wos, G. Robinson, and Carson [43], and was called unit preference. Basically, it required the pro gram to try all resolutions in which one of the clauses was a unit before trying resolution on pairs of non-units. In addition, the program should try shorter clauses before longer clauses. The motivation was simply that a contradiction was being sought in the form of the empty clause (a clause with no literals) and that resolution of a unit clause with any other yields a clause shorter than the longer of the two parents. With this strategy proofs of quite simple classroom exercises were immediately obtained. Such problems as "in a group, both the right identity and right inverse axioms are dependent axioms" were proved by an automated theorem-proving program in from one to five seconds. The strat egy was not immediately employed by many and only came into its own when the importance of units was established by Kuehner [17] and by Henschen and Wos [12] in the 70's. Kowalski and Slagle separately suggested less profitable selection strategies based only on the number of literals without the emphasis on units. Much later there was developed another powerful selection strategy which chose the clause on which to focus attention by evaluating the significance of its symbols. This technique, known as weighting and formulated by Overbeek [23], shows the continued interest in and value of selection strategies. 3.3.2
Restriction strategies
Consideration of the second of the four questions turned out to be more prof itable than the first, for it led to "restriction" strategies. Such a strategy prevents certain paths through the search space from being explored. The first of these, known as the set-of-support strategy and developed by Wos, G. Robinson, and Carson [44], takes advantage of the assumed consistency of an axiom set. The idea is that, since contradiction is the objective and hence not deducible from the axiom set itself, clauses should not be generated unless in a recursive sense they are in part traceable to the denial of the supposed theorem. The set-ofsupport strategy immediately brought into range more interesting although still not particularly deep theorems from mathematics such as, in a ring, x 2 = x
Automated Theorem Proving
1965-1970
407
implies that the ring is commutative. The effect on the number of generated clauses is rather dramatic. This strategy is still very important to the field. Another interesting and important restriction is the unit restriction [43]. This requires one of the two resolving clauses to contain only one literal. Note that this restriction is different than the unit preference guiding strategy, which merely says try all units first and then try non-units. However, in practice these operate identically since most programs usually run out of time or memory before exhausting all of the unit deductions. There were also other interesting restrictions given slightly later in the pe riod. Linear resolution from each of Loveland [19] and Luckham [20] and an cestry filter form from Luckham [20] were and are rather effective in improving the proof search for some problems. With but a few exceptions, they prevent generated clauses from being used together as parents. Also of some note was the concept of singly connectedness by Wos et al. [45]. Employing this concept forces one to apply a sequence of resolutions in a canonical order, thereby eliminating a number of paths to duplicate resolvents. 3.3.3
Simplification s t r a t e g i e s
As for the third question, that of canonicalization, the important work that oc curred in this connection was the introduction of the concept of demodulation by Wos et al. [45]. The two uses of demodulation at the time were to auto mate simplification and to automate canonicalization. Forcing 0 + x to be always replaced by x in expressions is an example of the first use, while forcing formu las when possible to always right associate is an example of the second. (The power and uses of demodulation were vastly underestimated as would be clearly demonstrated by Winker [38,40] much after the close of the period in question.) 3.3.4
Pruning strategies
Subsumption was proposed by J. A. Robinson [31] to help solve the fourth and final problem, that of pruning. Use of it enables one to discard most of those clauses which are logically weaker than ones already present. When the consid eration was limited to the elimination of unit clauses because of the presence of more general units, the technique was called the less-general unit strategy [43]. This last was relied on rather heavily by those with running programs. T h e more general subsumption was less widely used because of the (at the time) unresolved question of its effect on overall program efficiency.
3.4
Consequences
The introduction of strategy and additional inference rules led to both excite ment and disappointment. The excitement arose from the possible improvement in the performance of theorem-proving programs. The disappointment in part
Collected Works of Larry Wos
408
resulted from the realization of how complicated theorem proving really is. More importantly, these new developments stirred much interest in two important logical questions. First, how should one choose the combination of representation, strategy, and inference rule? For example, in problems dealing with algebraic structures, when should one use the equality formulation with paramodulation versus the non-equality formulation with resolution? In this regard, some advice can be given: one should generally not use certain combina tions such as equality representation and resolution. The second logical question is, "Will the combination chosen actually yield a proof?" For example, hyperresolution coupled with the set-of-support strategy can prevent the program from making any inferences at all. This occurs when the denial of the proposed theorem consists only of negative clauses, and one chooses only the denial to support the proof search. Still some choices for the set of support do combine effectively with hyper-resolution. The very property which makes some strategies so effective is that which makes the corresponding analysis of the possible value so difficult, for blocking the generation of various clauses includes blocking various paths leading to a proof. The abstraction of this particular problem, known as the problem of refutation completeness, became one of the prime concerns for those in the field of automated theorem proving for the 1965-1970 period.
4 4.1
Refutation Completeness and Other Logical Properties Motivation
Two forces conjoined to cause much effort to be expended by those in automated theorem proving on various logical questions between 1965 and 1970. The first could be termed a matter of tradition and style. After all, the field is founded on mathematical logic where issues like completeness are fundamental. The second force was the understandable concern that the inference rules and strategies to be imposed on them might lack certain abstract but essential properties. For example, such a property is the ability, in theory, to find at least one proof for each theorem. It was deemed important to know which types of reasoning lacked this property. In response to these two pressures, a very evident trend in research occurred.
4.2
Refutation completeness
The designation that an inference rule or strategy is "refutation complete" guar antees that, when a proof by contradiction is sought for a formula corresponding to the denial of a theorem, the use of said inference rule or strategy allows for a contradiction to be found. Recall that the formulas submitted to automated
Automated Theorem Proving 1965-1970
409
theorem-proving programs actually correspond to the negation of the proposed theorem. Hence, strictly speaking, the program attempts to find a refutation of the formula. So the presence of refutation completeness for a procedure means that a refutation exists within the constraints of that procedure when applied to refutable sets of clauses. As noted above, some plausible combinations of strategies and inference rules, such as hyper-resolution and set-of-support, actually block all proofs for some, or even all, theorems. Thus it is at least theoretically important to know that the procedure is refutation complete. Unfortunately, during the period in question, it became a virtual requirement for publishing in automated theorem proving that the paper prove some result on refutation completeness. This re quirement may have contributed to what, at least in retrospect, would have to be viewed as a preoccupation with this property. The view at the time was that inference rules, strategies, and automated theorem-proving programs had to be complete in order to be worth studying or using. Such was not to be the case. In fact the interest in this property is presently at its low. It has been realized that the presence of refutation completeness adds little to effectiveness and that its absence usually interferes in only a theoretical sense. By way of amplification, note that the presence just says that waiting long enough in a computer run gets results. Long enough can mean much longer than one can afford. No time estimate is suggested by the presence. In general, if version 1 of a program is known to be incomplete and version 2 of that same program has only that defect corrected, the two will often function similarly. On easy problems both will find a proof. On most hard problems, both will run out of time. Finally, in practice, theorem-proving programs often simultaneously employ a variety of strategies and inference rules. Thus, proving refutation com pleteness for some strategy or for that strategy in combination with an inference rule sheds little light on a program's actual performance. From the viewpoint of advancing the state of the art and thus producing more effective and usable programs, too much time and effort was spent on these theoretical studies. Nevertheless, it was important to consider and answer some of the corresponding questions and thus provide a solid logical foundation for the field.
4.3
Other logical properties
Among the other possible logical properties, there were three that received some attention during the period. Near the end, Luckham [20] studied the bounds of complexity for proof. Unfortunately, these bounds provide little guidance in the search for a proof. A second and intriguing question involved the notion of theorem finding as opposed to theorem proving. The idea is to use the theorem prover to generate interesting theorems from an axiom set rather than to generate a contradiction from the denial of a conjecture. Lee [18] gave some completeness results for con-
410
Collected Works of Larry Wos
sequence finding. However, there remains the practical problem of determining which of the myriad of generated clauses are significant. Finally, the theoretical lower limit of complexity of the unification process was given some attention. However, the first unification algorithm actually im plemented [42] had essentially achieved this lower limit up to an insignificant difference. With such an algorithm in hand, the way to materially improve pro gram effectiveness was to sharply reduce the space of clauses being searched rather than to speed up unification.
5
Testing, Implementation, Experimentation
When the desired goal is the development of an approach for solving some class of problems, such an approach must be tested to determine its value. For the field of automated theorem proving such a test consists of successfully finding proofs by using a computer program if the designation of "good" is to be correctly applied. The "proofs" do not have to be for theorems from mathematics. The problems to be solved might come, for example, from program verification or from question-answering or some such other area. The crucial test of methodology in the field is made by experimenting, and the experiments must be conducted with a running program. The program is necessary because one must attempt problems with enough difficulty that hand computation is essentially out of the question. Although a number of programs existed, not much of the experimentation with them was described in the literature by 1970. As was recognized by those in the field, the most effective program at the time was the implementation by Carson [42]. At the beginning of the period, Guard et al. [10] put up a rather different theorem-proving program in that it was interactive. With their system, a lemma from combinatorial lattice theory called Sam's Lemma was proved. This lemma was the only "new" result proved by a theorem-proving program at that time. Yet one more program is worth citing, namely, that of Allen and Luckham [1]. Theirs was also interactive and was used for testing some results gleaned from the AMS Notices. Other programs that existed by 1970 (but which may not have appeared in the literature until later) were those of: Slagle and Bursky [36]; the Edinburgh program [16]; Darlington (5); Green [9]; Quinlan and Hunt [29]; Nevins [24]; Norton [26]; Veenker [37]; and Bledsoe [3]. Two natural questions arise. Which problems could such programs solve? Was there much effort expended to solve open questions? The problems ranged from simple examples taken from group theory whose proofs were already known to problems from the theory of Henkin models [11,21] whose proofs were unknown to the theorem proving community. The fact that Luckham [1] was able to find proofs for these theorems with his program without any prior knowledge was an excellent sign that the field was really progressing. As for the second question, almost all experimentation involved problems
Automated Theorem Proving 1965-1970
411
with known proofs—known to the experimenter. The reason for this was simply that one could thus measure the performance of the program and the value of a "new" notion by seeing how much of the proof was found. With an open question, on the other hand, one does not even know whether it is a theorem and hence provable. Furthermore, even if one is assured that the result can be proved, the lack of a given proof removes the mechanism for measuring progress. The various computer programs contributed very much more than a means of idea testing. Through their use and the corresponding study of the gener ated clause sets, important additions to the theory were found. For example, discoveries were made in the area of strategy. Numbered among such are: the set-of-support strategy, singly connectedness, and demodulation. In view of such discoveries, it is quite surprising that others were not en couraged to do more implementation and experimentation during the period. Only in part can such be explained by some scarcity of computer access and of computer power. Too little was tried by those in the field. Although some may not share our position, to us the evidence clearly states that the field of auto mated theorem proving would have progressed much more rapidly from 1965 to 1970 had there been greater concentration on testing, implementation, and experimentation.
6
Further Developments
One of the most interesting and imaginative contributions of the pe;riod was the work of C. Green [8,9]. His research and program give the first use of au tomated theorem proving to an area outside of mathematics, namely, to the area of question-answering. By appending a literal, the answer literal, to certain clauses which are the encoding of the question to be answered, Green's pro gram yielded additional information in excess of the "yes" or "no" answer being sought. An example of a kind of question that was typical of the time is, "Who is a grandparent of John?", given some facts about parents and the definition of grandparent. This would be posed as the theorem, "There exists an x such that x is the grandparent of John." The literal ANS(x) is attached to the denial of this theorem and the program attempts to find a refutation. If it succeeds, then the value that was substituted for x in the ANS literal can be given as the grandparent that was found by the program. The next significant development (which would receive ever-increasing atten tion during the next decade) was the early study of the application of automated theorem proving to the verification of computer programs. One starts with some given computer program, a statement of its purpose in terms of properties that its results must satisfy, and various assertions about intermediate ste:ps in the computation. With this information conjoined with appropriate axioms, an au tomated theorem-proving program then attempts to find a proof by contradic tion that the given program is correct—that the results of the program upon
Collected Works of Larry Wos
412
termination have the stated properties. There was also closely related work con cerning the use of theorem provers for writing programs. A proof similar to that required for the verification of an existing program is sought. Then infor mation is extracted from this proof, albeit in a much different way than for question-answering. Much of this effort was aimed at programs for the control of robots. Almost at the end of the period, there emerged quietly an interest in natural deduction or Gentzen systems. It would have to wait until the 1970's for the interest in such non-resolution systems to increase to the point of producing the corresponding programs [2,3,24].
7
Trends, T h e Next Decade
We close by mentioning where, in our opinion, the major topics of study during 1965-1970 led in the next decade. The concern for completeness declined drastically in the 70's. People thought it interesting to know for what class of problems a system was complete, but were not overly concerned if a system was not complete for all classes. They were more interested in how well the program worked, that is, how many theorems it could actually prove. This decline of interest was due in part to the general ineffectiveness of complete strategies by themselves. Also there developed an interest in interactive and non-resolution theorem provers, where the question was either not relevant or was too difficult to answer. Indeed, by the end of the 70's, even resolution programs were too complex and had too many features to be formally analyzable. A related topic, the development of new strategies, also appeared to die down in favor of the refinement of existing strategies. For example, people studied the incorporation of a selection mechanism in linear resolution for choosing the literal out of the center clause to resolve on. Others considered different ways of ordering clauses to be chosen for resolution that could be used with existing strategies. These are but a few of the efforts in this direction. The general area of special treatment of certain relations continued to be studied. Proposals were made to handle set theory relations by new rules of inference, just as paramodulation had been proposed for equality; however, these new rules did not receive the attention that paramodulation did. Equality also continued to receive much attention, both in the study of paramodulation and the study of simplifiers. The work on commutative/associative unifiers can also be viewed as building in certain classes of equalities. Experimentation continued during the 70's, but only at those few centers that were concentrating on developing more powerful programs. It became clear that in order to explore quite difficult problems, efficient new techniques for implementing a wide range of ideas were required. As noted above, the natural deduction approach that had just begun in the
Automated Theorem Proving 1965-1970
413
late 60's received much greater attention and achieved some notable successes. And last, we note that the application of theorem proving to various other non-mathematical problems became an even more active area of research in the 70's. An intense study was made of program verification. The area of questionanswering was extended to include the use of theorem provers in general data base and information retrieval systems. We believe this played a significant role in developing interest in the general application of logic to data base research. These activities were followed by totally new applications such as automated circuit design and the use of logic as a programming language.
8
Conclusion
Because of obvious limitations, we have in the main confined this treatment to a discussion and evaluation of those occurrences between 1965 and 1970 which directly or indirectly led to later progress. Automated theorem proving during this period could be viewed as essentially an action-reaction cycle. It began with the realization that more general and more powerful ways of reasoning were needed. These were found but discovered to be insufficient if undirected and unrestricted. So strategies were formulated to deal with the situation. How ever, it was then realized that they might in turn interfere with certain basic properties of proof finding. This realization then led to the study of various logical properties to provide assurance that everything still worked. It was then understood that the language for the encoding of problems could in certain cases benefit from extension. Thus methods for "building in" equality were found and studied. All of this presented the need for the testing of value and significance, and experimentation with automated theorem-proving programs began. The period produced much on which later work would rely. The inference rules, for example, of resolution and hyper-resolution, the set-of-support, linear, unit and demodulation strategies, the treatment of equality via paramodulation, and the importance of the unit clause dominate much of automated theorem proving now in 1981. It is the 1965-1970 period more than any other to which the present success and broadened scope of automated theorem proving can be traced. The field has now passed from that of the potential use to the actual use. Evidence of such is provided by the various open questions whose answers were obtained with an automated theorem-proving program. Of the questions thus answered, some are from abstract mathematics, some from circuit design, and some from formal logic. The first mathematical inquiry concerned the possible independence of each of axioms 1, 2, and 3 of the five axioms defining a ternary Boolean algebra [1,4]. Axioms 4 and 5 had each already been proved dependent on the first three. Each of the first three was found to be independent. These questions of axiom dependence turned out to be easily answered. The technique employed in the investigation was that of model generation [38]. This use of automated theorem
Collected Works of Larry Wos
414
proving was and is a valuable extension of the scope of such programs. The second problem from mathematics was: Does there exist a finite semi group possessing a nontrivial antiautomorphism but admitting no nontrivial involutions? This problem was rather more difficult than the first for, among others, a procedure was required to generate and examine possible mappings. The resulting amended model generation technique found a semigroup of order 83 with the desired properties [39]. This success immediately led to the con sideration of the related minimality question. The smallest such semigroup was found to be of order 7 [39]. The interesting point here is that in no way was the program forced to examine the myriad of smaller semigroups on the way to answering this minimality question. The circuit design problem was one of possibly finding more efficient fourvalued logic circuits than existed in the literature. The electronic circuits were required to use T-gates. In the majority of cases examined, more efficient circuits were found by the theorem-proving program [41]. Finally, the problems from formal logic were each from equivalential calculus [28]. This calculus essentially relies on "condensed detachment" as its inference rule. This rule behaves like hyper-resolution. There are certain single formulas therein which are strong enough to serve singly as axioms. There were seven formulas of length eleven whose status with regard to being a possible axiom was unknown. Of the seven, five were shown to be too weak, while the other two were proved to be shortest single axioms for the equivalential calculus [46]. This set of problems presented a wide range of difficulty. The most difficult of the seven required finding a proof whose analogue with condensed detach ment would consist of more than 150 steps and contain some formulas of length greater than 100. Automated theorem proving gained in two ways from this study of formal logic. First, a method was found to enable the theorem-proving program to examine various infinite sets in a finite manner. Second, although the actual induction steps used in the solutions of the problems were not them selves automated, the arguments on which they rested were taken directly from the computer runs. With the foregoing in mind, it seems reasonable to conjecture that the field of automated theorem proving has entered a new phase. Although many of the inherent difficulties are virtually untouched, automated theorem proving is now clearly making valuable contributions to research in various other unrelated areas.
References 1 Allen, J. and Luckham, D., "An interactive theorem-proving program," Machine Intelligence, Vol. 5(1970), Meltzer and Michie (eds), American Elsevier, New York, pp. 321-336.
Automated Theorem Proving 1965-1970
415
2 Bibel, W. and Schreiber, J., "Proof search in a Gentzen-like system of firstorder logic," Proc. of the International Computing Symposium (1975), North Holland Publ., pp. 205-212. 3 Bledsoe, W. and Bruell, P., "A man-machine theorem-proving system," Artificial Intelligence Journal, Vol. 5(1974), pp. 51-72. 4 Chinthayamma, "Sets of independent axioms for ternary Boolean alge bra," Notices of the American Mathematical Society, Vol. 16(\%9), p. 654. 5 Darlington, J., "Some theorem-proving strategies based on the resolu tion principle," Machine Intelligence, Vol. 2(1968), Dale and Michie (eds), American Elsevier, New York, pp. 57-71. 6 Davis, M. and Putnam, H., "A computing procedure for quantification theory," J. ACM, Vol. 7(1960), pp. 201-215. 7 Gilmore, P., "A proof method for quantification theory," IBM Journal of Research and Development, Vol. ^(1960), pp. 28-35. 8 Green, C , "The application of theorem proving to question-answering systems," Ph.D. thesis, AI Memo-96, Dept. of Computer Science, Stanford University, Stanford, California, June, 1969. 9 Green, C , "Theorem proving by resolution as a basis for question-answering systems," Machine Intelligence, Vol. ^(1969), Meltzer and Michie (eds), American Elsevier, New York, pp. 183-205. 10 Guard, J., Oglesby, F., Bennett, J. and Settle, L., "Semi-automated math ematics," J. ACM, Vol. ;6(1969), pp. 49-62. 11 Henkin, L., "An algebraic characterization of quantifiers," Fundamenta Mathematicae, Vol. 37(1950), pp. 63-74. 12 Henschen, L. and Wos, L., "Unit refutations and Horn sets," J. ACM, Vol. 21(1974), pp. 590 €05. 13 Herbrand, J., "Rccherches sur la theorie de la demonstration," Travaux de la Societe des Sciences et des Lettres de Varsovie, Classe III Science Mathematique et Physiques, 1930. 14 Herbrand, J., "Investigations in proof theory," in From Frege to Godel: A Source Book in Mathematical Logic by J. van Heijenoort, Harvard Univer sity Press, 1967, pp. 525-581. 15 Kowalski, R., "The case for using equality axioms in automatic demon stration," Proc. of the IRIA Symposium on Automatic Demonstration, Versailles, France, 1968, Springer-Verlag Publ., pp. 112-127.
416
Collected Works of Larry Wos
16 Kowalski, R., "Search strategies for theorem proving," Machine Intelli gence, Vol. 5(1970), Meltzer and Michie (eds), American Elsevier, New York, pp. 181-200. 17 Kuehner, D., "Some special purpose resolution systems," Machine Intel ligence, Vol. 7(1972), Meltzer and Michie (eds), American Elsevier, New York, pp. 117-128. 18 Lee, R., "A completeness theorem and a computer program for finding theorems derivable from given axioms," Ph.D. thesis, U. of California, Berkeley, California, 1967. 19 Loveland, D., "A linear format for resolution," Proc. of the IRIA Sym posium on Automatic Demonstration, Versailles, France, 1968, SpringerVerlag Publ., pp. 147-162. 20 Luckham, D., "Refinement theorems in resolution theory," AI Memo-81, AI Project, Stanford University, Stanford, California, 1969. 21 Marsden, E., "A note on implicative models," Notices of the American Mathematical Society, Vol. 75(1971), p. 89. 22 McCharen, J., Overbeek, R. and Wos, L., "Problems and experiments for and with automated theorem proving programs," IEEE Transactions on Computers, Vol. C-25(1976), pp. 773-782. 23 McCharen, J., Overbeek, R. and Wos, L., "Complexity and related en hancements for automated theorem-proving programs," Computers and Mathematics with Applications, Vol. 2(1976), pp. 1-16. 24 Nevins, A., "A human-oriented logic for automatic theorem proving," J. ACM, Vol. 2/(1974), pp. 606-621. 25 Newel, A., Shaw, J. and Simon, H., "Empirical explorations with the logic theory machine," Computers and Thought, Feigenbaum and Feldman (eds), McGraw Hill Publ., New York, 1963, pp. 109-133. 26 Norton, L., "Experiments with a heuristic theorem-proving program for predicate calculus with equality." Heuristics Lab., Div. of Computer Re search and Technology, National Institute of Health, Bethesda, Maryland, 1971. 27 Overbeek, R., "An implementation of hyper-resolution," Computers and Mathematics with Applications, Vol. /(1975), pp. 201-214. 28 Peterson, J., 'Shortest single axioms for the equivalential calculus," Notre Dame Journal of Formal Logic, Vol. i7(1976), pp. 267-271.
Automated Theorem Proving
1965-1970
417
29 Quinlan, J. and Hunt, E., "A formal deductive problem-solving system," J. ACM, Vol. 15(1968), pp. 625-646. 30 Robinson, G. and Wos, L., "Paramodulation and theorem proving in firstorder theories with equality," Machine Intelligence, Vol. 4(1969), Meltzer and Michie (eds), American Elsevier, New York, pp. 135-150. 31 Robinson, J., "A machine-oriented logic based on the resolution principle," J. ACM, Vol. 72(1965), pp. 23-41. 32 Robinson, J., "Automatic deduction with hyper-resolution," International Journal of Computer Mathematics, Vol. 7(1965), pp. 227-234. 33 Robinson, J., "A review of automatic theorem proving," Proc. of the Sym posia in Applied Mathematics, Vol. 79(1967), American Mathematical So ciety, Providence, Rhode Island, pp. 1-18. 34 Skolem, T., "Uber die mathematische logic," Norsk Matematisk Vol. 70(1928), pp. 125-142.
Tidskrift,
35 Slagle, J., "Automatic theorem proving with renamable and semantic res olution," J. ACM, Vol. 7^(1967), pp. 687-697. 36 Slagle, J. and Bursky, P., "Experiments with a multipurpose, theoremproving heuristic program," J. ACM, Vol. 75(1968), pp. 85-99. 37 Veenker, G., "Beweisverfahren fur die predikatenlogic," Computing, Vol. 2(1967), pp. 263-283. 38 Winker, S. and Wos, L., "Automated generation of models and counterex amples and its application to open questions in ternary Boolean algebra," Proc. of the Eighth International Symposium on Multiple-valued Logic, Rosemont, Illinois, 1978, IEEE and ACM Publ., pp. 251-256. 39 Winker, S., Wos, L. and Lusk, E., "Semigroups, antiautomorphisms, and involutions: a computer solution to an open problem, I," to appear in Mathematics of Computation. 40 Winker, S., "Generation and verification of finite models and counterexam ples using an automated theorem prover answering two open questions," to appear in J. A CM. 41 Wojciechowski, W. and Wojcik, A., "Multiple-valued logic design by the orem proving," Proc. of the Ninth International Symposium on Multiplevalued Logic, Bath, England, 1979. 42 Wos, L., Robinson, G. and Carson, D., "Some theorem-proving strate gies and their implementation," Argonne National Laboratory, Technical Memo 72, Argonne, Illinois, 1964.
418
Collected Works of Larry Wos
43 Wos, L., Carson, D. and Robinson, G., "The unit preference strategy in theorem proving," Proc. of the Fall Joint Computer Conference, 1964, Thompson Book Company, New York, pp. 615-621. 44 Wos, L., Carson, D and Robinson, G., "Efficiency and completeness of the set-of-support strategy in theorem proving," J. ACM, Vol. 12(1965), pp. 536-541. 45 Wos, L., Robinson, G., Carson, D. and Shalla, L., "The concept of demod ulation in theorem proving," J. ACM, Vol. ^(1967), pp. 698-704. 46 Wos, L., Winker, S., Veroff, R., Smith, B. and Henschen, L., "Questions concerning possible shortest single axioms in equivalential calculus: an application of automated theorem proving to infinite domains," in prepa ration.
Questions Concerning Possible Shortest Single Axioms for the Equivalential Calculus: An Application of Automated Theorem Proving to Infinite Domains L. WOS, S. WINKER, R. VEROFF, B. SMITH and L. HENSCHEN
1
Introduction
Occasionally in mathematics, and especially in various fields of formal logic, there arise various questions of alternate axiomatization. In the equivalential calculus, for example, there are formulas that are known to be strong enough to serve as single axioms. In [15] Peterson gave various possible shortest single axioms for that calculus. With the 10 given there and the one found by Kalman [3], there arose the question concerning the existence of any additional formulas that might also be shortest single axioms. There remained seven formulas yet to be classified in that regard [15]. In this paper we show that each of the four formulas XJL, XKE, XAK and BXO is too weak to be a single axiom. Although the corresponding proof and discussion of the remaining three unclassified formulas is deferred to a later paper, we remark that XCB is also too weak but both XHK and XHN are each 'new' shortest single axioms. The method for obtaining both the results presented here and those that are deferred rests heavily on the use of an automated theorem-proving program. This program is a general-purpose program in that it has been and is used to study questions from various fields of mathematics and logic. Before this study was made, proofs obtained with such programs were for theorems naturally phrasible in the first-order predicate calculus. This study, on the other hand, re quired proving theorems of a higher order. This additional requirement resulted "This work was supported in part by the Applied Mathematical Sciences Research Program (KC-04-02) of the Office of Energy Research of the U.S. Department of Energy under Contract W-31-109-Eng-38 (Argonm: National Laboratory, Argonne, IL 60439) and in part by NSF grant MCS79-03870 (Northern Illinois University, DeKalb, IL 60115). Reprinted from Notre Dame Journal of Formal Logic, Vol. 24, no. 2, pp. 205-223 (April 1983).
420
Collected Works of Larry Wos
from the intent of examining the full set of theorems deducible from a formula in order to show that certain known theorems are absent from the set. Since, for each of the formulas under study, the set of deducible theorems is infinite, the direct examination thereof is impossible. To cope with such infinite domains and remain within the province of the existing theorem-proving program, a new methodology was developed. For each of the four formulas, use of the program led to the discovery of a corresponding finite set of schemata. The individual sets of schemata each re spectively characterize the set of theorems deducible from the particular formula under study. Although this treatment of infinite domains extends the scope of automated theorem-proving programs, its more significant iispect for the logi cian is its generality. Evidence of the generality of the method is provided by applications to similar problems in both the R and the L calculus [4] and is covered in a later paper. Four aspects of the method given in this paper are worth noting. First, for those four formulas that are proved here too weak to be a single axiom, the method yields a characterization of the theorems deducible from them in terms of a finite set of schemata. Second, all formulas are treated in a uniform fashion. Third, for each of the seven formulas studied, the method is used to establish either the inadequacy or the adequacy of the formula as a single axiom. For example, XJL is inadequate, and XHK is adequate. Fourth, other than that which was required to produce the existing theorem-proving program, no programming was required to obtain the results. In the interest of providing an understanding of the potential value of such a program and thereby suggesting possible alternate uses of the computer in the study of formal logic, we provide a brief discussion of how the program was used to obtain these results. We include the discussion of the solution of a rather different problem than that of the consideration of infinite domains. Specifically, we show how the program can be used to find shorter proofs for already proved theorems. The example chosen is XGK. Kalman [3] proved that XGK is a single axiom for the equivalential calculus. We briefly discuss the heavy use of Kalman's proof by the program in its successful attempt at obtaining an alternate proof-a proof roughly half the length of Kalman's. The techniques given in this paper, especially when coupled with the knowl edge that no additional programming is required by the researcher, may suggest the feasibility of attacking additional open questions with the assistance of an automated theorem-proving program.
Possible Shortest Single Axioms for Equivalential Calculus
2 2.1
421
Overview Background
The focus here is on the equivalential calculus. The elements of that calculus are the expressions that can be recursively well-formed from the variables, x, y, z, w, ..., and the 2-place function E. The theorems of the calculus are just those formulas in which each variable therein occurs an even number of times [14]. There are individual formulas there that are strong enough to serve alone as axioms. It has been proved [15] that the shortest possible single axiom must contain at least 11 symbols, and there are in fact formulas of that length that suffice. There are 630 formulas of length 11—that contain 11 symbols. Of these, 11 have been shown to be single axioms [3,13], but 612 have been proved too weak. Of the remaining seven, we show here that four are also too weak. In a later paper, we will show that two of the seven are additional "new" shortest single axioms and that the last of the seven is too weak. We thus disprove the conjecture [5] that no additional shortest single axioms would be found. The standard rules of inference in this calculus are the substitution rule and the rule of detachment [17]. However, studies thereof are often conducted by means of the inference rule of condensed detachment [15]. By a remark by Kalman [16], we have the fact that all theorems in the calculus can be obtained by substitution into some formula that can in turn be obtained by condensed detachment. Since then; exist single axioms for the calculus in which each vari able therein occurs precisely twice, and since Lemma 2.2.1 establishes the fact that the successful condensed detachment of two formulas of this type yields a formula of the same type, we choose in this paper to confine our attention to the use of condensed detachment. We also, therefore, restrict our attention to those theorems of equivalential calculus in which each variable therein occurs twice. Definition For the two formulas E(A, B) and A, detachment is that inference rule that yields the formula B. Definition For the two formulas E(A, B) and A' which are assumed to have no variables in common, condensed detachment is that inference rule that yields the formula B", where B" is that which is obtained from detaching E(A", B") and A", and where E(A", B") and A" are obtained from E{A, B) and A', re spectively, by the most general possible substitution whose application forces A and A' to become identical. Condensed detachment is denoted by CD. Thus condensed detachment, when it applies, takes two formulas and re names their variables so that they have no variables in common, then seeks the most general substitution that can be found whose application will per mit a detachment, and finally applies detachment to the pair of formulas af ter the substitution has been made. For example, the condensed detachment
Collected Works of Larry Wos
422
of E(E(E(x,x),z),z) with E(E(x,y), E(y,x)) yields E(x, x) and also yields E(x, E(E(y,y),x)), depending on the order in which the premisses are consid ered. For the remainder of the paper, a 'theorem' of equivalential calculus will be a formula in which each variable occurs twice. Such formulas will be called pure. The study of the calculus will thus be entirely in terms of pure formulas.
2.2
Definitions and notation
We now turn to the formal treatment. We adopt the following notation and employ the following definitions. The formulas of the equivalential calculus will be written in terms of the 2-place function, E, and the variables, x,y,z, .... However, when two formulas are considered simultaneously (as in condensed detachment, for example), we assume that no variables are shared regardless of the syntactic form. We refer to the equivalential calculus as EC. Using the notation of Peterson [15], the four formulas to be studied are XJL, XKE, XAK and BXO. Definition Two well-formed expressions (which are assumed to have no vari ables in common) are said to unify [18] if there exists a substitution that can be applied to them which makes them identical. Definition Except for alphabetic variancy, the most general unifier (MGU) is the most general substitution that forces a pair of unifiable expressions to become identical. Definition The most general common instance (MGCI)—within alphabetic variancy—for two unifiable expressions is that expression yielded by applica tion of the MGU. Definition If the condensed detachment of E(A, B) with A' yields 5 " , then E(A, B) is called the major premiss and A' the minor premiss. By convention, when we say "condensed detachment of A with B", hence forth we shall mean that A is the major premiss and B is the minor. Since the condensed detachment of E(A, B) with A' requires finding the most general common instance, if any exists, of A and A', we have the following definition. Definition If the successful unification of A with A' is represented by the set of pairs Ul/zi where U are well-formed expressions and z< are the variables in A and A', then U are called the replacement terms of unification, or simply the replacement terms. When E(A, B) is condensed detached with A', those replacement terms U whose Zi are present in both A and B are called key
Possible Shortest Single Axioms for Equivalential Calculus
423
replacement terms. Thus the formula yielded by the successful condensed detachment of E(A, B) with A' is obtained by replacing those Zi in B that are also in A by the cor responding key replacement terms. For example, the condensed detachment of E(E(E(x,x),y),y) with E(E(x,y),E(y,x)) yields E(x,x), where the key re placement term is E(x, x). Definition A well-formed formula of EC is called pure if each of its distinct variables occurs exactly twice. Definition When a variable in a well-formed formula A of EC occurs exactly once in A, that variable is called isolated and is usually denoted by w. Definition A well-formed formula of EC is called almost pure if it contains ex actly one isolated variable; and, except for the occurrence of the isolated variable, the formula is pure. For example, the formula E(E(x, x), w) is almost pure, and also the formula w by itself is almost pure. Definition The kernel(s) of a pure formula are those (not necessarily proper) subexpressions that are pure formulas but that properly contain no pun: formu las. Kernels are usually denoted by K, K', .... Thus we have: E(y, z) is not pure; E(E(x, x), E(y, y)) is pure, where its only kernel (exclusive of alphabetic valiancy) is E(x, x); and the formula, E(E(x, y), E(y, x)), is itself a kernel. Definition For any formula, A, the closure of A, denoted by CL(A), is the smallest set of formulas that contains A and that is closed under condensed detachment. Lemma 2.2.1 The successful condensed detachment of two pure formulas yields a pure formula. Proof: The proof is omitted. A similar result is found in Belnap [1] after point 12 in the proof of the lemma. We therefore have the following remark. Remark 2.2.1: If A is a pure formula, then all elements of CL(A) are pure. Finally, in order to study the precise nature of CL(A) for the four choices of A in question, we introduce the following definitions. Definition Let A be any pure formula of EC, and let C be any nonempty set of
424
Collected Works of Larry Wos
well-formed formulas of EC. Then C is called a containment set for A when: A is in C; all elements of C are pure; and C is closed under condensed detachment. Definition Let A be any pure formula of EC, let C be any containment set for A, and let U be any nonempty set of well-formed expressions from EC. Then U is cAlled a unification set for A and C when: every element of U is almost pure; every element of U contains exactly one isolated variable, which is denoted by w; and the successful unification of any element of U with any element of C yields a replacement term for w that is itself an element of C. (Although the first property of unification sets implies the second, we choose to have both given explicitly because of extensive use of isolated variables in the following sections.) The concept of unification set is introduced because of the close connection between condensed detachment and unification. Since both particular unifica tion sets and particular containment sets occurring in later sections are defined in terms of schemata, we do not restrict the application either of unification or condensed detachment to just the formulas of the equivalential calculus. In fact we will in most cases be concerned with application of either to various schemata. For example, if the schema f(A) = E(E{x, A), x) and the schema i(z) = E(z, z), the condensed detachment of /(^4) with i(z) yields A. We can immediately give a trivial example of these definitions. Let A be any pure formula, let C be CL(A), and let U consist of the single expression, to. Then C is a containment set for A, and U is a unification set for A and C. Although we define a 'new' containment set and a 'new' unification set for each formula to be studied, we omit notationally their respective dependence on the formula in focus. A similar remark holds for the various schemata and kernels relevant to the corresponding study.
2.3
The problem and the method of solution
The problem is that of considering a formula and the possibility that it may be strong enough to be a single axiom for the equivalential calculus. One can prove that the selected formula is a single axiom by merely deriving from it by repeated use of condensed detachment some known single axiom. On the other hand, if it is too weak, establishment of that fact might proceed by showing that some known theorem cannot be thereby deduced. Since in general from a given formula one can deduce an infinite number of theorems, direct examination of that set is not possible. Thus the problem of showing a formula too weak to be a single axiom is potentially harder than proving it strong enough. With much assistance from the automated theoremproving program [10,19,25,26], we found that a finite set of schemata exists that circumvents the difficulty of examining the infinite domain of interest. More precisely, for each of the four formulas considered here (XJL, XKE, XAK
Possible Shortest Single Axioms for Equivsdential Calculus
425
and BXO), there exists a finite set of schemata that completely characterizes the theorems deducible from the formula. Not surprisingly, the nature of the respective sets depends on the particular formula under study. To prove that a formula A of EC is not a single axiom, it is sufficient to prove that some containment set C for A excludes a known theorem, since such a C contains all formulas deducible from A. For each of the four formulas A at hand, we do this by presenting a C such that every formula in C contains a variant of A—which is itself a kernel—or, in the case of BXO, a variant of A or a second kernel, namely, E(x, E(y, E(x, y))). Thus in every case, C fails to contain E(x,x), a known theorem. (As an aside, it can be proved that C = CL(A) for all four formulas, although this equality is not crucial here.) In each case the required C, which is infinite, is inductively defined in terms of a finite set of schemata. That C is closed under condensed detachment is proved by conducting a case analysis (based on these schemata) for the pos sible forms of the major premiss coupled with a study of the corresponding condensed detachments. When such a CD is attempted, a subformula S of the major premiss is considered for unification with the minor premiss. To study the appropriate unifications, an infinite unification set U is also inductively defined in terms of a finite set of schemata. Then various unifications of elements from C with elements from U are considered. The consideration of such unifications for these formulas often reduces to yet further unifications whose MGCI is smaller in length. Thus the proof that C is closed relies on an induction argument based on the length of the MGCI. (The schemata used to define C and U were dis covered with the aid of the automated theorem-proving program by attempting unifications on partially defined C and U.) For each of the four formulas, we first prove a lemma that shows that the unification of an element of U with an element of C yields a key replacement term that in turn is an element of C. From this, it is easy to show by case analysis that the successful CD of two formulas in C is also in C. Upon its completion, this study yields the following for A, where A is re spectively each of the four formulas under investigation. 1. C is closed under condensed detachment 2. C contains CL(A) 3. C is a containment set for A 4. U is a unification set for A and C 5. With the exception of BXO, the only kernel to be found (up to alphabetic variancy) in any element of C is A itself; for BXO a second kernel appears, namely, E(x, E(y, E(x, y))) 6. Among the theorems of EC, C does not contain E(x, x)
Collected Works of Larry Wos
426
7. C = CL(A); (A strengthening of 2 but with some detail omitted), and, because of (6), 8. A is too weak to be a (shortest) single axiom for the equivalential calculus. Because purity of formulas is heavily relied upon throughout the treatment given here, we give the following word of warning. When defining various C and U, we implicitly assume that the various schemata employ variables distinct from those occurring in their arguments. For example, if h(w) — E(y, E(w, y)), then h(h(w)) = E{z, E(E(y, E(w, y)), z)), as occurs in BXO.
3 3.1
Examination of four possible shortest single axioms for equivalential calculus Ground rules
In this section we show that each of the four formulas—XJL, XKE, XAK, and BXO—is too weak to be a (shortest) single axiom for EC. For each, we are con tent merely to define the appropriate containment set, unification set, kernel(s), and schemata and give the necessary CD arguments in terms of unification. The proofs are contained in various tables. Before turning to the first of the four, we give the following remark but without the tedious and straightforward details of its proof. The remark is relied upon throughout the rest of this section. Remark 3.1.1: If E(A, B) and E(A', B') can be unified, where A, B, A', B' are all well-formed expressions of EC, then the pairs A, A' and B, B' can be re spectively unified. Furthermore, if a is a most general unifier of A and A1', and if the most general common instance of E(A, B) and E(A', B') is of length p, then oB and aB' unify and the length of their most general common instance is strictly less than p. In addition the replacement terms that occur in the uni fication of aB and aB' are the same (except for possible variable renaming) as their correspondents that occur in the unification of E(A, B) with E(A', B'). By symmetry, the respective roles of A and B and A' and B' can be interchanged with the corresponding remarks for a most general unifier r.
3.2
XJL
In this section we prove that XJL = E(x, E(y, E(E(E(z, y), x), z))) is too weak to be a single axiom for the equivalential calculus. The proof proceeds by first letting XJL be denoted by K. The schemata to be used in the definition of C are
Possible Shortest Single Axioms for Equivalential Calculus
427
1. K = XJL = E(x, E(y, E(E(E(z, y), x), z))) 2. f(A) = 3. g(B,A) =
E(y,E{E(E(z,y),A),z)) E(E(E(z,B),A),z)
4. i(A, B) = E(A, B) where A and B are pure formulas and also f(A), g{B, A), and i(A, B) are pure. Note that K is indeed a kernel. Definition Let Co consist of K alone. For i = 0,1,2,..., let Cj+i be the union of: d; all f(A) with A in C<; all g(B, A) with A and B in d; and i(4, B) with A and B in C^. Then let C equal the union over i of C^. The schemata for U are: 1. w 2. /(S) = £(y, £(£(£(*, y),S), 2 )) 3. g(S,A) =
E(E(E(z,S),A),z)
4. fl(B,S) = £ ( £ ( £ ( ; , B),S), 2 ) 5. i(S,B) = £(S,B) 6. i(A,S) =
E(A,S)
where A and B are pure formulas and where 5, /(5), p(5, A), g(B, S), i(S, B), and i(A, S) are almost pure formulas with isolated variable w. Definition Let U0 consist of the expression, w, alone. For i = 0,1,2,..., let U{+i be the union of: [/<; all f(S) for S in Ut; all g(5, B) for 5 in [/< and B in C; all p(B, S) with 5 in £/< and B in C; all i(S, B) and all i(B, 5) with 5 in */< and B in C. Then let U equal the union over i of Ui. Lemma 3.2.1 If the pair S in U and Bo in C are unifiable, then the key re placement term t for the isolated variable w in S occurring in the unification is itself an element of C. Proof: Let S be an element of U and Bo be an element of C. If S and Bo are not unifiable, there is nothing to prove. Now assume that 5 and Bo are unifiable. Then S and Bo have a most general common instance. The proof is one of induction on the length of this most general common instance, where length is defined as the symbol count. If the length, p, is one, the lemma holds vacuously since all elements of C have length at least eleven. Next, assume by induction that the lemma holds for all unifiable pairs whose MGCI is of length less than p, and let S and Bo be unifiable with MGCI of length p. The proof is one of
Collected Works of Larry Wos
428
case analysis on the possible forms for both S and BO. The results of this case analysis are given in a table below in terms of schemata rather than in terms of formulas. The columns are indexed by the possible forms for S, while the rows are indexed by those for BQ. Each entry in the table reflects the outcome of consideration of a pair of schemata for unification. There are three possible outcomes: 1. the unification fails 2. the unification succeeds, and the key replacement term is in C and is found in the corresponding table entry 3. the attempted unification reduces to the attempted unification of another pair of schemata, where the pair is found in the corresponding table entry. In this third case, the length of the MGCI of the formulas represented by the second pair is strictly less than that of the formulas represented by the original pair under consideration. Remark 3.1.1 comes into play. If this third case terminates with successful unification, we appeal to the induction hypothesis to prove that the key replacement term is in C. Before presenting the table, we cite one example, taken from the table, to illustrate each of the three cases. 1. Consider S = f{T) = E(y, E(E(E(x,y),T),x)) and B0 = g(B,D) = E{E{E{z,B),D),z). Clearly, y must become E(E(z,B),D). But z must then unify with a term containing z itself, which is impossible. 2. Suppose S = w and BQ = K. Then the key replacement term is K itself. 3. Now suppose that S = /(T) and BQ = f(B). The unification question im mediately reduces to one for T and B. Recall that we are assuming purity of / ( £ ) , almost purity of /(T), and disjointness of the sets of variables for XJL w f(T) g(T,A) g(A,T) i(T,A) i(A,T)
K K failure failure failure f(T); A T; f(A)
f(B) f(B) T; B failure failure g(T,B); A T; g(A,B)
g(B,D) g(B,D) failure T;B T;D T; i(i(A,B),D) i(i(T,B),D); A
i(B,D) i(B,D) g(B,T); D i(i(D,T),A); B i(i(D,A),T); B T;B T;D
Examination of the table completes the proof. Lemma 3.2.1 establishes that U is a unification set for XJL and C. More importantly, this lemma enables us to prove the following theorem that in turn shows XJL too weak to be a single axiom for EC.
Possible Shortest Single Axioms for Equivalential Calculus
429
Theorem 3.2.1 The set, C, of formulas is closed under condensed detachment, and the only kernel, within alphabetic variancy, to be found in any element of Cis K = XJL. Proof: The proof is one of case analysis. We focus attention on the possible forms for the major premiss of the various cases of condensed detachment: Case 1. Assume the major premiss is K = XJL itself. (To conform to the definition of the various schemata under consideration, we assume throughout the proof that purity is present.) The condensed detachment of K with any A of EC yields f(A). Since, by definition, f(A) is in C whenever A is, closure is preserved in this case. Case 2. Let the major premiss be f{A) with A in C. It is trivial to verify that the condensed detachment of f(A) and any B is g(B, A). As above, if A and B are in C, then g(B, A) is also. Case 3. Let g(B, A) with B, A in C be the major premiss. For an arbitrary choice of D from the equivalential calculus as minor premiss, the condensed detachment question can be settled by considering the unification question for E(E(w, B), A) with D. If the unification is successful, the inference of interest is determined by the key replacement term, the term to be substituted for w. That E(E(w, B), A) is in U can be seen by letting 52 = w, SI = i{S2, B), and noting that i(Sl, A) is in U. When D is restricted to be an element of C, Lemma 3.2.1 forces the key replacement term in question, say D', to be in C. Since the CD of g(B, A) and D will be just D' itself, C is closed under this set of condensed detachments. Case 4- Let E(A, B) be the major premiss for some A and B in C. Since A and B are by definition assumed to have no variables in common, the condensed detachment with some D in C will either fail or yield B, and again closure is preserved. This completes the proof of closure for C. That the only kernel to be found in any element of C is K follows from the definition of the classes of elements comprising C, which completes the proof of the theorem.
3.3
XKE
In this section we prove that XKE = E(x, E{y, E(E(x, E(z, y)), z))) is too weak to be a single axiom for the EC. The proof proceeds as that for XJL. The schemata to be used in the definition of C are: 1. K = XKE = E(x, E(y, E(E(x, E(z, y)), z))) 2. f(A) = 3. g(B,A) =
E(y,E{E(A,E(z,y)),z)) E(E(B,E(z,A)),z)
Collected Works of Larry Wos
430
4. i(A,B) =
E(A,B)
where A and B are pure formulas and also f(A), g(A, B), and i(A, B) are pure. C is the minimal set generated by K and closed under the operations of / , g, i, which is just the analogue of the definition of the corresponding C for XJL. The schemata for U are: 1. w 2.
f(S)=E(y,E(E(S,E(z,y)),z))
3. g(S,A) = 4.
E(E(S,E(z,A)),z)
g(B,S)=E(E{B,E(z,S)),z)
5. i(S, B) = E{S, B) 6. i(i4,S) = £ ( A , S )
where A and S are pure formulas and where S, f(S), g(S, A), g(B, S), i(S, B), and i(A, S) are almost pure formulas with isolated variable w. Essentially, U is the set generated by w and closed under the operations represented by schemata 2 through 6 above, which is just the analogue of the definition of the correspond ing U for XJL. For this C and this U, both dependent on XKE, we can prove the analogue to Lemma 3.2.1. Lemma 3.3.1 // the pair S in U and BO in C are unifiable, then the key re placement term t for the isolated variable w in S occurring in the unification is itself an element of C. Proof: As in Lemma 3.2.1, this proof is by induction on the length of the most general common instance of 5 and BQ. Remark 3.1.1 again comes into play. XKE w f(T) g(T,A) g(A,T) i(T,A) i(A,T)
K K failure failure failure f(T); A T; f(A)
f(B) f(B) T; B failure failure g(B,T); A T; g(B,A)
g(B,D) g(B,D) failure T;B T; D T; i(B,i(A,D)) i(B,i(T,D)); A
i(B,D) i(B,D) g(T,B); D i(T,i(D,A)); B i(A,i(D,T)); B T;B T;D
The proof of Lemma 3.3.1 is thus obtained. Lemma 3.3.1 establishes that U is a unification set for XKE and C. More importantly, we can prove Theorem 3.3.1 which shows XKE too weak to be a single axiom for EC.
Possible Shortest Single Axioms for Equivalential
Calculus
431
T h e o r e m 3.3.1 C (which is dependent on XKE) is closed under condensed detachment, and the only kernel (within alphabetic variancy) to be found in any element of C is K = XKE. Proof: As in Theorem 3.2.1, we proceed by case analysis by focusing attention on the forms for the major premiss of the various cases of condensed detachment. The following summary suffices. The condensed detachment of K as major premiss with any A of EC is f(A). The CD of f(A) for any A in C with any B of EC is g(A, B). The CD of g(A, B) for A, B in C with some D in C reduces to the unification question of E(A, E(w, B)) with D, and Lemma 3.3.1 applies since this E(A, E(w, B)) is in U. And finally, the CD of i(A, B) with D for A and B and D in C either fails or is B. Examination of the definition of C shows that K = XKE is the only kernel therein, which completes the proof. One can immediately see that C contains CL(XKE) but does not contain E(x, x). So XKE is too weak to be a single axiom for the equivalential calculus.
3.4
XAK
The formula, XAK = E(x,E(E(E(E(y,z),x),z),y)), is too weak to be a single axiom. This result can be established by defining a C and a U, each dependent on XAK, and proceeding as with XJL and XKE. The schemata to be used in the definition of C, which is shown to be a containment set for XAK by examining the following tables, are: 1. K = XAK 2. f(A) = 3. g(A,B)
= E{x, E(E(E(E(y,
z), x), z), y))
E(E(E(E(y,z),A),z),y) = E(E(E(A,
z),
B),z)
4. i(A, B) = E(A, B) where A and B are pure formulas and also f{A), g(A, B), and i(A, B) are pure. C is the minimal set generated by K and closed under the operations of / , g, i, which is just the analogue of the definitions of the corresponding C for XJL and XKE. The schemata for U, which is shown to be a unification set, are: 1. w 2.
f(S)=E(E(E(E(y,z),S),z),y)
3. g(S, A) =E(E(E(S,z),
A), z)
4. g(B,S)
S), z)
= E(E(E(B,z),
Collected Works of Larry Wos
432 5. i(S, B) = E(S, B) 6. i(A,S)
=E{A,S)
where A and B are pure formulas and where S,f(S),g(S,A),g(B,S),i(S,B), and i(A, S) are almost pure formulas with isolated variable w. Essentially, U is the set generated by w and closed under the operations represented by schemata 2 through 6 above, which is just the analogue of the definitions of the corre sponding U for XJL and XKE. Unification table for U and C: XAK w f(T) g(T,A) g(A,T) i(T,A) i(A,T)
K K failure failure failure f(T); A T; f(A)
f(B) f(B) T; B T; i(B,A) i(B,T); A T; g(A,B) g(T,B); A
g(B,D) g(B,D) i(T,D); B T; B T; D T; i(i(B,A),D) i(i(B,T),D); A
i(B,D) i(B,D) g(D,T); B i(i(T,D),A); B i(i(A,D),T); B T; B T; D
Condensed detachment table for XAK: Major premiss "K f(A) g(A,B) i(A,B)
Condensed detachment with D in C reduces to f(D) unification of g(w,A) with D unification of i(i(A,w),B) with D B (if A and D unify; failure otherwise)
This concludes the discussion of XAK.
3.5
BXO
We now come (in this paper) to the last of the four candidates for the status of shortest single axiom for EC, namely, BXO = E(E(E(E(x, E(y, z)), z), y), z). (In a second paper we dispatch the remaining three candidates, XCB, XHK, and XHN. This task is accomplished by extending the method described herein.) BXO is rather more interesting than its three predecessors in that imme diately one infers E(x, E(y, E(x, y))) from the condensed detachment of BXO with itself. Thus a second kernel is quickly present. What may be surprising is the fact that no further kernels arise. Hence we can conclude that BXO is also too weak to be a single axiom for EC, although the case analysis is somewhat more complicated. The schemata to be used in the definition of C, which is shown to be a containment set for BXO, are: 1. K = BXO = E(E(E(E(x,
E(y, z)), z), y), x)
Possible Shortest Single Axioms for Equivalential Calculus 2. f(A) =
433
E{E(E(A,E(y,z)),z),y)
3. g(A,B) =
E(E{A,E(B,z)),z)
4. i(A,B) = E(A,B) 5. K' =
E(x,E(y,E(x,y)))
6. h(A) =
E(y,E(A,y))
7.
j(A)=E(E(z,E(E(A,z),y)),y)
8.
n(A,B)=E(z,E(E(A,z),B))
where A and B are pure formulas and also f(A), g(A, B), h(A), i(A, B),n(A, B), and j(A) are pure. C is the minimal set generated by K and K' and closed under the operations of f,g,h,i,j,n, which is just the analogue of the definitions of the corresponding C for XJL, XKE, and XAK. The schemata for U, which is shown to be a unification set, are: 1. w 2. f(S) = 3.
E{E(E(S,E(y,z)),z),y)
g(S,A)=E{E(S,E(A,z)),z)
4. g(B,S) =
E(E(B,E(S,z)),z)
5. i(S,B) = E{S,B) 6. i(A,S) = E(A,S) 7. h(S) = 8.
E(y,E(S,y)) j(S)=E(E(z,E(E(S,z),y)),y)
9. n(S, A) = E(z, E(E{S, z), A)) 10. n(B,S) =
E(z,E(E(B,z),S))
where A and B are pure formulas and where S,f(S),g(S,A),g(B,S),i(S,B), i{A, S), h(S),j(S),n(S, A), and n(B, S) are almost pure formulas with isolated variable w. Essentially, U is the set generated by w and closed under the oper ations represented by schemata 2 through 10 above, which is just the analogue of the definitions of the corresponding U for XJL, XKE, and XAK.
434
Collected Works of Larry Wos
Unification table for U K BXO w K T; K' f(T) g(T,A) T; j(A) g(A,T) J(T); A i(T,A) T; f(A) f(T); A i(A,T) failure h(T) failure J(T) n(T,A) failure n(A,T) failure BXO w f(T) g(T,A) g(A,T) i(T,A) i(A,T) h(T) J(T) n(T,A) n(A,T)
K' K' failure failure failure h(T); A T; h(A) failure failure h(T); A T; h(A)
and C: f(B) f(B) T; B T; i(B,h(A)) i(B,h(T)) ; A T; g(B,A) g(B,T); A failure failure failure failure h(B) h(B) failure failure failure i(B,T); A T; i(B,A) T; B failure i(T,A); B i(A,T); B
g(B,D) g(B,D) i(T,h(D)) ; B T; B T; D T; i(B,i(D,A)) i(B,i(D,T)); A failure i(T,B); D failure failure J(B) J(B) failure i(B,T); A T; i(B,A) T; n(B,A) n(B,T); A failure T; B failure failure
i(B,D) i(B,D) g(T,D); B i(T,i(A,D)); i(A,i(T,D)); T; B T;D i(T,B); D n(T,D); B i(i(T,B),A); i(i(A,B),T);
B B
D D
n(B,D) n(B,D) failure failure failure i(i(B,T),D); A T; i(i(B,A),D) T; i(B,D) failure T;B T; D
Condensed detachment table for BXO: Major premiss K f(A) g(A,B) i(A,B) K' h(A) J(A) n(A.B)
Condensed detachment with D in C reduces to unification of f(w) with D unification of g(A,w) with D unification of i(A,i(B,w)) with D B (if A and D unify; failure otherwise) h(D) i(A,D) unification of n(A,w) with D i(i(A,D),B)
This concludes the discussion of BXO except for one important point, namely, there are two kernels present in the theorems deducible from BXO instead of just one as in the other cases. They are BXO itself, which is usual for this study, and E(x,E(y, E(x,y))). It is the presence of this second kernel that makes this study of BXO rather more interesting.
Possible Shortest Single Axioms for Equivalential Calculus
4
435
Use of an automated theorem-proving program
At this point, we touch briefly on the methodology and also on aspects of the automated theorem-proving program employed in obtaining our results. The assistance of such a program was invaluable in completing this study. A more complete treatment of the method and use of the program can be found in [26]. Examination of the following material may suggest to the logician other uses for such a program. The language required by the program is a modified first-order predicate calculus. For the problem at hand, we use a one-place predicate P to represent 'is deducible', and '-' to represent 'not'. Thus the wff P(E(x,x)) states that E(x, x) is deducible. The conjunct
-P(E(x,y))-P(x)P(y) states the rule of condensed detachment: for any x and y, if E(x, y) and x are both deducible, then y is also deducible. Although the first inference rule of note was binary resolution [18], which combines substitution with a generalization of modus ponens and syllogism, a number of inference rules are now extant in the program. One of these, UR-resolution [9], actually performs condensed detachment when supplied with the encoding of condensed detachment given above. When seeking to prove that a particular formula is a single axiom, the program generates formulas by repeated application of condensed detachment. These formulas are continually compared to a list of known single axioms. The object is that of noting when a known single axiom has been derived. Because of the need to avoid examination of the myriad of formulas that would naturally arise, various powerful strategies must be used to guide the search. We now briefly describe certain of these. One strategy is to key on certain formulas. This strategy is especially useful in seeking shorter proofs of known theorems (see Appendix). Examination of the work of Kalman [3] and that of Peterson [15] reveals that certain formulas that occur while attempting to establish that a formula is a single axiom are exceedingly powerful. Examples are: 1. the given formula under study and the one immediately deducible from it by a single application of CD 2. formulas that have certain structural properties, such as the occurrence of a variable as the first argument of a formula 3. certain formulas that arise repeatedly in related proofs found in the liter ature. The program can be instructed to place these formulas on special lists [19], and/or it can be instructed to assign them high priority by means of 'weighting' [10]. Such an instruction enables the program to prefer such a formula as a
436
Collected Works of Larry Wos
premiss for CD. One can thus 'build in' one's intuition and/or take advantage of known structure when using the program. Certain other formulas, like E(E(x,y),t) for any t other than E(y,x), if felt to be unnecessary (because they did not occur in proofs of other single axioms) can be avoided (as in searching for a different or shorter proof, see Appendix). These formulas can be removed from consideration by assigning them low priority or by subsumption (the removal of formulas that are either less general than or identical to ones already present [18]). For example, to prevent the program from finding the same proof of XGK as given by Kalman [3], certain formulas of his proof were put on a special list that was not used for CD. If any of these formulas were generated by the program, they were discarded by subsumption. Thus certain steps in Kalman's proof were blocked. With such a mechanism one can easily explore a wide variety of alternate proofs. A major use of the program was that of gathering information on the struc ture of formulas derivable from the one being studied. The purpose of many runs was not to generate a proof, but rather to identify patterns in the formulas and to formulate conjectures about the space of derivable theorems. In one instance, we had the program generate a number of the derivable theorems from XAK, the formula then under study. To aid in the examination of the derived formulas, we employed a standard mathematical approach-that of using notation to simplify the form of the for mulas. When using the program, one has access to such simplifying notation by means of demodulation [24]. For example, when the equality E(x, E(E(E(E(y, z), x), z), y)) = K {XAK = K) is adjoined, the program automatically replaces every occurrence of XAK by the single constant K. Examination of the transformed formulas gen erated by the program led directly to the conjecture that all theorems derivable from XAK by CD contain a variant of XAK as a kernel. Use of demodulation coupled with a series of program runs alternated with analyses of the runs then led to the discovery of the various schemata used in completing the proof of the conjecture. Before the given study was completed, it was necessary to refute a number of conjectures about the structure of the derivable theorems which, although natural, were easily rejected only because of access to the program. These con jectures required counting various symbol occurrences and also classifying for mulas according to their structure—that briefly alluded to in 2 above. Although we could have used tedious hand counting or could have written yet another program, instead this study led to the formulation of new uses of demodulation. The new uses include scanning formulas as they are derived, counting symbol occurrences, and classifying formulas [23]. Finally, once the schemata had been discovered, the program was used to study the interaction of these schemata under CD. This led almost immediately to the case analysis given earlier and presented in tabular form. An alternate and, as it turned out, pointless case analysis had been pursued for some time.
Possible Shortest Single Axioms for Equivadential Calculus
437
It was found wanting and was thus terminated because of information derived directly from use of the program. Of equal importance, the results obtained with the program pointed the way to the correct nature of the case analysis and the corresponding induction argument. The techniques of this section, especially the use of demodulation and weight ing, have proven to be applicable to many areas of study.
5
Conclusions
We have proved here that each of the four formulas, XJL,XKE,XAK, and BXO, is too weak to be a shortest single axiom for the equivalential calculus. Each of the corresponding proofs exemplifies a method that studies the set of theorems deducible therein. We were able with this method to examine the infinite domain of deducible theorems in each of the four cases by finding a finite presentation. We in fact found, for each of the four, a finite set of schemata that proved that certain well-known theorems of the calculus are not present even as subexpressions of any of the theorems deducible from the formula. These studies were conducted by relying heavily on a general-purpose automated theoremproving program. Furthermore, the information was obtained without recourse to any special programming, which suggests that the system in its present state may prove useful to those interested in conducting various types of research but without the burden of programming. Among the kinds of questions that one might consider attacking with this automated theorem-proving program are the following. What is the full set of theorems deducible from a given formula or set of formulas? For a given set of formulas and a given domain, does that set axiomatize the domain? Are the elements of the set independent? Can an alternate and/or a shorter proof than that which is known be found for a specified theorem? Can a proof be found for a purported theorem? Can a counterexample be found for a given conjecture? Can a model, especially a small finite model, be generated for a set of axioms? Since we have succeeded in answering questions of the listed types with the system [20,21,22], we are encouraged to ask for additional open questions on which to work. We have included here at least some details relevant to the theorem-proving techniques for accomplishing the above tasks. We hope thereby to further sug gest uses of the system. For example, both the concept of kernel and the corre sponding conjectures for the four formulas studied here resulted directly from the use of the procedure of demodulation in its function of simplification. Finally, we wish to dispel the possible notion that the method employed in Section 3 relies on the weakness of the formulas therein. We shall in fact show in a succeeding paper that the method can be applied to both sides of the question, that is, it can also be used to prove a formula strong enough to be a single axiom when that is the case. In fact two new shortest single axioms for the equivalential
Collected Works of Larry Wos
438
calculus have been found. The method, together with the automated theoremproving program, has also been used to answer certain open questions in both the i?-calculus and //-calculus. Thus, at least in this context, the method has the property of correctly establishing either adequacy or inadequacy for the property of being a single axiom. The nature of the methodology presented in this paper leads one to conjec ture that in no way is it dependent specifically on the equivalential calculus. The successful examination of infinite domains gives rise to the thought that a number of the techniques may well apply to other areas of formal logic and perhaps to other areas of mathematics.
Appendix: A shorter proof The following proof, employing condensed detachment, establishes that XGK is a shortest single axiom for the equivalential calculus. The standard approach is used, namely, we show that PYO [13,15], one of the known single axioms for EC, is derivable by condensed detachment from XGK. The following proof is roughly half the length of that given by Kalman [3). Proof: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
1 2 3 1 5 2 5 2 1 2 5 1 10 14 13 16 17 1 19 1
1 1 3 4 1 6 6 8 9 7 11 12 1 11 1 1 17 18 15 20
E(x,E(E(y,E(z,x)),E(z,y))) E(E(x,E(y,E(z,E(E(u,E(v,z)),E(v,u))))),E(y,x)) E(E(E(E(x,E(y,z)),E(y,x)),E(z,u)),u) E(x,x) E(E(x,E(y,E(z,z))),E(y,x)) E(E(x,E(x,y)),y) E(x,E(y,E(y,E(x,E(z,E(E(u,E(v,z)),E(v,u))))))) E(x,E(y,E(y,E(x,E(z,z))))) E(x,E(y,E(y,x))) E(E(x,E(y,E(z,E(u ) E(u,z))))),E(y,x)) E(x,E(E(E(y,E(z,u)),E(z,y)),E(u,x))) E(E(E(x,E(y,z)),E(y,x)),z) E(E(x,E(y,E(E(E(z,E(u,v)),E(u,z)),v))),E(y,x)> E(E(E(x,E(x,y)),E(y,z)),z) E(x,E(y,E(y,E(E(z,E(u,x)),E(u,z))))) E(E(x.E(E(E(y,E(z,x)),E(z,y)),u)),u) E(x,E(y,E(x,y))) E(x,E(E(y,E(z,E(y,z))),x)) E(E(x,E(y,E(z,E(E(u,E(v,E(u,v))),z)))),E(y,x)) E(E(x,y),E(y,x)) E(E(x,E(y,E(E(z,u),E(u,z)))),E(y,x))
Possible Shortest Single Axioms for Equivalential Calculus 22 23 24
21 22 2
1 11 23
439
E(E(E(x,y),E(E(y,x),z)),z) E(x,E(E(y,z),E(z,E(y,x)))) E(E(E(x,E(y,z)),z),E(y,x))»PYO.
References 1 Belnap, N., "The two-property," Relevance Logic Newsletter 1, (1976), pp. 173-180. 2 Kalman, J., "Computer studies of T —> - W - I," Relevance Logic Newslet ter 1, (1976), pp. 181-188. 3 Kalman, J., "A shortest single axiom for the classical equivalential cal culus," Notre Dame Journal of Formal Logic, vol. 19, no. 1 (1978), pp. 141-144. 4 Kalman, J., "Substitution-and-detachment systems related to abolian groups." With an appendix by C. A. Meredith, pp. 22-31 In A Spectrum of Math ematics, Essays presented to H. G. Forder, Auckland University Press, Auckland, New Zealand, 1971. 5 Kalman, J., private communication. 6 Lukasiewicz, J., "Der Aquivalenzenkalkul," Collectanea Logica,xo\. 1 (1939), pp. 145-169. English translation in [8], pp. 88-115 and in [7], pp. 250-277. 7 Lukasiewicz, J., Jan Lukasiewicz: Selected Works, ed., L. Borkowski, NorthHolland Publishing Company, Amsterdam, 1970. 8 McCall, S., Polish Logic, 1920-1939, Clarendon Press, Oxford, (1967). 9 McCharen, J., R. Overbeek, and L. Wos, "Problems and experiments for and with automated theorem proving programs," IEEE Transactions on Computers, vol. C-25(1976), pp. 773-782. 10 McCharen, J., R. Overbeek, and L. Wos, "Complexity and related en hancements for automated theorem-proving programs," Computers and Mathematics with Applications, vol. 2(1976), pp. 1-16. 11 Meredith, C , "Single axioms for the systems (C,N), (C,0) and (A,N) of the two-valued propositional calculus," The Journal of Computing Sys tems, vol. 1, no. 3 (1953), pp. 155-164. 12 Meredith, C , and A. Prior, "Notes on the axiomatics of the propositional calculus," Notre Dame Journal of Formal Logic, vol. 4 (1963), pp. 171-187. 13 Peterson, J., "Shortest single axioms for the equivalential calculus," Notre Dame Journal of Formal Logic, vol. 17(1976), pp. 267-271.
440
Collected Works of Larry Wos
14 Peterson, J., "Single axioms for the classical equivalential calculus," Auck land University Department of Mathematics Report Series No. 78, 1976. 15 Peterson, J., "The possible shortest single axioms for EC-tautologies," Auckland University Department of Mathematics Report Series No. 105, 1977. 16 Peterson, J., "An automatic theorem prover for substitution and detach ment systems," Notre Dame Journal of Formal Logic, vol. 19 (1978), pp. 119-122. 17 Prior, A. N., Formal Logic, 2nd Ed., Clarendon Press, Oxford, 1962. 18 Robinson, J., 1 "A machine-oriented logic based on the resolution princi ple," Journal of the Association for Computing Machinery, vol. 12(1965), pp. 23-41. 19 Smith, B., "Reference manual for the environmental theorem prover," to be published as an Argonne National Laboratory technical report. 20 Winker, S. and L. Wos, "Automated generation of models and counter examples and its application to open questions in ternary Boolean alge bra," pp. 251-256'in Proceedings of the Eighth International Symposium on Multiple-Valued Logic, Rosemont, Illinois, 1978. 21 Winker, S., L. Wos, and E. Lusk, "Semigroups, antiautomorphisms, and involutions: a computer solution to an open problem, I," Mathematics of Computation, vol. 37 (1981), pp. 533-545. 22 Winker, S., "Generation and verification of finite models and counterexam ples using an automated theorem prover answering two open questions," Journal of the Association for Computing Machinery, vol. 29 (1982), pp. 273-284. 23 Winker, S., and L. Wos, "Procedure implementation through demodula tion and related tricks," 6th Conference on Automated Deduction, vol. 138, Lecture Notes in Computer Science (1982), pp. 109-131. 24 Wos, L., G. Robinson, D. Carson, and L. Shalla, "The concept of demod ulation in theorem proving," Journal of the Association for Computing Machinery, vol. 14(1967) pp. 698-709. 25 Wos, L., S. Winker, and E. Lusk, "An automated reasoning system," AFIPS Conference Proceedings, vol. 50 (1981), National Computer Con ference, Chicago, Illinois, 1981, AFIPS Press, pp. 697-702. 26 Wos, L., S. Winker, R. Veroff, B. Smith, and L. Henschen, "A new use of an automated reasoning assistant: open questions in equivalential calculus and the study of infinite domains," submitted for publication.
Possible Shortest Single Axioms for Equivalential
L. Wos, S. Winker, and B. Smith Mathematics and Computer Science Argonne National Laboratory Argonne, Illinois 60439 L. Henschen Computer Science Department Northwestern University Evanston, R. Veroff Department of Computer Science University of New Mexico Albuquerque, New Mexico 87131
Division
Illinois 60201
Calculus
441
AUTOMATED REASONING: REAL USES AND POTENTIAL USES L. Wos* Mathematics and Computer Science Division Argonne National Laboratory 9700 S. Cass Ave. Argonne,IL 60439
Abstract An automated reasoning program has provided invaluable assistance in answering certain previously open questions in mathematics and in formal logic. These questions would not have been answered, at least by those who obtained the results, were it not for the program's contribution. Others have used such a program t o design logic circuits, many of which proved superior (with respect to transistor count) t o the existing designs, and to validate the design of other circuits. These successes establish t h e value of an automated reasoning program for research and suggest the value for practical applications. We thus conclude t h a t the field of auto mated reasoning is on the verge of becoming one of the more significant branches of computer science. Further, we conclude that the field has al ready advanced from stage 1, t h a t of potential usefulness, to stage 2, t h a t of actual usefulness. To pass to stage 3, t h a t of wide acceptance and use, requires, among other things, easy access to an a u t o m a t e d reasoning program and an un derstanding of the various aspects of automated reasoning. In fact, an automated reasoning program is available t h a t is portable and can be run on relatively inexpensive machines. Moreover, a system exists for pro ducing a reasoning program tailored to given specifications. As for t h e requirement of understanding the aspects of automated reasoning, much research remains—research aided by access t o a reasoning program. A large obstacle has thus been removed, permitting many to experiment * This work was supported by the Applied Mathematical Sciences Research Program (KC004-02) of the Office of Energy Research of the U.S. Department of Energy under Contract W-31-109-Eng-38. Reprinted from Proceedings of the Eighth International Joint Conference on Artificial Intelligence, Vol. 2, ed. A. Bundy, IJCAI, Karlsruhe, West Germany, pp. 867-876 (August 1983).
Automated
Reasoning: Real Uses and Potential
Uses
443
with and find uses for a computer program that can be relied upon as a most valuable automated reasoning assistant.
1
INTRODUCTION
Recent successes [3,4,20,23,26,35,24,27,28,6,29] resulting from heavy use of an automated reasoning program demonstrate that the field has advanced from conjectured usefulness to actual usefulness. By reviewing certain of the successes, we provide evidence for individuals from other fields to judge the progress that has occurred. Rather than surveying the field of automated reasoning as a whole, we concentrate on the work of an informally organized team of which the author is a member. Nevertheless, to give the minutest of hints about what is being achieved by others in the field, we cannot resist citing (here and in Section 4) some of the outstanding work of such researchers as R. Boyer and J Moore, W. W. Bledsoe, and J. Siekmann. The first success realized by the aforementioned team was obtained with much assistance from the program AURA (for Automated Reasoning Assis tant) [21]-a program developed jointly at Argonne National Laboratory and Northern Illinois University (ANL/NIU). The success was that of answering certain previously open questions in mathematics [23,26,27], followed by an swering various open questions in formal logic [35,24]. The results were judged of significant interest that they were published respectively in a mathematics journal and in a logic journal. Such recognition by researchers having no di rect interest in automated reasoning represents a significant breakthrough for the field of automated reasoning, and hence for automated theorem proving where it all began more than 20 years ago. Perhaps this occurrence is the first of many such occurrences in which various open questions will be answered by researchers using an automated reasoning program. Must you master the various aspects of automated reasoning to answer open questions or, for that matter, to use such a program in an important way? After all, you might argue that, since those who answered the questions are active in automated reasoning, perhaps an automated reasoning program can be used only by those in the field. That this is not the case is proved by additional successes. Researchers having no previous exposure to automated reasoning used a reasoning program to design logic circuits [28], many of which are superior (with respect to transistor count) to those previously known, and to validate the design of other circuits [29] already in existence. These researchers have provided us with powerful evidence for the curious and for the skeptical. To the former, we can say with confidence that patience and pain may be rewarded with the discovery of a new application for automated reasoning. To the latter, we can say with equal confidence that the years of research, development, implementation, and experimentation have culminated in the availability of a portable computer program [8,9,11,12] that can be used as a most valuable automated reasoning
Collected Works of Larry Wos
444
assistant. Further, we can say that the field of automated reasoning as a whole has cause for genuine excitement and optimism, for we can now list various real problems that have been solved with an automated reasoning program. The main objective of this paper is to inform individuals with diverse and unrelated interests of what has occurred and, equally, of what is likely to occur in the field of automated reasoning. We shall discuss the past and the future, and thus establish the position of this field relative to various other fields of computer science and of artificial intelligence. Some who read this paper may even share our conclusion that the field of automated reasoning is on the verge of becoming one of the more significant branches of computer science. If not this, at least we show that the field has already advanced from stage 1, that of potential usefulness, to stage 2, that of actual usefulness. To pass to stage 3, that of wide acceptance and use, requires, among other things, easy access to an automated reasoning program and an understanding of the various aspects of automated reasoning. We shall discuss this transition as well. Since many who may read this paper are not directly concerned with auto mated reasoning itself, we provide background material. Some of you may be surprised to find that an automated reasoning program is now or soon will be useful as an aid for research or for applications. The kinds of assistance that such a program can provide include finding proofs, generating models or coun terexamples, suggesting and verifying conjectures, and testing hypotheses. The research and application areas in which a reasoning program can be used include mathematics, formal logic, program verification, logic circuit design, logic circuit validation, chemical synthesis, systems control, database inquiry, and robotics. How can one program—an automated reasoning program—provide so many kinds of assistance and in so many diverse areas? In fact, what is automated reasoning [32]?
2
BACKGROUND
Reasoning is the process of drawing conclusions from given facts or assumptions. The conclusions must follow inevitably and logically from the facts or assump tions. If the conclusions are false, then one of the facts or assumptions is false. (In the main, we are not concerned with fuzzy logic or with probabilistic reason ing. Thus, conclusions that are likely to be true, or quite possibly true, are not what we have in mind. We shall touch briefly on that topic in the concluding section.) The goal of automated reasoning is the design and implementation of a computer program that provides assistance for that phase of problem solving requiring reasoning. Reasoning is applied after the problem has been identified and formulated, after an approach has been chosen to attack the problem, and only if the chosen approach dictates the need for such reasoning. As we are using the term, some problems do not require reasoning to obtain a solution, for computation suffices.
Automated Reasoning: Real Uses and Potential Uses
445
An automated reasoning program can assist in so many different ways and for such diverse applications because of its generality. The most commonly used language—that of clauses [32]—for phrasing problems for an automated rea soning program is very general and powerful, although admittedly somewhat difficult to master. We were surprised to discover that we had underestimated its generality and power and that, with effort and inventiveness, the language of clauses could easily dispatch an even wider variety of tasks [28,35,24,36,25]. The various inference rules [18,19,17,13] employed to draw conclusions apply re gardless of the domain from which the problem is selected. The strategies used to control the application of inference rules enable a reasoning program to avoid much fruitless inquiry [31], and permit one to impose knowledge and intuition [16] on the program's search for a solution. The procedure of demodulation [33] allows a reasoning program to canonicalize and simplify information, resulting in an increased effectiveness. Finally, subsumption [18] is employed to remove duplicate information and, more importantly, to retain general facts and discard instances of those facts. An automated reasoning program relies on an arsenal of weapons for problem solving, which is why it can be used for various purposes and in various studies. Of course many problems remain to be solved in the three main areas, rep resentation, inference rule, and strategy. Nevertheless, as will soon become ev ident, difficult questions have yielded to an attack relying on heavy use of an automated reasoning program. We shall now turn to some of those questions. The program used to answer the questions is resolution-based, but the other procedures cited above all play a vital role. What we clearly demonstrate is the usefulness of a resolution-based automated reasoning program both in research and for applications.
3
ANSWERING OPEN QUESTIONS WITH AN AUTOMATED REASONING PROGRAM
Answering open questions, regardless of the means, is considered a laudable ac tivity in most circles. Answering any such question with an automated reasoning program might have been thought impossible. Nevertheless, such has occurred. Of course, this occurrence represents a breakthrough for automated reasoning, and hence for automated theorem proving. Roughly the first 18 years of au tomated theorem proving were spent in attempting to prove already proven theorems with an automated theorem-proving program, for knowing a proof permits the researcher to make judgments about the progress the reasoning program is making. Notwithstanding, one of the primary goals is that of using such a program to prove conjectured theorems—claims for which a proof is not yet known, or for which a proof may not even exist. To complement this activity, the need exists for disproving a conjectured theorem, hence finding a model or
446
Collected Works of Larry Wos
counterexample. The questions to be discussed address both aspects, that of finding a proof and that of generating a model or counterexample. For the first question, concerned with the dependence or independence of ax ioms in a ternary Boolean algebra [23], the capacity of AURA (for Automated Reasoning Assistant) to generate models was relied upon. For the second ques tion, that concerned with the possible existence of certain semigroups [26,27], the program's capacity to generate models as well as find proofs was employed. For the third question, that concerned with the adequacy or inadequacy of var ious formulas in equivalential calculus [35,24], AURA's capacity to find proofs came into play as well as its capacity to consider schemata under certain condi tions. Since the details and methodology for solving the three questions can be found elsewhere [23,26,35,24,27], we are content merely to present each question with its solution. Answering open questions—more precisely, the attempt to answer such ques tions—by using a reasoning program as an automated reasoning assistant often has a secondary benefit. The attempt may force one to formulate new methodol ogy. As you will see, new methodology was needed. The existing features of the program were sufficient for the task, for the new methodology did not require implementation of new features tuned to the particular problem under attack. The program AURA was indispensable for answering the open questions to be discussed. As evidence, we point out that the researchers who answered these questions have no expertise in any of the fields concerned. Their attempt to an swer the first question was motivated solely by the attempt to demonstrate the value of using an automated reasoning program as an assistant. Their consid eration of the second question was to show that somewhat difficult questions of interest to mathematicians could also be attacked with the assistance of a reasoning program. Finally, their interest in the third question was to show that the program was useful for a problem of a completely different type. How hard are the open questions that were answered? While the first of the three questions could in no way be termed difficult, the second clearly presents serious problems. In particular, the number of semigroups of order 7 exceeds 800,000, and no smaller semigroup exists of the type to be discussed. The third question presents an even more awesome search space to be examined or cir cumvented. The number of formulas containing 27 significant symbols is greater than 100,000,000,000, and the completion of the study relied on a formula with 103 significant symbols. The solutions were obtained without examining the myriad of uninteresting semigroups or irrelevant formulas. In view of the researchers' lack of expertise in any of the fields from which the diverse problems are taken, we have strong evidence that an automated rea soning program did play a vital role in answering the previously open questions.
Automated Reasoning: Real Uses and Potential Uses
3.1
447
Ternary Boolean Algebra
The first question concerns the possible independence of the elements of the usual set of five axioms given for a ternary Boolean algebra. Intuitively, the function f that occurs in each of the five axioms can be thought of as a 3-place product, and the function g as inverse. 1) 2) 3) 4) 5)
f(f(v,w,x),y,f(v,w,z)) = f(v,w,f(x,y,z)) f(y,x,x) = x f(x,y,g(y)) = x f(x,x,y) = x f(g(y),y,x) = x
The problem is to determine which, if any, of the five axioms is independent of the remaining four. If an axiom is dependent, then a proof can be found of that fact. If an axiom is independent, then a model exists that satisfies the other four but does not satisfy the independent axiom. Axioms 4 and 5 were known to be dependent even before proofs were obtained with two unrelated theorem-proving programs in 1969—that of Alan and Luckham [1] and that of G. Robinson and Wos (unpublished). Axioms 1. 2, and 3 are independent, and the required models were obtained with AURA. Before this study of the fascinating-to-few field of ternary Boolean algebra, the methodology for generating models and counterexamples with an automated reasoning program did not exist. We credit S. Winker [63] for this contribution. He also is chiefly responsible for answering the questions under discussion, but his methodology is the more significant achievement.
3.2
Finite Semigroups
The second question concerns the possible existence of a finite semigroup in which one type of mapping is present while another type is absent. Specifically, does there exist a finite semigroup admitting a nontrivial antiautomorphism but admitting no nontrivial involutions? A nontrivial antiautomorphism is a one-toone, onto mapping H such that H(xy) = H(y)H(x) and such that H is not the identity mapping. A nontrivial involution is a nontrivial antiautomorphism whose square is the identity mapping. Whichever way the question is settled, commutative semigroups are excluded from consideration, for they are not of interest by assumption. This question is more interesting and much harder than the previously dis cussed question for ternary Boolean algebra. I. Kaplansky, the famous algebraist at the University of Chicago, suggested this question because of its relation to a similar question in division algebras. If the presence of a nontrivial antiau tomorphism always implies the presence of a nontrivial involution, then the proof-finding capacity of an automated reasoning program comes into play. If a semigroup exists for which the implication does not hold, then the model-
Collected Works of Larry Wos
448
generation capacity is the key. The latter case presents certain problems since the number of nonisomorphic semigroups increases rapidly with the order—more than 800,000 exist of order 7—and thus the search for the desired semigroup is potentially lengthy. Thus, to answer the question, we must either find a proof or generate a model. The model generation capacity settled the issue by finding a semigroup of the desired type. The first found has order 83 [26]. With this information in hand, the natural question to ask is what is the smallest such semigroup. Just as the previous study led to the methodology for generating models and counterexamples, this study led to new methodology. To find the minimal semigroup with the given properties [27] required AURA to cope with problems of isomorphism. A way was found to have AURA ap ply various other techniques such as the well-known without loss of generality argument that mathematicians use. The result was a proof that the smallest semigroup of interest has order 7 [27] and that four such nonisomorphic ones exist. This study was conducted jointly with Winker. The discussion of this question is not complete without a brief reference to the true story [34] behind its solution-the story of what occurred before finding the semigroup of order 83. Before discovering that semigroup, we had a prior solution. That solution to the open problem was thought to be correct for some 18 months, before it was discovered that the wrong problem had been solved. What was missing was the correct definition of an involution. In the first attempt at solving the problem, an involution was not assumed to be an antiautomorphism, but simply a one-to-one, onto mapping J whose square is the identity and such that J(xy) = J(x)J(y). With that definition of J, there exist semigroups of order 4 that suffice, but the corresponding problem is not of much interest. When the correct problem was identified, three hours of the researchers' time sufficed to extend the methodology to enable AURA to solve the problem in a sequence of runs requiring two minutes of time on an IBM 3033. The method used to solve the uninteresting problem proved pertinent to the interesting one, so the effort was not wasted after all. We thus have an illustration of how a class of problems can be treated by a single methodology developed for one of them—even if the wrong one. This story is told when we are asked if one must start anew when submitting each distinct problem to an automated reasoning program.
3.3
Equivalential Calculus
The third question concerns the adequacy or inadequacy of various formulas to serve as shortest single axioms for the equivalential calculus. Intuitively, the equivalential calculus is concerned with the abstraction of "equivalent". The calculus consists of the formulas that can be composed from variables x, y, z, ..., and the two-place function E. In addition, the inference rule of condensed de tachment [35] is employed to yield formulas from pairs of formulas. The calculus can be axiomatized with a single formula, a formula from which all theorems
Automated Reasoning: Real Uses and Potential Uses
449
can be deduced by repeated application of condensed detachment. The shortest single axiom must contain five occurrences of the function E. Before this area of formal logic was studied with the assistance of AURA, 11 shortest single axioms were known. When the study commenced, seven of the 630 formulas in which the function E occurs exactly five times remained unclassified-the adequacy or inadequacy for being a single axiom was unknown. The model-generation method was deemed inadequate for the study. What was desired was a characterization of the entire set of theorems deducible from each of the seven formulas under investigation. While answering the open ques tion for ternary Boolean algebra led to the methodology for generating models, this study led to a methodology to achieve the goal of obtaining a complete characterization [35,24] of the set of deducible theorems. The approach centers on the use of schemata, forms that describe collections of formulas sharing cer tain global syntactic properties. The needed schemata were found by relying heavily on an automated reasoning program. The use of such a program, how ever, was not limited to schemata discovery. Other uses [36] include suggesting conjectures, finding notation, conducting case analyses, proving and refuting conjectures, and of course finding proofs. The completion of this study required many computer runs, much examination of the output, and approximately 30 minutes of CPU time on an IBM 3033. With invaluable assistance from AURA, five of the seven previously unclas sified formulas were proved too weak to be a shortest single axiom [35,24]. What was surprising was that two of the seven were proved to be new shortest sin gle axioms [24], contrary to the conjecture that no more would be found. The two new shortest single axioms are denoted by XHK and XHN. The study of equivalential calculus, especially the proof that two additional shortest single axioms exist, proved to be the most intricate and complex use of an automated reasoning program known to us. The proof that XHK is a single axiom includes 84 applications of condensed detachment and involves formulas as long as 71 symbols, not counting grouping symbols and commas. The proof that XHN is a single axiom consists of 162 steps, one of which involves a formula of length 103. The number of formulas of length 27 exceeds 100,000,000,000.
4
OTHER USERS, OTHER PROGRAMS
The primary goal of automated reasoning, and hence of automated theorem proving, is the design and implementation of a computer program. The primary use of the program is to assist in the reasoning phase of problem solving. If that program can be used only by an expert in automated reasoning, then we have failed. More precisely, if we never provide an automated reasoning program that can easily be used by researchers from other fields and by individuals interested in applications outside of our field, then we have not fulfilled our charter. Some progress in this direction has occurred.
450
Collected Works of Larry Wos
Both students and faculty from the Illinois Institute of Technology have used and are using an automated reasoning program for their research. Two of the students, W. Wojciechowski and W. Kabat, have received a Ph.D. for work on logic circuit design. Each relied heavily on an automated reasoning program to design circuits with given characteristics. Many of the circuits obtained by Wojciechowski [28] were pronounced by others in the field of design as superior (with respect to transistor count) to those previously known. The technology employed is that of T-gates, the analogue in 4-valued logic of the multiplexor in binary logic, as the basic building block or component. The methodology was then extended by Kabat [6] to the use of arbitrary building blocks, for either multi-valued or binary logic design. In addition, A. Wojcik, their thesis advisor, is using a reasoning program for the validation of existing designs [29]. For example, he has obtained a 297-step proof validating the design of a 16-bit adder. The proof was obtained in 20 seconds of CPU time on an IBM 3033. The research in these areas relies on the use of AURA-Automated Reasoning Assistant. Also at IIT, M. Evens and her student T. Wang are studying the possible use of an automated reasoning program for chemical synthesis [5]. The problem focuses on a large database of simple compounds and a set of reaction rules that combine them to produce complex compounds. At the University of Illinois at Urbana, L. Hanes is using an automated reasoning program to prove the equivalence of symbolic representations purported to represent the same logic circuit. The two studies are being conducted with the assistance of a reasoning program ITP [12] produced from the LMA (Logic Machine Architecture) system. The LMA system is a set of procedures or subroutines for tailoring an automated reasoning program to given specifications. The tailoring is not an automated process. The LMA system [8,9] was designed and implemented by E. Lusk, W. McCune, and R. Overbeek. Occasionally, various diverse areas of research meet in a fortuitous fashion. The study of the equivalential calculus and the development of LMA provide an example of such an occurrence. In the fall of 1982, J. Kalman from the University of Auckland came to Argonne to study and use our techniques in automated reasoning. He is interested in equivalential calculus and is the person who pointed us to the previously discussed open questions in that field. During his visit, we asked him about the possibility of axiomatizing the calculus with three obvious axioms that might be chosen in view of the fact that the calculus studies the abstraction of the notion of equivalent. Specifically, do the following three formulas axiomatize the calculus? 1) E(x,x) 2) E(E(x,y),E(y,x)) 3) E(E(x,y),E(E(y,z),E(x,z))) These three formulas can be thought of as reflexivity, symmetry, and transitivity. Kalman answered our question in the affirmative [7] by using a program pro-
Automated Reasoning: Real Uses and Potential Uses
451
duced from LMA. We thus have another example of actual use of an automated reasoning program. One other group of users must be mentioned. A workshop was given at Argonne National Laboratory in May of 1982. The workshop was a tutorial in automated reasoning, demonstrating existing and possible uses of both AURA and programs produced from LMA. Most of the attendees were from various industries, including IBM, DEC, Motorola, INTEL, AMOCO, Silicon Systems, APTEC, NCR, and Lockheed. They came expressing some doubt about the po tential usefulness of automated reasoning, but hoping to gain an understanding of its basic aspects. They left expressing much enthusiasm and some optimism, and with an understanding of the basics. Perhaps more important, some of them are now experimenting with an automated reasoning program, produced from LMA, for various applications. Although no industry has yet committed itself to a solid attempt to apply automated reasoning, the change in attitude from but a few years ago is marked. We now come, as promised in the introduction, to the briefest of accounts of the work of others in the field of automated reasoning. The successes of other researchers provides still more evidence of the progress that has occurred. These successes resulted directly from the use of an automated reasoning program. Ob viously other powerful automated reasoning or automated theorem-proving pro grams exist, besides those designed and implemented by the ANL/NIU group. Independent development of this kind is essential for the field. The availabil ity of other programs provides valuable opportunities to compare performance, features, implementation details, and special-purpose versus general-purpose approachs to solving a problem. Perhaps the most outstanding of these programs, measured by the problems solved with it, is that of Boyer and Moore. Their system is a special-purpose program aimed at program verification. Among their recent successes with their program they proved the recursive unsolvability of the halting problem [3] and also proved the invertibility of the RSA encryption algorithm [4] used for mes sage transmission. The encryption algorithm is not a classroom exercise, nor a problem purely of theoretical interest, for the algorithm is in actual use. Boyer and Moore are to be congratulated for their achievements. Besides being a beau tiful piece of work, the success demonstrates the potential value of using such a program. As we do, they also use their program in the assistant mode, occa sionally suggesting to it lemmas that might be of value when and if the program succeeds in proving them. Two other efforts must be mentioned, that of Bledsoe and that of Siekmann. Bledsoe's work [2] is oriented toward intermediate analysis, and he has proved with his system some fairly difficult and fundamental theorems in that domain. The proofs were obtained with an automated theorem-proving program employ ing a number of his techniques. Especially from the viewpoint of automated rea soning, the area of intermediate analysis presents significant challenges. Rather different from Bledsoe's approach, Siekmann has developed a large integrated
452
Collected Works of Larry Wos
reasoning program. As one example of the type of problem that can be solved with his program, Siekmann has recently announced [20] that a proof of an interesting theorem from relevance logic has been obtained with his system.
5
FROM STAGE 1 TO STAGE 2: WHAT CAUSED THE PROGRESS?
Fields like automated reasoning usually begin in stage 1, in which conjectures are made about potential value, possible uses, and expected power. If all goes well, such a field advances to stage 2, in which some of the potential has been realized, various uses exist, and successes have been achieved that might not have occurred were it not for the power that has been provided. Of course the goal is to reach stage 3, in which the field is widely accepted and in which its products are widely used. Automated reasoning is at stage 2—which is what Sections 3 and 4 are about. Of course, stage 2 is not a point on the entire spectrum, but rather an interval in which we find ourselves with many problems still to solve. The question here is, How did automated reasoning advance from stage 1 to stage 2? One of the prime factors was much experimentation with an existing au tomated reasoning or automated theorem-proving program. Various concepts that are considered central to the field came directly from such experimen tation, concepts such as the unit preference strategy [30], the set of support strategy [31], demodulation [33], and paramodulation [17]. Various uses were added because of experimentation, uses such as question-answering, program verification, database inquiry, and the design and validation of logic circuits. For experimentation, the ideal case is that in which the program presents to the researcher an array of choices for representation, inference rule, strategy, and the use of auxiliary processes. Since the only available form offered by AURA for representing information was that of clauses, we were not in the ideal case. In the other areas, however, we did have access to a wide array of choices. A large and integrated system such as AURA provides unusual opportunities for learning and, in fact, no substitute can be found. A second important factor is the work of Overbeek [15,10,16,13,14], especially his design and implementation of various programs. Of these programs, AURA is by far the most powerful and versatile automated reasoning program, and is the one that was used to answer the open questions. AURA extends and incorporates the design and implementation found in Overbeek's earlier work, and includes vital features due to Smith, Winker, Lusk, and Wos. Without AURA, the open questions presented here would not even have been considered, at least by the researchers who solved them. The questions even might have resisted solution by any means were it not for the existence of this program with its many features. The combination of the particular implementation, well-chosen inference rules,
Automated Reasoning: Real Uses and Potential
Uses
453
and carefully selected strategies was mainly responsible for the successes. How does the particular implementation have such an important effect? A poor implementation can obscure the value of a new idea. For example, if a new and powerful strategy is tested with a poor implementation, any attempt at obtaining a proof might take essentially forever. On the other hand, a poor implementation can equally mislead the researcher into evaluating a bad idea as good. If, for example, a new inference rule is tested with a program that requires a great deal of time to obtain a proof for even the simplest of problems, a sharp reduction of that time might be meaningless. The researcher could, however, mistakenly conclude that the new inference rule was quite promising. A good implementation, when presented with the new rule, might have produced no important change in the experiments, and thus the erroneous conclusion would have been avoided. The choice of implementation, therefore, can have serious consequences. A third important factor that advanced automated reasoning from stage 1 to stage 2 is the work of Winker, who, by the way, does not totally agree with the views expressed in this paper. His methodology for generating models and counterexamples provides the needed complement to finding proofs. But perhaps •more important is his establishment of the usefulness of clause representation. His mastery of problem representation and the techniques resulting from it have led to the successful submission of diverse and unrelated problems to an automated reasoning program. Before turning to the final factor that caused the advance to stage 2, we note that many researchers have made contributions both to the theory and to the application of automated reasoning. We are content here to concentrate on the work that has led to our contribution, and not focus on the many and important aspects of others' work. The final factor promoting the advance of automated reasoning centers on answering open questions with the assistance of an automated reasoning pro gram. This success has caught the interest of members of other fields, such as mathematics and formal logic. We have clearly demonstrated that an automated reasoning program can provide invaluable assistance in research. We must rec ognize that, for example, proving a known theorem with a reasoning program often does not impress those outside of the field. For one thing, real difficulty exists in ascertaining how unbiased the experiment is. An analysis of how much the "dice were loaded" is most complex. In contrast, answering an open question by relying on an automated reasoning program produces many fewer questions about "loading the dice". One may certainly wonder how much credit should be given to the ingenuity of the researchers and to their intimate knowledge of the program that was used. However, when one takes into account the fact that the researchers knew and still know very little about the fields from which the open questions were selected, the case for the program's contribution is strengthened markedly. An even stronger case can be made when one takes into account the successes of other researchers, especially when those researchers have virtually
454
Collected Works of Larry Wos
no knowledge of the underlying reasoning program. When the success with open questions was followed by the success of members from other fields using an au tomated reasoning program for other applications, the field had arrived at stage 2.
6
FROM STAGE 2 TO STAGE 3: HOW DO WE GET THERE?
Much experimentation with existing automated reasoning programs will be re quired to get from stage 2 to stage 3. Certainly more theory is needed in the three major areas of representation, inference rule, and strategy. However, to the disappointment of some, too much emphasis is placed on theory without evidence to support the resulting claims. When a particular approach has been explored for many years and still cannot be employed even to solve problems whose solution is known, that approach must be viewed with great skepticism. Perhaps some of the effort devoted to the theoretical questions might better be placed in bridging the gap between the researchers in automated reasoning and those who might use an automated reasoning program. In particular, we must find a way to inform various individuals of how a reasoning program works and how to "think" the way it does, and make clear that, with patience and pain, communication with such a program is possible and available on various levels. For example, one argument for using such a program is the fact that it can, upon request, present the precise derivation information permitting the user to ascertain what may be missing from the input, or why the program is struggling. If the user doubts the results obtained with an automated reasoning program, the user can examine each step of the reasoning process. Acquainting those who might use an automated reasoning program that such advantages exist and that various successes have occurred will help. In addition, we must seriously consider certain current practices. Among the most dangerous is that of writing about advances in automated reasoning but with no evidence. Of course a paper can be of substantial value even though no experimental data can be quoted. However, actual problems that are solved are, in the final analysis, the only real sign of progress. The prob lems need not be open questions. Proving a well-known theorem, even if trivial, counts. Verifying a small computer program counts. Solving a puzzle counts. What must be viewed with grave question is the paper that has the appearance of a mathematics paper, but whose only examples are either propositional or purely syntactic. With few exceptions, propositional examples or purely syntactic examples taken from first-order predicate calculus are valuable only for expository pur poses. An illustration, for example, that consists of a set of clauses containing variables, functions, and predicates, but for which no meaningful interpretation
Automated Reasoning: Real Uses and Potential Uses
455
can be given, must be viewed with skepticism when it is offered as evidence of the value of a new concept. The usefulness of an inference rule or strategy cannot be demonstrated by such an illustration. In fact, the conjectured value is highly suspect, for such a conjecture should at least appeal to intuition. Such an appeal in most cases should in turn be based on some real example, some problem selected from the existing literature, or some problem that has mean ing to individuals outside of automated reasoning. When the value of a new idea can be indicated only by a syntactic example, or when the weakness of an idea can be illustrated only by a syntactic example, the corresponding claim is suspect. We therefore recommend very strongly that papers include examples that correspond to real problems. Since the literature suffers from a paucity of such problems, you can turn to puzzles for that domain provides a wealth of examples. Some puzzles correspond to problems that might be faced by some industry, at least in miniature. As one example, consider the problem in which you are asked to design a circuit and are required to use only NAND gates. The circuit has two inputs, x and y, and two outputs, y and x. The input x is above the input y, but the reverse is true for the outputs. Finally, you are required to build this circuit with no crossing wires. This puzzle has been solved with the program ITP produced from LMA. For a more complex example, you are asked to build a circuit with inputs a, b, and c, and with outputs not a, not b, and not c. You can think of the inputs as each taking on values 0 or 1. You are permitted to use as many OR gates and as many AND gates as you wish, but no more than two NOT gates. (Incidentally, this problem was brought to our attention by E. Snow of INTEL, an attendee at the 1982 Workshop on Automated Reasoning, which illustrates the value of such tutorial/dialogues.) The problem can be phrased equivalently as a problem of moving the contents of three locations to three other locations in memory, using "move", "or", "and", and "complementation" instructions. You are of course limited to the use of no more than two "complementation" instructions. This puzzle has also been solved with the program ITP, but substantial time was required as compared with the previous circuit design puzzle. By including actual problems as part of the illustrations of the potential value of a new inference rule or a new strategy, the writer of the paper presents information by which the new contribution can perhaps be judged. In addition, if the problem has not been presented before, the writer has provided a needed addition to the pool of problems. The preferable case, of course, is that where actual results from a computer run can be quoted. When those results reflect that another previously open question was solved with the assistance of an automated reasoning program, they take on added significance. Perhaps the most significant of all is the case in which an automated reasoning program is successfully used in some industrial or commercial application. When the suggestion was made that experiments using an actual automated reasoning program were needed, a typical response was that no program was
456
Collected Works of Larry Wos
easily available and writing one required too much time. That void has now been filled. In fact, a portable automated reasoning program ITP can now be obtained. Moreover, a system LMA (for Logic Machine Architecture) consisting of a set of procedures or subroutines for producing a reasoning program satis fying given specifications is also available. Both ITP [12] and LMA [11] are due to Lusk, McCune, and Overbeek. The system LMA has been ported to a num ber of machines, including rather inexpensive ones. It offers access to a large integrated reasoning program, thus permitting the user the simultaneous use of various inference rules and strategies that in turn permit comparisons to be made. Equally, the structure permits the removal of unwanted procedures. The program is written in PASCAL, and therefore the AI community might won der how accessible it is for integration with existing software. LMA is designed to interface to LISP and to programs like MACSYMA, and is even prepared for multiprocessing. The LMA system is structured to permit a researcher in automated reasoning to adopt a language other than clause input, to add to the array of inference rules, and to make other similar modifications. Since a number of the central concepts of the field have resulted from experimentation, we recommend that, if no alternative exists, you obtain a copy of LMA and experiment freely. The lack of a suitable reasoning program on which to test ideas is no longer an obstacle. The foregoing remarks do not mean that we endorse an ad hoc approach. Rigor and care in both the development of the theoretical foundations and the design and implementation are mandatory. In almost all instances, for example, soundness is required. Experimentation that includes a careful comparison with the work of others is most laudable. What the foregoing does say is that those who considered automated reasoning, and hence automated theorem proving, at best an ivory tower discipline were and are in error. Practical applications may occur sooner than anyone might have guessed, if the progress of the last few years is an indication. As mentioned earlier, we must convey to various potential users what au tomated reasoning is about. The fact that a reasoning program can cope with problems that require moving cannibals, playing dominos on a modified checker board, or weighing billiard balls comes as a surprise to many. The natural reac tion to such a claim is skepticism, even sometimes by members of the field itself. What is necessary is the usual: namely, to educate people about what can be done. Were an interface available permitting a user to communicate to an au tomated reasoning program in the user's own language, the gap and resistance would narrow rapidly. The design and implementation of such a translator is truly a worthy project. Although this useful interface is still missing, the present state of automated reasoning as a whole is most encouraging.
Automated
7
Reasoning: Real Uses and Potential
Uses
457
THE FUTURE
The future is far more promising than many might imagine. In fact, exciting opportunities now exist, both for research and for applications. Many basic re search questions in automated reasoning remain unanswered, questions that are challenging in themselves but also have substantial relevance to solving problems in other areas. For example, can the power of the set of support strategy that is most evident at level 1 be recursively extended to higher levels in the clause space? What strategies can be formulated to tightly control paramodulation or comparable inference rules for building in equality? A number of applications appear quite tractable. They include the design and validation of circuits and chips, the chemical synthesis of complex compounds, robotics, program verifi cation, and database inquiry. Both those already active in automated reasoning and those who may wish to use an automated reasoning program should experience great excitement. The probability that such programs will be commonplace in but five years has increased from essentially zero to one half. Among the factors that have caused this change are the progress that has occurred in just the last four years and the trend in the cost and in the type of computer that is available. Within two years, a computer with one megabyte of memory may be available for less than 2,000 dollars. The user can then port an LMA-based system, or an alternative, to such an inexpensive machine. Experimentation, formulation, development, and implementation will be accessible to many and diverse individuals. Com parisons of representations, of inference rules, and of strategies will be possible, and on real and varied problems. The evidence gathered in the past few years, demonstrating the value and usefulness of a resolution-based reasoning program with its attendant features, may cause many computer scientists and others to share the fascination of automated reasoning. But even more is to come;.
8
A FORECAST OF WHAT IS TO COME
At home, you have a set of discs; and at the office, you have a copy of each. On your home computer resides a reasoning program; on the office computer, a duplicate resides. By selecting the appropriate disc, you can have a dialogue with the reasoning program on a variety of topics. T h e topics include scheduling the day's activities so that conflicts are avoided, analyzing the consequences of a proposed decision, and "prioritizing tasks to be accomplished. You carry a few of these discs with you so that they can be used with your reasoning program on your pocket computer, should some important problem arise. Your personal reasoning program can learn from previous experiments. When asked to solve a problem, it can determine that the given strategy must be re placed by another. Given the problem, your reasoning program can choose a representation that has the best chance of permitting it to solve the problem.
Collected Works of Larry Wos
458
It can decide that more unit clauses are needed, or that more equality clauses would help, and then set about to find them. Finally, your reasoning program can examine its output, presenting to you only the more interesting results. In fact, it can find significant theorems, make conjectures, and suggest concepts that might be worth studying. You have become aware of four new areas of research with commercial pos sibilities. Their respective subjects of investigation are: systems of axioms or assumptions that permit a reasoning program to attack problems in new areas; inference rules that are tailored to specific problem areas; strategies that enable a reasoning program to be very intelligent in its attack on a given problem; and, finally, reasoning programs themselves. Should you spend any of your research time on any of these areas? Your personal automated reasoning assistant may have the answer. Such a scenario may sound like science fiction, but it may well be scientific fact in the near future.
9
CONCLUSIONS
The field of automated reasoning, and hence automated theorem proving, has progressed rapidly in the previous four years. Open questions in mathematics and in formal logic have been answered with the assistance of an automated reasoning program. Logic circuits have been designed and validated, and by researchers with little or no background in automated reasoning. Complex al gorithms have been verified using a theorem-proving program. Representatives from various industries are expressing both interest and curiosity about the potential of the field. One advantage of using a reasoning program is the infor mation contained in its output. All derivations can be given explicitly and com pletely, and can be checked algorithmically. Examination of results from early runs often shows what is missing from the input or shows why the program is struggling. The results can be trusted, for they are obtained with inference rules that are sound, that yield conclusions that follow inevitably and logically from the assumptions. Even when probabilistic reasoning is desired, as in certain ex pert systems, a means exists for having an automated reasoning program obtain the results. Admittedly, using an automated reasoning program is often difficult, but the rigor and unambiguity often more than compensate for the required effort. An interface permitting the user to communicate in the user's chosen language would be of obvious and great value for it would sharply reduce the difficulty of using a reasoning program. What we have shown is that, even without this interface, a resolution-based, automated reasoning program such as AURA pro vides invaluable assistance in problem solving. The power of such a program is derived not only from its array of inference rules, but also from procedures such as demodulation, subsumption, and the strategies that it employs. What is needed now is much experimentation. Experimentation has led to
Automated Reasoning: Real Uses and Potential Uses
459
the formulation of a number of important concepts of the field. Where previously such experimentation was made difficult by the lack of a suitable program, now such a program is available. Moreover, a system LMA is available and portable, and provides the researcher with the opportunity of tailoring an automated reasoning program to given specifications. Only by using a reasoning program to attack problems both in research and in application can we gain the needed information to solve certain basic problems of the field. Such usage has resulted in the advance of automated reasoning from conjectured usefulness to actual usefulness, and will result in advancing the field to the stage of wide acceptance and use. Much is still unknown about representation. More powerful inference rules are needed. More effective strategies must be found, for without strategy even the simplest of problems becomes hard. Nevertheless, with all that remains to be accomplished, automated reasoning has made important advances, resulting in more powerful and versatile reasoning programs. Perhaps soon such a program will be used by many in both research and for applications, and will function as an automated reasoning assistant.
REFERENCES 1 Allen, J. and Luckham, D., "An interactive theorem-proving program," Machine Intelligence, Vol. 5(1970), Meltzer and Michie (eds), American Elsevier, New York, 321-336. 2 Bledsoe, W. W. "Some Automatic Proofs in Analysis", December 1982, University of Texas, Math Dept Memo ATP-71. 3 Boyer, R. and Moore, J, "A Mechanical Proof of the Unsolvability of the Halting Problem," accepted for publication by J. ACM. 4 Boyer, R. and Moore, J, "Proof Checking the RSA Public Key Encryp tion Algorithm" technical report 33, The Institute for Computing Science, University of Texas at Austin 78712. 5 Evens, M. Private Communication (1982). 6 Kabat, W. and Wojcik, A., "Automated synthesis of combinational logic using theorem proving techniques," Proceedings of the Twelfth Interna tional Symposium on Multiple-Valued Logic, Paris, France, May 1982, IEEE, 178-199. 7 Kalman, J., Private Communication (1981). 8 Lusk, E., McCune, W. and Overbeek, R., "Logic machine architecture: ker nel functions," 6th Conference on Automated Deduction, Vol. 138, Lecture
460
Collected Works of Larry Wos Notes in Computer Science, ed. D. W. Loveland, Springer-Verlag, Berlin, Heidelberg, New York, 1982, 70-84. 9 Lusk, E., McCune, W. and Overbeek, R., "Logic machine architecture: inference mechanisms," 6th Conference on Automated Deduction, Vol. 138, Lecture Notes in Computer Science, ed. D. W. Loveland, SpringerVerlag, Berlin, Heidelberg, New York, 1982, 85-108.
10 Lusk, E. and Overbeek, R., "Experiments with resolution- based theoremproving algorithms," Computers and Mathematics with Applications 8 (1982), 141-152. 11 Lusk, E. and Overbeek, R., "Logic Machine Architecture Inference Mech anisms - Layer 2 User Reference Manual", Argonne National Laboratory Technical Report ANL-82-84. 12 Lusk, E. and Overbeek, R., "An LMA-Based Theorem Prover", Argonne National Laboratory Technical Report ANL-82-75. 13 McCharen, J., Overbeek, R. and Wos, L., "Problems and experiments for and with automated theorem proving programs," IEEE Transactions on Computers, Vol. C-25(1976), 773-782. 14 Overbeek, R., "A New Class of Automated Theorem-proving Algorithms", J. ACM, Vol. 21(1974), 191-200. 15 Overbeek, R., "An implementation of hyper-resolution," Computers and Mathematics tuith Applications, Vol. 1(1975), 201-214. 16 Overbeek, R., McCharen, J. and Wos, L., "Complexity and related en hancements for automated theorem-proving programs," Computers and Mathematics with Applications, Vol. 2(1976), 1-16. 17 Robinson, G. and Wos, L., "Paramodulation and theorem- proving in firstorder theories with equality," Machine Intelligence, Vol. 4(1969), Meltzer and Michie (eds), American Elsevier, New York, 135-150. 18 Robinson, J., "A machine-oriented logic based on the resolution principle," J. ACM, Vol. 12(1965), 23-41. 19 Robinson, J., "Automatic deduction with hyper-resolution," International Journal of Computer Mathematics, Vol. 1(1965), 227-234. 20 Siekmann, J., Private Communication (1982). 21 Smith, B., "Reference manual for the environmental theorem prover, An Incarnation of AURA," to be published as an Argonne National Labora tory technical report.
Automated Reasoning: fteaJ Uses and Potential Uses
461
22 Winker, S., "Generation and verification of finite models and counterexam ples using an automated theorem prover answering two open questions," J. ACM, Vol. 29 (1982), 273-284. 23 Winker, S. and Wos, L., "Automated generation of models and counterex amples and its application to open questions in ternary Boolean algebra," Proc. of the Eighth International Symposium on Multiple-valued Logic, Rosemont, Illinois, 1978, IEEE and ACM Publ., 251-256. 24 Winker, S. and Wos, L., "New shortest single axioms for the equivalential calculus," in preparation. 25 Winker, S. and Wos, L., "Procedure implementation through demodula tion and related tricks," 6th Conference on Automated Deduction, Vol. 138, Lecture Notes in Computer Science, ed. D. W. Loveland, SpringerVerlag, Berlin, Heidelberg, New York, 1982, 109-131. 26 Winker, S., Wos, L. and Lusk, E., "Semigroups, antiautomorphisms, and involutions: a computer solution to an open problem, I," Mathematics of Computation, Vol. 37 (1981), 533-545. 27 Winker, S., Wos, L. and Lusk, E., "Semigroups, antiautomorphisms, and involutions: a computer solution to an open problem of Minimality, II," in preparation. 28 Wojciechowski, W. and Wojcik, A., "Automated design of multiple-valued logic circuits by automatic theorem proving techniques," to appear in IEEE Transactions on Computers. 29 Wojcik, A., "Formal design verification of digital systems, Proceedings of the 20th Design Automation Conference, June 1983. 30 Wos, L., Carson, D. and Robinson, G., "The unit preference strategy in theorem proving," Proc. AFIPS 1964 Fall Joint Computer Conference, Vol. 26, Part II, 615-621 (Spartan Books, Washington, D.C.). 31 Wos, L., Carson, D. and Robinson, G., "Efficiency and completeness of the set of support strategy in theorem proving," J. ACM, Vol. 12(1965), 536-541. 32 Wos, L., Overbeek, R., Lusk, E., and Boyle, J., "Automated Reasoning— Introduction and Applications", Book in preparation. 33 Wos, L., Robinson, G., Carson, D. and Shalla, L., "The concept of demod ulation in theorem proving," J. ACM, Vol. 14(1967), 698-709. 34 Wos, L. and Winker, S., "Open Questions Solved with the Assistance of AURA," to be published.
462
Collected Works of Larry Wos
35 Wos, L., Winker, S., Veroff, R., Smith, B. and Henschen, L., "Questions concerning possible shortest single axioms for the equivalential calculus: an application of automated theorem proving to infinite domains," accepted for publication by Notre Dame Journal of Formal Logic. 36 Wos, L., Winker, S., Veroff, R., Smith, B. and Henschen, L., "A new use of an automated reasoning assistant: open questions in equivalential calculus and the study of infinite domains," submitted for publication.
A New Use of an Automated Reasoning Assistant: Open Questions in Equivalential Calculus and the Study of Infinite Domains* L. Wos, S. Winker and B. Smith Mathematics and Computer Science Division Argonne National Laboratory Argonne, IL 60439, U.S.A. and R. Veroff Department of Computer Science University of New Mexico Albuquerque, NM 87131, U.S.A. and L. Henschen Department of Electrical Engineering and Computer Science Northwestern University Evanston, IL 60201, U.S.A.
Recommended by Robert Boyer ABSTRACT The field of automated reasoning is an outgrowth of the field of automated the orem proving. The difference in the two fields is not so much in the procedures "This work was supported in part by the Applied Mathematical Sciences Research Program (KC-04-02) of the Office of Energy Research of the U.S. Department of Energy under Contract W-31-109-Eng-38 (Argonne National Laboratory, Argonne, IL 60439) and in part by NSF grant MCS79-03870 (Northern Illinois University, DeKalb, IL 60115). Reprinted from the Journal of Artificial Intelligence, Vol. 22, pp. 303-356, 1984, with kind permission from Elsevier Science - NL, Sara Burgerhartstraat 25, 1055 KV Amsterdam, The Netherlands.
Collected Works of Larry Wos
464
on which they rest, but rather in the way the corresponding programs are used. Here we present a comprehensive treatment of the use of an automated reasoning program to answer certain previously open questions from equivalential calculus. The questions are answered with a uniform method that employs schemata to study the infinite domain of theorems deducible from certain formulas. We in clude sufficient detail both to permit the work to be duplicated and to enable one to consider other applications of the techniques. Perhaps more important than either the results or the methodology is the demonstration of how an automated reasoning program can be used as an assistant and a colleague. Precise evidence is given of the nature of this assistance. 1. Introduction The field of automated reasoning [36] is a natural outgrowth of the field of automated theorem proving. An automated reasoning program can be used by itself or as the reasoning component in some larger system such as an expert system. We show here how one can start with virtually no knowledge of the field under study and, by relying on a program that functions as an automated reasoning assistant, develop a complex methodology that in turn leads to the answers to previously open questions in that field. Although proof finding is clearly one of the more common uses of a reason ing program, other uses include model and counterexample generation, puzzle solving, and hypothesis testing. In this paper, we present certain new uses, some of which require exchanges between the user and the program. The new uses in clude finding notation, suggesting conjectures, refuting conjectures, conducting a case analysis, and employing a methodology for treating infinite domains in a finite manner. These new uses as well as those cited later were found without recourse to additional programming. Often, when using an automated reasoning program, one is not in a position to simply submit the problem and await the final result. Instead in many cases one must engage in some form of exchange. Such exchanges cause us to view a reasoning program as an assistant or as a colleague. The evidence given in this paper supports this view. Here we give virtually the complete study of certain previously open ques tions in formal logic. Although the results are of interest in themselves, the methodology is the primary concern in this paper. We state categorically that the results are presented elsewhere [35]. The results, as well as a rather de tailed account of the equivalential calculus [5], are included here to enable us to fully describe the methodology from its inception to its complete development. Absent from [35] is the full treatment of each question from the viewpoint of automated reasoning. The equivalential calculus [5] is essentially concerned with the abstract no tion of equivalence. Within that calculus there are formulas that are strong
New Use of an Automated
Reasoning
Assistant
465
enough to serve as shortest single axioms. At the time this study commenced, there were seven formulas whose status with respect to being shortest single axioms was unknown. We prove here with a single uniform methodology that four of the formulas—XJL, XKE, XAK, and BXO [16]—are too weak to serve as single axioms. (Of the remaining three axioms, we show in [29] with an ex tension of the methodology presented in this paper that XCB is also too weak, but that each of XHK and XHN is, surprisingly, a 'new' shortest single axiom.) We also answer a question, posed by Kalman [7], concerning the existence of a shorter proof establishing that a particular formula, XGK, is also a (known) shortest single axiom. In attempting to answer the questions, a number of obstacles were encoun tered. To overcome them, a general methodology was formulated that relies heavily on the assistance of an automated reasoning program. The toughest obstacle was that of coping with infinite domains. Additional obstacles include counting symbol occurrences, classifying formulas according to their structure, and blocking entire search paths through the inference space. Although the methods for coping with these difficulties appear to be of value in many other problem-solving areas, we must warn the reader to be exceedingly careful in the use of nonstandard demodulation. In particular, if insufficient care is taken, un sound inferences will be made [28,36]. Allowing the corresponding demodulators to participate freely in the inference mechanism can produce misleading results. Nevertheless, such uses of demodulation can be very useful [28]. It seems quite likely that the questions would not have been answered without the program's assistance and the methodology discussed here. The program AURA (Automated Reasoning Assistant) [24] employed in this study is simply an extension of an automated theorem-proving program, and thus relies on the usual array of inference rules and strategies found in a number of theorem-proving programs [1,24]. To be precise, it is not the program that is so different, but rather its use and breadth of application that cause us to continually refer to it as an automated reasoning program [34,33]. Bear in mind throughout this paper that the information here was obtained by making a series of runs, each followed by an analysis of that run, and often then followed by another run. Such an exchange is reminiscent of a typical exchange between a researcher and an assistant or a colleague. The results ranged from complete success through partial help to complete failure. But when the study ceased, we had, with the invaluable assistance of AURA, a substantially shorter proof for a known theorem and the answers to seven previously open questions in equivalential calculus. 2. O v e r v i e w To provide the background for introducing the new uses for an automated rea soning program, we include a brief review of automated reasoning itself. We follow this with a brief introduction to equivalential calculus. In Section 5 we
Collected Works of Larry Wos
466
present and solve the problem of finding a shorter proof. In Section 6 we intro duce the methodology that, when fully developed, enables one to solve the open questions solved in Section 7. In order to present the fully developed method ology, in Section 7.3 we extend the discussion of Section 4 to a more detailed account of equivalential calculus including additional definitions and notation. The narration will be a chronological reflection of much of our study of this area of formal logic. We shall list the obstacles that arose while attempting to answer the questions under study, and then give the method for coping with each. The methodology that we give is of general interest in that it is relevant to an attack on a wide variety of problems. Since the approach is transferable to other automated reasoning programs and to other automated theorem-proving programs, it is accessible to a number of researchers. Our usual approach to problem solving with the aid of an automated reason ing program is the following. An obstacle is identified, the program is asked to solve the corresponding problem, and the results of its attempt are examined. We emphasize again that the results range from total success to total failure. Usually, however, they fall somewhere in between. The analysis of such inter mediate output often leads to the formulation of additional methodology that in turn points to a run that may solve the problem at hand. As a result of these exchanges, we now use the automated reasoning program AURA to refute conjectures, conduct a case analysis, and obtain information that supports or discards a proposed induction argument. Of the new uses cited here and earlier, the treatment of infinite domains is perhaps the most interesting and valuable, especially to the logician. To understand how an automated reasoning program can be used for such a variety of tasks, we turn to a brief introduction to the field itself. 3. Automated Reasoning 3.1. Background An automated reasoning program is a general-purpose program that can be used for problems ranging from the study of questions from various fields of mathematics and formal logic to the design and/or validation of logical circuitry. For some applications, the key aspect of such a program is its capacity to find proofs, while for others it is its capacity to generate models or counterexamples. In this section, we focus on the components of an automated reasoning pro gram. For those who are familiar with automated theorem proving, a number of the topics to be discussed will not be new. The methodology and a number of the uses presented in Sections 5, 6, and 7, however, will be. We give sufficient material here to hopefully provide at least a cursory understanding of some of the underlying procedures and thereby perhaps suggest further possible appli cations for the system. As illustrations of what can be accomplished, we give two applications in Sections 5 and 6—applications that have little in common.
New Use of an Automated Reasoning Assistant
467
As in automated theorem proving, when one uses an automated reasoning program, one begins by supplying the program with a set of assumptions in the form of axioms. One then presents the objective of the endeavor by supplying some condition that can be used for termination. The usual termination con dition is that of 'contradiction', which is not surprising since a common use of reasoning programs is that of proving theorems. However, when the program arrives at a contradiction, it often merely means that the problem under study has been solved, and not necessarily that a theorem (in the ordinary sense) has been proved. 3.2. Language, unification, and inference rules Problems submitted to the automated reasoning program must be phrased essentially in the first-order predicate calculus. Existential quantifiers are, how ever, replaced with appropriate Skolem functions [23], and universal quantifi cation is present only implicitly. By convention, universally quantified variables are denoted by x,y,z, .... In addition, the conjunctive normal form is required. Each variable that occurs is thus assumed implicitly to be universally quantified and to have its scope restricted to that conjunct in which it occurs. Therefore, variables that occur in different conjuncts are assumed to be distinct regard less of their syntactic form. Similarly, the 'and' between conjuncts and the 'or' between the disjuncts of a conjunct are present only implicitly. The conjuncts that result are called clauses. The basic operation common to many procedures within the program is that of unification [22]. Two terms are said to unify if there exists a substitution of expressions for variables that can be applied simultaneously to the pair such that the two terms become identical. The program seeks only most general unifiers. No mechanism exists in the program that permits arbitrary instantiation, that is, for example, from the single premiss Q(x) the program is unable to deduce Q(a). When using the program, one is permitted a choice from among a wide vari ety of inference rules. The choices range from binary resolution [22] to paramodulation [21]. While binary resolution does not utilize the meaning of any predi cate symbol, paramodulation 'builds in' equality by generalizing the substitution property of equality. (The results in this paper were obtained without employ ment of paramodulation.) The inference rule of binary resolution considers two premisses, ignoring the possible designation of major and minor, and seeks a conclusion. A conclusion is made if and only if an appropriate unification ex ists. Such a unification acts like universal instantiation [20]. Binary resolution in effect seeks a most general universal instantiation that, when applied to the premisses, causes a disjunct in each (where the two disjuncts must have opposite sign) to become otherwise identical. Then, depending on the number of disjuncts in the premisses, modus ponens or syllogism is applied. In place of applying the two processes separately, binary resolution combines the two processes in a sin gle step rather than retaining information after the first operation, unification,
468
Collected Works of Larry Wos
is applied. For equivalential calculus, the inference rule of interest to the logician is condensed detachment, discussed in Section 4. Intuitively, condensed detach ment says that, if E(x, y) and x are deducible, then y is deducible, where E is a two-place function that can be thought of as 'equivalent'. There is available to the program an inference rule, UR-resolution [11], that can, in the presence of an appropriate clause, be used to implement condensed detachment. (The inference rule hyperresolution can be used instead and with certain advantages. In particular, with hyperresolution a use of clause lists that we discuss later is unnecessary. By presenting the treatment in terms of UR-resolution, we can conveniently introduce the notion of the use of special lists of clauses.) The rule of UR-resolution assumes the presence of n 4- 1 premisses, of which n are re quired to consist of a single disjunct while the remaining is required to consist of n + 1 disjuncts. (A clause consisting of a single disjunct is called a unit clause [31].) A successful application of UR-resolution yields a unit clause. To apply the inference rule, the program first attempts to find a most general unifier to pairwise unify the n unit premisses simultaneously with each of n of the dis juncts of the remaining premiss. If such a unifier is found, the corresponding substitution is applied to the remaining disjunct to obtain the inference. As in binary resolution, only that which results from this two-step process is retained, and no record remains of the intermediate computations. To see how UR-resolution can be employed to mirror condensed detachment, consider the following clauses. -DEDUCIBLE(E(x,y)) -DEDUCIBLE(x) DEDUCIBLE(y) DEDUCIBLE(E(E(x,x),E(y,y))) DEDUCIBLE(E(x,x))
(1) (2) (3)
The first clause can be viewed as an encoding of the rule of condensed detach ment. The next two clauses are examples of two formulas to which we might wish to apply condensed detachment. First recall that, for the automated reasoning program, the variables in each clause are treated as being universally quantified. Second, recall that the scope of quantification is precisely the single clause in which a variable occurs. Thus, in clauses (1), (2), and (3), the variable x is treated as not being shared by any two of the three clauses. A substitution, therefore, applied to clause (1) has no effect on (2) or (3). The predicate DEDUCIBLE is present to satisfy the language requirement of the first-order predicate calculus. It can be interpreted as 'true' or as 'is deducible'. The condensed detachment of (2) as major premiss with (3) as minor yields DEDUClBLE(E(y,y)), or just E(y,y) when viewed from the language of equivaler tial calculus. The UR-resolution of (1) with (2) and (3) in that order is also DEDUCIBLE(£(y,y)). On the other hand, if the roles of (2) and (3) are inter changed either with condensed detachment or with UR-resolution, the resulting inference is E{E(x,x),E(y,y)) or DEDUCIBLE(.E(.E(:E,x),.E(y,y))).
New Use of an Automated Reasoning Assistant
469
Although reversed condensed detachment [14] is not used in this study, it is accessible by merely employing (1') as a clause. -DEDUCIBLE(£(a;, y)) -DEDUCIBLE(j/) DEDUCIBLE(x) (1') Again UR-resolution is sufficient. The simultaneous presence of (1) and (1') presents no difficulty for UR-resolution since by definition the rule would never consider a set of premisses simultaneously containing both (1) and (1'). One word of caution must be given. As will be seen in Section 5, use of the automated reasoning program in certain applications relies on the inclusion of clauses in the form of negative unit clauses (e.g. -DEDUCIBLE(E(a, a)), where 'a' is the name of a constant). Among other uses, such inclusions enable the program to know that a proof has been completed. When using UR-resolution to mirror condensed (or reversed condensed) detachment, these negative unit clauses must be prevented from participating in the inference mechanism. Oth erwise, clauses could be deduced that are not justifiable with condensed detach ment. This problem can be avoided by placing the negative units on a list that is consulted only for the answer to the question: "Is the proof complete?". 3.3 Subsumption, complexity, list manipulation, nonstandard use of demodulation, and clause level In order to understand the techniques employed in solving the problems dis cussed in Sections 5, 6, and 7, we must delve yet further into the array of procedures employed by an automated reasoning program and the concepts on which they rest. The first among these is that of subsumption [22]. One clause is said to subsume another if and only if there exists a substitution that can be applied to the first such that, after substitution, the first becomes a subclause of the second. In other words, the second must be logically weaker than the first for subsumption to occur. For example, DEDUCIBLE(£(x,x)) sub sumes each of DEDUCIBLE(£(£(x, y), E{x, y))) and DEDUCIBLE(£(£(y, y), E(y,y))). Subsumption is usually used to curtail the abundance of inferences that can occur during a proof search. The subsumed clauses are in a sense redundant and superfluous since their more general counterparts are usually sufficient for any reasoning task. The use of subsumption that occurs in Section 5, however, is rather different than the standard one just discussed. There subsumption is used to avoid using certain facts or steps of a known proof. The next procedure of the automated reasoning program that proved useful in these studies of formal logic is that called weighting [12]. The use of weighting permits priorities to be assigned to the various concepts present in a problem, where the priorities are determined by given definitions of complexity. One can define complexity in virtually any fashion that is required by the problem. Thus, in equivalential calculus, expressions with precisely five E's can be defined as less complex than all other expressions and therefore preferable as possible premisses from which to reason. As a more interesting example, expressions of the form
Collected Works of Larry Wos
470
E(x,t) for some formula t can be considered as the most preferred. On the other hand, one can instead direct the program to treat such formulas as so unpreferable that they are in fact purged from the space of retained information. T h e third feature to be noted is a reasoning program's ability to manipulate lists of clauses or formulas [24]. Examination of various proofs in the equivalential calculus reveals the following singular occurrence. When establishing that a particular formula is in fact strong enough to be a single axiom, the proof often repeatedly uses the formula a n d / o r an immediate descendant thereof as major or minor premiss for condensed detachment. The program can be forced to concentrate on a single formula or on a set of formulas when conducting a proof search or in conducting some other investigation. This is accomplished by placing the formula(s) on a preferred list. T h e next important concept, called demodulation [32], is used to rewrite and rephrase information. Its use rather than its definition is the concern here. Demodulation in the standard usage enables the program to canonicalize a n d / o r simplify expressions. Demodulators take the form of equalities. One could, for example, input in the form of a demodulator the definition that the formula BXO of equivalential calculus is equal to the constant K. Then all derived formulas would have any occurrence (or alphabetic variant) of BXO replaced by K. (It may be of interest to know that the first conjecture relevant to the studies of Section 6 resulted from such a reduction. The concept of kernel, defined in Section 7.3, was formulated after having the program apply such a demodulator to each of the clauses obtained in an early computer run.) There are, in addition, many nonstandard uses of demodulation [28]. One such enables the program to classify formulas according to whether or not, for example, they are of the form E(x, s) or E(t, y), where s and t are arbitrary formulas and x and y are variables, see Appendix B. This in turn allows the search to be directed toward or away from certain formulas and classes of expressions. (We again caution researchers about the use of nonstandard demodulation, for such procedural use can, if not appropriately separated from the general inference mechanism, permit a reasoning program to draw unsound conclusions.) T h e final relevant concept is that of clause level. Since a particular clause of ten can be derived in many different ways, we define the level (of an occurrence) of a clause. This concept is of value since, under certain conditions, the level of an occurrence of a clause is equal to the length of its derivation. T h e level of an input clause is defined as 0. The level of an occurrence of a deduced clause is one greater than the maximum of the levels of the premisses from which it is deduced. 4. Equivalential C a l c u l u s The elements of equivalential calculus, often denoted by EC, are the expres sions that can be recursively well-formed from the variables, x,y,z,w, ..., and the two-place function E. The standard rules of inference in this calculus are
New Use of an Automated
Reasoning
Assistant
471
the substitution rule and the rule of detachment [19]. However, studies thereof are often conducted by means of the inference rule of condensed detachment
[16]. Definition 4 . 1 . For the two formulas E(A, B) and A, detachment is that infer ence rule that yields the formula B. Definition 4 . 2 . For the two formulas E(A, B) and A' that are assumed to have no variables in common, condensed detachment is that inference rule that yields the formula B", where B" is that which is obtained from detaching E(A", B") and A", and where E(A", B") and A" are respectively obtained from E{A, B) and A' by the most general possible substitution whose application forces A and A' to become identical. Condensed detachment is denoted by CD. Thus condensed detachment, when it applies, takes two formulas and re names their variables so that they have no variables in common, then seeks the most general substitution that can be found whose application will per mit a detachment, and finally applies detachment to the pair of formulas af ter the substitution has been made. For example, the condensed detachment of E(E(E(x,x),z),z) with E(E(x,y),E(y,x)) yields E(x,x) and also yields E(x, E(E(y,y),x)), depending on the order in which the premisses are consid ered. In order to discuss the problem of focus in Section 5 and the questions of focus in Section 6, we require certain additional definitions. Definition 4 . 3 . Two well-formed expressions (which are assumed to have no variables in common) are said to unify [22] if there exists a substitution that can be applied to them that makes them identical. Definition 4.4. Except for alphabetic variancy, the most general unifier, de noted by MGU, is the most general substitution that forces a pair of unifiable expressions to become identical. Definition 4.5. The most general common instance, MGCI, (within alphabetic variancy) for two unifiable expressions is that expression yielded by application of the MGU. Definition 4.6. If the condensed detachment of E{A, B) with A' yields B", then E(A, B) is called the major premiss and A' the minor premiss. By convention, when we say 'condensed detachment of A with B', henceforth we shall mean that A is the major premiss and B is the minor. Given the preceding definitions and remarks, we now turn to the actual prob lem that was our first focus of attention in the study of equivalential calculus.
Collected Works of Larry Wos
472
5. Alternative and Shorter Proofs 5.1 Overview In this section we concentrate on the problem of finding a shorter proof that the formula XGK = E{x, E(E(y, E(z, x)), E(z, y))) is a shortest single axiom for the equivalential calculus. The standard for com parison is the proof, consisting of forty-four steps, given by Kalman in [6]. The proof given here consists of but twenty-four steps. We hasten to point out that knowledge of Kalman's proof was essential to the finding of the shorter one. (Overbeek found one of twenty-one steps using this same automated reasoning program under discussion.) In addition to giving the alternative proof, we shall show how the automated reasoning program was employed in finding that proof. To achieve this objective, techniques were found that enable a reasoning program to overcome various obstacles. These obstacles include avoiding a known proof, classifying formulas, and finding a way to rely heavily on certain formulas. The techniques require no additional programming. Thus the material and procedures covered in the preceding two sections will come into play. The problem solved in this section presents a sharp contrast to the questions answered in Sections 6 and 7. However, taken as a whole, they may suggest some of the possible uses of such a program. The methodology we are about to briefly discuss may in part enlighten one as to the relative ease of using the system, especially when the goal of solving open questions is taken into account. In Sections 6 and 7, the treatment is rather far from straightforward in that condensed detachment is mainly used on classes of EC formulas rather than on the EC formulas themselves. Here we apply condensed detachment directly to the objects of EC. 5.2. A shorter proof The following proof, employing condensed detachment, establishes that XGK is a shortest single axiom for the equivalential calculus. The standard approach is used, namely, we show that PYO [15,16], one of the known single axioms for EC, is derivable by condensed detachment from XGK. Proof. In reading the proof we give shortly, the first number in a triple is the number of the step, the second is the number of the major premiss, and the third is the number of the minor premiss. 1 2 3 4 5
1 2 3 1
1 1 3 4
E(x,E(E(y,E(z,x)),E(z,y))); E(E(x,E(y,E(z > E(E(u,E(v,z)),E(v.u))))),E(y,x)); E(E(E(E(x,E(y,z)),E(y,x)),E(z,u)),u); E(x,x); E(E(x,E(y,E(z,z))),E(y,x));
New Use of an Automated
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
5 2 5 2 1 2 5 1 10 14 13 16 17 1 19 1 21 22 2
1 6 6 8 9 7 11 12 1 11 1 1 17 18 15 20 1 11 23
Reasoning
Assistant
473
E(E(x,E(x,y)),y); E(x,E(y,E(y,E(x,E(z,E(E(u.E
5.3. T h e m e t h o d o l o g y The proof given in Section 5.2 is a faithful translation of the one found by the automated reasoning program. We show here how the program is assigned the task of finding a shorter proof than that given by Kalman. As will bo seen, his proof plays an essential role in the program's success. Because the task is that of finding a proof rather than examining the usually infinite set of theorems deducible from a given formula, we choose to directly employ condensed detachment alone and rely on a straightforward encoding of the EC formulas. To obtain the use of condensed detachment for the program and yet avoid additional programming, clause (1) of Section 3.2 is used together with the already existing inference rule of UR-resolution. The formulas of EC are merely prefixed with a one-place predicate DEDUCIBLE to map them to clause form. To enable the program to know when a proof has been completed, those for mulas already known to be shortest single axioms are each negated and placed on a list that itself is isolated from the inference mechanism. That list is con tinually consulted as each new inference is retained to see if a contradiction has been found. (The shortest single axioms were an arbitrary choice. Any known single axiom would also have sufficed.) Since allowing a reasoning program to conduct an unrestricted proof search can yield far too many inferences, a means to direct the investigation was sought.
474
Collected Works of Larry Wos
In formal logic and in mathematics, one often finds that certain lemmas or facts are of unusual importance. Such lemmas may be used repeatedly in certain studies. Examination of both Kalman's proof t h a t XGK is a single axiom [6] as well as various similar proofs in [15] revealed repeated use of clauses of level 0 and of level 1—those clauses respectively t h a t are the formula under study and its immediate descendant under condensed detachment. We were thus faced with the obstacle of formulating a method to enable the program to also make repeated use of such formulas. The method consists of placing the corresponding clauses on another special list. This list is visited repeatedly for making choices for either possible major or possible minor premisses. (If additional knowledge or intuition suggested restriction of the elements to the use, say, for major premiss alone, the program could have been directed to reflect such knowledge or intuition.) Further examination of the Kalman proof revealed the importance of certain clauses somewhat deep in the inference space, that is, of rather high clause level. To have the program reflect this importance, complexity is defined so that these clauses (when generated) are considered to have almost no complexity. Since the program focuses, when possible, on clauses of low complexity in preference to those of higher, the chosen definition of complexity proved very beneficial. These important clauses would, if treated with standard definitions of complexity, have had rather high values of complexity and thus would not have been used frequently enough. Still further examination of Kalman's result led to a classification of EC formulas according to certain structural properties. This observation presented another obstacle, t h a t of having the program automatically classify formulas and discard those in unneeded classes. In Kalman's proof, for example, there is essentially an absence of formulas of the form E(E(x, y), t) for some expression t. The single exception is E(E(x, y), E(y, x)). The obstacle is overcome by appro priately defining complexity and by using demodulation. As a result, the class of unneeded elements—those of the form E(E(x, y), t)-is purged from the space of retained information. This move materially aids the efficiency of the search. (Our first successful search for a proof did not require such classification.) To affect such a purge, the program is required to automatically classify each new formula. This classification is accomplished through a nonstandard use of demodulation [28]. Techniques of this kind now exist [28] for: counting, scanning, and classifying the formulas produced by the program, see Appendix B. To prevent examination and generation of a proof identical to Kalman's, certain formulas from his proof are selected for avoidance. By placing them on yet another list whose elements are not allowed to participate in the search, subsumption can be used to block proofs relying on those preselected formulas. When a copy of one such is generated, it is immediately purged via subsump tion rather than adjoined to the pool of possible premisses. Thus the copy is unavailable for use as a premiss.
New Use of an Automated Reasoning Assistant
475
Finally, there is the following procedure that can be used to assist in the search for shorter derivations of given steps of some proof. Note that, when a derivation of a clause involves at each step an input clause, the length of the derivation equals the level of the clause so derived. Thus, in many cases, the derivation length bears an important relation to the level. (On the other hand, a clause whose ancestors both have level 4 will have level 5, while the corre sponding derivation will often have length 9.) To aid in finding a shorter proof for some formula A, input the clause DEDUC(s(.z), A), where s(z) expresses the known derivation length in terms of the successor function. Then we add to the input a clause (1") that with UR-resolution will encode condensed detachment similarly to the way (1) of Section 3.2 does. -DEDUC(z, E(x,y)) -DEDUC(z,x) DEDUC(s(z),y) (1") Clause (1") has the advantage over (1) in that it leads to some information related to derivation length. The level of an inference will be correctly computed through the use of (1") with UR-resolution because the new inference will have one added to the maximum of the levels of its immediate ancestors. (To see how this works, see Appendix C.) If a new derivation of one of the chosen clauses should occur, and if the level is less than the input derivation length, subsumption will result. If such a subsumption results, it suggests that a shorter proof for the chosen step has been found. To summarize, we have shown how an automated reasoning program can be used to find a shorter proof than that which is already known. In order to find such a proof, the program was required to emphasize the importance of various formulas, classify formulas according to structure, and block particular paths of proof. One especially interesting point is the way in which the existing literature, especially Kalman's proof, is used in achieving the objective. The corresponding techniques are of a general nature and can, therefore, be applied in many other areas. However, many of the techniques of this section do not apply to Sections 6 and 7. 6. The Automation of the Study of Possible Shortest Single Axioms The intent in this section is to show how an automated reasoning program can be used to answer seven previously open questions—questions of the form, are any of the formulas, XJL, XKE, XAK, BXO, XCB, XHK, XHN, strong enough to serve as single axioms for the equivalential calculus. These questions, some of which are answered in Section 7 and some in a later paper [29], present a sharp contrast to the problem solved in Section 5. While the problem of Section 5 focuses on a formula already known to be a single axiom for EC, the questions of Section 7 focus on formulas whose status was unknown. (Prior to our attempt at solving the problem discussed in Section 5, none of the authors had more than the merest exposure to the equivalential calculus. The success of our attempt was the sole force for attacking the harder problems discussed in this and the
476
Collected Works of Larry Wos
next section.) Two possibilities exist for each of the seven formulas. If a formula under study is in fact a single axiom, to some extent we might proceed as in Section 5. We could attempt to derive a known single axiom of EC starting with the formula of focus. On the other hand, if the formula itself is not a single axiom, then we might attempt to show that some known theorem such as E(E(x,y), E(y, x)) is not derivable from the formula. As it turns out, the methodology we are about to present is applicable in either case. The heart of this methodology is its treatment of infinite domains. But how do infinite domains come into the picture? Such domains are of concern since in general from a given formula one can deduce an infinite number of theorems. Direct examination of that set is not possible. Nevertheless, we must cope with that set in order to show that certain formulas are not members of that set. In contrast, when seeking a proof, one need explore only finite subsets of the possibly infinite set of deducible theorems. Thus the problem of showing a formula too weak to be a single axiom is potentially harder than proving it strong enough. Nevertheless, with much assistance from an automated reasoning program, we successfully analyzed these infinite sets. The obstacle of treating infinite domains was circumvented by the discovery, for four of the formulas, of a finite classification scheme. For each of the four formulas proved too weak in Section 7, output from the program led to a finite set of classes, schemata, that completely characterize the infinite set of derivable theorems. (The sets of schemata that characterize the situation for the remaining three formulas are not finite.) With this preview of things to come, we resume the chronological narration of how the automated reasoning program was actually used. Because Sections 7.1 and 7.2 contain specific details and a simple illustration, one might find it useful to continually refer to those two sections. We shall mark our progress by listing the various steps. The first step was to arbitrarily choose for study XBB, a formula already known by the logician to be too weak to be a single axiom for EC. (Incidentally, we did not at the time share in this knowledge. Only after completing a proof that XBB is too weak did we discover, with amusement, that the information was not new. In contrast to the method employed in Section 7.2, the original proof proceeds by finding an appropriate model [16].) As is usual, we began by including in the input to the program the negations of known single axioms with the intention of seeking a proof by contradiction. However, it quickly became clear that the usual goal had to be replaced by a new goal—the goal of (even tually) studying the (entire) space of possible inferences deducible from a given formula of EC. The program is asked to start with a formula, XBB in this case, and apply condensed detachment some number of times. The object is that of producing a list of theorems to be examined for possible patterns and properties. An ex amination of the theorems found by the program led to the conjecture that all
New Use of an Automated Reasoning Assistant
477
theorems deducible from XBB are ever-increasing in length. (As will be seen, they in fact are of the form fn(K) for n = 0,1,2,..., where K = XBB.) The next step, proving this conjecture, requires coping with the obstacle of infinite domains. Our response to this challenge was to formulate a primitive methodologyfirst carried out by hand, and later implemented within the program-in order to attempt to prove the conjecture. (Present in that methodology is a hint of that which would be discovered and which is employed in Section 7.) The result was a proof that the theorems deducible from XBB are ever-increasing in length. This in turn implies that this formula is too weak to be a single axiom for equivalential calculus, since known theorems of EC such as E(x, x) are not deducible from XBB. With XBB proved too weak, we then turned our attention to the study of the formula XAK. The formula XAK is more interesting than XBB since, at the time this study took place, the axiomatic status of XAK was unknown. Our first move was to consider the obvious possibility that XAK behaves like XBB, that the theorems deducible from XAK are also ever-increasing in length. If they are ever-increasing in length, then XAK also is not a (shortest) single axiom for equivalential calculus, for the known theorem E(x,x) of EC will then not be deducible. In this case, the obvious possibility proved not to hold, that is, by simply inspecting the output of a single run, premisses were found such that condensed detachment yields a formula not longer than both. The ever-increasing length conjecture was then modified to that which says that the inferences yielded by CD are at least longer than one of the immediate parents of the inference. While mere inspection disposes of the first conjecture, this second conjecture poses the obstacle of actually counting symbols. Rather than count them by hand or write a new program for this task, a method was de vised to have the reasoning program count symbols and place the counts within the derived inferences, see Appendix B. A nonstandard use of demodulation is the key [28]. Indeed, premisses were found such that condensed detachment yielded a conclusion whose length is less than that of either parent, and the second conjecture for XAK was disproved. Thus we found that the theorems deducible from XAK are not nearly as well behaved as those deducible from XBB, since the latter are ever-increasing in length. In order to more easily read the theorems derived from XAK by the program, we had the program rewrite them by using demodulation [32]. Through this use of demodulation, the program automatically replaces every occurrence of XAK by the constant K in all derived formulas. Since such replacements could block applications of condensed detachment, a method, presented in Appendix B, was devised for retaining within a single clause both the derived formula and its rewritten form. The unaltered copy is then available for participation in further applications of condensed detachment. Using this definition that XAK = K, the next run immediately led to the observation that those theorems so far yielded by condensed detachment and deducible from the single formula XAK
478
Collected Works of Larry Wos
each contain XAK as a subexpression. The conjecture was then made that all of the theorems so deducible have this property—this common subexpression property. But, since the set is infinite, there exists again the obstacle of finding a way for the reasoning program to cope with an infinite set—a set, however, that is more complex than that encountered with XBB. This obstacle, together with the fact that the theorems deducible from XBB also have this common subexpression property, led to an extension of the prim itive methodology referred to earlier. This extension is the first move in gener alizing the methodology—the methodology that is completed in Section 7. A key concept in this generalization is that of kernel. Intuitively, a kernel is a (sub)expression in which every variable occurs exactly twice and in which no proper subexpression has this property. By way of example, E(E(x, y), E(y, x)) is a kernel, but E(E(x,x), E(y,y)) is not. The second formula contains two copies of the kernel E(x,x). Kernel(s) are usually denoted by K or K'. Note that the conjecture for XAK thus says that all theorems deducible from it contain a kernel equal to XAK itself. Also recall that we remarked earlier and will prove in Section 7.2 that all theorems deducible from XBB are of the form /"(/f)—a notation that arises in part from the fact that each theorem so deducible contains XBB as a subexpression—and hence share a common kernel. The use of K = XBB in one part of the study and K = XAK in another hints at the similarity that will soon become apparent. When the four questions have been answered in Section 7, the complete methodology promised in the introduction will have been exemplified. In particular, the methodology at its inception is applied to the formula XBB whose theorems are well-behaved, and culminates with the formula BXO whose theorems are far less well-behaved. In fact, certain theorems deducible from BXO have present in them two distinct kernels. (The methodology continued to generalize and complexify as illustrated in the studies of XCB, XHK, and XHN [29].) The method for coping with these infinite sets of theorems, specifically those deducible from XAK, was suggested by examination of the theorems found at this point in the investigation. This examination yielded the definitions to be presented in the next section of K, f(K),g(K, K),i(K,K), and others. The notion is that of classifying all deducible theorems in terms of these forms. To test this notion, the plan was that of applying condensed detachment repeatedly starting with XAK = K. But rather than apply CD to individual formulas, CD is applied to these new forms, known as schemata. (From this point on, schemata were the focus of attention, with the result that the four previously open questions discussed in Section 7 and the three discussed in a later paper [29] were answered.) These forms, which illustrate the developing methodology, bring us to two additional concepts. Intuitively, a containment set for a formula is a set that contains the formula and is closed under condensed detachment. Intuitively, a unification set is a set of formulas that enables one to prove that some choice for a possible containment set is in fact closed under condensed detachment.
New Use of an Automated Reasoning Assistant
479
We often denote containment sets by C and unification sets by U. The study proceeds by examining potential containment sets and potential unification sets. The procedure for examining these sets, and hence for considering the possi bility that the infinite set of deducible theorems can be described with a finite set of schemata, requires a case analysis. The cases result from a pairwise analysis of applying CD to the schemata. To have the program apply CD to the schemata as opposed to individual formulas, it was necessary at the time to invent a pro cedure permitting the program to sometimes apply unification piecemeal—to partially unify two expressions yielding a further task for unification, see Ap pendix A. (Piecemeal unification of two schemata should not be confused with the unification of literals that occurs in, say, UR-resolution.) Ordinarily unifi cation of two expressions either succeeds or fails, but in piecemeal unification the final result is often delayed and replaced instead by a subproblem of uni fying two other expressions. Incidentally, piecemeal unification is yet another new use for an automated reasoning program, a use that requires no additional programming. Piecemeal unification is reflected in the proofs and tables found in Section 7. It is the means for studying partially defined (and completely defined) contain ment sets and unification sets. To search for the appropriate containment set C and unification set U (see Section 7.6) needed to complete the proof that XAK is too weak, preliminary definitions of the C and U are made. A computer run based on the preliminary C and U was made with the assumption that a straight forward case analysis would complete the proof that XAK was too weak. When the run yielded such expressions as E(K, K), E(K, E(K, K)), E(K, E(K, E(K, K))), and also evidence that such would recursively occur continually throughout the full set of theorems, it became clear that an induction argument was needed. The definitions of C and U were modified to capture this recursive flavor. Another run was made to complete a case analysis based on the proposed form of the induction argument. The proposed form was found wanting, but the out put pointed to the correct form. A last run was made that yielded the needed information to complete the latter induction argument. Finally, we had proved XAK too weak to be a single axiom for EC by showing that certain known theo rems of the calculus, such as E(x, x) and E(E(x, y), E(y, x)), are not deducible from XAK. It was only after the completion of the studies covered in this paper that a method was formulated to automate, except for the induction step, the entire investigation in a single run. The most significant feature of the later formula tion is its realizability within well-known and standard techniques of automated theorem proving. Although the complete discussion is deferred to a later paper [29], we can give one simple example here. In place of UR-resolution, we employ binary resolution. We are therefore neither employing condensed detachment in a straightforward fashion nor using variables in the typical manner. If, for example, we binary resolve the first disjunct of
Collected Works of Larry Wos
480
-DEDUCIBLE(E(x, y)) -DEDUCIBLE(x) DEDUCIBLE(y) (clause (1) of Section 3.2) with DEDUCIBLE(£(:r, E(y, E(E(E(z, y), x),«)))) (encoding of K = XJL) we obtain -DEDUCIBLE(x) DEDUCIBLE(£(y, E(E(E(z, y), x), z))) which we abbreviate as -DEDUCIBLE(a;) DEDUCIBLE(/(x)) where the variable x ranges over formulas of EC rather than being an element of EC. This clause can be read as: if the formula x is derivable from K — XJL, then the formula f(x) is also derivable. This clause is precisely what is desired in studies like those of Section 7 in that it represents the schema yielded by condensed detachment of K with any formula A of EC. The following summarizes the just discussed methodology that is exempli fied in Section 7—the methodology that allows treatment of infinite domains by an automated reasoning program, at least for this study. Since the set of theorems deducible by condensed detachment from even so simple a formula as XBB is infinite, to achieve the objective of inference exhaustion we had the automated reasoning program examine classes of theorems with the hope that the set of classes is finite. The hope is of course that this action results in a finite presentation of the infinite set of theorems. As we see in Section 7, the hope is fulfilled for four of the seven formulas under study. (In a second paper, we shall show that the situation is rather more complicated for certain other formulas in that such a straightforward finite presentation is not available. However, an extension of the general method still prevails there.) Although the reasoning program was used in a nonstandard fashion for the results given in Section 7 as well as those given in [29], no additional program ming was required. Condensed detachment is not applied to individual formulas of the equivalential calculus, as is the case in Section 5, but rather to schemata. 7. The Open Questions and Their Answers 7.1. Overview For each of the five formulas—XBB, XJL, XKE, XAK, and BXO—considered here, there exists a finite set of schemata that completely characterizes the theorems that can be deduced from it. (The formula XBB is considered for illustrative purposes only.) Not surprisingly, the nature of the respective sets of schemata depends on the particular formula under study. With one excep tion, for each of the formulas studied here, the corresponding set of deducible theorems has a remarkable characteristic—a characteristic that holds for every element of the corresponding containment set given in Section 7. If A is one of the formulas other than BXO of Section 7, each element of the corresponding
New Use of an Automated
Reasoning
481
Assistant
containment set contains as a kernel an alphabetic variant of A. In fact, no other kernel can be found in any element of the containment set. For BXO, a second kernel, E(x, E(y, E(x, y))), exists. Thus, for example, all theorems deducible from BXO contain at least one of the kernels, BXO or E(x, E(y, E(x, y))). Such theorems of EC as E(x, x) are therefore not deducible from any of the formulas under study in this paper. Even stronger, such theorems do not occur as subex pressions therein. The procedure for establishing these claims is the following. After selecting the particular formula for study, we inductively define an infinite containment set C for the chosen formula. To prove that all deducible theorems of concern are elements of C, we prove C is closed under condensed detachment. To prove this closure, we inductively define a unification set U that is closely related to C. The unification set is used to analyze the possible outcome of applying condensed detachment to a pair of formulas from C. Each of C and U is defined in terms of a finite set of schemata that depend on the formula in focus. With the exception of BXO, we show that each element of C contains as a (sub)expression a kernel equal to the formula being studied. As we remarked, a second kernel appears for BXO. Since there are known theorems of EC that are free of any of the kernel(s), we thus establish that each of XJL, XKE, XAK, and BXO is too weak to be a single axiom for EC. T h e proof of each of the eight points that we give shortly depends on the concepts, formalized in Section 7.3, of pure, almost pure, isolated variable, and the closure of a formula. A formula is pure if each of its variables occurs twice, and almost pure if it contains a variable that occurs once while its other variables occur twice. An isolated variable is a variable that occurs once in a formula. Finally, the closure of a formula A, denoted by CL(A), is the smallest set of formulas that contains A and that is closed under condensed detachment. Upon its completion, this study yields the following eight points for A, where A is respectively XBB and each of the formulas of Sections 7.4 through 7.7. 1. C is closed under condensed detachment. 2. C contains
CL(A).
3. C is a containment set for A. 4. U is a unification set for A and C. 5. With the exception of BXO, the only kernel to be found (up to alphabetic variancy) in any element of C is A itself; for BXO a second kernel appears, namely, E(x,E(y,E(x,y))). 6. Among the theorems of EC, C does not contain
E(x,x).
7. C = CL(A): A strengthening of (2) but with some detail omitted. 8. And because of (6), A is too weak to be a (shortest) single axiom for the equivalential calculus.
482
Collected Works of Larry Wos
Because purity of formulas is heavily relied upon throughout the treatment given here, we give the following word of warning. When defining the various C and U, we implicitly assume that the schemata employ variables distinct from those occurring in their arguments. For example, if h(w) = E(y, E(w, y)), then h(h{w)) = E(z, E(E(y, E(w, y)), z)), as occurs in BXO. Finally, rather than repeating certain provisos, note that in Sections 7.2 through 7.7 the elements of C are pure and those of U are almost pure with isolated variable w. The treatment of the four previously open questions given in Sections 7.4 through 7.7 is preceded by a formal discussion of equivalential calculus in Section 7.3. 7.2. A simple illustration of the method of proof: XBB To provide a template for the proofs to be given in Sections 7.4 through 7.7, we now apply the basic method to the study of the formula XBB = E(x, E(E(E(x, E(y, z)), y), z)). This study of XBB will corroborate the known fact [16] that XBB is too weak to be a single axiom for EC. Thus it is the approach rather than the result to be obtained that is the focus here. We choose to begin with this example, even though it represents a known fact, because its treatment is rather simple both conceptually and notationally. By giving here a detailed account, we are then able to condense the proofs for each of XJL, XKE, XAK, and BXO, which are found in Sections 7.4 through 7.7. We shall prove that, for example, E(x, x) does not even occur as a subex pression in any theorem deducible from XBB. Rather than directly studying CL(XBB), we define a set C that is intended to be both large enough to contain CL(XBB) and yet small enough to exclude E(x,x). Since such a C is infinite, we seek a finite presentation thereof—a finite set of schemata that permits the definition of C to be given inductively. To find some of the needed schemata, we let K = XBB and examine the outcome of applying CD (condensed detach ment) to K with any A of EC. (Note that no applications of CD are omitted from consideration by relying on an analysis in terms of K or in terms of the additional schemata that occur later, see Section B.6.) We consider this more general application of CD rather than that of K with itself since we are seek ing schemata rather than individual formulas. This more general CD yields a schema, denoted by f(A), that represents a class of formulas. The nature of f(A) and of various schemata given later enables us to consider pairs thereof for both CD and unification. The results of applying condensed detachment to E(A, B) and A' depend on the key replacement terms (see Section 7.3), those terms that are substituted for the variables shared by A and B. To treat the question of closure, we then proceed to the examination of various required CD's but applied to pairs of schemata (representing classes of formulas) rather than applied to individual formulas. Each CD can be studied
New Use of an Automated
Reasoning
483
Assistant
by instead studying some corresponding unification. We therefore inductively define a unification set U that is intended to be just large enough to study the desired closure of C under CD. The complete definitions of both C and U were in fact finally determined by examining various unifications of elements of the partially defined C with elements of the partially defined U. To begin the quest for establishing the eight points cited in Section 7.1, we have Lemma 7.2.1. L e m m a 7 . 2 . 1 . The CD of K = XBB = E(x,E(E(E(x,E(y,z)),y),z)) of EC succeeds and yields the schema, E(E(E(A,E(y,z)),y),z) which is denoted by f(A).
with any A
Proof. This CD merely requires the unification of x with A. The outcome depends on the key replacement term which, in this case, is A itself. The result of the unification, and hence of the CD in question, is obtained by simply replacing x by A in an expression equal to the right side of K, which completes the proof. Now by letting K be instead the minor premiss, we have the following com panion lemma. L e m m a 7.2.2. For any A of EC, the CD of f(A)
with K fails.
Proof. The success or failure of the CD depends on the success or failure of the unification of g(A,w), the first argument of f(A), with K, where
g(A,w) =
E(E(A,E{y,w)),y).
This unification fails since at some point an expression containing E(A, E(y, w)) is matched with a subterm of itself, namely y, which thus prevents the existence of a common instance for both g(A, w) and K. The proof of Lemma 7.2.2 is independent of the formula A and rests only on K and the schema g(A, w). This argument is but one example of that which occurs in this section and in Sections 7.4 through 7.7. The reduction first of a CD of schemata to a unification and then, depending on the nature of that unification, a further reduction to another unification is typical of what is to come. We encounter examples of such additional and secondary reductions in Lemma 7.2.5. However, before turning to Lemma 7.2.5 which will complete the study of XBB, we propose the following definitions for both the required C and the required U. Definition 7.2.3. Let CO consist of K = XBB alone. For i = 0,1,2,..., let d+i be the union of Ci with the set of all B = f(A) for some A in C{. Finally, let C be the union over i of Cj.
484
Collected Works of Larry Wos
Definition 7.2.4. Let UQ consist of the single expression h(w) = E(E(x, tu), x). For i = 0,1,2,..., let £/<+i be the union of: Uf, the set of elements of the form h(S) with S in Ui\ the set of elements of the form E(B, h(w)) for some B in C; the set of elements of the form E(B, h(S)) for some B in C and some S in Ui\ the set of elements of the form E(E(A, E(y, w)), y) for A in C; and the set of elements of the form E(E(A, E(y, S)), y) with A in C and S in C/j. Let £/ be the union over i of C/j. The elements of the last form are denoted by g(A, S). The definition of U is motivated by considering the only remaining question relevant to the attempt to prove that C is closed under CD. Since every element of C either is K or has the form f(D) for some D in C, the question concerns the application of CD to f(A) with f(B) with both A and B in C. This question reduces to a unification question that in turn reduces still further to other uni fication questions involving particular schemata found in U, see Lemmas 7.2.1 and 7.2.2. This iterated reduction argument is embodied in the case analysis proof of Lemma 7.2.5 and is also found in Table 1. The table mirrors the case analysis and is a succinct encoding of it. Tables of this type will be employed later in this section in place of the case analysis argument found in Section 7.2.3. In summation, we succeed in proving that C is a containment set and that U is a unification set, since the respective purity and almost purity therein follow from their definitions. To read the tables that embody the various case analyses, note the following. The rows are indexed by the possible choices for elements from U, while the columns are indexed by possible choices for elements from C. The intersection of a given row with a given column can be of three possible forms: failure, which says that the corresponding unification fails; a single element, which says that the unification completes immediately and yields an element of C; or an ordered pair, which says that the unification may or may not fail eventually but at least reduces to the unification of the two elements given in the pair, where the first is from U and the second from C'. Lemma 7.2.5. The unification of any S in U with any B in C fails. Proof. The proof is by induction. But first observe that the unification of either h(w) or h(S) with B in C fails, regardless of the choice between B = K and B = f(B') for B' in C. Let the length p of an expression be its symbol count, exclusive of grouping symbols and commas. From the definition of C, note that every element therein contains XBB and, therefore, every element of C has length at least 11. In particular, forp = 1, the lemma therefore holds vacuously. Assume by induction that unification fails for all pairs T in U and B' in C when the length of B' is less than p. Then consider the possible unification of S in U with B in C, where B has length p. Case 1. S = h(w) or S = h{T) with T in U. The failure here has been
New Use of an Automated Reasoning Assistant
485
already remarked upon. Case 2. S = E(A, h(w)) or S = E(A, h(T)) with A in C and T in U. If B = K, this unification question is respectively reducible to the unification of h(w) or h(T) with f(A), which is known to fail. If B = }{B') for # ' in C, the unification question reduces to the unification of A with g(B',T') where respectively T" = /i(tw) or T' = h(T) in £/. If A = K, by an argument similar to that of Lemma 7.2.2, the unification will fail. On the other hand, if A = f(A') for A' in C, a further reduction yields the possible unification of B' with E(A',h(T')), where B' in C is of length less than p. The induction hypothesis can now be applied to conclude failure of unification. Case 3. S = g(A,w) or S = g(A.T). By essentially repeating the arguments of Case 2, we again have either immediate failure of unification or eventual failure by means of the induction hypothesis. Thus the proof of Lemma 7.2.5 is complete.
Collected Works of Larry Wos
486 TABLE 1. Piecemeal unification study for XBB K h{w) h(T) E{A, h{w)) E(A,h(T)) g{A,w) 9(A,T)
failure failure failure failure failure failure
/(*) failure failure
g(B,h(w));A g(B,H(T));A E(B,h(w));A E(B,h(T));A
Note that Lemma 7.2.5 establishes the failure of CD when applied to f{A) and f(B) for A and B in C. To see this, note that such a CD reduces to the unification of A with E(B,h(w)), which fails by Lemma 7.2.5. Since the proof of this single failure requires a further succession of unification analyses, U is defined in such a way as to capture the requirements for those unifications. We can now consider the eight points given earlier. Since all cases have been covered successfully for the possible application of CD to pairs from C, we have that C is closed under CD. Since by definition K is in C, C contains CL(A'). In fact, in view of the respective definitions, C is a containment set for K — XBB, and U is a unification set. Next, the three lemmas just proved imply that the theorems deducible from K = XBB have the form fn(K) for some n = 0,1,2,.... Hence K is the only kernel therein. In particular, no well-formed pure expression occurs in an element of C other than a copy of K = XBB. Thus CL(XBB) fails to contain various known theorems of EC such as E(x, x). Therefore XBB is too weak to be a single axiom for EC, which establishes the final point of the given eight points. The seventh point holds also, but the details of the proof are not given here. Let us point out certain similarities and certain differences between XBB on the one hand and on the other the set of four formulas to be considered in Sections 7.4 through 7.7. Since the unifications that occur later result in many successes rather than in almost uniform failure, the concept of isolated variable is much more relevant to the study of the four formulas in Sections 7.4 through 7.7 than to the study of XBB. For each of the four formulas to be considered we shall, as with XBB, define a corresponding K and C and U. The definitions of C and U will pairwise share various schemata for each of the formulas to be considered, which is not the case for XBB. The induction arguments to be given will be in terms of the length of the MGCI rather than in terms of the length of the actual formulas. The definition of each of the unification sets to be defined will each begin with the inclusion of an expression that itself is the isolated variable, w. For XBB, we could have proceeded in a similar fashion, but the resulting proof would have been less clear. The continual reduction of one unification argument to another will persist. Finally, the eight given points will be proved for each of XJL, XKE, XAK, and BXO, but with appropriate and necessary modifications. Rather than giving
New Use of an Automated Reasoning Assistant
487
an explicit case analysis, the proofs will be given in tabular form. For each of the four open questions respectively solved in Sections 7.4 through 7.7, we are content merely to define the appropriate containment set, unification set, kernel(s), and schemata and give the necessary CD arguments in terms of unification. The proofs are contained in various tables. Before turning to the first of the four, we give Remark 7.2.6 but without the tedious and straightforward details of its proof. The remark is relied upon throughout the rest of this section. Remark 7.2.6. If E(A, B) and E(A', B') can be unified, where A, B, A', B' are all well-formed expressions of EC, then the pairs A, A' and B, B' can be respectively unified. Furthermore, if a is a most general unifier of A and A', and if the most general common instance of E(A, B) and E(A', B') is of length p (symbol count), then uB and crB' unify and the length of their most general common instance is strictly less than p. In addition the replacement terms that occur in the unification oioB and crB' are the same (except for possible variable renaming) as their correspondents that occur in the unification of E(A, B) with E(A', B'). By symmetry, the respective roles of A and B and A' and B' can be interchanged with the corresponding remarks for a most general unifier T. 7.3. Formal treatment 7.3.1. Equivalential calculus in detail Certain assumptions pervade the discussions of Sections 7.4 through 7.7. For example, we are concerned only with formulas in which each variable occurs exactly twice. The j ustification for this set of assumptions is given here in Section 7.3.1. In Section 7.3.2 we give certain necessary notation and definitions that complement those given in Section 4. The focus here is on the equivalential calculus. The elements of that calcu lus are the expressions that can be recursively well-formed from the variables, x,y, 2, w,..., and the two-place function E. The theorems of the calculus are just those formulas in which each variable therein occurs an even number of times [18]. There are individual formulas there that are strong enough to serve alone as axioms. It has been proved [16] that the shortest possible single axiom must contain at least 11 symbols, and there are in fact formulas of that length that suffice. There are 630 formulas of length 11-that contain 11 symbols. Of these, 11 have been shown to be single axioms [6,15], while 612 have been proved too weak. Of the remaining seven, we show here that four are also too weak. In a later paper [29], we show that there are two additional shortest single axioms and one more that is too weak. We thus disprove the conjecture [7] that no additional shortest single axioms would be found. For the remainder of the paper, a 'theorem' of equivalential calculus will be a formula in which each variable occurs exactly twice. Such formulas will be called
488
Collected Works of Larry Wos
pure. The study of the calculus will thus be entirely in terms of pure formulas. 7.3.2. Notation and definition We adopt the following notation and employ the following definitions. The for mulas of the equivalential calculus will be written in terms of the two-place function, E, and the variables, x,y, z, w, .... However, when two formulas are considered simultaneously (as in condensed detachment, for example), we as sume that no variables are shared regardless of the syntactic form. We employ the notation and conventions given in Fig. 1. Definition 7.3.1. If the successful unification of A with A' is represented by the set of pairs U/zi where U are well-formed expressions and Zi are the variables in A and A', then ti are called the replacement terms of unification, or simply the replacement terms. When E(A, B) is condensed detached with A', those replacement terms U whose Zi are present in both A and B are called key replacement terms. Thus the formula yielded by the successful condensed detachment of E(A, B) with A' is obtained by replacing those z, in B that are also in A by the corresponding replacement terms. For example, the condensed detachment of E{E{E(x, x), y), E(y, E{z, z))) with E(E(x, y), E{y, x)) yields E(E(x, x), E(z, z)\ where the key replacement term is E(x,x). Definition 7.3.2. A well-formed formula of EC is called pure if each of its distinct variables occurs exactly twice.
New Use of an Automated Reasoning Assistant
Symbol
489
Meaning
A, B, A', D, ...
elements of a (to be defined) containment set, but also some well formed formulas of the equivalential calculus
C
a containment set
CD
condensed detachment
CL(A)
(to be defined) closure of A
EC
equivalential calculus
f, g, h, i, n, ...
schemata occurring in the definition of particular containment sets and occurring in the definition of particular (to be defined) unification sets
K, K'
(to be defined) kernel
MGCI
(to be defined) most general common instance
MGU
(to be defined) most general unifier
S, T, S', ...
elements of a unification set
U
a unification set
w
(to be defined) an isolated variable
x, y, z, ...
variables in various well-formed formulas
XBB, XJL, XKE, XAK, BXO formulas of EC to be studied, where we are using the notation of Peterson [16] FIG. 1. Notation and conventions Since the condensed detachment of E(A, B) with A' requiresfindingthe most general common instance, if any exists, of A and A', we have the following definition. Definition 7.3.3. When a variable w in a well-formed formula A of E C occurs
490
Collected Works of Larry Wos
exactly once in A, that variable is called isolated. Definition 7.3.4. A well-formed formula of EC is called almost pure if it con tains exactly one isolated variable and, except for the occurrence of the isolated variable, the formula is pure. For example, the formula E(E(x, x), w) is almost pure, and also the formula w by itself is almost pure. Definition 7.3.5. The kernel(s) of a pure formula are those (not necessarily proper) subexpressions that are pure formulas but that properly contain no pure formulas. Thus we have: E(y, z) is not pure; E(E(x, x), E(y, y)) is pure, where its only kernel (exclusive of alphabetic variancy) is E(x, x); and the formula E(E(x, y), E{\ is itself a kernel. Definition 7.3.6. For any formula A, the closure of A, denoted by CL(y4), is the smallest set of formulas that contains A and that is closed under condensed detachment. Lemma 7.3.7. The successful condensed detachment of 2 pure formulas yields a pure formula [2]. (The proof is included here because of the difficulty of simply extracting it from Belnap's paper.) Proof. Let E(A, B) and D be two pure formulas that successfully condense detach, where E(A, B) is the major premiss. Let B' be the corresponding infer ence yielded by the CD of E(A, B) with D. We then have the fact that A and D unify with the corresponding substitution yielding B' = oB, where a is a most general unifier of A and D. This MGU, a, can be determined by a left-to-right unification that proceeds one position at a time. Conceptually, begin by writing E(A, B) and D with D written immediately below A. Then place an imaginary pointer immediately to the left of both the first symbol of A and the first symbol of D. This pointer will be considered to advance at each stage of the left-to-right unification of A and D. It will be advanced after the substitution is applied—that substitution required by unifying the two subterms under consideration. The proof is by iteration on the number of steps taken to complete the uni fication. We shall show that, after each step, each variable occurs twice in the union of the two subexpressions to the right of the newly advanced pointer. These two subexpressions are continually transformed by making the appropri ate substitution required by the just completed step of unification of the two subterms in focus.
New Use of an Automated
Reasoning
Assistant
491
Recall that, as the procedure is about to commence, the usual assumption holds, namely, E(A, B) and D are assumed to share no variables. By hypothesis, each of the two formulas, E(A, B) and D, is pure. Thus, at the Oth step, each variable occurring in the union of the two subexpressions to the right of the pointer occurs exactly twice. The subexpression B is in this union. Next, assume this is the case after k steps, that is, that each variable to the right of the newly moved pointer still occurs exactly twice there. The (k + l)st step either finds an E to be matched with an E, or finds a variable to be matched with a term that may itself be a variable. In the former case, the iterated unification proceeds without any possible undesirable effect on the result. In the latter, we have three possibilities: the subterm may be identical to the variable with which it is being considered for unification; the subterm may be a variable, but different than the variable with which it is being matched; or the subterm may be other than a variable. In the first case, no substitution is required by the unification. The pointer is merely advanced immediately to the right of the identical variable pair. The variable does not occur to the right of the advanced pointer because it had occurred precisely twice at the fcth step. Thus the property still holds—each variable to the right of the pointer still occurs exactly twice. In the second case, we merely replace one variable by the other and advance the pointer. Before this replacement, each of the two variables occurred exactly once to the right of where the pointer will be after being advanced. Thus after replacing one by the other, and after advancing the pointer one position, one of the two variables is removed permanently from consideration while the other now occurs twice. Finally, in the last case we can classify the variables occurring in the subterm in question as being of two types. They are either paired in the subterm, or their second copy occurs to the right of the subterm and the variable with which it is being matched. We can ignore the possibility that the subterm contains an occurrence of the variable being matched since such would block unification and, by hypothesis, the unification succeeds. Again we merely replace the variable by the subterm and move the pointer one position to the right. The variable just matched is thus eliminated completely from occurring. The variables in the subterm that occurred twice therein had no additional copy, so they still occur twice to the right of the newly advanced pointer. Those that occurred once in the subterm had a second copy already present in the union to the right of the moved pointer, so each still occurs twice. Thus after the ( k + l ) s t unification has been accomplished and the corresponding substitution applied, we still have the desired property that each variable occurs precisely twice in the union of the two subexpressions to the right of the newly moved pointer. Since the condensed detachment is assumed to succeed, the iterated unifica tion must terminate after a finite number of steps. At that point, the union to the right of the pointer is precisely B' = (s)B, where B' is that which results from the continued but finite sequence of substitutions corres- ponding to the
492
Collected Works of Larry Wos
steps of unification. But B' must, therefore, be such that each variable occurs therein exactly twice, which completes the proof. We therefore have the following remark. Remark 7.3.8. If A is a pure formula, then all elements of CL(>1) are pure. Finally, in order to study the precise nature of CL(A) for the four choices of A in question, we introduce the following definitions. Definition 7.3.9. Let A be any pure formula of EC, and let C be any nonempty set of well-formed formulas of EC. Then C is called a containment set for A when: A is in C; all elements of C are pure; and C is closed under condensed detachment. Definition 7.3.10. Let A be any pure formula of EC, let C be any containment set for A, and let U be any nonempty set of well-formed expressions from EC. Then U is called a unification set for A and C when: every element of U is almost pure; every element of U contains exactly one isolated variable, which is denoted by w; and the successful unification of any element of U with any element of C yields a replacement term for w that is itself an element of C. (Although the first property of unification sets implies the second, we choose to have both given explicitly because of extensive use of isolated variables in the following sections.) The concept of unification set is introduced because of the close connection between condensed detachment and unification. Since the particular unification sets and the particular containment sets occurring in later sections are defined in terms of schemata, we do not restrict the application either of unification or condensed detachment to just the formulas of the equivalential calculus. In fact we shall in most cases be concerned with the application of either to var ious schemata. For example, if f(A) = E(E(x, A),x) and i(z) = E(z,z), the condensed detachment of f{A) with i(z) yields A. We can immediately give a trivial example of these definitions. Let A be any pure formula, let C be CL(i4), and let U consist of the single expression w. Then C is a containment set for A, and U is a unification set for A and C. Although we define a 'new' containment set and a 'new' unification set for each formula to be studied, we omit notationally their respective dependence on the formula in focus. A similar remark holds for the various schemata and kernels relevant to the corresponding study. 7.4. XJL In this section we prove that XJL = E(x, E(y, E(E(E(z, y), x), z))) is too weak to be a single axiom for the equivalential calculus. The proof proceeds by first letting XJL be denoted
New Use of an Automated Reasoning Assistant
493
by K. The schemata to be used in the definition of C are: (1) K = XJL = E{x,E(y,E(E(E(z,y),x),z))) (2) f(A) = E(y,E(E(E(z,y),A),z)) (3)g(B,A) = E(E(E(z,B),A),z) (4)i(A,B) = E(A,B) where A and B are pure formulas and also f(A), g(B, A), i(A, B) are pure. Definition 7.4.1. Let Co consist of K alone. For i = 0,1,2,..., let ci+i be the union of: d; all f(A) with A in CJ; all g(B, A) with A and B in Q ; and i(A, B) with /I and B in Q . Then let C equal the union over i of Cj. The schemata for U are: (1)™ (2)/(S) = £(y, £(£(£(*, i/),S),2)) (3)s(S,A) = E(E(£(z,S)M),*) (4)g(B,S) = E(E(E(z,B),S),z) (5) i(S, B) = E(S, B) (6)i(A,S) = E(A,S) where A and B are pure formulas and where S, f(S), g(S, A), g(B, S),i{S, B), i(A, S) are almost pure formulas with isolated variable w. Definition 7.4.2. Let U0 consist of the expression w alone. For i = 0,1,2,..., let Ui+i be the union of: t/r, all f(S) for S in U{; all g{S, B) for S in Ux and B in C; all g(B, S) with S in £/, a n d B in C; all i(5, B) and all t(B, S) with 5 in Ui and B in C. Then let £/ equal the union over i of Ui. Lemma 7.4.3. // the pair S in U and BO in C are unifiable, then the key replacement term t for the isolated variable w in S occurring in the unification is itself an element of C. Proof. Let 5 be an element of U and Bo be an element of C such that S and Bo are unifiable. Then 5 and Bo have a most general common instance. The proof is one of induction on the length of this most general common instance, where length is defined as the symbol count. If the length p is one, the lemma holds vacuously since all elements of C have length at least eleven. Next, assume by induction that the lemma holds for all unifiable pairs whose MGCI is of length less than p, and let 5 and Bo be unifiable with MGCI of length p. We conduct a case analysis on the possible classification of both Bo and S. The analysis is given in Table 2.
494
Collected Works of Larry Wos
TABLE 2. Piecemeal unification study for XJL
w
f(T) 9{A,T) i(T,A) i(A,T)
K K failure failure
T-B failure
f(T);A T;f(A)
9(T,B);A T;g(A,B)
f(B) f(B)
g(B,D)i(B,D) 9(B,D) failure T;B
T;i(i(A,B),D) i(i(T,B),D);a
i(B,D) g(B,T;D i(i(D,T),A);B T\B T;D
T h e proof of Lemma 7.4.3 is thus obtained. Lemma 7.4.3 establishes that U is a unification set for XJL and C. More important, this lemma enables us to prove the following theorem that in turn shows XJL too weak to be a single axiom for EC. T h e o r e m 7.4.4. The set C of formulas is closed under condensed detachment, and the only kernel, within alphabetic variancy, to be found in any element of Cis K = XJL. Proof. The proof is one of case analysis. We focus attention on the possible forms for the major premiss of the various cases of condensed detachment. Case 1. Assume the major premiss is K = XJL itself. (To conform to the definition of the various schemata under consideration, we assume throughout the proof that purity is present.) Since the condensed detachment of K with any A of EC yields f(A), the closure of C under condensed detachment is preserved when the major premiss is K itself. Case 2. Let the major premiss be f(A) with A in C. It is sufficient to remark that the condensed detachment of f(A) and B is g(B, A). Case 3. Let g(B, A) with B, A in C be the major premiss. For an arbitrary choice of D from the equivalential calculus as minor premiss, the condensed detachment question can be settled by considering the unification question for E(E(w, B), A) with D. The inference of interest is determined by the key re placement term yielded by the unification if such is successful—the term to be substituted for w. By definition, since B and A must be in C, E(E(w, B),A) is in U. When D is restricted to be an element of C, Lemma 7.4.3 forces the key replacement term in question to be in C. Thus C is closed under this set of condensed detachments. Case 4- Let E(A, B) be the major premiss for some A and B in C. Since A and B are by definition assumed to have no variables in common, the condensed detachment with some D in C will either fail or yield B, and again closure is preserved. This completes the proof of closure for C. T h a t the only kernel to be found in any element of C is K follows from the definition of the classes of elements comprising C, which completes the proof of the theorem. As with XBB in Section 7.2, we can examine the appropriate eight points.
New Use of an Automated Reasoning Assistant
495
They hold here also but, of course, with a consistent replacement of XBB by XJL. Thus we have proved XJL too weak. 7.5. X K E In this section we prove that XKE = E(x,E(y,E(E(x,E(z,y)),z))) is too weak to be a single axiom for EC. The proof proceeds as that for XJL. The schemata to be used in the definition of C are: (1) K= XKE = E(x, E(y, E(E(x, E(z, y)), *))) (2) f{A) = E(y,E{E(A,E(z,y)),z)) (3)g(B,A) = E(E(B,E(z,A)),z) (4)i(A,B) = E(A,B) where the usual provisos hold. The schemata for U are: {\)w (2)f(S) = E(y,E(E(S,E(z,y)),z)) (3)g(S,A) = E(E(S,E(z,A)),z) (4)g(B,S) = E(E(B,E(z,S))>z) (5) i(S, B) = E(S, B) (6)i(A,S) = E(A,S) where the usual provisos hold. For this C and this U, both dependent on XKE, we can prove the analogue to Lemma 7.4.3. Lemma 7.5.1. // the pair S in U and Bo in C are unifiable, then the key replacement term t for the isolated variable w in S occurring in the unification is itself an element of C. Proof. As in Lemma 7.4.3, this proof is by induction on the length of the most general common instance of S and Bo- Remark 7.2.6 again comes into play. Table 3 gives the results of the unification study. The proof of Lemma 7.5.1 is thus obtained.
Collected Works of Larry Wos
496 TABLE 3. Piecemeal unification study for XKE w
f(T) 9(T,A) 9(A,T) i{T,A)7 f(T);A i(A,T)
K K
failure failure failure g(B,T),A T;f(A)
HB)
f(B) T;B
failure failure T;i(B,i{A, D)) T;g(B,A)
9(B, D) 9{B,D) failure T,B T,D T;B
i(B,i(T,D));A
i(B,D) i(B,D) 9(T, B); D i(T,i{D,A));B t(A,i(D,r));B T;D
Lemma 7.5.1 establishes that U is a unification set for XKE and C. More important, we can prove Theorem 7.5.2 which shows XKE too weak to be a single axiom for EC. Theorem 7.5.2. C (which is dependent on XKE) is closed under condensed detachment, and the only kernel (within alphabetic variancy) to be found in any element of C is K = XKE. Proof. As in Theorem 7.4.4, we proceed by case analysis by focusing attention on the forms for the major premiss of the various cases of condensed detachment. The following summary suffices. The condensed detachment of K as major premiss with any A of EC is f(A). The CD of f(A) for any A in C with any B of EC is g{A, B). The CD of g(A, B) for A, B in C with some D in C reduces to the unification question of E(A, E(w, B)) with D, and Lemma 7.5.1 applies since this E(A, E(w, B)) is in U. And finally, the CD of i(A,B) with D for A and B and D in C either fails or is B. Examination of the definition of C shows that K = XKE is the only kernel therein, which completes the proof. One can immediately see that C contains CL(XKE) but does not contain E(x, x). So XKE is too weak to be a single axiom for the equivalential calculus. Again the key eight points hold as with XBB but with XBB replaced by XKE. We again have omitted the proof of the seventh point. 7.6. XAK The formula XAK = E(x, E(E(E(E(y, z), x), z), y)) is too weak to be a single axiom. This result can be established by defining a C and a U, each dependent on XAK, and proceeding as with XJL and XKE. The schemata to be used in the definition of C, which is shown to be a containment set for XAK by examining Tables 4 and 5, are: (1) K = XAK = E(x,E(E(E(E(y,z),x),z),y)) (2) f(A) = E(E(E(E(y,z),A),z),y) (3)g(A,B) = E(E(E(A,z),B),z) (4)i(A,B) = E(A,B)
New Use of an Automated Reasoning Assistant
497
where the assumptions present in the preceding subsections hold. The schemata for U. which is shown to be a unification set, are: (l)w (2) f(S) = E(E(E(E(y,z),S),z),y) (3)g(S,A) = E(E(E(S,z),A),z) (4)g(B,S) = E(E(E(B,z),S),z) (5) i(S, B) = E{S, B) (6)i(A,S) = E(A,S) where the assumptions of the preceding subsections hold. Tables 4 and 5 give the results of the unification study and the con- densed detachment study for XAK. This concludes the discussion of XAK. TABLE 4. Piecemeal unification study for XAK w
f(T) 9(T, A) 9(A,T) i(T,A) t(A,T)
K K failure failure failure f(T); A T;f(A)
f(B) f(B) g{B, D) T;B T;i(B,A) i(B,T);A T;g(A,B) 9(T, B)- A
g(B, D) i(B,D) i(T,D)-B T;B T;D T;i(i(B,A),D) i(i(B,T);A
i{B,D) 9{D,T)-B i(i(T,D),A);H i(i(A,D),T);B T;B T;D
TABLE 5. Condensed detachment study for XAK Major prremiss K
Condensed detachment with D in C reduces to
f(A)
unification of g(w, A) with D unification of i(i(A,w), B) with D B (if A and D unify; failure otherwise)
9(A,B) i(A,B) 7.7. BXO
We now come (in this paper) to the last of the four candidates for the status of shortest single axiom for EC, namely, BXO = E(E(E(E(x,E(y,z)),z),y),x). (In a second paper we dispatch the remaining three candidates, XCB and XHK and XHN. This task is accomplished by extending the method described in this paper.) The formula BXO is rather more interesting than its three predecessors in that immediately one deduces E(x, E{y, E(x,y))) from the condensed detach ment of BXO with itself. Thus a second kernel is quickly found. What may be surprising is the fact that no additional kernels exist. Hence we can conclude that BXO is also too weak to be a single axiom for EC, although the case analysis is somewhat more complicated. The schemata to be used in the definition of C, which is shown to be a
Collected Works of Larry Wos
498 containment set for BXO, are: (1) K = BXO = E(E(E(E(x,E(y,z)),z),y),x) (2) f{A) = E(E(E(A,E(y,z)),z),y) (3)g(A,B) = E(E(A,E(B,z)),z) (A)i(A,B) = E(A,B) (5)K' = E(x,E(y,E(x,y))) (6)h(A) = E(y,E(A,y)) (7)j(A)=E(E(z,E(E(A,z),y)),y) (8)n(A,B) = E(z,E(E(A,z),B))
where the assumptions of the preceding subsections hold. The set C is the mini mal set generated by K and K' and closed under the operations of /, g, h, i, j , n, which is just the analogue of the definitions of the corresponding C for XJL, XKE, and XAK. The schemata for U, which is shown to be a unification set, are: (l)u; (2) f(S) = E(E(E(S,E(y,z)),z),y) (3)g(S,A)=E(E(S,E(A,z)),z) (4)g(B,S) = E(E(B,E(S,z)),z) (5)i(S,B) = E(S,B) (6)i(A,S) = E(A,S) (7)h(S) = E(y,E(S,y)) (8) j(S) = E(E(z,E(E(S,z),y)),y) (9) n(S, A) = E(z, E(E(S, z), A)) (10) n(B,S) = E(z,E(E(B,z),S)) Essentially, U is the set generated by w and closed under the operations repre sented by schemata 2 through 10, which is just the analogue of the definitions of the corresponding U for XJL, XKE, and XAK. TABLE 6a. Unification table for U and C w
f(T) 9(T,A) 9(A,T) i(T,A) i(A,T) h(T) 3(T) n(T,A) n(A,T)
K K T;K' T;j(A) 3{T)\A T;f{A) f(T);A failure failure failure failure
f(B) f(B) T;B T;i(B,h(A)) i(B,h(T));A T;g(B,A) 9(B,T);A failure failure failure failure
g(B, D) g(B, D) i(T,h(D));B T;B T;D T;i(B,i(D,A)) i(B,i(D,T));A failure i(T,B);D failure failure
i(B, D) i(B, D) 9(T,D);B i(T,i(A,D));B i(A,i(T,D));B T;B T;D i(T,B);D n(T, D); B i(i(T,B),A);D i(i(A,B),T);D
New Use of an Automated Reasoning Assistant TABLE 6b. Unification table for U and C w
K' K'
f(T) 9(T,A) 9(A,T) i(T,A) i(A,T) h(T) J(T) n(T,A) n(A,T)
failure failure failure h(T);A T;h(A) failure failure h(T);A T; h(A)
h(B) h(B) failure failure failure i(B,T);A T;i{B,A) T;B
failure i(T,A);B i(A,T);B
3(B) 3(B) failure i(B,T);A T;i(B,A) T;n(B,A) n(B,T)-A failure T;B
n(B, D) n(B, D) failure failure failure i(i(B,T),D);A T;i(i(B,A),D) T;i(B,D) failure
failure failure
T;B T;D
TABLE 7. Condensed detachment study for BXO w
K K
J(B) f(B)
f(T) 9(T..A) 9(A,T) i(T,A) i(A,T) h(T) 3(T) n(T,A) n(A,T)
T-K' T;j(A) j(T);A f(T);A f(T);A failure failure failure failure
T;i(B,h(A)) i(B,h(T));A 9(B,T);A 9(B,T);A failure failure failure failiure
T;B
9(B,D) 9(B, D) i(T,h(D));B T-B T;D
i{B,i{D,T));A i(B,i(D,T));A failure i(T,B);D failure failure
i(B,D) i(B,D) 9(T,D);B i(T,i(A,D));B i(A,i(T,d))-B T;B T;d
i(T, B); D n(T,D);B i(i(T, B), A); D i(i(A,B),T);D
TABLE 7 (contd.). Condensed detachment study for BXO
w
K' K'
f(T) 9(T,A) 9(A,T) i(T,A) i(A,T) h(T) 3(T) n(T, A) n(A,T)
failure failure failure h(T);A T;h(A) failure failure h(T)\A T;h(A)
h(B) h(B) failure failure failure i(B,T);A T;i(B,A) T;B
failure i(T,A)-B i(A,T);b
3(B) f(B) failure i(B,T);A T;i(B,A) T;n(B,A) i(i(B,T),d):A failure T; B 7 failure failure failiure
n(B, D) n(B, D) failure failure failure i(i(B,T),D);A T;i(B,D) T;B T;D
500
Collected Works of Larry Wos Major premiss
K f{A) 9(A,B) i(A,B) K' h(A) !{A) n(A,B)
Condensed detachment with D in C reduces to unification of f(w) with D unification of g(A, w) with D unification of i(A, i(B, w)) with D B (if A and D unify; failure otherwise) h(D) i(A,D) unification of n(A, w) with D i(i(A,D),B)
Tables 6 and 7 give the results of the unification study and the condensed detachment study for BXO. This concludes the discussion of BXO except for one important point. The point is that we must modify the fifth of the standard eight points, namely, there are two kernels present in the theorems deducible from BXO. They are BXO itself, which is usual for this study, and E(x, E(y, E(x, y))). It is the presence of this second kernel that makes this study of BXO rather more interesting. 8. Conclusions We have shown here how the automated reasoning program AURA (Auto mated Reasoning Assistant) [24] provided invaluable assistance in answering certain previously open questions in formal logic. Because we were able to find the answers, and because the study led to discovering additional uses for an automated reasoning program, we are actively seeking other open questions like the following. What is the full set of theorems deducible from a given formula or set of formulas? For a given set of formulas and a given domain, does that set axiomatize the domain? Are the elements of the set independent? Can an alter native and/or a shorter proof than that which is known be found for a specified theorem? Can a proof be found for a purported theorem? Can a counterexample be found for a given conjecture? Can a model, especially a small finite model, be generated for a set of axioms? The specific questions answered in this paper were taken from the equivalential calculus. We proved here that each of the four formulas, XJL, XKE, XAK, BXO, is too weak to be a shortest single axiom for that calculus. All four proofs rely on one me;thod-a method that permits studying the entire set of theorems that can be deduced from each of the formulas. We were able with this method to examine the infinite domain of deducible theorems in each of the four cases by finding a finite presentation. We in fact found, for each of the four, a finite set of schemata that proves that certain well-known theorems of the calculus are not present even as subexpressions of any of the theorems. The information was obtained without recourse to any special programming, which suggests that the program AURA in its present state may prove useful to those interested in conducting various types of research but without the burden of programming.
New Use of an Automated Reasoning Assistant
501
We have Included various details relevant to the automated reasoning tech niques that were employed in this study with the intention of suggesting ad ditional uses for AURA and for similar programs. For example, an automated reasoning program can assist in formulating concepts and related conjectures. In particular, both the concept of kernel and the corresponding conjectures for the four formulas studied here resulted directly from the use of the procedure of demodulation in its function of simplification [32]. Demodulation was also used in a nonstandard fashion—used to encode procedures for counting symbols and for classifying formulas, for example. We caution the researcher about such nonstandard usage of demodulation, for there is the potential of making unsound inferences if used with insufficient care [28,36]. To dispel the possible notion that the method employed in Section 7 relies on the weakness of the formulas discussed there, note that the same method can be applied to both sides of the question; that is, it can also be used to prove a formula strong enough to be a single axiom [29] when that is the case. In fact two new shortest single axioms for the equivalential calculus have been found. The method, with the assistance of the automated reasoning program AURA, has also been used to answer certain previously open questions in both the R-calculus and L-calculus [5]. Thus, at least in this context, the method has the property of correctly establishing either adequacy or inadequacy for the property of being a single axiom. The nature of the methodology presented in this paper leads us to conjecture that in no way is it dependent specifically on the equivalential calculus. The suc cessful examination of infinite domains gives rise to the thought that a number of the techniques may well apply to other areas of formal logic and perhaps to other areas of mathematics. In view of the successes cited here, researchers from diverse and unrelated fields might strongly consider using a computer program that functions as an automated reasoning assistant. Appendix A. Piecemeal Unification Unification, as well as piecemeal unification, considers two expressions and seeks a substitution for their variables that, if applied, yields two identical expressions. The distinction between (ordinary) unification and piecemeal unification resides in the possible outcomes of a single application of the corresponding algorithm. A single application of ordinary unification immediately either yields failure or yields a substitution of the desired type. A single application of piecemeal unification, on the other hand, either yields failure, or yields a substitution of the desired type, or yields a further problem for piecemeal unification. Of the three possible outcomes, the third is that which requires special treatment. The following questions are answered in this section. Why must the third possibility, that of yielding a further piecemeal unification problem, be consid ered? Why is ordinary unification insufficient? Is it necessary to augment the automated reasoning program to cope with the third possible outcome of piece-
502
Collected Works of Larry Wos
meal unification? If not, what technique exists within the present program for handling the task? What steps are taken to prevent the combination of piece meal unification and schematic notation from skipping certain unifications that would succeed if considered by ordinary unification? Does piecemeal unification terminate for each pair of schemata? If it does terminate, what are the possible results? Can one determine that all schemata—those needed to complete the closure arguments—have been found? As for the first question, the need arises from the fact that schemata are being considered for unification rather than individual formulas from the equivalential calculus. Some of the discussion of Section 6 and also the tables of Section 7 focus on the unification of a pair of schemata, one representing elements from a unification set U and one representing elements from a containment set C. For example, in the study of XAK, the pair f(T) from U and i(B, D) from C must be considered for piecemeal unification. The crux of the problem is that piecemeal unification ultimately rests on ordinary unification. If ordinary unification were applied directly to i(B,D) and f(T), the outcome would be failure. After all, the symbols i and / are distinct function symbols. In actuality, however, i and / are definitional function symbols that arise from the methodology resting on schemata. The symbols, B, D, and T, are not symbols of the equivalential cal culus, but are instead metavariables whose values are formulas of EC. It would be erroneous to simply accept failure. The correct result of the unification de pends on the 'values' of B, D, and T. If, for example, B is XAK itself, then, regardless of the values for D and T, an ordinary unification fails. In contrast, if for example T is the variable w and B is g(D, B'), then ordinary unification succeeds and yields a substitution of B' for w—when, of course, the functions are expanded in terms of E and the appropriate variables. In other words, if a condensed detachment were under consideration and the corresponding unifica tion was that just given, then the result would be the formula B', regardless of the specific formula denoted by B'. Thus ordinary unification is not sufficient, which answers the second question that we posed, and we have an example of the need for piecemeal unification, which answers the first question. In partic ular, as will be seen, the piecemeal unification of i(B, D) with f(T) yields the further unification problem of Swith g{D, T). The answer to the third question is that it is unnecessary to augment the automated reasoning program. Rather, the following technique suffices, which answers the fourth question. For piecemeal unification, the functions, f,g,i, ..., that denote the various schemata are replaced by the corresponding definitions—the definitions in terms of the function E and the required variables. Similarly, each kernel, K or K', is replaced by its definition. The arguments of the schemata, on the other hand, remain as A,B,D,T, .... (A technique, implemented purely within the input language of the reasoning program, could have been employed to automate the expansion of the functions f,g,i, ..., and the kernel(s), rather than adding the expansions by hand to the input.)
New Use of an Automated
Reasoning
Assistant
503
Two nuclei, employing the predicate UNIFY, are relied upon for piecemeal unification, where the predicate UNIFY is a two-place predicate that holds respectively the two expanded schemata to be unified. - U N I F Y ( £ ( x , y), E(x, z)) UNIFY(y, z) and -UNIFY(£(x, z), E(y, z)) UNIFY(x, y) The first of the two nuclei attempts to unify (in the ordinary sense) the lefthand arguments of the two terms being considered for piecemeal unification. If successful, the derived clause gives the 'new' unification problem to be solved. In other words, a success with the first nucleus reduces the original unification problem to the unification of two 'new' terms. The second of the two nuclei plays a role similar to the first except that the righthand arguments of the two schemata are considered for possible unification (in the ordinary sense). (The method given here is an improvement over that which was actually used in the study.) T h e process is initiated by starting with a unit clause that encodes the pair being considered. Since the chosen example is that of the piecemeal unification of i(B, D) with f(T) from the XAK study, we have UmFY(E(E(E(E(y, z),T), z), y), E(B, D)) as the unit clause that initiates the process. The (ordinary) unification of the unit clause with the first nucleus fails—fails because, from standard unification theory, the constant B does not unify with E(E(E(y, z), T), z). In other words, the first argument of i(B, D) does not unify with the first argument of f(T), that is, when viewed from standard unification theory. On the other hand, the second nucleus does unify with the unit clause, yielding UNIFY (E{E{E{D, z), T), z), B) In the schematic notation, this clause says that the the third possibility for piece meal unification has occurred—that the original unification problem has been reduced to a further unification problem. The new problem is that of unifying B with g(D,T), as evidenced in the XAK table. (This notational interpreta tion could be automatically obtained by including an additional nucleus and appropriate demodulators.) The given example is typical of many entries found in the tables of Section 7. However, for others, a number of such binary resolutions are needed before obtaining the corresponding entry in the table. Briefly, in such cases, a depthfirst search, one that continues until no further clauses are found, suffices to yield the entry found in the corresponding intersection of the row and column of the table. The depth-first search starts with the unit clause that encodes the pair under consideration for unification; resolves the unit with the appropriate nucleus, yielding a unit clause; takes the output and resolves again with the appropriate nucleus; .... The unit clauses yielded in this search do not necessarily preserve the order of the arguments—force the first to be a schema representing elements of U and the second to be a schema representing elements of C. For example, if the pair under consideration is i(T, A) and K from the XAK study,
504
Collected Works of Larry
Wos
then the piecemeal unification yields UNIFY{/1, E(E(E(E(y, z), T ) , z), y)) stating that the new pair is f(T) from U and A from C. A depth-first search is not necessary, but allows one to easily locate the desired output. Such a search is especially convenient when the intent is t h a t of generating the entire table in a single run. The piecemeal unification of f(B) with f(T) in the XAK study is an example of the case in which more than one binary resolution is required. In addition to the cases already cited, there are other piecemeal unifications that do not behave quite so simply—that are not covered by employing just the two given nuclei. For example, the piecemeal unification of i(A, T) with i(B, D) requires additional nuclei, since A, B, D, and T are metavariables. T h e two nuclei given earlier do not allow for the case in which A and B are unifiable expressions. When A and B do unify, their unification has no effect on the outcome of piecemeal unification because none of their variables occur elsewhere. To cope with such unifications and thus answer the fifth question that we posed, we add -UNIFY(E(x, y), E(z, w)) UNIFY(y,UTEST(x, z, w)) and - U N I F Y ( £ ( x , y), E(z, w)) UNIFY(a;,UTEST(y, w, z)) and the nonstandard demodulators (with EQUAL as the impetus for the pro gram to classify the corresponding clause as a demodulator) EQUAL(UTEST(/1, B, w), w) EQUAL(UTEST(B, A, w), w) EQUAL(UTEST(.4, D, w), w) EQUAL(UTEST(D, A, w), w) E Q U A L ( U T E S T ( 5 , D, w),w) EQUAL(UTEST(£>, B, w), w) and (in the event that none of the given demodulators applies) EQUAL(UTEST(x, z, w), discard) to discard the attempt to find either an A and B or another pair to unify, and the subsumer clause UNIFY(a;, discard) to subsume away discards. Thus, for example, if i{A,T) and i(B,D) are under consideration for piece meal unification, we begin with the unit clause
UmFY(E(A,T),E(B,D)) We derive UNIFY(T,UTEST(,4, B, £>)) which immediately demodulates to
New Use of an Automated
Reasoning
Assistant
505
UNIFY(T, D) the desired unification task. The piecemeal unification question for the pair i{A,T) and i{B,D) is thus reduced to one for T and D. Note that such a reduction is intended to yield a pair of schemata, one representing elements from U and one representing elements from C, to be considered for further unification. Since the schema from U must contain the metavariable T, T must be present in the reduced unification. Therefore UTEST does not unify T with any of A, B, or D, for such an action would eliminate T from the derived unification. In a somewhat similar spirit to that of the UTEST technique, demodulators can be added to test for failure of unification (the nuclei given do not lead to an explicit statement that the unification task fails). Finally, we point out. that the conversion from schematic notation such as UNIFY(/(T),z(B,£>)) to the expanded notation in terms of £ ' s and variables and back again can be accomplished with the use of additional nuclei and demodulators. For the sixth and seventh questions of this section, note that piecemeal uni fication does terminate for any pair of schemata. This termination is reflected in the tables of Section 7. In particular, if a pair is selected from a row and column of the table, one can trace that pair through the various cases, ascertaining that the table is closed. As for the results, piecemeal unification can be seen from the tables to result in failure, success with the resulting outcome, or reduction to a related unification problem. Of course, to obtain the specific formula that results from a successful unification, it is necessary to choose specific instances of the schemata in question—to choose specific formulas and then rely on the schematic notation of the tables. For the final question, inspection of a run employing the preceding techniques determines whether or not all needed schemata have been found. Such a run will generate but a finite number of clauses. If some schemata were missing from the proposed list, then an expression would be found at the end of a (local) depthfirst search that was absent from the list. If no such expression is present, then the list of schemata is complete. We close this section by remarking that ordinary unification would not have sufficed, for the set of derivable formulas is infinite. The study requires the examination of the full set of derivable theorems, and thus the need for the schemata and the corresponding need for piecemeal unification. A p p e n d i x B . D e m o d u l a t i o n : O v e r v i e w and Its A p p l i c a t i o n t o Equivalential Calculus In this section, we begin with a brief review of demodulation in general, and then discuss certain aspects pertinent to our treatment. We then turn to vari ous applications of demodulation—applications that include counting symbols, classifying formulas, and assisting in finding needed schemata. (Certain of the applications rely on a nonstandard use of demodulation, and we again caution
506
Collected Works of Larry Wos
the researcher about such usage for it can result in unsound inferences if insuf ficient care is exercised.) These applications were discovered during the study of the equivalential calculus. B.l. Review Demodulation [32] is a technique that is usually employed to modify a clause by means of equality substitution. T h e modifications or rewrites are affected by employing certain unit equality clauses, termed demodulators, chosen by the user or by the program. For example, in the presence of the demodulator EQUAL(a, b) the clause P(f(a)) is demodulated to P(f(b)). Here an occurrence of the left side of the demodulator is automatically replaced by the right side of the demodulator. As a more interesting example, a clause may be modified by use of a proper instance of a demodulator. T h e clause P{g(a, b)) in the presence of the demodulator EQ\JAL(g(a,x), h(x)) is demodulated to P(h(b)). Hence, demodulation is not simply equality substitution. Nor is demodulation a gen eralization of the equality substitution rule, for the clause being considered for modification must not be instantiated during the modification. Thus the clause P(g(x,y)) is not modified by the demodulator EQUAL(g(a, y),h(y)) because the term g(x, y) is not an instance of the left side of the demodulator. Whenever a clause is demodulated, the undemodulated form is discarded. The undemodulated form of a clause can be viewed, in many cases, as semantically redundant. By removing such clauses, efficiency can be greatly enhanced. Demodulation has been recently used (in a nonstandard fashion) to remove clauses once their presence has been deemed unneeded [28]. In case analysis, for example, once a particular case has been completeed, certain information is purged when classified as relevant only to that case. B . 2 . T h e t r e a t m e n t in A U R A Demodulation admits of a number of options of which we have implemented the following. If more than one demodulator is applicable to a given term in a clause, only one path of demodulation is followed. Of two demodulable terms in a clause the rightmost one is demodulated first. In particular a subterm is demodulated before the containing term is considered for demodulation. If two demodulators are applicable to one term, then the demodulator that was input first is applied. A clause is demodulated repeatedly until no further demodulators apply, and only then is considered to be in final form (the intermediate demodulants are discarded). Certain implementation features prevent the program from looping, as can occur in the presence of various sets of demodulators. Before turning to the applications of demodulation pertinent to this paper, one final feature of the program must be mentioned. There exist various builtin functions that are employed in obtaining some of the information presented here. T h e functions $SUM and SCOMPARE are the ones in question. If the
New Use of an Automated
Reasoning
Assistant
507
arguments of $SUM are both integers, then demodulation automatically yields their sum. If the arguments of SCOMPARE are both integers, then demodula tion automatically yields + 1 when the first argument is greater than the second, -1 when the second is greater than the first, and 0 when they are equal. B . 3 . Applications By using demodulation in a nonstandard fashion, three obstacles were overcome during the study of the equivalential calculus. The three are: 1. counting the number of occurrences of the function E in a formula derived by condensed detachment, and then comparing that count with those of its immediate parents; 2. classifying a formula according to a given classification scheme; 3. searching for the required schemata, and then employing the correspond ing notation. In each of the three applications, we wished the use of condensed detachment to be such that the resulting clause would retain both the derived formula and the appropriate related information. Thus, for example, we preferred that a successful application of CD to the pair of formulas A and B yields a clause containing both the derived formula and the number of E's occurring in the formula. We employ a predicate DEDUC whose first argument contains the formula while the second contains the related information. Thus D E D U C ( £ ( x , E{E(E{E(y, z),x), z), y)),5) states that the formula denoted by XAK contains 5 occurrences of E. We employ a nucleus, resembling that of Section 3.2, for condensed detach ment. This nucleus examines only the first argument of the predicate DEDUC when applying CD. -DEDUC(£(x,y),i;) -DEDUC(x, w) DEDUC(y,COUNT(t/)) For example, if the condensed detachment of two formulas A and B is the formula D, and if the respective number of E's in each is m and n, then the nucleus derives from DEDUC(A, m) and DEDUC(B, n) the clause DEDUC(£>,COUNT(D)) where A and B and D are all expressed in terms of E and the appropriate vari ables. Rather than retaining the clause as shown, the program then demodulates COUNT(L>) to the desired count by means of the counting demodulators that we now give. B.4. Counting For the task of counting symbols, we have two simple rules and correspondingly two demodulators that apply them. The first rule is that the count for a formula
508
Collected Works of Larry Wos
of the form E(fl, /2) is the sum of the counts for the two subformulas, plus one for the containing E. For this rule, we write the demodulator EQUAL(COUNT(£(i,y)),$SUM($SUM(COUNT(x),COUNT(y)),l)) Recall that $SUM of two integers demodulates to their sum. The second rule is that the count for a variable is zero: EQUAL(COUNT(x),0) If, for example, the derived formula D has 11 E's, then the derived clause DEDUC(D,COUNT(D)) is demodulated with the use of these two demodulators to DEDUC(£>,11) as desired. Note the following important point about the order of the demodulators used for counting. The second demodulator, standing alone, would apply to COUNT of any expression—variable or otherwise. Therefore, to trap each nonvariable expression and give it the correct count, we input the two demodulators in the given order. The second demodulator is applied only when the first fails to apply, that is, when the argument of COUNT is not of the form E{d\, ^2) for some formulas di,d?. This occurs only when the argument of COUNT is a variable. If the two demodulators were interchanged, then terms that were not variables would be given counts of 0. (Note that if we permitted multiple-path demodulation, each formula would be given many counts ranging from 0 to the correct value.) Notice that the first demodulator is recursive in the function, COUNT. By this use of recursion, we need only prefix the entire formula under study by the one occurrence of COUNT, thus avoiding the necessity of placing COUNT in front of each of the subterms. In a certain sense, the demodulation then works from outside in, for the recursion propagates the COUNT function appropriately to the various subterms. The automated counting of symbols just exemplified can be made still more useful in the following way. Recall that we conjectured, when first studying the formula XAK, that no derived formula would be shorter than both immediate parents, and that we wished to test this conjecture by relying on the program. To relegate the task to the program, we replace the two-place predicate DEDUC previously discussed with a four-place predicate R. The last two positions are present to retain the comparisons of count with that of each of the immediate parents. To place the count and the comparisons in the predicate R we use the following nucleus. -R(E(x, y), vcount, vl, v2) — R(x, wcount, wl,w2) i?(y,COUNT(y),$COMPARE(COUNT(y),vcoune), $COMPARE(COUNT(y), wcount)) Thus, for example, if the derived formula D has 9 E's and each parent has 5, the clause .R(ACOUNT(£>),$COMPARE(COUNT(£>),5), $COMPARE(COUNT(£>),5)) is derived and immediately demodulates to R(D, 9,1,1). (Recall that the $COMPARE function demodulates to 1 if the first argument is greater than the second,
New Use of an Automated
Reasoning
Assistant
509
-1 if lesser, 0 if equal.) We searched the output from the program for an occur rence of -1,-1 that, if found, signifies the presence of a derived formula shorter than both parents. Such an occurrence was found, thus refuting the conjecture. (Note that we have presented a method improved over that originally used in the study.) B . 5 . Classifying The task of classifying derived formulas arose when seeking a shorter proof, see Section 5. As in the case of symbol counting, we have the program place the classification information and the derived formula within a two-place predicate DEDUC. Thus the clause DEDUC(£(a;,x),l) states that the formula E(x,x) is of class 1, where 1 stands now for 'class 1' defined shortly. The following nucleus is used to derive a formula by condensed detachment, and simultaneously place the corresponding class number in the clause contain ing the derived formula. -DEDUC(E(x,y),t;) -DEDUC(x,w) DEDUC(y,CLASS(y)) We now define the classes, and then give the demodulators used to determine them. Designate those formulas that are of the form E(x,t) to be of class 1, where x is some variable and t is some expression. Designate the formulas of the form E(s, y) that are not of class 1 to be of class 2, where s is an expression and y is a variable. (We wish the classes to be disjoint, so we force E(x, x), for example, to be of class 1 and not of class 2.) Class 3 formulas have the form E(E(x, y), t). Class 4 formulas have the form E(s,E(x,y)). The definitions of classes 5, 6, and so on proceed similarly. Of course, no assumption is made in classes 3 and 4 of distinctness of variables. We continue to impose the requirement that the classes be disjoint. We proceed now to the demodulators. For each term and subterm of each generated formula, we must be able to determine its status—that of being a variable or not a variable—in order to correctly classify the formula. The de modulators, which are applicable only after the way has been prepared (and which are given shortly), are: EQUAL(IFVAR(£(x, y)), false) which applies when the term is not a variable, and EQUAL(IFVAR(x), true) which applies when the term is a variable. The function IFVAR means 'if its argument is a variable'. It may seem that, at least intuitively, the two demod ulators are in the wrong order. However, it is vital that these be applied in the order given so that the correct status will be found. After all, the second applies to all formulas. So if the order were reversed, terms that are not variables would be classed as variables. (Note that if we permitted multiple-path demodulation, the fact that a term was not a variable would be assigned both 'true' and 'false'.) If the first demodulator does not apply, then the formula (or subformula) being demodulated must not have the form E{d\,di). Hence it must be a variable. Because of the limited forms the formulas can take, one of the two demodulators
510
Collected Works of Larry Wos
must always apply. The following are used for the task of assigning the correct class number. Here we shall assume that those formulas that are not in the union of classes 1 to 4 are to be assigned class number 5. We begin with EQUAL(CLASS(£(:r, y)),EVAL(IFVAR(a;),IFVAR(y),E(a;, y))) where the three-place function EVAL will, with the aid of other demodulators, return the class number. But EVAL also holds the formula in question. The two preceding demodulators will now apply to test the two arguments of the (sub)formula under study. To proceed further with the task of assigning the correct class number, we need demodulators to use the information yielded by the two demodulators for the function IFVAR. We have EQUAL(EVAL(true,t;, tu),l) which applies when the wff should be assigned the class number of 1; EQUAL(EVAL(false,true,tu),2) which applies when the class number is 2; EQUAL(EVAL(false,false,£(£(zl, x2), E(yl, y2))), EVAL2(AND(IFVAR(xl),IFVAR(x2)),AND(IFVAR(yl),IFVAR(y2)))) which applies when the class number is greater than 2. Formulas that are not of class 1 or 2 need to be processed further. We there fore have demodulators to use the information yielded by the last demodulator, and we have EQUAL(AND(true,x), x) EQUAL(AND(false,a:),false) EQUAL(EVAL2(true,u),3) which assigns the class number of 3 for the wffs whose first argument is sxiE of two variables, (and of course not of class 1 or 2); EQUAL(EVAL2(false,true),4) which assigns class 4 for the wffs whose second argument is an E of two variables; and EQUAL(EVAL2(false,false),5) which assigns class 5 to the remaining wffs. Notice that the requirement of demodulating inside out is important, for the EVAL demodulators are applied only after those for IFVAR. B.6. Searching for schemata We consider finally the task of finding the needed schemata for studying a partic ular formula. The process is iterative. We begin with a technique for identifying all occurrences of the kernel K that occur in derived formulas. The technique is designed to also replace those occurrences by K. In the spirit of the preceding sets of demodulators, we use the nucleus -DEDUC(E(x,y),v) -DEDUC(x,to) DEDUC(y,ABBREV(y)) to derive, for the condensed detachment of two parent formulas, the clause
New Use of an Automated Reasoning Assistant
511
DEDUC(D,ABBREV(£>)) By way of example, let us assume that XAK is under study. The following demodulators are then used to demodulate ABBREV(£>) to the desired notational form. The demodulator EQUAL(ABBREV(£(a:> E{E(E{E(y, z), x), z), y))), K) identifies an occurrence of the kernel K. Examination of the output from a run employing the given demodulator leads to the observation that additional schemata are present. Where the func tion / is chosen to represent the next schema, the demodulator EQUAL(ABBREV(£(£(£(£(y, z),x), z), y)), /(ABBREV(x))) identifies an occurrence of the schema / and also prepares the way for other demodulators to apply. The applications of other demodulators rewrite, when possible, the argument of / to K or to /(y) or .... Similarly, the demodulator EQUAL(ABBREV(£(£(£(y, z),x), z)), 5(ABBREV(y),ABBREV(a;))) identifies the occurrences of g, while preparing the way for other demodulators to apply to either of its arguments. In the case that none of the given demodulators applies, the demodulator EQUAL(ABBREV(£(x, y)), £(ABBREV(x),ABBREV(y))) pushes the search for schemata recursively deeper into the formula. Finally if even this demodulator does not apply, then the ABBREV function captures a variable by means of the demodulator EQUAL(ABBREV(x),i) and returns just that variable as the correct notation. If the demodulators for / and g are omitted (as was the case in the first such run in the study of XAK), then the occurrences of K are replaced by K while the remaining schemata are expressed in terms of E's and variables. If a run is made with the possibly incomplete set of schemata, /,g, ..., the expressions that remain unnamed point to the needed missing schemata. The use of the schematic notation does not block any applications of condensed detachment. To see this, recall that ABBREV(XAK), and not XAK itself, is the term that is demodulated to K. The technique does not affect the first argument of DEDUC, and thus the formula contained in the first argument is free to participate in condensed detachment. (We have presented here a method improved over that used in the original study.) Appendix C. Derivation Length and UR-resolution In seeking a shorter proof, one approach consists of singling out particular steps of a known proof and attempting to find shorter derivations of those steps. To see how such an approach can be implemented, let A be one such step in the known proof. Let the derivation length of A in that proof be m. The components of automating the attempt are: a means for encoding the length m; a means for computing the derivation length of an alternative path to A; and a means to signify that a shorter derivation of A has been found.
512
Collected Worics of Larry Wos
To encode the known derivation length m of A, we write DEDVC(s(s(...s(z)...)),A) where the function s is the successor function and occurs precisely m times. This clause is an input clause in which the two-place predicate DEDUC is such that its first argument holds the length information while the second holds the formula itself. To compute the actual length of the derivation of a formula A is a rather complex process. We are content to present that which was used in this study, namely, the computation of the level of an occurrence of a clause. The level of an occurrence of a clause often closely approximates the length of the derivation of that clause. To compute this approximation, a number of techniques are required. For each of the formulas B that were used as input in deriving the known proof, we proceed similarly by writing DEDUC(2, B) where the variable z as the first argument of DEDUC states that the formula B has derivation length 0. (We denote the derivation length of 0 by the variable z and other derivation lengths by the appropriate number of occurrences of the function s followed by z in order to have the program easily signify that a shorter derivation has been found. This notation also allows the occurrence of a clause with longer derivation to be purged. The means, as will be seen, is via subsumption. Were we to employ the more natural notation of, say, 0 and the like, subsumption would have no effect and the nucleus given shortly would require modification.) For each such formula B, the corresponding clause is added to the input to the program. Next, we employ a clause that permits the program to apply the sole infer ence rule, condensed detachment, of this study while simultaneously performing a computation closely related to that for derivation length. The needed clause -DEDUCE, E(x, y)) -DEDUC(z,x) DEDUC(s(z),x) (1") is reminiscent of clause (1) of Section 3.2. The clause -DEDUCIBLE(£(x, y)) -DEDUCIBLE(x) DEDUCIBLE(y) (1) together with UR-resolution permits the program to apply condensed detach ment. Before illustrating the effect of using (1"), we review the mechanism behind using (1). The inference rule of UR-resolution takes n + 1 clauses, n of which are unit clauses (contain but one literal each), and yields (if successful) a unit clause. The n + 1st clause must contain n + 1 literals. Condensed detachment takes two formulas and, if successful, yields a formula. With CD, the two premisses are tacitly assumed to have no variables in common, and thus a unification must take place to complete the inference. With this brief review of the mechanisms behind the use of (1), we turn to an illustration of the use of (1"). Let B and C be formulas from which the original proof was derived. For the length-derivation computation, we input D E D U C E S ) (2") and DEDUC(z,C) (3")
New Use of an Automated
Reasoning
Assistant
513
where the two clauses are tacitly assumed to have no variables in common. Recall t h a t B and C are of the form E(S,T) and E(S',V). Now assume that B and C successfully condense detach, yielding D. Consider the UR-resolution of (1") with (2") and (3") unified respectively with the first two literals of (1"). The result DEDUC(s(2),£>) (4") states that the CD of B with C yields D, and that the approximate derivation length of D is 1. (In actuality, as discussed in Section 5, this process calculates the level of a derived clause, where the level is one greater than the levels of the immediate ancestors.) For a more complex illustration of the effect of using (1"), let (2") and (3") be respectively replaced by DEDUC(s(s(s(z))), B) (2") and DEDUC(s(s(z)),C) (3") where the respective first arguments state that the approximate derivation lengths, (levels), are 3 and 2. The UR-resolution of (1") with the 'new' (2") and (3") in that order yields DEDUC(s(s(s(s(z)))),D) (4") which states that the approximate derivation length of D is 4. To see that the new (4") will result from the UR-resolution, first keep in mind that the new (2") and the new (3") are assumed to have no variables in common. Next note that the required unification will force the variable z of the new (3") to be replaced by s{z). Thus, the program will compute with this process the approximate derivation length, actually level, of each occurrence of each derived clause. It will correctly do so if the derivation lengths are input or are present as a result of earlier computations within the run. One final task remains, that of signifying that a shorter derivation has been found. The key is subsumption. If a copy of A is derived with fewer than m occurrences of the function s, then the new copy will subsume the input copy of A. If a new copy of A is derived with more occurrences than m, then the new copy will be subsumed by the input copy. If the number is precisely m, then one of the two identical copies is purged, again by subsumption. Of course, if a second copy is found with even fewer occurrences of s, then that latter copy will be preferred by subsumption over the original, and the first copy will be purged. The procedure given in this section gives only an approximation of the de sired information since the computation is actually one of level and not of deriva tion length. For example, if the immediate ancestors of a derived clause each have level 4, then the derived clause has level 5. But the derivation of that derived clause is often 9. Nevertheless, the technique is quite useful.
Collected Works of Larry Wos
514
REFERENCES 1. Allen, J. and Luckham, D., An interactive theorem-proving program, in: B. Meltzer and D. Michie (Eds.), Machine Intelligence 5 (American Elsevier, New York, 1970) 321-336. 2. Belnap, N., The two-property, Relevance Logic Newsletter 1 (1976) 173180. 3. Kalman, J., Substitution-and-detachment systems related to abelian groups; with an appendix by C.A. Meredith, in: A Spectrum of Mathematics, Essays Presented to H.G. Forder (Auckland University Press, Auckland, 1971) 22-31. 4. Kalman, J., Computer studies of T -> - W - I, Relevance Logic Newslet ter 1 (1976) 181-188. 5. Kalman, J., Axiomatizations of logics with values in groups, J. London Math. Soc. 14 (1976) 193-199. 6. Kalman, J., A shortest single axiom for the classical equivalential calculus, Notre Dame J. Formal Logic, 19 (1) (1978) 141-144. 7. Kalman, J., private communication. 8. Lukasiewicz, J., Der Aquivalenzenkalkiil, Collectanea Logica 1 (1939) 145169 (English translation in [10, pp. 88-115; 9, pp. 250 277]). 9. Borkowski, L., (Ed.), Jan Lukasiewicz: Selected Works (North-Holland, Amsterdam, 1970). 10. McCall, S., Polish Logic, 1920-1939 (Clarendon Press, Oxford, 1967). 11. McCharen, J., Overbeek, R. and Wos, L., Problems and experiments for and with automated theorem proving programs, IEEE Trans. Comput. 25 (1976) 773-782. 12. McCharen, J., Overbeek, R. and Wos, L., Complexity and related enhance ments for automated theorem-proving programs, Comput. Math. Appl. 2 (1976) 1-16. 13. Meredith, C , Single axioms for the systems (C,N), {C,0) and (A, N) of the two-valued propositional calculus, J. Comput. Systems i (3) (1953) 155-164. 14. Meredith, C , and Prior, A., Notes on the axiomatics of the Propositional Calculus, Notre Dame J. Formal Logic 4 (1963) 171-187.
New Use of an Automated Reasoning
Assistant
515
15. Peterson, J., Shortest single axioms for the equivalential calculus, Notre Dame J. Formal Logic 17 (1976) 267-271. 16. Peterson, J., The possible shortest single axioms for EC-tautologies, Auck land University Department of Mathematics Report Series No. 105, 1977. 17. Peterson, J., An automatic theorem prover for substitution and detach ment systems, Notre Dame J. Formal Logic 19 (1978) 119-122. 18. Peterson, J., Single axioms for the classical equivalential calculus, Auck land University Department of Mathematics Report Series No. 78, 1976. 19. Prior, A.N., FORMAL
LOGIC (Clarendon Press, Oxford, 2nd Ed., 1962).
20. Quine, W., Universal Instantiation, Rev. Ed., 1959).
Mathematical
Logic (Holt, New York,
21. Robinson, G. and Wos, L., Paramodulation and theorem proving in firstorder theories with equality, in: B. Meltzer and D. Michie (Eds.), Machine Intelligence 4 (American Elsevier, New York, 1969) 135-150. 22. Robinson, J., A machine-oriented logic based on the resolution principle, J. A CM 12 (1965) 23-41. 23. Skolem, T., Uber die mathematische Logic, Norsk Matematisk 10 (1928) 125-142.
Tidskrift
24. Smith, B., Reference manual for the environmental theorem prover, an incarnation of AURA, Argonne National Laboratory Tech. Rept. Argonne, IL (to appear). 25. Winker, S. and Wos, L., Automated generation of models and counterex amples and its application to open questions in ternary Boolean algebra, Proc. Eighth International Symposium on Multiple-valued Logic, Rosemont, IL (IEEE, New York, 1978) 251-256. 26. Winker, S., Wos, L. and Lusk, E., Semigroups, antiautomorphisms, and involutions: a computer solution to an open problem, I, Math. Comp. 37 (1981) 533-545. 27. Winker, S., Generation and verification of finite models and counterexam ples using an automated theorem prover answering two open questions, J. ACM29 (1982) 273-284. 28. Winker, S., and Wos, L., Procedure implementation through demodula tion and related tricks, 6th Con}. Automated Deduction, Lecture Notes in Computer Science, Vol. 138 (Springer-Verlag, Berlin, 1982) 109-131.
516
Collected Works of Larry Wos
29. Winker, S. and Wos, L., New shortest single axioms for the equivalential calculus, in preparation. 30. Wos, L., Robinson, G. and Carson, D., Some theorem-proving strategies and their implementation, Argonne National Laboratory, Technical Memo 72, Argonne, IL, 1964. 31. Wos, L., Carson, D. and Robinson, G., The unit preference strategy in theorem proving, Proc. Fall Joint Computer Conference (Thompson, New York, 1964) 615-621. 32. Wos, L., Robinson, G., Carson, D. and Shalla, L., The concept of demod ulation in theorem proving, J. ACM 14 (1967) 698-704. 33. Wos, L., Winker, S. and Lusk, E., An automated reasoning system, AFIPS Conference Proceedings, Vol. 50, National Computer Conference (AFIPS Press, Chicago, IL, 1981) 697-702. 34. Wos, L., Solving open questions with an automated theorem-proving pro gram, in: D.W. Loveland (Ed.), 6th Conference on Automated Deduction, Lecture Notes in Computer Science, Vol. 138 (Springer-Verlag, Berlin, 1982) 1-31. 35. Wos, L., Winker, S., Veroff, R., Smith, B. and Henschen, L., Questions concerning possible shortest single axioms for the equivalential calculus: an application of automated theorem proving to infinite domains, Notre J. Formal Logic 24 (2) (1983) 205-223. 36. Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: Introduction and Applications (Prentice-Hall, Englewood Cliffs, NJ, 1984). Received October 1983; revised version received December 1983
OPEN QUESTIONS SOLVED WITH THE ASSISTANCE OF AURA
by L. Wos and S. Winker 1 A B S T R A C T . The computer program AURA (Automated Reasoning Assis tant) has provided invaluable assistance in solving open questions in mathe matics and in formal logic. Historically, the questions were taken from studies of ternary Boolean algebra, finite semi-groups, Robbins algebra, equivalential calculus, the R-calculus, and the L-calculus. In answering the questions, AURA was used both to generate proofs and to find models and counterexamples. In particular, the program assisted in suggesting and verifying conjectures, testing for the presence and absence of various mappings, and characterizing certain infinite domains of theorems. No modifications to the existing program AURA were required to solve the open questions. Research in mathematics and in for mal logic may be sharply enhanced by employing an automated assistant such as AURA. Open questions requiring either the generation of a proof or the finding of a small model or counterexample are being sought.
1
INTRODUCTION
The activity that occupies much of a mathematician's or a logician's time is that of proving new theorems. Obviously, always present is the possibility that 1 Authors' address: Mathematics and Computer Science Division, Argonne National Lab oratory, 9700 South Cass Avenue, Argonne, IL 60439 This work was supported in part by the Applied Mathematical Sciences Research Program (KC-04-02) of the Office of Energy Research of the U.S. Department of Energy under Contract W-31-109-ENG-38 (Argonne National Laboratory) and in part by NSF grant MCS79-03870 (Northern Illinois University). Reprinted by permission of the American Mathematical Scoiety from Automated Theorem Proving: After 25 Years, ed. W. W. Bledsoe and D. Loveland, Contemporary Mathematics, Vol. 29, AMS, Providence, Rhode Island, pp. 73-88 (1984).
518
Collected Works of Larry Wos
the new proof will be faulty. Often a colleague is shown the proof with the in tention of catching such errors, especially before publication. With the advent of the computer, interest was expressed in attempting to automate the activ ity of proving theorems. Perhaps understandably, some originally thought that the entire activity eventually could be automated—thought t h a t a computer program could be written to accept a purported theorem, and return a proof. After all, the computer is very fast and dispatches certain tasks simply by being assigned them. With a computer program—a theorem-proving program—of the desired type, the burden of proof finding would be shifted from the mathemati cian and logician to the computer. In addition, such a theorem-proving program would have the fortuitous property that faulty proofs would never occur. As his tory proved, this all-powerful program would not be found. Proving theorems in mathematics and in logic is too complex a task for total automation, for it requires insight, deep thought, and much knowledge and experience. Even with this disappointment, the game was far from over. Despite the complexity, a computer program [7,8,9,10,11,14,26] has been written that, although not fulfilling the original expectation of some, can be and is used to assist in finding proofs of theorems. In fact, the program under discus sion has assisted in solving previously open questions from various fields of math ematics and formal logic [17,19,24,27]. This theorem-proving program—AURA (Automated Reasoning Assistant)—like other theorem-proving programs, does have the desirable property of yielding proofs that rely on inference rules that are sound. By a sound inference rule, we mean that a conclusion yielded from its use follows logically from the premisses. Although we have found no error in any proof yielded by our theorem-proving program in the last four years, one must always note that a (large) computer program cannot be pronounced free of flaws. However, since the program AURA makes explicit every step of any proof it finds, one can, if desired, check all the details of such a proof. With AURA's assistance, much of the burden of solving the previously open questions was shifted to the computer. W h a t will become evident is the fact that the researchers involved in the effort knew and know almost nothing of the fields from which the questions were selected. Rather than indicating the triviality of the questions (some of which are far from easy to answer), this fact shows the potential value of having access to an automated assistant--a colleague in the form of a theorem-proving program. T h e questions are taken from the fields of ternary Boolean algebra, finite semigroups, oquivalentiai calculus, the R-calculus, and the L-calculus. We shall discuss these questions from two viewpoints. First, we shall demonstrate that a theorem-proving program can provide invaluable assistance in research. Second, we shall focus on aspects that, if possessed by a problem, make it more amenable to the joint attack of a researcher and a theorem-proving program. By providing some criteria for partitioning problems into those suitable and those unsuitable for treatment with an automated theorem-proving program, we may make possible the attainment of two goals. Our intention is to obtain
Open Questions Solved with the Assistance of AURA
519
additional open questions to attack with a theorem-proving program. Further, we wish to interest others in conducting research with the assistance of such a program.
2
FINITE SEMIGROUPS
The following anecdote is enlightening and perhaps amusing. The anecdote con cerns solving a previously open question in finite semigroups. Although this question was not the first open question that was answered with the assistance of the theorem-proving program AURA, the story of its solution best illustrates various points that must be made. So let us tell the story exactly as it occurred. Elated with having solved certain previously open questions in ternary Boolean algebra, we began the search for new territory to conquer. Since ternary Boolean algebra has at best a small following, and since the questions we had answered resulted in the formulation of techniques for finding small models or counterex amples, we sought some problem that was rather more mainstream. The soughtafter problem could address either side of the question—require finding a proof or require generating a small model or counterexample—and still be of interest. One phone call to 1. Kaplansky was sufficient. He suggested the following problem for finite semigroups concerning the possibility of various mappings occurring in combination. Specifically, does there exist a finite semigroup ad mitting a nontrivial antiautomorphism but admitting no nontrivial involutions? Two obvious choices existed. We could attempt to prove that every finite semi group admitting a nontrivial antiautomorphism must also admit a nontrivial involution, or we could seek a counterexample to the theorem. Since the the orem would be difficult to state in the language required by an automated theorem-proving program, and since we had the new toy for generating small models and/or counterexamples, we chose the latter approach. We must point out that neither of us knew or now know very much about finite semigroups. The importance of this point will shortly become obvious, and the accuracy of it will be transparent. However, despite our lack of knowledge, we were also encouraged to take the approach of seeking a counterexample since that was our intuitive inclination. After formulating an approach that permitted us to rely heavily on an auto mated theorem-proving program, we made a series of computer runs. We were rewarded. We found the sought-after counterexample. We found various semi groups of order 4 that admit a nontrivial antiautomorphism but fail to admit a nontrivial involution. What we failed to do was write the corresponding paper and submit it for possible publication. Instead, we announced the result to var ious colleagues in the field of automated theorem proving. We were, of course, congratulated profusely. Approximately 18 months later, in another conversation with Kaplansky, a remark was passed that caused him to point out that we had not solved the
520
Collected Works of Larry Wos
problem he had suggested. Yes, it was no doubt true that we had a counterex ample to something, but the something was not particularly interesting. How fortunate that we had not written the paper, much less submitted it for pub lication! How puzzled, though polite, were our colleagues! What had we done wrong? Where was the misunderstanding? The small detail that was misunderstood was a definition. An involution is a one-to-one onto mapping whose square is the identity and that preserves products, isn't it? At least, this was the definition of involution we employed in solving the problem. But it is not the definition that should have been employed. Rather, an involution is an antiautomorphism whose square is the identity. An antiautomorphism h (for noncommutative semigroups) does not preserve prod ucts, but rather is such that h(xy) = h(y)h(x), and not a mapping with h(xy) = h(x)h(y). What had we demonstrated? First and foremost, we had proved that we knew very little about finite semigroups. Otherwise we would not have employed the wrong definition. We had shown that, with the assistance of a theorem-proving program, we could answer some question whose answer we did not know—even if the question were not interesting mathematically. Might there be something else we had accomplished? If the method for doing the wrong problem was general, then it should be applicable to the right problem. All we need do is replace the incorrect definition of an involution and, as it turned out, make a few other relevant changes and then attempt to solve the much harder and more interesting problem. Three hours after discovering that the many references to having solved an other open problem were at best misleading, we had in fact solved the interesting problem. The solution was obtained by making a series of computer runs that took 40 seconds of time on a large-scale computer. That we were able to solve the correct problem was very gratifying. Perhaps of greater importance, we had demonstrated the flexibility and power available to one using an automated theorem-proving program. We had not been forced to modify the program itself in any way. We were able to recover from a mistake in very short time. With much assistance from AURA, we were, despite knowing very little about the field, able to solve an open question of a somewhat interesting nature. Finally, we state the precise problem with its correct definitions, and give the solution [19]. Does there exist a finite semigroup admitting a nontrivial an tiautomorphism but admitting no nontrivial involution? An antiautomorphism is a one-to-one onto mapping h with h(xy) = h(y)h(x). An involution is an anti automorphism whose square is the identity. To be nontrivial, the mapping must not be the identity map. Commutative semigroups are of course not of interest for, in such a semigroup, an antiautomorphism is simply an automorphism. Yes, there does exist such a semigroup. The first found has order 83, and is gener ated by b, c, d, and e. The defining relations are: bbc = dde; dec = bee; and all products of four or more elements are equal. The antiautomorphism is such that h(b) = c, h(c) = d, h(d) = e, and h(e) = b. The smallest such semigroup
Open Questions Solved with the Assistance of AURA
521
has order 7, and there are four such semigroups [20].
3 TERNARY BOOLEAN ALGEBRA The technique for generating small models and counterexamples [16] with an automated theorem-proving program did not originate with the study of finite semigroups. Rather, it originated with an earlier study, namely, the study of open questions in ternary Boolean algebra [17]. The attempt to answer those open questions by relying heavily on AURA in fact led directly to the model generation technique that proved so valuable in the study of finite semigroups. A ternary Boolean algebra is a nonempty set satisfying the following axioms. 1) f(f(v,w,x),y,f(v,w,z)) - f(v,w,f(x,y,z)); 2) f(y,x,x) = x; 3) f(x,y,g(y)) = x; 4) f(x,x,y) = x; 5) f(g(y),y,x) = x The function f acts as product, while the function g acts as inverse. The ques tion is: Which, if any, of the first three axioms is independent of the remaining four? It was known [2] that axiom 4 and axiom 5 are dependent axioms. In fact, proofs to that effect were easily obtained with AURA, as well as obtained with other automated theorem-proving programs. As in the semigroup problem discussed in Section 2, two choices exist. A proof of dependence can be sought, or a model can be sought that satisfies, for example, axioms 1,3,4, and 5 while violating axiom 2. We first tried to find proofs of the dependence of axioms 2 and 3 by submitting the corresponding purported theorems to the theorem-proving program. The program found no proofs of dependence. Unfortunately, because of a fundamental theorem of logic, we could not conclude that dependence cannot be established. We could merely conclude that no proof had yet been found. AURA is often very successful at finding short proofs, especially of simple theorems. We therefore suspected that dependence might not be the case, and turned to the consideration of finding appropriate models. At the time, we knew of no means to have a theorem-proving program at tempt to generate models, even small finite models. Thus, we were forced to formulate a method for using a theorem-proving program to do so. Our effort resulted in a general approach to finding small models and counterexamples [16]. The approach yielded models establishing the independence of each of the first three axioms of a ternary Boolean algebra [17]. As mathematicians and logicians so well know, the capacity to find models and counterexamples is a necessary complement to finding proofs. Indeed, as was seen in the previous section, this capacity was vital to solving the semigroup problems. The possible uses for an automated theorem-proving program had finally been extended to fill an obvious gap.
522
4
Collected Works of Larry Wos
EQUIVALENTIAL CALCULUS
Here again we have recourse to an anecdote before giving the precise statement of the problem. The anecdote begins with our colleague, Brian Smith, running a set of experiments with AURA. In automated theorem proving, experiments of various kinds are absolutely necessary. Through them, one tests the additions and modifications to a theorem-proving program for possible flaws. As a result of experimentation, new inference rules and strategies and notation are found. Smith's set of experiments were designed to test certain additions to the basic program. (No such additions are necessary for the mathematician and/or logician to utilize a theorem-proving program to assist in research. We add to the program to give it more power and effectiveness. But, as it stands, we have shown that AURA is quite useful now.) One of Smith's experiments [28] was with a known theorem [6] of the equivalential calculus [5], a branch of formal logic that is concerned with the abstraction of "equivalence". Smith was attempting to find a proof using AURA. To this point, we had never obtained a proof of this theorem with our program. By using a mechanism within AURA known as weighting [10,14] and ordinarily used to impose one's intuition on the search for a proof or for a model, Smith forced the program to traverse the known proof, closely but not (necessarily) identically. Rather than duplicating the known proof as Smith intended, AURA instead found a proof half as long [28]. His success caused the authors of this paper to consider the possibility of answering certain questions still open [12] in the calculus. Yet another member of the group, at the time not directly involved in the study, suggested a formula for investigation. The problem was to prove that the selected formula is a single axiom for the equivalential calculus, or prove that it is too weak to be such. (At the time, 11 formulas [6,12] were known to be shortest single axioms for the calculus.) A single computer run elicited much excitement, for the theorems deducible from the formula appeared to have a predictable pattern of behaviorappeared to be ever-increasing in length. If this proved true, then the formula would quickly be established as too weak to be a single axiom, for there are theorems of the calculus that are shorter than the formula under discussion. The excitement proved well founded. Another colleague, Bob Veroff, and one of the authors of this paper easily proved that the conjecture was true—that the theorems are ever-increasing in length—and a celebration occurred. More important, the success with this formula led immediately to the investigation of the corresponding question for the remaining, as yet unclassified formulas. The authors of this paper wholeheartedly attacked the set of at-the-time open questions. Two of the formulas yielded immediately—proved too weak to be single axioms. Again the key was AURA. But perhaps the sole credit should go to the researchers, and not to a theorem-proving program. Did the researchers know much about the calculus? As indicated earlier, apparently not, for a startling discovery then occurred.
Open Questions Solved with the Assistance of
AURA
523
After solving two open questions—attacked because of the ease with which the first question was answered—the researchers discovered that the first and easy question had not been an open question after all. In fact, its answer was well known to those with any knowledge of the field. Only a transcription error had led to the consideration of that easy-to-solve question. Thus, as with the semi group study, again good fortune was present. Not only had two previously open questions been answered, but a method had been developed that would prove sufficient to answer the remaining open questions of the type under discussion. We view this and the earlier anecdote with amusement. Each supports the contention that we were far from knowledgeable in the fields of study from which the open questions were selected. Thus, the results strongly indicate what can be done with the assistance of an automated theorem-proving program. Were we experts in some field of mathematics or logic, and were we to conduct a concentrated investigation with the assistance of AURA, how far might we get? Equally, how far might a mathematician or logician get using AURA as an assistant or colleague? We would clearly like the answer to this question, and encourage some mathematician and/or logician to consider a joint effort of the type that parallels our studies. The precise statement of the problem is: Are any of the following seven formulas [12] shortest single axioms for the equivalential calculus [5]?
1) X J L = E(x,E(y,E(E(E(z,y),x),z))) 2) X K E = E(x,E(y,E(E(x,E(z,y)),z))) 3) X A K = E(x,E(E(E(E(y,z),x),z),y)) 4) B X O = E(E(E(E(x,E(y,z)),z),y),x) 5) X C B = E(x,E(E(E(x,y),E(z,y)),z)) 6) X H K = E(x,E(E(y,z),E(E(x,z),y))) 7) X H N = E(x,E(E(y,z),E(E(z,x),y))) The first five are too weak to be a single axiom [18,27], while the last two are in fact each single axioms [18]. The conjecture was that no additional shortest single axioms existed, and thus the results (as yet unpublished) concerning the last two of the seven formulas are of particular interest. The weakness of each of the first five formulas was demonstrated by means of a complete characterization of the deducible theorems therefrom. With that characterization, we were able to show that, for each of the five formulas, cer tain known theorems are absent from those deducible from the formula. The approach of generating models, which was used for the previous two classes of problem, is not adequate for obtaining the desired characterizations. The obsta cle rests with the fact that each of them is sufficiently powerful that an infinite number of theorems can be deduced from each. Thus, a new technique was required to obtain the desired characterization. A complete characterization is a goal sought by mathematicians and logicians, but not always obtained. Our result was, therefore, unusually rewarding. The proofs that XHK and XHN are each a single axiom consist of 87 and 162
Collected Works of Larry Wos
524
steps, respectively. Since there are steps in the first proof that contain 71 sym bols exclusive of commas and grouping symbols, and in the second proof steps containing 103, the proofs might be considered rather complex. The methodol ogy formulated to obtain these two proofs, as well as obtain the characterization of the theorems deducible from each of the other five, is sufficiently general to apply to related calculi.
5
THE R-CALCULUS AND THE L-CALCULUS
We give here the briefest of notes. In the R-calculus [5], a field of formal logic, there are formulas whose status with respect to being a single axiom is unknown [12]. The technique employed to answer corresponding questions in the equivalential calculus was successfully applied to certain formulas with the following results. In the R-calculus, two previously unclassified formulas were examined. XEH = E(x,K(E(y,E(E(y,z),x)),z)) XGJ = E(x,E(E(y,E(z,x)),E(y,z))) One of these, XEH, was proved too weak to be a single axiom, while the other, XGJ, was proved to be a "new" single axiom for the R-calculus [18]. In the L-calculus [5], the following previously unclassified formula was proved too weak to be a single axiom [18]. XCK = E(x,E(E(E(y,z),E(x,z)),y)) Thus, the study of the equivalential calculus led to similar results for related calculi.
6
PROBLEMS SUITABLE FOR AN ATTACK WITH AN AUTOMATED THEOREM-PROVING PROGRAM
We come now to the discussion of which types of problem are suitable for attack with the assistance of an automated theorem-proving program. We focus first on the open questions that were solved, listing by example some of the properties that enabled us to consider them. Then we give various examples that indicate what concepts can and what concepts cannot be easily mapped into the language required by an automated theorem-proving program. We are of course promoting the use of theorem-proving programs by others, but we are also attempting to interest mathematicians and logicians in finding open questions suitable for attack with such a program. An automated theorem-proving program is used primarily to find proofs of purported theorems. But, as demonstrated, it can also be used to find small
Open Questions Solved with the Assistance of
AURA
525
models and small counterexamples. With its assistance, valuable lemmas occa sionally are found—found by examining the results of a computer run. Such was the case in the study of ternary Boolean algebra. This algebra is particularly suitable for study with an automated theorem-proving program since its axioms take the form of simple equalities, and can thus be written as unit clauses in the predicate EQUAL. For example, axiom 1 is given to the program as EQUAL(f(f(v,w,x),y,f(v,w,z)),f(v,w,f(x,y,z))), with the remaining axioms treated similarly. A lemma that was found in one of the computer runs proved valuable in the search for models establishing the independence of various axioms. Although axiomatic studies are currently not in vogue, nevertheless, occasionally such a question might arise and might be answered with an automated theorem-proving program. The axioms for a semigroup, like those for a ternary Boolean algebra, can also be written as simple equalities. For example, the associative law is written EQUAL(f(f(x,y),z),f(x,f( y ,z))). Although no means exists for stating that a structure under study is finite, the use of generators and relations is extremely compatible with the language requirements of a theorem-proving program. In answering the initial question— that concerning the existence of a semigroup of the desired type—the use of relations appeared to be of greater value than the use of the entire multiplication table, although the latter can also be done. For example, one relation that was used in defining the first semigroup possessing the desired properties is written EQUAL(f(b,f(b,c)),f(d,f(d,e))). The relation that forces products of four or more elements to be identical is written EQUAL(f(x,f(y,f(z,w))),f(b,f(b,f(b,b)))). When the minimality question was considered, the multiplication tables were used, as well as the defining relations. For mappings such as antiautomorphisms, their general action can be rep resented with EQUAL(h(f(x,y)),f(h(y),h(x))). The specific action of the chosen antiautomorphism h is represented with EQUAL(h(b),c) and similar equalities. For an involution j , one simply gives the clause t h a t corresponds to that given for the general action of an antiautomorphism, and also writes EQUAL{jO(x)),x). In this study, the program derived any and all nontrivial relations implied by those that were given—derived all relations that were needed to characterize the multiplication table. Various tests were made by the program—tests that asso ciativity held throughout, that the proposed antiautomorphism held, and that no involutions were present. Not only is the automation of various tests conve nient, but such automation often immediately shows that the assumptions given to the program must be modified. For example, the first attempt at finding the
526
Collected Works of Larry Wos
required semigroup failed—failed because the proposed semigroup was discov ered to admit a number of involutions. We were forced to modify the relations defining the semigroup, with the result that the next attempt succeeded. In the study of the corresponding minimality question, both proof finding and model generation were required. Needless to say, the program was forced to cope with questions of isomorphism and even with "without loss of generality" arguments. The study of the equivalential calculus was amenable to attack with AURA because of the structure of its formulas and because of an inference rule used to generate formulas of the calculus. The formulas can be represented merely by prefixing each with a predicate symbol. For example, the formula XJL was studied by writing P(E(x,E(y,E(E(E(z,y),x),z)))). The inference rule, condensed detachment [12], was encodable by writing -P(E(x,y)) -P(x) P(y) and using either of two well-known inference rules extant in automated theoremproving, namely, hyperresolution [13] and UR-resolution [9|. However, even with these properties, the study presented problems that we had not previously en countered. The most serious of the problems was that of examining the entire set of theorems deducible from a given formula. This examination was deemed necessary because we conjectured that certain of the formulas under investiga tion might be too weak to be a single axiom. A typical approach to establishing such weakness is that of presenting an appropriate model. The desired model is intended to demonstrate that certain known single axioms of the calculus are not among the theorems so deducible. But the set of deducible theorems, at least for the formulas under study, is infinite. Furthermore, while seeking such a model for certain of the formulas under investigation, Peterson [12] had already examined without success a number of order 8. Since the number of models of order 8 that might be examined is 8 to the 64th, the model generation technique applied to the studies of ternary Boolean algebra and of finite semigroups was classed as unpromising. A new approach [27] was needed and was therefore developed. The approach is based on the use of schemata. With schemata, the fact that the set to be characterized is infinite was no longer an obstacle. Thus, in those cases where schemata suffice to circumvent the difficulties presented by examination of an infinite class, a theorem-proving program can also be used as an assistant. In the study, AURA was both used to find proofs and to generate counterexam ples, the latter by means of obtaining a complete characterization of the set of deducible theorems. The conjecture that led eventually to the solutions of all seven problems was made directly as a result of examining the output from a single computer run. With the assistance of AURA, the needed schemata were found, conjectures were proved, and the heart of the key induction argument was obtained. What becomes evident is an overall description of the activity. A theoremproving program is written and tested on easy theorems. Then it is tested on
Open Questions Solved with the Assistance of AURA
527
harder theorems, and often found lacking. So new inference rules are formu lated, and new strategics are found to enable the program to be more effective in its search for a solution. Finally, an open question is considered. The question forces a new technique to be invented—for example, one for finding models, or for studying mappings, or for manipulating schemata. The new techniques often require no additional programming, but are phraseable instead strictly within the language employed to present problems and ques- tions to an automated theorem-proving program. Then the new methodology is tried on similar ques tions and modified and extended as necessary. New open questions are sought on which to test the new methodology. It is often found lacking, and more method ology is developed. Thus, more open questions are needed. What would be of great value and is missing is the use by other mathematicians and logicians of an automated theorem-proving program. Use of an automated theorem-proving program by an expert in some field might lead to startling results. But precisely what are the properties of the "new" open questions to be considered? Succinctly, the best case occurs when the entire problem can be simply phrased in first-order predicate calculus. Equality presents no intrinsic problem, for there exist inference rules available to a theorem-proving program that "build in" equality—that treat equality as if its meaning is understood. Because of the existence of such inference rules, a theorem from universal al gebra becomes relevant. If a class of algebras is a variety, and if the variety is finitely based, then an algebra of the class can be characterized with a finite set of equations [3,15]. From the view- point of automated theorem proving, such a variety is said to be representable with a finite set of equality units. Such varieties—groups, rings, semigroups, for example—are most amenable to consideration by a theorem-proving program. In contrast to such varieties, many concepts cannot simply be phrased in first-order predicate calculus. No way exists to simply state that the domain is finite, and the obvious way of informing a theorem-proving program that the domain is infinite is not particularly useful. Between these extremes is, for example, the statement that "the group has order 120". This statement can be conveyed, but conveyed in a very cumbersome fashion. Statements such as "the group has exponent 3" are trivial to phrase. But statements of the form "all mappings from G to H are onto" are very difficult to phrase, if not impossible. We can, obviously, have recourse to certain methods employed in mathematics and in logic. For example, if told "there exists a function", we can simply name the function. No such maneuver, however, yet exists for transfinite ordinals, for partial differential equations, and for very many other concepts. Nevertheless, the study of some fields and of parts of other fields is somewhat amenable to relying on the assistance of an automated theorem-proving program. At this point we give, for those who are curious, some of the actual figures (in seconds) required to obtain the results quoted in this paper. These figures do not account for the time spent by the researchers in developing the methodology, but are only the computer time that was required.
528
Collected Works of Larry Wos
To find the consequences that can be deduced from a given set of relations requires approximately 15 seconds of computer time on an IBM 3033, if several hundred relations are derivable. For the semigroup of order 83, 2 seconds suf ficed to find the derived relations, and 10 seconds to check that no involutions are present. A number of such runs were required to find the desired semigroup. Several additional runs of the same order of time were required to find a semi group of order 7 with the desired properties. To find, among the over 800,000 semigroups of order 7 [4], the remaining three of the desired type required some 80 runs, each of which was approximately 30 seconds in duration. In the equivalential calculus study, 15 to 30-second runs produced many formulas that, when examined, led to the key conjecture. Runs of 15 seconds sufficed to establish that each of three formulas is too weak to be a single axiom, while a fourth was proved too weak in a 30-second run. To prove that the fifth formula is too weak, a series of runs was required with a total computer time of about 4 minutes. The establishment of each of XHK and XHN as new shortest single axioms required roughly 50 runs, each of which was from 5 to 45 seconds in duration.
7
OTHER APPLICATIONS
Although this paper focuses chiefly on the use of an automated theorem-proving program for research in mathematics and logic, other applications [24,25,26] might be of interest. AURA has been used in both logical design [21,22] and design validation [23]. In the first of these two uses, the program is given the descriptions of various components, and is asked to design a circuit with chosen properties. In the second, the program is given the design of a circuit purported to have certain properties, and is asked to prove that the circuit in fact has the claimed properties. The evidence to this point indicates that both applications are quite promising. Some of the circuits designed with the aid of AURA proved superior [22] to others of the type previously known to those in the field of logic design. As for the second application, the validations of various designs of adders required surprisingly little computer time. For example, given the design of a 16-bit adder, AURA proved [23] that the design has the desired properties in 297 steps and in less than 20 seconds on an IBM 3033. A rather different application is that of chemical synthesis. The problem is to determine which combination of compounds selected from a large database of compounds will, when combined subject to given reaction rules, produce the desired compound. This study has just commenced. A potential application that interests some engineers is that of using a theorem-proving program to validate the design of a nuclear plant. Such an effort would, of course, require far more than a program like AURA, for many computation questions would likely occur. But questions of a logical nature would also exist and could be submitted to such a program.
Open Questions Solved with the Assistance of
AURA
529
Finally, the application that occupies so much of the attention of both R. Boyer and J Moore [1] deserves mention. Their interest is in using an automated theorem-proving program to prove claims made for other computer programs. With no exaggeration, their work can be evaluated as extremely promising.
8
ACKNOWLEDGMENTS
The results on which this paper is based would not have been possible were it not for the existence of a team of researchers of which we are but two. The team—which exists only on a very informal level—consists of L. J. Henschen, E. L. Lusk, W. McCune, R. A. Overbeek, B. T. Smith, R. L. Stevens, R. L. Veroff, S. K. Winker, and L. Wos. These individuals have collaborated on a number of research topics in automated theorem proving. Although the authors of this paper and some members of the team are from Argonne National Laboratory, other members are from Northern Illinois University, Northwestern University, the University of New Mexico, and Western Michigan University. The questions were answerable because of access to AURA and its array of inference rules, strategies, data structures, and various other implementation and design features. The value of a powerful theorem-proving program that simultaneously makes available the basic procedures of the field cannot be over estimated.
9
CONCLUSIONS
The evidence given here indicates that an automated theorem-proving program can and does provide invaluable assistance in research. The program AURA clearly played a vital role in answering the various open questions. This claim is substantiated by the fact that the principal investigators were able to an swer the open questions despite having little knowledge about any of the three fields involved. Since the results presented here were obtained without recourse to program modification, we have demonstrated that an important obstacle to conducting research with an automated theorem-proving program has been re moved. Additional open questions would be of great value. Those answered here led to important advances in automated theorem proving itself and in the use of the corresponding program. Of even greater value would be the use by mathemati cians and logicians of such a program as an assistant and colleague. Perhaps the union of mathematics and/or logic with automated theorem proving is finally at hand.
Collected Works of Larry Wos
530
BIBLIOGRAPHY Boyer, R. and Moore, J, A Computational Logic, ACM Monograph Series, Academic Press, 1979. Chinthayamma, "Sets of independent axioms for ternary Boolean algebra," Notices of the American Mathematical Society, Vol. 16(1969), p. 654. Graetzer, G., Universal Algebra, 1st ed., van Nostrand, 1968, pp. 152- 171. Jurgensen, H. and Wick, P., "Die Halbgruppen der Ordnungen < 7," Semi group Forum, Vol. 14 (1977), pp. 69-79. Kalman, J., "Axiomatizations of logics with values in groups," J. London Math. Soc. (2), 14 (1976), pp. 193-199. Kalman, J., "A shortest single axiom for the classical equivalential calcu lus," Notre Dame Journal of Formal Logic, Vol. 19, No. 1, January 1978, pp. 141-144. Lusk, E., "Input translator for the environmental theorem prover - user's guide," to be published as an Argonne National Laboratory technical re port. Lusk, E. and Overbeek, R., "Experiments with resolution-based theoremproving algorithms," Computers and Mathematics with Applications 8 (1982), pp. 141-152. McCharen, J., Overbeek, R. and Wos, L., "Problems and experiments for and with automated theorem proving programs," IEEE Transactions on Computers, Vol. C-25(1976), pp. 773-782. McCharen, J., Overbeek, R. and Wos, L., "Complexity and related en hancements for automated theorem-proving programs," Computers and Mathematics with Applications, Vol. 2(1976), pp. 1-16. Overbeek, R., "An implementation of hyper-resolution," Computers and Mathematics with Applications, Vol. 1(1975), pp. 201-214. Peterson, J., "The possible shortest single axioms for EC-tautologies," Auckland University Department of Mathematics Report Series No. 105, 1977. Robinson, J., "Automatic deduction with hyper-resolution," International Journal of Computer Mathematics, Vol. 1(1965), pp. 227-234. Smith, B., "Reference manual for the environmental theorem prover, An Incarnation of AURA," to be published as an Argonne National Labora tory technical report. Taylor, W., "Equational Logic," Houston J. Math. 5 (Survey 1979), pp. 1-83.
Open Questions Solved with the Assistance of
AURA
531
[16] Winker, S., "Generation and verification of finite models and counter- ex amples using an automated theorem prover answering two open questions," J. ACM, Vol. 29 (1982), pp. 273-284. [17] Winker, S. and Wos, L., "Automated generation of models and counterex amples and its application to open questions in ternary Boolean algebra," Proc. of the Eighth International Symposium on Multiple-valued Logic, Rosemont, Illinois, 1978, IEEE and ACM Publ., pp. 251-256. [18] Winker, S. and Wos, L., "New shortest single axioms for the equivalential calculus," in preparation. [19] Winker, S., Wos, L. and Lusk, E., "Semigroups, antiautomorphisms, and involutions: a computer solution to an open problem, I," Mathematics of Computation, Vol. 37 (1981), pp. 533-545. [20] Winker, S., Wos, L. and Lusk, E., "Semigroups, antiautomorphisms, and involutions: a computer solution to an open problem, II," in preparation. [21] Wojciechowski, W. and Wojcik, A., "Multiple-valued logic design by the orem proving," Proc. of the Ninth International Symposium on Multiplevalued Logic, Bath, England, May 1979, IEEE, pp. 196-199. [22] Wojciechowski, W. and Wojcik, A., "Automated design of multiple-valued logic circuits by automatic theorem proving techniques," to appear in IEEE Transactions on Computers. [23] Wojcik, A., "Formal design verification of digital systems," Proceedings of the Twentieth Design Automation Conference, Miami Beach, June 1983, pp. 228-234. [24] Wos, L., "Solving open questions with an automated theorem-proving pro gram," 6th Conference on Automated Deduction, Vol. 138, Lecture Notes in Computer Science, ed. D. W. Loveland, Springer-Verlag, Berlin, Heidel berg, New York, 1982, pp. 1-31. [25] Wos, L., Overbeek, R., Lusk, E., and Boyle, J., "Automated reasoning: introduction and Applications," Prentice-Hall, Englewood Cliffs, New Jer sey, 1984. [26] Wos, L., Winker, S. and Lusk, E., "An automated reasoning system," AFIPS Conference Proceedings, Vol. 50 (1981), National Computer Con ference (Chicago, 111., 1981), AFIPS Press, pp. 697-702. [27] Wos, L., Winker, S., Veroff, R., Smith, B. and Henschen, L., "Questions concerning possible shortest single axioms for the equivalential calculus: an application of automated theorem proving to infinite domains," Notre Dame Journal of Formal Logic, Vol. 24, No. 2, April 1983, pp. 205-223. [28] Wos, L., Winker, S., Veroff, R., Smith, B. and Henschen, L., "A new use of an automated reasoning assistant: open questions in equivalential calculus and the study of infinite domains," submitted for publication.
The Linked Inference Principle, II: The User's Viewpoint* L. Wos Mathematics and Computer Science Division Argonne National Laboratory 9700 S. Cass Ave. Argonne, IL 60439 R. Veroff Department of Computer Science University of New Mexico Albuquerque, NM 87131 B. Smith Mathematics and Computer Science Division Argonne National Laboratory 9700 S. Cass Ave. Argonne,IL 60439 W. McCune Department of Electrical Engineering and Computer Science Northwestern University Evanston, IL 60201
1
Introduction
In the field of automated reasoning, the search continues for useful representa tions of information, for powerful inference rules, for effective canonicalization procedures, and for intelligent strategies. The practical objective of this search is, of course, to produce ever more powerful automated reasoning programs. In ' T h i s work was supported by the Applied Mathematical Sciences subprogram of the office of Energy Research, U.S. Department of Energy, under contract W-31-109-Eng-38 Reprinted with permission from the Proceedings of the Seventh International Conference on Automated Deduction, Vol. 170, Lecture Notes in Computer Science, ed. R. E. Shostak, Springer-Verlag, New York, pp. 316-332 (May 1984).
The Linked Inference Principle, II
533
this paper, we show how the power of such programs can be sharply increased by employing inference rules called linked inference rules. In particular, we focus on linked UR-resolution, a generalization of standard UR-resolution [2], and discuss ongoing experiments that permit comparison of the two inference rules. The in tention is to present the results of those experiments at the Seventh Conference on Automated Deduction. Much of the treatment of linked inference rules given in this paper is from the user's viewpoint, with certain abstract considerations reserved for Section 3. Employment of linked inference rules enables an automated reasoning pro gram to draw conclusions in one step that typically require many steps when standard (unlinked) inference rules are used. Each of the linked inference rules is obtained by applying the "linked inference principle", a principle of reason ing that is fully developed in [8]. Application of the linked inference princi ple yields generalizations of a number of well-known inference rules—for ex ample, binary resolution, UR-resolution, hyperresolution, and paramodulation. The larger steps permitted by the use of various linked inference rules are made possible by substituting semantic criteria for syntactic criteria. In particular, the usual clause boundaries that define certain well-known inference rules are replaced by criteria defined in terms of the meaning of the predicates and func tions being employed. For example, consider the case in which the natural rep resentation of a problem produces two nonunit clauses, each containing negative literals. Further, assume that some reasoning step that you would like a reason ing program to take requires the simultaneous consideration of the two nonunit clauses. Neither standard hyperresolution nor standard UR-resolution suffice on syntactic grounds. However, linked UR-resolution would not be so restricted for the criteria that are employed governing application of the rule are semantic and not syntactic. Although the discussion focuses chiefly on the inferential process, we shall touch on some consequences and benefits of a strategic nature that are present when employing linked inference. (We often discuss various strategic and infer ential approaches as if they are integrally connected when the connection is in fact primarily historical. The study of linked inference has led to the discovery of strategies [8] that can be used outside of linking, strategies such as the tar get strategy and the extension of the set of support strategy [7], for example.) Notwithstanding our emphasis on the user, we shall briefly discuss the abstract notion of linking in order to show how it unifies a number of concepts. In addi tion to furthering the objective of producing more effective and more powerful reasoning programs, linking contributes to two other objectives. First, the user is provided greater control over the performance of an automated reasoning pro gram when attacking some specific problem. In particular, the user has control over the size of the steps that occur in a deduction, and also can instruct an au tomated reasoning program to restrict its deductions to those directly relevant to some chosen concept or goal. Second, the user is permitted more freedom in the use of a natural presentation of a specific problem. The choice of notation
534
Collected Works of Larry Wos
is not dictated by the syntactic flavor of the clauses to be deduced. In contrast, because of such syntactic considerations, many (unlinked) inference rules place limitations on the choice of notation. T h e problems we solve with linked inference are taken from the world of puzzles, circuit design, and program verification. By selecting from the first of these three areas, we can immediately give a sample of how linked inference works. We choose two fragments of a puzzle called the "jobs puzzle". The jobs puzzle concerns four people who, among them, hold eight jobs. Each of the four people—Roberta, Thelma, Steve, and Pete—holds exactly two jobs. Each of the eight jobs—actor, boxer, chef, guard, nurse, police officer, teacher, and telephone operator—is held by one person. You are asked to determine which jobs are held by which people. Among the clues, you are told that Roberta is not the chef, and that the husband of the chef is the telephone operator. Perhaps you have jumped to the conclusion that Thelma is the chef. To see if you are right, the following clauses can be used to represent this puzzle fragment, and UR-resolution can be used to draw conclusions. Roberta is not the chef. (1)
-HASAJOB(Roberta,chef)
If a job is held by a female, then the female is Roberta or Thelma. (2)
-FEMALE(jobholder(y)) HASAJOB(Roberta,y) HASAJOBdhelma.y)
If a person is a wife, then that person is female. (3)
-HUSBAND(x.y) FEMALE(y)
The person who holds the job of telephone operator is the husband of the person who holds the job of chef. (4)
-HASAJOB(x.telop)
HUSBAND(x,jobholder(chef))
(A second clause -HUSBAND(x,jobholder(chef))
HASAJOB(x,telop)
is needed to complete the representation of this fact, but it does not participate in the illustration.) For every j o b , t h e r e i s a p e r s o n h o l d i n g t h a t j o b . (5) HASAJOB(jobholder(y),y) UR-resolution suffices to yield the desired conclusion in three steps. From 5 as satellite and 4 as nucleus,
The Linked Inference Principle, II
(6)
535
HUSBANDCjobholder(telop),jobholder(chef))
is obtained. From 6 as satellite and 3 as nucleus, (7)
FEMALE(jobholder(chef))
is obtained. And finally, from 7 and 1 as satellites with 2 as nucleus, (8)
HASAJOB(Thelma.chef)
is deduced as the desired result. A person solving this puzzle fragment would simply and naturally conclude clause 8 by (simultaneously) considering the information contained in clauses 1 through 5. The information contained in clauses 6 and 7 would not exist, at least explicitly. One variant of linked UR-resolution would also immediately deduce clause 8 by simultaneously considering clauses 1 through 5 without deducing clauses 6 and 7. In particular, in the terminology to be illustrated in this paper, the user could instruct a reasoning program to choose clause 1 as the "initiating satellite" and the predicate HASAJOB as the "target". With those choices, clause 2 is the "nucleus", and clauses 3 and 4 are "linking clauses" that "link" clause 2 to the "satellite", clause 5. In the example just discussed, the choice of the "target" is motivated by the natural interest in who holds which jobs. The intent is to produce a unit clause as output, since the goal is to establish a (simple) fact rather than a choice of possibilities. The conclusion, HASAJOB(Thelma,chef), is a descendant of a literal in clause 2. Thus, in this variation of linked UR-resolution, the nucleus is the "target clause". In the following variation, however, the nucleus is not the target clause, for the conclusion is not a descendant of a literal in the nucleus. For this variant, we select another fragment from the "jobs puzzle". Another clue in the puzzle is that the job of nurse is held by a male. From this clue, you quickly deduce that Roberta is not the nurse. (Incidentally, this fragment is the example t h a t led to the first application of the principle of linked inference and, in fact, to the first variant of linked UR-resolution.) The deduction can be obtained with the following clauses. (9) (10) (11)
FEMALE(Roberta) -FEMALE(x) -MALE(x) -HASAJOB(x,nurse) MALE(x)
Here again the user chooses the natural target and the inference rule of linked UR-resolution, the two choices motivated as discussed earlier. Clause 9 is the initiating satellite, clause 10 the nucleus, and clause 11 the target clause. The literal MALE(x) of clause 11 links to the literal -MALE(x) of clause 10. The other literal of clause 11, -HASAJOB(x,nurse), is the target literal, and is the parent of the deduced clause (as a literal)
Collected Works of Larry Wos
536 (12)
-HASAJOB(Roberta,nurse)
and we have an illustration of a variation on the preceding example of linked UR-resolution. The two examples illustrate two variants of linked UR-resolution. They show how the user can rely on a natural representation for the problem, without regard to syntactic tricks required by the wish for using a particular inference rule. They show how the step size need not be limited by the obvious clause boundaries that occur when using this natural formulation of the puzzle. Finally, they suggest the possible increase in program control and possible decrease in user effort that can occur when employing linked inference. The increase in control is derived in part from avoiding the generation of certain classes of intermediate clauses and in part from keying on semantically chosen targets. The decrease in effort is derived in part from the ability to rely on a natural representation without being so concerned with the need to generate (intermediate) clauses that are required to be unit clauses.
2
Overview
In this section, we briefly review certain material covered in [8]. In particular, we discuss the need for linking, some of its properties, and the motivation for its existence. At the most general level, the motivating forces are the desire to rely on semantic considerations in place of syntactic, the intention of increasing the power and efficiency of automated reasoning programs, and the desire to provide the user with more control over the actions taken by a reasoning program while simultaneously placing less burden on the user. At the more specific level, linking addresses a number of problems commonly faced when using a reasoning program. Of course the problems are extremely interconnected, but let us discuss them as if they are somewhat separate. The first problem focuses on the size and nature of the steps that ordinarily occur in a deduction. Because many inference rules are constrained and defined in terms of syntactic criteria alone, and because clause boundaries currently prohibit certain combinations of facts from being simultaneously considered, the steps taken by a reasoning program are often smaller than necessary or de sired. The termination of a deduction step is often given in terms of syntactic criteria such as the signs of the literals and the number of the literals. Users of an automated reasoning program might well prefer the termination condition to rely on the significance and the meaning of the conclusion. In standard hyperresolution, for example, a reasoning program might be forced to accept a conclusion containing two positive literals, while linked hyperresolution might produce a conclusion with but one positive literal, the second literal being removed with a negative unit clause. The second problem concerns representation and its interconnection with the choice of inference rule(s) and strategy. Too often the user wishes to use
The Linked Inference Principle, II
537
one choice of predicates and functions dictated by a desire for convenience, readability, and naturalness, and finds that, for example, binary resolution must then be included as an inference rule. If binary resolution is to be avoided—after all, typically its use results in too many clauses of too small a step size—then more clauses must be added to the set of support. Thus, in these situations, the user is forced to choose between using an inference rule that may be too prolific and weakening the power of the chosen strategy. The third problem addresses user control of the actions taken by an auto mated reasoning program. In many cases, the user does not wish to be forced to read through and examine a myriad of conclusions, but instead wishes to be presented only with important conclusions. The intent of using linked infer ence is to provide each user with a means for telling a reasoning program which concepts are interesting, in turn permitting the program to present only conclu sions consistent with the given instruction. By judicious choices, the program can be prohibited from generating intermediate clauses by in effect classifying them as relatively insignificant. Many such clauses are merely links between one significant statement and another significant one. Depending of course on the price paid (measured in terms of time) for achieving this reduced clause space, a sharp increase in efficiency results. The fourth and final problem is that of extending the power and flavor of the set of support strategy. The strategy, as currently defined and employed, partitions the input clauses into those with support and those without. The strategy prohibits application of an inference rule to a set of clauses when none of its members has support. By doing so, many clauses that would have been generated are not generated. This action is far more efficient than actions that generate clauses and then purge them subject to various criteria. However, as pointed out by Luckham [1], this partitioning of the input clauses is not recur sively present—is not present at higher levels of the clause space. Of course, levels 2, 3, 4, and so on are smaller than they would have been because of the clauses not present at level 1 when using the strategy. But the recursive power, were it present, would further partition the retained level 1 clauses into two sets, one with support and one without. With this action, the level 2 clause space would be smaller than with the standard definition of the set of support strategy. The problem thus is to provide a means for partitioning each level of retained clauses—as currently occurs for level 0—and, as a result, to continu ally reduce the size of levels greater than 1 comparable to the way that level 1 is reduced. Of course, the object is to extend the set of support strategy in this fashion without (operationally) losing refutation completeness. (Questions of refutation completeness are not addressed in this paper.) Application of the linked inference principle to produce various linked infer ence rules addresses these various problems. Intuitively, linked inference rules enable an automated reasoning program to "link" together as many clauses as are required to skip the less significant intermediate results. The object is to draw a conclusion, or term the deduction step complete, only when a significant
Collected Works of Larry Wos
538
result has been obtained, where significance is defined by the user. Rather than totally abandoning syntactic notions such as sign of literals and number of liter als and clause boundaries, linked inference rules permit the user to combine such criteria with certain semantic notions. Thus, for example, linked UR-resolution requires that the conclusion be a unit clause but, when the appropriate strat egy is employed, broadens the definition of standard UR-resolution to require that the unit clause satisfy additional specified criteria. This extension enables a reasoning program to avoid terminating the deduction step merely because of having produced some unit clause. The extension also allows the use of clauses that would normally not be considered satellites. Linked UR-resolution is to standard UR-resolution as standard UR-resolution is to unit resolution.
3
The Linked Inference Principle
Note that, when referring to a clause, here we mean an occurrence of a clause. Thus the mention of two clauses admits the possibility that the clauses are identical-are merely copies of the same clause. Similarly, the reference to a literal means an occurrence of a literal. Thus the mention of two literals does not imply that the two literals are distinct, but rather that they are different occurrences of (possibly the same) literals. Although we could define the linked inference principle to cover literal merging and to cover factoring [6], such a definition interferes slightly with an understanding of the principle and is not consistent with the current implementation of the corresponding inference rules. Employment of the principle, and hence of various inference rules derived from it, requires using factoring as an additional inference rule. Finally, we choose here to define the principle at the literal level, presenting its extension to the term level in another paper. Thus, equality-oriented inference rules such as paramodulation are not covered in this treatment.
3.1
Definition
The linked inference principle is a principle of reasoning that considers a finite set S of two or more (not necessarily distinct) clauses with the objective of deducing a single clause that follows logically from the clauses in S. The principle applies if there exists an appropriate function f and an appropriate unifier u that depends on f. (The formal discussion of appropriate functions and unifiers is found in [8].) Such a function—that required for the linked inference rule to apply—pairs literals in the same sense that certain standard inference rules do. For example, standard binary resolution considers two clauses and pairs a literal in one with a literal of opposite sign in the other with the intent of the two literals unifying. As a different example, standard UR-resolution considers a nucleus and a set of satellites, and pairs all but one of the literals in the nucleus with the satellites. Again the intent is to find an appropriate unifier that depends on the pairings,
The Linked Inference Principle, II
539
and that is required to simultaneously unify the chosen pairs. In the same spirit, linked UR-resolution considers a nucleus, a set of satellites, and various linking clauses. It pairs literals in the nucleus with satellites and possibly with literals from linking clauses with the intent of employing a unifier that simultaneously unifies the chosen pairs. The object is to "cancel", with one exception, all literals in all clauses—the exception being the linked UR-resolvent that results if the application is successful. With this perspective, standard URresolution can be viewed as an instance of linked UR-resolution. Just as standard UR-resolution and standard hyperresolution can be implemented as a sequence of the appropriate binary resolutions, so also can various linked inference rules. However, as expected, linked inference rules are not implemented in this fashion, but instead are implemented to avoid the generation of intermediate clauses.
3.2
Inference Rules
Before briefly discussing other concepts covered by the linked inference principle, we focus on inference rules. For example, binary resolution is captured by the linked inference principle, even when a clause is resolved with itself. In that case, S consists of two copies of the same clause, and each of the literals not involved in the unification is mapped to itself. Factoring, on the other hand, is not captured by the principle as presented here. Hyperresolution, negative hyperresolution, and UR-resolution are also captured. Equally, linked UR-resolution and linked hyperresolution are captured by the linked inference principle. We can now give the following formal definition of linked UR-resolution. Definition. Linked UR-resolution is that inference rule that requires the se lection of a unit clause, called the initiating satellite, and a nonunit clause, called the nucleus, such that the literal of the initiating satellite unifies with a literal of opposite sign in the nucleus. In addition, with at most one exception, for each of the remaining literals of the nucleus, there must exist a (unit or nonunit) clause containing a literal of opposite sign that unifies with that literal. The unit clauses are called immediate satellites or satellites of ancestor-depth 1, and the nonunit clauses are called links of ancestor-depth 1. Further, for each of the literals in the ancestor-depth 1 links that are not paired with a literal in the nucleus, with at most one exception, there must exist a satellite of ancestordepth 2 or a link of ancestor-depth 2 that provides a literal of opposite sign that unifies with that literal.... There must be an n such that no satellites or links of ancestor-depth greater than n participate. Next, the number of so-called excep tion literals in the set consisting of the nucleus and the links must be exactly one. Finally, there must exist a unifier that simultaneously unifies pairwise all pairs designated by the given conditions. The linked UR-resolvent is obtained by applying the unifier to the unpaired literal. In the unification requirement, the reason for allowing the possibility of no exception literals in the nucleus but instead allowing an exception in one of the links is that the deduced unit clause may be descended from a literal contained in
Collected Works of Larry Wos
540
one of the links. Accidental deduction of a unit clause, as can occur with merging, is not permitted. As in standard UR-resolution, we are interested in a definition that operationally predicts, if all conditions are satisfied, that a unit clause will be deduced. Allowing in the definition the unit clause that is accidentally produced by merging leads to an implementation of linked UR-resolution, as well as of standard UR-resolution, that is less effective. The broader definition would force exploration of many paths that in fact would not produce a unit clause. The definitions, from the abstract viewpoint of the linked inference principle or from the user viewpoint, of linked hyperresolution can be obtained by fo cusing on the objective of deducing a positive clause rather than a unit clause. The corresponding definitions for linked negative hyperresolution and for linked binary resolution can be obtained by focusing on the corresponding objectives. The linked inference principle is thus seen to capture a number of inference rules.
3.3
Other Applications of the Principle
The linked inference principle also captures other concepts in addition to cap turing various inference rules. For example, it captures, with one exception, all classes of proof by contradiction that are signaled by the deduction of the empty clause. The exception is illustrated with the two clauses P(x) P(y) -P(x) -P(y) which, taken together, are an unsatisfiable set. The proof of unsatisfiability requires the use of factoring. The linked inference principle as given here can be extended to capture this type of proof as well by replacing the requirement of the one-to-one property of the required function f. In the extension, rather than simply considering pairs of literals 1,5(1), the function is allowed to admit paired sets T,f(T). All literals in any such T must be from a single clause C in S, all literals in f(T) must be from a single clause D, and of course the literals of T must simultaneously unify, so must the literals of f(T), and the two resulting literals must unify and be of opposite sign. This extension is similar to the first definition published for binary resolution [3]. The linked inference principle also captures, with one exception, the notion of the deduction of a clause D from a given set S of clauses. As expected, again the exception is any deduction that requires factoring. Finally, the linked inference principle can be viewed as capturing the de ductive aspects of Prolog [4]. The procedural aspects can be captured by an appropriate strategy. The execution of a Prolog program can be achieved with a single linked hyperresolution. The point of noting the various concepts captured under the linked inference principle is merely to observe that the principle provides a unifying framework
The Linked Inference Principle, II
541
for a number of rather distinct concepts. No claim is being made that, for example, when seeking a proof by contradiction, the user should instruct a reasoning program to search for the appropriate single linked inference. In fact, unless the user has a well-tailored algorithm for solving the problem under consideration, searching for such one-step proofs by contradiction is essentially a waste of time.
4
Experiments
We cannot overstate the importance of proper experimentation in evaluating new ideas. Because our implementation of the linked inference rules is still in a very early stage, we have not yet been able to do the extensive testing that is required to properly assess the value of the concept. In this section we briefly summarize the few experiments that we are running, and include other examples, obtained by hand, to further illustrate the potential of linking. The problems are selected from three areas: solving puzzles, designing cir cuits, and proving properties of programs. The experiments focus on compar isons between standard and linked UR-resolution. Because of the obvious need for brevity, we include here only sketches of solutions to problems. A more de tailed discussion of the problems is found in [8].
4.1
Solving Puzzles
The first experiment focuses on the "jobs puzzle", a fragment of which was described in the introduction. There are four people: Roberta, Thelma, Steve, and Pete. Among them, they hold eight different jobs. Each holds exactly two jobs. The jobs are: actor, boxer, chef, guard, nurse, police officer (gender not implied), teacher, and telephone operator. The job of nurse is held by a male. The husband of the chef is the telephone operator. Roberta is not a boxer. Pete has no education past the ninth grade. Roberta, the chef, and the police officer went golfing together. Who holds which jobs? The second experiment concerns the "fruit puzzle". A merchant wishes to sell you some fruit. He places three boxes of it on a table. Each box contains only one kind of fruit: apples, bananas, or oranges. Each box contains a different type of fruit. Each box is mislabeled. Box a is labeled apples, box b oranges, and box c bananas. Box b contains apples. What do the other boxes contain?
4.2
Designing Circuits
Circuit design is an application of automated reasoning that has generated much interest [5]. The basic approach is to describe with axioms the available compo nents and the way they interact, and then deny that a circuit with the desired properties can be constructed. Examination of a proof of the corresponding
Collected Works of Larry Wos
542
theorem contains all of the information necessary to specify the design of the desired circuit. The experiments are with multiple-valued logic circuits employ ing T-gates. The following clause defines a T-gate. (1)
-CKT(x) -CKT(y) -CKT(z) CKT(tgate(x,y,z,w))
The following clauses define the circuit problem to be solved. (2) (3) (4) (5)
CKT(O) CKT(l) CKT(2) -CKT(tgate(tgate(0,l,0.il),tgate(l,2,l,il), tgate(0,l,0,il),i2))
With standard UR-resolution, the choice of clause 5 as set of support does not yield a proof that the desired circuit can be designed. In fact, no clauses are generated with that choice. And yet, clause 5 is an obvious choice, while the inclusion of any of clauses 2 through 4 is less justified. Thus, you must choose between modifying your choice of inference rule and modifying your choice of set of support. With linked UR-resolution, on the other hand, you are not required to modify the natural choice of having clause 5 as the only input clause in the set of support.
4.3
Proving Properties of Programs
Automated reasoning is applicable to a wide variety of formal verification prob lems. One area of particular interest is that of proving that a given computer program has certain properties it is claimed to have. For example, you might wish to prove that the program correctly implements a given algorithm. Many of the programs that we study involve some use of integers, vectors, and matrices. The corresponding axiom sets have the property that very closely related facts are deducible from them when standard inference rules are em ployed. For example, if the reasoning program deduces that a is less than b, then it soon deduces that b is not less than a. The presence of such closely related facts can seriously impair a reasoning program's performance. Since employment of linked inference rules, by relying heavily on semantic criteria, enables a reasoning program to avoid drawing such closely related conclusions, efficiency is enhanced. Correspondingly, verification problems for computer pro grams with such axiom sets appear to be very amenable to attack with a linked inference rule. We include here a portion of a proof (obtained by hand) that a given program correctly finds the maximum element of an array. The predicates, functions, and constants of this problem have the following interpretations.
543
The Linked Inference Principle, II
LT(x,y) IB(x,y) eval(x,y) s(x),pd(x) cc,numl,cn cj, cmax a,b
x is less than y index y is in bounds in array x the value in position y of array x successor and predecessor functions array cc is dimensioned from numl through en constants representing program variables other Skolem constants that come from the statement of the theorem The relevant portion of the problem is the following. Special hypothesis: (1) (2) (3) (4) (5) (6) (7) (8)
LT(a,cj) -LT(cj,numl) -LT(cn.cj) -LT(s(cn),cj) -LT(a,numl) - I B ( c c . a ) EQUAL(cmax,evaKcc,a)) LT(xl,numl) - L T ( x l . c j ) - I B ( c c , x l ) -IB(cc,cj) -LT(cmax,eval(cc,cj))
-LT(cmax,evaKcc,xl))
Denial of the conclusion: (9)
-LT(b,numl) - I B ( c c . c j ) L T ( s ( c j ) , n u m l ) LT(a,numl) - L T ( a , s ( c j ) ) - I B ( c c . a ) -EQUAL(cmax,eval(cc,a))
LT(s(cn),s(cj))
(10)
LT(b,s(cj)) -IB(cc.cj) LT(s(cj),numl) LT(a.numl) - L T ( a , s ( c j ) ) - I B ( c c . a ) -EQUAL (cmax, e v a K c c , a ) )
LT(s(cn),s(cj))
(11)
LT(cmax,eval(cc,b)) - I B ( c c . c j ) LT(s(cj),numl) L T ( s ( c n ) , s ( c j ) ) LT(a,numl) - L T ( a , s ( c j ) ) - I B ( c c . a ) -EQUAL (cmax, e v a K c c , a ) )
In addition to these clauses, there is a set of general axioms that gives properties of the integers, of ordering relations, of arrays, and other relevant information. Note that there are seven literals that are common to each of the clauses of the denial, clauses 9, 10, and 11. A single application of linked UR-resolution to each of the three clauses removes the seven common literals and yields the following three unit clauses. (12) (13)
-LT(b.numl) LT(b,s(cj))
Collected Works of Larry Wos
544 (14)
LT(cmax,eval(cc,b))
Before completing the proof, which requires two additional linked UR steps, we show how linking removes each of the seven literals. The process is described by associating each literal with the appropriate axioms and set of support clauses that are required to remove it from the nucleus. Simply for illustrative purposes, each of the seven literals is viewed as a unit clause that is used to deduce the empty clause. Note the difference between linked UR-resolution and standard UR-resolution in the treatment of this proof fragment. In standard UR, it would be necessary to deduce in separate steps an appropriate unit clause to remove each of the seven literals from clauses 9, 10, and 11. To see precisely what suffices—to derive the standard UR proof from the linked UR proof we are about to give—merely consider the linking clauses associated with each of the seven literals, but in reverse order. a.
-IB(cc.cj) LT(xl.numl) LT(cn.xl) IB(cc,xl) -LT(cj,numl) -LT(cn.cj)
b.
LT(s(cj),numl) -LT(x.y) -LT(y.z) LT(x,z) LT(x,s(x)) -LT(cj,numl)
c.
(axiom) (axiom) (2)
LT(s(cn),s(cj)) -LT(x.y) -LT(pd(x),pd(y)) EqUAL(pd(s(x)),x) -LT(cn.cj)
d.
(axiom) (clause 2) (3)
(axiom) (demodulator) (3)
LT(a,numl) -LT(a,numl)
(5)
-LT(a,s(cj)) -LT(x,y) -LT(y,z) LT(x.z) LT(x,s(x)) LT(a,cj)
(axiom) (axiom) (1)
545
The Linked Inference Principle, II
f.
-IB(cc.a) LT(xl,numl) LT(cn,xl) IB(cc.xl) -LT(a.numl) >
(axiom) (5)
LT(cn,a) (intermediate result added for clarity)
LT(a,cj) -LT(x,y) -LT(y,z) LT(x.z) -LT(cn,cj) g.
(1) (axiom) (3)
-EQUAL(cmax,eval(cc,a)) - I B ( c c . a ) EQUAL(cmax,eval(cc,a)) (6) ( s e e s o l u t i o n of l i t e r a l "f" t o complete)
Having shown how the seven literals can be removed with linked UR-resolution to deduce the unit clauses (12) (13) (14)
-LT(b,numl) LT(b,s(cj)) LT(cmax,eval(cc,b))
we show how the proof can be completed. With clause 12 as the initiating unit and clause 7 (7)
LT(xl.numl) - L T ( x l . c j ) - I B ( c c . x l )
-LT(cmax,eval(cc,xl))
as the nucleus, the intermediate clause -LT(b.cj) -IB(cc.b)
-LT(cmax,eval(cc,b))
can be deduced by binary resolution. The first literal can be transformed into a (different) unit clause, and simultaneously the second and third literals can be removed by linking. The output of this linked UR step is the following unit clause. (15)
EQUAL(b.cj)
This application of linked UR can be described as we described the action of linking in removing the seven literals. h.
-LT(b.cj) LT(x,y) LT(y,x) EQUAL(x,y) -LT(xl,s(x2)) -LT(x2,xl) LT(b,s(cj))
(axiom) (axiom) (13)
546
Collected Works of Larry Wos
> i.
EQUAL(b.cj)
(result of inference)
-IB(cc.b) LT(xl.numl) LT(cn.xl) IB(cc.xl) -LT(b,numl) > LT(cn,b)
(intermediate result for clarity)
-LT(x,y) LT(z,y) LT(x,z) -LT(cn.cj) > LT(cj,b)
(axiom) (3)
(intermediate result for clarity)
-LT(xl,s(x2)) -LT(x2,xl) LT(b,s(cj)) j.
(axiom) (clause 12)
(axiom) (13)
-LT(cmax,eval(cc,b)) LT(cmax,eval(cc,b))
(14)
Note that the new equality (clause 15, which was derived from literal "h") back demodulates clause 14 to produce the following unit clause. (16)
LT(cmax,eval(cc,cj))
To complete the proof, it is sufficient to show how clause 16 can be used to deduce a unit clause that conflicts with an existing unit. k.
LT(cmax,eval(cc,cj)) -IB(cc.cj) -LT(cmax,eval(cc,cj)) LT(xl.numl) L T ( c n . x l ) I B ( c c . x l ) -LT(cj.numl)
(8) (axiom) ( c l a u s e 2)
The result of this linked UR-resolution step is the unit clause (17)
LT(cn.cj)
which conflicts with clause 3. Note that the intermediate result -IB(cc,cj) is itself a linked UR-resolvent that would be generated with this step. The entire problem is solved with 5 linked UR steps.
5
Conclusions
We have discussed the linked inference principle and, specifically, the application that yields linked UR-resolution. Linked UR-resolution enables a reasoning pro-
The Linked Inference Principle, II
547
gram to take much larger steps than standard UR-resolution does. By employing this inference rule, the user is usually free to choose a natural representation for presenting a problem in clause form. In particular, while standard inference rules often force you to choose between expanding the set of support and adding binary resolution to the inference rules being used, linked inference rules often avoid both undesirable choices. We have described certain experiments to test the position that employment of linked inference increases the effectiveness of automated reasoning programs. In addition, we have included other illustrations (carried out by hand) to aid in understanding how the linked inference principle works. The experiments and illustrations focus on problems from the world of puzzles, circuit design, and proving properties of computer programs. We intend to present the results of those experiments at the Seventh Conference on Automated Deduction. Although we have not given a detailed account of precisely how the user gives the reasoning program the instructions that in turn result in controlling linked inference, we have illustrated how a strategy, the target strategy, can be used to employ semantic considerations rather than the usual syntactic ones that define standard inference rules. The motivation for formulating the linked inference principle is to provide greater control over a reasoning program's at tack on a problem, and also to increase the role of semantic criteria. Questions of soundness and refutation completeness as well as a detailed discussion of the fine points of the linked inference principle are found in [8]. Our main objec tive here is to demonstrate that the use of linked inference rules may increase the potential of relying on a reasoning program to function as an automated reasoning assistant.
References [1] Luckham, D. C , "Some Tree-paring Strategies for Theorem Proving," Ma chine Intelligence 3 (ed. Michie, D.), Edinburgh University Press 1968, pp. 95-112. [2] McCharen, J., Overbeek, R. and Wos, L., "Problems and experiments for and with automated theorem proving programs," IEEE Transactions on Computers, Vol. C- 25(1976), pp. 773-782. [3] Robinson, J., "A machine-oriented logic based on the resolution principle," J. ACM, Vol. 12(1965), pp. 23-41. [4] Warren, D. H. D., Implementing Prolog - compiling predicate logic pro grams, DAI Research Reports 39 & 40, University of Edinburgh, May 1977. [5] Wojciechowski, W. and Wojcik, A., "Automated design of multiple-valued logic circuits by automatic theorem proving techniques," to appear in IEEE Transactions on Computers.
548
Collected Works of Larry Wos
[6] Wos, L., Carson, D. and Robinson, G., "The unit preference strategy in theorem proving," Proc. AFIPS 1964 Fall Joint Computer Conference, Vol. 26, Part II, pp. 615-621 (Spartan Books, Washington, D.C.). [7] Wos, L., Carson, D. and Robinson, G., "Efficiency and completeness of the set of support strategy in theorem proving," J. ACM, Vol. 12(1965), pp. 536-541. [8] Wos, L., Smith, B. and Veroff, R., "The Linked Inference Principle, I: The Formal Treatment," in preparation.
Computational Sciences
Achievements in Automated Reasoning By Larry Wos This is the first of two articles. What do the following problems and puzzles have in common? • You are given the design of a circuit that supposedly meets certain speci fications (see Fig. 1). It is required to take as input x and y (with x above y) and yield as output y and x (with y above x), and without any crossing wires. Your problem is to prove that the design meets the specifications. • For the second problem, you are given three checkerboards missing various squares (see Figs. 2, 3, and 4)- You are also given an adequate supply of one-by-two dominoes. The problem is to determine which, if any, of the checkerboards can be precisely covered with dominoes. (Puzzles of this type are reminiscent of Layout problems.) • In the third problem, you are asked to design a circuit that will return the signals not(a), not(b), and not(c), when a, b, and c are input to it (see Fig. 5). The task would be trivial were it not for one important constraint. You can use as many AND and OR gates as you like, but you cannot use more than two NOT gates. • The fourth and final problem concerns computer programs and their re liability. Specifically, you are given a subroutine that is claimed to cor rectly find the maximum element of any array given to it. You must give a proof that the code performs as claimed, or find a counterexample and thus demonstrate that the code contains a bug. One answer to the question of commonality for these four problems is that each can be solved with reasoning, logical reasoning. Another and perhaps more interesting answer is that all four problems have been solved by a single com puter program, the automated reasoning program AURA (AUtom ated Reason ing Assistant). But what is automated reasoning-and what are the answers to the given problems? One answer to the question of commonality for these four problems is that each can be solved with reasoning, logical reasoning. Another and perhaps more Reprinted with permission from SIAM News, Vol. 14, No. 4, pp. 4-5 (July 1984).
Collected Works of Larry Wos
550
*>~^>—!>
FD-
:D
>
Figure 1 Design of a circuit
Figure 2 Checkerboard 1
Figure 3 Checkerboard 2
{>~^0-
Achievements in Automated
Reasoning
551
Figure 4 Checkerboard 3 not(x) not(y) not(z) Figure 5 Specifications for a circuit
interesting answer is that all four problems have been solved by a single com puter program, the automated reasoning program AURA (Automated Reason ing Assistant). But what is automated reasoning-and what are the answers to the given problems? Automated reasoning is the study of how the computer can be used to as sist in that part of problem solving requiring reasoning. Reasoning as used here means logical reasoning, not probabilistic or common-sense reasoning. Each con clusion that is reached must follow inevitably from the facts from which it is drawn. If a conclusion is false but obtained with logical reasoning, then one of the facts from which it is obtained is false. Using a computer program that reasons logically thus assures you of totally accurate information, providing you give it totally accurate information to begin with. Such a program, if it gives you access to an appropriate array of choices, can be used effectively as an automated reasoning assistant.
Achievements Automated reasoning appeals strongly to various people interested in research and applications because actual successes have been obtained. In particular, previously open questions both in mathematics and in formal logic have been
552
Collected Works of Larry Wos
answered with the assistance of the automated reasoning program AURA. Su perior logic circuits were also designed with that program. As an example of the power of the program, a 16-bit adder was proved correctly designed in 20 seconds of CPU on an IBM 3033, producing a 297-step proof. A number of the successes were obtained by people far from expert in automated reasoning itself.
Automated Reasoning Programs In addition to powerful automated reasoning programs, systems such as LMA (Logic Machine Architecture) are now available. LMA is a portable and modular system for producing reasoning programs tailored to given specifications. The program ITP (Interactive Theorem Prover), produced with LMA, is currently in use by more than 100 researchers throughout the world. In addition to portability, LMA and the programs produced with it have the advantage that new ideas can easily be adjoined and tested. Programs like AURA and ITP offer a wide variety of procedures for solving problems requiring reasoning. The system LMA—designed and implemented by Ross Overbeek, Ewing Lusk, and William McCune—consists of more than 50,000 lines of Pascal. ITP— designed chiefly by Lusk—consists of an additional 20,000 lines of Pascal. Both LMA and ITP run under UNIX, VAX/VMS, and IBM VM/CMS, and have been ported to a variety of machines including the VAX, the Apollo, and the PERQ. The use of LMA or ITP requires approximately one megabyte of memory. Although this memory requirement makes either program inaccessible to use with a so-called personal computer, there exist computers priced under $10,000 that provide an environment sufficient for using both LMA and ITP. The program AURA—designed and implemented by Overbeek, Lusk, Brian T. Smith, and Steve Winker—consists of more than 40,000 lines of IBM assembly code and more than 20,000 lines of PL/I. The smaller versions of AURA run in 120k bytes of memory, while the larger versions require 500k bytes. While AURA can be used only in batch mode, ITP can be used interactively or in batch. All versions of AURA run on IBM 370 machines, and afford the user very impressive execution times. The lack of portability of the versions of AURA was one of the causes for designing both LMA and ITP. The designers of the three programs, all members of the automated reasoning group of the Mathematics and Computer Science Division of Argonne National Laboratory, share the approach of integrating into one large program the basic elements of automated reasoning. This approach facilitates the testing and comparing of different ideas, and provides the user with a more flexible and useful reasoning program. For the Argonne group, automated reasoning focuses on techniques that are machine-oriented, rather than on mimicking human reasoning. Their goal is to design and implement
Achievements
in Automated
Reasoning
553
ever more powerful automated reasoning assistants.
How it Works Just as with any assistant or colleague, you need a means for discussing the problem with the reasoning program. A common language must be chosen in which to represent information. In the second article, in the section "A Reason ing Program Solves a Puzzle", you will be given a glimpse of a language currently used by many reasoning programs. Learning this language is somewhat simpler than learning a programming language. Once a language has been chosen, inference rules for drawing conclusions must be given to the program. Since the likelihood of solving a given problem is substantially affected by the type of reasoning employed, a variety of inference rules have been formulated and implemented in many reasoning programs. In ference rules of the type under discussion permit you to check the work of your automated reasoning assistant, should you suspect that it has erred. In partic ular, by issuing the appropriate request, a reasoning program will provide the corresponding list of facts and statements from which each conclusion is drawn. You will be given some examples of such inference rules in the second article, in the section in which a puzzle is solved. Even a wide variety of effective inference rules is not sufficient for an auto mated reasoning program to provide much assistance in solving problems. The simplest of problems, if attacked in an unguided and unrestricted fashion, results in an avalanche of new information. It is thus necessary to employ strategy, just as it is in poker or chess or any other pursuit where the reward is high. Strategy to guide the search for a solution is required, and strategy to restrict the search must be used. As an example of the former, one use of the "weighting strategy" permits you to impose your knowledge and intuition on the search for a solution by having the program assign priorities to concepts. As an example of the latter, one use of the "set of support strategy" prohibits a reasoning program from exploring paths that begin solely with the axioms or general information. In addition to a variety of inference rules and strategies, many automated reasoning programs can automatically rephrase and rewrite information to a normal form. For example, if provided with the appropriate rewrite rules, such a program will immediately replace -(-a) by a, xy + xz by x(y + z), and brother of father of z by uncle of z. In other words, a reasoning program can automatically simplify expressions with the "inverse of the inverse" rule, factor expressions by applying the distributive law, and employ commonly used definitions. The rules for simplification and canonicalization can be given to the program, and they can also be discovered by it during an investigation. Another useful feature of many reasoning programs is the ability to behave like the mathematician who discards trivial corollaries in favor of the more
554
Collected Works of Larry
Wos
powerful theorem. For example, rather than retaining facts stating that (ab)c = a(bc) and (de)f = d(ef) for constants a through / , the program discards them in favor of the associative law for product {xy)z = x(yz). The purging of the first two identities in favor of the third and more general identity depends on a feature of the language for representing information to the program. In this language, x, j / , and z are treated as variables that are (implicitly) universally quantified— for all x, for all y, for all z, the statement holds. The first two identities are recognized as instances or particularizations of the third, obtainable merely by replacing the variables with the corresponding constants. This procedure for purging less general information in favor of more general has other applications. It can also be used to remove weaker information in the presence of stronger. For example, the weaker statement "Box 1 contains apples or bananas" is purged in favor of the stronger statement "Box 1 contains bananas". Such discarding of less general and weaker statements in the presence of more general and stronger ones occurs regardless of which is found first. Typically, a reasoning program ascertains that the task has been completed by discovering a "proof by contradiction". When you wish to prove some theorem in mathematics or to establish that some fact is true, you assume the theorem or the fact false. The corresponding statements are added to the other information the reasoning program is given. The program is then asked to apply the inference rules to the information at hand, guided and constrained by the strategies that were chosen, and then seek a contradiction. If in fact the theorem is true or the fact is deducible, assuming it false in principle will lead to a contradiction. The reasoning program may of course exhaust the time or memory that is available before the problem under study is solved. Even in that case, examination of the program's work often yields valuable information.
How an A u t o m a t e d Reasoning P r o g r a m C a n Be Used An automated reasoning program can be used in three ways. You can submit the problem to it for study and disappear for some time, hoping on your return to find a solution—batch mode. You can sit at a terminal and have a dialogue with the program, asking it to execute single instructions you issue—interactive mode. You can submit the problem to it with a somewhat severe constraint on the time it is allowed or a constraint on the amount of new information to be found, and then examine its results to see how the next run should be modified-undergraduate assistant mode. In all cases, you must represent the problem to be attacked in a language ac ceptable to the reasoning program, pick inference rules for drawing conclusions, and choose strategies for controlling the inference rules. For any specific problem, the first of the three, knowledge representation, is
Achievements in Automated Reasoning
555
usually the most difficult. Concepts are hard to pin down; obvious information is often overlooked; false information can easily be supplied. While the concept of a "group" in mathematics can easily be pinned down, the concepts of "con currency" in computer programming, "circuit layout" in design automation, "table" in interior decorating, and "laughter" cannot be easily pinned down. The fact that every person is either female or male is assumed and therefore often overlooked. The statement that it is permissible to divide any number by any other number is false—obviously, zero is not permitted as a divisor. After making the various choices, you usually assume the goal unreachable, the theo rem false, or the fact not deducible from the given information. The problem is solved when a contradiction is found. Examination of the output of the reasoning program often shows what else is needed to pin down a concept, what mundane information is missing, and even what false information is present. Sometimes the output contains the missing keys to solving the problem under study—a useful lemma, a fact that suggests the needed conjecture, a hole in a proposed proof, or the complete solution. The answers to various previously open questions, some superior logic cir cuits, and the results of different types of research were all obtained with the assistance of one single automated reasoning program AURA. This assistance often takes the form of a series of computer runs. As with any assistant or col league, sometimes the result is total failure, sometimes partial help, and some times complete success.
Disadvantages of Using an A u t o m a t e d Reasoning Assistant The use of an automated reasoning program has the disadvantage of requiring you to carefully pin down the concepts involved in your application or research. For example, if the problem to be solved is about people, you must inform a reasoning program that every person is female or male. But you must also tell the program that a person cannot be both. You must often supply mundane and trivial information. If Roberta is one of the people in the problem, you must state that Roberta is female—a fact you know because of the name Roberta. A reasoning program understands very few concepts a priori. Of course, once you have produced a database that reasonably characterizes the domain of investi gation, you can use it repeatedly. A related disadvantage is the requirement of using a language other than that which you might prefer. (A language used by reasoning programs is illustrated in the second article.) This annoying disadvantage occurs both in supplying the needed information to a reasoning program and in understanding its output. Since the better reasoning programs offer a wide variety of choices to the user, there is the disadvantage of choosing from among a number of options.
556
Collected Works of Larry Wos
You can choose from among various inference rules, various strategies, various representations, and various procedures. In effect, you are presented with a com plicated instrument that can execute complex commands and complete difficult tasks. The situation is rather like listening to music with an advanced stereo system that gives you access to filters, an equalizer, an attenuator, and various dials for producing sound according to your tastes. A two-dial pocket radio is much easier to use, but it does not suffice for many purposes.
Advantages of Using a n A u t o m a t e d Reasoning Asssistant One advantage of using an automated reasoning program is its ability to reason without error. No implicit assumptions accidentally occur, and no conclusions are drawn that fail to follow from the given information. A result obtained with a reasoning program-a proof of a theorem, a design of a circuit, a verification of computer code—can generally be accepted. The "generally" follows from the possibility that the input clauses may contain misinformation and, of course, the possibility that the reasoning program may not be free of bugs. The first possibility can be minimized by making a general run whose conclusions are then examined for obvious nonsense. Similarly, missing information can be de tected with such an examination. The second possibility is mitigated by the explicit treatment a reasoning program gives to all derivations of information. The program can tell you which facts and statements were used to deduce which conclusions. If desired, you can execute the algorithm the program executes to see if the "proof holds. Another advantage of using a reasoning program is its capacity to examine large numbers of paths in search of a solution. Its effectiveness is not substan tially decreased even when the information is very complex, as occurs when processing very long formulas from mathematics or very complicated logical expressions from circuit design. Finally, a reasoning program can seek to prove some statement true or equally to find a counterexample. Neither side of a question is more attractive, as is often the case when a person is presented with a problem. In addition, you can impose your knowledge and intuition on the program's attempt to answer a given question.
Problems with A u t o m a t e d Reasoning Even though the advantages appear to sharply outweigh the disadvantages, many problems remain. Much more must be learned about knowledge represen tation. More effective inference rules must be found. More powerful strategies are needed.
Achievements
in Automated
Reasoning
557
With regard to knowledge representation, a characterization of the relevant concepts is not yet available, at least for many fields of study and for many applications. You are required to attempt to pin down a concept, rather than simply using an existing database. You must choose between using and avoiding relations such as equality. You must weigh the choices for representation to decide which fits best with the choices to be made from among the inference rules and strategies. The choices for the three—representation, inference rule, and strategy—should be made with all three in mind, if you wish to increase the chance of your reasoning program succeeding. The effects of the three are tightly coupled. User interfaces permitting you to interact easily and naturally with a reasoning program must be developed. Such an interface would allow you to use notation and terminology of your choosing, rather than learning a language like that illustrated in the next article. With regard to inference rules, methods of reasoning are needed that take much larger steps. Rules are needed that employ semantic criteria, rather than the current syntactic criteria. The user should be provided with a means for dictating the structure of the reasoning—for controlling the depth, breadth, and size of the steps being taken. With regard to strategy, a means must be found to prevent the program from drawing so many irrelevant conclusions. For even the simplest of problems, a reasoning program ordinarily accrues much information that has little or nothing to do with the problem under attack. Of course the information is sound, follows logically from that which you supply. But this extra and unneeded information interferes with the performance of the program, often causing it to get totally lost. A related problem is the ability of a reasoning program to deduce the same fact-or trivial instances of an existing fact-many, many times. For example, problems exist that, if attacked with a reasoning program, are solved but only after some fact—or instances of that fact—has been deduced thousands of times. When strategies that direct an automated reasoning program more effectively and, even more important, that restrict it more effectively are available, such a program will become a far more valuable reasoning assistant. Summarizing, for reasoning programs to reach the stage where they are commonly employed, they must be simple to use and must return solutions even faster than they do now. Nevertheless, as they are currently structured, automated reasoning programs provide valuable assistance of many kinds.
Future of Automated Reasoning The field of automated reasoning is young, challenging, and exciting. Interest in the field has grown to the point that a new journal, Journal of Automated Reasoning, will commence publication by D. Reidel in 1985. In the second article, the objectives, purpose, and content of this new journal will be dis cussed. Successes—in answering previously open questions, designing superior
558
Collected Works of Larry Wos
logic circuits, validating existing circuits, verifying algorithms currently in use— illustrate the value of using an automated reasoning program. Although many problems still exist for the field, much progress is evident and the future appears very promising. Such optimism results from a number of developments. Various people far from expert in the field of automated reasoning have successfully used auto mated reasoning programs. The advent of parallel-processing computers offers both the potential for far faster execution of programs and the possibility of formulating algorithms that benefit from parallelism. The use of various expert systems demonstrates the value of automated reasoning in areas such as med ical diagnosis and mineral prospecting. The performance of logic-programming languages such as Prolog establishes the usefulness of languages designed for algorithmic reasoning. Finally, the recent formulation of certain inference rules and strategies relying heavily on semantic criteria addresses an important need in automated reasoning. Soon it may be commonplace for many applications and much research to rely on a program that functions as a high-level, automated reasoning assistant.
Answers to Problems and Puzzles • The circuit shown in Fig. 1 does in fact satisfy the requirements. • Of the three checkerboards shown in Figs. 2, 3, and 4, no placement of dominoes exists that covers precisely either of the first two, while the third can in fact be covered precisely. • The circuit design in Fig. 6 is a solution to the third problem. • The fourth and final problem is merely an example of what can be done, and therefore does not admit of an answer other than that such subroutines have been verified.
Larry Wos is a member of the Automated Reasoning Group of the Mathe matics and Computer Science Division at Argonne National Laboratory. A new book, Automated Reasoning: Introduction and Applications, by Wos, Overbeek, Lusk, and Jim Boyle has just been published by Prentice-Hall. It is written in an informal style and assumes no background on the part of the reader. Applica tions specifically discussed include the design of logic circuits, control systems, proving properties of computer programs, and mathematics research. The mate rial is taken from actual experience with existing automated reasoning programs that are available for use by those interested in applications or research.
Achievements in Automated Reasoning
559
J>3>.
3>
rO
^
:£> rl>^>
£>[>■
-O
"Ob
-O-
■O-
M
:[>
^CK,
Figure 6 Circuit design (note that in the original paper, x was replaced by il, y by i2, z by i3, not x by ol, not y by o2, and not z by o3)
Computational Sciences
Automated Reasoning Programs: How They Work By Larry Wos This is the second of two articles. In the first article, published in the July issue of SIAM News, you learned that computer programs exist that can be used as automated reasoning assis tants. You also learned that the successes achieved with such programs include answering previously open questions in mathematics and in formal logic, design ing superior logic circuits, validating the design of existing circuits, and verifying algorithms currently in use. In all of the cited cases, the role of the program that was used was to reason logically from a description of the problem. In this article, you will learn the answers to the following questions: • How does an automated reasoning program, of the type discussed here and in the first article, know what the problem is about? • How does such a program reason? • How is the reasoning controlled to increase the likelihood of finding a solution to the given problem?
A Puzzle t o Solve To answer these questions, a simple puzzle—the fruit puzzle —will suffice: There are three boxes, respectively labeled apples, oranges, and bananas (see Fig. 1). Unfortunately, each box is mislabeled. You are correctly told that each box contains exactly one of the three kinds of fruit, and no two boxes contain the same kind. You are also correctly told that box 2-the one labeled orangesactually contains apples. You are asked to determine the contents of boxes 1 and 3, and, of equal importance, then prove that your answer is correct. Puzzles are often abstractions of some class of everyday problems. For exam ple, the domino-and-checkerboard puzzle, given in the first article, is represen tative of layout problems. The chance of solving puzzles like the domino-andcheckerboard puzzle and the fruit puzzle is sharply increased by using logical reasoning; the proof that the solution is correct requires it. Reprinted with permission from SIAM News, Vol. 14, No. 4, pp. 4-5 (July 1984).
Automated
Reasoning Programs: How They
Work
561
Figure 1 Fruit puzzle
The fruit puzzle will be used to illustrate a language you can use to describe a problem to a reasoning program of the type discussed here and in the first article, inference rules that permit such a program to draw logical conclusions, and strategies that are available to control the reasoning.
W h a t You Must Do to Use a Reasoning P r o g r a m For an automated reasoning program to solve a puzzle or problem (see Fig. 2), you must describe the puzzle or problem to the program. Rather than using the language in which the problem is naturally stated, you must employ some language that provides appropriate rigor and removes ambiguity. You are often forced to include mundane and obvious information-for example, that box 1 is different from box 2.
You must then choose some inference rule(s)—way(s) of reasoning—or rely on the default choice made by the program. Some inference rules that are avail able take small reasoning steps; some take moderate-size steps; some behave like equality substitution. As with problem solving in general, the kind of reasoning that is employed can markedly improve your chance, or the program's, of solving the problem. Finally, you can impose strategy on the program's attempt to solve the prob lem. In particular, you can employ a strategy that imposes your knowledge and intuition to direct the program's focus of attention, and you can simultaneously employ a strategy that forces the program to avoid consideration of various paths of inquiry. Valuable hints based on your experience can be most use ful. Avoiding fruitless paths of reasoning often transforms a failure into instant success—for a person, or for an automated reasoning assistant.
Collected Works of Larry Wos
562
Posing the problem to the reasoning program
Directing the program's focus
• •
•*
• • •. • • • •
• : • •
Drawing conclusions by applying inference rules
Rewriting and simplifying conclusions
Testing for significance
Integrating those that are significant
Figure 2 Solving a puzzle
Automated
Reasoning Programs: How They
Work
563
A Reasoning P r o g r a m Solves a Puzzle To inform a reasoning program that box 2 contains apples, (1)
CONTAINS(box2,apples)
suffices. Similarly, (2) (3) (4)
LABEL(boxl,apples) LABEL(box2,oranges) LABEL(box3,bananas)
convey the label information in the puzzle. Between each pair of numbered statements, the program assumes an implicit occurrence of "and". To state t h a t each box contains apples, bananas, or oranges, (5)
CONTAINS(xbox,apples) I CONTAINS(xbox,bananas) I CONTAINS(xbox.oranges)
is used, where "|" is read as "or", and where "xbox" is read "for all x" with x ranging over the possible boxes. To say that every box is mislabeled, (6)
-LABEL(xbox.yfruit)
I -CONTAINS(xbox.yfruit)
is the choice, where "-" is read as "not". To see this, first note that "if P , then Q" is logically equivalent to "not P , or Q". The statement to be translated into the language under discussion can be written "if box x is labeled y, then box x does not contain y", for all boxes x and all fruit y. Similarly, noting that "not(not(P))" is logically equivalent to " P " , (7)
EQUAL(xbox.ybox) I -CONTAINS(xbox,zfruit) I -CONTAINS(ybox,zfruit)
conveys the information that each fruit is contained in at most one box. The statements (8) (9) (10)
-EQUAL(boxl,box2) -EQUAL(box2,box3) -EQUAL(boxl,box3)
convey the inequality pairwise of the three boxes, and illustrate supplying ob vious and mundane information. Although statements 1 through 10 (called clauses) do not fully capture the concepts and statement of the puzzle, they are sufficient for illustrating the language, inference rules, and strategy that can be used by a reasoning program. An example of information that is not captured by statements 1 through 10 is the fact that each box contains exactly one kind of fruit. You might write down your representation of the fact in this language of clauses.
564
Collected Works of Larry Wos
How a Reasoning P r o g r a m Knows It Has Succeeded Statements 1 through 10 are sufficient for a reasoning program of the type under discussion to solve the puzzle. However, they are not enough for a reasoning program to "know" that it has solved the puzzle when the solution has been found. To see what is missing, you need to know that, when an automated reasoning program is asked to prove something, it usually seeks a "proof by contradiction". Since you are asked in the puzzle to prove your answer correct, and since the puzzle is being solved by a reasoning program, information is needed to enable it to find a "proof by contradiction". In particular, in many uses of such a program, you are required to add a statement or statements that amount to assuming the problem under study is unsolvable or that the expected answer is false. For example, if you ask a reasoning program to use certain components to design a circuit meeting given specifications, you add statement(s) that say no circuit of the type can be designed. If you wish the program to prove that Nan is married, you inform the program that she is not. If you request a proof that a specific subroutine correctly finds the maximum element of any given array, you tell the program that there exists an array for which the subroutine fails to correctly find the maximum. If the object is to prove that a group satisfying certain properties is commutative, then you give the program the assumption that there exists a noncommutative group satisfying the given properties. A rea soning program "knows" it has succeeded in fulfilling your request when among its facts—those you give it to begin with, and those it deduces-a contradiction can be found. What is not necessary is for you to reason out the solution, and then use the reasoning program simply as a proof checker. Of course, it can be used this way, but much more can be asked of it. For example, a reasoning program proved an existing 16-bit adder was correctly designed-the proof consisting of 297 steps, obtained in less than 20 seconds of CPU time on an IBM 3033. The proof was obtained by describing the design of the adder, giving the required output, assuming the circuit fails to meet its specifications, and submitting the problem to the reasoning program AURA (Automated Reasoning Assistant).
How You Enable a Reasoning P r o g r a m to Test for Success Although the puzzle could be submitted to a reasoning program with the in struction of simply searching for information, the following approach illustrates a more typical use of such a program. (If statements 1 through 10 alone were
Automated
Reasoning Programs: How They
Work
565
used to submit the puzzle for consideration, the program would solve the puz zle correctly. However, the program would most likely continue to reason even after the solution had been found, stopping only when nothing more could be deduced. It would have no way of "knowing" t h a t the puzzle had been solved. A subsequent examination of the conclusions drawn by it would reveal the con tents of both boxes 1 and 3; the contents of box 2 are known at the start to be apples. The additional statements, given shortly, would not b e needed, but they provide a means for the program to "know" it has succeeded.) What is the typical approach to solving the fruit puzzle and to solving prob lems in general? In this puzzle, the reasoning program is asked to determine the contents of both boxes 1 and 3, and then prove the answers correct. An accept able approach is to have the reasoning program first determine the contents of box 1, prove that the answer is correct, and then do the same for box 3. In view of the earlier discussion about missing statements and proof by contradiction, you could start by assuming that "box 1 does not contain bananas" or t h a t "box 1 does not contain oranges". If you assume the former, then -CONTAINS(boxl,bananas) is the missing statement to be given to the reasoning program to enable it to seek a contradiction and, if it finds one, "know" it has succeeded in its attempt to determine the contents of box 1. If you assume the latter, then -CONTAINS(boxl,oranges) is the missing statement. If the information in the puzzle together with the first of the two clauses just given is sufficient to prove that box 1 actually does contain bananas, then adding the first of the two to the 10 given earlier and then submitting the set of 11 to a reasoning program will enable it to find a "proof by contradiction". Before giving a proof that a reasoning program might find, illustrating the kind of reasoning and strategy it can use, here is one you might give.
A Person's Solution to the Fruit Puzzle You might begin with the "false" assumption that (11)
-CONTAINS(boxl.bananas)
box 1 does not contain bananas. Your first conclusion might be that box 1 does not contain apples, since box 2 does. From the "false" assumption 11 and your first conclusion, your second conclusion might be that box 1 contains oranges. Your third conclusion might be t h a t box 3 does not contain apples, and your fourth that box 3 does not contain oranges. Your fifth conclusion might then be t h a t box 3 contains bananas. Since according to the puzzle every box is mislabeled and, therefore, its label cannot match its contents, your sixth conclusion
Collected Works of Larry Wos
566
might be that box 3 is not labeled bananas. But box 3 is in fact labeled bananas, and you have thus found a "proof by contradiction". The assumption that box 1 does not contain bananas is the culprit-the rest of the statements correspond to facts in the puzzle-so box 1 in fact does contain bananas.
How an A u t o m a t e d Reasoning P r o g r a m Can Reason To see how an automated reasoning program can find a proof precisely like that just given, you must first understand how some of its inference rules work. The basic rule takes two statements and attempts to draw a conclusion from them, provided that a common ground can be found to which both statements apply. For example, application of the basic rule to clauses 1 and 6 enables a reasoning program to conclude -LABEL(box2,apples)
stating that box 2 is not labeled apples, which is clearly true. The reasoning program obtains the conclusion by relying on the fact that all variables in all clauses are implicitly treated as meaning "for all", and by observing the con vention that all expressions beginning with "x" or with "y" are variables. The conclusion is drawn by finding the most general replacement for the variables in -CONTAINS(xbox.yfruit)
of clause 6 that produces (except for sign) an expression identical to clause 1, applying the replacement to all of clause 6, and then canceling that part of the result that is identical (except for sign) to clause 1. Finding most general re placements for variables that, when applied, produce identical (with the possible exception of sign) expressions is at the heart of automated reasoning. Similarly, application of this particular inference rule to clauses 1 and 7 yields EQUAL(xbox,box2) | -CONTAINS(xbox,apples) which says that if a box contains apples, it must be box 2. Although the inference rule just illustrated is occasionally of some value, its use usually produces too many new facts, each representing too small a step. To enable a reasoning program to take larger steps resulting in increased effectiveness of the program, various refinements of that rule are thus preferred. The rule used in the next section to solve the puzzle is such a refinement. It yields a proof like the one given earlier, the one you might have given. An illustration of how it works can be provided by simultaneously considering clauses 8, 1, and 7. Application of this second rule establishes that box 1 does not contain apples. While the basic rule must be applied to pairs of clauses, this refinement can be applied to statements taken two at a time, three at a
Automated Reasoning Programs: How They Work
567
time, or more, depending on certain conditions being met. The conditions are given in terms of the notions of "simple" and "complex" applied to clauses. Clauses 1 through 4 and 8 through 11 are "simple" clauses, while 5 through 7 are "complex" clauses. The inference rule to be used in the program's solution of the puzzle is required to deduce simple clauses only, while the preceding inference rule is not subject to such a constraint. Many other inference rules, subject to various constraints, are often available in an automated reasoning program.
A Reasoning Program's Solution to the Fruit Puzzle Given clauses 1 through 11 and using the more powerful inference rule, the following proof could be obtained by an automated reasoning program. This proof, if translated into the language of the puzzle, is precisely that cited earlier. From clauses 8, 1, and 7: (12) -CONTAINS(boxl.apples) From clauses 12, 11, and 5: (13) CONTAINS(boxl,oranges) From clauses 9, 1, and 7:
(14)
-CONTAINS(box3,apples)
From clauses 10, 13, and 7: (15) -CONTAINS(box3,oranges) From clauses 14, 15, and 5: (16) CONTAINS(box3,bananas) From clauses 16 and 6: (17) -LABEL(box3,bananas)
Since clauses 17 and 4 contradict each other, a "proof by contradiction" has been found. The assumption, clause 11, that box 1 does not contain bananas is proved false, so box 1 does in fact contain that fruit. Notice that, as it turns out, clause 13 (among others) represents false infor mation, but information that follows logically from the given data. Rather than illustrating the weakness of using a reasoning program, the deduction of clause 13 shows how such a program adheres rigorously to sound reasoning. In fact, examination of the results yielded by a reasoning program's attack on a problem often unearths assumptions that are not valid. Such errors can be detected by
568
Collected Works of Larry Wos
discovering a deduced fact that is clearly false, that was found by the program, but that was found without using the input clauses that were deliberately added to represent false information.
Strategy to Enable a Reasoning Program to Win Without strategy, a reasoning program will usually fail to solve the given prob lem or answer the posed question. It is simply very easy to get lost, and very easy to draw far too many irrelevant conclusions. Especially valuable is strategy that avoids fruitless paths. The strategy to be illustrated is the "set of support strategy"—a strategy that restricts a reasoning program's search for new information (see Fig. 3). This strategy enables the program to avoid many fruitless paths of investigation. The set of support strategy asks you to pick certain key input clauses from which the program can begin reasoning, treating the remaining input clauses as auxiliary information. Clause 11 is such a key clause; it represents the assumed false information that is intended to lead eventually to finding a contradiction. Clause 1 is another key clause; it represents vital information for solving the puzzle. What may be a surprise is that clauses 2 through 10 can in fact be treated simply as auxiliary information. In particular, to solve the puzzle, the program need not draw conclusions that depend only on clauses 2 through 10. (For those who are curious, the relevant theorem for the set of support strategy can be paraphrased by saying that, if the complement of the chosen input clauses is consistent, then avoiding reasoning purely from this consistent set works.) Ex amination of the given proof shows that none of its steps is deduced solely from clauses 2 through 10.
How and When to Use an Automated Reasoning Program The choices of representation, inference rule, and strategy should not be made separately. The effects they have on a reasoning program's performance are tightly coupled. Although this fact might imply that you must be an expert in automated reasoning to use such a program effectively, it is not the case. Much of the successful use of reasoning programs is by individuals who are far from expert in automated reasoning itself. Such programs are still quite difficult to master, but the mastery of any area from which a great deal can be derived usually is difficult. An automated reasoning program can be used when seeking a proof, gen-
Automated Reasoning Programs: How They Work
No Strategy INFORMATION
Set of Support Strategy KEY INFORMATION
Figure 3 Using strategy
AUXIUARY INFORMATION
569
570
Collected Works of Larry Wos
erating a model or counterexample, forming a conjecture, testing hypotheses, and for many other purposes. For example, if you have tentatively decided on a design or on the constraints for some layout or on the hypotheses for making some decision, you could give the conditions to a reasoning program. You could then ask it to draw some number of conclusions from the given input. An ex amination of the conclusions might reveal flaws in the plan as given, enabling you to ask the program for the list of input assumptions that led to the un desirable conclusion. After all, a reasoning program can make explicit precisely which facts were used to draw each conclusion. Relying on the assistance of a reasoning program might thus avoid costly and painful choices. Applications in which automated reasoning (AR) has already proved useful include the design and validation of logic circuits, the verification and synthe sis of computer programs, and research in mathematics and in formal logic. Applications in which AR may prove useful include the verification of reactor safety systems, organic chemical synthesis, robotics, and the design of control systems. For example, members of the Mathematics and Computer Science Di vision at Argonne National Laboratory are currently studying the feasibility of using automated reasoning in the first of these four new endeavors, while some faculty members of the Illinois Institute of Technology together with members of Argonne's Mathematics and Computer Science Division are investigating the second of the four. By trying different applications and by attempting to answer open questions with the assistance of a reasoning program, the field of automated reasoning has made and will continue to make progress. Such actions will lead to extensions of the theory, improvements in the software, and more understanding of what is still needed. With the progress that seems likely in the next few years, many people may come to rely in various ways on a computer program—a program that functions as a high-level automated reasoning assistant.
AUTOMATED REASONING* L. WOS Mathematics and Computer Science Division, Argonne National Laboratory, 9700 S. Cass Avenue, Argonne, IL 60439 1. Introduction. Two of the principal activities of mathematicians and lo gicians are the search for a proof of some lemma or theorem and the search for some model or counterexample. Until recently, both activities were conducted by the researcher alone or conducted with a colleague or colleagues with a simi lar interest. Recent occurrences suggest that another alternative now exists. The alternative is that of relying on the assistance of a computer program, an auto mated reasoning program. One such automated reasoning program, AURA (for Automated Reasoning Assistant) [12], has in fact provided valuable assistance in answering certain previously open questions from the fields of ternary Boolean algebra [14], finite semigroups [16], [17], and equivalential calculus [15], [21]. The capacity of this program both to find proofs and to generate models and counterexamples played a vital role in answering the open questions. AURA is not the only automated reasoning program that has been used to obtain new results in mathematics. Slightly more than 15 years ago, a reasoning program [3] of a distinctly different design proved a lemma in lattice theory that had not been previously known. Just as the computer has been used for years to assist in certain numerical aspects of mathematics, it can now be used to assist in various reasoning aspects. Since an automated reasoning program can provide such valuable assistance in diverse fields of mathematics and formal logic, you might wish to know more Lawrence Wos received his Ph.D. in mathematics under Reinhold Baer at the University of Illinois in 1957. Since then, he has conducted research in various aspects of automated theorem proving and automated reasoning at Argonne National Laboratory, Argonne, Illinois 60439. He introduced the notion of "strategy" into the field. In collaboration with one of his colleagues, he answered (previously) open questions in abstract algebra and in formal logic. The questions were answered by relying heavily on the automated reasoning program AURA developed jointly at Argonne and Northern Illinois University. In recognition of his achievements, Wos (together with his colleague) was awarded the Mathematics Prize for the best current research in automated theorem proving. 'This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research of the U.S. Department of Energy under Contract W-31-109-ENG-38 Reprinted from the American Mathematical Monthly, Vol. 92, no. 2, pp. 85-92 (February 1985).
Collected Works of Larry Wos
572 about it. 1. What is automated reasoning?
2. What has been achieved with the assistance of an automated reasoning program? 3. How much work is required to use such a program? 4. Is such a program available? 5. Which types of research are amenable to assistance from such a program? By answering these questions, I intend to satisfy the curiosity of some, pique the curiosity of others, and, most important, enlist the aid of both mathematicians and logicians in finding additional open questions to attack with the assistance of an automated reasoning program. Equally, I wish to interest members from various fields to begin actively using a reasoning program as a research assistant. 2. The Elements of Automated Reasoning. Automated reasoning is concerned with the discovery, formulation, and implementation of concepts and procedures that permit the computer to be used as a reasoning assistant. One of the primary objectives is the design and implementation of a computer program—often called a theorem-proving program—that automates the process known as reasoning. By reasoning, we mean the process of drawing conclusions rigorously, as in mathematics and in formal logic. Reasoning here means logical reasoning, not probabilistic or common-sense reasoning. When a conclusion is drawn from some given set of assumptions, the conclusion must follow logically and inevitably. If the conclusion itself represents false information, then one of the assumptions from which it was obtained is false. How does an automated reasoning program derive its logical power and rigor? A program of the type under discussion reasons by applying well-defined inference rules to statements called "clauses". (The discussion of automated reasoning programs given here is influenced by our particular programs. Certain features, for example the use of "clauses" and of "weighting", are often not available, especially in those programs with a quite different design.) For the concept of a "clause", first note that, informally, an "atom" is a statement free of logical operators. A "literal" is an atom or an atom preceded by the "not" operator. Finally, a "clause" is the "or" of a (possibly empty) finite set of literals. For example, the axiom of left identity in a group—the product of e and a; is a; for all x—can be written as the clause PRODUCT(e,x,x), which contains a single literal. Where "-" denotes "not" and "|" denotes "or", the statement "the subset H is closed under addition" can be written as the clause
Automated
573
Reasoning
-H(x) I -H(y) | H(sum(x,y)) in which the first two literals are called "negative literals". This clause, which can be read "if x and y are in H, then their sum is in / / " , is obtained by using the fact that "if P, then Q" is logically equivalent to "not P or Q". Each inference rule selects from the available information some number of statements, each of which satisfies certain syntactic requirements, and yields a conclusion only if it satisfies certain (possibly different) syntactic requirements. For example, one inference rule employed by reasoning programs yields a con clusion only if it contains a single literal. Another inference rule requires that the conclusion contain only positive literals, placing no restriction on their num ber. Many inference rules that are employed are generalizations of the familiar rules of modus ponens and syllogism. Still others generalize equality substitu tion. For example, an inference rule exists that, when applied to the equations "x H—x = 0" and "y + (—y + z) = z", yields in a single step "y + 0 — -(—y)". In clause form, from EQUAL(sum(x,minus(x)),0) and EQUAL(sum(y,sum(minus(y),z)),z) the clause EQUAL(sum(y,0).minus(minus(y))) is obtained. To be acceptable, an inference rule must be sound: the conclusions obtained with it must be logical consequences of (the conjunction of) the state ments to which it is applied to yield them. From the viewpoint of model theory, an inference rule is sound if, when it is applied to a set of premisses to yield a conclusion, the conclusion holds in any model that satisfies the premisses from which it is obtained. When an automated reasoning program draws a conclusion, as in the spirit of high school geometry, it cites the specific and immediate ancestors of the conclusion, thus enabling you to check its work. All steps of a chain of reasoning are made explicit; you can check any or all steps of a deduction simply by executing the same algorithm that was executed by the reasoning program. Any proof obtained by a reasoning program can, therefore, be refereed in a straightforward though tedious manner. But how does a reasoning program recognize that a proof has been obtained? By far the most common form of proof obtained by an automated reasoning program is a proof by contradiction. As often occurs in mathematics, you begin by stating the theorem under study and assume it to be false. If the symbolic form of the theorem is "if P, then Q", you assume P true and Q false. Should "if P, then Q" be a theorem, making this assumption yields a self-contradictory set of statements. Such a set of statements is called an "unsatisfiable" set. In the
574
Collected Works of Larry Wos
typical case, an automated reasoning program is presented with an unsatisfiable set of statements and asked to establish the unsatisfiability. Such a program recognizes it has completed a proof when it finds two statements that obviously contradict each other. For example, the program might eventually deduce that for some element a, a is not equal to o. Since the reflexivity axiom of equals, x = x, is ordinarily included in the submission of a problem to a reasoning program, deducing that a is not equal to a immediately signals a contradiction. How does a reasoning program search for a proof, given statements that correspond to assuming P true and Q false? After all, in mathematics and in logic a random and undirected search seldom succeeds. Since the computer is so fast, does a reasoning program simply conduct an exhaustive search until the contradiction is discovered, discovered more or less by accident? By no means, for an attempt to prove even the most uninteresting theorems with an exhaustive search produces a tremendous number of facts, almost all of which are irrelevant. Even though the computer is very fast, such a search requires far too much time. What occurs instead, when using an automated reasoning program, is the employment of "strategy". Some strategies, called "ordering strategies", direct a reasoning program's attack on a problem, employing criteria for selecting the information on which to focus next. Some strategies, called "restriction strategies", restrict a reasoning program's attack, totally prohibiting certain paths from being explored. An example of an ordering strategy is "weighting" [9]. You can assign "weights" to the various concepts in a problem, enabling a reasoning program to give pri orities to the concepts. The program selects the information on which to focus next according to these priorities, selecting the least complex information for focus. You can assign weights to define "complexity" strictly in terms of the number of symbols in an expression. On the other hand, you can choose the op posite strategy—define "complexity" so that the more symbols in an expression, the more it is preferred for being considered next. As another alternative, you can assign weights so that multiplication is preferred over sum, so that inverse is preferred over identity, and so that the cube of an element is preferred over its square. Weighting allows you to impose your knowledge and intuition on the program's attack on a problem. An example of a restriction strategy is the "set of support strategy" [18]. This strategy is in effect often employed by mathematicians and logicians, al though not with an official name. The strategy attempts to take full advantage of the assumed consistency or satisfiability of the set of statements that corre sponds to P, where the theorem under consideration has the form "if P, then Q". That set of statements—call it P'—is satisfiable, for its correspondent P typically consists of the axioms for some domain of inquiry together with certain additional hypotheses. For example, if you were studying Boolean rings—rings in which, for all x, the product of x with itself is x—then the set P would consist of the axioms for a ring together with a statement that the ring is Boolean. Imagine that you wish to prove that such a ring is commutative, that xy = yx
Automated Reasoning
575
for all x and y. You would begin by assuming the theorem false-assuming that there exist elements o and 6 in the ring with ab not equal to ba. You would then have three sets of clauses—A' which consists of the clauses that correspond to the axioms for a ring, S" which consists of those that correspond to the Boolean property, and D' which consists of those that correspond to assuming such a ring is not commutative. The set P ' would then be the union of A' and 5'. The idea behind the set of support strategy is to prevent an automated rea soning program from randomly selecting clauses from P ' from which to draw conclusions. Such a random search for new information simply explores the the ory of Boolean rings, rather than concentrating on the theorem to be proved, namely, such rings are commutative. Further, since the objective is to obtain a proof by contradiction, and since this forward search from P ' produces ad ditional consistent information, the proof will be found only by accident—by accidentally proving commutativity. When used as recommended, the set of support strategy restricts the actions of a reasoning program by preventing it from applying an inference rule to a set of premisses all of which are in A\ the correspondent of the set of axioms. To use the set of support strategy, you choose a subset T of the set S of clauses that represents the problem to be studied. In the spirit of the example just discussed, the recommended choices for T are either the union of S' and £>', or D' alone. For a set of premisses from among the elements of S to be considered by an inference rule, the set is required to contain at least one element of T. By imposing the strategy on a reasoning program's search for information, the program is forced to key (at least recursively) on the elements in the chosen subset T. In the example from Boolean rings, the recommended choices for T cause the program (recursively) to key on the Boolean property or on the fact that ab is assumed different from ba. All new information is therefore traceable to S' or to D\ If any lemmas from ring theory are supplied as part of the problem description, in keeping with the intent of the strategy, they are not included in T. The choice of T as the union of S' and D' is reminiscent of the practice in mathematics and logic, for it causes an automated reasoning program to emphasize the role of the special hypothesis of the theorem—to key on those statements that are part of P but are not the axioms and lemmas that are supplied. An automated reasoning program of the type under discussion relies on two additional processes to enhance its effectiveness in finding proofs and in gener ating models and counterexamples. The first process, known as "subsumption" [10], enables a reasoning program to prefer general information to specific in formation. When presented with two statements such that one is captured by the other as a trivial corollary, the program discards the corollary. For example, in the ring problem cited earlier, if the program discovers that x + x = x (for all x) and that a + a = a, then the second discovery is discarded in favor of the first. (Typically, the lemma that x + x = x for all x is in fact found and used in the proof that Boolean rings are commutative.) The order of the discoveries
Collected Works of Larry Wos
576
is not relevant, only the relative generality of the two statements. By means of subsumption, an automated reasoning program performs as a mathematician or logician often does, retaining the theorem and discarding the trivial corollaries. The other process that enhances effectiveness is "demodulation" [20]. Through demodulation, a reasoning program normalizes and simplifies information. For example, with the appropriate information present, the program will replace 0 + x by x, — (—i) by x, (xy)z by x(yz), and xy + xz by x(y + z). In other words, demodulation enables a reasoning program, if so instructed, to remove the (additive) identity from expressions, to cancel the inverse of the inverse, to right associate all expressions, and to use distributivity to write certain ex pressions in a factored form. The information for normalizing and simplifying can be supplied to the program at the beginning, and this information can be added to or found by the program as it conducts its search for the proof or for the model or counterexample. Despite the existence of a number of as yet unanswered questions concerning the use of demodulation, the process is a most valuable and often necessary feature for solving problems. 3. Successes. The attempt to answer open questions with the assistance of an automated reasoning program often benefits both fields—the field of math ematics or logic from which the problem is selected, and the field of automated reasoning. The various obstacles that are encountered, if overcome, lead to en hancements of existing techniques or even to totally new techniques for attacking problems. The value of finding open questions that are amenable to considera tion by a reasoning program cannot be overestimated. In fact, your assistance in the search for such open questions is strongly encouraged. Equally, your use of a reasoning program in your own research could be beneficial to both mathematics and to automated reasoning itself. The first open question that was answered with the aid of the automated reasoning program AURA (Automated Reasoning Assistant) [12] concerns the possible dependence of certain axioms for a ternary Boolean algebra [14]. A ternary Boolean algebra is a nonempty set satisfying the following five axioms, where the function / can be thought of as a three-place "product" and g as inverse: (1) f ( f ( v , w , x ) , y , f ( v , w , z ) ) (2) f ( y , x , x ) - x
f(v,w,f(x,y,z))
(3) f(x,y,g(y)) = x (4) f ( x , x , y ) = x (5) f ( g ( y ) , y . x ) - x The precise question to be answered is: Are any of the first three axioms inde pendent of the remaining four? (The fourth and fifth were already known to be dependent.) Each of the first three was proved independent by finding a model satisfying the remaining four but failing to satisfy the axiom in question. It was this study of ternary Boolean algebra that led to the technique for generating
Automated
Reasoning
577
models and counterexamples [13] using an automated reasoning program. T h e next open question that was answered [16], [17] with the assistance of AURA concerns the possible existence of a finite semigroup admitting certain mappings in combination. Specifically, does there exist a finite semigroup admit ting a non-trivial antiautomorphism but admitting no non-trivial involutions? An antiautomorphism is a one-to-one onto mapping h with h(xy) = h(y)h(x). An involution is an antiautomorphism whose square is the identity. To be nontrivial, the mapping must not be the identity map. Commutative semigroups are of course not of interest for, in such a semigroup, an antiautomorphism is simply an automorphism. There does exist a non-commutative semigroup with the desired properties, and the first found has order 83 [16]. The smallest such semigroup [17] has order 7, and there are four such semigroups. Since there are over 800,000 semigroups of order 7, finding those four could present seri ous difficulties were one to simply sort through them looking for appropriate semigroups. The open questions of existence and minimality were answered by using generators and relations, relying on multiplication tables, considering pos sible isomorphisms, and applying "without loss of generality" arguments. The capacity of AURA both to find proofs and to generate models was required. Other questions that were answered [15], [21] by relying on AURA concern the classification of formulas in the equivalential calculus. The equivalential calculus is t h a t field of formal logic that studies the abstraction of "equivalence". In particular, the formulas
(1) E(x,x)
(reflexivity)
(2) E ( E ( x , y ) , E ( y , x ) ) (symmetry) (3) E ( E ( x , y ) , E ( E ( y , z ) , E ( x , z ) ) ) (transitivity) taken together can serve as a complete set of axioms for the calculus. (The designations of reflexivity, symmetry, and transitivity, not ordinarily used in equivalential calculus, are chosen to provide an intuitive understanding.) The elements of equivalential calculus are the expressions that can be recursively well-formed from the variables, x,y,z,w, ..., and the two-place function E. In the equivalential calculus, there exist individual formulas that are sufficiently strong that they serve as single axioms for the entire calculus. The shortest single axiom for the calculus contains 11 symbols, excluding grouping symbols and commas. Of the 630 such formulas of length 11, at the time we began our study, eleven were known to be shortest single axioms and seven remained unclassified with respect to this property. We decided to consider the corresponding open questions: Are any of the following seven formulas strong enough to serve as a single axiom for the equivalential calculus?
(1) XJL = E(x,E(y,E(E(E(z,y),x),z))) (2) XKE - E ( x , E ( y , E ( E ( x , E ( z , y ) ) , z ) ) ) (3) XAK = E ( x , E ( E ( E ( E ( y , z ) , x ) , z ) , y ) ) (4) BX0 - E ( E ( E ( E ( x , E ( y , z ) ) , z ) , y ) , x )
Collected Works of Larry Wos
578
(5) XCB =- E(x,E(E(E(x > y),E(z,y)),z)) (6) XHK = E(x,E(E(y,z),E(E(x,z),y))) (7) XHN = E(x,E(E(y,z),E(E(z,x),y))) In particular, it was conjectured that no additional shortest single axioms existed— that the remaining unclassified seven formulas are each too weak to serve as a single axiom. The study revealed that the first five are each too weak, but, contrary to the conjecture, each of the last two is in fact strong enough [15] to be a single axiom. To obtain these results, the model generation technique used successfully to answer the preceding questions was deemed unsuitable. The approach we chose was to seek a complete characterization of all deducible the orems from each formula under study. The characterizations were obtained by devising a means for an automated reasoning program to employ schemata [21]. Again the study of an open question led to a new technique for using an auto mated reasoning program. The proof that XHK is a single axiom consists of 87 steps, including steps containing 71 symbols not counting grouping symbols and commas. The proof that XHN is a single axiom consists of 162 steps, including steps containing 103 symbols. An indication of the difficulty of completing these proofs is provided by the fact that there are more than 100,000,000,000 formulas containing 27 symbols. The program AURA, as well as various other automated reasoning programs, has also been used in various studies only distantly related to mathematics and formal logic. The program has been used to design logic circuits, some superior to those already known. It has been used to validate the design of existing circuits also, and to experiment with the operation of control systems. Reasoning programs have been used to prove given claims for computer programs. Finally, the possible use of such a program for chemical synthesis is currently being investigated. 4. Use and Availability. The biggest obstacle to using an automated reasoning program is language. As with various fields of mathematics and of logic, automated reasoning has its own notation. The most common notation relies on the use of "clauses" [19]. The clause language is very closely related to the first-order predicate calculus. The language treats variables as meaning "for all", so it is trivial to say that "the square of every element is the identity", for example. When you wish to express that something "exists", depending on the nature of the statement, you employ a function of the appropriate number of variables or employ a constant. In addition, the conjunctive normal form is used-all statements are implicitly assumed to be separated by "and", while all literals of a statement are separated by "or". The only other operator that is acceptable is "not". Nevertheless, the language is more than sufficient for attacking a wide variety of problems. In fact, the language of clauses is extremely powerful, as we discovered in the past few years. Relationships involving "if then" and "equivalent" present no problem, for they are simply transformed
Automated
Reasoning
579
into statements relying on "or", "not", and "and" having the same meaning. Despite the power and richness of the language, the presentation of a problem to an automated reasoning program is an art. In addition to the representation problem, there are closely related problems of choosing the appropriate rules of reasoning and of choosing the strategies to control the rules [19]. Good choices of representation, inference rule, and strat egy are extremely interconnected. The choices must not be made separately. Then there is the problem of providing the appropriate normalization and sim plification information. Even with these obstacles, as evidenced earlier, an au tomated reasoning program can be successfully used to solve problems, some of which are quite difficult. The value of such an automated assistant can be seen by noting that the researchers who solved the open questions knew remarkably little about the areas from which the problems were selected. You need not be an expert in automated reasoning to use such a program. The studies in circuit design, circuit validation, operation of control systems, and chemical synthesis are being conducted by people with little knowledge of automated reasoning. The people in question were able to initiate these studies by relying on manuals and by consulting with experts in automated reasoning. Even with the various successes and the current activities, we must again say that the use of an automated reasoning program is at present an art. Until recently, the available written material consisted of manuals and for mal texts on the subject. The book "Symbolic Logic and Mechanical Theorem Proving" by Chang and Lee [2] is a very readable and rather formal introductory text. It covers well the topics of representation, inference rule, strategy, demod ulation, and subsumption. The book "Logic for Problem Solving" by Kowalski [4] is somewhat less formal, and is particularly valuable for questions of repre sentation. It covers applications such as state-space problems, and introduces the topic of logic programming with specific attention to the programming lan guage of Prolog. The book "Automated Theorem Proving: A Logical Basis" by Loveland [5] presents a complete and thorough treatment and in a very formal manner. It contains much material on the logical foundations of the subject, including various completeness theorems. The book "Automation of Reason ing, Volumes 1 and 2, Classical Papers on Computational Logic", edited by Siekmann and Wrightson [11], contains the important research papers on the subject written before 1971. The editors have provided a valuable guide to this collection by designating which of the papers deserves special attention. The book "Automated Theorem Proving: After 25 Years", edited by Bledsoe and Loveland [1], contains a number of papers presented on the subject at the win ter AMS meeting in 1983. It includes Loveland's paper [6], which reviews the previous 25 years of automated theorem proving—the field from which auto mated reasoning evolved—and the two papers given by the respective winners of the prize for milestones and the prize for current achievement in automated theorem proving. With the intention of reaching a much wider audience than that aimed at
580
Collected Works of Larry Wos
by each of the preceding books, and to provide material not available elsewhere, a fifth book has just been completed. The book, "Automated Reasoning: Intro duction and Applications" by Wos, Overbeek, Lusk, and Boyle [19], assumes no background. It covers various applications-mathematical, logical, and others-of the type discussed in this paper and, moreover, provides some guidance for using an automated reasoning program. Very powerful and effective portable reasoning programs are now available [7], [8]. These programs, written in Pascal, can be run on relatively inexpensive computers, provided an appropriate Pascal compiler is accessible. They offer the researcher an arsenal of inference rules, strategies, and related processes from which to choose. Those who wish to experiment with and conduct research with an automated reasoning program can now do so. 5. Amenable Questions. An open question is amenable to attack with the assistance of an automated reasoning program if it is representable in the language of clauses. Being representable in first-order predicate calculus is suf ficient, for an algorithm exists for mapping from that language to the language of clauses. Even better, an open question is amenable to such an attack if it can be represented by a finite set of equations. Specifically, if the structures under study are finitely based varieties—structures such as semigroups, groups, and rings—an automated reasoning program might well provide valuable assistance. Mappings of various kinds are perfectly acceptable. So also are finite sets of gen erators and relations. On the other hand, the statement "the structure is finite" cannot be represented in the language of clauses, and the fact that it is infinite can be represented but not in a useful fashion. To talk about "all mappings from one structure to another" is not possible, and to talk about "there exists a mapping" requires a trick. The trick is similar to one used in mathematics; we simply name the mapping in question. Problems in differential equations, for example, are not well suited to consideration. In short, problems similar to the ones discussed earlier are the best bet. 6. Summary. You are not required to be an expert in automated reasoning to use such a program. Its use is difficult, especially from the linguistic viewpoint. In fact, "the art of automated reasoning" captures the flavor of the present state of the discipline. Nevertheless, a number of activities are now benefiting from reliance on a reasoning program. They include research in mathematics and logic, the design and validation of logic circuits, and proving that computer programs fulfill certain claims made for them. What is needed is additional open questions to attack with the assistance of a reasoning program. Such questions will lead to enhancements of existing techniques and the development of totally new techniques for problem solving. What is also needed is the use by mathematicians and logicians of automated reasoning programs. If open questions can be solved by researchers who know so little about the respective fields from which the problems were taken, how much
Automated Reasoning
581
more might be accomplished by experts in various fields with the assistance of such a program! A reasoning program provides an explicit treatment of each proof and each model or counterexample it obtains. It offers a wide variety of inference rules, strategies, and related processes from which to choose when attacking a given problem. In view of the successes and properties cited here, perhaps mathemati cians and logicians might strongly consider enlisting the aid of a different type of colleague—a computer program that functions as an automated reasoning assistant. References 1. W. W. Bledsoe and D. Loveland, eds., Automated Theorem Proving: After 25 Years, Contemporary Math., Vol. 29, Providence, RI, 1984. 2. C. Chang and R. Lee, Symbolic Logic and Mechanical Theorem Proving, Academic Press, New York, 1973. 3. J. Guard, F. Oglesby, J. Bennett, and L. Settle, Semi-automated mathe matics, J. Assoc. Comput. Mach., 16 (1969) 49-62. 4. R. Kowalski, Logic for Problem Solving, Elsevier, North-Holland, New York, 1979. 5. D. Loveland, Automated Theorem Proving: A Logical Basis, North-Holland, New York, 1978. 6. , Automated Theorem Proving: A Quarter Century Review, in Auto mated Theorem Proving: After 25 Years, ed. by W. W. Bledsoe and D. Loveland, Contemporary Math., Vol. 29, pp. 1-45, Providence, RI, 1984. 7. E. Lusk, W. McCune, and R. Overbeek, Logic machine architecture;: kernel functions, in 6th Conference on Automated Deduction, ed. by D. W. Loveland, Springer-Verlag, Lecture Notes in Computer Science, Vol. 138, pp. 70-84, New York, 1982. 8. , Logic machine architecture: inference mechanisms, in 6th Confer ence on Automated Deduction, ed. by D. W. Loveland, Springer-Verlag, Lecture Notes in Computer Science, Vol. 138, pp. 85-108, New York, 1982. 9. J. McCharen, R. Overbeek, and L. Wos, Complexity and related enhance ments for automated theorem-proving programs, Comput. Math. Appl., 2 (1976) 1-16. 10. J. Robinson, A machine-oriented logic based on the resolution principle, J. Assoc. Comput. Mach., 12 (1965) 23-41. 11. J. H. Siekmann and G. Wrightson, eds., The Automation of Reasoning, Vols. I and II, Springer-Verlag, Classical Papers on Computational Logic, New York, 1983. 12. B. Smith, Reference manual for the environmental theorem prover, an incarnation of AURA, Argonne National Laboratory Technical Report (to ap pear). 13. S. Winker, Generation and verification of finite models and counterex amples using an automated theorem prover answering two open questions, J.
582
Collected Works of Larry Wos
Assoc. Comput. Mach., 29 (1982) 273-284. 14. S. Winker and L. Wos, Automated generation of models and counterex amples and its application to open questions in ternary Boolean algebra, Proc. of the Eighth International Symposium on Multiple-valued Logic, IEEE and ACM, Rosemont, IL, 1978, pp. 251-256. 15. — , New shortest single axioms for the equivalential calculus (in prepa ration). 16. S. Winker, L. Wos, and E. Lusk, Semigroups, antiautomorphisms, and involutions: a computer solution to an open problem, I, Math. Comp., 37 (1981) 533-545. 17. , Semigroups, antiautomorphisms, and involutions: a computer solu tion to an open problem, II (in preparation). 18. L. Wos, D. Carson, and G. Robinson, Efficiency and completeness of the set of support strategy in theorem proving, J. Assoc. Comput. Mach., 12, 4 (1965), 536-541. 19. L. Wos, R. Overbeek, E. Lusk, and J. Boyle, Automated Reasoning: Introduction and Applications, Prentice-Hall, Englewood Cliffs, NJ, 1984. 20. L. Wos, G. Robinson, D. Carson, and L. Shalla, The concept of demod ulation in theorem proving, J. Assoc. Comput. Mach., 14 (1967) 698-709. 2 1 . L. Wos, S. Winker, R. Veroff, B. Smith, and L. Henschen, Questions concerning possible shortest single axioms for the equivalential calculus: an ap plication of automated theorem proving to infinite domains, Notre Dame J. Formal Logic, 24, 2 (1983) 205-223.
What is Automated Reasoning? L. Wos Mathematics and Computer Science Division Argonne National Laboratory Argonne, IL 60439-4844
L. Wos / What is Automated Reasoning? Automated reasoning is concerned with the study of using the computer to assist in that part of problem solving requiring reasoning [1]. Some questions arising during the study concern the representation of knowledge, the rules for deriving new knowledge from that which is given, and strategies for controlling the rules [2,3]. Other questions concern the implementation of the resulting theory and concern various applications for which the corresponding software can be used [4-9]. Theory, implementation, and application play equally vital and interconnecting roles for automated reasoning in its attempt to reach one of its primary goals—the goal of providing an automated reasoning assistant. In 1980, the challenging and exciting field of automated reasoning was in vented, evolved, or simply identified. Interest in the field is growing rapidly. Some of the activity centers on the underlying theory, some on the implementation of that theory, and some on the use of the resulting automated reasoning programs to solve problems. The role of such programs varies from providing assistance in checking a person's reasoning to performing the majority of the reasoning with some guidance from the person using the program. Automated reasoning programs are currently used in mathematical research [10-13], in circuit de sign [4,5], for medical diagnosis [14], and for many other uses. The field is very young, and much is unknown. Nevertheless, the use of an automated reasoning program has already led to a number of successes. Previously open questions from mathematics and from formal logic have been answered [10-13,15,16]. cir cuits superior to ones previously known designed [4], and algorithms currently relied upon verified [24,30]. Areas for which automated reasoning is relevant include program verification, program synthesis, automated theorem proving, logic programming, expert systems, some parts of artificial intelligence, com putational logic, robotics, and various industrial applications. In the subarticle correspondingly titled, you will be introduced to each of these fields by an expert Reprinted from the Journal of Automated Reasoning, Vol. 1, no. 1, pp. 6-9 (February 1985) with kind permission from Kluwer Academic Publishers.
584
Collected Works of Larry Wos
in that field. How did it all start? The quest for knowledge and simple curiosity is where it began. Researchers invented formal languages, such as the first-order predicate calculus [17], for rigorously stating a wide range of problems in an unambiguous way. Logicians then formulated inference rules to take statements in the lan guage and draw conclusions only if the conclusion must follow from the chosen statements. In particular, logicians studied inference rules that are 'sound'. An inference rule is 'sound' if any conclusion yielded by its application follows logi cally from the premisses to which it is applied. As you will also see later in this overview article when expert systems are introduced, systems are also studied that apply inference rules that draw conclusions that do not necessarily follow logically and inevitably, but instead follow with a probability other than 1. Al though most of the inference rules currently studied or used employ syntactic criteria, the interest in semantically oriented inference rules is growing [18]. As for the formulation and study of strategies to control inference rules [2,3,19], it did not commence until an attempt was made to use the power and speed of the computer for finding proofs in mathematics. What was discovered was that, despite the impressive speed offered by the computer, unrestricted application of even the most powerful inference rules is not sufficient for most reasoning tasks. You will learn more about the need for and the types of strategy when the field of automated theorem proving is introduced. Where is the field of automated reasoning at now? A variety of programs are available, some of which are stand-alone automated reasoning programs, some of which are a reasoning component within a larger program, and some of which are systems for producing other reasoning programs. Some of the programs are portable, written in Pascal or LISP, and can be run on a variety of comput ers including relatively inexpensive ones. At one end of the spectrum, LMA is used to produce specifically-tailored portable reasoning programs [6,7,20] and EMYCIN is used to produce a variety of expert systems [21]. As examples of expert systems, DENDRAL is used for chemical synthesis [22], PROSPECTOR for geology [23], and MYCIN for medical diagnosis [14]. At the other end of the spectrum, AURA [8] is used in mathematical research, circuit design, and circuit validation. With regard to achievements, the program verification system of Don Good [30], which relies heavily on one of W. W. Bledsoe's automated theorem-proving programs, has verified an encrpytion packet interface to the ARPANET consisting of 4200 lines in Gypsy, while the program AURA has assisted in answering previously open questions in mathematics [10-13] and in formal logic [15,16]. Programming languages specifically oriented toward the use of automated reasoning to solve problems are rapidly gaining in interest. You will learn more of this when the topic of logic programming, and Prolog in par ticular [25], is introduced. Even with all of the progress that has been made and the zeal with which various areas are currently under attack, many problems still exist. What problems need solving, and what means are available? Many ques-
What Is Automated Reasoning?
585
tions on the representation of knowledge remain unanswered [1, Chap. 16]. For example, for solving problems in many areas, the needed axioms or assump tions that adequately characterize the domain of inquiry are still absent. Rules or algorithms for choosing between alternatives are needed—rules for choosing between relying on an equality notation or avoiding it, for choosing between the use of predicates or the use of functions, and for choosing between vari ous normal forms. With regard to the types of reasoning to be employed, more powerful inference rules would be of great value. Even with such rules, more ef fective strategies for controlling the reasoning are needed. Many problems that a person can reason through very quickly still cause an automated reasoning program to spend too much time to solve. Communication between a person using an automated reasoning program and the program itself is far too poor at this time. Much work in natural language remains to be done. Expert systems do provide an important step in the direction of ease of use. But much more is desirable. Finally, in the area of theory, many deep and challenging questions are as yet unanswered. Research is the key to solving the current problems that remain in automated reasoning. This research can be assisted greatly with the use of current and future automated reasoning programs. Experimentation with problems whose solution is already known and with as yet unsolved problems, as woll as at tempting to employ the various techniques for different application areas, often yields important but missing information. History has established the value of experimentation. A number of powerful inference rules [18,26-28] and effective strategies [2] were discovered directly as a result of attempting to solve some specific problem with the use of a reasoning program. For example, in my own research, the attempt to solve a problem in group theory led directly to for mulating the set of support strategy [2], while the consideration of a problem in number theory resulted in finding the concept of demodulation [29]. To ex periment adequately, a powerful and flexible automated reasoning program is needed. Theory, implementation, and application are thus shown to play equally vital and interconnecting roles in automated reasoning. Even with access to the excellent reasoning programs that are currently available and with access to a number of promising application areas, the task is formidable. For example, questions of representation, inference rule, and strategy are extremely interwo ven. Choices in the three areas should not be made independently, if the intent is to maximize the chance for solving the problem under consideration. Even very effective use of an automated reasoning program is a problem. In fact, such effective usage can at this time only be termed an art [1: Chap. 16]. But, as has been demonstrated by some of the achievements cited earlier, some researchers have in part mastered that art. Such mastery, as well as the advances evident in the previous 25 years, suggests that the various problems are solvable and many will be solved soon. The result will be the attainment of some of the goals of automated reasoning. W h a t are some of the goals of the field? Perhaps the most commonly sought
586
Collected Works of Larry Wos
after goal is that of having access to various automated reasoning programs each of which functions as an automated reasoning assistant. The assistance would vary from that of simple and straightforward calculations of a reasoning nature to that of an equal colleague. The desire exists to freely and effectively 'converse' with the automated reasoning program being used. In particular, a far distant goal is that of presenting a problem to such a program, turning your attention to some quite distinct problem, and finding upon your return that the first problem has been solved—solved without your help or intervention. Such a program, or even one with less qualifications, might well serve as an important teaching aid to teach reasoning of various kinds. These goals may seem clearly out of reach, but researchers in 1958 would not have guessed that in 1985 computer programs would have the reasoning power that some in fact do have. What seems inevitable is that this exciting and promising field will continue to expand for some time, attracting the attention of individuals with widely differing interestests and objectives. That this is true can be seen from what follows in this article.
References 1. Wos, L, Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: Introduction and Applications, Prentice-Hall, Englewood Cliffs (1984). 2. Wos, L., Carson, D., and Robinson, G., 'Efficiency and completeness of the set-of-support strategy in theorem proving', J. Assoc. Comput. Mach. 12, 536-541 (1965). 3. McCharen, J., Overbeek, R., and Wos, L., 'Problems and experiments for and with automated theorem-proving programs', IEEE Trans. Computers C-25, 773-782 (1976). 4. Wojciechowski, W. S., and Wojcik, A. S., 'Automated design of multiplevalued logic circuits by automated theorem proving techniques', IEEE Trans. Computers (September 1983). 5. Wojcik, A. S., 'Formal design verification of digital systems', Proc. 20th Design Automation Conference, pp. 228-234 (1983). 6. Lusk, E., and Overbeek, R. A., 'Logic machine architecture: inference mechanisms-layer 2 user reference manual', ANL-82-84, Argonne National Laboratory (December 1982; revised 1984). 7. Lusk, E. L., McCune, W., and Overbeek, R. A., 'Logic Machine Archi tecture: kernel functions', Proc. of the 6th International Conference on Automated Deduction, Lecture Notes in Computer Science (Ed. D. W. Loveland), Vol. 138, Springer-Verlag, pp. 70-84, 1982.
What Is Automated Reasoning?
587
8. Smith, B. T., 'A reference manual for the environmental theorem prover, an incarnation of AURA', to be published as an ANL technical report. 9. Boyer, R. S., and Strother Moore, J, A Computational Logic, Academic Press, New York (1979). 10. Wos, L., and Winker, S., 'Open questions solved with the assistance of AURA," in Automated Theorem Proving: After 25 Years, Vol. 29 of Con temporary Mathematics (eds. W. W. Bledsoe and D. W. Loveland), AMS, Providence, Rhode Island, pp. 73-88 (1984) 11. Wos, L., 'Solving open questions with an automated theorem-proving pro gram', Proc. of the 6th Conf. on Automated Deduction, Lecture Notes in Computer Science Vol. 138 (ed. D. W. Loveland), Springer-Verlag, New York, pp. 1-31 (1982). 12. Winker, S., Wos, L., and Lusk, E., 'Semigroups, antiautomorphisms, and involutions: a computer solution to an open problem, I', Math. Comp. 37 (156), 553-545 (1981). 13. Winker, S., and Wos, L., 'Automated generation of models and counterex amples and its application to open questions in ternary Boolean algebra', Proc. 6th International Symposium on Multiple-Valued Logic, Rosemont, 111., IEEE and ACM, pp. 251-256 (1978). 14. Shortliffe, E., 'Consultation systems for physicians', in Readings in Arti ficial Intelligence (eds. B. L. Webber and N. J. Nilsson), Tioga, Pal Alto, pp. 323-333 (1981). 15. Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., 'Questions concerning possible shortest single axioms in equivalential calculus: an ap plication of automated theorem proving to infinite domains', Notre Dame J. Formal Logic 24, 205-223 (1983). 16. Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., 'A new use of an automated reasoning assistant: open questions in equivalential calculus and the study of infinite domains', Artificial Intelligence 22, 303356 (1984). 17. Smullyan, R. M., First Order Predicate Calculus, Springer-Verlag, New York (1968). 18. Wos, L., Veroff, It., Smith, B., and McCune, W., 'The linked inference principle, II: the user's viewpoint', CADE/7, Proc. 7th International Con ference on Automated Deduction, Lecture Notes in Computer Science (ed. R. E. Shostak), Vol. 170, Springer-Verlag, New York, pp. 316-332 (1984).
588
Collected Works of Larry Wos
19. Wos, L., Carson, D., and Robinson, G., 'The unit preference strategy in theory proving', Proc. Fall Joint Computer Conference, Thompson Book Company, New York, pp. 615-621 (1964). 20. Lusk, E., and Overbeek, R., 'A portable environment for research in auto mated reasoning', CADE/7, Proc. 7th International Conference on Auto mated Deduction, Lecture Notes in Computer Science, (ed. R. E. Shostak), Vol. 170, Springer-Verlag, New York, pp. 43-52 (1984). 21. Van Melle, W. J., System Aids in Constructing Consultation Programs, UMI Research Press, Ann Arbor, Michigan (1980). 22. Buchanan, B., Fiegenbaum, E., Webb, B. L., and Nilsson, N. J., 'Dendral and Meta-Dendral: their application domain', Readings in Artificial Intelligence (eds. B. L. Webber and N. J. Nilsson), Tioga, Palo Alto, pp. 313-321 (1981). 23. Duda, R., Gaschnig, J., Hart, P., Webber, B. L., and Nilsson, N. J., 'Model design in the PROSPECTOR consultant system for mineral exploration', Readings in Artificial Intelligence (eds. B. L. Webber and N. J. Nilsson), Tioga, Palo Alto, pp. 334-348 (1981). 24. Boyer, R. S., and Moore, J, 'Proof checking the RSA public key encryption algorithm', Amer. Math. Monthly 91, 181-189 (1984). 25. Clocksin, W. F., and Mellish, C. S., Programming in Prolog, SpringerVerlag, New York (1981). 26. Wos, L., Overbeek, R., and Henschen, L., 'Hyperparamodulation: a re finement of paramodulation', Proc. 5th Conf. on Automated Deduction, Lecture Notes in Computer Science (ed. R. Kowalski and W. Bibel), Vol. 87, Springer-Verlag, New York, pp. 208-219 (1980). 27. Wos, L., and Robinson, G. A., 'Paramodulation and set of support', Proc. IRIA Symposium on Automated Demonstration (Versailles, France), Springe Verlag, New York, pp. 276-310 (1968). 28. Overbeek, R., McCharen, J., and Wos, L., 'Complexity and related en hancements for automated theorem-proving programs', Comput. Math. Appl. 2, 1-16 (1976). 29. Wos, L., Robinson, G., Carson, D., and Shalla, L., 'The concept of de modulation in theorem proving', J. Assoc. Ccomput. Mach. 14, 698-704 (1967). 30. Smith, M., Siebert, A., Divitto, B., and Good, D., 'A verified encrpyted packet interface', SIGSOFT 6, 3 (1981).
A u t o m a t i n g Reasoning How to use a computer to help solve problems requiring logical reasoning. by Larry W o s How can a single computer program correctly solve the following problems and puzzles? How can you determine whether its answers are correct or not? How would you correctly solve each of the problems and puzzles? • The first problem concerns computer programs and their reliability. You are given a subroutine for rinding the maximum element of any given array. You must give a proof that the code performs as claimed, or find a counterexample and thus demonstrate that the code contains a bug. • For the second problem, you are given three checkerboards missing various squares (see Figures 1, 2, and 3). You are also given an adequate supply of one-square by two-square dominoes. The problem is to determine which, if any, of the checkerboards can be precisely covered with dominoes. (Puzzles of this type are reminiscent of layout problems.) • In the third problem, you are given the design of a circuit that supposedly meets certain specifications (see Figure 4). It is required to take as input x and y (with x above y) and yield as output y and x (with y above x), and without any crossing wires. The goal is to prove that the design meets the specifications. (Avoiding crossing wires is often important in layout problems.) • The fourth problem—sometimes known as the "fruit puzzle"—is one that Sherlock Holmes would have solved with a flourish. There are three boxes, respectively labeled A P P L E S , O R A N G E S , and B A N A N A S (see Figure 5). Unfortunately, each box is mislabeled. You are correctly told that each box contains exactly one of the three kinds of fruit, and no two boxes contain the same kind. You are also correctly told that box 2 - the one labeled ORANGES—actually contains apples. You are asked to deter mine the contents of boxes 1 and 3, and then, just as important, prove that your answer is correct. (This problem will be used later to illustrate various concepts in automated reasoning.)
Reprinted from ABACUS, Vol. 2, No. 3, pp. 6-21 (Spring 1985).
590
Collected Works of Larry Wos
Figures 1, 2, 3. Which of these checkerboards can be precisely covered with dominoes? [SIAM News, 7/84.]
-t>T£>—1>
Figure 4. The circuit design puzzle. Does the circuit produce the outputs as shown? [Automated Reasoning (Prentice-Hall, 1984), p. 224.] • The fifth and final problem can be viewed as a problem in circuit design or a problem in computer programming. From the viewpoint of circuit design, you are asked to design a circuit that will return the signals not(x), not(y), and not(z), when x, y, and z are input to it (see Figure 6). The task would be trivial were it not for one important constraint. You can use as many AND and OR gates as you like, but you cannot use more than two NOT gates. From the viewpoint of assembly language programming, you are asked to write a program that will store in locations U, V, and W the Is complement of locations x, y, and z. You can use as many COPY, OR, and AND instructions as you like, but you cannot use more than two COMP (Is complement) instructions.
The way a single computer program can correctly solve the five problems, and the way you can also, is by using reasoning—logical reasoning. The way to determine whether the answers given by a program using logical reasoning are correct is by "asking" it for a "proof. When such a request is made, a reasoning program can explicitly give every step used in its reasoning, and also cite precisely which facts were used to reach each conclusion. You can then check any step you question. (A detailed discussion of all but the first of the five problems, as well as an expanded treatment of the concepts and applications of
Automating Reasoning
591
Figure 5. Mislabeled boxes of fruit. [SIAM News, 9/84.] not(x) not(y) not(z)
Figure 6. The inverter problem. Can you design it with no more than two NOTs? [SIAM News, 7/84.] automated reasoning discussed in this article, can be found in the book Auto mated Reasoning: Introduction and Applications by Wos, Overbeek, Lusk, and Boyle, published by Prentice-Hall.) Since you may have already solved some or all of the five problems, you might be curious about how well reasoning programs do when given those same problems. Some of them do very well. For example, each of the five problems has been solved by a single program—the automated reasoning program AURA (Automated Reasoning Assistant). But what is automated reasoning—and what are the answers to the five problems?
What Automated Reasoning Is Automated reasoning is the study of how the computer can be programmed to assist in that part of problem solving requiring reasoning. Reasoning as used here means logical reasoning, not probabilistic or common-sense reasoning. Each conclusion that is reached must follow inevitably from the facts from which it is drawn. If a conclusion is false but obtained with logical reasoning, then at least one of the facts from which it is obtained is false. Using a computer program that reasons logically thus assures you of obtaining totally accurate information, providing you give it totally accurate information to begin with. Such a program, if it gives you access to an appropriate array of choices, can be used effectively as an automated reasoning assistant.
592
Collected Works of Larry Wos
History of A u t o m a t e d Reasoning From one viewpoint, the challenging and exciting field of automated reasoning was invented, evolved, or simply identified in 1980. (For those interested in the precise history of terms, the term automated reasoning was introduced by the author in 1980 in a discussion at Argonne National Laboratory.) From another viewpoint, the field can be traced to the work in automated theorem proving, a field in which the first significant research occurred in the early 1960s. That research immediately led to programs that could prove some simple theorems in mathematics. Although those programs were not very powerful, especially compared to those in existence now, they provided an important beginning. In fact, were it not for those programs and the concepts that were formulated based on experiments with them, the entire field of automated reasoning might not exist today. The main difference between automated theorem proving and automated reasoning is the way in which the corresponding computer programs are used. In most cases, a theorem-proving program is used to find proofs of purported theo rems. An automated reasoning program, on the other hand, is often used simply to find information of various kinds. While one use of automated reasoning is in fact proving theorems, other uses include finding models and counterexam ples, assisting in formulating conjectures, and simply drawing conclusions from some set of hypotheses. Applications include designing logic circuits, proving properties of computer programs, writing computer programs, and conducting research in mathematics. In contrast to the early 1960s, surprisingly powerful automated reasoning programs now exist. The general-purpose reasoning program AURA (Auto mated Reasoning Assistant) has provided invaluable assistance in answering various previously open questions in mathematics and in formal logic. Boyer and Moore's program-verification system has been used to verify an encryp tion algorithm currently in use. Good's program-verification system has veri fied a 4200-line Gypsy program which is an encryption packet interface to the ARPANET. In addition to these three programs, one other program deserves mention, especially in view of its use. That program is LMA (Logic Machine Architec ture). While each of the three previously mentioned programs is employed to "reason" about some situation, LMA is employed to "produce" reasoning pro grams tailored to given specifications. LMA offers mechanisms at the subroutine level that encode the various processes you will learn about in this article. It is portable (written in Pascal) and modular in design, and it and the reasoning program ITP produced with it have been ported to various machines including the VAX, PERQ, Apollo, Ridge, and IBM 3033. To use LMA or ITP requires approximately one megabyte of memory. (LMA was designed and implemented by Overbeek, Lusk, and McCune; AURA was designed and implemented by Overbeek, with contributions from Lusk, Winker, and Smith. Overbeek, Lusk,
Automating
Reasoning
593
McCune, and Smith are currently active members of the Argonne National Lab oratory automated reasoning group.)
The Basic Elements of A u t o m a t e d Reasoning For an automated reasoning program to assist you, you need a language (of the type to be illustrated shortly) for communicating with the program. After se lecting the problem or question to study, you must have a means for telling the program what the problem is about. Ordinary language does not suffice. It is too ambiguous, and too often relies on connotation and implicit information. What is needed is a language that removes ambiguity, and forces the user to state the required information explicitly rather than trusting to connotation. Since rea soning programs have little or no knowledge on their own, you must adequately describe the concepts and relationships involved in the problem under attack, and you must follow the conventions required by the particular reasoning pro gram you are using. As you will see later, you are sometimes forced to include mundane and obvious facts. While the burden of describing the problem in detail rests with you, the burden of drawing conclusions rests with the program. The better reasoning programs offer a variety of ways of reasoning, some of which will be illustrated later. For example, one type takes very small reasoning steps, another takes moderate-size steps, and a third automatically substitutes one term for another when they are known to be equal. You can either choose the way(s) of reasoning you deem best for the problem at hand, or you can rely on the program's default choice. Since the type of reasoning used in solving one problem is often not effective in solving the next problem being studied, access to a number of ways of reasoning—inference rules—is very advantageous. Even with effective inference rules, still more is needed. Neither you nor an automated reasoning program should be turned loose to draw conclusions without regard to their relevance to the question being investigated. Such un controlled reasoning will prevent you or a reasoning program from reaching the goal, for entirely too many irrelevant conclusions will be drawn. What is needed is strategy—strategy to direct the search for information and, even more impor tant, strategy to restrict the search. Both types of strategy will be illustrated. In addition to a precise language, effective ways of reasoning, and powerful strategies, two additional components are essential for a reasoning program to be very useful. First, a means for automatically rephrasing and rewriting infor mation into a normal (standard) form must be available. In many cases, there are far too many ways to express the same fact or relationship. For example, facts about "my father's father's brother's son" can be rephrased as facts about "my second cousin." Similarly, "-(-a)" can be replaced by "a," "b + 0" by "b", and "c(d + e)" by "cd + ce." The normal form to be used, as the last example shows, is not necessarily the simplest possible form. The user of the program can
594
Collected Works of Larry Wos
decide which, if any, normal forms are preferred. Although retention of infor mation in more than one form provides alternative paths from which to reason, many of those paths often lead to the same conclusion. Such duplication can sharply interfere with the effectiveness of a reasoning program—or with your effectiveness—when trying to solve some problem or answer some question. However, even with a means for automatically rephrasing information into a normal form and thus enhancing the effectiveness of reasoning programs, a second procedure is needed for automatically removing both redundant and less general information. For example, drawing and retaining the conclusion that "Sheila is a teacher" once is sufficient; retention of additional copies of that fact serves no purpose. Such redundancy obviously should be avoided—by a reasoning program or by a person attempting to solve some given problem. Also to be avoided is retention of a new fact when some already-known fact is more general—contains the same information that the new fact does, and more. For example, knowing that "all people are female or male" should cause a reasoning program to discard the conclusion that "Kim is female or male." For a somewhat different example, if a program "knows" that "Sheila is a teacher," the conclusion that "Sheila is a teacher or a nurse" should be discarded because it contains less information. Given either of these examples of more general versus less general information, you and your reasoning program would usually prefer keeping the more informative. Retaining more general information in preference to less general contributes to effective problem solving. Just as the presence of the same information in a number of different forms can interfere markedly with a reasoning program's (or your) attempt to solve a problem, so also can the presence of either redundant or less general information interfere markedly.
A Language Some Reasoning P r o g r a m s Understand If you have ever written a computer program, you know that you cannot simply tell a computer in everyday language what you wish it to do. Similarly, you cannot use everyday language to present the problem under attack to an auto mated reasoning program. What you must do is observe certain conventions of the language your particular reasoning program "understands." Of the various languages "understood" by reasoning programs, perhaps the most common is the language of clauses—a language that is, for example, understood by AURA and by ITP. Rather than giving a formal discussion of that language, various examples will suffice. The following pairs of statements—first in everyday language, and then in a language acceptable to many automated reasoning programs—show how various information is translated into "clauses." In the "clause language," "not" can be represented with " - ", and "or" with "|." (A convention observed by AURA
Automating
Reasoning
595
and I T P is to write predicates such as "married" in uppercase and functions such as "sum" in lowercase. Both programs treat EQUAL as a built-in predi cate, a predicate that does not require inclusion of such axioms as symmetry, transitivity, and substitutivity.) Nan i s p r e t t y PRETTY(Nan) Nan i s m a r r i e d MARRIED(Nan) Sheila i s a teacher HASAJOB(Sheila,teacher) S h e i l a i s not a boxer -HASAJOB(Sheila.boxer) S h e i l a i s a t e a c h e r or a n u r s e HASAJOB(Sheila,teacher) I HASAJOB(Sheila,nurse) c ( d + e) = cd + ce EQUAL(prod(c,sum(d,e)), sum(prod(c,d),prod(c,e))) Just as you can easily convey specific information with clauses, you can also convey general information. a l l p e o p l e axe female or male FEMALE(x) I MALE(x) The "variable" x is automatically interpreted by the program as "for all," for any value that is substituted for x. In fact, in the language of clauses, all variables are treated as meaning "for all." The program "knows" that a well-formed expres sion is a variable by observing the convention t h a t all well-formed expressions beginning with (lowercase) u through z are variables, and any variable must begin with (lowercase) u through z. (Although variables could be declared, the given convention is one currently observed by various reasoning programs such as A U R A and I T P . ) The ability to represent general information by simply writing the appropriate clause(s) has a variety of uses. For example, it is far preferable simply to write the general form for distributing product over sum x(y + z) » xy + xz ( f o r a l l x , y , and z) as
Collected Works of Larry Wos
596
EQUAL(prod(x,sum(y,z)), sum(prod(x,y),prod(x,z)))
than to write some instance of it involving c, d, and e. (Directly using math ematical notation rather than using equivalent statements in clause form is acceptable to many reasoning programs as well.) Three additional conventions are present in this language—one for "and," one for "if-then", and one for "there exists." The operator "and" is used but only implicitly. For example, to translate the fact that Nan i s p r e t t y ' ' a n d ' '
intelligent
requires two clauses. The clauses PRETTY(Kan) INTELLIGENT(Nan)
will do. The program automatically "understands" that between each pair of clauses there is an implicit occurrence of "and." As for "if-then," it is replaced by using "not" and "or." Instead of translating (directly) "if x is female, then x is not male," you translate "x is not female, or x is not male." for all x, x is not female or x is not male -FEMALE(x) I -MALE(x)
No information is lost—and this is one point that sometimes presents some difficulty—since "if P, then Q" is logically equivalent to "not P, or Q" (see the truth table in Figure 7).
p true true false false
Q true false truet false
not P false false true true
(not P) or Q true false true true
if P then Q true false true true
Figure 7. Truth table for equivalence of it-then with not-or. Finally, to express the "existence" of something, you introduce an appropri ate constant or function. If you wish to write a clause for the statement there exists some kind of fruit in box 2 the clause
Automating
Reasoning
597
CONTAINS(box2,a) suffices. The constant a is the name of the kind of fruit that exists in box 2; you "name" the kind of fruit. In other words, you use names with the reason ing program as you frequently do with a co-worker. For example, you give the "name" 7 to the integer that exists (strictly) between 6 and 8; you use an ap propriate constant. On the other hand, some facts about existence require use of an appropriate function: f o r a l l i n t e g e r s x , t h e r e e x i s t s a number g r e a t e r t h a n x and a number l e s s t h a n x GREATERTHANCf(x),x) LESSTHAN(g(x),x) Two clauses are required because of the "and" in the statement; two different functions, f(x) and g(x), are required to express the two existences. How might you translate into clauses the following statement? Given arrays o, b, and c, for every pair x, y such that a; is in a and x is an integer and y is in 6 and y is an integer, there exists an element z in c, (strictly) between x and y, such that z is an integer. Since this translation illustrates what you might be required to do to use an automated reasoning program, you might wish to attempt it before looking at the answer that follows immediately. f o r e v e r y i n t e g e r p a i r x , y w i t h x i n a and y i n b , t h e r e i s an element h ( x , y ) i n c -EL(x,a) 1 -INT(x) I -EL(y.b) I -INT(y) I EL(h(x,y),c) for every integer pair x,y with x in a and y in b, h(x,y) is greater than x -EL(x,a) I -INT(x) I -EL(y,b) I -INT(y) I GREATERTHAN(h(x,y),x) for every integer pair x,y with x in a and y in b, h(x,y) is less than y -EL(x.a) I -INT(x) I -EL(y,b) I -INT(y) I LESSTHAN(h(x,y),y) for every integer pair x,y with x in a and y in b,
Collected Works of Larry Wos
598
h(x,y) i s an integer -EL(x,a) I -INT(x) I -EL(y.b) I -INT(y) I INT(h(x,y)) The language of clauses is richer than it might appear; the set of clauses just given is not the only acceptable answer (see Figure 8). As in writing any program—or, for that matter, in language in general—you have some freedom in how you express information. However, you must observe the requirements of using variables to replace "for every" or "for all" statements, using constants or functions to replace "exists" statements, and relying on the explicit use of "not" and "or" within a clause and the implicit use of "and" between clauses. By doing so, as you will shortly see, you can have a reasoning program provide flawless assistance for solving a number of different problems requiring (logical) reasoning.
for every integer pair x, y with x in a and y in b, there is an element h(xa, x, yb, y( in c -EQUAL(EVAL(a,xa),x) I -EqUAL(EVAL(b(yb),y) | -INT(y) for every integer pair x, y with a; in a and y in b, h(xa, x, yb, y) is greater than x -EQUAL(EVAL(a,xa),x) I -INT(x) | -EqUAL(EVAL(b,yb),y) I -INT(y) I GREATERTHAN(h(xa,x,yb,y),x) for every integer pair x, y with x i n a and y in b, h(xa, x, yb, y) is less than y -EqUAL(EVAL(a,xa),x) I -INT(x) | -EQUAL(EVAL(b,yb),y) I -INT(y) I LESSTHAN(h(xa,x,yb,y),y) For every integer pair x, y with a; in a and y in b, h{xa, x, yb, y) is an integer -EQUAL(EVAL(a,xa),x) I -INT(x) I -EQUAL(EVAL(b.yb),y) I -INT(y) I INT(h(xa,x,yb,y)) Figure 8. Translation of Program Verification Statements into Automated Reasoning Clauses.
599
Automating Reasoning
How Such Programs Reason An automated reasoning program usually offers you a variety of ways of reason ing, called "inference rules," from which to choose. Almost all of the inference rules are based on just two operations, canceling one part of a clause against a part of another clause, and substituting expressions for variables in a clause. As an example of canceling, the two clauses FEMALE(Kim) -FEMALE(Kim) I -MALE(Kim) together (logically) imply the conclusion -MALE(Kim) by canceling FEMALE(Kim) with-FEMALE(Kim). For, if you know that "Kim is female" and that "Kim is not female or not male," then it follows logically that "Kim is not male." (You cannot conclude from "Kim is female" alone that "Kim is not male"; as Sherlock Holmes or Mr. Spock of "Star Trek" would say, "The conclusion does not follow logically." Here you have an example of the kind of implicit information that is often used by people but that must be given explicitly to a reasoning program, namely, that "all people are not female or not male." As you will see later, while being forced to supply such information is a nuisance, it does have some advantages.) To see how substituting for variables comes into play, two clauses closely related to the preceding two will suffice. The two clauses FEMALE(Kim) -FEMALE(x) I
-MALE(x)
together (logically) imply the conclusion -MALE(Kim) by first substituting Kim for the variable x in the second clause to obtain tem porarily a new second clause [-FEMALE(Kim) MALE(Kim)], and then ap plying cancellation to the new pair of clauses. To see that the conclusion is valid, first note t h a t the second clause can be read as "for all x, x is not female or not male." Then note that "Kim is not female or not male" follows trivially from the second clause by merely substituting Kim for x. By applying the kind of reasoning used in the preceding paragraph to explain "canceling," the validity of the conclusion is established. Both examples, that illustrating "canceling" and that illustrating "substitut ing," are covered by one inference rule, binary resolution. A two-step explanation provides an intuitive justification for the name of this inference rule. First, the rule always simultaneously considers two clauses from which to attempt to draw
Collected Works of Larry Wos
600
a conclusion, hence "binary." Second, the rule attempts to resolve the question of what is the maximum common ground covered by obvious consequences of the two clauses, hence "resolution." In the first of the two examples of this section, no effort is required to find the common ground; no substitution for variables is necessary to permit an obvious cancellation. In the second example, however, to find the common ground requires substituting Kim for the variable x in the second clause. The conclusions yielded by applying binary resolution always fol low logically from the pairs of statements to which it is applied. Of course, if one of the statements is false, then the conclusion may (but still might not) be false. What inference rules used by an automated reasoning program promise is "logical soundness"—the conclusions that are drawn follow inevitably from the statements from which they are drawn. In addition to this vital logical property of being "sound," the rules draw as general a conclusion as possible, which is why the word maximum was used when discussing "common ground." For example, binary resolution applied to the two clauses -HASAJ0B(x,nurse) I MALE(x) (for all x, x is not a nurse or x is male) -FEMALE(y) I -MALE(y) (for all y, y is not female or y is not male)
yields the clause -HASAJOB(x,nurse) I -FEMALE(x) (for a l l x, x i s not a nurse or x i s not female) as the conclusion. It does not yield -HASAJOB(Kim,nurse) I -FEMALE(Kim) (Kim is not a nurse or Kim is not female)
which also follows logically from the two given clauses. This last conclusion simply lacks the generality required by the kind of inference rules employed by automated reasoning programs. Unfortunately, binary resolution is not ordinarily effective enough, for its use usually yields too many conclusions, each representing too small a step of reasoning. As you will see when the puzzle about boxes of fruit is solved by a reasoning program, refinements of binary resolution exist that yield larger reasoning steps because they can be applied to clauses taken two at a time, three at a time, and more.
Automating Reasoning
601
A Reasoning P r o g r a m Solves t h e Fruit Puzzle In the fourth problem -the "fruit puzzle"—given at the beginning of this article, you are asked to determine the contents of two of the three boxes of fruit. (You are correctly told that box 2 contains apples.) Perhaps more interesting, you are also asked to "prove" your answer correct. Of the various types of proof, proof by contradiction will be the choice, for that is the usual form of proof found by an automated reasoning program. A proof by contradiction consists of a sequence of steps of reasoning that starts with statements taken from the problem under study, together with the additional assumption of the falseness of what you are trying to prove, and ends with a statement that contradicts some earlier statement in the sequence. One reason for seeking this form of proof is that it provides a means for a reasoning program to "know" that it has succeeded in completing the assigned task. For the fruit puzzle, for example, the search for such a proof could begin by first adding a "false" assumption about the contents of, say, box 1, with the object of eventually finding a contradiction. If a contradiction is found, then the falseness of the assumption will have been discovered, and the actual contents of box 1 will be known. In particular, you might begin with the "false" assumption that box 1 does not contain bananas. You could then reason to a contradiction in this way: • First, box 1 does not contain apples, for box 2 does. • Second, box 1 must then contain oranges, from the preceding conclusion and the false assumption. • Third, by arguing as in drawing the first conclusion, box 3 does not contain apples. • Fourth, from the second conclusion, box 3 does not contain oranges. • Fifth, box 3 must then contain bananas. • Since, according to the puzzle, every box is mislabeled, and therefore its label cannot match its contents, your sixth conclusion might be that box 3 is not labeled BANANAS. But box 3 is, in fact, labeled BANANAS, and you have completed a proof by contradiction. (Although giving such an argument can be tedious, explicit and detailed rea soning, supplied by a person or by a reasoning program, has the advantage of permitting the argument to be totally checked for validity.) An automated reasoning program, given an appropriate inference rule, can find a proof (expressed in clauses) identical to the one just completed. To give the steps of that proof, the description of the puzzle must first be translated into an appropriate set of clauses, as is done immediately. If some of the clauses seem unclear, the comments that precede them may help.
Collected Works of Larry Wos
602 box 2 contains apples (1) CONTAINS(box2,apples)
boxes 1, 2, and 3 are respectively labeled APPLES, ORANGES, BANANAS (2) LABEL(boxl,apples) (3) LABEL(box2,oranges) (4) LABEL(box3,bananas) each of the boxes contains apples, bananas, or oranges (5) CONTAINS(xbox,apples) I CONTAINS(xbox,bananas) I CONTAINS(xbox,oranges) each box is mislabeled (6) -LABEL(xbox.yfruit) I -CONTAINS(xbox,yfruit) no fruit is contained in more than one box (7) EQUAL(xbox,ybox) I -CONTAINS(xbox,zfruit) I -CONTAINS(ybox,zfruit) there are three (distinct) boxes (8) -EQUAL(boxl,box2) (9) -EQUAL(box2,box3) (10) -EQUAL(boxl,box3)
box 1 does not contain bananas (11) -CONTAINS(box1,bananas) Before giving a proof that an automated reasoning program might give, a few comments about the clauses will fill in some gaps and provide a review of what has already been discussed. Clause 11 is not part of the puzzle description; it corresponds to denying the true situation; its purpose is to enable the program to seek a contradiction and, if one is found, provide a means for the program to "know" it has succeeded. Clauses 1 through 10 are sufficient for solving the puzzle, but they provide no means for the program to "know" when the puzzle has been solved. Without a clause such as clause 11 and the proof by contradiction it leads to, a typical reasoning program would most likely continue reasoning even after the solution had been found. The presence of clause 11 does not mean that you need to know the correct answer about the contents of box 1; clause 11 merely represents denying one of the possibilities being true.
Automating Reasoning
603
(What happens when clause 11 is replaced by a clause that denies the other obvious possibility—the possibility that box 1 contains oranges—is discussed in the next paragraph.) In clause 5, the variable xbox implicitly ranges over all possible boxes. By convention, all well-formed expressions beginning with u through z are automatically treated as variables meaning "for all". In clause 6, the variable xbox implicitly ranges over all boxes, while the variable yfruit implicitly ranges over all types of fruit in the puzzle. It is obtained by translating the corresponding clue in the puzzle first into "if a box x is labeled y, then it cannot contain y," and then translating the if-then into clause form using the fact that "if P, then Q" is logically equivalent to "not P, or Q." Clause 7 can be obtained by taking actions similar to those taken to obtain clause 6, and using the fact that "not(not(P))" is logically equivalent to "P." Clauses 8, 9, and 10 are examples of the kind of mundane information, as commented earlier, you are sometimes forced to include. Finally, for those who wish to know the whole story, clauses 1 through 10—although sufficient for illustrative purposes—do not capture all of the information in the puzzle. For example, no clause is given for the fact that each box contains exactly one kind of fruit. You might give your representation in clause form for this fact. In place of clause 11 denying that box 1 contains bananas, you could give the reasoning program (11') -CONTAINS(boxl,oranges)
denying the possibility that box 1 contains oranges. Since, as it turns out, clause 11' does not represent false information, a program reasoning from 11' together with clauses 1 through 10 could never find a proof by contradiction. Among other effects, the program would not "know" when the task had been com pleted. In such a situation—when given a set of clauses from which no proof by contradiction can be obtained—a reasoning program will run out of time, or run out of memory, or run out of conclusions to draw. In the case under discussion, the program will run out of conclusions to draw. Although among the conclusions drawn from clause 11' together with clauses 1 through 10 will be the statements (true, as it turns out) that box 1 contains bananas and box 3 contains oranges, you cannot simply consider the problem solved. The truth of deduced statements depends on the truth of the statements in the history of the deduction of the corresponding clauses. Conclusions drawn from false statements, as remarked earlier, may be false. In particular, if clause 11' is in the history of some deduced clause, the "truth" of that clause is in doubt, since 11' represents an assumption that may be false. Since using clause 11' in place of clause 11 does not lead to a proof by contradiction, the truth or falseness of 11' remains in doubt. On the other hand, since using clause 11 can lead to a proof by contradiction, the falseness of 11 can be established. In short, when trying to solve this problem, you do not know whether to use 11 or 11'. If you try the latter first, the result will be inconclusive, and you would then naturally try the former and obtain a solution.
Collected Works of Larry Wos
604
To understand more fully what can happen when clause 11 is replaced with clause 11', you might write down a proof that parallels the following one. The following proof by contradiction, equivalent to the one cited earlier, does establish that box 1 contains bananas. Rather than using binary resolution (dis cussed in the preceding section) as the rule for drawing conclusions, the rule to be used will be UR-resolution. UR-resolution is a more powerful inference rule than binary resolution: it is not constrained to consider only two clauses at a time; it is required to draw simple conclusions—clauses that contain no occur rence of " | " ("or") and contain at least one symbol. For example, simultaneous consideration by UR-resolution of the three clauses FEMALE(Gail) (Gail is female) HASCHILDREN(Gail) (Gail has children) -FEMALE(x) I -HASCHILDREN(x) I MOTHER(x) (females who have children are mothers) yields
MOTHER(Gail) (Gail i s a mother) as the conclusion. If the second of these three clauses is replaced by -MOTHER(Gail) (Gail i s not a mother) UR-resolution applied to the new set of three clauses yields -HASCHILDREN(Gail) (Gail has no children) as the conclusion. The two conclusions are examples of unit clauses. UR-resolution (unit-resulting) derives its name from the requirement of yielding unit clauses as conclusions. Here is the promised proof. From clauses 8, 1, and 7: (12) -CONTAINS(boxl,apples) From clauses 12, 11, and 5: (13) CONTAINS(boxl,oranges) From clauses 9, 1, and 7:
Automating Reasoning
605
Contradiction Figure 9. Proof by contradiction: a 'proof tree" for the fruit puzzle (see Figure 5).
(14) -CONTAINS(box3.apples)
From clauses 10, 13, and 7: (15) -CONTAINS(box3,oranges) From clauses 14, 15, and 5: (16) CONTAINS(box3,bananas) From clauses 16 and 6:
(17) -LABEL(box3,bananas) Since clauses 17 and 4 contradict each other, a proof by contradiction has been found (see Figure 9). The assumption, clause 11, that box 1 does not contain bananas is proved false—the other 10 clauses come from the puzzle description— so box 1 does, in fact, contain that fruit.
606
Collected Works of Larry Wos
If you are puzzled by the fact that various clauses—such as clause 13— in the proof are actually "false," the explanation lies with the rigor of logical reasoning. The program is simply drawing conclusions that follow logically from the given information. Since clause 11 is "false," it is not surprising that some clauses having clause 11 in their ancestry are also "false." Clauses representing false information are to be expected, for here the program is, after all, seeking a "proof by contradiction."
Strategy for Controlling Reasoning Just as you will usually fail if you try to solve a problem or answer a ques tion without using strategy, so too will an automated reasoning program usu ally fail without it. Without strategy—for a person or an automated reasoning program—it is simply too easy to get lost, to draw too many irrelevant conclu sions, and to fail to focus on the problem under attack. When you, for example, give a hint or suggestion to a co-worker about how to attack some problem, you are trying to give that co-worker an advantage by using a strategy based on your knowledge or intuition. To provide a reasoning program with the same advan tage, you may use a strategy called the "weighting strategy." With "weighting," you instruct the program about the priorities (weights) to be assigned to the concepts, properties, and symbols that occur in the problem under study. In the fruit puzzle, for example, you could tell the program to concentrate on any information that mentions apples. Equally, you could instead tell it to delay reasoning from any information mentioning apples. By using the "weighting strategy," you can use your knowledge and intuition to "direct" the program's search for information toward or away from an area. With that strategy, you can even tell the program to discard all information of some given type whenever it is found. Of potentially greater value than strategies that direct the reasoning pro gram's search are strategies that restrict its search. For example, in the proof in clause form that was just given, no conclusion depends on clauses 2 through 10 alone; each (deduced) step can be traced back to clause 1. By prohibiting the program from drawing conclusions involving clauses 2 through 10 only—and thus restricting its search for information—the number of possible conclusions to be examined can be sharply reduced. Such a restriction of the program's rea soning can be achieved by using a strategy called the "set of support strategy" (see Figure 10). Using that strategy, an automated reasoning program can be restricted to reasoning from certain clauses only, using the remaining clauses merely to complete the application of some inference rule. The most common use of the "set of support strategy" relegates the general information in a problem to that which is used only to complete applications of inference rules. When used this way, you are taking advantage of the fact
Automating Reasoning
607
W ft* S t r a t e g y
INFORMATION
Set «f Support Strategy
KEY INFORMATION
AUXILIARY INFORMATION
Figure 10. T h e intuitive notion of t h e "set of s u p p o r t " strategy, used in restricting a search. [SIAM News, 9/84.] that you are asking the program to seek a proof by contradiction, knowing that reasoning from the general information (ordinarily) simply adds more selfconsistent information. In particular, you are using the known consistency of certain information to increase the effectiveness of the reasoning program. You are providing a means for the reasoning program to concentrate on the specific problem at hand rather than on exploring the entire theory underlying the problem. Use of strategies that direct and strategies that restrict a reasoning program's actions is required if such a program is to provide much assistance in solving problems and in answering questions.
Using an A u t o m a t e d Reasoning P r o g r a m An automated reasoning program can be used in three ways. You can submit the problem to it for study and disappear for some time, hoping on your return to find a solution (batch mode). You can sit at a terminal and have a dialogue with the program, asking it to execute each instruction you issue (interactive mode). You can submit the problem to it with some chosen constraint on the time it is allowed or on the amount of new information to be found, and then examine the results to see how the next run should be modified (graduate assistant mode). Of these three ways to use an automated reasoning program, the way that has yielded the most significant achievements is the graduate assistant mode.
608
Collected Works of Larry Wos
In that mode, you play an integral role in the attempt to solve each given prob lem, but you do not have to issue the detailed instructions usually required in the interactive mode. Based on the results of earlier runs, you decide whether or not to change the inference rule or strategy to be employed in later runs. Each run takes the form of an experiment or a small investigation, often yield ing a substantial amount of information. The graduate assistant mode has the advantage—over the batch mode—of not limiting the possible outcome to com plete failure or total success, and—over the interactive mode—of avoiding the usual dialogue that occurs in that mode. In such a dialogue, you might, for ex ample, begin by asking the program to draw three conclusions; it might respond with three new facts or relationships. You might then instruct it to discard the second of the three; it would respond by signifying that the second was purged. You might next ask it to draw two additional conclusions from the first; it might then display two additional statements. Although the dialogue that usually oc curs in the interactive mode can be very profitable, often the preferred choice is to use the program as an assistant. On the other hand, although seeking an answer in a single attempt (as occurs in the batch mode) sometimes meets with success, for many problems the graduate assistant mode works best. By using your knowledge and intuition to direct your automated reasoning assistant, you might solve problems that neither you nor it could solve alone. Given the problem or question to be attacked with the assistance of your reasoning program, you decide on which of the three modes of operation to use. Next, you translate the problem or question into an appropriate set of clauses, being careful to include explicitly whatever information you suspect is needed to pin down the various concepts that are involved in the problem. You must also pick the inference rule(s) that seems suited to the problem and the strategy (or strategies) that reflect the attack you wish made. Although it may be far from obvious, the three choices—representation, inference rule, and strategy— should be made simultaneously, for the effects of the three are tightly coupled. (Guidelines, in the form of proverbs, for making such choices are discussed in Chapter 16 of Automated Reasoning: Introduction and Applications.) Finally, since the most effective way to use an automated reasoning program is to have it seek a contradiction, you usually assume the result false, the goal unreachable, or the fact not deducible. You might also add clauses that permit the program to rephrase all information into a normal form. If you are not sure which clauses to add but conjecture that normal forms would help, the reasoning program can be asked to find candidates. As with any co-worker or colleague, the program's attempt at solving the given problem or answering the given question can lead to utter failure, some help, or total success. Failure to complete the assignment is not always a disaster, and, in fact, the run may provide some help. In particular, examination of the program's output after a failure often reveals the key to the answer you are seeking. Sometimes the information you desire is obtained only after a sequence of runs, each influenced by the results of the preceding run. And, of course,
Automating Reasoning
609
sometimes you must accept defeat, deciding that the problem is simply too difficult or the program not powerful enough. However, before deciding that the power of the program is inadequate to the task, you should examine the conclusions it has drawn to see if some mundane information is missing from the input. For example, both clauses FEMALE(x) I MALE(x) -FEMALE(x) I -MALE(x) are required to pin down the relationship of people to gender—in particular, to state that every person is either female or male. Regardless of what happens when submitting any given problem or question to an automated reasoning pro gram, the advantages of using such a program often outweigh the disadvantages.
Disadvantages of A u t o m a t e d Reasoning Most of the disadvantages of using a reasoning program can be traced to ques tions of language. To be required to learn yet another language is often annoying or. for some, not worth the effort. To be forced to include obvious and mundane information of the type you tell to the totally uninitiated is boring at best. Finally, to have to look for information that is implicitly present is tedious. In short, automated reasoning programs "understand" very little at the beginning of any completely new endeavor. As for mastering the use of a reasoning program—learning which inference rules work best where, and which strategies are most effective in which situ ations, for example—it is like acquiring any complex skill. No real substitute exists for practice and experience. That is clearly a disadvantage.
Advantages of A u t o m a t e d Reasoning One of the most important advantages of using an automated reasoning program is its reliability. Such programs do not make errors—well, hardly ever. If a bug exists, then of course they can err. However, if you are suspicious of any result, you can check its validity by simply applying the same algorithm the program was intended to use. After all, a reasoning program can list every step of its reasoning, and provide the justification for each step. Flaws in the information given to such a program to describe the problem are in fact often discovered by finding obvious nonsense: among the conclusions drawn by it. What is missing and needed can often be discovered with such an examination. Perhaps equal in value to reliability is a reasoning program's ability to com plete assignments that might be extremely difficult if not impossible for a person. For example, a 297-step proof validating the correctness of the design of a 16-bit adder was obtained in less than 20 seconds of CPU time on an IBM 3033 by the
Collected Works of Larry Wos
610
reasoning program AURA. That proof would have been tedious—and perhaps out of reach—for a person to find. Equally, the 162-step proof that settled a previously open question in formal logic might never have been found without the assistance of a program like AURA, especially since some of the formulas that occur in that proof contain 103 symbols exclusive of commas and grouping symbols. The formula E(E(E(xO,E(E(xl, x2),E(E(x2,xO),xl))), E(E(x3,x4),E(E(x4, E(x5,E(E(x6,x7), E(E(x7,x5),x6)))), x3))),E(E(E(E(E(x8, E(E(x9,xlO),E(E(xlO,x8), x 9 ) ) ) , x l l ) , E(E(xl2,E(xl3, E(E(xl3,xl2),E(xl4, E(E(xl5,xl6), E ( E ( x l 6 , x l 4 ) , x l 5 ) ) ) ) ) ) , E(xl7,E(E(xl8,xl9), E ( E ( x l 9 , x l 7 ) , x l 8 ) ) ) ) ) , E(xll,E(x20,E(E(x21,x22), E(E(x22,x20),x21))))), E(x23,E(E(x24,x25), E(E(x25,x23),x24))))) illustrates the complexity of that proof, and also illustrates the kind of expres sions that an automated reasoning program easily handles. The third advantage of using a reasoning program concerns the wish to "prove" that your answer to some given problem or question is correct. You might, for example, wish to know that a piece of code is free of bugs, that a circuit is correctly designed, or that a statement from mathematics is true. An automated reasoning program can sometimes provide that knowledge. In particular, if you have wished for a way to examine an argument for flaws, find inconsistencies, or discover hidden and invalid assumptions, use of a reasoning program may get you your wish. The fourth advantage of using an automated reasoning program is that it makes no implicit assumptions. You are forced to state in an unambiguous manner precisely what the problem is about. Though often painful, the result can be the discovery of invalid assumptions and subtle but useful distinctions. The last and perhaps most obvious advantage of using an automated reason ing program is simply to have access to logical reasoning—to have an automated assistant that can draw conclusions that follow logically from some given set of hypotheses.
Summary; Applications for A u t o m a t e d Reasoning Automated reasoning is a young and challenging field whose long-term objective is to design and implement computer programs each of which functions as an automated reasoning assistant. The object is for one single program to provide assistance that ranges from that offered by an individual with much experience and intelligence to that offered by an untrained individual, where the choice of
Automating Reasoning
611
the level is at the user's control. You and your automated reasoning assistant form a partnership, where, for each given problem, the distribution of work is your choice. At one end of the spectrum, your choice might be to issue very specific instructions: draw three conclusions; discard the second; save the third to be used with other facts later; draw two additional conclusions from the first of the three; . . . . At the opposite end of the spectrum—if the current research succeeds—your choice might be simply to describe the problem, and then rely on your assistant to choose the rules for reasoning, to pick the strategy for controlling the reasoning, and self-analytically to redirect the attack if necessary. Between these two points, your choice might be to make a series of computer runs, each modified according to what you find in the preceding runs—in effect, a dialogue between you and your assistant. Having access to a computer program that functions as a reasoning assistant may make it possible to solve many difficult problems that are currently beyond those that can now be solved by a computer alone or by a person alone. A computer program of the type just discussed reflects one of the differences between automated reasoning (AR) and that part of (classical) artificial intel ligence (AI) that focuses on reasoning. In AR you are combining the power of the computer with the control of the user in a fashion that permits and even encourages you to play an active role. In AI you are often using a "black box" approach, an approach in which your function is essentially to submit the prob lem. While the use of an AR program can produce results that lie at various points between success and failure, the use of an AI program usually produces either one or the other. A second difference between AR and AI concerns the nature of the reasoning and approach to problem solving that is employed. In AR, the reasoning and approach are not necessarily designed to imitate the way a person would attack a problem; in fact, they are often designed to rely on a combination of the computer's ability to manipulate symbols and to match patterns, enabling it to use procedures (such as paramodulation and subsumption) that a person would not use. (Paramodulation is an inference rule that enables a reasoning program to "build in" equality substitution, and subsumption is the procedure used to remove both redundant and less general information automatically.) In AR, the inference rules, strategies, and language for representing the problem are general-purpose rather than being tuned to a specific problem or problem domain. The inference rules are designed to yield (the most) general conclusions, and the strategies are designed to give you (the most) general control over the rules. Of course, when using an automated reasoning program, you must describe the problem to be solved by that program; but, when that is done, you are permitted the use of a wide variety of inference rules and strategies and related procedures that enable you to give varying amounts of guidance to the program. In AI, the approach often is special-purpose, oriented to a specific problem or problem domain, imitating a person's method, and guided by heuristics that a person might use. While the emphasis in AR is on reasoning
612
Collected Works of Larry Wos
that yields conclusions that follow logically and inevitably, in much of AI the reasoning is probabilistic or common-sense. As discussed here, both AR and AI approaches have their advantages and disadvantages, and it remains to be seen which is best for which applications. Until more is known, research in automated reasoning will continue to aim at producing a general-purpose highlevel reasoning assistant. To reach the goal of making available a high-level automated reasoning assis tant will require first answering various theoretical questions about more useful representations of information, more effective inference rules for drawing conclu sions, and more powerful strategies for controlling the inference rules. As those questions are being studied—in fact, in order to study them-computer programs are needed to conduct numerous experiments. Only through extensive experi mentation can the needed theory be developed, tested, and evaluated. The more useful programs, therefore, must offer a variety of inference rules and strategies from which to choose, but also offer certain other necessary features. For ex ample, they should offer a procedure for automatically rephrasing information, and a procedure for automatically removing both redundant and less general information. Effective and useful automated reasoning programs do exist. The generalpurpose reasoning program AURA (Automated Reasoning Assistant), the pro gram verification system of Boyer and Moore, and the program verification sys tem of Good are three programs that have a number of successes to their credit. Of a somewhat different nature, the system LMA (Logic Machine Architecture) has been successfully used to produce effective reasoning programs tailored to given specifications. In particular, the portable reasoning program ITP pro duced with LMA is now in use by many people throughout the world. Some of the users of ITP are studying circuit design, some studying circuit validation, some conducting research in mathematics, some exploring the application to chemical synthesis, some exploring the application to program verification, and some employing it as a teaching aid. Although most reasoning programs have been available only for a few years— and in fact the field of automated reasoning itself is very young—a number of applications of automated reasoning already exist. Computer programs actually in use have been verified, superior logic circuits designed, other existing circuits validated, and previously open questions in mathematics and in formal logic answered. Some of the results were obtained by people far from expert in auto mated reasoning itself, demonstrating that, with effort, reasoning programs can be used without substantial expertise in automated reasoning. The reliability of reasoning programs makes them very attractive as assis tants. The results obtained with them can be generally accepted without ques tion. Such programs provide a needed complement to those used for numerical computation and for data processing. Learning to use a reasoning program can require substantial effort, especially when exploring a new application. How ever, once the database of facts and relationships describing the application is
Automating Reasoning
613
in place, it can be used repeatedly. The mastery of the use of a reasoning program is in part made easier because many of its functions correspond somewhat to ordinary actions (see Figure 13). People often use normal (standard) forms, discard trivial consequences of known information, remove duplicate information, and occasionally keep track of which facts lead to which conclusions. Those who are more successful at solving prob lems and answering questions use strategy, even though they do not always do so explicitly. After all, to play chess well, to win at poker, to score well at most games, strategy is indispensable. Thus, in view of the variety of problems that can be solved with a reasoning program, becoming familiar with the explicit use of strategy is not very taxing. The future is very exciting, offering many opportunities for using, imple menting, and conducting research in automated reasoning. Some of the pro grams that will be developed will use extensive amounts of parallelism, some will incorporate a logic programming component, some will be tailored to a given application. Soon it may be commonplace for all kinds of applications and research to rely on a program that functions as a high-level automated reasoning assistant.
References Bledsoe, W. W., and Loveland, D., eds. Automated Theorem Proving: After 25 Years. Contemporary Mathematics, Vol. 29. Providence, RI: AMS, 1984. Boyer, R. S., and Moore, J Strother. A Computational Logic. New York: Aca demic Press, 1979Chang, C , and Lee, R. Symbolic Logic and Mechanical Theorem Proving. New York: Academic Press, 1973. Kowalski, R. Logic for Problem Solving. New York: Elsevier North-Holland, 1979. Loveland, D. Automated Theorem Proving: A Logical Basis. New York: NorthHolland, 1978. Siekmann, J. H., and Wrightson, G., eds. The Automation of Reasoning. Vols. I and II. Classical Papers on Computational Logic. New York: Springer-Verlag, 1983. Wos, L.; Overbeek, R.; Lusk, E.; and Boyle, J. Automated Reasoning: Introduc tion and Applications. TOnglewood Cliffs, NJ: Prentice-Hall, 1984.
614
Collected Works of Larry Wos
Figure 11. A pattern of dominoes showing the solution for the checker board puzzle in Figure 3.
Answers to Problems and Puzzles • The first problem is merely an example of what can be done, and therefore does not admit of an answer other than that such subroutines have been verified. • Of the three checkerboards shown in Figures 1, 2, and 3, as proved by the reasoning programs AURA and ITP, no placement of dominoes exists that covers precisely either of the first two, while the third can in fact be covered precisely (see Figure 11). • The circuit shown in Figure 4 does in fact satisfy the requirements. • A solution of the fourth problem—one you might give, and its equivalent in clauses—was given earlier (see Figure 9) to illustrate various concepts. • The circuit design in Figure 12 is a solution to the fifth and final problem, if viewed as a problem in circuit design. If viewed as a problem in computer programming, then Figure 12 provides a solution by replacing the NOT gates by Is complement instructions, the OR gates by OR instructions, and the AND gates by AND instructions, and using the appropriate COPY instructions.
Automating Reasoning
615
4>
-L^
S>TJ>^
■O-
kM
£H>
I
-O
t>
-
^
£>i
--3>
O
iCK. D-^
Figure 12. Solution to the inverter problem (Figure 6), from Automated Reasoning, p. 215. Figures 4 and 12 are reprinted by permission of Prentice-Hall, Inc., copyright 1984.
• •
.
• :
•
Posing the problem to the reasoning program
Directing the program's focus
• i
:•••:•
Drawing conclusions by applying inference rules
1
• •
••
• • • •
Rewriting and simplifying conclusions
i
!•• •
Testing for significance
/ . •
Integrating those that are significant
Figure 13. The sequence of actions in a reasoning program is shown in the diagram at left. [SIAM News, 9/84.]
616
Collected Works of Larry Wos
Larry Wos is a senior mathematician in the Mathematics and Computer Sci ence Division at Argonne National Laboratory. He has written numerous articles on automated theorem proving and automated reasoning, and lectured exten sively on both topics. He recently coauthored the book Automated Reasoning: Introduction and Applications; he is also editor-in-chief of the Journal of Auto mated Reasoning, and president of the Association for Automated Reasoning. Dr. Wos is currently conducting research at Argonne National Laboratory on the formulation of more effective inference rules and more powerful strategies for automated reasoning.
Job-Shop Scheduling Using Automated Reasoning: A Case Study of the Car-Sequencing Problem BRUCE D. PARRELLO and WALDO C. KABAT Northwestern University, Evanston, IL 60201, U.S.A. L. WOS Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL 60439, U.S.A. (Received: 27 November 1985) Abstract. The 'job-shop scheduling problem' is known to be NP-complete. The version of interest in this paper concerns an assembly line designed to produce various cars, each of which requires a (possibly different) set of options. The combinatorics of the problem preclude seeking a maximal solution. Neverthe less, because of the underlying economic considerations, an approach that yields a 'good' sequence of cars, given the specific required options for each, would be most valuable. In this paper, we focus on an environment for seeking, studying, and evaluating approaches for yielding good sequences. The environment we discuss relies on the automated reasoning program ITP. Automated reasoning programs of this type offer a wide variety of ways to reason, strategies for con trolling the reasoning, and auxiliary procedures that contribute to the effective study of problems of this kind. We view the study presented in this paper as a prototype of what can be accomplished with the assistance of an automated reasoning program. Key words. Job-shop scheduling, automated reasoning, economic considera tions.
1
Introduction
The manufacture of automobiles is colored by the fact that the cars produced in a single day on a single assembly line are not homogeneous: each car may require a slightly different set of options. For example, one car might require a vinyl roof, air conditioning, and power windows; the next might require no vinyl roof, but instead require cruise control; and a third might require no special options Reprinted from the Journal of Automated Reasoning, Vol. 2, no. 1, pp. 1-42 (February 1986) with kind permission from Kluwer Academic Publishers.
618
Collected Works of Larry Wos
at all. An assembly line could be designed to move slowly enough to allow sufficient time to put every possible option on every car processed by the line, but such an approach is needlessly expensive. Instead, for each option, the line is designed to handle a predetermined ratio of cars with that option to cars without that option. For example, let us say that on the average fewer than 60% of the cars ordered from plant A are required to have air conditioning. Let us further say that the cars are moving through the line at such a rate that five cars will pass through the air-conditioning station in the time it takes to install an airconditioning unit on one car. In order to be able to install air conditioning on 60% of the cars that pass through, the plant would have three installation teams at the station (because 3/5 = 60%). As a car requiring installation of air conditioning passes through the front of the air-conditioning station, an available team will start work on it, walking along with the car until it reaches the end of the station. At this point, four more cars will have passed through the station entrance. If any two of them require air conditioning, the other two teams will be able to handle the load. If, however, a third car requires an air conditioner-which means that four of the five cars require this feature—the station will be unable to react fast enough. For this particular example, we say that the assembly line in plant A has a capacity constraint of 3 out of 5 for air conditioning. Let a set of cars to be run through the line be called a schedule. Associated with each car in the schedule is a list of attributes, one for each constrained option that must be installed on that car. For each such attribute, the assembly line possesses an integer ratio, called a capacity constraint, which dictates how frequently a given attribute can occur before the performance of the line begins to degrade. To solve (within the constraints of the assembly line) the sequencing problem for a given schedule of cars, a linear ordering, called a sequence, for the cars must be defined that ensures the capacity constraints are always met. The sequencing problem is not always solvable for a given schedule. For example, if 80% of the cars in a given schedule require air conditioning and the assembly line to produce them has a 60% constraint on air conditioning, the capacity constraint of 3:5 cannot be met. As a consequence, to search for a sequence in which the violations that occur are the least costly, we introduce the concept of a penalty function. The desired penalty function will assign a numeric penalty value to an entire sequence of cars. To define the penalty function, we shall first define a penalty for each attribute at each position in the sequence. The penalty for each car in the sequence is then computed by summing the penalties for the attributes it possesses. The attribute penalty function is computed in the following way. First, to each attribute A we assign a positive integer I called the interval of relevance. Then, the penalty function for an attribute assigns a penalty value that depends on the number of occurrences of that attribute in the interval of relevance. The penalty value, for a given number N of occurrences of a given attribute A in
Job-Shop Scheduling
Using Automated
Reasoning
619
an interval of length I, represents the cost of scheduling a car with attribute A immediately after I consecutive cars, N of which also have attribute A. For example, to discourage having more than one set of power windows in any set of three consecutive cars, we might create the following penalty function for power windows. interval of relevance: 2 occurs penalty ~0 0 1 1 2 6 When a car requires power windows, this function assigns no penalty if the preceding two cars require no power windows (which means that the 1 in 3 constraint is satisfied), a small penalty if one car of the preceding two requires power windows, and a large penalty if both of the preceding two cars require power windows. For example, in the following sequence, let ' P ' denote a car requiring power windows and 'N' a car not requiring power windows. car P N N N P N P penalty 0 0 0 0 0 0 1 total penalty = 8
P P 1 6
Note that, in the given sequence, the total penalty could be reduced by interchanging the fourth and fifth cars. car P N N P N N P P P penalty 0 0 0 0 0 0 0 1 6 total penalty = 7 The interchange reduces the number of violations of the 1:3 constraint from three to two. Note, however, that the following sequence has a still smaller penalty even though the number of violations is greater than that for both of the preceding two sequences. car P N P N P N P N P penalty 0 0 1 0 1 0 1 0 1 total penalty = 4 The penalty of 8 for the first of the three sequences is twice the penalty of 4 for the third even though the third has more violations. The difference in penalties results from the large penalty of requesting power windows for three consecutive cars. The presumption is that a power-windows team working somewhat faster can handle the third sequence with a slight drop in efficiency, but to install three sets of power windows in a row would be almost impossible. The basic penalty function described to this point does not precisely behave in the way we wish. For example, it assigns the same overall penalty to both of the following sequences.
Collected Works of Larry Wos
620 car penalty
P 0
N 0
P 1
car penalty
N 0
P 0
P 1
Clearly, the first sequence is preferable since the team has more time to work on the first set of power windows. To assign the second sequence a larger penalty, we create a second interval, smaller than the interval of relevance, called the proximity interval. The penalty value is incremented by a value called the proximity factor if the proximity interval contains a car with the given attribute and the base penalty value is nonzero. Let us say that for power windows the proximity interval is 1 and the proximity factor is 2. The penalties for the two given sequences are the following. car penalty
P 0
N 0
P 1
car penalty
N 0
P 0
P 3
Our penalty mechanism in this case would correctly choose the first sequence as the better one. The following table presents five sample attributes and defines a penalty function for each. We shall use these penalty functions in all of our examples. attribute roofvinyl powrwindw air roofsun cruisctl
intrel 8 2 4 9 9
0 0 0 0 0 0
1 0 1 0 4 1
2 1 6 0 5 2
3 2
4 3
5 4
6 5
7 6
8 7
9
4 6 3
8 7 4
8 5
9 6
10 7
11 8
12 9
intprx 4 1 1 2 2
prxfac 4 2 0 9 6
The table is used to compute attribute penalties in the following manner. First, we take the interval of relevance for the attribute from the 'intrel' column (for example, in the case of power windows this would be 2). Next, we count the cars in the interval possessing the attribute (for example, of the two cars pre ceding the current position, one may have power windows). The resulting count determines the column of the table from which we take the base penalty (in our example this would be the column for '1', which contains a base penalty of 1). Finally, the length of the proximity interval is taken from the 'intprx' col umn (this is 1 for power windows), and the proximity penalty from the 'prxfac' column (2 for power windows) is added if that interval contains a car with the given attribute. Two points about these functions are worth noting. First, although sun roof and cruise control both have the same capacity constraint (1:10), violating the
Job-Shop Scheduling
Using Automated
Reasoning
621
sun roof constraint is more expensive. Second, the proximity factor for air con ditioning is 0, so proximity has no effect on the sequencing of air-conditioned cars. The given discussion shows how, for any attribute and any sequence of cars, we can compute a penalty value. The penalty for placing a car immediately after a sequence of cars that precede it is the sum of the penalty values assigned by that sequence to the car's attributes. Finally, the penalty value of an entire sequence is computed by summing the penalty values assigned to each car in the sequence. For example, assume that car 1 requires a vinyl roof and power win dows, car 2 requires air conditioning, car 3 requires a vinyl roof, cruise control, power windows, and air conditioning, car 4 requires a vinyl roof, air condition ing, and a sun roof, and car 5 requires air conditioning, cruise control, and power windows. The following table summarizes these requirements. attribute roofvinyl powrwindw air roofsun cruisctl
2 N N Y N X
1 Y Y N N N
3 Y Y Y N Y
4 Y N Y Y X
5 N Y Y N Y
To each position in the given table containing a 'Y', we assign a penalty value using our formula. (For purposes of illustration, those penalties that are modified by a proximity factor are shown in boldface.) attribute roofvinyl powrwindw air roofsun cruisctl
1 2 0
3 0
4 5
5
O i 0 0 0
l 4 0 7
0
By summing each column of the table, we can compute the penalty for each car in the sequence. car penalty
1 2 0 0
3 L
4 5
5 12
By summing the car penalties, we get the penalty of 18 for the entire se quence. As before, we can decrease the penalty by interchanging cars. The following table shows the penalties when the sequence is 3-4-2-5-1.
Collected Works of Larry Wos
622
attribute roofvinyl powrwindw air roofsun cruisctl total
3 0 0 0 0 6
4 0
2
5
0 0
0
0 4
0
0
1 5
1 5 3
8~
The total penalty for this scrambled sequence is 13, which is a decrease of 5. Thus, the scrambled sequence is preferable. In this context, the goal of the car-sequencing study is to derive the sequence with the smallest penalty. In Section 3.1, we shall discuss current approaches to this problem. Since the techniques presented in Section 3 for finding and evaluating the different approaches rely on the use of an automated reasoning program, the next section is devoted to a review of the basic concepts that are needed.
2
A u t o m a t e d Reasoning: A Review
To make it easier to follow the specific details of how an automated reasoning program can be used to attack the car-sequencing problem, we pause here for a review of the pertinent concepts. By including this material here, we provide the needed background for those who are not very familiar with automated rea soning itself. In particular, we discuss by example the language for representing the problem, the inference rules for drawing conclusions, the strategies for con trolling the reasoning, a procedure for simplifying and normalizing information, and a procedure for discarding trivial information.
2.1
LANGUAGE
To submit a problem to an automated reasoning program, the problem can be stated in the Jem clause language. For example, where '|' is read as or and '-' is read as not, the three clauses 1.
FEMALE(Nan)
2. 3.
-IRISH(Nan) FRENCH(Nan)IIRISH(Nan)
respectively represent the specific facts that 'Nan is female', 'Nan is not Irish', and 'Nan is French or Irish". The three clauses all represent specific information about Nan. To represent general information, the clause language relies on the use of variables. For example, the clause 4.
FEMALE(x)I MALE(x)
Job-Shop Scheduling
Using Automated
Reasoning
623
can be written for the statement 'everyone is female or male'. The variable 'x' in clause 4 is implicitly treated as meaning for all x. In fact, all variables are treated as meaning 'for all'. If the problem under consideration requires expressing the existence of some quantity or object, then an appropriate constant or function is introduced. For example, the statement 'for all integers x, there exists an integer y larger than x ' can be represented with the clause 5.
GREATERTHAN(f(x),x)
where the function ' / ' is introduced and can be thought of as a function mapping integers to larger integers. The functions and constants that are introduced to express existence are called Skolem functions. Such functions are generally, but not always, distinct from constants and functions such as 'Nan' in clauses 1, 2, and 3 that name specific objects. If the function ' / ' in clause 5 is to be treated as a particular function—for example, the successor function—then additional clauses such as 6.
EQUAL(f(x),sum(x,l))
would be required. The symbol ' 1 ' is a constant, just as the expression 'Nan' is a constant in clauses 1, 2, and 3. Where clauses such as clause 6 are needed to restrict ' / ' to the notion of successor, certain other obvious candidates are not. For example, where the symbol 'y' is considered to be a variable, the clause GREATERTHAN(f(f(y)),f(y)) is not needed. Obviously, since the variable 'x' in clause 5 means 'for all x', clause 5 also holds when 'x" is replaced by ' / ( y ) " . We say that this last clause is captured as an instance, of clause 5. If one clause is an instance of another clause, then the instance is immediately discarded with the subsumption procedure (discussed in Section 2.4) in favor of the more general and more informative clause. One term is an instance of a second term if the first can be obtained from the second by a uniform replacement of the variables in the second term. Similar definitions exist for instance of a clause and instance of a variable. An instance containing no variables is called a ground instance. For example, the clause FEMALE(Nan)iMALE(Nan) is a ground instance of the clause FEMALE(x)|MALE(x) and the first clause can be obtained from the second clause by a uniform re placement of 'x' by 'Nan', by instantiating the second clause. The ground lit eral 'FEMALE(Nan)' is a ground instance of the literal 'FEMALE(x)', and the term 'Nan" is a ground instance of the variable 'x". Finally, the term
Collected Works of Larry Wos
624
'prod(0,sum(x, y))' is an instance of the term 'prod(0,«)', although not a ground instance. An example that reviews what we have covered so far is the clause EQUAL(sum(y,minus(y)),0) which is an acceptable representation of the statement 'there exists z such that for all y there exists x such that the sum of y and x equals z'. Here the Skolem constant '0' is used to replace the existential variable 'z' and the Skolem function 'minus" to replace the existential variable 'x". To complete the treatment of language, certain additional terms and con ventions are needed. Between each pair of clauses, the presence of an implicit occurrence of and is assumed. If clauses 1 through 6, given earlier in this section, are included as part of a database problem description, the reasoning program treats the six clauses as having and (implicitly) written between clauses 1 and 2, between 2 and 3, between 3 and 4, and so forth. Conversely, if the problem includes the fact that 'Nan is pretty and intelligent', then the clauses 7. PRETTY(Nan) 8. INTELLIGENT(Nan) must be given to the program if it is to have access to this information. Similarly, if the fact that 'everyone is female or male, but not both' is believed to be vital to solving the problem, then, in addition to clause 4 4.
FEMALE(x)I MALE(x)
clause 9 9.
-FEMALE(x)|-MALE(x)
must be supplied. Clause 9 simply says that 'everyone is not female or not male'. The presence in both clauses 4 and 9 of the same variable 'x' does not imply that the scope of that variable is the and of the two clauses. Rather, variables are relevant only to the clause in which they occur. In particular, the replacement of clause 9 by the clause -FEMALE(y)|-MALE(y) conveys the same meaning to the reasoning program as clause 9 does and, as will be shortly seen, has no effect on the program's capacity to draw conclusions. Ordinarily, the clause language employs as logical connectives only | for or, - for not, and (implicitly) and. A statement of the form 'if P, then Q' is transformed to the logically equivalent statement 'not P, or Q\ Clause 9 is a typical example of this transformation. In addition to the meaning given to clause 9 in the preceding paragraph, that clause also is a representation of the statement 'for all x, if x is female, then x is not male'. Although we could require such transformations prior to input, we shall occasionally write
Job-Shop Scheduling
Using Automated
Reasoning
625
statements in the if-then form for readability. The reasoning program I T P used in this study accepts such statements and converts them into the appropriate clauses. For example, the statement 'if x is the mother of y and z is the brother of x, then z is the uncle of y' is represented with the clause -MOTHER(x,y)|-BROTHER(z,x)|UNCLE(z,y) relying only on or and not. In each clause, the expressions that are separated by | (if | is present) are called literals. For example, clause 3 consists of two literals, and clauses 1 and 2 each consist of a single literal. Clause 1 consists of a positive literal, and clause 2 consists of a negative literal. Clause 10 10. ('if
-HASAJ0B(x,nurse|MALE(x) x h a s t h e j o b of n u r s e , t h e n x i s m a l e ' )
contains one negative and one positive literal. Because clauses 1 and 2 contain only one literal each, they are called unit clauses or simply units. Similarly, clauses 9 and 10 are called nonunit clauses. Unit clauses, as will be seen, are of especial interest in the approach given in Section 3. We close this discussion on language by discussing some additional concepts and giving certain conventions we observe. Although reasoning programs in general 'understand' few concepts, equality is one exception. When a literal begins with the symbol string EQUAL or -EQUAL, various reasoning programs, such as ITP, treat these literals as meaning equal or not equal, respectively. (The program I T P used in this study treats equality as 'built in'.) For example, the presence of the clause 11.
EQUAL(prod(x,0),0)
automatically forces the clause GREATERTHAN(sum(a,b),prod(x,0)) to be rewritten as GREATERTHAN(sum(a,b),0) if clause 11 has been appropriately designated as a rule for automatically rewrit ing expressions. Access to 'built-in' equality is vital to certain procedures on which the approach for attacking the car-sequencing program relies. The expression EQUAL of clause 11 is called a predicate. Similarly, the ex pressions HASAJOB and MALE of clause 10 are also predicates. In addition to the built-in treatment of equality predicates, I T P also employs predicates such as $GT for 'greater than' and $LE for 'less than or equal'. For arithmetic purposes, the program also has access to built-in functions such as $sum, $prod, $dif, and $div. I T P allows built-in arithmetic functions to be specified in infix form. Thus,
626
Collected Works of Larry
Wos
EQUAL((x*0),0) is an alternative form of clause 11. Besides these built-in predicates and func tions, the convention for variables that is observed requires all variables to begin with lower case ' s ' through 'z', and conversely. Finally, all predicates are written in upper case, and all functions in lower case with the exception of proper names such as 'Nan'.
2.2
INFERENCE RULES
Inference rules are rules used by an automated reasoning program to derive new information from existing information. T h e simplest inference rule employed by the automated reasoning program I T P used in this study is binary resolution. Binary resolution applied to the pair of clauses FEMALE(Nan) ('Nan i s f e m a l e ' ) and -FEMALE(Nan)I-MALE(Nan) ('Nan i s n o t female or Nan i s n o t m a l e ' ) yields the clause -MALE(Nan) ('Nan i s n o t m a l e ' ) as the conclusion by canceling the literal 'FEMALE(Nan)' with the literal 'FEMALE(Nan)'. In addition to cancellation of literals, binary resolution also relies on substitution for variables. For example, when applied to the pair of clauses FEMALE(Nan) -FEMALE(x)|-MALE(x) the clause -MALE(Nan) is deduced. The second clause of this pair is an acceptable representation of the general fact that 'every person is not female or not male'. The conclusion is obtained by substituting 'Nan' for the variable ' i ' and canceling literals as before. For a more complex illustration of how binary resolution works, consider the equations x + -x = 0 y + (-y + z) = z
Job-Shop Scheduling
Using Automated
Reasoning
627
which yield in a single step y + 0 » -(-y) In clause form, using the predicate SUM, from SUM(x,minus(x),0) and -SUM(minus(y),z,u)lSUM(y,u,z) the clause SUM(y,0,minus(minus(y)) is obtained by substituting 'minus(y)' for 'x', l minus(minus(j/))" for 'z" and '0" for V in both clauses. This substitution unifies the literals to be canceled and, ignoring sign, produces the single literal 'SUM(minus(j/),minus(minus(y)),0)'. Binary resolution always considers a pair of clauses and, when its application is successful, yields conclusions that follow logically. Because of the nature of this study, rather than employing binary resolution itself, we use various refinements of it. We employ unit resolution which considers pairs of clauses and requires that at least one of the pair be a unit clause. We also use UR-resolution (unit-resulting resolution) which considers a set of clauses all but one of which are required to be a unit clause and yields conclusions that are required to be unit clauses. For example, if UR-resolution is applied to the set consisting of the clauses FEMALE(Gail) ('Gail i s female') CHILD(Kirsten,Gail) ('Kirsten is Gail's
child')
-FEMALE(x)I-CHILD(y,x)I MOTHER(x) ( ' f o r a l l x and y , i f x i s female and y i s t h e c h i l d of x , then x i s a mother') the clause MOTHER(Gail) is deduced. The inference rule hyperresolution is also of interest in this study. It considers a set of clauses all but one of which are required to contain positive literals only and is required to yield a clause containing only positive literals. For example, if hyperresolution is applied to the clauses
628
Collected Works of Larry Wos
14. 15. 16.
-MOTHER(x,y)I-BROTHER(z,x)|UNCLE(z,y) MOTHER(Thelma,Pete)ILIVESIN(Pete,Boston) BROTHER(Steve.Thelma)
the conclusion 17.
UNCLE(Steve,Pete)ILIVESIN(Pete,Boston)
is obtained. The final inference rule that is relevant to this study is paramodulation, a rule that 'builds in' equality into reasoning programs. For a trivial example, paramodulation applied to the equation la + —a = 0' and the statement 'o 4- —a is congruent to 6' yields in a single step '0 is congruent to b". In clause form, from EQUAL(sum(a,minus(a)),0) into CONGRUENT(sum(a,minus(a)),b) the clause CONGRUENT(O.b) is obtained by paramodulation. For a complex example, paramodulation applied to the equations 'x+—x = 0' and 'y+(—y+z) = z' yields in a single step ' y + 0 = —(—y)'. This example was cited earlier in the context of binary resolution; however, the availability of paramodulation enables us to recast the problem directly in equational form rather than using the 'SUM' predicate. In clause form, from EQUAL(sum(x,minus(x)),0) into EQUAL(sum(y,sum(minus(y),z)),z) the clause EQUAL(sum(y,0),minus(minus(y))) is deduced as the conclusion by applying paramodulation. To see how a single application of paramodulation yields this conclusion as a one-step deduction, substitute 'minus(y)' for V and 'minus(minus(y))" for 'z" in both clauses to produce EQUAL(sum(minus(y),minus(minus(y))),0) and
Job-Shop Scheduling Using Automated Reasoning
629
EQUAL(sum(y,sum(minus(y),minus(minus(y)))).minus(minus(y))) as respective instances of the two given clauses. The first of the two instances states that the expression 'sum(minus(j/),minus(minus(y)))' equals 0 —an im mediate consequence of the first given clause—which justifies the replacement of that particular expression by 0 in the second clause to yield the conclusion.
2.3
STRATEGY
Undirected or unrestricted application of reasoning by a person or a program will usually result in failure to reach the desired objective. Both strategy to direct and strategy to restrict the application of the inference rules are needed. In ITP, the weighting strategy is used to direct the reasoning, and the set of support strategy is used to restrict it. With weighting, the user assigns values to the concepts and symbols in the problem under study, and the reasoning program uses those values to assign priorities. The program chooses to focus its attention on the clause with the highest priority. (In the case of ITP, the highest priority is given to clauses with the lowest weight value.) The user's knowledge and intuition can thus be imposed on the search for a solution to a given problem by causing the program to prefer certain paths of investigation to others. With this same weighting mechanism, the user can assign appropriately high weights (low priorities) to various concepts and symbols and instruct the reasoning program to discard all clauses whose weight exceeds some chosen value. To restrict the reasoning, the user can employ the set of support strategy. To do so, the program is in effect instructed to treat certain input clauses as usable only to complete a deduction step. A subset T of clauses is chosen from among the input clauses, and the input clauses not in T are prohibited from being considered by themselves for application of an inference rule. The subset T is called the set of support. The clauses in T and those that are deduced and kept in the database are termed supported. The objective is to restrict the program's reasoning to deducing clauses that are intended to be directly germane to the problem under consideration.
2.4
DEMODULATION AND SUBSUMPTION
Two other procedures, demodulation and subsumption, contribute markedly to the effectiveness of automated reasoning programs. The use of demodulation enables a reasoning program to both simplify and normalize information by rewriting it. For example, in the presence of the demodulator EQUAL(sum(x,0),x) the clause GREATERTHAN(sum(a,0),b)
Collected Works of Larry Wos
630 is immediately simplified to the clause GREATERTHAN(a.b)
with demodulation. For a different example, the clause LESSTHAN(prod(prod(a,b),c),d) is immediately normalized to the clause LESSTHAN(prod(a,prod(b,c)),d) when EQUAL(prod(prod(x,y),z),prod(x,prod(y,z))) is present as a demodulator. Demodulation relies on the 'built-in' treatment of equality that is present in I T P and in various other automated reasoning pro grams. In particular, predicates that begin with EQUAL are treated by I T P as if they are 'understood' to mean equality. Demodulation can be viewed as a restricted form of paramodulation with certain vital differences. The most important difference for this study is the removal of a clause in favor of a sim plified or normalized version of that clause produced by applying demodulation. Although demodulation is usually used as just discussed, in this study it is also used as a programming language to perform certain computations. Demodula tion is particularly useful for this purpose because it acts in a strictly procedural manner. Subsumption is employed to discard clauses that are trivial consequences of other existing clauses. For example, the clause MALE(father(Ardis)) ('Ardis's father i s male') is discarded in favor of the clause MALECfather(x)) ('fathers are always male') by subsumption. The first clause is a trivial consequence of the second. T h e use of subsumption also discards the clause FEMALE(Nan)IMALE(Nan) when the clause FEMALE(Nan) is present. The second of these two clauses is more informative than the first and, in fact, logically implies the first, which justifies discarding the first in favor of the second.
Job-Shop Scheduling Using Automated
2.5
Reasoning
631
PROOF BY CONTRADICTION
Having shown how a problem can be represented to an automated reasoning program, how the program can draw conclusions, how the reasoning can be controlled, and how information can be appropriately rewritten or discarded, we now come to the means for a reasoning program to 'know' that it has solved the problem. The usual way a reasoning program 'knows' the assigned problem has been solved is by finding a proof by contradiction. In particular, it attempts to deduce a sequence of clauses such that each clause in the sequence is either an input clause or a clause deduced from clauses earlier in the sequence, and such that the final clause in the sequence obviously contradicts one of the earlier clauses. The typical approach to using a reasoning program is to assume the desired result false with the intention that that assumption will eventually lead to a contradiction. The following trivial example illustrates the approach. The specific fact 'Nan is female' and the general fact 'everyone is not female or not male' together obviously imply that Nan is not male. If the goal were to have a reasoning program find a proof of this obvious conclusion, the approach calls for assuming the conclusion false. From the corresponding clauses 1. 2. 3.
FEMALE(Nan) -FEMALE(x)|-MALE(x) MALE(Nan)
a one-step proof can easily be obtained. By applying unit resolution to clauses 2 and 3, clause 4 4.
-FEMALE(Nan)
is deduced, which obviously contradicts clause 1. Since clauses 1 and 2 corre spond to accurate information and are tacitly assumed to be consistent, the fact that a contradiction is found establishes that clause 3 does in fact correspond to a false assumption. As soon as an automated reasoning program finds a proof by contradiction, it 'knows' that the problem has been solved. I T P can be asked to continue on to find other, alternative solutions. Proof by contradiction is a very simple and convenient test for a person or a program to know that the assignment has been completed. In the next section, we shall discuss different methods for solving the carsequencing problem. Obviously, since some schedules require that the constraints of the assembly line be exceeded, we mean solve in a manner that is not too expensive for the line. In subsequent sections, we shall apply the techniques described in this section to the problem of finding, testing, and evaluating al ternative methods for producing 'good sequences'.
632
3 3.1
Collected Works of Larry Wos
Solving t h e Car-Sequencing P r o b l e m SOLUTION STRATEGIES
The optimal solution to the car-sequencing problem can be found by examining all possible sequences and choosing the one with the smallest overall penalty. In a real-life schedule of over 200 cars, however, this scheme is simply impractical. A more practical approach, although less likely to lead to an optimal solution, is to assign the cars to positions in the sequence one position at a time. At each point in the sequence, the penalty for every available car is computed and the car with the smallest penalty is selected. We call this approach the leftward-sampling method of solving the car-sequencing problem (see Note 1 in Appendix B). Of course, some mechanism is needed to break ties. For now, let us assume that, when a tie occurs, we arbitrarily choose the first suitable car. The following table shows how the approach works for our sample problem of Section 1. For each position, the penalties are shown for all available cars. The selected car's penalty is shown in boldface. pos f 1 0 2 3 4 5
2 0 0
3 4 0 0 0 0 1 0 5 14
5 0 3 1 0
This approach could easily be implemented in a traditional algorithmic pro gram. Such a program would be far less useful than it might be. First, the penalty functions, designed to reflect assembly line capabilities, tend to change radically as new technologies are developed. Even highly table-driven functions, such as the one defined in Section 1, are often inadequate to handle these changes smoothly. For example, older assembly lines require that the cars be sequenced by make: if there are five makes numbered 1 through 5, the sequence of makes would be 1 2 3 4 5 1 2 3 4 5 . . . . The penalty functions specified earlier are not adequate for implementing this requirement. Newer assembly lines, however, do not require a strict sequence of makes; instead, there is a standard m:n capac ity constraint for each make. When changes, such as the one cited, occur in either the specifics or the structure of the penalty functions, the batch program must be reprogrammed. Because of the cost of reprogramming and because such changes occur so often, people who are expert in the field are now required to examine the computer-generated sequences and alter them to satisfy new rules. To overcome the need for this form of expert assistance, some sort of automated reasoning technology is preferred over batch programming. Unfortunately, even with access to an automated reasoning program, leftwardsampling is still inadequate. In particular, even when the rules are all correct,
Job-Shop Scheduling
Using Automated
Reasoning
633
leftward-sampling still does not produce very good sequences. For example, the 1-2-4-5-3 sequence produced earlier is not as good as the 3-4-2-5-1 sequence we used as an example in Section 1. A good question to ask is why. Of the five cars, car number 3 requires the most options (attributes). The placement of car 3 in the sequence has the greatest risk of incurring a penalty. The given table shows that the longer we wait to place car 3, the larger the price we must pay. The leftward-sampling method, unfortunately, cannot look ahead to see what is going to happen. As the penalty for placing car 3 rises, the method becomes increasingly determined not to place it, setting itself up for an even larger penalty in the long run. For historical reasons, this phenomenon is called cherry picking. It can be avoided by trying to schedule the difficult cars as early as possible. This seems like a good move, since our flexibility decreases as we proceed further down the sequence. To facilitate this move, we assign a difficulty factor to each attribute. The difficulty factor of a car is computed by summing the difficulty factors of its attributes. Ties among cars are broken in favor of the car with the largest difficulty factor. For our example, we shall use as the difficulty factor for an attribute the sum of the attribute's proximity factor and its interval of relevance. We obtain the following tables of difficulty factors.
attribute roofvinyl powrwindw air roofsun cruisctl
diff 12 4 4 18 15
car 1 2 3 4 5
diff 16 4 35 34 23
Incorporating difficulty factors into leftward-sampling leads to the following solution. pos 1 1 0 2 3 3 6 4 5 5 8
2 0 0 0
3 0
4 0 0
5 0 10 8 5
Now there are going to be cases where use of difficulty factors leads to a worse solution instead of a better one. In practice, however, difficulty factors have the greatest influence when there are several attributes with zero penalty (leading to a large number of cars with zero penalty). In such an environment, we have the least to lose by quickly scheduling those cars that place the maxi mum restrictions on immediately subsequent cars; actually, such cars should be scheduled early because we have the most to lose by waiting.
634
Collected Works of Larry Wos
The technique of leftward-sampling using difficulty factors shows promise in solving the car-sequencing problem. To see if that promise is fulfilled, we must first evaluate the technique experimentally. In the next section, we shall discuss an environment for doing just that. In fact, we focus on an aid—the automated reasoning program ITP—that can be used for finding and comparing various approaches to solving the car-sequencing problem.
3.2
USING AUTOMATED REASONING TO DEVELOP ALTERNATIVE METHODS
Difficulty factors are one example of a heuristic for improving the approach for solving the car-sequencing problem; there are most certainly others. The nature and effects of all of these heuristics, however, is unknown at this time. Thus, our first priority is not to implement a program to derive car sequences, but to create an environment in which other useful heuristics can be discovered. The desirable characteristics of such an environment are the following. (1) It should be relatively easy to change the rules by which cars are selected. (2) It should be possible to monitor the progress of the selection process in great detail. (3) It should be possible to interrupt the selection process while it is running and modify it. (4) At any point, it should be possible to ask questions about the current attributes of the cars in the partially generated sequence. Characteristic (1) is one of the properties possessed by an expert system. Thus it seems appropriate to build an expert system for car sequencing. This de cision should not, however, be taken lightly! The car-sequencing problem makes heavy use of statistical functions (in particular, the penalty functions and the function for selecting the next car to use). These functions are second-order functions because their arguments are sets rather than objects. This means that they cannot be expressed directly in the first-order logic which is the basic language of most expert systems tools. As will be seen in later sections, a great deal of the effort on this project was consumed in dealing with this problem. To return to the definition of our experimental environment, characteristic (4) suggests that the desired system should be a forward-chaining rather than a backward-chaining system. In a forward-chaining system, the natural derivation of facts from productions leaves the attributes of the cars in the sequence and the sequence itself as facts in working memory. In addition, it is very straightforward to make a forward-chaining system derive facts that are useful to the user but unnecessary to the reasoning process. For example, when all but the final car have been assigned a position in the sequence, then no penalty computations are needed; the car can simply be assigned the final position. However, the reasoning program, by computing the penalty for this car, provides useful information for evaluating alternative approaches to finding acceptable sequences. In effect, the system creates a database of useful information about the sequence as the
Job-Shop Scheduling Using Automated Reasoning
635
sequence is generated. In a backward-chaining system, the explanation facility explains why the program arrived at its current conclusions, but it is not trivial to convert this information into a database against which queries can be made. Most forward-reasoning systems have facilities of the sort described in (2) and (3), so these goals should not be a problem. The tools available for this project at its inception were Prolog [Clock81], ITP [Lusk84j, and OPS5 [Forgy81]. Of the three, Prolog is by far the fastest— around 600 times faster than the other two—and is strongly recommended as the implementation vehicle for production pilot testing. Unfortunately, forward reasoning in Prolog must be simulated by a conceptually simple but opera tionally tedious and error-prone process. Thus it was deemed not suitable for the experimental prototype. As a genuine production system tool, OPS5 offers several advantages over ITP. In particular, it provides greater user control over the contents of working memory, and it has more flexible I/O facilities. On the other hand, the notation used by ITP is considerably more compact than that used by OPS5, and ITP provides greater flexibility in controlling the order in which productions are chosen (see Note 2 in Appendix B). In addition, ITP has a built-in mechanism— demodulation—for programming strictly procedural computations, which occur frequently in the car-sequencing problem. Although neither tool offers a clear advantage, the ability to control the processing order and the availability of demodulation proved the deciding factors. In the next section, we describe the initial approaches to the problem and the techniques developed as a result.
3.3
THE INITIAL MODEL
The basic approach we developed in Section 3.1 is to derive the sequence one car at a time, starting from the beginning, using the following two rules to select a car. (1) For the sequence position currently to be filled, the car selected must have a smaller penalty than any other available car. (2) The attributes of the car selected must make it the most difficult to place of all available cars of the same penalty. To ensure a unique solution at every sequence position, the cars are linearly ordered. If, according to the rules, more than one eligible car exists, the earliest one in the ordering is selected. The two given rules and the definition of penalties rely on statistical func tions. In particular, the rules rely on minimization and maximization functions, and the penalties rely on count and sum functions. We call the minimization and maximization functions selection functions because they select an element from the base set, and the count and sum functions reduction functions because they reduce the base set to a single numeric value. Since functions of these types cannot be expressed directly in first-order logic, expressing them presents
Collected Works of Larry Wos
636
a major obstacle. One approach to overcoming this obstacle requires adding axioms from set theory to the model and representing the functions in set-theoretic notation. We rejected this approach for two reasons. First, it appears to be too inefficient for this study. Second and more important, since the model is intended to suggest how automated reasoning can be used in other industrial applications, we felt that an approach different from one employing set theory might be easier to follow. Our first approach, which we later rejected, was to use demodulation to gather all the elements of a function's base set into a list and then evaluate the function over the list using recursion. This technique is not always feasible, for the gathering of the elements into a list requires that a function exist to generate each element from its predecessor. Nevertheless, the technique has the advan tage of being a procedural solution to what is normally a procedural problem. The first model derived for the car-sequencing problem uses this technique. Un fortunately, since the number of demodulations required is more than 200 per car for each position in the sequence, the approach is prohibitively slow. The direct approach performs much unnecessary work; it recomputes each component of each car's penalty every time. The cost of computing the penalties can be sharply reduced by defining the initial penalty for each car to be 0, and then defining the penalty for each subsequent position in terms of the changes made by the addition of the car immediately preceding that position. This tech nique is called finite differencing [Paige82]. The second model derived for the car-sequencing problem uses this technique to reduce the number of demodula tions for a penalty computation to just over 20. However, finite differencing only works for reduction functions, so a second technique is needed for the selection functions. The obvious technique for handling selection functions is to define them using a first-order predicate, and let the evaluation be made using resolution. For example, assume we wish to select the maximum element of the set {x|P(x)}. This element is selected by the predicate 'MP(i)' with the following definition. MP(x) iff P(x) ft (Vy)(P(y) -> x >= y) This definition is represented with the following clauses, where 'fy' is a Skolem function (see Note 3 in Appendix B). (1) (2) (3) (4)
if if if if
MP(x) then P(x); MP(x) ft P(y) then $GE(x,y); P(x) ft -P(fy(x)) then MP(x); P(x) ft $GE(x,fy(x)) then MP(x);
As an example, let us consider the case in which we have a set of three numbers—3, 5, and 7—of which we wish to find the maximum. Normally, we would add the following three clauses as the set of support
Job-Shop Scheduling
(5) (6) (7)
Using Automated
Reasoning
637
P(3); P(5); P(7);
and apply hyperresolution in search of a proof by contradiction that contradicts the following clause. (8)
-MP(x);
Our desire is that the reasoning program contradict clause 8 by generating the clause (8')
MP(7);
but in fact the reasoning program would run indefinitely without finding a con tradiction. T h e problem with the approach is that we have not stated that o n l y 3, 5, and 7 have the property P. Although such an omission is normally not a problem [Reiter78], our use of the Skolem function ' / y ' requires this additional information. To make the given set of clauses unsatisfiable, and thus set the stage for finding a proof by contradiction, we must add the domain closure axiom (0)
i f P ( x ) t h e n EQUAL(x,3)|EQUAL(x,5)|EQUAL(x,7);
which enables the program to find the following derivation of 'MP(7)' by using hyperresolution, paramodulation, and the built-in treatment of greater than or equal. (9;7,3) (10;9,0) (11;10>4) (12;11,7) (13;12>4) (14;13,7) (15;14>4) (16;15,7)
P(fy(7))|MP(7); EQUAL(fy(7),3)|EQUAL(fy(7),5)|EQUAL(fy(7) ,7)|MP(7); if P(7) & $GE(7,3) then MP(7)|EQUAL(fy(7) ,5)1 |EQUAL(fy(7),7); MP(7)|EQUAL(fy(7),5)|EQUAL(fy(7),7); if P(7) ft $GE(7,5) then MP(7)|EQUAL(fy(7),,7); MP(7)|EQUAL(fy(7),7); if P(7) ft $GE(7,7) then MP(7); MP(7);
The second model derived for the car-sequencing problem uses the domain closure axiom and finite differencing to reduce the demodulation overhead of the first model. Unfortunately, since the domain-closure formulation of maximiza tion functions produces a large number of extraneous clauses, the reasoning program requires frequent manual intervention to keep it on the track. In a practical problem, where the domain closure axiom would usually contain 200 or more equality literals, the number of extraneous clauses would be exponen tially larger. This is to say nothing of the onerousness of having to actually write the clause for the corresponding domain closure axiom.
Collected Works of Larry
638
Wos
An alternative to the use of the domain closure axiom is to use domain induction. The trick to domain induction is to number the elements of the set sequentially from 1. The effect of domain closure is simulated by stating that what is true for all elements corresponding to whole numbers is true for all elements in the set. The third model derived for the car-sequencing problem uses domain induction in place of the domain closure axiom. Experiments with this model led to the development of the following structured approach to domain induction and finite differencing. We present domain induction first. Let us assume we wish to select the first element of the finite set {x|P(x)} that is maximal on the left side of the inclusive ordering relation ' Q ' . (For example, if ' Q ' were the relation 'lexically greater than', we would be attempting to select the lexical maximum of the elements in P.) The element having this property will be identified by the predicate ' Q P ' . To make this selection, we need a function 'p' such that every 'a;' that satisfies 'P(x)' is equal to 'p(ny for some integer 'n'. Let ' N ' be the largest such 'n'. The function 'p' is the enumerator of ' P ' and 'N' is the enumeration limit of ' P ' . We call ' P ' the base predicate and ' Q ' the ordering predicate. The existence of an enumerator and an enumeration limit for the base predicate is a prerequisite for making domain induction work. The selection predicate ' Q P ' is defined in the following way. (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11)
if if if if if if if if if if if
QPX(x.z) ft EQUAL(N.z) t h e n q P ( x ) ; NQPX(z) ft EQUAL(N,z) t h e n - Q P ( x ) ; INITIAL ft P ( p ( D ) t h e n Q P X ( p ( l ) , l ) ; INITIAL k ( n o P ( p ( D ) t h e n NqPX(l); QPX(x.z) ft PG(z.y) ft Q ( y , x ) t h e n QPX(y,z+l); QPX(x.z) ft PG(z,y) ft - Q ( y , x ) t h e n QPX(x,z+l); QPX(x.z) ft NPG(z.y) t h e n Q P X ( x , z + l ) ; NQPX(z) ft PG(z,y) t h e n Q P X ( y , z + l ) ; NQPX(z) ft NPG(z.y) t h e n NqPX(z+l); INITIAL ft P ( p ( z ) ) t h e n P G ( z - l , p ( z ) ) ; INITIAL ft - P ( p ( z ) ) t h e n N P G ( z - l , p ( z ) ) ;
Note the use of two induction predicates, ' Q P X ' and 'NQPX', to recursively define ' Q P " . Both a positive and a negative version are required because of the need to start the induction even if some initial sequence of the 'p(i)'s does not satisfy 'P(x)'. Note also that the generator predicates ' P C and ' N P G ' are used to get from one element in the enumeration to the next. These predicates are used rather than a direct invocation of constructs such as 'P(p(.z + 1))' because demodulation and built-in arithmetic are not applied when matching antecedents (see Note 4 in Appendix B). Note that the special 0-ary predicate INITIAL is used to mark clauses (3), (4), (10), and (11). The set of support will consist only of a unit clause contain ing INITIAL, so its use in these clauses guarantees that they will be invoked immediately. By way of example, let us assume t h a t the following clauses define P and Q.
Job-Shop Scheduling
(12) (13) (14) (15) (16) (17) (18) (19) (20) (21) (22) (23) (24)
Using Automated
Reasoning
639
P(p(D); P(p(2)); P(p(3)); EQUAL(N,3); Q(p(l),p(l)); -Q(p(l),p(2)); Q(p(l),p(3»; Q(p(2),p(l)); Q(p(2),p(2)); Q(p(2),p(3)); -Q(p(3),p(l)); -Q(p(3),p(2)); q(p(3),p(3));
Obviously, l p(2)' is the element we are looking for. Now, to make the rea soning program find l p(2)', we add clause (25) as the set of support, use URresolution [McChar76, Wos84], and deduce the following clauses. (25) (26;25,3,12) (27;25,10,12) (28;25,10,13) (29;25.10.14) (30:28,5,26,19) (31:30,6,29,23) (32;31,1,15)
INITIAL; QPX(p(l),l); PG(0,p(D); PG(l,p(2)); PG(2.p(3)); QPX(p(2),2); QPX(p(2),3); QP(p(2));
The given derivation is extremely efficient. No extraneous clauses are generated! Note especially the use of clause (15) as a fact rather than as a demodulator. Clause (15) must be used as a fact because I T P will not apply input demodu lators to the input clauses (1) through (25). The derivation makes use of the fact that there is a positive or negative unit P-clause for every element of p ( l ) , p(2), p(3), and similarly a positive or negative unit Q-clause for every ordered pair of elements in that set. The set {p(l), p(2), p(3)} is called the enumeration of ' P ' , and we say that ' P ' and 'Q" are unit-defined over the enumeration of 'p". For domain induction to work, the base predicate must be unit-defined over the enumeration of the enumerator. The required unit clauses must be either axioms or derivable from the axioms and the set of support by repeated applications of UR-resolution. The ordering predicate need not be unit-defined, but it must be unit-computable. A predicate
is unit-computable if it is unit-defined or is a built-in predicate, such as $GE. The restrictions on domain induction are the following. An enumerator and an enumeration limit must exist that specify a superset of the objects sat isfying the base predicate. The base predicate must be unit-defined over the
Collected Works of Larry Wos
640
enumeration, and the ordering predicate must be a valid linear ordering that is unit-computable over the enumeration. (The ordering predicate need not be unit-computable over the entire enumeration, but must be unit-computable for every pair of elements to be compared.) Finally, there must exist a unit clause stating whether or not the first element of the enumeration satisfies the base predicate, and that unit clause must have a supported derivation. Finite differencing is similar to domain induction in structure. However, it is simplified by the fact that there is no need for a negative induction predicate. If the base predicate is not satisfied by any elements of the enumeration, a default value is returned. Let us assume that we wish to evaluate a binary function '/'> called a finite difference, over the set {x|P(a;)}. (For example, if ' / ' w e r e addition, we would be seeking the sum of all the elements in the set.) Let 'p' be an enumerator of 'P' and 'N" the enumeration limit. Assume that, if the set is empty, we wish the default value 'd' returned. The reduction predicate 'FP' is defined with the following clauses. (1) (2) (3) (4) (5) (6)
if FPX(x.z) & EQUAL(N.z) then FP(z); if INITIAL then FPX(d.O); if FPX(x.z) & PG(z.y) then FPX(f(x,y),z+l; if FPX(x.z) & -PG(z,y) then FPX(x,z+l); if INITIAL & P(p(z)) then P G ( z - l , p ( z ) ) ; if INITIAL ft -P(p(z)) then - P G ( z - l , p ( z ) ) ;
To see how the process works, assume that we have defined 'P' with the following clauses. (7) P ( p ( l ) ) ; (8) P ( p ( 2 ) ) ; (9) P ( p ( 3 ) ) ; (10) EqUAL(N,3); To compute the reduction of 'P' using ' / ' , we add the INITIAL clause as set of support and use UR-resolution as we did with domain induction. (11) (12;11,2) (13;11,5,7) (14;11,5,8) (15;11,5,9) (16;13,12,3) (17;16,14,3) (18;17,15.3) (19;18,10,1)
INITIAL; FPX(d.O); PG(0,p(D); PG(l,p(2)); PG(2,p(3)); FPX(f(d,p(l)),l); FPX(f(f(d,p(l)),p(2)),2); FPX(f(f(f(d,p(l)),p(2)),p(3)),3); FP(f(f(f(d,p(l)),p(2)),p(3)));
The following restrictions are imposed on finite differencing. An enumerator and an enumeration limit must exist that specify a superset of the objects
Job-Shop Scheduling
Using Automated
Reasoning
641
satisfying the base predicate. The base predicate must be unit-defined over the enumeration. Finally, there must exist a unit clause specifying the default value, and that unit clause must have a supported derivation. We are now ready to develop an improved model for the car-sequencing problem. We begin by specifying the problem-specific input clauses. (These will be given for our original example of five cars and five attributes.) First, we need enumerators and enumeration limits for the set of available cars and the attributes. The enumerator for the cars will be the function 'c', and the enu merator for the attributes will be the function 'a'. The following demodulators give names for the attributes and enumeration limits for both sets. (Note that we use 'roofvinyl' and 'roofsun' instead of 'vinylroof" and 'sunroof" since terms beginning with V and 's" are automatically treated as variables.) PSO1) PS02) PS03) PS04) PS05) PS06) PS07)
EQUAL (a (1) , roof viny 1) ; EQUAL(a(2).powrwindw); EQUAL(a(3),air); EqUAL(a(4),roofsun); EQUAL(a(5),cruisctl); EQUAL(psncars,5); EQUAL(psnattrs,5);
Next, we need a set of demodulators that describe the penalty functions. The set of demodulators will define the problem-specific functions 'psirel(i4)\ which returns the interval of relevance for attribute lA\ 'psval(A, N)\ which returns the initial penalty value for attribute A given N occurrences in the interval of relevance, 'psirpx(yl)', which returns the proximity interval for attribute A, and 'psxfac(zl)', which returns the proximity factor for attribute A. The following demodulators are used. PS08) PS09) PS10) PS11) PS12) PS13) PS14) PS15) PS16) PS17) PS18) PS19) PS20) PS21) PS22) PS23)
EqUAL(psirel(roofvinyl),8); EqUAL(pspval(roofviny1,0),0); EQUAL(pspval(roofvinyl,1),0); EqUAL(pspval(roofvinyl,2) ,1) ; EqUAUpspval (roof v i n y l , 3) , 2 ) ; EqUAUpspval (roof v i n y l , 4) ,3) ; EqUAUpspval (roof v i n y l , 5) , 4 ) ; EQUAUpspval(roofvinyl,6) , 5 ) ; EQUAL(pspval(roofviny1,7),6); EqUAL(pspval(roofvinyl,8),7); EqUAL(psiprx(roofvinyl),4); EQUAL(psxfac(roofvinyl),4); EQUAL(psirel(powrwindw),2); EQUAL(pspval(powrwindw,0),0); EQUAL(pspval(powrwindw,1),1); EQUAL(pspval(powrwindw,2),6);
Collected Works of Larry Wos
642
PS24) PS25) PS26) PS27) PS28) PS29) PS30) PS31) PS32) PS33) PS34) PS35) PS36) PS37) PS38) PS39) PS40) PS41) PS42) PS43) PS44) PS45) PS46) PS47) PS48) PS49) PS50) PS51) PS52) PS53) PS54) PS55) PS56) PS57) PS58) PS59)
EQUAL(psiprx(powrvindv),1); EQUAL(psxfac(powrvindw),2); EQUAL(psireKair) ,4); EQUAL(pspval(air,0),0); EQUAL(pspval(air,1),0); EQUAL(pspval(air,2),0); EQUAL(pspval(air,3),4); EQUAL(pspval(air,4),8); EQUAL(psiprx(air),1); EQUAL(psxfac(air),0); EQUAL(psirel(roofsun),9); EQUAL(pspval(roofsun,0),0) ; EQUAL(pspval(roofsun,1),4); EQUAL(pspval(roofsun,2),5); EQUAL(pspval(roofsun,3) ,6) ; EQUAL(pspval(roofsun,4),7); EQUAL(pspval(roofsun,5),8); EQUAL(pspval(roofsun,6),9); EQUAL(pspval(roofsun,7),10) EQUAL(pspval(roofsun,8),ll) EQUAL(pspval(roofsun,9),12) EQUAL(psiprx(roofsun),2); EQUAL(psxfac(roofsun),9); EQUAL(psireKcruisctl) ,9) ; EQUAL(pspval(cruisctl,0),0) EQUAL(pspval(cruisctl,1),1) EQUAL(pspval(cruisctl,2),2) EQUAL(pspval(cruisctl,3),3) EQUAL(pspval(cruisctl,4),4) EQUAL(pspval(cruisctl,5),5) EQUAL(pspval(cruisctl,6),6) EQUAL(pspval(cruisctl,7),7) EqUAL(pspval(cruisctl,8),8) EqUAL(pspval(cruisctl,9),9) EQUAL(psiprx(cruisctl),2); EQUAL(psxfac(cruisctl),6);
Next, for each car-attribute pair, we must either affirm or deny that the car possesses the attribute. We use the 'PSATTR' predicate, defined with clauses 60 through 84, for our five sample cars. (Note that 'PSATTR' is unit-defined for the enumeration of 'c'.) PS60) PS61) PS62)
PSATTR(c(l),roofvinyl); PSATTR(c(1),powrwindw); -PSATTR(c(l),air);
Job-Shop Scheduling
PS63) PS64) PS65) PS66) PS67) PS68) PS69) PS70) PS71) PS72) PS73) PS74) PS75) PS76) PS77) PS78) PS79) PS80) PS81) PS82) PS83) PS84)
Using Automated
Reasoning
643
-PSATTR( c C O . r o o f s u n ) ; -PSATTRC cCD . c r u i s c t l ) ; -PSATTRC c C 2 ) , r o o f v i n y l ) ; -PSATTRC cC2).powrwindw); PSATTRCc C 2 ) , a i r ) ; -PSATTRC c ( 2 ) , r o o f s u n ) ; -PSATTRC c C 2 ) . c r u i s c t l ) ; PSATTRCc ( 3 ) . r o o f v i n y l ) ; PSATTRCc C3).powrwindw); PSATTRCc ( 3 ) , a i r ) ; -PSATTRC c C 3 ) . r o o f s u n ) ; PSATTRCc ( 3 ) . c r u i s c t l ) ; PSATTRCc C 4 ) . r o o f v i n y l ) ; -PSATTRC c(4).powrwindw); PSATTRCc ( 4 ) , a i r ) ; PSATTRCc ( 4 ) . r o o f s u n ) ; -PSATTRC c ( 4 ) . c r u i s c t l ) ; -PSATTRC c ( 5 ) . r o o f v i n y l ) ; PSATTRCc C5).powrwindw); PSATTRCc C 5 ) , a i r ) ; -PSATTRC c C 5 ) . r o o f s u n ) ; PSATTRCc C 5 ) . c r u i s c t l ) ;
Next, we must associate a difficulty factor with each attribute. The difficulty factors will be used to guide the reasoning program in placing the most difficult cars as soon as possible. Although difficulty factors can be computed mathe matically from the penalty functions, for the purposes of experimenting with the prototype we shall define them with problem-specific demodulators. PS85) PS86) PS87) PS88) PS89)
EQUALCpsadiff Croofvinyl),12); EQUALCpsadiff Cpowrwindw),4); EQUALCpsadiff Cair),4); EQUALCpsadiffCroofsun),18); EqUALCpsadiffCcruisctl),15);
Finally, we need to know the maximum number of positions to be filled; it may be less than, but not greater than, the number of cars. The maximum is specified by a demodulator for 'psnposs'. PS90)
EQUALCpsnposs,5);
The problem-specific definitions are now complete. The next step is to develop the axioms that will utilize the problem-specific definitions to derive a sequence of cars. At the highest level, we observe that a sequence of cars exists if a car is known for every position in the sequence. The predicate 'BESTCAR' is used to determine the best car at a given position in the sequence, and the following axioms define a good sequence of cars.
Collected Works of Larry Wos
644
(1) if INITIAL then POSG(0,pos(D); (2) if INITIAL ft PQSG(z,pos(x)) ft $LT(x,psnposs) then P0SG(x,pos(x+D); (3) if BESTCAR(x.posU)) then GOODSEQ(l);
(4) if GOODSEQ(z) ft POSG(z.y) ft BESTCAR(x,pos(y)) then G00DSEQ(z+l); These four clauses define the predicate 'GOODSEQ' inductively, using 'POSG' as a generator predicate for positions. Note that the l$LT(z,psnposs)' literal in the second clause functions as a base predicate for positions. The definition of 'GOODSEQ' is simpler than normal domain induction; since nothing is being selected, no ordering predicate is needed, and no requirement for remembering the current 'best' value exists. When we have filled every position in the sequence, we wish to stop. The following pair of clauses will suffice. (5)
if EQUAL(psnposs.x) ft GOODSEQ(x) then FINISHED;
(6) -FINISHED; Note that we use a 0-ary predicate 'FINISHED' to derive unit conflict (and thus stop the reasoning program) instead of simply denying the existence of a good sequence of the proper length. We take this approach so that forward rea soning is used and backward reasoning is blocked as much as possible. Backward reasoning is undesirable because it leads to the deduction of false information, polluting the database of useful information about the sequence we wish to derive. Normally, UR-resolution permits both forward and backward reason ing. Backward reasoning is blocked in this case since neither '-FINISHED' nor 'EQUAL(psnposs,x)' are supported, so neither can participate in resolution un til 'GOODSEQ(x)' is derived for 'x' equal to the number of positions. The car chosen for any position is obviously the best car for that position. (7) if BESTCAR(x,pos(y)) then EqUAL(carat(pos(y)),x); Since 'BESTCAR' is a selection predicate over the domain of available cars, we define it using domain induction with 'AVAIL' as the base predicate and 'BETTERCAR" as the ordering predicate. (8
if BESTCARX(x,pos(y),z) ft EQUAL(psncars.z) then BESTCAR(x,pos(y)); (9) if N0G00DCARX(pos(y),z) ft EQUAL(psncars.z) then -BESTCAR(x,pos(y)); (10) if AVAIL(c(l),pos(y)) then BESTCARX(c(1),pos(y).1); (11) if -AVAIL(c(l),pos(y)) then N0G00DCARX(pos(y),1); (12) if BESTCARX(x,pos(y),z) ft AVAILG(z,zpl,pos(y)) ft ft BETTERCAR(zpl,x,pos(y)) then BESTCARX(zpl,pos(y),z+l); (13) if BESTCARX(x,pos(y),z) ft AVAILG(z,zpl,pos(y)) ft
Job-Shop Scheduling
Using Automated
Reasoning
645
ft -BETTERCAR(zpl,x,pos(y)) t h e n BESTCARX(x,pos(y),z+l); (14) i f BESTCARX(x,pos(y),z) ft UNAVAILG(z,zpl,pos(y)) t h e n BESTCARX(x,pos(y),z+l); (15) i f NOGOODCARX(pos(y),z) ft AVAILG(z,zpl,pos(y)) t h e n BESTCARX(zpl,pos(y),z+l); (16) i f NOGOODCARX(pos(y),z) ft UNAVAILG(z,zpl,pos(y)) t h e n NOGOODCARX(pos(y),z+l); (17) i f AVAIL(c(z),x) t h e n A V A I L G ( z - l , c ( z ) , x ) ; (18) i f -AVAIL(c(z),x) t h e n UNAVAILG(z-l,c(z),x); We are now obligated to ensure that 'AVAIL' is unit-defined and 'BETT E R C A R ' unit-computable over the enumeration of cars at every position. Fur thermore, since we did not protect any of the clauses containing 'AVAIL' by affixing them with the '-INITIAL' literal, we must ensure that the unit clauses containing 'AVAIL" are supported. At the first position in the sequence, all cars in the schedule are available. (19) i f INITIAL t h e n AVAIL(c(l) , p o s ( D ) ; (20) i f A V A I L ( c ( z ) , p o s ( l ) ) ft $ L T ( z , p s n c a r s ) then AVAIL(c(z+l),pos(l)); Beyond the first position, a car is available if and only if it was available for the preceding position but not selected for that position. (21) i f AVAIL(x,pos(z)) ft E Q U A L ( c a r a t ( p o s ( z ) ) , y ) ft $NE(x,y) t h e n AVAIL(x,pos(z+l)); (22) i f AVAIL(x,pos(z)) ft E Q U A L ( c a r a t ( p o s ( z ) ) , x ) then -AVAIL(x,pos(z+D); (23) i f -AVAIL(x,pos(z)) ft $ L T ( z , p s n p o s s ) then -AVAIL(x,pos(z+l)); It is easy to see that these axioms make 'AVAIL' unit-defined for any given position. Every car in the enumeration is unavailable at the preceding position (in which case it is unavailable at the new position), available and used (in which case it is also unavailable at the new position), or available and unused (in which case it is available at the new position). Note t h a t we could not use 'EQUAL' negatively in the first axiom. The alternatively formulated clause i f AVAIL(x,pos(z)) ft - E Q U A L ( c a r a t ( p o s ( z ) ) , x ) t h e n AVAIL(x,pos(z+l)); would never be triggered because 'EQUAL' is never generated negatively. In order to be able to use a negative literal in an antecedent this way, it is necessary to ensure that either (1) the literal's predicate is unit-defined, or (2) the literal's predicate is unit-computable and all variables used in the literal are also used in positive literals or literals with unit-defined predicates (see Note 5 in Appendix B). (The equality predicate is derived only positively, so it is not unit-defined,
Collected Works of Larry Wos
646
and it is not evaluated using built-in functions, so it is not unit-computable.) Thus, we use the trick of converting -EqUAL(f(x),y) to EQUAL(f(x),z) ft $NE(y,z) which is equivalent but uses only positive literals. It is tempting to use $NE(f(x),y) but if 'x' becomes ground, this literal will be false for all constant values of 'x' and 'y" unless a demodulator for ' / ( x ) " has already been generated. This will quickly lead to incorrect results as the reasoning program will decide early in the game that all cars are available at all positions even though we know this is not the case (see Note 6 in Appendix B). Next we must give axioms for the ordering predicate ' B E T T E R C A R ' . Ear lier, we stated that a car is better if it has a smaller penalty or better if it has an equal penalty and a larger difficulty. We shall use this definition for ' B E T T E R CAR'. If we define ' B E T T E R C A R ' in the obvious way, however, the reasoning program will derive a unit clause for each possible pair of cars at each position. To avoid such an occurrence, we protect each defining clause for ' B E T T E R C A R ' with the special predicate 'ISWORTHATRY' by adding the corresponding neg ative literal. An 'ISWORTHATRY' clause will be generated for two cars only if it can be determined t h a t we actually need to compare them. (24) BETTERCAR(x,x,pos(y)); (25) i f ISW0RTHATRY(fbettercax(xl,x2,pos(y))) ft ft CPENALTY(xl,pos(y),wl) ft CPENALTY(x2,pos(y),w2) ft ft $LT(wl,w2) t h e n BETTERCAR(xl,x2,pos(y)); (26) i f ISW0RTHATRY(fbettercar(xl,x2,pos(y))) ft ft CPENALTY(xl,pos(y),w) ft CPENALTY(x2,pos(y),w) ft ft CDIFF(xl.wl) ft CDIFF(x2,w2) ft $GE(wl,w2) then BETTERCAR(xl,x2,pos(y)); (27) i f ISW0RTHATRY(fbettercar(xl,x2,pos(y))) ft ft CPENALTY(xl,pos(y),wl) ft CPENALTY(x2,pos(y),w2) ft ft $GT(wl,w2) t h e n -BETTERCAR(xl,x2,pos(y)); (28) i f ISW0RTHATRY(fbettercar(xl,x2,pos(y))) ft & CPENALTY(xl,pos(y),w) ft CPENALTY(x2,pos(y),w) ft ft CDIFF(xl.wl) ft CDIFF(x2,w2) ft $LT(wl,w2) t h e n -BETTERCAR(xl,x2,pos(y)); Note that a car is always better than itself, for the ordering is inclusive. The axiom for 'ISWORTHATRY' is derived from the earlier axioms concerning 'BETTERCAR'.
Job-Shop Scheduling
Using Automated
Reasoning
647
(29) i f BESTCARX(x,pos(y),z) ft AVAILG(z,zpl,pos(y)) t h e n ISWORTHATRY(fbettercar(zpl,x,pos(y))); With the given axioms, ' B E T T E R C A R ' is not unit-computable. However, it will still work as an ordering predicate because we shall always have it when it is needed to drive one of the 'BESTCAR' domain induction axioms. To complete the picture, we must define 'CPENALTY' and 'CDIFF'. We shall start with 'CDIFF', which is the most straightforward. The difficulty of placing a car is the sum of the difficulty values assigned to its attributes. Since the summation function is a reduction function, we use finite differencing across the enumeration of the base predicate. The fi nite difference function is simple addition, and the base predicate in this case is ' P S A T T R ( x , y ) \ which is satisfied only if 'y' is an attribute of car V . The default value is 0. To define ' C D I F F ' we use the following axioms. (30) i f AVAIL(x,pos(D) t h e n CDIFFX(x,0,0); (31) i f CDIFFX(x,y,z) & ATTRG(z.w) & PSATTR(x.w) t h e n CDIFFX(x,y+psadiff(w),z+l); (32) i f CDIFFX(x,y,z) & ATTRG(z,w) & -PSATTR(x,w) t h e n CDIFFX(x,y,z+l); (33) i f CDIFFX(x,y,z) ft EQUAL(psnattrs.z) t h e n CDIFF(x.y); (34) i f INITIAL & EQUAL(a(z),w) t h e n ATTRG(z-l,w); Note that there will be a positive 'CDIFF' unit clause for every available car. Note also that the first clause contains no 'INITIAL' literal because support is obtained from 'AVAIL'. The heart of the entire model is the 'CPENALTY' predicate. The penalty for a given car in a given position is the sum of the penalties for all its attributes. The definition precisely parallels the one for ' C D I F F ' . (35) i f AVAIL(x,pos(y)) t h e n CPENALTYX(x,pos(y),0,0); (36) i f CPENALTYX(x,pos(y),v,z) & ATTRG(z.w) ft PSATTR(x,w) ft APENALTY(w,pos(y),v2) t h e n CPENALTYX(x,pos(y),v+v2,z+l); (37) i f CPENALTYX(x,pos(y),v,z) ft ATTRG(z,w) ft -PSATTR(x.w) t h e n CPENALTYX(x,pos(y),v,z+l); (38) i f CPENALTYX(x,pos(y),v,z) & EQUAL(psnattrs.z) t h e n CPENALTY(x,pos(y),v); The definition of 'CPENALTY' depends on 'APENALTY', which is used to determine the penalty at this position for a given attribute. This penalty is com puted based on attribute counts over the intervals of relevance and proximity. It is possible to define 'APENALTY' entirely using resolution. However, because APENALTY has a simple algorithmic definition without loops, we shall use a demodulation program instead.
648
Collected Works of Larry Wos
(39) i f E q U A L ( p s i r e l ( y ) , y i ) ft A C O U N T ( p o s ( x ) , l e n ( y i ) , y , w i ) ft ft EQUAL(psiprx(y),yp) ft ACOUNT(pos(x),len(yp),y,vp) t h e n APENALTY(y,pos(x),fapenalty(y,wi,wp)); (40) E Q U A L ( f a p e n a l t y ( y , w i , w p ) , c p l u s ( p s p v a l ( y , u i ) , cselect(wp,psxfac(y)))); (41) E Q U A L ( c p l u s ( 0 , x ) , 0 ) ; (42) E Q U A L ( c p l u s ( x , y ) , ( x + y ) ) ; (43) E Q U A L ( c s e l e c t ( 0 , x ) , 0 ) ; (44) E Q U A L ( c s e l e c t ( x , y ) , y ) ; Note that demodulation can be used as a highly sophisticated programming language (as discussed more fully in [Winker82]), although one with extremely clumsy syntax. Finally, we must define 'ACOUNT', which is the defining predicate of a reduction function. We define it using finite differencing. To begin with, we derive the counts for the null interval at position 1 and for all intervals of length 1 at all positions. This requires three axioms. (45) if INITIAL then AC0UNT(pos(l),len(0),y,0); (46) if EQUAL(carat(pos(x)),v) ft PSATTR(v.y) then ACOUNT(pos(x+l),len(l),y,1); (47) if EQUAL(carat(pos(x)),v) ft -PSATTR(v.y) then ACOUNT(pos(x+l),len(l),y,0); The finite difference for ACOUNT is addition by 1. In this case, induction is on the length. (48) i f ACOUNT(pos(x),len(z),y,w) ft BEFOREHAS(pos(x),len(z),y) ft E Q U A L ( p s i r e l ( y ) . z a ) ft $ L T ( z , z a ) then ACOUNT(pos(x),len(z+l),y,w+l); (49) i f ACOUNT(pos(x),len(z),y,w) ft -BEF0REHAS(pos(x),len(z),y ft E Q U A L ( p s i r e l ( y ) , z a ) ft $ L T ( z , z a ) then ACOUNT(pos(x),len(z+l),y,w); The given clauses use the predicate 'BEFOREHAS' to determine if the car immediately preceding the start of an interval has a given attribute. There are two reasons we could not use the logically equivalent expression PSATTR(carat(x-z-l),y) First, use of the expression requires demodulation in an antecedent literal. Sec ond, we wish 'beforeHAS' to be false for all cars before the start of the sequence, and the 'PSATTR' predicate is undefined for those cars. We provide an inductive definition of 'BEFOREHAS' using the following axioms. (50) i f INITIAL t h e n -BEFOREHAS(pos(1),len(0),y); (51) i f -BEFOREHAS(pos(l),len(x),y) ft EQUAL(psirel(y),xa) ft
Job-Shop Scheduling Using Automated Reasoning
649
ft $LT(x,xa) then -BEFOREHAS(pos(l),len(x+l),y); (52) if EQUAL(carat(pos(x)),v) ft PSATTR(v,y) then BEFOREHAS(pos(x+l),len(0),y); (53) if EQUAL(carat(pos(x)),v) ft -PSATTR(v.y) then -BEFOREHAS(pos(x+l),len(0),y); (54) if BEFOREHAS(pos(x),len(z),y) ft $LT(x,psnposs) ft ft EQUAL(psirel(y),za) ft $LT(z,za) then BEFOREHAS(pos(x+l),len(z+l),y); (55) if -BEFOREHAS(pos(x),len(z),y) ft $LT(x,psnposs) ft ft EQUAL(psirel(y),za) ft $LT(z,za) then -BEFOREHAS(pos(x+l),len(z+l),y); This completes our model of the car-sequencing problem. The model just completed works; however, it is exceedingly slow: when the example problem was run with this model, more than 35 minutes of CPU time on a VAX 11/780 was required to solve the problem. In the next section, we discuss how to reduce the required time. 3.4
IMPROVING THE PERFORMANCE OF THE INITIAL MODEL Four approaches exist for improving the performance of an ITP model.
(1) Develop a search strategy to reduce the number of clauses that are gen erated. (2) Change the processing options. (3) Use demodulation instead of resolution-based rules for computations. (4) Modify the model to reduce the number of required inferences. Many extraneous clauses produced with the model are clauses involving neg ative versions of the 'CDIFF' and 'CPENALTY' literals derived by backward reasoning. An appropriate weight template and weight threshold can be used to eliminate these occurrences. By assigning an exceedingly large weight to neg ative 'CDIFF' and 'CPENALTY' literals, the chosen template and threshold will result in the deletion of clauses derived with that weight. Use of the weight template results in the deletion of more than half of the generated clauses. A better approach would be to avoid generating the undesirable clauses. This can be done by increasing the restrictions on UR-resolution so that the resulting unit always comes from the last literal in the nucleus clause. This would not only reduce the number of generated clauses, but it would then be possible to improve the inference algorithm itself. This particular enhancement to UR-resolution is supported in the next release of ITP. A third approach would be to use confidence factors to simulate nega tion, and use hyperresolution instead of UR-resolution. For example, wherever 'AVAIL(a;, y)' occurs we would replace it by 'AVAIL(x, y,l)' and wherever 'AVAIL(x, y)" occurs we would replace it by 'AVAIL(:c, y,-l)". A similar opera-
Collected Works of Larry Wos
650
tion would be performed on every predicate that occurs negatively in the rules. It is worth noting that production-rule resolution of the type described in the preceding paragraph is complete only for clause sets that retain their unsatisfiability under such a transformation. Indeed, the restrictions on unit-defined and unit-computable predicates are designed to ensure that the unsatisfiability is preserved. When the global approach has been appropriately improved, the next step is to examine the processing options. The sample run with this model shows that backward subsumption almost never succeeds. Thus, this option was turned off. In addition, more than half of the attempted unifications fail. This results from the heavy use of nested functions. So the FPA level was increased to 3. This action ensures that the indices searched to find unifiable literals have access to information that is more deeply nested. The remaining possible improvements, use of demodulation and optimization of inferences, will require changes to the model itself. Since the number of cars presents obvious problems, the greatest gain from demodulation would be obtained by using demodulation for 'CDIFF' and 'CPENALTY'. To do so, however, requires a major change: because the attributes of a car are specified by a predicate and not a function, the demodulation programs for 'CDIFF' and 'CPENALTY' have no way of accessing attribute information. One way to make that information accessible would be to replace 'PSATTR' with a function that assigns a 1 or a 0 to every car-attribute pair. Such a change is perhaps too significant for the model. Instead, we shall add the following two clauses to define the desired function. (56) if INITIAL & PSATTR(x,y) then EQUAL(fattr(x.y),1); (57) if INITIAL & \(noPSATTR(x,y) then EQUAL(fattr(x.y),0); Given the 'fattr' function, we can employ a demodulation program for 'CD IFF'. The following clauses will then replace clauses (30) through (33). (58) EqUAL(fcdiff(x,0),0); (59) EqUAL(fcdiff(x,z), (cselect(fattr(x,a(z)).psadiff(a(z))) + fcdiff(x.z-l))); (60) if AVAIL(x,pos(D) then CDIFF(x,fcdiff(x.psnattrs));
To derive the corresponding program for 'CPENALTY', we need a function for 'APENALTY', which is provided by the following clause. (61) if APENALTY(x.y.z) then EQUAL(fapenalty(x,y),z); The demodulation program for 'CPENALTY' replaces clauses (35) through (38) with clauses (62) through (64). (62) EQUAL(fcp«naltyx(x,y,0),0); (63) EQUAL(fcpenaltyx(x,y,z), ( c s e l e c t ( f a t t r ( x , a ( z ) ) , fapenalty(a(z),y)) + fcpenaltyx(x,y,z-l)));
Job-Shop Scheduling
Using Automated
Reasoning
651
(64) i f AVAIL(x,pos(y)) t h e n CPENALTY(x,pos(y), fcpenaltyx(x,pos(y).psnattrs)); Note that since clauses (30) through (33) and (35) through (38) were the only ones using the predicate 'ATTRG', we can also delete clause (34) at this point. Next to 'CPENALTY' and 'CDIFF', the most expensive predicates to com pute are 'ACOUNT" and 'BEFOREHAS", primarily because of the fact that a clause must be generated at each position for each attribute and every length less than the attribute's interval of relevance. The following demodulation program for 'ACOUNT' replaces clauses (45) through (55). (65) E Q U A L ( f a c o u n t ( p o s ( l ) , l e n ( x ) , y ) , 0 ) ; (66) E Q U A L ( f a c o u n t ( p o s ( x ) , l e n ( 0 ) , y ) , 0 ) ; (67) E Q U A L ( f a c o u n t ( p o s ( x ) , l e n ( z ) , y ) , ( f a t t r ( c a r a t ( p o s ( x - l ) ) , y ) + facount(pos(x-l).len(z-l),y))); (68) i f INITIAL t h e A C 0 U N T ( p o s ( l ) , l e n ( x ) , y , 0 ) ; (69) i f BESTCAR(w,pos(x)) t h e n ISW0RTHATRY(facounts (pos(x+l))); (70) i f ISWORTHATRY(facounts(pos(x))) ft EQUAL(psirel(y),z) then AC0UNT(pos(x),len(z),y,facount(pos(x),len(z),y)); The remaining technique is to attempt to reduce the number of inferences re quired to select a car. The following two techniques have already been employed in the existing model for just this purpose. (1) The IS WORTH ATRY predicate was employed to avoid evaluating the relative merits of cars that do not need to be compared. (2) The built-in inequality predicates were used to block computations of values that are not meaningful. A third technique exists—that of specifying redundant clauses containing computational shortcuts. For example, since the penalty for every car at po sition 1 is 0, we could add a clause to that effect and thus avoid any penalty computations for position 1. The following clauses replace clauses (64) and (39) and achieve the desired reduction in penalty computation. (71) i f E Q U A L ( p s i r e l ( y ) , y i ) ft A C 0 U N T ( p o s ( x ) , l e n ( y i ) . y . w i ) ft ft EQUAL(psiprx(y),yp) & ACOUNT(pos(x),len(yp),y,wp) ft & $NE(x,l) t h e n APENALTY(y,pos(x),fapenalty(y,wi,wp)); (72) i f AVAIL(x,pos(y)) ft $NE(y,l) t h e n CPENALTY(x,pos(y), fcpenaltyx(x,pos(y).psnattrs)); (73) i f INITIAL t h e n CPENALTY(x,pos(1),0); It would be very easy to use the ISWORTHATRY technique to avoid the computation of a car's difficulty unless it were needed to break a tie. However, at the first position all the cars have a penalty of 0, so the difficulty has to be
Collected Works of Larry Wos
652
computed for every car anyway. A similar problem exists for penalties: every available car at a position must be checked against the best preceding car, so every available car must have a penalty computed for it. The number of penalties computed could be reduced if we had some way of reducing the number of cars examined on each pass. For example, rather than searching for the car with the largest difficulty, we could ask only for a sufficiently large difficulty. This would enable us to stop as soon as a car with that difficulty level and a zero penalty was found. The following axioms, which replace (29) and (71), accomplish this. (74) if BESTCARX(x,pos(y),z) ft CPENALTY(x,pos(y),0) ft ft CDIFF(x.w) ft $GT(w,pssdiff) then BESTCAR(x,pos(y)); (75) if BESTCARX(x,pos(y),z) ft AVAILG(z,zpl,pos(y)) ft ft CPENALTY(x,pos(y),w) ft $NE(w,0) then ISWORTHATRY(fbettercar(zpl,x,pos(y))); (76) if BESTCARX(x,pos(y),z) ft AVAILG(z,zpl,pos(y)) ft ft CDIFF(x.w) ft $LT(w,pssdiff) then ISWQRTHATRY(fbettercar(zpl,x,pos(y)));
(77) if AVAIL(c(l),pos(y)) then ISWORTHATRY(fcpenalty(c(l), pos(y))); (78) if N0G00DCARX(pos(y),z) ft AVAILG(z,zpl.pos(y)) then ISWORTHATRY(fcpenalty(zpl,pos(y))); (79) if ISWORTHATRY(fbettercar(zpl,x,pos(y))) then ISWORTHATRY(fcpenalty(zpl,pos(y))); (80) if ISWORTHATRY(fcpenalty(x,pos(y))) ft AVAIL(x,pos(y)) ft ft $NE(y,l) then CPENALTY(x,pos(y),fcpenaltyx(x,pos(y), psnattrs)); These clauses require the following problem-specific demodulator to define 'pssdiff'. PS91)
EqUAL(pssdiff,20);
When all these changes are combined, the resulting model takes 11 minutes of CPU time on a VAX 11/780 to do the sample problem. In the next section, we discuss the steps remaining to convert this model to a production expert system.
4 4.1
Summary and Conclusions FUTURE DIRECTIONS
Currently, the model is still too slow to do any serious research. The run statistics show, however, that the speed can be reduced by as much as 1/3 by using an inference rule that prohibits backward reasoning—using a rule that ensures that
Job-Shop Scheduling
Using Automated
Reasoning
653
the resolvent is descended from the last literal of the nucleus. Such a rule will be available in the next release of ITP, as mentioned earlier. Arrangements are being made to run the model under this release as well as to run it on a faster machine. Once a speedup is accomplished, the next step is to run experiments with the model to determine if more effective heuristics exist. As an aid, a small program will be written to find the optimal sequence for a short schedule. The program will be used to find the optimal sequence for several sample schedules, and the results will be compared to the results of the model. If the model's results compare poorly to those obtained with the brute-force program, it will indicate the need for enhancements to the heuristics. In particular, different variations of the attribute difficulty factors will be tried. Finally, once a good set of heuristics is derived, the entire model should be transferred to a high-speed automated reasoning tool such as Prolog. This would provide a middle ground between the very slow but very flexible I T P model and a very fast but very inflexible algorithmic model. Because of its speed, the Prolog model can be run for much longer sequences of cars to get a more realistic appraisal of its effectiveness. If the model continues to perform well on long sequences, it can be put into production. In the next section, we discuss the suitability of I T P as an expert systems development tool. The discussion is based on the experience with this study.
4.2
USING ITP AS A TOOL FOR DEVELOPING EXPERT SYSTEMS
A major goal of this project was to determine the suitability of I T P as a tool for developing expert systems. At this time, most available expert systems use fairly simple production rules or frames, both expressed in terms of functions and predicates defined over objects in the problem domain. The car-sequencing problem differs from such systems in that it relies heavily on functions and predicates evaluated over s e t s of objects in the domain rather than individual objects. Thus, it uses a second-order, rather than a first-order, knowledge base. None of the tools considered handle second-order knowledge bases comfortably. The use of I T P led to the development of a highly computation-intensive solution to this problem, and that in turn made inference speed the primary consideration in the practicality of the model. For this reason, I T P as currently developed is not suitable as a medium for a production version of this expert system. This does not, however, imply that the same would be true for a more standard, first-order problem. Viewed from the development perspective, on the other hand, ITP turns out to be quite useful in experimenting with different approaches to the problem. The original intent behind I T P (and its predecessor, AURA) was to make it an automated reasoning assistant—a program that could produce enough of a partial solution to make a complete solution easier to see. It is therefore not
654
Collected Works of Larry
Wos
surprising that in that environment it performs well. T h e superiority of I T P for the car-sequencing problem will be proved the first time it is used t o develop a new heuristic for car selection. T h a t time has not yet come; however, there is no reason to believe t h a t it is far off. Appendix A: Model Listing The final model contains the following clauses. AXIOMS: if INITIAL then P0SG(0,pos(D) ; \ if INITIAL ft P0SG(z,pos(x)) ft $LT(x,psnposs) then POSG(x,pos(x+D); if BESTCAR(x,pos(l)) then GOODSEQ(l); if GOODSEQ(z) ft POSG(z.y) ft BESTCAR(x.y) then G00DSEQ(z+l); if EQUAL(psnposs.x) ft GOODSEQ(x) then FINISHED; -FINISHED; if BESTCAR(x,pos(y)) then EQUALCcaratCposCy)),x); if BESTCARX(x,pos(y),z) ft EQUALCpsncars.z) then BESTCAR(x,pos(y)); if N0G00DCARX(po3(y),z) ft EQUAL(psncars.z) then (noBESTCAR(x,pos(y)); if AVAIL(c(l),poa(y)) then BESTCARX(c(l),pos(y),1); if -AVAIL(c(l),pos(y)) then NQG00DCARX(pos(y),1); if BESTCARX(x,pos(y),z)ftAVAILG(z,zpl,pos(y)) ft BETTERCAR(zpl,x,pos(y)) then BESTCARX(zpl,pos(y),(z+l)); if BESTCARX(x,pos(y).z) ft AVAILG(z,zpl,pos(y)) ft -BETTERCAR(zpl,x,pos(y)) then BESTCARX(x,pos(y),(z+l)); if BESTCARX(x.pos(y),z) ft -AVAILG(z,zpl,pos(y)) then BESTCARX(x,pos(y),(z+D); if N0G00DCARX(pos(y),z) ft AVAILG(z,zpl,pos(y)) then BESTCARX(zpl,pos(y),(z+l)); if N0G00DCARX(pos(y).z) ft -AVAILG(z,zpl,pos(y)) then N0G00DCARX(pos(y),(z+l)); if AVAIL(c(z),x) then AVAILG((z-l),c(z),x); if -AVAIL(c(z),x) then -AVAILGCCz-1),cCz),x); if INITIAL then AVAIL(c(l),pos(l)); if AVAIL(c(z),pos(l)) ft $LT(z,psncars) then AVAIL(c(z+l) ,pos(D) ; if AVAIL(x,pos(z)) ft BESTCAR(y,pos(z)) ft $NE(x,y) then AVAIL(x.pos(z+1)); if AVAIL(x,pos(z)) ft BESTCAR(x,pos(z)) then -AVAIL(x,pos(z+D); if -AVAIL(x,pos(z)) ft $LT(z,psnposs) then -AVAIL(x,pos(z+D); BETTERCAR(x,x,po3(y)); if ISW0RTHATRY(fbettercar(xl,x2,pos(y))) ft CPENALTYCxl,pos(y),wl) ft ft CPENALTY(x2,pos(y),w2) ft $LT(wl,v2) then BETTERCAR(xl,x2,pos(y)); if ISW0RTHATRY(fbettercar(xl,x2.pos(y))) ft CPENALTYCxl,pos(y),w) ft ft CPENALTY(x2,pos(y),w) ft cdiff(xl,tfl)ftCDIFF(x2,u2) ft $GE(ul,w2) then BETTERCAR(xl,x2,pos(y)); if ISW0RTHATRY(fbettercar(xl.x2,pos(y))) ft CPENALTYCxl,pos(y),wl) ft
Job-Shop
Scheduling
Using Automated
Reasoning
655
ft CPENALTY(x2,pos(y),v2) ft $GT(wl,v2) t h e n -BETTERCAR(xl,x2,pos(y)); i f ISW0RTHATRY(fbettercar(xl,x2,pos(y))) ft CPENALTY(xl,pos(y),w) ft ft CPENALTY(x2,pos(y),v) ft c d i f f ( x l . u l ) ft CDIFF(x2,w2) ft $LT(wl,w2) then -BETTERCAR(xl,x2,pos(y)); if INITIAL ft PSATTR(x.y) then EQUAL(fattr(x.y) ,1); if INITIAL ft -PSATTR(x.y) then EQUAL(fattr(x,y) ,0); if AVAIL(x,pos(D) then CDIFF(x,fcdiff (x.psnattrs)); if APENALTY(x,y,z) then EQUAL(fapenalty(x,y),z); if EQUAL(psireKy).yi) ft AC0UNT(pos(x) ,len(yi) ,y,wi) ft ft EqUAL(psiprx(y),yp) ft ft ACOUNT(pos(x),len(yp))y,wp) ft $NE(x,l) then APENALTY(y,pos(x),fapncalc(y,wi,wp)); if INITIAL then AC0UNT(pos(l),len(x),y,0); if BESTCAR(w,pos(x)) then ISWORTHATRYCf acounts(pos(x+D)) ; if ISWORTHATRY(facounts(pos(x))) ft EQUAL(psirel(y),z) then ACOUNT(posCx),len(z),y,facount(pos(x),len(z),y)); if ISWORTHATRYCfacounts(pos(x))) ft EQUAL(psiprx(y),z) then ACOUNT(pos(x),len(z),y,facount(pos(x),len(z),y)); if INITIAL then CPENALTY(x,pos(l),0); if BESTCARX(x,pos(y),z) ft CPENALTY(x,pos(y),0) ft CDIFF(x,w) ft ft $GE(w,psdiff) then BESTCAR(x,pos(y)); i f BESTCARX(x,pos(y),z) ft AVAILG(z,zpl,pos(y)) ft CPENALTY(x,pos(y),w) ft $NE(w,0) then ISWORTHATRY(fbettercar(zpl,x,pos(y))); i f BESTCARX(x.pos(y),z) ft AVAILG(z,zpl,pos(y)) ft CDIFF(x.w) ft ft $LT(w,psdiff) then ISWORTHATRY(fbettercar(zpl,x,pos(y))); i f A V A I L ( c ( l ) , p o s ( y ) ) then ISWORTHATRYCf c p e n a l t y ( c U ) , p o s ( y ) ) ) ; i f N0G00DCARX(pos(y).z) ft AVAILG(z,zpl,pos(y)) then ISWORTHATRY(fcpenalty(zpl,pos(y))); i f ISWORTHATRY(fbettercar(zpl,x,pos(y))) t h e n ISWORTHATRY(fcpenalty(zpl,pos(y))); i f ISWORTHATRY(fcpenalty(x,pos(y))) ft AVAIL(x,poa(y)) ft $NE(y,l) t h e n CPENALTY(x,pos(y),fcpenaltyx(x,pos(y).psnattrs)); SET OF SUPPORT: INITIAL;
DEMODULATORS: EQUAL(fapncalc(y,wi,wp), cplus(pspval(y,wi),cselect(wp,psxfac(y)))); EQUAL(cplus(0,x),0); EQUAL(cplus(x,y),(x+y)); EQUAL(cselect(0,x),0);
Collected
656
Works of Larry Wos
EQUAL(cselect(x,y),y); EQUAL(fcdiff(x,0),0); EQUAUfcdiff ( x , z ) , ( c s e l e c t ( f a t t r ( x , a ( z ) ) , p s a d i f f ( a ( z ) ) ) + f c d i f f ( x , ( z - l ) ) ) ; EQUAL(fcpenaltyx(x,y,0),0); EQUAL(fcpenaltyx(x,y,z), ( c s e l e c t ( f a t t r ( x , a ( z ) ) , f a p e n a l t y ( a ( z ) , y ) ) + + fcpenaltyx(x,y,(z-l)))); EQUAL(facount(pos(l),len(x),y),0); EQUAL(facount(pos(x),len(0),y),0); EQUAL(facount(pos(x),len(z),y), (fattr(carat(pos(x-l)),y)+ + facount(pos(x-l) .len(z-l) ,y))) ; EQUAL((0+x),x); EQUAL((x+0),x); In the given formulation, the demodulators must also be made available as axioms. (In ITP, this requires reading them in twice.) To run the sample problem, we add the following axioms to define the list of cars with their required options (attributes). PSATTR(c(l),, roofvinyl); PSATTR(c(l),.powrwindw); -PSATTR(c(i:l.air); -PSATTR(c(i:),roofsun); -PSATTR(c(i;I.cruisctl); -PSATTR(c(2:),roofvinyl); -PSATTR(c(2:) .powrwindw); PSATTR(c(2)!.air); -PSATTR(c(2:1,roofsun); -PSATTR(c(2]).cruisctl); PSATTR(c(3);,roofvinyl); PSATTR(c(3);,powrwindw); PSATTR(c<3);,air); -PSATTR(c(3:),roofsun); PSATTR(c(3) .cruisctl); PSATTR(c(4) ,roofvinyl); -PSATTR(c(4]).powrwindw); PSATTR(c(4);,air); PSATTR(c(4) .roofsun); -PSATTR(c(4:).cruisctl); -PSATTR(c(5]).roofvinyl); PSATTR(c(5) ,powrwindw); PSATTR(c(5) .air); -PSATTR(c(5:).roofsun); PSATTR(c(5) .cruisctl);
Job-Shop Scheduling Using Automated Reasoning
657
W e must also add the following equality clauses as demodulators and axioms to describe the parameters of the problem.
EQUAL(a(l),roofvinyl); EQUAL(a(2).powrwindw); EQUAL(a(3),air); EQUAL(a(4),roofsun); EQUAL(a(5).cruisctl); EQUAL(psncars,5); EQUAL(psnattrs,5); EQUAL(psirel(roofvinyl),8); EQUAL(pspval(roofvinyl,0),0) EQUAL(pspval(roofvinyl,1),0) EqUAL(pspval(roofvinyl,2),1) EQUAL(pspval(roofvinyl,3),2) EQUAL(pspval(roofvinyl,4),3) EQUAL(pspval(roofvinyl,5),4) EQUAL(pspval(roofvinyl,6),5) EQUAL(pspval(roofvinyl,7),6) EQUAL(pspval(roofvinyl,8),7) EQUAL(psiprx(roofvinyl),4); EqUAL(psxfac(roofvinyl),4); EqUAL(psirel(powrwindw),2); EQUAL(pspval(powrwindw.O),0) EQUAL(pspval(powrwindw,1),1) EQUAL(pspval(powrwindw,2),6) EQUAL(psiprx(powrwindw), 1); EqUAL(psxfac(powrwindw),2); EQUAL(psirel(air),4); EQUAL(pspval(air,0),0); EQUAL(pspval(air,1),0); EqUAL(pspval(air,2),0); EqUAL(pspval(air,3),4); EQUAL(pspval(air,4),8); EQUAL(psiprx(air),1); EQUAL(psxfac(air),0); EQUAL(psirel(roofsun),9); EQUAL(pspval(roof sun,0),0); EqUAL(pspval(roofsun,1),4); EQUAL(pspval(roofsun,2),5); EqUAL(pspval(roofsun,3),6); EqUAL(pspval(roofsun,4),7); EQUAL(pspval(roofsun,5),8);
Collected Works of Larry Wos
658
EQUAL(pspval(roofsun,6),9); EQUAL(pspval(roofsun,7),10); EQUAL(pspval(roofsun,8),11); EQUAL(pspval(roofsun,9),12); EQUAL(psiprx(roofsun),2); EQUAL(psxfac(roofsun),9); EQUAL(psireKcruisctl) , 9 ) ; EQUAL(pspval(cruisctl,0),0); EQUAL(pspval(cruisctl,l),1) ; EQUAL(pspval(cruisctl,2),2); EQUAL(pspval(cruisctl,3),3); EQUAL(pspval(cruisctl,4),4); EQUAL(pspval(cruisctl,5),5); EQUAL(pspval(cruisctl,6),6); EqUAL(pspval(cruisctl,7),7); EqUAL(pspval(cruisctl,8),8); EqUAL(pspval(cruisctl,9),9) ; EqUAL(psiprx(cruisctl),2); EQUAL(psxfac(cruisctl),6); EQUAL(psadiff(roofvinyl),12); EQUAL(psaiff(powrwindw),4); EqUAL(psadiff(air),4); EQUAL(psadiff(roofsun),18); EQUAL(psadiff(cruisctl),15); EQUAL(psnposs,5); EQUAL(pssdiff,20); Appendix B: Explanatory Notes (1) The name 'leftward-sampling' refers to the fact that the car chosen for a given position is dependent solely on the cars chosen to the left of it. (2) It is worth pointing out that this flexibility is useful only because the selection mechanism can be changed on the fly. In OPS5, the order of selection of the productions is changed by changing the productions themselves, which requires a reload. (3) Clauses (3) and (4) can be obtained from the definition of maximum in the following way. i f P(x) & (Vy)(P(y) -> x >= y) then MP(x) - P ( x ) | - ( V y ) ( P ( y ) -> x >- y)|MP(x) - P ( x ) | ( E y ) \ ( n o ( P ( y ) -> x >- y)IMP(x) ( E y ) ( - P ( x ) | - ( P ( y ) -> x >- y)|MP(x)) - P ( x ) | - ( P ( f y ( x ) ) -> x >» f y ( x ) ) | M P ( x ) - P ( x ) | ( P ( f y ( x ) ) & - ( x >- f y ( x ) ) ) | M P ( x )
Job-Shop Scheduling Using Automated Reasoning
659
-P(x)IP(fy(x))lMP(x)) ft (-P(x)l-(x >- fy(x))|MP(x)) (4) Not demodulating antecedents (during the application of an inference rule) is a general problem with forward reasoning. In backward-reasoning sys tems, demodulation and built-in arithmetic computation occur in the antecedents but not in the consequents. This results not from any theoretical constraint, but from the order in which operations are traditionally performed. Demodulation and built-in arithmetic computation are normally performed only on the results of an inference step. In forward reasoning, the consequent is the result, and in backward reasoning the entire set of antecedents is the result. (5) In general, we are trying to ensure that, for literals with unit-computable predicates, the variables will be instantiated to ground terms so that the predi cate can be evaluated. This usually occurs if the variable is determined as defined in [Henschen, 1984]. In fact, it is the case that whenever a built-in predicate is used with UR-resolution, the variables must be determined. Thus, $NE is legal in the definition of AVAIL only because the first two literals determine 'x' and
V(6) In subsequent releases of ITP, the built-in predicates were changed so that they only evaluate when both terms are ground and simple.
Acknowledgements We wish to thank John D. Joyce and Robert P. Kromer of General Motors Research Laboratories for bringing the problem to our attention. This work was supported in part by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under contract W-31-109-Eng-38.
References [Clark84] Clark, K. L. and McCabe, F. G., Micro-PROLOG: Programming in Logic, Prentice-Hall (1984). [Clock81] Clocksin, W. F. and Mellish, C. S., Programming in Prolog, SpringerVerlag (1981). [Forgy81] Forgy, C. L., 0PS5 User's Manual, Carnegie-Mellon University Report CMU-CS-81-135 (July, 1981). [Hensch84] Henschen, L. and Naqvi, Shamim, 'On compiling queries in recursive first-order databases', JACM 33:1 (Jan, 1984). [Kowal79] Kowalski, R., Logic for Problem Solving, North-Holland (1979).
660
Collected Works of Larry Wos
[Lusk84] Lusk, E., and Overbeek, R., An LMA-Based Theorem-Prover, Argonne Technical Report #ANL-84-27 (April, 1984). [McChar76] McCharen, J., Overbeek, R., and Wos, L., 'Problems and exper iments for and with automated theorem-proving programs', IEEE Trans, on Comp. C-2 (1976). [Paige82] Paige, R. and Koenig, S., 'Finite differencing of domputable expres sions', em ACM TOPLAS 4:3 (July, 1982). [Reiter78] Reiter, R., 'Equality and domain closure for first-order data bases', JACM 27:2 (April, 1978). [Winker82] Winker, S. and Wos, L., 'Procedure implementation through demod ulation and related tricks', 6th Conference on Automated Deduction, Lecture Notes in Computer Science, Vol. 138, Springer-Verlag (1982). [Wos84] Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: Introduction and Applications, Prentice-Hall (1984). [WRC67] Wos, L., Robinson, J. A., and Carson, D., 'Efficiency and completeness of the set of support strategy in theorem proving', JACM 14 (1967).
Negative Paramodulation* L. Wos and W. McCune Mathematics and Computer Science Division Argonne National Laboratory Argonne, IL 60439-4844
Abstract In this paper, we introduce the inference rule negative paramodulation. This rule reasons from inequalities, in contrast to paramodulation which reasons from equalities. Negative paramodulation is recommended for use when certain con ditions are satisfied; here we give those conditions. We present experimental evidence that suggests the potential value of employing the closely related in ference rule negative hyperparamodvlation.
1
Introduction
The effectiveness of a computer program that reasons logically can be sharply increased by employing inference rules that "build in" semantics. An example of such a rule is paramodulation [2,5], a rule that generalizes the usual notion of equality substitution. Paramodulation applied to the equations x -\—x = 0 and y + (-y + z) = z yields in a single step y + 0 = — (—y). In clause form, from EQUAL(sum(x, minus(x)), 0) 'This work was supported by the Applied Mathematical Sciences subprogram of the office of Energy Research, U.S. Department of Energy, under contract W-31-109-Eng-38 Reprinted withh permission from the Proceedings of the Eighth International Conference on Automated Deduction, Vol. 230, Lecture Notes in Computer Science, ed. J. Siekmann, Springer-Verlag, New York, pp. 229-239 (July 1986).
Collected Works of Larry Wos
662
into EQU AL(sum(y, sum(minus(y), z)), z) the clause EQUAL{sum{y, 0),minus(minus(y))) is obtained by paramodulation. As the example shows, equality substitution itself is not sufficient to make the given deduction. Rather, an instantiation of variables is found that unifies the argument sum(x, minus(x)) with the term sum(minus(y), z) to then permit an obvious substitution of one term for another. Combining in a single step the unification process with the equality substitution process markedly improves the efficiency of an automated reasoning program. For various problem domains, paramodulation is the best suited rule of infer ence. For example, many problems from group theory and ring theory are easily solved with this inference rule. The rule does not, however, enable a reasoning program to make deductions of one obvious class. Specifically, although the use of paramodulation enables the program to take appropriate action when the term s is known to equal the term t, its use does not address the case in which it is known that s does not equal t. For example, what deduction is valid given the associative law, (xy)z = and the fact that the product of ab is not equal to the product ba?
x(yz),
EQUAL(prod(prod(x, y), z),prod(x, prod(y, z))) -EQUAL(prod(a,
b),prod{b, a))
The group theorist would correctly accept as a valid conclusion —EQUAL(prod(prod(x,a),b),prod(x,prod(b,
a)))
stating that (xa)b is not equal to x(ba) for all x. Such an algebraist would make this deduction in a single step and, if asked, give the justification that cancel lation holds. With the appropriate clauses and the inference rules currently in use, two steps would be required to make this deduction in contrast to the onestep deduction produced with negative paramodulation. If in addition it were known that, in the groups under consideration, the square of every element is the identity e, EQUAL(prod(u,u),e) our algebraist would have immediately concluded in a single but larger step that -EQUAL(b, prod(a, prod(b, a)))
Negative
Paramodtdation
663
without stopping to note that (xa)b is not equal to x(ba). To enable an automated reasoning program to make one-step deductions exemplified by the clause -EQUAL(prod(prod(x,
a), b),prod(x,prod(b,
a)))
negative paramodulation was formulated. So that one-step deductions exempli fied by the clause -EQUAL{b,
prod{a, prod(b, a)))
are possible, negative hyperparamodulation was formulated. (For those who wish history accurately recorded, negative hyperparamodulation was formulated first.) Since current evidence supports the position that negative hyperparamod ulation will prove more useful, we concentrate on experiments with that infer ence rule. In Section 2, we give the precise conditions under which the two inference rules are sound; a glance at the first paragraph of that section sum marizes the differences between positive and negative paramodulation. Although the two inference rules presented here give a reasoning program the capacity to draw conclusions that a person might draw, they were not for mulated to imitate a person's reasoning. Rather, they are intended to give an automated reasoning program the same kind of power as paramodulation does, but the power to reason from inequalities. The example of paramodulation cited earlier illustrates one of the differences between reasoning that imitates that of some person and reasoning that is tailored to a machine. A person would not ordinarily use (explicitly or implicitly) such an inference rule. Rules of this type are common in automated reasoning. They are not so common in a classical artificial intelligence approach. In the latter, the objective is to have a machine employ problem-solving techniques that closely imitate those a person might use. A simpler illustration of the difference between automated reasoning and classical artificial intelligence is provided by the possible use of instantiation. In various mathematical proofs, instantiation is used. For example, consider the theorem that states that, in a group, if the square of every element is the iden tity, the group is commutative. A typical first step in proving this theorem is that of deducing (yz)(yz) = e with the justification that uu = e. The variable u is simply instantiated to the product yz. Were one designing a program to find proofs in algebra, and were one taking a classical artificial intelligence approach, instantiation would get strong consideration as an inference rule. In the typi cal automated reasoning program, simply instantiating some clause to produce another is not available. Currently, no strategy is known for picking effective instantiations. The generality offered by the available inference rules seems far
Collected Works of Larry Wos
664
preferable when compared to deducing instances of clauses. The preceding remarks explain in part why we seek rules such as negative paramodulation. The nature of such rules, at least in their more complex use, does not reflect the type of reasoning that one would expect from a person. But they are well suited to a machine. An example similar to that used earlier for paramodulation again illustrates this point. Consider an array A of rational numbers in which numbers may occur more than once. Let its elements be denoted by c\, C2,.... Assume that C\ is such that no Cj has the property that Ci + Ci = c\. Negative paramodulation applied to the clauses -ELEMENT(x,arraya)
-
EQUAL(sum(x,x),d)
EQU AL(sum(y, sum(minus(y), z)), z) yields the clause -ELEMENT(minus(y),
arraya)EQUAL(sum(y,
cl), minus( y))
in one step. The soundness of this inference follows from the fact that the left cancellation law holds for the function sum.
2
Negative P a r a m o d u l a t i o n Defined
Negative paramodulation is similar to (positive) paramodulation with three ex ceptions. First, the literal justifying the term replacement (the from literal) is a negative equality rather than a positive equality literal. Second, the literal containing the term to be replaced (the into literal) must be a positive literal. Finally, the transformed into literal in the negative paramodulant is negated. Negative paramodulation is sound provided -that the into literal satisfies certain properties. Those properties are defined before the formal definition of negative paramodulation is presented.
2.1
Admissibility of "into" Terms
The ith argument position of an n-ary function / is admissible for negative paramodulation (hereafter abbreviated admissible) if the clause -EQUAL(f(xi,...,
Xi-i, Xi, xi+i,...,
xn), f(xx,...,
Xi_i, y, xi+i,...,
x n ))
665
Negative Paramoduiat/on EQUAL(xt,y)
is valid in the theory under consideration. Similarly, the ith argument position of an n-ary predicate P is admissible if the clause -P(x1,...,Xi_l,Xi,Xi+i,...)In)-P(li,...,I
)EQUAL{xt,y)
is valid in the theory under consideration. The ith argument of a term whose major function symbol is / (respectively, positive literal whose predicate is P) is admissible if the ith argument position of / (respectively, P) is admissible. Admissibility of the ith argument position of a function / can be viewed as one-to-oneness of all unary functions in the family of functions obtained by fixing all but the ith argument of / . Admissibility in a function can also be viewed as a generalized cancellation law. For example, the left argument of a binary function is admissible provided that the right cancellation law holds for that function. Admissibility in a pnxiicate can be viewed as a functional dependency. For example, the third argument of a ternary predicate is admissible provided that the third argument is a function of the first two arguments. For the predicate FATHER, where FATHER(x,y) means that x is the father of y, the first argument is a function of the second, but the second is not a function of the first. The position of an occurrence of a subterm in a literal can be identified by a position vector, which is a sequence of positive integers that gives the path from the root of the literal to the occurrence of the subterm. For example, the position of the term c in the literal P(a, x, g(f(b, c))) is given by the position vector (3,1,2), for c occurs in the third argument of P , the first argument of g, and the second argument of / . The position of an occurrence of a subterm in a literal is admissible if the literal is positive and the literal and all terms that contain the occurrence contain it in an admissible argument position of the corresponding function or predicate symbol. In the preceding example, the position of c is admissible provided that the following three clauses hold. -EQUAL(f(x,
y), f(x, z))EQUAL(y, z)
-EQUAL(g{y),
g{z))EQUAL(y, z)
-P{x, w, y) - P{x, w, z)EQUAL{y, z) Notice that both argument positions of the equality predicate are admissible. In particular, the clauses -EQUAL{x,y)
-
EQUAL(z,y)EQUAL{x,z)
Collected Works of Larry Wos
666 -EQUAL(y,
x) - EQUAL(y, z)EQUAL(x,
z)
are what is needed. They are obviously deducible from transitivity and symme try of EQUAL. In Section 1, the example of deducing —EQU AL(prod(prod(x, a), b), prod(x, prod(b, a))) from the clauses EQUAL(prod(prod(x, y), z),prod(x, prod(y, z))) -EQUAL(prod(a,
b), prod(b, a))
is sound because the second argument position of prod is admissible. The con clusion is obtained by unifying prod(a, b) with prod(y, z). To see that the admissibility property is required for soundness to be present, consider the following case. Let j be a function that is not one-to-one. There fore, the pair of clauses EQUAL(j(a),j(b)) and —EQUAL(a,b) is consistent. If negative paramodulation is applied to these two clauses, an unsound inference is yielded, namely, -EQUAL(j(b), j(b)).
2.2
The Formal Definition of Negative Paramodulation
We can now give the formal definition of negative paramodulation. We sim ply quote the definition of (positive) paramodulation, making the appropriate modifications. See Figure 1.
(A-K)
-EqUAL(r.s) J[t] (B-J) \ / \ / \ / \ / \ / \ -> / \ / \ / (A' - K') - J [ s ' ] )B' - J ' ) Figure 1. Negative Paramodulation
Negative Paramoduiation
667
Definition. An equality literal is a literal whose predicate is to be interpreted as "equal". The inference rule negative paramodulation yields the clause C from the clauses A and B (that are assumed to have no variables in common) when A contains a negative equality literal K and B contains a positive literal J that in turn contains a term t admissible in J that unifies with one of the arguments of K. Assume without loss of generality that the chosen negative equality literal K has the form -EQUAL(r,s) for terms r and s, and that the first argument is that which is being unified with the chosen term t in B. The clause C is obtained from A and B with the following procedure. First, find an MGU for the argument r and the term t. Second, apply the MGU to A and B, yielding A', B', K'', J', and t' as the respective correspondents of A, B, K, J, and t. Third, generate J" from J' by first replacing t' by s', where K' is of the form —EQUAL(r',s'), and then negating the literal. Finally, form the disjunction of J" and B' — J' (B' minus a single occurrence of J') and A' — K' (A' minus a single occurrence of K'). Clause A is called the from clause, clause B the into clause, term (the into term, and clause C a negative paramodulant.
2.3
The Soundness of Negative Paramodulation
This subsection contains an informal justification of the soundness of negative paramodulation. Given a negative paramodulation inference that produces a clause C from clause A into clause B, one can construct a binary resolution deduction of C from A, B, and the clauses that justify the admissibility of the into position in B. Consider the earlier example P(a,x,g(f(b,c))) in which the term c is in an admissible position. With the additional clause —EQUAL{c, d), one can deduce —P{a, x, g(f(b, d))) by negative paramodulation. To construct a binary resolution deduction of this negative paramodulant, first consider the following clauses which justify the admissibility of the position in which c occurs. (1) -EQUAL(f{x, (2)
y), f(x, z))EQUAL(y, z)
-EQUAL(g(y),g(z))EQUAL(y,z)
(3) -P(x, w, y) - P(x, w, z)EQUAL{y, z) Start with -EQUAL(c,d), resolve with clause (1), then resolve the result with clause (2), then resolve that result with clause (3) to obtain -P(x, y, g(f(u, c)) - P(x, y, g(f(u, d))). The desired clause follows by resolving with P(a,x,g(f(b,
c))).
We emphasize the point that it is the predicate and functions that contain the term being replaced that must have certain properties, and not the terms
Collected Works of Larry Wos
668
that are unified. We illustrate with an example from ring theory, in which both argument positions of sum are admissible, but neither argument position of prod is admissible. (Note that groups differ from rings in that the arguments of product are admissible.) Consider the clauses (1) EQUAL(prod(x, sum(y, z)), sum(prod(x, y),prod(x, z))) (2) -EQUAL(prod{a, (3)
0),0)
EQUAL(sum(x,Q),x)
where clause (2) is the denial of an elementary theorem. The negative paramodulation inference that produces —EQUAL(prod(a, svm(y, 0)), sum{prod{a, y), 0)) by unifying prod(a, 0) in clause (2) with prod(x,z) in clause (1) is sound even though prod does not have the admissibility property. (As an aside, notice that if clause (3) is present as a demodulator, then a contradiction is obtained in one step in the presence of reflexivity.)
3
Negative Hyperparamodulation
In order to easily introduce the inference rule "negative hyperparamodulation", we first discuss (positive) hyperparamodulation. We begin with an example taken from elementary group theory. The theorem of interest, so often quoted, says that if the square of every element is the identity e, then the group is commutative. In one presentation of this theorem to an automated reasoning program, the set of input clauses includes the following. (1) EQU AL(prod(prod(x, y), z),prod(x, prod(y, z))) (2)
EQUAL(prod(x,e),x)
(3)
EQUAL(prod(x,x),e)
(4)
EQUAL(prod(a,b),c)
If the version of (positive) hyperparamodulation under discussion in this paper is applied to clauses (1) through (4) considered simultaneously, the clause (5)
EQUAL(prod(c,b),a)
is deduced. Clause (5) is obtained by letting clause (1) be the nucleus and clauses (2), (3), and (4) be satellites, and applying (simultaneously) paramodulation three times. The term prod(x, y) of clause (1) is unified with the argument
Negative Para.modula.tion
669
prod(a, b) of clause (4); the term prod(y, z) of clause (1) is unified with the argu ment prod(x, x) of clause (3); and the term prod(a, e), which is the transform of the term prod(x, prod(y, z)) of (1), is unified with the argument prod(x, e) of (2). If the set of chosen terms from the nucleus contains some term s and a subterm t of s, then any unification involving t must be considered before any involving s Further, rather than unifying s with some argument r, hyperparamodulation requires attempting to unify s' with r, where s' is the term resulting from the paramodulations involving the subterms of s that are among the terms chosen from the nucleus. Finally, each of the chosen terms must participate exactly once. The version of hyperparamodulation discussed here is somewhat different from that introduced in an earlier paper on the subject [4]. In the version here, new nuclei can be addod during a run, any input clause can be a nucleus, various input clauses can be designated as inadmissible as satellites, and the user does not mark the terms in the nuclei to be considered for unification. From one viewpoint, once a nucleus has been chosen, all of its terms must participate. With this view, an effective strategy requires all terms that are variables to be paramodulated with the clause for reflexivity, EQUAL{x,x). From another viewpoint, this version of hyperparamodulation permits some set of terms of the nucleus to be involved, but omits all terms that are variables and allows other terms to be omitted also. Intuitively, hyperparamodulation is to paramodulation as hyperresolution is to PI-resolution. Any hyperresolvent can be obtained by applying the ap propriate set of Pl-resolution steps. With such an implementation, only the final positive clause, if one is found, is considered for retention. A more efficient implementation is achieved if the appropriate set of unifications is sought, pro cessed to produce the required single unifier that unifies certain pairs of literals, and no intermediate clauses are generated. The object is, of course, to remove all negative literals from the nucleus without introducing any new negative lit erals. Similarly, hyperparamodulation can be implemented by a succession of paramodulation steps that produces a sequence of clauses such that the final clause is the only one considered for retention. It can also be implemented by a simultaneous application of paramodulation steps that produce no intermedi ate clauses. Where hyperresolution attempts to remove some designated set of literals (the negative literals of the nucleus), hyperparamodulation attempts to substitute (with equalities) into some designated set of terms of the into clause. Negative hyperparamodulation requires that exactly one of the satellites be an inequality. The other important requirement is that the paramodulation in volving the inequality must obey the constraints imposed on negative paramod ulation. The remaining requirements are those of positive hyperparamodulation. The following example is typical of negative hyperparamodulation. We again
Collected Works of Lurry Wos
670
consider the same theorem from elementary group theory. We replace clause (2) with clause (6), and clause (4) with clause (7). (1) EQUAL(prod(prod(x,y), (6)
EQUAL(prod(e,x),x)
(3)
EQUAL(prod(x,x),e)
{7)-EQUAL(prod{a,
z),prod(x,prod(y,
z)))
b),prod{b, a))
In one negative hyperparamodulation step, an automated reasoning program can deduce (8)
-EQUAL(b,prod(a,prod(b,a)))
by simultaneously applying negative paramodulation to the argument prod(a, b) of (7) and the term prod(y, 2) of (1), paramodulation to the argument prod(x,x) of (3) and the term prod(x,y) of (1), and paramodulation to the argument prod(e, x) of (6) and the term prod(e, b) which is the transform of the term prod(prod(x, y), z) of (1). Before turning to the algorithm employed to implement negative paramod ulation and negative hyperparamodulation, we give the following rather elegant proof—a proof that was new to us and was first found by the reasoning pro gram. Again, the focus is that same theorem from group theory. When the set of support consists of clause (7) alone, clauses (7) and (3) are used as satel lites, clause (1) is used as a nucleus, and clauses (1) and (2) and (3) are used as demodulators, a single application of negative hyperparamodulation coupled with demodulation yields a proof of the theorem. We are, of course, assuming that the input set of clauses consists of the axioms for a group (expressed as unit clauses) together with the axiom of reflexivity, the hypothesis of the the orem, and clause (7) as the denial. Among the negative hyperparamodulants, the clause (9)
-EQUAL(e,e)
is deduced. The set of terms from the nucleus, clause (1), consists of prod(y, z) and prod(x, prod(y, z)). The first of these is unified with the argument prod(a, 6) of clause (7), and the resulting transform of the second is unified with the ar gument prod(x,x) of clause (3). The mathematical translation of a detailed account of this one-step negative hyperparamodulation proof focuses on an in stance of associativity, namely, ((ba)a)b = (ba)(ab). Since 06 is assumed not to equal ba, the right side of the equality becomes (ba)(ba), and the equality becomes an inequality. But (6a) (60) = e, from the hypothesis that the square of every element equals e. The left side of the original equality becomes e, by
Negative Paramodulation
671
first reassociating, then using the hypothesis of the theorem, then using right identity, and finally using the hypothesis of the theorem again. The conclusion is that e is not equal to e, and the proof is complete.
4
Implementation and Experiments
Negative hyperparamodulation has been incorporated into tpO, an automated theorem-proving program based on LMA [l]. The user declares the admissible argument positions of the appropriate functions and predicates. The basic al gorithm for generating negative hyperparamodulants is the following. Assume that the given c/ause is a negative unit equality clause, and that nuclei and satellites are sets of clauses. 1. Initialize the set of negative hyperparamodulants to the empty set. 2. For each nonvariable admissible into position of each member of nuclei, where the term in the into position unifies with the left argument of the given clause, perform steps (a) through (d). (a) Mark all nonvariable terms in the nucleus. (b) Generate a negative paramodulant such that the negative paramodulant inherits all marks from the nucleus except the marks on the into term and its subterms. (c) Add the negative paramodulant to the set of negative hyperparamod ulants, then do step (d) with the negative paramodulant. (d) Generate a set of positive binary paramodulants by paramodulating members of satellites into the marked terms such that the paramod ulants inherit the following marks from the into clause: marks on terms to the right of the into term, and marks on terms that prop erly contain the into term. Add each paramodulant to the set of negative hyperparamodulants. Do step (d) for each paramodulant. 3. Demodulate and test for retention each clause in the set of negative hy perparamodulants. Problem 1 is to prove that groups of exponent 2, groups in which xx = e holds, are commutative. The following set of clauses is used, where prod is abbreviated to / , and inv is abbreviated to g. (1)
EQUAL(x,x)
Collected Works of Larry Wos
672
(2)
EQUAL(f(e,x),x)
(3)
EQUAL(f(x,e),x)
(4)
EQUAL(f(g(x),x),e)
(5)
EQUAL(f(x,g(x)),e)
(6) EQUAL(f(f(x, (7) (8)
y), z), f(x, f(y, z)))
EQUAL(f(x,x),e) -EQUAL(f(a,b)J(b,a))
Clause (8) is the only clause in the initial set of support, and clauses (2) through (7) are used as demodulators as well as axioms. Problem 2 is to prove that in groups of exponent 3, groups in which xxx = e holds, h(h(x,y),y) = c, where h is the commutator function h(x, y) = xyx~ly~l. The following set of clauses is used, where clause (13) is the demodulated form of the denial of the theorem. < clauses (1) through (6) from problem 1> (7) EQUAL{g{e),e) (8) EQUAL(g(g(x)),x) (9)EQUAL(f(x,f(g(x),y)),y) (10) EQUAL(f(g(x),f(x,y)),y) (11) EQUAL(g(f(x,y))J(g(y),g(x))) (12) EQUAL(f(x,f(x,x)),e) (13) -EQUAL(f(a, f(b, f(g(a), f(b, f(a, f(g(b), f(g(a), g(b)))))))), e) Clause (13) is the only clause in the initial set of support, and clauses (2) through (12) are used as demodulators as well as axioms. Problem 3 is to show that (—x){—y) = xy in rings, without using the lemmas xO = 0 and Ox = 0. The following set of clauses is used. (1) (2) (3) (4) (5) (6) (7) (8) (9)
EQUAL(x,x) EQUAL(swn(0,x),x) EQUAL(sum(x,0),x) EQUAL(sum(minus(x),x),0) EQUAL(sum(x,minus(x)),Q) EQUAL(sum(sum(x, y), z), sum(x, sum(y, z))) EQUAL(prod(prod(x, y), z),prod(x,prod(y, z))) EQUAL(prod(x, sum(y, z)), sum(prod(x,y),prod(x, EQUAL{prod(sum(y, z),x), sum{jprod{y,x),prod(z,
z))) x)))
Negative Paramodulation
673
(10) EQUAL(sum(x,y),sum{y,x)) (11) —EQUAL(prod(minus(a), minus(b)), prod(a, b)) Clause (11) is the only clause in the initial set of support, and clauses (2) through (9) are used as demodulators as well as axioms. Table 1 contains the results of some initial experiments on these three prob lems. Negative hyperparamodulation is the sole inference rule used, and demod ulation is applied to all deduced clauses. The unification counts do not include failed unification attempts or matches for demodulation or subsumption checks. "Length" is the number of steps in the proof, where one step is one negative hyperparamodulation inference, including demodulation of the result. The prob lems were run on a SUN 3/75 workstation. Table 1. Experimental Results Problem 1. xx = e groups 2. xxx = e groups 3. - x - y = xy in rings
Gentd. 8 405 154
Kept 4 115 59
Sec. 2 193 51
Unifs. 81 5831 2088
Length 1 11 4
To give some perspective to the results presented in Table 1, we close this section with some data gathered from related experiments. In particular, we dis cuss the results of attempting to prove the given three theorems when negative hyperparamodulation is replaced with either paramodulation or hyperparamod ulation. Although the comparisons are in general very favorable to negative hy perparamodulation, we advise against concluding that this new inference rule is far superior to its positive relatives. The experiments are simply too few and too incomplete; this paper merely presents a preliminary study. In fact, the very nature of the field makes interpreting experiments at best somewhat suspect. The results can even be very misleading. The difficulty rests with the intercon nection of representation, inference rule, and strategy. The comparisons provide only a hint of what may be true, but do suggest certain soft conjectures. A glance at the data leads to the conjecture that the use of negative hyper paramodulation may remove some of the burden on the user of picking which demodulators to employ and deciding whether or not to use back demodulation. Of course, it is well known that back demodulation can be extremely useful, but it can also be too expensive for certain given problems. For all of the experiments cited in this paper, we chose to suppress the use of back demodulation. A sec ond conjecture says that employment of negative hyperparamodulation avoids the need for such careful tuning of the various parameters that govern the pro gram's reasoning; for example, it may not be crucial to choose the weights to
674 Collected Works of Larry Was
reflect the user 's insight . A third conjecture concerns the inclusion of auxiliary lemmas . For example, when negative hyperparamodulation is the sole rule of inference, the ring theory theorem was proved without the usual lemmas x0 = 0 and Ox = 0 . But, as already commented , these conjectures are soft conjectures; far more data is required before any of them can be strongly considered to be true. What is obvious, however, is that the use of negative hyperparamodulation sharply increases the role of negative equality unit clauses , clauses that might otherwise play no active part in the search for a proof. Other than this obvious fact , as the following discussion shows , the situation is still too complicated for drawing many well-founded conclusions. For all of the paramodulation and hyperparamodulation experiments, the set of demodulators was the same as in the corresponding negative hyperparamodulation experiment, but the set of support was modified. In the xx = e group problem, paramodulation produced a proof in 5 seconds, with 71 generated clauses, 11 kept clauses, 35 successful unifications, and a proof length of 4. Hyperparamodulation produced a proof in 137 seconds, with 1513 generated clauses, 49 kept clauses, 10,519 successful unifications, and a proof length of 3. For both of these experiments, the special hypothesis xx = e was moved to the set of support. For the xxx = e group problem, no proofs were obtained using the default parameter settings with either paramodulation or hyperparamodulation. During each attempt , 500 clauses were generated. Some tuning of the parameters enabled a proof to be found in 81 seconds, with 53 generated clauses, 69 kept clauses, 2002 successful unifications , and a proof length of 6 . The set of support consisted of the special hypothesis xxx = e. Finally, no proofs were found for the -x - y = xy ring problem with either paramodulation or hyperparamodulation, regardless of whether or not the lemmas x0 = 0 and Ox = 0 were included. During each attempt, 500 clauses were generated. The left distributivity axiom was moved to the set of support.
5 Summary In this paper , we have introduced two new inference rules , negative paramodulation and negative hyperparamodulation. The actions of negative paramodulation complement those of (positive) paramodulation . Where (positive) paramodulation (which generalizes the usual notion of equality substitution ) focuses on positive equality literals , negative paramodulation focuses on negative equality literals . Both rules permit an automated reasoning program to act directly on terms deep within some expression.
Negative Paramodulation
675
Negative hyperparamodulation was formulated to enable a reasoning program to (simultaneously) consider sets of clauses n at a time such that one of the clauses contains a negative equality literal, n each contain a positive equality literal, and the nth (the into clause) contains a positive literal. We give the additional conditions that the into clause must satisfy to guarantee the logical soundness of the conclusions yielded by applying negative paramodulation and negative hyperparamodulation. The simultaneous consideration of clause sets containing more than two clauses permits an automated reasoning program to take larger and more significant deduction steps. Since the most relevant measure of the value of an inference rule is its performance, we have included the results of some preliminary experiments. Each of the experiments relies solely on reasoning backward from the denial of the theorem to be proved, and employs negative hyperparamodulation as the only inference rule. Our intention is to experiment with bidirectional proof searches that simultaneously employ (positive) hyperparamodulation to reason forward and negative hyperparamodulation to reason backward. This experimentation will be conducted with both a uniprocessing and a parallel-processing reasoning program. One objective is to show that such bidirectional searches circumvent an obstacle that commonly occurs with an approach solely employing the positive variant of an inference rule for "building in" equality. With such a forwardreasoning approach, unfortunately, the denial of the theorem to be proved often plays a very passive role in the search. In fact, negative equality clauses often are considered only at the last step of the proof, that which completes the establishment of contradiction. With rules such as negative hyperparamodulation, on the other hand, negative equality clauses can play a very active role in the search for a proof. Three properties of both negative paramodulation and negative hyperparamodulation deserve mention. First, by permitting the reasoning program to focus directly on terms deep within an expression, the potential power of the program is sharply increased. Being able to bypass so-called intermediate clauses and explore much smaller clause spaces is one of the goals of the field. Second, both rules "build in" cancellation. The importance of such a built-in treatment of cancellation is amply demonstrated by Stickel's excellent study of rings in which x3 = x [3]. He gives his program access to cancellation by relying on appropriate demodulators, which is distinctly different from that which occurs with the two inference rules discussed in this paper. The third property concerns the attempt to measure the overall advancement of the fields of automated reasoning and automated theorem proving. Briefly, trivial theorems should be proved trivially. Little time or control should be required to find the proof of a simple theorem from mathematics. Our early experiments suggest that the use of negative hyperparamodulation permits the program to easily prove simple theorems. Both the extent to which this property holds and the value of the two introduced
676
Collected Works of Larry Was
inference rules for attacking hard problems remains to be ascertained through future experimentation.
References 1. Lusk, E., McCune, W., and Overbeek, R., "Logic Machine Architecture: Kernel Functions", Proceedings of the 6th Conference on Automated Deduction, Springer-Verlag Lecture Notes in Computer Science (ed. D. Loveland), vol. 138, pp. 70-84 (June 1982). 2. Robinson, G., and Wos, L., "Paramodulation and theorem proving in first-order theories with equality" , Machine Intelligence (ed. Meltzer and Michie), vol. 4, American Elsevier, New York, pp. 135-150 (1969). 3. Stickel, M., "A case study of theorem proving by the Knuth-Bendix Method: discovering that xsup3 = x implies ring commutativity", Proceedings of the 7th Conference on Automated Deduction, Springer-Verlag Lecture Notes in Computer Science (ed. R. Shostak), vol. 170, pp. 248-258 (May 1984). 4. Wos, L., Overbeek R., and Henschen, L., "Hyperparamodulation: A refinement of paramodulation", Proceedings of the 5th Conference on Automated Deduction, Springer-Verlag Lecture Notes in Computer Science (eds. R. Kowalski and W. Bibel), vol. 87, pp. 208-219 (July 1980). 5. Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: Introduction and Applications, Prentice-Hall, Englewood Cliffs, N.J. (Feb. 1984).
Problem Corner:
Set Theory in First-Order Logic: Clauses for Godel's Axioms* ROBERT BOYER', EWING LUSK2, WILLIAM McCUNE2, ROSS OVERBEEK2, MARK STICKEL3, and LAWRENCE WOS2 ' Microelectronics and Computer Technology Corporation , 9430 Research Boulevard, Austin, TX 78759, U.S.A. 2Mathematics and Computer Science Division , Argonne National Laboratory, Argonne, IL 60439-4844, U.S.A. 3Artificial Intelligence Center, SRI International, Menlo Park, CA 94025, U.S.A.
(Received: 15 May 1986) Abstract. In this paper we present a set of clauses for set theory, thus developing a foundation for the expression of most theorems of mathematics in a form acceptable to a resolution-based automated theorem prover. Because Godel's formulation of set theory permits presentation in a finite number of first-order formulas, we employ it rather than that of Zermelo-Fraenkel. We illustrate the expressive power of this formulation by providing statements of some well-known open questions in number theory, and give some intuition about how the axioms are used by including some sample proofs. A small set of challenge problems is also given. Key words . Set theory, logic, automated theorem proving.
1 Introduction Mathematics at the graduate and research level offers a virtually unlimited supply of difficult, even open, problems to be studied with automated reasoning systems. Not everyone, however, is aware just how easy it is to cast such problems into the format suitable for input to a resolution-based theorem prover: to present such problems with finite number of clauses. There are two sources of this lack of knowledge. (a) Some people think that because resolution is `firstorder', it is inherently incapable of dealing with many of the basic functional concepts of mathematics, such as homomorphism or continuous function. These This work was partially supported by the Applied Mathematical Sciences subprogram of the office of Energy Research, U.S. Department of Energy, under contract W-31-109-Eng-38, and partially supported by the Defense Advanced Research Projects Agency under contract N00039-84-K-0078 with the Naval Electronic Systems Command. Reprinted from the Journal of Automated Reasoning, Vol. 2, pp. 287-327 (1986). with kind permission from Kluwer Academic Publishers.
678
Collected Works of Larry Wos
people are just not aware that set theory can be easily expressed in first-order logic and that set theory is a sufficient vehicle within which to express the entire logic of functions normally used by mathematicians. (There may be obscure corners of category theory and universal algebra dealing with concepts such as the category of all categories that cannot be handled within set theory. But certainly the overwhelming majority of analysis and algebra can be easily presented within set theory.) (b) Some people think that because set theory is usually based on the set-builder notation {x : p(x)} where p can be any firstorder formula, that a first-order clausal formulation of set theory will involve an infinite number of clauses. In fact, the set theory most widely studied by logicians , Zermelo-Fraenkel (ZF), cannot be expressed in a finite number of clauses. In this article, on the other hand, we present a set theory, expressible in a finite number of clauses , that follows von Neumann's approach, and we give a few sample challenge problems from mathematics. First, a little background. It is well known that set theory was originally developed by Georg Cantor in the 19th century and was confounded with paradoxes, such as Russell's paradox concerning {x : x x}. Attempts to resolve the paradoxes have resulted in three well-known varieties of set-theory: ZermeloFraenkel [9], von Neumann-Bernays-Godel (vNBG) [3, 4, 6], and Russell-Quine [8]. A detailed comparison of these three theories may be found in [8]. One basic difference between these set theories is the treatment of the power of the set-builder notation {x : p(x)}. In the Zermelo-Fraenkel approach, the axioms about that notation limit one to building sets as subsets of given sets: x is in {x E B : p(x)} if and only if x is in B and p(x). In the vNBG theory, there is a segregation statute: the world consists of `little' sets and ` big' sets . The little sets are members of other sets, some big and some little. The big sets are eligible for membership in neither little nor big sets. One has as a theorem that x is in {x : p(x)} if and only if x is little and p(x). The Russell-Quine limitation on the use of the set builder notation is syntactic; in Quine's system New Foundations, it is required that in asserting the existence of {x : p(x)} that one be able to assign integer indices to the bound variables in such a way that a bound variable occurring to the left of an `E' is assigned an integer precisely one less than the variable on the right of the same `E' . Thus Russell's {x : x 0 x} becomes an ill-formed formula. That set is also inexpressible in the Principia Mathematica type theory, which has an infinite syntactic hierarchy of variables; variables of one layer of the hierarchy range over classes of objects of the layer just below. It is a surprising fact that ZF, which is widely studied by logicians , cannot be finitely axiomatized . (Cf. [8], p. 320.) Since it cannot be finitely axiomatized, it cannot be input to a resolution-based theorem prover. Fortunately, the vNBG set theory has a finite axiomatization , and is in fact strictly stronger than ZF. How does vNBG avoid the necessity of an infinite number of axioms, which seems inherent in any handling of a schematic notion such as {x : p(x)}, where p ranges over all first-order formulas? Metatheorems describing in detail how this is done occupy the first few pages of Chapter II of [3]. Briefly, here is
Set Theory in First-Order Logic
679
the trick. We take as primitive a few theoretic operations such as intersection, complementation , extracting the domain of a relation, and taking the converse of a relation . We also take as given the operation of taking the non-ordered pair of two `little' sets, and posit that the pair is itself little. Finally, we take as given { (x,y) : x E y}, the set of all ordered pairs of little sets x and y such that x is in y. We then observe that in any given instance of {x : p(x)} the formula p must be built up out of 's', `A', `- ', and `E'. By a simple structural induction on the form of p, we see how to eliminate the set-builder notation as follows: {x : q(x) A r(x)} is precisely the intersection of {x : q(x)} and {x : r(x)}. {x : -'p(x)} is merely the complement of {x : p(x)}. {x : dyp(x, y)} is just the domain of {(x, y) : &,y)}. Some fiddling around with ordered tuples and {(x, y) : x E y} handles the base case. In the following set of formulas, we have followed closely the spirit of the axiom system given in i[3]: we believe that there is a definitional extension of Godel's theory in which our axioms are theorems, and we believe that Godel's axioms follow from ours. But we have not followed Godel's axiomatization to the letter. The comments included indicate the rough correspondence between Godel's axioms and ours. We have taken the liberty of using Godel's General Existence Theorem to posit the existence of a few set operations, e.g. image, that are not mentioned in Godel's axioms but that Godel adds by definition shortly thereafter. It is not our intention to suggest that any existing resolution-based theorem prover ought to be able to attack the example challenge problems successfully. Indeed, we suspect that all of the challenge problems are probably beyond the ability of any currently known resolution-based system. Rather, our objective is to make it clear to the automated reasoning community that there is a limitless supply of truly difficult challenge theorems readily available. We are not the first researchers to focus on the possibility of studying set theory with an automated theorem-proving program. In fact, among others, Bledsoe [2, 1] and Pastre [7] have conducted such investigations and published some of their results. Research in this area has been principally concerned with "building in" set-theoretic knowledge and with the development of heuristic reasoning techniques, rather than with the derivation of resolution-style proofs. The work of Patrick Suppes [5] is an exception to the majority of such research. In particular, since 1974 he has taught a set theory course to undergraduates at Stanford in which a proof-checking program is used that contains a resolutionbased theorem prover. This program can be invoked by the user for various steps of the proof. For an extensive development of much of set theory and topology within the vNBG set theory in modern mathematical style, see [4] and [6].
Collected Works of Larry Wos
680
2
Commentary on t h e Axioms and Definitions
The formulas in this section are divided into 5 groups. Group 1 contains the basic set theory axioms and the definitions of concepts that are referenced in the axioms. Group 2 contains useful additional definitions. Group 3 contains definitions for abstract algebra. Group 4 contains definitions for number theory. Group 5 contains some test problems and challenge problems. 2.1. GROUP 1: BASIC AXIOMS AND DEFINITIONS
Some of the differences between our axiomatization and Godel's are the follow ing. (a) Godel uses typed variables for variables whose ranges are restricted to be little sets. We use untyped variables, and we use the unary predicate W to restrict the range of a variable. (Godel's use of typed variables is a notational abbreviation and does not lead to a fully sorted logic. For example, the intersection of two big sets is not necessarily big, and not necessarily little.) (b) In our rewriting of the Godel axioms that assert the existence of sets, we have, whenever possible, uniquely determined those sets and named them. For example, Godel's axiom C-3, which asserts the existence of a set that contains the power set of a given set, is (Vx)[m(x) - (3»)[m(y) A (Vz)(m(z) -* (z e y ^ z C x)}}}. Our version of axiom C-3 is (VzVx)[z g powerset(x) m(powerset (x))].
*-* m(z) A z C x] A (Vx)[m(x) —>
(This change is a matter of convenience—we believe that it does not make our system stronger or weaker than Godel's. (c) We have included axioms that assert the existence of first (x) and second(x), which are the first and second components of x, provided that x is an or dered pair. Godel's axiom B-6, which asserts the existence of the converse of a set, is (Vu3vVxV2/)[m(x) Am(j/) —» ((x, y) g v *-* (y,x) g u)]. The set v is not uniquely determined—it can contain objects other than ordered pairs. Our use of first, second, and opp (ordered pair predicate) allow us to conveniently state our version of axiom B-6 as
Set Theory in First-Order Logic
681
(VzVx)[z € converse(x) «-» m(z)Aopp(z)/\(second(z),
x]
first(z))
€
in which the converse of a set contains no junk. (As in the preceding point, we believe that this device does not strengthen or weaken our system.) (d) Godel's positions for domain and range are the reverse from what is done in modern mathematical style. We use the modern convention in which domain(x) is the set of the first components of the ordered pairs in x. (e) We have introduced 0 (the empty set) and V (the universal set) in exten sional definitions. They can easily be proven to exist from the axioms of intersection and complement. 2.2. GROUPS 2, 3, AND 4: DEFINITIONS
We have observed the following conventions when introducing extensional defi nitions, that is, definitions of the form tl € g(xl, ...,xn) «-» p(tl, i l , . . . , xn). (a) tl is always a variable, rather than, for example, an ordered pair, as ap pears frequently in Godel's definitions. (b) tl is explicitly restricted to be a little set in the right-hand-side of the equivalence, even if the restriction is redundant. (The littleness of il is re quired by the General Existence Theorem.) For example, in the definition of the identity relation, (V2)[z € ident <-► m(z) A opp(z) A first(z)
= second(z)]
the condition m(z) is redundant in light of the easily proven lemma (Vx)[opp(x) ->m(x)]. (c) All quantified variables in the right-hand-side of the equivalence are re stricted to be little. (This is required by the General Existence Theorem.) The particular definitions that we present have been chosen so that a few interesting test and challenge problems can be proposed. 2.3. GROUP 5: T E S T AND CHALLENGE PROBLEMS
This group contains some problems from set theory, group theory, and number theory, each of which is formulated in the setting of the preceding axioms and definitions.
682
3 3.1.
Collected Works of Larry Wos
First-Order Formulas G R O U P 1: A X I O M S AND B A S I C D E F I N I T I O N S
This set of axioms closely follows the axioms given by Godel. It contains a few additional axioms (such as those for first and second) that we found useful.
/* Axiom A-1 little sets are sets (omitted because all objects are sets) */ /* Axiom A-2 elements of sets are little sets */ (VxV3/)[x € y —» m(x)] /* Axiom A-3 principle of extensionality */ (VxVj/)[(Vu)[m(u) —► (u e x «-» u e y)\ —» x = y] /* Axiom A-4 existence of nonordered pair */ (VuVxVy)[u € {x, y} «-» m(u) A (u = x V u = y)] (Vxyy)[m({x,y})l /* Definition of singleton set */ (Vx)[{x}={x,x}] /* Definition of ordered pair */ (VxVj,)[(x,y) = {{x},{x,J/}}] /* Definition of opp (ordered pair predicate) */ (Vx)[opp(x) «-► (3j/3z)[m(j/) A m{z) A I = ( J , z)\] I* Axiom of first */ (VzVx)[z e first(x) «-» m(z) A (3u3u)[m(u) A m(v) A x = (u, v) A z e uj] /* Axiom of second */ (VzVx)[z G secon
6 seconrf(z)]
/* Axiom B-2 intersection */ (yzVxVy)\z 6 x n y «-> m(z) A z e x A z G y ] /* Axiom B-3 complement */ (Vz\/x)[z G~ x «-» m(z) A z £ x] /* Definition of union */ (VxVj/)[x U y = ~ (~ xn ~ j/)]
Set Theory in First-Order
Logic
683
/* Axiom B-4 domain */ (VzVx)[z e domainix) *-* m(z) A (3xp)[m(xp) A opp(xp) A xp e x A z = /* Axiom B-5 cross product */ (VzVxVy)[z € x x y <-t m(z) A opp(z) A first(z)
£ x A second(z) 6 y]
/* Axiom B-6 converse */ (VzVx)[z e cont;erse(x) ♦-» m(z) A opp(z) A (seco7i m(z) A (3u3v3w)[m(u) A m(v) A m(w) A 2 = («> («, «>» A
/* Axiom B-8 flip_range */ (VzVx)[2 6 flip.range(x) «-> m(2) A (3u3t;3w)[m(u) A m(v) A m(u;) A z (u, (v, to)) A (u, (w,v)) ex]] /* Definition of successor */ (Vx)[succ(x) = i U {x}] /* Definition of 0 (empty set) */ (Vz)[z*0] /* Definition of \J (universal set) */ (Vz)[2 6 V ^ "»(*)] I* Axiom C-l infinity */ (3y)[m(y) A 0 € y A (Vx)[x £ y -> sttcc(x) G y]] /* Axiom C-2 sigma (union of elements) */ (VzVx)[z G sigma(x) <-► m(z) A (3y)[m(y) A y e x A 2 6 y]] (Vu)[m(u) —► Tn(sigma(u))] /* Definition of subset */ (VxVy)[x C y ♦-» (Vu)[m(u) —» (u € x -» u e y)]] /* Definition of proper subset */ (VxVy)[x C y « - > z C y A x / y ] /* Axiom C-3 powerset */ (V2Vx)[z e powerset(x) *-* m(z) A z C i ] (Vu)[m(u) —► m(powerset(u))] /* Definition of relation */ (Vz)[re/a
first(xp)\\
Collected Works of Larry Wos
684
(Vx)[sing-val(x) <-» (VuVuVu;)[m(u) A m(v) A m(w) —♦ ((u, v} G x A (u, w) G x —► v = w I* Definition of function */ (ixf)[function(xf)«-» relation(xf)
A sin
/* Axiom C-4 image and substitution */ (VzVxVx/)[z G »ma5e(x, x / ) «-> m(z) A (3y)[m(y) A opp(y) A y € x / A first(y) € x A second(j/) = 2]] (VxVx/)[m(x) A function(xf) —» m(imape(x, x/))] /* Definition of disjoint */ (VxVj/)[disjoint(x,y) «-+ (Vu)[m(u) —» ->(u G x A u G y)]] /* Axiom D regularity */ (Vx)[x 5^ 0 —> (3u)[m(u) A u 6 x A dis.;'oint(u,x)]] /* Axiom E choice */ (3u)[function(u) A (Vx)[m(x) A i / 0 - * (3y)[m(y) A y G x A (x, y) G uj]]
3.2.
G R O U P 2: M O R E S E T T H E O R Y
DEFINITIONS
Here we add some definitions that make statments of the theorems that follow more convenient. One of the most heavily used is the definition of what it means to apply a function to an argument. /* Definition of range */ (VzVx)[z G range(x) <-* m(z) A (3xp)[m(xp) A opp(xp) A xp G x A z = $econd(xp)]] /* Definition of identity relation */ (Vz)[z G ident«-» m(z) A opp(z) A first(z)
= second(z)]
I* Definition of restrict */ (VxVy)[restrict(x,y) = x(~l (y x V)] /* Definition of one.one (one-to-one function) */ (Vx/)[one J one(x/) «-> function{xf) A }unction{converse{xf))\ /* Definition of apply */ (VzVx/Vj/)[z G apply(xf, y) «-» m(z) A (3w)[m(w) A opp(w) A w G x / Afirst(w) = y A z G second(w)]] /* Definition of app2 */ (Vx/VxVy)[app2(x/, x, y) = apply(xf, <x,y))] /* Definition of maps */ (Vx/VxVy)[maps(x/,x, y) «-» function(xf)
A domain(xf)
= x Arange(xf)
C y]
Set Theory in First-Order
Logic
685
/* Definition of closed */ (VxsVx/)[dosed(xs,x/) <-» m(xs) A m(xf) A maps(xf, xs x xs,xs)j /* Definition of composition */ (VzVx/Vxg)[z e i g o xf «-> m(z) A (3x3y3u))[m(x) A m(y) A m(ixj) A z = (x,i/) A (x,w) e xf A (w,i/> £ xp]] /* Definition of homomorphism */ (VxhVxslVx/lVxs2Vx/2)[/iom(x/i,xsLx/l,xs2,x/2) <-> Aclosed(xs2,xf2) A maps(xh, xsl,xs2)A (VxVj/)[x £ xsl A y e xsl —» apply(xh, app2(xfl, x,y)) = app2(xf2, apply(xh, x), apply(xh, y))}]
closed(xsl,x/l)
3.3. GROUP 3: SOME DEFINITIONS FOR ABSTRACT ALGEBRA
This set of definitions is used for elementary group theory—one of the traditional domains in which theorem provers have been relatively successful when using much higher-level axioms than these. /* Definition of associative system */ (VxsVxf)[assoc(xs,xf) <-> (VxVi/Vz)[x £ xs A y 6 xs A z e xs -> app2(xf, app2{xf, x, y),z) = app2(xf, x, app2(xf, y, z))]] /* Definition of identity (left and right) */ (VxsVx/Vxe)[identttj/(x5,x/,xe) *-* xe 6 xs A (Vx)[x 6 xs —* = x A app2(xf, x, xe) — x]]
app2(xf,xe,x)
/* Definition of inverse (left and right) */ (VxsVx/VxeVx<;)[tnverse(xs,x/,xe,x<7) <-► maps(xg,xs,xs) A (Vx)[x e xs —» app2(xf, apply(xg, x), x) = xe A app2(x/, x, apply(xg, x)) = xe]] /* Definition of group */ (VxsVx/)[group(xs,x/) <-* closed(xs,xf) A(3x
A assoc(xs,xf)
A (3xe)[identi(y(xs,x/,xe)
/* Definition of commutative system */ (VxsVx/)[commute(xs,x/)«-» (VxVy)[x € xs Ay £ xs —» app2(xf,x,y)
3.4.
GROUP 4: NUMBKR THEORY
= app2(xf,y,x)}]
DEFINITIONS
Here we give the definitions for arithmetic we will neeed to express the Peano axioms and number theory problems.
Collected Works of Larry
686
Wos
I* Definition of nats (natural numbers) */ (VZ)[JZ G nats «-» m(z) A (Vxs)[m(xs) A 0 € xs A (Vxfc)[xfc G xs —♦ suce(xfc) G xs] —♦ 2 G /* Definition of plus */ (Vz)[z 6 plus «-► m(z) A (Vxs)[m(xs) A (Vxi)[xi G nats -► ((0,xi),xi> G xs] A (VxiVxj'Vxfc)[xi 6 nats Axj G nats A xfc G nats A ((xi, xj), xk) G xs —► ((succ(xi),xj),5ticc(xfc)) G xs] —» z G xs}} I* Definition of times */ (Vz)[z G times <-* m(z) A (Vxs)[m(xs) A (Vxi)[xi G nats —» ((0, xi),0) € xs] A (VxiVxjVxfc)[xi 6 nats A xj G natsA xfc G nats A {(xi, xj), xk) G xs —» ((succ(xi),xj'),app2(pZus, xfc.xj)) G xs] —» z G xs]] /* Definition of primes */ (Vz)[z G primes «-» m(z) A 2 G nats A z 5^ 0 A 2 ^ succ(O) A (VuVv)[u G nats A v G nats A app2(times, u, v) = z —> u G {s«cc(0),2}]] /* Definition of finite */ (Vx)[/inite(x) <-> (3xn3x/)[xn G nats A maps(xf,xn,
x) A range(xf)
= x A one-one(x.,
/* Definition of twin primes */ (Vz)[2 G twin.prim.es «-* m(z) A 2 G primes A succ(succ(z)) G primes] /* Definition of evens (even natural numbers) */ (V2)[2 G evens «-> m(z) A 2 G nats A (3x)[m(x) A x G nats A app2(p/us, x,x) = z]]
3.5.
G R O U P 5: T E S T P R O B L E M S AND O P E N
QUESTIONS
In this section we state some test problems. These are given in negated form, ready to be used in a proof of unsatisfiability. We give a small set of simple group theory problems, the standard Peano axioms for the natural numbers which become theorems in this set theory, and the open twin-prime and Goldbach conjectures. /* Negation of theorem: the composition of homomorphisms is a homomorphism */ -(Vx/ilVxft2Vxsl Vx/lVxs2Vx/2Vxs3Vx/3) [hom{xhl, x s l , xf 1, xs2, x/2)A hom(xh2,xs2,x/2,xs3,x/3) —► hom(xh2 o x / i l , x s l , x / l , x s 3 , x / 3 ) ] /* Negation of theorem:{x}, {((x, x),x)} is a group */ -.(Vx)[m(x) -► group({x}, {((x,x),x)})] /* Negation of theorem: there is a homomorphism from a group to itself */ ->(VxsVx/)(on>up(xs, x / ) —» (3y)[hom(y,xs,xf,xs,xf)}}
Set Theory in First-Order
Logic
687
/* Negation of theorem: xx = e implies commutativity in groups */ -i(VxsVx/Vxe)[gro«p(xs,x/) A identity(xs,xf,xe) A (Vx)[x € xs -* app2{xf, x, x) = xe] —» comm'ute(xs,x/)] /* Negation of theorem: Peano axiom 0 */ -im(nats) /* Negation of theorem: Peano axiom 1 */ 0 £ nats I* Negation of theorem: Peano axiom 2 */ -■(Vx)[x e nats —► succ(x) 6 nats] /* Negation of theorem: Peano axiom 3 */ -■(Vx)[x e nats —» 0 / succ(x)] /* Negation of theorem: Peano axiom 4 */ -i(VxVy)[x e nats A y e nats A succ(x) = succ(y) —» x = j/] /* Negation of theorem: Peano axiom 5 */ ->(Vxa)[0 € xa A (Vxfc)[xfc € xa — ► suee(xA:) G xa] —> nats C xa] /* Negation of conjecture: there is an infinite number of twin primes */ finite(twinjprimes) /* Negation of conjecture: Goldbach conjecture */ -<(Vz)[z e evens —* z 6 {0, succ(succ(0))} V (3x3y)[x e primes A y e primes Aapp2(plus, x, y) = z}]
4
T h e Clauses
The clauses in this section (except Clause 1) were derived from the formulas in the preceding section by a program that first skolemizes (without attempting to reduce the scopes of quantifiers), then converts to CNF, then does some additional processing. The additional processing is of three kinds, each of which is justified by axiom A-2: (in clause form) x & y V m ( x ) . (a) Clauses subsumed by fx g y V m(x) are deleted. (b) If a clause contains a pair of literals ->m(tl) V tl & t2, for any terms tl and t2, the literal -•m(tl) is deleted. This is sound because the result is a consequence of the original clause and the clause x g y V m(x) by resolution and factoring. (c) If the pair of clauses t l £ t2 V t3 € tA and t l 0 t2 V m(t3) occurs, then the second clause is deleted, because it is a consequence of the first clause
Collected Works of Larry Wos
688
and the clause x £ y V m(x). It is possible to remove other kinds of redundancy from this set of clauses. For example, after proving the lemma (Vx)[opp(a;) —► m(x)}, one might delete ->m(£) from a clause that contains the pair of literals ->m(£) V ->opp(£). And now, here are the clauses. A symbol is a variable if and only if it starts with a letter (lower case) in {u, v, w, x,y, z}. T h e functions / l , / 2 , . . . are all Skolem functions. 4.1.
G R O U P 1: A X I O M S AND B A S I C D E F I N I T I O N S
/* equality axiom */ 1.
i = x
/* Axiom A-l little sets are sets (omitted because all objects are sets) */ /* Axiom A-2 elements of sets are little sets */ 2. x & y V m(x) I* Axiom A-3 principle of extensionality */ 3. m ( / l ( x , j / ) ) V x = j/ 4. / l ( x , y ) e x V / l ( x , y ) 6 yVx = y 5. fl(x,y) £ x V / l ( x , y ) £ j / V x = y /* Axiom A-4 existence of nonordered pair */ 6. u $. {x,y}Vm(y) V -im(z) V i ^ ( y , z) /* Axiom of first */ 16. z £ first(x) V m(/4(z, x)) 17. z <jL /irsf(x) V m(/5(z,x)) 18. z g / i r s t ( x ) V x = (/4(z,x),/5(z,x))
Set Theory in First-Order
19. 20.
Logic
2 f[first(x)V z inf 4(2, x) z € first(x) V -<m(u) V ->m(t;) V i / ( u , t » ) V z ^ t i
/* Axiom of second */ 21. 2^secorui(z)V77i(/6(2,i)) 22. 2 £ secoTid(x) V m(f7(z,x)) 23. 2 £ second(x) V x = (/6(2, x)J7(z, x)) 24. 2 £ second(x) V z e f7(z,x) 25. 2 € secori(i(x) V -im(a) V negm(v) V i ^ ( a , » ) V z ^ » /* Axiom B-l estin (element relation) */ 26. 2 0 estin V opp(z) 27. 2 £ estin V first(z) e second(2) 28. 2 G estin V -1771(2) V -^opp(z) V first(z)
& second(z)
I* Axiom B-2 intersection */ 29. 30.
z^xnyV2€x 2^xnj/Vz€y
31.
2 e x O y Vz £ x V2 £ y
/* Axiom B-3 complement */ 32. 2 £ ~ x V 2 £ x 33. 2 e ~ x V ^m(z) V 2 e x /* Definition of union */ 34.
xUy=~(~xn~y)
/* Axiom B-4 domain */ 35. 2 £ domain(x) V opp(f8(z, x)) 36. 2 £ domain(x) V /8(2, x) £ x 37. 2 £ domain(x) V 2 = first(f&(z,x)) 38. 2 6 domain(x) V -'771(2) V -^opp(xp) V xp& xV z ^ /* Axiom B-5 cross product */ 39. 2 £ x x y V opp(z) 40. 2 0 x x y V first(z) e x 41. 2 0 x x y V seco7u/(2) 6 y 42. 2 € x x y V -■771(2) V -iopp(z) V first(z)
first(xp)
£ x V second(2) £ y
/* Axiom B-6 converse */ 43. 2 £ ccmverse(x) V opp(2) 44. 2 £ converse(x) V (sec0nd(2),/irst(2)) 6 x 45. 2 G conuerse(x) V -■m(z) V ->opp(z) V (seco7wf(2),/irst(2)) £ x /* Axiom B-7 rotate-right */ 46. 2 £ rotate.right(x) V m(/9(2,x)) 47. 2 £ rotate.right(x) V m(/10(2, x))
690
48. 49. 50. 51.
Collected Works of Larry Wos
z z z z
0 rotate-right(x) V m ( / l l ( z , x ) ) 0 rotatejright(x) V z = ) 6 x e rotate-right(x) V nm(z) V -im(u) V -^m(i)) V ->m(w) V z ^ (u, (v,tu» V (v, (w,u)) &
/* Axiom B-8 flip_range */ 52. z 0 flip.range(x) V m(/12(z, x)) 53. z £ //tp_ran0e(x) V m(/13(z, x)) 54. 2 0 flipjrange(x) V m(/14(z, x)) 55. z # flip.range(x) V z = (/12(z,x), (/13(z,x),/14(z,x))) 56. z 0 flip.range(x) V (/12(z, x), ) e x 57. z e flipjrange(x) V ->m(z) V ->m(u) V -rn(v) V ^m(w) V z / ( u , (v, tu>) V(u,(w,v)) £x I* Definition of successor */ 58. succ(x) — x U {x} /* Definition of 0 (empty set) */ 59. 2 0 0 /* Definition of y (universal set) */
60.
zeVv_,m(2)
/* Axiom C-l infinity */ 61. m(/15) 62. 0 6 /15 63. x <£ /15 V succ(x) e /15 /* Axiom C-2 sigma (union of elements) */ 64. z 0 sigma(x) V /16(z,x) e x 65. z 0 si£ma(x) V z £ /16(z, x) 66.
z e sigma(x)
67.
->m(u) V m(sigma(u))
VJ/^IVZ^J/
I* Definition of subset */ 68. xgyVu^xVuGy 69. x C y V / 1 7 ( x , y ) € x 70. x C y V / 1 7 ( x , y ) 0 y I* Definition of proper subset */ 71. x ( Z ! y V x C y 72. x£y\fx?y 73. xCyVxgyVx=y /* Axiom C-3 powerset */ 74. z 0 powerset(x) V z C x 75. z e powerset(x) V -im(z) V z g x
Set Theory in First-Order
76.
691
Logic
-*m(u) V m{powerset(u))
I* Definition of relation */ 77. -irelation(z) V x ^ z V opp(x) 78. relation(z) V /18(z) £ 2 79. relation(z) V -.opp(/18(z)) /* Definition of sing.va! (single valued set) */ 80. ->singjval(x) V -w(u) V ->m(u) V -w(w) V (u, v) £ x V (u, w) £ x V v - w 81. smg_i>ai(x) V m(/19(x)) 82. sins.uo/(x) V m(/20(x)) 83. sing.val(x) V m(/21(x)) 84. s m j . w / ( i ) V (/19(x), /20(x)) <E x 85. singjval(x) V (/19(x), /21(x)) e x 86. smj.wii(i) V /20(x) ■£ /21(x) /* Definition of function */ 87. -'function(xf) V relation(xf) 88. ->function(xf) V sing.val(xf) 89. function(xf) V -^re.lation(xf) V -•singjual(xf) I* Axiom C-4 image and substitution */ 90. 2 <£image(x,xf) V opp(f22(z,x,xf)) 91. z £ i m a g e ( x , x / ) V / 2 2 ( z , x , x / ) e x / 92. 2 £ tmage(x,x/) V first(f22(z,x,xf)) £ x 93. 2 £ image(x, xf) V second(f22(z,x, xf)) = z 94. 2 e image(x, xf) V -rni(z) V -•opp(y) V y ^ i / V firstly) 95. ->77i(x) V ->/unction(x/) V m(imape(x, x / ) ) /* Definition of disjoint */ 96. ->disjoint(x, y ) V u £ x V u £ y 97. disjoint(x,y) V /23(x, y) 6 x 98. disjotnt(x, j/) V /23(x, y) e y /* Axiom D regularity */ 99. x = 0 V /24(x) e x 100. x = 0 V disjoint (/24(x), x) /* Axiom E choice */ 101. function{f25) 102. -.m(x) V x = 0 V /26(x) e x 103. -.m(x) V x = 0 V (x, /26(x)) 6 /25
4.2.
G R O U P 2: M O R E S E T T H E O R Y
/* Definition of range */
DEFINITIONS
£ x V secondly) ^ 2
Collected Works of Larry Wos
692 104. 105. 106. 107.
2 z z 2
£ t £ €
range(x) range(x) range(x) ran
V opp(/27(z, x)) V /27(2, i ) € i V z = second(/27(z,x)) V -im(z) V -
/* Definition of identity relation */ 108. z g ident V opp(z) 109. z £ ident V first(z) = second(z) 110. z € ident V ->m(z) V -iopp(z) V first(z) /* Definition of restrict */ 111. restrict(x,y) = xn(y
^ second(z)
x\J)
I* Definition of one.one (one-to-one function) */ 112. ->one-one(xf)V function(xf) 113. -*onejone(xf) V function{converse(xj)) 114. one.one(xf) V -ifunction(xf) V -ifunction(converse(xf)) I* Definition of apply */ 115. z £ apply(xf,y) V opp(/28(z,x/,y)) 116. z £ apply(xf,y) V /28(z,x/,y) £ x / 117. z £ apply(xf,y) V / i r s t ( / 2 8 ( z , x / , y ) ) = y 118. z £ apply(xf,y) V z e second(f28(z,xf,y)) 119. z G apply(xf, y) V ->opp(iu) V tu £ x / V first(w)
^ y V 2 £ sera>nd(u;)
/* Definition of app2 */ 120. opp2(x/, x, y) = apply(xf, (x, j/» /* Definition of maps */ 121. ->maps(xf, x, j/) V function(xf) 122. ->maps(x/,x,y) V domain(xf) = x 123. ->maps(xj, x, y) V range(xf) C y 124. maps(xf, x, y) V -^function{xJ) V domain(xf)
/ i V range(xf)
I* Definition of closed */ 125. -yclosed(xs,xf)V m(xs) 126. -idosed(xs, x / ) V m(x/) 127. -idosed(xs,x/) V maps(xf, xs x xs, xs) 128. closed{xs, xf) V -im(xs) V ->m(x/) V -imaps(x/, xs x xs, xs) /* Definition 129. z g x g 130. z £ x g 131. z £ x p 132. 2 $xg 133. z £ x 0 134. z g x g
of composition */ o x/ Vm(/29(z,i/,ij)) o x/Vm(/30(z,x/,xg)) o x/Vm(/31(z,x/,xs)) o x/V2= (f29(z,xf,xg),f30(z,xf,xg)) o x/V(/29(z,x/,x
%y
Set Theory in First-Order
Logic
693
135. 2 6 1 5 0 1 / v ->m(z) V ->m(x) V ->m(t/) V ->m(u;) V 2 ^ (x,y) V (x, w) £ x / V (u),y) £ x p /* Definition of homomorphism */ 136. ->/iom(x/i,xsl,x/l,xs2,x/2) V d o s e d ( x s l , x / l ) 137. -'/iom(x/»,xsl, x / 1 , xs2, x/2) V dosed(xs2, x/2) 138. ->hom(xh,xsl,xfl,xs2, x/2) V maps(xh, xsl,xs2) 139. ->/u>m(x/i,xsl,x/l,xs2, x/2) V x £ x s l V y £ x s l V apply(xh, app2(xfl,x,y)) = app2(xf2, apply(xh, x), apply{xh, y)) 140. hom(xh,xs\,xf\,xs2,xf2) V -.dosed(xsl,x/l) V -.dosed(xs2,x/2)V ->77iaps(x/i,xsl,xs2) V / 3 2 ( x / i , x s l , x / l , x s 2 , x / 2 ) £ x s l 141. hom(xh,xs\,xfl,xs2,xf2) V-.dosed(xsl,x/l) V ->dosed(xs2,x/2)V ->maps(xh,xsl,xs2) V /33(x/i,xsl,x/1,xs2,x/2) € xsl 142. hom{xh,xs\,xf\,xs2,xf2) V ->dosed(xsl,x/l) V -ndosed(xs2,x/2)V ->maps(xh, xsl,xs2) V apply(xh,app2(xfl, /32(x/i,xsl,x/l,xs2, x/2), /33(x/i,xsl,x/1,xs2,x/2))) # app2(x/2, apply(xh, f32{xh,xsl,x/1,xs2, x/2)), apply(xh, /33(x/i, xsl, x/1,xs2, x/2)))
4.3. GROUP 3: ABSTRACT ALBEGRA DEFINITIONS / * Definition of associative system */ 143. -•assoc(xs,xf) VxgxsVygxsVzgxsV app2(xf,app2(xf,x,y),z) = app2(xf, x, app2(xf, y, z)) 144. assoc(xs,xf) V /34(xs,x/) 6 xs 145. assoc(xs,xf) V /35(xs,x/) € xs 146. assoc(xs,xf) V /36(xs,x/) £ xs 147. assoc(xs,xf)V app2(xf, opp2(x/, /34(xs, x / ) , /35(xs, x / ) ) , /36(xs, x / ) ) / app2(x/, /34(xs,x/), app2(x/, /35(xs, x / ) , /36(xs, x/))) /* Definition of identity (left and right) */ 148. ->identity(xs, xf ,xe) V xe G xs 149. ->identity(xs, x / , xe) V x £ xs V app2(xf, xe, x) = x 150. -•identity(xs,x/,xe) V x 0 xs V app2(xf,x,xe) = x 151. identity (xs, x / , xe) V xe £ xs V/37(xs, x / , xe) 6 xs 152. identity(xs, xf, xe) V xe g xs V app2(xf, xe, /37(xs, x / , xe)) ^ /37(xs, x / , xe)V app2(xf,f37(xs,xf,xe),xe) 5* f37(xs,xf,xe) / * Definition of inverse (left and right) */ 153. -maps(xg, xs, xs) V f38(xs, xf, xe, xg) £ xs 157. inverse(xs, x/, xe, xg) V -*maps(xg, xs, xs) V app2(xf, apply(xg, f3S(xs,xf,xe,xg)),f3S(xs,xf,xe,xg)) / xe Vopp2(x/, f38(xs,xf,xe,xg), apply(xg, f3&(xs,xf,xe,xg))) ^ xe
694
Collected Works of Larry Wos
/* Definition of group */ 158. -group{xs, xf) V inverse(xs, xf, /39(xs, xf), /40(xs, xf)) 162. group(xs, xf) V -commute(xs,xf) V x ft xs V t/ £ xs V app2(xf,x,y) = app2(xf, y, x) 164. commute{xs,xf) V / 4 1 ( x s , x / ) € xs 165. commu(e(is,i/) V /42(xs, x / ) € xs 166. commute(xs,xf) V app2(xf, /41(xs,x/),/42(xs, x / ) ) ^ app2(x/,/42(xs,x/),/41(xs,x/))
4.4. GROUP 4: NUMBER THEORY DEFINITIONS
/* Definition of nats (natural numbers) */ 167. z £ nats V -im(w) V 0 £ xs V /43(z, xs) £ xs V z G xs 168. 2 £ nats V ->m(xs) V 0 £ xs V succ(/43(z,xs)) & xsV z £ xs 169. 2 G Tiats V -im(z) V m(/44(2)) 170. 2 G nats V ^m(z) V 0 6 /44(z) 171. z e nats V -.m(2) V xfc £ /44(z) V succ(xk) G f44(z) 172. 2 € nats V 2 ft /44(2) /* Definition of plus */ 173. 2 £ plus V -im(xs) V /45(2, xs) 6 nats V f46(z, xs) G nats V z 6 xs 174. 2 £ pius V ->m(xs) V /45(z, xs) e nats V /47(z, xs) G nats V z G xs 175. z £ p/us V ->m(xs) V /45(z, xs) 6 nats V /48(z, xs) G nats V z € xs 176. z £ p/us V->m(xs) V/45(z, xs) G nats V ((/46(z,xs),/47(z,xs)),/48(z,xs))
e xsv z e xs 177. z £ plus V -im(w) V /45(z, xs) € nats V (( succ(/46(z,xs)),/47(z,xs)),succ(/48(z,xs))) fixsVz G xs 178. z £ p/us V -im(xs) V ((0,/45(z,xs)),/45(z,xs)) ft xs V /46(2,xs) 6 natsV z G xs 179. z gp/us V-im(xs) V ((0, /45(z,xs)),/45(z,xs)) £ xs V /47(z,xs) G natsV z G xs 180. z fLplusV ->m(xs)V((0,/45(z,xs)),/45(z,xs)) £ xs V /48(z, xs) £ natsV z£xs 181. z gplus V -im(is) V {{0, /45(z,xs)),/45{z,xs)) 0 xs V((/46(z,xs),/47(z,xs)),/48(z,xs)) G xs V z G xs 182. z £ p/us V->m(xs) V ((0, /45(z,xs)),/45(z,xs)) £ xs V ((succ(/46(z,xs)), /47(z, xs)), succ(/48(z,xs))) 0 xs V z G xs 183. z G p/us V -1)71(2) V m(/49(z)) 184. z G plus V -im(z) V i t ^ nats V ((0,xi),xi) G /49(z) 185. z G p/us V ->m(z) V uul £ nais V xj fi nats V xfc 0 nats V ((uul, xj), xk) & /49(z)V ((succ(uul),xj'),succ(xfc)) G /49(z) 186. z G plus V 2 ft /49(z)
Set Theory in First-Order
/* Definition of times */ 187. 2 £ times V -<m(xs) V /50(2,xs) 188. 2 £ times V -'TO(IS) V /50(2,is) 189. 2 £ times V -■m(xs) V /50(z, i s ) 190. 2 £ times V->m(xs) V /50(2,is)
e is v 2 e xs
695
Logic
6 nats V /51(2,xs) € nats V z € xs £ nats V /52(z,xs) G nats V z £ xs € nats V /53(2, i s ) 6 nats V 2 £ xs e nats V ((/51(z,is),/52(2,xs)),/53(2,is))
191. 2 $ times V-nn(is) V / 5 0 ( z , i s ) G nats V ((succ(/51(z,is)), /52(z, is)), app2(plus, /53(z, xs), /.r>2(2, is))) ^ i s V 2 € i s 192. 2 £ times V--m(zs) V ((0,/50(z,xs)),0) £ i s V /51(2,is) G nats V z € i s 193. 2 £ times V -.m(is) V ((0,/50(z,xs)),0) $ xs V /52(z,xs) G nats V 2 G xs 194. 2 i times V - m ( i s ) V ((0, /50(z,is)),0) ^ i s V/53(z,xs) G nats V z G xs 195. 2 /inite(i) V /57(i) € nats 210. -./inite(i) V maps(/58(x), /57(i), 1) 211. -./inite(i) V range(/58(x)) = x 212. -./inite(i) V one_one(/58(i)) 213. /inite(i) V i n £ nats V ->maps(i/, i n , x) V range(xf)
/ i V ->one.one(i/)
/* Definition of twin primes */ 214. 2 £ tuun_primes V 2 £ primes 215. 2 £ twin.primes V succ(succ(2)) 6 primes 216. 2 6 twin.primes V 2 £ primes V succ(succ(2)) £ primes /* Definition of evens (even natural numbers) */ 217. z £ evens V z 6 nats 218. z £ evens V /59(z) £ nats
Collected Works of Larry Wos
696
219. z g evens V app2(plus, /59(z), /59(z)) = z 220. z 6 evens V z ^ nats V i ^ nats V app2(ptus, x,x) ^ z
4.5.
G R O U P 5: T E S T P R O B L E M S AND O P E N Q U E S T I O N S
/* Negation of theorem: the composition of homomorphisms is a homomorphism */ 221. hom{j'60, j62,/63, J'64, J'65) 222. /iom(/61,/64,/65,/66,/67) 223. -./iom(/61 o / 6 0 , / 6 2 , / 6 3 , / 6 6 , / 6 7 ) /* Negation of theorem: {x},{({x,x),x)} is a group */ 224. m(/68) 225. ->group({f68}, {((/68, /68), /68)}) /* Negation of theorem: there is a homomorphism from a group to itself */ 226. group(f69, f 70) 227. -./iom(y, /69, /70, /69, /70) /* Negation of theorem: xx=e implies commutativity in groups */ 228. group(f 71, f 72) 229. identityU'71, j72, j73) 230. x £ /71 V app2(/72, x, x) = /73 231. ->commute(j71, /72) /* Negation of theorem: Peano axiom 0 */ 232. ->m(nats) /* Negation of theorem: Peano axiom 1 */ 233. 0 £ nats /* Negation of theorem: Peano axiom 2 */ 234. /74 e nats 235. succ(f 74) £ nats /* Negation of theorem: Peano axiom 3 */ 236. / 7 5 € nats 237. 0 = succ(/75) /* Negation of theorem: Peano axiom 4 */ 238. /76 e nats 239. / 7 7 e nats 240. succ(f 76) = succ(f 77) 241. / 7 6 / / 7 7 /* Negation of theorem: Peano axiom 5 */ 242. 0 € /78
Set Theory in First-Order
Logic
697
243. xk £ /78 V succ(xk) € /78 244. nats £ / 7 8 /* Negation of conjecture: there is an infinite number of twin primes */ 245. finite(twinjprimes) /* Negation of conjecture: Goldbach conjecture */ 246. /79 e evens 247. /79 £ {0, succ(succ(0))} 248. x £ primes V y £ primes V app2(plus, x, y) ^ /79
5
A Sample Proof
This section contains a proof of the composition-of-homomorphisms test prob lem. The entire proof (including all lemmas) was human-derived and checked mechanically. The proof proceeds in a straightforward manner, starting from the clauses in groups 1 and 2. First, a statement is conjectured. Next, the clauses from the negation of the conjecture are adjoined. After the proof search is terminated, all clauses from the negation of the conjecture and all derived clauses are erased. If a refutation is found, the clauses corresponding to (the positive form of) the conjecture are adjoined. And so on. 5.1.
U S E F U L LEMMAS
These are used in the proof and are also of general usefulness.
/* First components of equal ordered pairs are equal */ Lemma 1. (ViVj/VuVv)[m(x) Am(u) A {x,y) = (u, v) —► i = u] (proved from [6,7,9,10,11]) /* Left cancellation for non-ordered pairs */ Lemma 2. (VxVj/Vz)[m(x) A m(y) A {z, x} = {z, y} —► x = y] (proved from [6,8]) /* Second components of equal ordered pairs are equal */ Lemma 3. (VxVyVuVv)[m(x) A m(y) A m(u) A m(v) A (x, y) = (u, v) —> y = v] (proved from [9,11,320,334]) /* Two sets that contain one another are equal */ Lemma 4.(VxVj/)[x CyAyCx-*x = y) (proved from [4,5,68]) /* Property of first */
Collected Works of Larry Wos
698 Lemma 5. (VxVy)[m(x) A m(y) —> first((x,y)) (proved from [1,16,18,19,20,69,70,320,365]) /* Property of second */ Lemma 6. (VxVj/)[m(x) A m(y) —► second((x,y)) (proved from [1,21,22,23,24,25,69,70,354,365])
= x]
— y]
/* The first component of an ordered pair is small */ Lemma 7. (Vx)[opp(x) —♦ m(first(x))} (proved from [12,13,14,386]) /* The second component of an ordered pair is small */ Lemma 8. (Vx) [opp(x) —* m(second(x))] (proved from [12,13,14,409]) /* Property of singleton sets */ Lemma 9. (Vx)[m(x) —> x 6 {x}] (proved from [7,10]) /* Ordered pairs are small */ Lemma 10. (VarVy)[m({x,y»j (proved from [9,11]) Lemma 11. (Vx)[opp(x) —► m(x)] (proved from [14,439]) /* Transitivity of containment */ Lemma 12. (VxVyVz)[x CyAyCz—txCz] (proved from [68,69,70]) /* Relationship between apply and image */ Lemma 13. (Vx/Vy)[appZj/(x/, y) C sigma(image({y}, xf))] (proved from [66,69,70,94,115,116,117,118,419,429,435]) Lemma 14.(VxfWy)[sigma(image({y}, xf)) C apply(xf,y)] (proved from [6,10,64,65,69,70,90,91,92,93,119]) /* Function values are small */ Lemma 15. (VxVy)[function(y) —» m(apply(y, x))] (proved from [9,10,67,95,365,478,496]) /* The composition of two sets is a relation */ Lemma 16. (VxVy)[relation(y o x)] (proved from [15,78,79,129,130,132]) /* Range of composition */ Lemma 17. (VxVj/)[ronpe(j/ o x) C range(y)] (proved from [1,2,15,69,70,105,106,107,129,130,131,132,134,409])
Set Theory in First-Order
Logic
699
/* Domain of composition */ Lemma 18. (VxVy){rOTM?e(x) C domain(y) —* domain(x) = domain(y o x)j (proved from [1,2,9,11,12,13,14,15,35,36,37,38,68,69,70,107,129,130,131,132,133, 135,365,386,409]) /* The composition of functions is a function */ Lemma 19. (VxVy)[/unction(x) A function(y) —» function(y o x)] (proved from [80,81,82,83,84,85,86,88,89,129,130,131,132,133,134,320,354,531]) /* Maps for composition */ Lemma 20. (Vx/VxgVuVt;Vu;)[maps(x/, u,v) A maps(xg, v,w) —» maps(xg o xf, u,w)} (proved from [121,122,123,124,456,557,639,692]) /* Properties of apply for functions */ Lemma 21. (VxVyVx/)[m(x) A m(y) A function(xf) A (x,y) e xf —► apply(xf,x) (proved from [1,4,5,12,13,14,15,80,88,115,116,117,118,119,386,409]) Lemma 22. (VxVyVx/)[/unc£ion(x/) A x e domain{xf) A apply (xf, x) = y —► (x,y) e x/](proved from [2,12,13,14,35,36,37,386,754]) Lemma 23. (Vx/VxrfVxrVx)[maps(x/,xd, xr) A x e xd —» apply(xf, x) € xr] (proved from [12,13,14,35,36,37,68,107,121,122,123,386,409,508,754])
= y]
/* Properties of apply for composition of functions */ Lemma 24. (Vx/VxgVx)(/unction(x/) A x 6 domain(xf) —► apply(xg, apply(xf, x)) C apply(xg o xf,x)\ (proved from [1,2,9,11,12,13,14,15,69,70,115,116,117,118,119,135,386,409,778]) Lemma 25. (Vx/VxgVx)[/unction(x/) —► apply(xg o xf,x) C apply(xg, apply(xf, x))\ (proved from [1,15,69,70,116,117,118,119,129,130,131,132,133,134,386,409,754]) Lemma 26.(VxfVxgVx)lfunction(xf) Ax e domain(xf) —> apply(xg, apply(xf,x)) i= apply(xg o x/, x)] (proved from [365,848,884]) /* Ordered pairs are in cross products */ Lemma 27. (VxVyVxslVxs2)[x 6 xsl A y e xs2 -» (x, y) e xsl x xs2] (proved from [1,2,9,11,15,42,386,409]) /* The composition of homomorphisms is a homomorphism */ Theorem. (Vx/ilVx/i2Vx.slVxs2Vxs3Vx/lVx/2Vx/3)[/iom(x/il,xsl,x/1,xs2,x/2) iA/iom(x/i2, xs2,x/2, xs3, x/3) —► hom(xh2 o x/il, x s l , x / l , x s 3 , x / 3 ) ] (proved from [120,121,122,127,136,137,138,139,140,141,142,713,811,893,911])
5.2.
CLAUSES FOR THE LEMMAS
320. 334. 354. 365.
(lemma (lemma (lemma (lemma
1) -rm(x) V -nn(u) V {x, y) / («, v) V a: = u 2) --m(x) V ->m(y) V {2, I ) ^ { Z , I / } V I = J/ 3) ->m(x) V -w(y) V -im(u) V -<m(v) V ( x , ! / ) ^ ( U , » ) V I / = D 4)xgyVygxVx = y
Collected Works of Larry
700
Wos
386. (lemma 5) -.m(x) V ->m(y) V /irst((x, y)) = x 409. (lemma 6) ->m(x) V ->m(y) V sec<md{{x,y)) — y 419. (lemma 7) -opp(x) V m(second(x)) 435. ( l e m m a 9 ) ~>m(x) V x e {x} 439. ( l e m m a 1 0 ) m (( x >J/» 445. (lemma 11)->opp(x) Vm(x) 456. (lemma 12)x %yVy/wiction(y) V function(y o x) 713. (lemma 20) ->mops(x/,u, r) V ->maps(x<;, v, w) V maps(xg o xf,u,w) 754. (lemma 21) ->m(x) V -'ro(y) V ->function(xf) V (x, y) & xfV apply(xf, x) = y 778. (lemma 22) -^functiem(xf) V x £ domain(xf) V apply(xf, i ) / y V (x, y) € x / 811. (lemma 23) ->maps(xf, xd, xr) V i ^ i d V apply(xf, x) 6 xr 848. (lemma 24) -ifunction(xf) V x 0 domain{xf) V apply(xg, apply(xf, x)) C apply(xg o x / , x ) 884. (lemma 25) -/unction(x/) V x £ domain(xf) V apply(xg, apply(xf, x)) = apply(xg o x / , x ) 911. (lemma 27) x £ x s l Vy £ xs2 V (x,y) £ xsl x xs2
5.3.
P R O O F S O F A L L L E M M A S AND T H E
COMPOSITION-OF-HOMOMORPHISMS
THEOREM
Clause numbers from the preceding section are referenced. The notation "4. [5,6] p(a)" means that p(a) is clause 4 and is deduced from clauses 5 and 6 by binary resolution, and "4. [p,5,6] p(a)" means t h a t 4 is inferred by paramodulating 5 into 6. To make the proofs more readable, abbreviations are sometimes used for certain complex ground terms. The abbreviation list follows each proof. It is important to note t h a t abbreviations are local to each proof. L e m m a 1. (VxVyVtiVv)[m(x) A m(u) A (x, y) = {u, v) —► x = u] proved from [6,7,9,10,11] proof: 6. u £ {x, y} V u = x V u = y 7. u 6 {x, y) V --m(u) V u ^ x 9. m({x,y}) 10. {x} = {x,x}
Set Theory in First-Order
Logic
701
11. (x,y) = {{x},{x,y}} 301. (denial)m(f101) 302. {denial)m(f 103) 303. (denio0(/101,/102> =
L e m m a 2. (VxVyVz)[m(x) Am(j) A {2,a;} = {z,y} -» x = y] proved from [6,8] proof: 6. u $. {x, y} Vu = x V u = y 8. u € {x, y} V -im(ti) V u ^ y 322. (denial) m(/105) 323. (denial) m(/106) 324. (denial) {/107,/105} = {/107,/106} 325. (denial)/105 ± /106 326. [p,324,8]/105e {/107,/106} V-m(/105) 327. [p, 324,8]/106 € {/107, /105} V -m(/106) 328. [327,6] -.m(/106) V /106 = /107 V /106 = /105 329. [326,6] -m(/105) V /105 = /107 V /105 = /106 330. [p,328,329]->m(/105) V /105 = /106 V -^m{f 106) 331. [330,325] -m(/105) V -m(/106) 332. [331,323] -m(/105) 333. [332,322] D
702
Collected Works of Larry Wos
Lemma 3. (VxVyVuVv)[ra(x) A m{y) A m(u) A m(v) A {x, y) = (it, v) —» y = v] proved from [9,11,320,334] proof: 9. m({x,y}) 11. (x,y) = {{x},{x,y}} 320. (lemmal)-rm(x) V ->m(«) V (x, y) ^ («, v) V x = u 334. (iemma2)->m(x) V ->m(j/) V {z, x} ^ {z, y} V x = y 335. (denial) m(/108) 336. (denial) m(/109) 337. (denial) m(/110) 338. (denial) m ( / l l l ) 339. (denial) (/108,/109) = (/110,/111) 340. (denial) /109 / /111 341. [339,320] -m(/108) V -.m(/110) V /108 = / H O 342. [p, 341, 339] (/110,/109) = (/110,/111) V -m(/108) V ->m(/l 10) 343. \p, 11,342]{{/110}, {/110./109}} = (/110,/111) V -m(/108) V -.m(/110) 344. [p, 11, 343]{{/110}, {/HO, /109}} = {{/HO}, {/HO, /111}} V -™(/108) V-.m(/110) 345. [344,334] -m(/108) V - m ( / 1 1 0 ) V-m({/110,/109}) V - r n ( { / 1 1 0 , / l l l } ) V{/110,/109} = {/110,/111} 346. [345,334] -m(/108) V-m(/110) V--m({/110,/109}) V - m ( { / 1 1 0 , / l l l } ) V-.m(/109) V - . m ( / l l l ) V /109 = /111 347. [346,9] -.m(/108) V -.ro(/110) V ->m({/110,/lll}) V -m(/109) V - . m ( / l l l ) V/109 = / l l l 348. [347,9] -m(/108) V -.m(/110) V -m(/109) V - r o ( / l l l ) V /109 = /111 349. [348,340] -nn(/108) V -im(/110) V ->m(/109) V - i m ( / l l l ) 350. [349,335] -m(/110) V -m(/109) V - . m ( / l l l ) 351. [350,336] -.m(/110) V-.m(/111) 352. [351,337] - m ( / l l l ) 353. [352,338] D
Lemma 4. (VxVy)[x C y A y C x - » x = y] proved from [4,5,68] proof: 4. /l(x,y) € x V / l ( x , y ) 6 y V x = y 5. / l ( x , y ) £ x V / l ( x , y ) £ y Vx = y 68. xgyVu^xVugy 355. (denial)/112 C /113 356. (denial) /113 C /112 357. (denial)/l 12 ^ / 1 1 3 358. [355,68] xl <£ /112 Vxl e /113
Set Theory in First-Order
703
Logic
359. [356,68] x l £ /113 V x l € / 1 1 2 360. [357,4] / l a € /112 V / l a € /113 361. [357,5] / l a £ /112 V / l a g / 1 1 3 362. [361,358]/la 2 / 1 1 2 363. [360,359] / l a e / 1 1 2 364. [363,362] D abbreviations: / l a = /l(/112,/113)
L e m m a 5. (VxVy)[m(x) A m(y) -> first((x,y))
= x]
proved from [1,16,18,19,20,69,70,320,365] proof: 1. x= x 16. z = (/a,/5a) 374. [370,19] / l l 2 / " - . s t ( ( / l l , / 1 1 5 ) ) V / 1 7 a < E / a 375. [373,320] / l l 2 / i r s t ( ( / l l , /115» V - m ( / l l ) V -^m(fa) V / l l = / a 376. [375,372]/ll 2 /tr.st((/ll,/115)) V - . m ( / l l ) V / l l = / a 377. [ p , 3 7 6 , 3 7 ] / 1 1 2 / " - s t ( ( / l l , / 1 1 5 ) ) V / 1 7 a e / l l V - ' m ( / l l ) 378. [377,371]/11 g first({fUJ115)) V ^m(/ll) 379. [378,69] - m ( / l l ) V /17fe e / l l 380. [378,70] - m ( / l l ) V /176 0 / i r s i ( ( / l l , / 1 1 5 ) ) 381. [380,20] - 1 m ( / l l ) V - > m ( x l ) V - . m ( x 2 ) v ( / l l , / 1 1 5 ) # (xl,x2) V /176 £ xl 382. [381,1] - m ( / l l ) V -m(/115) V /176 £ / l l 383. [382,379] - m ( / l l ) V-m(/115) 38 . [383,366) -.m(/115) 385. [38 ,367] O abbreviations: /17a = / 1 7 ( / i r S t ( ( / l l , / 1 1 5 ) ) , / l l )
Collected Works of Larry Wos
704
/a = /(/17a,(/ll,/115» /5a = / 5 ( / 1 7 a , { / l l , / 1 1 5 » /176 = / 1 7 ( / l l , / i r s t ( ( / l l , / 1 1 5 » )
Lemma 6. (VxVy)[m(x) A m(y) -» second((x,y))
= y]
proved from [1,21,22,23,2 ,25,69,70,35 ,365] proof: 1. x= x 21. z i second(x)Vm(f6(z,x)) 22. z £ second(x) V m(/7(z, x)) 23. z £ second(x) V x = (/6(z,x), /7(z,x)) 2 . z 0 secorwi(x) V z e /7(z, x) 25. z € second(x) V -■m(u) V -<m(v) V i / ( u , u ) V 2 ^ » 69. xCyV fl7(x,y) e x 70. xCyV fl7(x,y)(?y 35 . (lemma 3) ->m(x) V -im(y) V ->m(u) V -^m^) V (x, y) ^ (u,v) V y =v 365. (lemma ) x g y V y g x V x = y 387. (denial)m(/116) 388. (denial) ro(/117) 389. (denial)second((/116,/117)) # / 1 1 7 390. [389,365] second((/l 1 6 , / l 17)) g /117 V /117 g second({f 116, f 117)) 391. [390,69] /117gsecond((/116,/117)) V / 1 7 a € second((/116,/117)) 392. [390,70] /117 g second((/116,/117)) V /17o £ /117 393. [391,21] /117 g second((/116, /117)) V m(/6o) 394. [391,22] /117 g second(m(/117) 407. [406,387] -.m(/117) 408. [407,388] D
Set Theory in First-Order
Logic
abbreviations: /17a = /17(secoruf({/116,/117)),/117) /6a = /6(/17a,(/116,/117}) / 7 a = /7(/17a,(/116,/117» /176 = /17(/117, secemd((/116,/117)))
L e m m a 7. (Vx)[opp(x) -
m(first{x))]
proved from [12,13,14,386] proof: 12. -.opp(x)Vm(/2(x)) 13. ->opp(x) Vm(/3(x)) 14. -opp(x)Vx=(/2(x),/3(x)) 386. (lemma 5) ->m(x) V ->m(y) V first((x,y)) = x 410. (denial) opp(/118) 411. (denial) -m(/irst(/118)) 412. [410,12] m(/2(/118)) 413. [410,13] m(/3(/118)) 414. [410,14]/118 = {/2(/118),/3(/118)) 415. [p,414,386] -m(/2(/118)) V -m(/3(/118)) V first(fUS) 416. [p,415,411] -.ro(/2(/118))V^m(/3(/118)) 417. [416,412] -.m(/3(/118)) 418. [417,413] O
= /2(/118)
L e m m a 8. (Vx)[opp(x) —> m(second(x))] proved from [12,13,1 , 09] proof: 12. -•opp(x) Vm(/2(x)) 13. -*opp(x) V m(/3(x)) 1. -opp(x)Vx=(/2(x),/3(x)> 09. (iemma6)-im(x) V ->m(t/) V second((x,y)) = y 20. (denial) opp(f 119) 21. (denial) ->m(second(/119)) 22. [20,12] m(/2(/119)) 23. [20,13] ro(/3(/119)) 2. [20,l]/119=(/2(/119),/3(/119)> 25. (p, 2 , 09] -.m(/2(/119)) V -.m(/3(/119)) V second(f119) = /3(/119) 26. (p,25,21]^m(/3(/119)) V -m(/2(/119)) 27. [ 26, 22] -.m(/3(/119)) 28.
[ 27, 23] D
706
Collected Works of Larry Wos
L e m m a 9. (Vx)[m(x) - x € {x}] proved from [7,10] proof: 7. -u € {x, y} V ->m(u) V u / i 10. {x} = {x,x} 30. (denial) ro(/120) 31. (denial)/120 0 {/120} 32. [p, 10,31]/120£{/120,/120} 33. [ 32,7] -.m(/120) 3 . [33, 30] D
L e m m a 10. (VxVy)[m«x,y»] proved from [9,11] proof: 9. ro({x,y}) 11. <x,y) = {{x},{x,y}} 36. (denial) -m((/121,/122)) 37. [p, 11, 36]-m({{/121}, {/121, /122}}) 38.
[ 37,9] D
Lemma 11. (Vx)[opp(x)->m(x)] proved from [1 , 39] proof: 14. -^opp(x) V x = (/2(x), /3(x)) 439. (lemma 10) m((x,y)) 440. (denial)opp(/123) 441. (denial)-m(/123) 442. [440,14)/123 = (/2(/123),/3(/123)) 443. [p,442,441]-.m«/2(/123),/3
L e m m a 12. (VxVyVz)[x C j A j C j - t i C z ] proved from [68,69,70]
Set Theory in First-Order
Logic
707
proof: 68. xgyVu^xVuey 69. i C yV/17(x,y) € x 70. x C y V / 1 7 ( x , y ) £ y 446. (denial) /124 C /125 447. (denial) /125 C /126 448. (denial) /124 % /126 449. [446,68] x l £ /124 V xl 6 /125 450. [447,68] x l g /125 V xl € /126 451. [448,69] /17(/124,/126) 6 /124 452. [448,70] /17(/124, /126) g /126 453. [449,451] /17(/124,/126) € /125 454. [453,450]/17(/124,/126) e /126 455. [454,452] D
L e m m a 13. {VxfVy)[apply(xf,y)
C sigma(image({y},
x/))]
proved from [66,69,70,94,115,116,117,118,419,429,435] proof: 66. z € sigma(x) VygxVzgy 69. x C y V/17(x,y) e x 70. x C y V / 1 7 ( x , y ) £ y 94. z g image(x, xf) V -^m(z) V ~*opp(y) V J ^ I / V firstly) £ x V secondly) / z 115. z 0 apply(xf, y) V opp(/28(z, x/, y)) 116. z £ apply(xf, y) V /28(z, x/, y) 6 x / 117. z g apply(xf, y) V first(f28(z, xf, y)) = y 118. z 0 apply(xf, y)V z £ second(f28(z, xf, y)) 419. (lemma 7) ->opp(x) V m(/irst(x)) 429. (lemma 8) -•opp(x) V m(second(x)) 435. (lemma 9) ->m(x) V x 6 {x} 457. (denial)app/y(/127, /128) 2 sioma(tmage({/128}, /127)) 458. [457,69] /17a e apply(f 127, /128) 459. [457,70] /17a £ szyma(tmage({/128}, /127)) 460. [458,115] opp(/28a) 461. [458,116] /28a £ /127 462. [458,117] first(f28a) = /128 463. [458,118]/17a € sea>nd{/28a) 464. [459,66] xl $ imaoe({/128}, /127) V /17a £ xl 465. [464,94] /17a £ second(x2) V ->m(second(x2)) V ->opp(x2) V x2 £ /127 Vfirst(x2) ecoruf(/28a)) V -.opp(/28a) V /28a £ /127 V/irst(/28a) £ {/irst(/28a)} 473. [472,435] -.m(second(/28a)) V -opp(/28a) V /28a £ /127 V-.m(/irs«(/28a))
Collected Works of Larry Wos
708
474. [473,419] -.m(second(/28a)) V -iopp(/28a) V /28a g /127 475. [474,429] -.opp(/28a) V /28a £ /127 476. [475,460] /28a £ /127 477. [476,461] □ abbreviations: /17a = /17(app/y(/127, /128), sigma(image({f 128], /127))) /28a = /28(/17a,/127,/128)
Lemma 14. (VxfVy)[sigma(image({y},
xf)) C
apply(xf,y)]
proved from [6,10,64,65,69,70,90,91,92,93,119] proof: 6. u & {x, J / } V U = X V U = J/
10.
{x}={x,x}
64. z £ sigma(x) V /16(z,x) e x 65. z £ sigma(x) V z 6 /16(z, x) 69. x C y y J\7(x,y) e x 70. x C y V / 1 7 ( x , y ) £ y 90. z £ image(x, xf) V opp(/22(z, x, x / ) ) 91. z opp(w) V w & xf V first(w) ^yVz& second(w) 479. (denia/)sigma(ima5e({/130}, /129)) 2 app/j/(/129, /130) 480. [479,69]/17a 6 sioma(imaoe({/130}, /129)) 481. [479,70]/17a £ apply(fl29, /130) 482. [480,64]/16a G tmape({/130},/129) 483. [480,65]/17a € /16a 484. [481,119] ->opp(xl) V xl £ /129 V / t r s t ( x l ) ^ /130 V /17a £ second(xl) 485. [482,90] opp(/22a) 486. [482,91]/22a G /129 487. [482,92]/irst(/22a) € {/130} 488. [482,93] second(/22a) = /16a 489. [484,485]/22a £ /129 V first(f 22a) ^ /130 V /17a £ second(f22a) 490. [489,486] /irst(/22a) ^ /130 V /17a £ second(f22a) 491. [p, 488, 490]/irsc(/22a) ^ /130 V /17a £ /16a 492. [491,483]/irs£(/22a) ? /130 493. [p, 10,487]/irst(/22a) e {/130, /130} 494. [493,6] first(f22a) = /130 495. [494,492] D abbreviations: /17a = /17(sigma(imaoe({/130}, /129)), apply(f 129, /130)) /16a = /16(/17a, imaoe({/130}, /129)) /22a = /22(/16a, {/130},/129)
Set Theory in First-Order
Logic
L e m m a 15. (VxVy)[function(y)
-> m(apply(y, x))}
proved from [9,10,67,95,365,478,496] proof: 9. m({z,»}) 10. {x} = {x,x} 67. ->m(u) V m(sigma(u)) 95. -■m(x) V -ifunctiori(xf) V m(image(x, x/)) 365. {lemmaA)x g yV y g xV x = y 478. (/emmal3)app/y(x/, y) C sigma(ima<7e({i/}, x / ) ) 496. (Iemmal4)sigma(image({y}, xf)) C apply(xf,y) 497. (denial) /tmctton(/132) 498. (denial) -m(app/j/(/132,/131)) 499. [478,365] si3ma(tmage({xl}, x2)) g apply(x2, xl) V apply(x2, xl) = sipma(image({xl}, x2)) 500. [499,496] appty(xl, x2) = sigma{image({x2}, xl)) 502. [p,500,498]-.m(stgma(image({/131}, /132))) 503. [502,67] -vn(image({/131},/132)) 504. [503,95]-m({/131}) V ^function(f 13,2) 505. [504,497]-m({/131}) 506. [p, 10,505]-m({/131,/131}) 507. [506,9] D
L e m m a 16. (VxVj/) [relation(y o x)] proved from [15,78,79,129,130,132] proof: 15. opp(x) V -.m(v) V -nm(z) V i / ( y , z ) 78. re/ation(z) V /18(z) € z 79. re/ation(z) V -x>pp(/18(z)) 129. z
710
Collected Works of Larry Wos
abbreviations: /18a = /18(/136 o /135) /29a = /29(/18a,/135,/136) /30a = /30(/18a,/135,/136)
L e m m a 17. (\/xVy)[range(y o x) C ranpe(y)] proved from [1,2,15,69,70,105,106,107,129,130,131,132,134,409] proof: 1. x = x 2. x & y V m(x) 15. opp(x) V ->m(y) V -'m(z) V i / ( t / , z) 69. x C y V/17(x,y) 6 2 70. x C y V / 1 7 ( x , y ) £ y 105. 2 0 ranpe(x) V /27(z,x) G x 106. z £ ranpe(x) V z = second(/27(z,x)) 107. z e range(x) V -im(z) V -m(/17a) V -.opp(xl) V xl £ /138 V /17a ^ aecond(xl) 545. [544,543] -.m(/17a) V -.opp((/31a, /30a)) V /17a /second((/31a,/30a)) 546. [p, 409,545] -mi(f 17a) V -.opp((/31a, /30a)) V /17a ^ /30a V -im(/31a) V -.m(/3C 547. [p,541, 537]/17a = second((/29a,/30a)) 548. [p, 409,547]/17a = /30a V -ro(/29a) V --m(/30a) 549. [548,546] ->m(/29a) V -m(/30a) V -.m(/17a) V -.opp((/31a, /30a)) V --m(/31a) 550. [549,15] ^m(/29a) V -.m(/30a) V - w ( / 1 7 a ) V - m ( / 3 1 a ) V -.m(xl) V-.m(x2) V (/31a,/30a) ^ (xl,x2) 551. [550,1] -.m(/29a) V - m ( / 3 0 a ) V - m ( / 1 7 a ) V - w ( / 3 1 a ) 552. [551,538] ->m(/30a) V -m(/17a) V -.m(/31a) 553. [552,539]-.m(/17a) V -^m(/31a)
Set Theory in First-Order
Logic
554. [553,540] -m(/17o) 555. [554,2] /17a g xl 556. [555,533] D abbreviations: /17a = /17(range(/138 o /137),range(/138)) /27a = /27(/17a,/138 o /137) /29a = /29(/27a, /137, /138) /30a = /30(/27a, /137, /138) /31a = /31(/27a, /137, /138)
L e m m a 18. (VxVy)[range(i) C domain(y) —» domain{x) = domain(y o x)] proved from [1,2,9,11,12,13,14,15,35,36,37,38,68,69,70,107,129,130,131,132,133, 135,365,386,409] proof: 1. x = x 2. x£yVm(x) 9. m{{x,y}) 11. (x,y) = {{x},{x,y}} 12. ->opp(x)Vm(/2(x)) 13. -opp(x) V m(/3(x)) 14. -iopp(x)Vx=(/2(x),/3(x)> 15. opp(x) V ->Tn(j/) V -rn(z) V x ^ (y, 2) 35. z £ domain(x) V opp(/8(z, x)) 36. z £ domain(x) V /8(2, x) € x 37. 2 £ d"omatn(x) Vz — first(f8(z,x)) 38. 2 € domain(x) V --m(2) V -iopp(xp) V xp £ x V z ^ first(xp) 68. xgyVu^xVuty 69. x C y V/17(x,y) e x 70. xCyv/17(x,y)£y 107. 2 € range(x) V -1771(2) V -*opp(xp) V xp £ x V 2 / second(xp) 129. 2 £ x g o x / V m ( / 2 9 ( 2 , x / , x a ) ) 130. 2 g x g o x / Vm(/30(z,x/,xg)) 131. z g x g o x / V m ( / 3 1 ( 2 , x / , x g ) ) 132. 2 £ xg o x / V 2 = (/29(2, x/, xg), /30(2, x/, xg)) 133. 2 <£ xg o x / V {/29(2, x/, xg), /31(z, x/, xg)) 6 x / 135. 2 € xg o x / V ^771(2) V -.m(x) V ^m(y) V ~m{w) V z ^ (x,y) V {x, w) £ x / V(w,y) £ x g 365. (lemma 4 ) x g y V y g x V x = y 386. (lemma 5) -.m(x) V -*m(y) V first({x, y)) = x 409. (lemma 6)->m(x) V -w(y) V second((x,y)) = y 558. (denial) range(fl3'j) C domain(f 140) 559. (denial)domatn(/139) ^ do7Tiain(/140 o /139) 560. [559,365] domain{f 139) g domain(/140 o /139) V damain(f 140 o /139) g domam(/139)
711
712
Collected Works of Larry Wos
562. [560,69] domain(/139) 2 domain(/140 o /139) V /17a € domain(/140 o /139) 563. [560,70] domatn(/139) g domain(/140 o /139) V /17a g domain(j139) 565. [562,36] adomain(/139) 2 domain(/140 o /139) V / 8 a € /140 o /139 566. [562,37] domain(/139) 2 domam(/140 o /139) V /17a = first(f8a) 567. [565,129]domain(/139) 2 domam(/140 o /139) V m(/29a) 568. [565,130]domain(/139) 2 domain(/140 o /139) V m(/30a) 569. [565,131] domain(/139) 2 domam(/140 o /139) V jn(/31a) 570. [565,132] domain(/139) 2 domam(/140 o /139) V / 8 a = (/29a,/30a) 571. [565,133] domain(f 139) 2 domain(/140 o /139) V (/29a,/31a) e /139 573. [563,38] domain(/139) 2 domain(/140 o /139) V -m(/17a) V ->opp(xl) V xl $ } V/17a ^ firsl(xl) 574. [573,571]domain(/139) 2 domain(/140 o /139) V -m(/17a) V-.opp((/29a, /31a)) V /17a ^ first((/29a, /31a)) 575. [p, 570, 566]domain(/139) 2 domain(/140 o /139) V /17a = /trst((/29a, /30a)) 576. [p, 386, 574]domain(/139) 2 domam(/140 o /139) V -.m(/17a) V-iopp((/29a, /31a)) V /17a ^ /29a V --m(/29a) V -.m(/31a) 577. [p,386, 575]domatn(/139) 2 domain(/140 o /139) V /17a = /29a V-.m(/29a) V -^m(/30a) 581. jp,577,576]domam(/139) 2 domam(/140 o /139) V -.m(/29a) V-.opp((/29a,/31a)) V -.m(/31a) V -.m(/30a) 582. [581,15] domatn{/139) 2 domam(/140 o /139) V -^n(/29a) V -.m{/31a) V-.m(/30a) V -.m(il) V -.m(x2)V (/29a,/31a) ^ (xl,x2) 583. [582,ljdomam(/139) 2 domam(/140 o /139) V -.ro(/29a) V-.m(/31a) V -.m(/30a) 584. [583,567]domain(/139) 2 domain(/140 o /139) V -.m(/31a) V -.m(/30a) 585. [584,568]domain(/139) m(/26) V --m(xl) V ->m(x2)
Set Theory in First-Order
Logic
713
V(/2b,/3b)^(xl,x2) 610. [609,l]/3b e domain(fUO) V -.m(/3b) V -.m(/2b) 611. [610,35] -.m(/36) V -.m(/2b) V opp{f8c) 612. [610,36] -.m(/3b) V ->m(/2fc) V /8c 6 /140 613. [610,37]-.m(/36) V -m(/2b) V /3b = /irst(/8c) 614. [611,12]-.m(/3b) V ^m(/2b) V m(/2c) 615. [611,13] -.m(/3b) V -w(/2b) V m(/3c) 616. [611,14] -im(/36) V -w(/2b) V /8c = (/2c, /3c) 617. [p, 616,613]-.m(/3b) V ->m(/2b) V /3b = first((/2c, /3c)) 618. [p, 386,617]-ro(/3b) V -.m(/2b) V /3b = /2c V - w ( / 2 c ) V - m ( / 3 c ) 621. [597,135] -.m(/17b) V -. 0 pp((x2,x3)) V /17b ^ /irst((x2,x3)) V -.m«x2,x3)) V-.m(x2) V -ro(x3) V -w(x4) V (x2, x4) £ /139 V (x4, x3) $ /140 622. [p, 594, 590] (/2b, /3ft) € /139 623. [p, 616,612]-m(/3b) V -m(/2b) V (/2c, /3c) e /140 624. [p, 618,623]-m(/36) V -w(/2b) V (/3b, /3c) e /140 V - m ( / 2 c ) V ^m(/3c) 625. [621,622] ->m(/17b) V -iopp({f2b, xl)) V /17b jt first({f2b, xl)) V -.m((/2b, xl)) V-m(/2b) V ^m(xl) V -.m(/3b) V (/3b, xl) £ /140 626. [625,624] -m(/17b) V -.opp«/2b, /3c)) V /17b ^ first({f2b, /3c )) V -m((/2b, /3c)) V -w(/2b) V - m ( / 3 c ) V -,m(/3b) V -m(/2c) 627. [p, 386,626]-m(/17b) V -nopp((/2b, /3c)) V /17b ^ /2b V ->m((/2b, /3c)) V-1m(/26) V -m(/3c) V -.m(/36) V -.m(/2c) 628. [627,596]-m(/17b) V -nopp((/2b, /3c)) V -.m((/2b, /3c)) V -m(/2b) V-.m(/3c) V -m(/3b) V -.m(/2c) 629. [628,15] -ro(/17b) V -w((/2b,/3c)) V -.m(/2b) V -^m(/3c) V -m(/3b) V -.m(/2c) V^m(xl) V -m(x2) V (/2b, /3c) ^ (xl, x2) 630. [629,1] -.m(/17b) V -m((/2b, / 3 c » V -rm(j2b) V -.m(/3c) V -nm(/3b) v -.m(/2c) 631. [p, ll,630]-.m(/17b) V -m({{/2b}, {/2b, /3c}}) V -w(/2b) V -m(/3c) V -im(/3b) V-.m(/2c) 632. [631,9]->m(/17b) V -m(/2b) V - m ( / 3 c ) V -.m(/3b) V -.m(/2c) 633. [632,614] -.m(/17b) V -,m(/2b) V -.m(/3c) V -m(/3b) 634. [633,615] -.m(/17b) V-.m(/2b) V-m(/3b) 635. [634,592]-m(/17b) V -vn(/3b) 636. [635,593] -m(/17b) 637. [636,2] /17b g xl 638. [637,587] D abbreviations: /17a =/17(domain(/140 o /139), aomain(/139)) /8a = /8(/17a,/140 o /139) /29o = /29(/8a, /139, /140) /30o = /30{/8o, /139, /140) /31a = /31(/8a, /139, /140) /17b = /17(domain(/139),domain(/140 o /139)) /8b = /8(/17b,/139) /2b = /2(/8b) /3b = /3(/8b) /8c = /8(/3b, /140) /2c = /2(/8c)
Collected Works of Larry Wos
714
/ 3 c = /3(/8c)
Lemma 19. (VxVy)[/wnction(i) A function(y)
—» function(y
o x)]
proved from [80,81,82,83,84,85,86,88,89,129,130,131,132,133,134,320,354,531] proof: 80. -<sing.val(x) V ->m(w) V -im(«) V ->m(iu) V (u, v) ^ I V ( M , I B ) ^ i V « = i» 81. sing.val(x) Vm(/19(i)) 82. sino-i;ai(x) V m(/20(x)) 83. szri0_i>ai(x) V m(/21(x)) 84. sing-val(x) V (/19(x),/20(x)) € x 85. stna.wi/(x) V (/19(x), /21(x)) e x 86. sino.va{(x) V /20(x) ^ /21(x) 88. ->function(xf) V sing-val(xf) 89. function(xf) V -ire/a£ton(x/) V ->sing-val(xf) 129. z ^ i j o i / V m ( / 2 9 ( 2 , i / , i j ) ) 130. z j ^ i j o i / V m(/30(z, x / , xo)) 131. z 0 x g o x / V m ( / 3 1 ( 2 , x / , x p ) ) 132. z$xg o xfVz = (f29(z,xf,xg), f30(z,xf,xg)} 133. z#xg o x / v ( / 2 9 ( . z , x / , x o ) , / 3 1 ( z , x / , x a ) ) e xf 134. z ^ i j o x / V ( / 3 1 ( z , x / , x o ) , / 3 0 ( z , x / , x a ) ) e xg 320. (lemma 1) ->m(x) V -im(u) V (x, j/> ^ ( « , i ) ) V i = u 354. (lemma 3)->m(x) V -im(j/) V ->m(u) V -iTn(v) V (x, y) ^ (u, v) V y = v 531. (lemma l6)relation(y o x) 640. (denial) function(f 141) 641. (denial)/tmctton(/142) 642. (denial)-i/unctton(/142 o /141) 644. [640,88] sing,val(f141) 646. [641,88]smg-wi/(/142) 647. [642,89] -nre/a
Set Theory in First-Order
Logic
715
663. [653,131]m(/316) 664. [653,132] (/19a,/21a) = (/29fe,/30b) 665. [653,133] (/296,/316) € /141 666. [653,134] $ /141 V (xl, x3) $ / H I V x2 = x3 668. [646,80] -nn(xl) V -m(x2) V -.m(x3) V (xl,x2) g / 1 4 2 V (xl,x3) g / 1 4 2 V x 2 = x3 669. [658,320] -.m(/19a) V -m(/29a) V /19a = /29a 670. [658,354] ^m(/19a) V -m(/20a) V -nm(/29a) V ->m(/30a) V /20a = /30a 671. [664,320]-m(/19a) V -m(/29b) V /19a = /296 672. [664,354]-m(/19a) V ^m(/21a) V -m(/29b) V -m(/306) V /21a = /30b 673. [p, 669,659] (/19a,/31a) £ /141 V -.m(/19a) V -m(/29a) 674. [p,671,665](/19a, /316) £ /141 V -m(/19a) V -.m(/29b) 675. [673,667] -.m(/19a) V -.m(/29a) V -.m(/31a) V - m ( x l ) V (/19a, xl) $ /141V /31a = xl 676. [675,674] -m(/19a) V -m(/29a) V -m(/31a) V -ro(/31b) V /31a = /31b V ^m(/296) 677. [p,676,660](/316, /30a) € /142 V -.m(/19a) V -m(/29a) V-m(/31a) V -m(/31b) V -m(/296) 678. [677,668] -m(/19a) V -m(/29a) V -m(/31a) V -m(/316) V -m(/296) V-m(/30a) V -.m(xl) V (/31fe,xl) £ /142 V /30a = x l 679. [678,666] -m(/19a) V -nm(/29a) V -im(/31a) V -.m(/31b) V -m(/296) V-.m(/30a) V ->m(/306) V /30a = /30b 680. [p,670,679]-m(/19a) V -m(/29a) V ^m(/31a) V -,m(/31b) V -<m(/296) V-im(/20a V -^m(/30b) V /20a = /30b V -m(/30a) 681. \p, 672,680]-m(/19a) V ^m(/29a) V ^ro(/31a) V ^m(/31b) V ^m(/29b) V - m ( / 2 0 a ) V-m(/21a) V /20a = /21a V -m(/30a) V -.m(/30b) 682. [681,654] -m(/19a) V -w(/29a) V -.m(/31a) V ->m(/31b) V -m(/296) V -m(/20a) V-.m(/21a) V -.m(/30a) V -w(/30b) 683. [682,649] -w(/29a) V -.m(/31a) V -m(/31b) V -m(/29b) V -.m(/20a) V -im(/21a) V-.m(/30a) V ->m(/30b) 684. [683,650] -m(/29a) V -m(/31a) V -m(/31b) V ^m(/296) V -m(/21a) V -.m(/30a) V-m(/306) 685. [684,651] -m(/29a) V -w(/31a) V -m(/31fe) V -.m(/29b) V -m(/30a) V -.m(/30b) 686. [685,655] -.m(/31a) V -m(/316) V -m(/29b) V -m(/30a) V -w(/30b) 687. [686,656] -.m(/31a) V -m(/31b) V - T O ( / 2 9 6 ) V -m(/30b) 688. [687,657] -im(/31b) V -m(/29b) V -.m(/30b) 689. [688,661] --m(/31b) V -m(/30b) 690. [689,662] -.m(/31b) 691. [690,663] D abbreviations: /19a = /19(/142 o /141) /20a = /20(/142 o /141) /21a = /21(/142 o /141) /29a = /29((/19a, /20a), /141, /142) /30a = /30((/19a, /20a>, /141, /142) /31a = /31((/19a, /20a), /141./142) /29b = /29((/19a, /21a), /141, /142) /30b = /30((/19a, /21a), /141, /142)
716
Collected Works of Larry
Wos
/316 = /31((/19a,/21a),/141,/142)
L e m m a 20. (Vx/Vx<7VuVvVw)[maps(x/,u, v) A maps(xg, v, w) —> maps(xj o xf,u, w)] proved from [121,122,123,124,456,557,639,692] proof: 121. ->maps(xf, x, j/) V function(xf) 122. -*maps(xf, x, y) V domain(xf) = x 123. ->maps(xf, x, y) V range(xf) C j/ 124. maps(xf,x,y) V ->function(xf) V domain(xf) ^ x V range(xf) 2 y 456. (lemma 12)x g y V j / g z V x C z 557. (lemma 17) ranfunction(fl44) 704. [703,696] domain(f 144 o /143) ^ /145 V range(f 144 o /143) 2 /147 V-i/unc
Lemma 21. ( VxVyVx/)[m(x) A m(y) A function(xf)
A (x, y) € xf -+ apply(xf, x) = y]
proved from [1,4,5,12,13,14,15,80,88,115,116,117,118,119,386,409] proof:
Set Theory in First-Order Logic 1.
717
X= X
4. /l(x,y)GxV/l(x,y)GyVx = y 5. /l(x,y)£xV/l(x,y)0yVx = y 12. ->opp(x) V m(/2(x)) 13. ->opp(x) V m(/3(x)) 14. - o p p ( x ) V x = ( / 2 ( x ) , / 3 ( x ) ) 15. opp(x) V -*m(y) V -<m(z) V x ^ (y, 2) 80. -isingjval(x) V ->Tn(u) V -rn(r) V ->m(u;) V (u, v) ^ i V ( t i , m ) ^ i V « = u 88. -■function(xf) V sing.val(xf) 115. 2 ^appiy(x/,y)Vopp(/28(2,x/,y)) 116. z ^ a p p i y ( x / , y ) V / 2 8 ( 2 , x / , y ) e x / 117. 2 £ apply(xf, y) V first(/28(z, xf, y)) = y 118. z & apply(xf,y)V z G second(f28(z,xf,y)) 119. 2 e apply(xf, y) V ->opp(ti;) V t u ^ i / V first(w) -£yV z $. second(w) 386. (lemma 5) ->m(x) V -im(y) V first((x,y)) = x 409. (lemma 6)->m(x) V ->m(y) V second((x,y)) = y 714. (denial) m(/148) 715. (denial)m(/149) 716. (denial)/tmctton(/150) 717. (denial) (/148,/149) G /150 718. (denial) app«y(/150, /148) ^ /149 719. [716,88] sing-ua*(/150) 720. [719,80]-m(xl) V -nm(x2) V ^m(x3) V (xl,x2) £ /150 V (xl,x3) £ /150 V x2 = x3 721. [720,717]-.m(/148) V -w(/149) V -.m(xl) V (/148, xl) £ /150 V /149 = x l 722. [718,4]/la € app/y(/150, /148) V / l a G /149 723. [718,5]/la <j£ app/y(/150, /148) V / l a £ /149 724. [722,115]/la G /149 V opp(/28a) 725. [722,116]/la G /149 V /28a G /150 726. [722,117]/lo G /149 V first(f28a) = /148 727. [722,118]/la G /149 V / l a € second(f28a) 730. [723,119]/la £ / 1 4 9 V-.opp(xl) V x l £ /150 V / t r s t ( x l ) ^ /148 V / l a ^ aecond(xl) 731. [724,12] / l a G /149 V m(/2a) 732. [724,13] / l a G /149 V m(/3a) 733. [724,14] / l a G /149 V /28a = (/2a, /3a) 734. [p, 733,725]/la G /149 V (/2a, /3a) G /150 735. [p,733,726]/laG /149 V first((/2a, /3a)) = /148 736. [p,733,727]/la G /149 V / l a 6 second((/2a,/3a)) 737. [p, 386,735]/la G /149 V / 2 a = /148 V - m ( / 2 a ) V - m ( / 3 a ) 738. [p,737,734)/la G /149 V (/148,/3a) G /150 V - m ( / 2 a ) V - m ( / 3 a ) 739. [738,721] / l a G /149 V -.m(/2a) V -.m(/3a) V ^ro(/148) V -.m(/149) V /149 = / 3 a 740. [730,717]/la £ /149 V -opp((/148, /149)) V /irst((/148, /149)) # /148 V / l a g seccmd{{f 148, /149)) 741. [p,386,740]/la £ /149 V -^opp((/148,/149)) V / l a £ second((/148,/149)) V-.m(/148) V -.m(/149)
742. \p, 409,741]/la 0 /149 V -,opp((f 148, /149)) V -im(/148) V ->m(/149) 743. [742,15] / l a £ /149 V -.m(/148) V ->m(/149) V -ro(xl) V -.m(x2) V (/148, /149) jt(il,x2>
718
Collected Works of Larry Wos
744. [743,l]/la g /149 V -m(/148) V ^m(/149) 745. [p,409,736]/la e /149 V / l a e /3a V -nro(/2a) V -im(/3a) 746. [p, 739,745]/la € /149 V ->m(/2a) V ^m(/149) V ^m(/3a) V -.m(/148) 747. [746,744] - m ( / 2 a ) V -.m(/149) V -<m(/3a) V -.m(/148) 748. [744,731] ^m(/148) V -m(/149) V m(/2a) 749. [744,732] -.m(/148) V -.m(/149) V m(/3a) 750. [747,748] -.m(/149) V -.m(/3a) V -.m(/148) 751. [750,749] -.m(/149) V -.m(/148) 752. [751,714] -.m(/149) 753. [752,715] □ abbreviations: / l a = /l(app/y(/150,/148),/149) /28a = / 2 8 ( / l a , / 1 5 0 , / 1 4 8 ) / 2 a = /2(/28a) / 3 a = /3(/28a)
L e m m a 22. (VxVyVx/)[/unrfion(x/) A x € domain(xf)
A apply(xf, x) = y —» (x, y) € xf]
proved from [2,12,13,14,35,36,37,386,754] proof: 2. i ^ y V m(x) 12. -*opp(x) v ro(/2(x)) 13. ^opp(x) V m(/3(x)) 14. -opp(x)Vx = (/2(x),/3(x)) 35. z g domain(x) V opp(/8(z, x)) 36. z & domain(x) V /8(z,x) 6 x 37. 2 £ a'omttin(x) V z = first(f8(z,x)) 386. (/emma5)-.m(x) V ->m(y) V /irs«((x, y)) = x 754. (lemma 21)->m(x) V ->m(y) V -^function(xf) V (x, y) £ x / V apply(xf, x) = y 755. (denial) function(f 153) 756. (denial)/151 6 domain(f 153) 757. (denial)appiy(/153,/151) = / 1 5 2 758. (denial)(/151, /152) g /153 759. [756,35]opp(/8a) 760. [756,36]/8a e /153 761. [756,37]/151 = / i r s i ( / 8 a ) 762. [759,12]m(/2a) 763. [759,13] m(/3a) 764. [759,14]/8a= (/2a,/3a> 765. [p, 764, 760](/2a, /3a) 6 /153 766. [p,764,761]/151 = / i r s t ( ( / 2 a , / 3 a ) ) 767. [p, 386, 766J/151 = / 2 a V -.m(/2a) V - 1 m(/3a) 768. [p,757,758](/151,appjy(/153,/151)) £ /153 769. [p. 767,765](/151, /3a) e /153 V -.m(/2a) V -.m(/3a) 770. [769,754]--m(/2a) V -.m(/3a) V ^m(/151) V ^function(f 153)
Set Theory in First-Order
Logic
Vapp/y(/153,/151) = /3a 771. [p, 770,768]{/151, /3a) £ /153 V --m(/2a) V ->m(/3a) V -.m(/151) V->/unction(/153) 772. [771,769] ^m(/2a) V - m ( / 3 a ) V -^m(/151) V -./unction(/153) 773. [772,755] - m ( / 2 a ) V -.m(/3a) V -m(/151) 774. [773,762]-m(/3a)V-m(/151) 775. [774,763]->m(/151) 776. [775,2]/151 £ xl 777. [776,756] D abbreviations: / 8 a = /8(/151,/153) /2a = / 2 ( / 8 a ) /3a = /3(/8a)
L e m m a 23. (VxfVxdVxrVx)[maps(xf,xd,
xr) A x 6 xd —► apply(xf, x) € xr]
proved from [12,13,14,35,36,37,68,107,121,122,123,386,409,508,754] proof: 12. ^opp(x) V m(/2(x)) 13. ^opp(x) V ro(/3(x)) 14. -.opp(x)Vx=(/2(x),/3(x)) 35. z £ domain(x) V opp(/8(2, x)) 36. z £ domain(x) V /8(2, x) € x 37. 2 £ domain(x) V z = first(fS(z,x)) 68. xgyVu^xVuGy 107. 2 e ranpe(x) V ->Tri(z) V ->opp(xp) V xp £ x V 2 ^ second(xp) 121. -imaps(x/, x, y) V function(xf) 122. -vmaps{xf, x, y) V domain(xf) = x 123. ->maps(x/, x, y) V range(xf) C y 386. (lemma 5) ->m(x) V ->m(y) V first((x,y)) = x 409. (lemma 6)->m(x) V -im(y) V second((x,y)) = y 508. (lemma 15) -•func.tion(y) V m(apply(y, x)) 754. (lemma 21) -^m(x) V -w(y) V -■function(xf) V (x, y) £ x / V apply(xf, x) 779. (denial) maps(/154,/155./156) 780. (denial) /157 € /155 781. (denial) apply(/154, /157) g /156 782. [779,121] function(f 154} 783. [779,122]domam(/154) = /155 784. [779,123]ranpe(/154) C /156 785. [784,68]xl £ ranof:(/154) V xl e /156 786. [785,781]appiy(/154, /157) £ range(/154) 787. [786,107j-.m(app/y(/154, /157)) V -^opp(xl) V xl £ /154 Vapp/y(/154,/157) / second(xl) 788. [p, 783, 780J/157 e domam(/154) 789. [788,35]opp(/8a)
720
Collected Works of Larry Wos
790. [788,36]/8a e /154 791. [788,37]/157 = / t r s t ( / 8 a ) 792. [789,12] m(/2a) 793. [789,13]m(/3a) 794. [789,14]/8a= (/2a,/3a) 795. [p, 794,790](/2a, /3a) € /154 796. [p, 794,791]/157 = / i r s t ( ( / 2 a , /3a)) 797. [p, 386,796]/157 = / 2 a V -^m(/2a) V -.m(/3a) 801. [789,787]-m(app/y(/154, /157)) V / 8 a £ /154 V app/j/(/154, /157) ^ second(fSa) 802. [p,794,801] -<m(apply(fl54, /157)) V (/2a, /3a) $ /154 V appiy(/154, /157) ^ second((/2a,/3a)) 803. [p. 409,802]-.m(appiy(/154, /157)) V (/2a, /3a) £ /154 V apply(f 154, /157) ^ / 3 a V -.m(/2a) V -.m(/3a) 804. [803, 754]-.m(app*2/(/154, /157)) V (/2a, /3a) £ /154 V - m ( / 2 a ) V - m ( / 3 a ) V-.m(/157) V -ifunctionlf 154) V (/157, /3a) £ /154 805. [804, 508] (/2a, /3a) £ /154 V - m ( / 2 a ) V - m ( / 3 a ) V -m(/157)V -./tmction(/154) V (/157,/3a) £ /154 806. [p, 797, 805](/2a, /3a) £ /154 V -.m(/2a) V -.m(/3a) V -/unction(/154) 807. [806,795] - m ( / 2 a ) V - m ( / 3 a ) V ^function(f 154) 808. [807,782]-.m(/2a) V - m ( / 3 a ) 809. [808,792] ^m(/3a) 810. [809,793]n abbreviations: / 8 a = /8(/157,/154) / 2 a = /2(/8a) / 3 a = /3(/8a)
L e m m a 24. (Vx/Vx
—» apply(xg, apply(xf, x))
proved from [1,2,9,11,12,13,14,15,69,70,115,116,117,118,119,135,386,409,778] proof: 1. x=x 2. x £ y V m(x) 9. m({x,y}) 11. (x,y) = {{x},{x,y}} 12. ->opp(x) V m(f2(x)) 13. ->opp(x) V m(/3(x)) 14. - o p p ( x ) V x = ( / 2 ( x ) , / 3 ( x ) > 15. opp(x) V -*m(y) V -1)71(0) V x ^ (j/, z) 69. xCj/V/17(x,i/)ex 70. x C y V / 1 7 ( x , i / ) ^ j / 115. z £ apply(xf, y) V opp(/28(z, x / , j/)) 116. ztapply(xf,y)Vf28(z,xf,y)£xf 117. z $ apply(xf,y)V first(f28(z,xf,y)) =y
Set Theory in First-Order
Logic
721
118. z opp{w) V m ^ i / V first(w) ^ yV z & second(w) 135. 2 € xg o x / v -ifra(z) V ->m(x) V-<m(y) V -im(u;) Vz ^ (x,y) V (x.u;) &xf V (w,y) £ xg 386. (lemma 5) ->m(x) V -•m(y) V Jirst({x, y)) = x 409. (lemma 6) ->m(x) V ->m(j/) V second((x, y)) = y 778. (lemma 22) -yfunction(xf) V x 0 domain(xf) V apply(xf, i ) / y V (x, y) £ x / 812. (denial) /unction(/158) 813. (denial) /160 £ domain(/158) 814. (denial) app/y(/159, app/y(/158, /160)) £ apply(f 159 o /158,/160) 815. [814,69] /17a £ appiy(/159, app/y(/158, /160)) 816. [814,70] /17a £ appiy(/159 o /158./160) 817. [815,115] opp(/28a) 818. [815,116] /28a 6 / 1 5 9 819. [815,117] first(f2Sa) = app/y(/158, /160) 820. [815,118]/17a£se«md(/28a) 821. [817,12] m(/2a) 822. [817,13] m(/3a) 823. [817,14]/28a = (/2a, /3a) 824. [p, 823,818](/2a, /3a) £ /159 825. [p,823,819]/trst((/2a,/3a)) = apply(f 158, /160) 826. [p, 823,820]/17a £ seeond((/2a,/3a)) 827. [p, 386,825]/2a = apply(fl58, /160) V -> m (/2a) V - m ( / 3 a ) 828. [p, 409,826]/17a £ / 3 a V ->m(/2a) V - m ( / 3 a ) 829. [816,119] -opp(xl) V x l $ /159 o /158 V / t r s t ( x l ) ^ /160 V /17a £ second(xl) 830. [p,386,829]-.opp((/160,x2))V(/160,x2) £ / 1 5 9 o / 1 5 8 V / 1 7 a £ second((/160, x2)) V ^m(/160) V ->m(x2) 831. [p,409,830]-.opp((/160,xl))V(/160,xl) £ / 1 5 9 o / 1 5 8 V / 1 7 a £ x l V-.7n(/160)V - w ( x l ) 832. [831,828] -opp((/l60, /3a)) V (/160, /3a) £ /159 o /158 V -.m(/160) V^m(/3a) V -.m(/2a) 833. [832,15](/160, /3a) $ /159 o /158 V ^m(/160) V - m ( / 3 a ) V - m ( / 2 a ) V - m ( x l ) V-m(x2) V (/160, /3a) / (xl, x2) 834. [833,1] (/160, /3a) g /159 o /158 V ^m(/160) V - m ( / 3 a ) V - m ( / 2 a ) 835. [834,135)-7n(/160) V -nm(/3a) V -.m(/2a) V -.m((/160, / 3 a » V ->m(xl) V -.m(x2) V-m(x3) V (/160, /3a) ■/ < x i, x2) V (xl, x3) £ /158 V (x3, x2) £ /159 836. [835,1] -m(/160) V ^m(/3a) V - m ( / 2 a ) V -m((/160, /3a)) V ->m(xl) V m(/3a) V -m(/160) V -.m((/160, /3a)) 842. [p, 11,841]-.m(/2a) V -^m(/3a) V -.m(/160) V ->m({{/160}, {/160, / 3 a } » 843. [842,9]-m(/2a) V ->m(/3a) V ^m(/160) 844. [843,821j-.m(/3a) V ^m(/160) 845. [844,822]-m(/160) 846. [845,2]/160 g xl
722
Collected Works of Larry Wos
847. [846,813]D abbreviations: /17a = /17(apply(/159,appiy(/158,/160)),appiy(/159 o /158,/160)) /28a = /28(/17a,/159,appiy(/158,/160)) /2o = /2(/28o) / 3 a = /3(/28a)
L e m m a 25. ( Vx/VxoVx)[/unctton(x/) —► apply(xg o x / , x ) C apply(xg,
apply{xf,x))]
proved from [1,15,69,70,116,117,118,119,129,130,131,132,133,134,386,409,754] proof: 1. x = x 15. opp(x) V ->m(y) V -nn(z) V i ^ ( j , z) 69. x C y V/17(x,y) e x 70. x C y V / 1 7 ( x , y ) £ y 116. z £ a p p / y ( x / , y ) v / 2 8 ( z , x / , y ) e x / 117. z £ apply(xf,y) V /irs«(/28(z,x/,y)) = y 118. z g apply(xf, y)V z€ second(J28(z, xf, y)) 119. z e apply(xf, y) V ->opp(ii;) V u ^ i / V first(w) # y V z ^ second(iti) 129. z g x o o x / V m ( / 2 9 ( z , x / , x o ) ) 130. 2 ^ i j o i / V m(/30(z, x / , xp)) 131. z £ x a o x / V m ( / 3 1 ( z , x / , x o ) ) 132. z £ x 5 o x / V z = (/29(z,x/,xp),/30(z,x/,xp)> 133. 2 ^ i s ° x / V ( / 2 9 ( z , x / , x p ) , / 3 1 ( z , x / , x p ) ) € x / 134. z$xg o x / V ( / 3 1 ( z , x / , x p ) , / 3 0 ( z , x / , x p ) ) e xg 386. (lemma 5) --m(x) V -n m (y) v /irst((x,y)) = x 409. (lemma 6) ->m(x) V -•m(y) V second((x, y)) = y 754. (lemma 21)->m(x) V ->m(y) V ->function(xf) V (x, y) £ x / V oppfy(x/, x) = y 849. (denial)/tmction(/161) 850. (denial)app/y(/162 o /161./163) 2 apply(f 162, appiy(/161,/163)) 851. (850,69]/17a € apply(f 162 o /161./163) 852. [850,70]/17a £ app/y(/162, appfy(/161, /163)) 854. (851,116]/28a€/162 o /161 855. [851,117]/irst(/28a) = /163 856. [851,118]/17a e second(J2%a) 858. [854,129]m(/29a) 859. (854,130]m(/30a) 860. [854,131]m(/31a) 861. [854,132]/28a = {/29a, /30a) 862. [854,133] (/29a,/31a) € /161 863. [854,134](/31a,/30a) e / 1 6 2 865. [p, 861,855]/irst((/29a, /30a)) = /163 866. [p,861,856]/17a e second((/29a,/30a)) 867. (p, 386,865]/29a = /163 V - w ( / 2 9 a ) V -.m(/30a) 868. [p, 409,866]/17a € /30a V -.m(/29a) V -.m(/30a)
Set Theory in First-Order
Logic
723
869. [852,119]-.opp(xl) V xl £ /162 V / i r s t ( x l ) ^ apply(f 161, /163) V/17a £ second(xl) 870. [869,863]-opp((/31a, /30a)) V /irst((/31a, /30o)) £ appiy(/161, /163) V/17o g second{ (/31a, /30a)) 871. [p, 386,870]-.opp«/31a, /30a)) V /31a £ appfy(/161, /163) V /17a £ second((/31a, /30a)) V -.m(/31a) V -.m(/30a) 872. [p, 409,871]-.opp((/31a, /30a)) V /31a ^ apply(f 161, /163) V /17a 0 /30a V-.m(/31a) V -.m(/30a) 873. [872,15]/31a ^ app/y(/161, /163) V /17a £ /30a V -m(/31a) V -m(/30a) V-.m(xl) V -.m(x2) V (/31a, /30a) # (xl,x2) 874. [873,l]/31a ^ apply(f 161, /163) V /17a $ /30a V --m(/31a) V -m(/30a) 875. [874,754]/17a £ /30a V -.m(/31a) V -nm(/30a) V -m(/163) V ^function(f161) V(/163,/31a) £ / 1 6 1 876. [875,868]-.m(/31a) V ->m(/30a) V -.m(/163) V -^function(f 161) V (/163, /31a) $ /161 V -m(/29a) 877. [p,867,862](/163,/31a) 6 / 1 6 1 V - m ( / 2 9 a ) V - m ( / 3 0 a ) 878. [877,876] -m(/29a) V -.m(/30a) V -m(/31a) V -m(/163) V -^function(f 161) 879. (878,849]-m(/29a) V ^m(/30a) V -m(/31a) V -m(/163) 880. [p, 867,879]-m(/29a) V -.m(/30a) V -.m(/31a) 881. (880,858]-.m(/30a)V^m(/31a) 882. [881,859]-m(/31a) 883. [882,860] D abbreviations: /17a = fl7(apply(f 162 o f 161, f 163),apply(f 162,apply(fl61, f 163))) /28a = /28(/17a,/162 o /161./163) /29a = /29(/28a, /161, /162) /30a = /30(/28a, /161, /162) /31a = /31(/28a, /161, /162)
L e m m a 26. (Vx/VxoVx)[/unctton(x/) A x e domain(xf) = apply(xg o x / , x)]
—► apply(xg, apply(xf, x))
proved from [365,848,884] proof: 365. (lemma 4 ) x g y V y g x V x = y 848. (lemma 24)-> funclion(xj) V i ^ domain(xf) V apply(xg, apply(xf, x)) C apply{xg o xf, x) 884. (lemma 25)^ function(xf) V apply(xg o xf ,x) C apply(xg, apply(xf,x)) 885. (denial)/wnc«Jon(/164) 886. (denial)/166 £ domain(f 164) 887. (denial)appiy(/165,appfy(/164,/166)) jt apply(f 165 o /164./166) 888. [887,365] apply(f 165, apply(f 164, f 166)) £ appty(/165 o /164,/166)V apply(f 165 o /164./166) 2 apply(f 165, apply(f 164, /166)) 889. [888,848]appiy(/165 o f 164, f 166) % apply(f 165, apply(f 164, f 166)) V-ifunction(f 164) V /166 £ domain(/164)
724 890. [889,884]-i/«ncfion(/164) V /166 g 891. [890,885]/166 £dornatn(.f 164) 892. [891,886] □
Collected Works of Larry
Wos
domain(f164)
L e m m a 27. (VxVyVxslVxs2)[x € xsl A y € xs2 -» {x, j/) e xsl x xs2] proved from [1,2,9,11,15,42,386,409] proof: 1. x —x 2. x £ y V m(x) 9. m({x,y}) 11. <x,y) = {{x},{x,y}} 15. opp{x) V ->m(j/) V -im(z) V i ^ (y, z) 42. z € x x yV ->m(z) V -iopp(z) V first(z) # x V second(z) £ y 386. (lemma 5)-rn(x) V -im(y) V first((x,y)) = x 409. (lemma 6)->m(x) V ->m(y) V second((x,y)) = y 894. (denial)/167 e /169 895. (denial)/168 € /170 896. (denial){/167, /168) £ /169 x /170 897. [896,42]-m((/167,/168» V -nopp((/167,/168)) V /irst((/167,/168)) £ /169 V secorui«/167, /168)) £ /170 898. [p, 386,897]-.m((/167, /168)) V -.opp( (/167, /168)) V /167 0 /169 Vsecond((/167,/168>) £ /170 V -m(/167) V ->m(/168) 899. [898,894]-.m((/167, /168)) V -.opp((/167, /168)) V second({f 167', /168)) 0 /170 V -.m(/167) V -.m(/168) 900. [p, 409,899]-.m«/167, /168)) V -.opp((/167, /168)) V /168 g /170 V-im(/167) V -m(/168) 902. [900,15]-.m((/167, /168)) V /168 $ /170 V ^m(/167) V -^m(/168) V ->m(xl) V--m(x2) V {/167,/168) ^ (xl,x2) 903. [902,l]-nm((/167,/168)) V /168 £ /170 V --m(/167) V -.m(/168) 904. (p, 11, 903]-m({{/167}, {/167, /168}}) V /168 0 /170 V -.m(/167) V -.m(/168) 905. [904,9]/168 g /170 V -im(/167) V --m(/168) 906. [905,895]-m(/167) V-.m(/168) 907. (906,2]-.m(/168)V/167£xl 908. [907,894] -m(/168) 909. [908,2]/168 £ xl 910. [909,895] □
Theorem. The Composition of Homomorphisms is a Homomorphism (Vx/ilVx/i2Vxsl Vxs2Vxs3Vx/lVx/2Vx/3)[/iom(x/il, xsl, x / 1 , xs2, x/2) Ahom(xh2,xs2,x/2,xs3,x/3) —> hom(xh2 o x / i l , x s l , x / l , x s 3 , x / 3 ) ]
Set Theory in First-Order
Logic
725
proved from [120,121,122,127,136,137,138,139,140,141,142,713,811,893,911] proof: 120. app2(xf, x, y) = apply(xf, (x, y)) 121. ->maps(xf,x,y)\/function(xf) 122. -imaps(x/,i, y) V domain(xf) = x 127. -*closed(xs,xf) V maps(xf, xs x i s , xs) 136. ->/iom(x/i,xsl, x / l , x s 2 , x / 2 ) V d o s e d ( x s l , x / l ) 137. -./u>m(x/i,xsl, x/1,xs2, x/2) V ciosed(xs2,x/2) 138. ->/iom(x/i,xsl,x/l,xs2,x/2) V maps(xh, xsl,xs2) 139. -ihom(xh,xsl,xfl,xs2,xf2) Vx £ x s l Vy £ x s l Vapp/y(x/i, app2(x/l, x, y)) = opp2(x/2, apply(xh, x),apply(xh, y)) 140. hom{xh,xsl,xfl,xs2,x}2) V ->c/osed(xsl,x/l) V ->dosed(xs2,x/2) V^maps(x/i, xsl, xs2) V /32(x/i, xsl, x / 1 , xs2, x/2) e xsl 141. hom(xh,xsl,xfl,xs2,x/2) V -iciosed(xsl,x/l) V ->dosed(xs2,x/2) V-imaps(x/i,xsl, x«2) V/33(x/i, xsl, x / 1 , xs2, x/2) £ xsl 142. /iom(x/i,xsl,x/l,xs2,x/2) V ^ d o s e d ( x s l , x / l ) V -.dosed(xs2,x/2) V-imaps(x/i,xsl,xs2) V apply(xh, a p p 2 ( x / l , / 3 2 ( x / i , x s l , x / l , x s 2 , x / 2 ) , /33(x/i,xsl,x/l,xs2,x/2))) ^ app2{xf2,apply(xh, /32(x/i,xsl,x/l,xs2,x/2)), apply(xh, /33(x/i, xsl, x / 1 , xs2, x/2))) 713. (lemma 20)-'maps(x/, u, u) V ->maps(xg, u, w) V maps(xg o x/, u, u;) 811. (lemma 23)->maps(x/, xd, xr) V x £ xd V apply(xf, x) € xr 893. (lemma 26)^function(xf) V x £ domain(xf) Vapply(xg,apply{xf,x)) = apply(xg o x / , x ) 911. (lemma 27)x £ xsl V y £ xs2 V (x,y) e xsl x xs2 912. (denial)/»om(/171,/173,/176,/174,/177) 913. (denial)/iom(/172, /174, /177, /175, /178) 914. (denial)-./iom(/172 o /171,/173,/176,/175./178) 915. [912,136]dosed(/173,/176) 917. [912,138]maps(/171,/173, /174) 918. [912,139]xl £ / 1 7 3 V x 2 £ / 1 7 3 Vappiy(/171, opp2(/176, x l , x2)) = app2(/177, apply(f 171, xl), apply(f 171, x2)) 920. [913,137]dosed(/175,/178) 921. [913,138]maps(/172, /174, /175) 922. [913,139]xl£/174Vx2g/174 Vapply(f 172, app2(f 177, xl, x2)) = app2(/178, apply(f 172, xl), apply(f 172, x2)) 923. [914,140j-dosed(/173, /176) V -dosed(/175, /178) V^maps(/172 o /171./173, /175) V apply(f 172 o /171,app2(/176,/32a,/33a))^app2(/178,app/y(/172 o /171,/32a), apply(f 172 o /171,/33a)) 926. [915,923]-.dosed(/175, /178) V -maps(/172 o /171, /173, /175) V /32a 6 /173 927. [915,924]-dosed(/175, /178) V -^maps{}172 o /171, /173, /175) V /33a 6 /173 928. [915,925]-.c/osed(/175,/178)V-.maps(/172 o /171,/173,/175)V app/y(/172 o /171,app2(/176, /32a, /33a)) / app2(/178, appty(f!72 o /171,/32a),
726
Collected Works of Larry Wos
apply(f 172 ° /171,/33a)) 929. [920,926]-.maps(/172 o /171,/173,/175) V/32a 6 / 1 7 3 930. [920,927]-roaps(/172 o /171, /173, /175) V /33a G /173 931. [920,928] -nmap«(/172 o /171,/173,/175)V applyif 172 ° /171,app2(/176,/32a,/33a)) ^ app2(/178,appij/(/172 o /171,/32a), applyif 172 ° fl71,f33a)) 932. [917,713]-.maps(xl,/174,x2)Vmaps(xl o /171,/173,x2) 933. [932,921]maps(/172 o /171,/173,/175) 934. [933,929]/32a G/173 935. [933,930]/33a G /173 936. [933,931]app/j/(/172 o /171,app2(/176,/32a,/33a)) ^ app2(/178,app/j/(/172 o /171,/32a),app/y(/172 o /171,/33a)) 937. [918,934jxl £ /173 V applyif 171, app2(/176, /32a, xl)) = app2(/177, applyif 171, /32a), applyif 171, xl)) 938. [937,935]app/j/(/171, app2(/176, /32a, /33a)) = app2(/177, applyif 171, /32a), applyif 171, /33a)) 939. [917,811]xl £ /173 V applyif 171, xl) G /174 940. [939,934]app/j/(/171,/32a) 6 /174 941. [939,935]app/J/(/171,/33a) 6 /174 942. [940,922]xl $ f 174 V apply if 172, app2if 177, apply if 171, f 32a), xl)) = app2(/178, applyif 172, applyif 171, /32a)), applyif 172, xl)) 943. [942,941]appfy(/172,app2(/177,appZj/(/171, /32a),appiy(/171, /33a))) app2(/178, applyif 172, applyif 171, /32a)), applyif 172, applyif 171, f 33a))) 944. [p, 938, 943]app/j/(/172, applyif 171, app2(/176, /32a, /33o))) = app2(/178, applyif 172, applyif 171, f32a)), applyif 172, applyif 171, f 33a))) 945. [p, 893,936]appZj/(/172, applyif 171, app2(/176, /32a, /33a))) / app2(/178,appty(/172 o f 171, f32a), applyif 172 ° /171,/33a)) V->/unction(/171)V app2(/176, /32a, /33a) £ domainif 171) 946. [p, 893, 945]app/j/(/172, applyif 171, app2(/176, /32a, /33a))) / app2if 178, applyif 172, applyif 171, f32a)), applyif 172 ° /171,/33a)) V-./unction(/171) V app2(/176, /32a, /33a) £ domain(/171) V/32a £ domain(/171) 947. [p, 893, 946]app/y(/172, applyif 171, app2(/176, /32a, /33a))) ^ app2(/178, applyif 172, applyif 171, /32a)), applyif 172, applyif 171, /33a))) V-./unction(/171) V app2(/176, /32a, /33a) £ domainif 171) V/32a 0 domam(/171) V /33a £ domain(/171) 951. [915,127]maps(/176, /173 x /173, /173) 952. [951,811]xl £ /173 x /173 V applyif 176, xl) G /173 953. [952,911]app/y(/176, (xl,x2)) € /173 V x l g /173 V x2 g /173 954. [953,934]appiy(/176, {/32a, x l ) ) e /173 V xl £ /173 955. [954,935]appfy(/176, (/32a, /33a)) G /173 956. [p, 120,955]app2(/176, /32a, /33a) 6 /173 957. [947,944]-./unction(/171) V app2(/176, /32a, /33a) £ domainif 171) V/32o $ domainif 171) V /33a £ domain(/171) 958. [917,122]domain(/171) = /173 959. [p, 958,957]-,functionif 171) V app2(/176, /32a, /33a) £ /173 V/32a t /173 V /33a £ /173
Set Theory in First-Order
Logic
727
960. [959,956]-i/unction(/171) V /32a g /173 V /33a £ /173 961. [960,121]/32a £ /173 V /33a $ /173 V -.mops(/171,xl, x2) 962. [961,917]/32a £ /173 V /33a £ /173 963. [962,934]/33a £ /173 964. [963,935] D abbreviations: /32a = / 3 2 ( / 1 7 2 o /171,/173,/176,/175,/178) /33a = / 3 3 ( / 1 7 2 o /171, /173, /176./175, /178)
6
Set Theory and A u t o m a t e d Theorem Proving
Anyone attempting to submit the set of clauses given here to an automated the orem prover will quickly confront many fundamental issues in theorem proving. This set of clauses is difficult to work with for several reasons. (a) There are many clauses, many of them non-Horn, and few useful units. Because so few basic concepts are used, there are many pairs of comple mentary literals. Unrestricted binary resolution or paramodulation will rapidly result in the dreaded combinatorial explosion. (b) A strategy for restricting inferences must avoid 'opening up' every defi nition so that mathematical arguments can be made at the appropriate level. Yet sometimes definitions must be expanded. Thus a key technique will be to layer the deductions and to identify (automatically) the proper occasions for crossing layer boundaries. This problem has been the topic of much research, and many contributions to its solution have been proposed. It has never really been solved. (c) A human learns relatively quickly how to construct proofs in this system, once he knows the general outline of the proof. Such expertise needs to be represented as a strategy for a theorem prover. (d) In constructing any proof in this system, one finds a need for a set of lemmas. If a large body of lemmas is built up, however, and uniformly made available to the theorem prover, the problem of a large axiom set is compounded. It is important to develop a strategy for selecting from a database the lemmas relevant to a particular problem.
References 1 Bledsoe, W. W., 'Splitting and reduction heuristics in automatic theorem proving', Artificial Intelligence 2 55-77 (1971).
728
Collected Works of Larry Wos
2 Bledsoe, W. W., 'Some automatic proofs in analysis', Automated Theorem Proving: After 25 Years, (eds. D. Lovelandand W. W. Bledsoe), American Mathematical Society (1984). 3 Godel, K., The Consistency of the Axiom of Choice and of the Gener alized Continuum-Hypothesis with the Axioms of Set Theory, Princeton University Press (1940). 4 Kelley, J., General Topology, D. van Nostrand, Princeton, New Jersey (1955). 5 McDonald, J., and Suppes, P., 'Student use of an interactive theorem prover', Automated Theorem Proving: After 25 Years, (eds. D. Loveland and W. W. Bledsoe), American Mathematical Society (1984). 6 Morse, A. P., A Theory of Sets, Academic Press, New York (1965). 7 Pastre, D., 'Demonstration automatique de theoremes en theorie des en sembles', Paris 6 (1976). (Ph.D. thesis) 8 Quine, W., Set Theory and Its Logic, Harvard University Press (1969). 9 Shoenfield, J. R., Mathematical Logic, Addison-Wesley, Reading, Ma. (1967).
Problem
Corner:
A Case Study in A u t o m a t e d T h e o r e m Proving: Finding Sages in Combinatory Logic W I L L I A M M c C U N E and L A R R Y W O S Mathematics and Computer Argonne, IL 60439-4844
Science Division,
Argonne
National
Laboratory,
(Received: 18 December 1986) A b s t r a c t . We present in this article an application of automated theorem proving to a study of a theorem in combinatory logic. The theorem states: the strong fixed point property is satisfied in a system that contains the B and WtR. combinators. The theorem can be stated in terms of Smullyan's forests of birds: a sage exists in a forest that contains a bluebird and a warbler. Proofs of the theorem construct sages from B and W. Prior to the study, one sage, discovered by Statman, was known to exist. During the study, with much assistance from two automated theorem-proving programs, four new sages were discovered. The study was conducted from a syntactic point of view because the authors know very little about combinatory logic. The uses of the automated theorem-proving programs are described in detail. K e y w o r d s . Automated theorem proving, automated reasoning, paramodulation, de modulation, proof checking, ITP, bidirectional search, open questions, combinatory logic, sage, bluebird, warbler.
1
Introduction
Ross Overbeek recently brought to our attention a problem in combinatory logic. T h e problem was phrased in terms of Smullyan's forests of birds [3]. In such forests, if i and y are birds, then (xy) is the name of the bird t h a t is the response of x when it hears the name y. T h e problem can be easily cast into a first-order form t h a t enables attack with an a u t o m a t e d theorem-proving program (see Section 2). T h e problem is: given a bluebird and a warbler, find some sages. B is a bluebird if B satisfies the equation [VxVyVz ] (((Bx)y)z)
=
(x(yz)),
W is a warbler if W satisfies "This work was supported by the Applied Mathematical Sciences subprogram of the office of Energy Research, U.S. Department of Energy, under contract W-31-109-Eng-38 Reprinted from Journal oj Automated Reasoning, Vol. 3, no. 1, pp. 91-107 (1987) with kind permission from Kluwer Academic Publishers.
Collected Works of Larry Wos
730 [VxVy] ((Wx)y) = ((xy)y), and a sage is any bird 0 satisfying
[Vx] (*(a*)) = (ex). (A system in which a sage exists is said to satisfy the strong fixed point property [4].) The problem of deriving a sage from a bluebird and one other regular combinator (a warbler is regular—regularity is defined in [3] and its meaning is not relevant to this study) was posed by Raymond Smullyan as an open question [3] and it was answered recently by Richard Statman [4]. Statman derived the sage ((B(WW))((BW)((BB)B))) from a bluebird and a warbler. Overbeek recognized this question as an excellent test problem for automated theorem-proving programs. After some preliminary experiments, he succeeded in having the program ITP [2] derive a proof that Statman's bird is in fact a sage, but ITP was unable to prove the more difficult theorem whose proof constructs a sage. In particular, ITP was able to prove (*) [Vx)(x(((B(WW))((BW)((BB)B)))x))
=
(((B(WW))((BW)((BB)B)))x),
but it was unable to prove (**) [3yVx] (x(yx)) = (yx). Our primary goal was to find with the aid of various theorem-proving pro grams sages different from Statman's sage. A secondary and possible interme diate goal was to devise a search strategy to enable ITP to derive Statman's sage during a proof of (**). We used Overbeek's proof of (*) as a starting point. During the study, with much assistance from ITP and another program, we found four new sages. Of the following five sages, Statman's is the J Sage, and the other four are the new sages. J sage: ((B(WW))((BW)((BB)B))) /* Statman's sage */ K sage: ((B(WW))((B((BW)B))B)) L sage: ((B((B(WW))((BW)B)))B) M sage: ((B((B(WW))W))((BB)B)) N sage: ((B((B((B(WW))W))B))B) All five sages exhibit the same behavior—when a bird's name is heard, all five sages give the same response. More precisely, the five sages are all equal in the presence of the extensionality axiom [VxVj/Vz] (xy) = (zy) —* x = z. Without extensionality, as far as we know, the five sages are distinct.
A Case Study in Automated
2
Theorem
Proving
731
Combinatory Logic and A u t o m a t e d Theorem Proving
Our knowledge about combinatory logic comes from a cursory reading of Smullyan's To Mock a Mockingbird [3]. There, objects in a combinatory logic (combinators) are viewed as birds in a forest. If the name of a bird y is called to a bird x, x responds with the name of a bird, designated (xy). (x always gives the same response to the name y.) Another view is that combinators are unary functions—apply a function to a function, and the result is a function. The be havior of some birds can be described by equations. For example, an identity bird / can be defined by [Vz ] (Ix) = x, in other words, / always responds with the name that it hears. The theorems in which we are interested can be easily cast into first-order logic by introducing a binary function s, which permits us to express (xy) as s(x, y). For example, the definition of the identity bird can be expressed as [VQrr] s ( / , x) = x. With that representation, many of the exercises presented in [3] are easily solved by various existing automated theorem-proving programs [1]. The focus of attention is the following theorem, which comes from the firstorder translation of (**). (***) [VxVyVz}s(s(s{B,x),y),z) = s(x,s{y, z))A[ixVy}s(s(W,x),y) = s(s(x,y),y) -+[3yVx]s(x,s(y,x)) = s(y,x) The clause form of the negation of the theorem is (1) x = x (2) s(s(s(B,x),y),z) = s(x,s(y,z)) (3) s(s(W,x),y) = s(s(x,y),y) (4)s(f(x),s(x,f(x)))^s(x,f(x)) where / is a Skolem function, B and W are constants, and x, y, and z are variables t h a t are (implicitly) universally quantified. Each refutation of those four clauses leads to a (not necessarily unique) sage. One extracts the sage from a refutation by tracing the substitution for x in clause (4). Alternatively, one could attach the answer literal answer(x) to clause (4). We used two programs during the study. The theorem-proving program ITP [2] was used in the noninteractive mode with various strategies. The second program, called the proof checker, was used primarily to check proofs rather than to find proofs, however use of this program also led us to several discoveries to be discussed later in this article. The proof checker executes commands in the spirit of "paramodulate clause 2 into clause 5" and "find all clauses that conflict with clause 14". All proofs that appear in this article were produced with the aid of the proof checker. Both programs use binary paramodulation [5], an inference rule that combines instantiation and equality substitution. Several new features were added to ITP as a result of the study.
Collected Works of Larry Wos
732
3
Terminology
With the exception of the proofs in Section 7 involving extensionality, we restrict ourselves to sets of unit clauses. In particular, all but one input clause are positive unit equality clauses; the remaining clause is a negative equality unit clause. • Demodulation is a procedure for rewriting clauses into a canonical form by using directed equalities (a subset of the input clauses). Clauses are demodulated immediately upon being generated by an inference rule. • The set of support strategy is a restriction strategy that requires that all lines of reasoning start from a specified subset (the initial set of support) of the input clauses. • A backward search is a search in which the initial set of support is the negative equality. Note that only negative equalities can be generated in a backward search when paramodulation is employed with unit clauses. • A forward search is a search in which the initial set of support is a set of positive equalities such that paramodulation is not permitted into negative equalities. Note that only positive equalities can be generated in a forward search. • An input search has the property that, in each inference, at least one of the parent clauses is an input clause. Note that all backward searches are input searches, but such is not the case for all forward searches. • Consider the paramodulation inference: from f(a) = g(b) into P(f(x),x), infer P(g(b),a). f{a) — g(b) is the from clause, f(a) is the from term, P(f(x),x) is the into clause, f(x) is the into term, and P(g(b),a) is the paramodulant. The from term is always the lefthand argument of the from clause. • In the proofs that appear in this article, the justification [p,3,5,[1,2]] means that the clause is derived by paramodulating the lefthand argument of clause 3 into clause 5 at position [1,2]. Position [1,2] is the second argument of the first argument of clause 5.
4
Transforming Proofs and Finding Another Sage
The first attempts at finding proofs of (***) with ITP failed. Several differ ent strategies were tried: forward versus backward search, varying the set of demodulators, and using and avoiding demodulation. We made the following observations from those initial experiments.
A Case Study in Automated Theorem Proving
733
• The branching factor was large in the forward searches; in particular, when a new clause was chosen as the focus of attention, the result was the generation and retention of many, many clauses. • The branching factor was relatively small in the backward searches. • When clause (3) is present in either orientation as a demodulator, de. modulation can fail to terminate. For example, the term s(s(W, W), W) is rewritten to itself. When clause (2) is present in either orientation as the only demodulator, demodulation is guaranteed to terminate. When the pair (2) and (3) is present in any orientation, demodulation fails to terminate on many clauses. Those experiments led us to study known proofs of (***). Independent of the preceding ITP atte.mpts, we had transformed by hand Overbeek's proof of (*) into the following proof of (***)• Proof A. Derived from Overbeek's proof of (*), J sage: ((B(WW))((BW)((BB)B))) A-2. s(x, s(y, z)) = s(s(s(B, x), y), z) A-3. s(s(x, y), y) = s(s(W, x), y) A-4. s(f(x), s(x, f(x))) != s(x, f(x)) A-5. [p, 3, 3, [2]] s(s(x, x), x) = s(s(W, W), x) A-6. [p, 3, 2, [2]] s(x, s(y, y)) = s(s(W, s(B, x)), y) A-7. [p, 6, 2, [2, 1]] s(x, s(s(y, y), z)) = s(s(s(W, s(B, s(B, x))), y), z) A-8. [p, 2, 7, [2, 1, 1, 2]] s(x, s(s(y, y), z)) = s(s(s(W, s(s(s(B, B), B), x)), y), z) A-9. [p, 2, 8, [2, 1, 1]] s(x, s(s(y, y), z)) = s(s(s(J, x), y), z) A-10. [p, 5, 9, [2]] s(x, s(s(s(J, x), s(J, x)), s(J, x))) = s(s(W, W), s(J, x)) A-ll. [p, 2, 10, [2]] s(x, s(s(s(J, x), s(J, x)), s(J, x))) = s(s(s(B, s(W, W)), J), x) A-12. [p, 5, 11, [1, 2]) s(x, s(s(W, W), s(J, x))) = s(s(s(B, s(W, W)), J), x) A-13. [p, 2, 12, [1, 2]] s(x, s(s(s(B, s(W, W)), J), x)) = s(s(s(B, s(W, W)), J), x) A-14. [4, 13] D (unit conflict) /* abbreviations */ J = s(s(B,W),s(s(B,B),B)) Note the following points about Proof A. • The last step (unit conflict) instantiates the variable x of clause A-4 to Statman's sage. (The abbreviated term J is a subterm of the sage.) • The proof is forward, and it is almost an input proof. Clauses A-10 and A12 were each derived from clause A-5 and the preceding (noninput) clause. Clause A-5 was derived from A-3 into A-3, so it appears that the proof can be easily transformed into an input proof by deleting clause A-5 and replacing each of the two uses of A-5 by two uses of A-3.
734
Collected Works of Larry Wos • Clause A-5 is the only noninput clause that is not of the form s(x, tl) = £2 for some terms tl and t2. Note that the last step of any proof must be of that form in order for it to conflict with clause A-4. • With the exceptions of clauses A-10 and A-12, clause A-7 is the only clause that was not derived by paramodulating from an input clause.
With the intermediate goal of producing a proof with "nice" properties, we attempted to transform Proof A into a backward (and therefore input) proof. Rather than transforming it by hand, we used the proof checker in the following way. 1. Look at the last step of Proof A: clause A-13 conflicts with clause A-4, and A-13 is derived by paramodulating the lefthand argument of A-2 into A-12. Therefore, paramodulate the righthand side of A-2 into A-4 to find a clause that conflicts with A-12. Any such clause is a candidate as the first step in a backward proof. 2. Assume we have a clause, say B-0, that conflicts with A-12. Look at the next to the last step of Proof A: clause A-12 is derived from A-5 into A-ll. We cannot use the same trick as in (1) because A-5 is not an input clause, but, noting that A-5 is derived from A-3 into A-3, we attempt to extend the backward derivation by paramodulating A-3 into B-0 twice to obtain a clause that conflicts with A-ll. 3. Continue extending the backward derivation by producing clauses that conflict with the steps of Proof A. (The user decides which inferences to make, and the proof checker produces the paramodulants and searches for unit conflict.) The result of the preceding three-step procedure is Proof B. (Instead of paramodulating from righthand sides, we have flipped the input clauses to per mit paramodulation from lefthand sides.) Proof B . Original inversion, J sage: ((B(WW))((BW)((BB)B))) B-2. s(s(s(B, x), y), z) = s(x, s(y, z)) B-3. s(s(W, x), y) = s(s(x, y), y) B-4. s(x, f(x)) != s(f(x), s(x, f(x))) B-6. (p, 2, 4, [2, 2]] s(s(s(B, x), y), f(s(s(B, x), y))) != s(f(s(s(B, x), y)), s(x, s(y, f(s(s(B, x), y))))) B-8. [p, 3, 6, [2, 2]] s(s(s(B, s(W, x)), y), f(s(s(B, s(W, x)), y))) != s(f(s(s(B, s(W, x)), y)), s(s(x, s(y, f(s(s(B, s(W, x)), y)))), s(y, f(s(s(B, s(W, x)), y))))) B-15. [P, 3, 8, [2, 2]] s(s(s(B, s(W, W)), x), f(s(s(B, s(W, W)), x))) != s(f(s(s(B, s(W, W)), x)), s(s(s(x, f(s(s(B, s(W, W)), x))), s(x, f(s(s(B, s(W, W)), x)))), s(x, f(s(s(B, s(W, W)), x)))))
A Case Study in Automated Theorem Proving
735
B-16. [p, 2, 15, [1]] s(s(W, W), s(x, f(s(s(B, s(W, W)), x)))) != s(f(s(s(B, s(W, W)), x)), s(s(s(x, f(s(s(B, s(W, W)), x))), s(x, f(s(s(B, s(W, W)), x)))), s(x, f(s(s(B, s(W, W)), x))))) B-23. [p, 3, 16, [1]] s(s(W, s(x, f(s(s(B, s(W, W)), x)))), s(x, f(s(s(B, s(W, W)), x)))) != s(f(s(s(B, s(W, W)), x)), s(s(s(x, f(s(s(B, s(W, W)), x))), s(x, f(s(s(B, s(W, W)), x)))), s(x, f(s(s(B, s(W, W)), x))))) B-36. [p, 3, 23, [1]] s(s(s(x, f(s(s(B, s(W, W)), x))), s(x, f(s(s(B, s(W, W)), x)))), s(x, f(s(s(B, s(W, W)), x)))) != s(f(s(s(B, s(W, W)), x)), s(s(5(x, f(s(s(B, s(W, W)), x))), s(x, f(s(s(B, s(W, W)), x)))), s(x, f(s(s(B, s(W, W)), x))))) B-60. [p, 2, 36, [1, 1, 1]] s(s(s(x, s(y, f(s(s(B, s(W, W)), s(s(B, x), y))))), s(s(s(B, x), y), f(s(s(B, s(W, W)), s(s(B, x), y))))), s(s(s(B, x), y), f(s(s(B, s(W, W)), s(s(B, x), y))))) != s(f(s(s(B, s(W, W)), s(s(B, x), y))), s(s(s(s(s(B, x), y), f(s(s(B, s(W, W)), s(s(B, x), y)))), s(s(s(B, x), y), f(s(s(B, s(W, W)), s(s(B, x), y))))), s(s(s(B, x), y), f(s(s(B, s(W, W)), s(s(B, x), y)))))) B-70. [p, 2, 60, [1, 1, 1, 2]] s(s(s(x, s(y, s(z, f(s(s(B, s(W, W)), s(s(B, x), s(s(B, y), z))))))), s(s(s(B, x), s(s(B, y), z)), f(s(s(B, s(W, W)), s(s(B, x), s(s(B, y), z)))))), s(s(s(B, x), s(s(B, y), z)), f(s(s(B, s(W, W)), s(s(B, x), s(s(B, y), z)))))) != s(f(s(s(B, s(W, W)), s(s(B, x), s(s(B, y), z)))), s(s(s(s(s(B, x), s(s(B, y), z)), f(s(s(B, s(W, W)), s(s(B, x), s(s(B, y), z))))), s(s(s(B, x), s(s(B, y), z)), f(s(s(B, s(W, W)), s(s(B, x), s(s(B, y), z)))))), s(s(s(B, x), s(s(B, y), z)), f(s(s(B, s(W, W)), s(s(B, x), s(s(B, y), z))))))) B-81. [p, 3, 70, [1, 1]] s(s(s(s(x, s(y, f(s(s(B, s(W, W)), s(s(B, W), s(s(B, x), y)))))), s(s(s(B, W), s(s(B, x), y)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, x), y)))))), s(s(s(B, W), s(s(B, x), y)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, x), y)))))), s(s(s(B, W), s(s(B, x), y)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, x), y)))))) != s(f(s(s(B, s(W, W)), s(s(B, W), s(s(B, x), y)))), s(s(s(s(s(B, W), s(s(B, x), y)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, x), y))))), s(s(s(B, W), s(s(B, x), y)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, x), y)))))), s(s(s(B, W), s(s(B, x), y)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, x), y))))))) B-82. [p, 2, 81, [1, 1]] s(s(s(x, f(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), x))))), s(s(s(s(B, W), s(s(B, B), x)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), x))))), s(s(s(B, W), s(s(B, B), x)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), x))))))), s(s(s(B, W), s(s(B, B), x)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), x)))))) ! = s(f(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), x)))), s(s(s(s(s(B, W), s(s(B, B), x)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), x))))), s(s(s(B, W), s(s(B, B), x)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), x)))))), s(s(s(B, W), s(s(B, B), x)), f(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), x))))))) B-83. [2,82] D Note the following points about Proof B. • The unit conflict (B-82 versus B-2) instantiates the argument of all occur rences of / in clause B-82 to Statman's sage.
736
Collected WorJcs of Larry Wos • The proof is backward (and therefore input). Each clause is derived by paramodulating the lefthand argument of either B-2 or B-3 into the pre ceding clause. • The following pairs of clauses are conflicting pairs (assuming symmetric unification for "="): B-6.A-12, B-15.A-11, B-16.A-10, B-36.A-9, B-60.A-8, B-70,A-7, and B-82.A-2. • Clauses B-8, B-23, and B-81 conflict with nothing in Proof A, and they are the only clauses in Proof B with that property. Those three clauses correspond to the three inferences in Proof A involving paramodulation from a non-input clause. • A similar proof can be obtained if clause B-2 is present as a demodulator.
A surprise emerged while constructing Proof B. When paramodulating clause B-2 into B-60 to derive a clause that conflicts with A-7, two different clauses were found that yield unit conflict. One is B-70, which led to Proof B; as expected, the conflict of B-70 and A-7 instantiates the argument of all occurrences of / to Statman's sage. The second is C-71; the surprise was that the conflict of C-71 and A-7 instantiates the argument of all occurrences of / to a term different from Statman's sage. The new proof (Proof C) was finished using Proof B as a guide. Another sage had been found. Proof C. A new sage K: ((B(WW))((B((BW)B))B)) C-2. s(s(s(B, x), y), z) = s(x, s(y, z)) C-3. s(s(W, x), y) = s(s(x, y), y) C-4. s(x, f(x)) != s(f(x), s(x, f(x))) The derivation of C-60 is the same as the derivation of B-60 in Proof B. C-60. s(s(s(x, s(y, f(s(s(B, s(W, W)), s(s(B, x), y))))), s(s(s(B, x), y), f(s(s(B, s(W, W)), s(s(B, x), y))))), s(s(s(B, x), y), f(s(s(B, s(W, W)), s(s(B, x), y))))) != s(f(s(s(B, s(W, W)), s(s(B, x), y))), s(s(s(s(s(B, x), y), f(s(s(B, s(W, W)), s(s(B, x), y)))), s(s(s(B, x), y), f(s(s(B, s(W, W)), s(s(B, x), y))))), s(s(s(B, x), y), f(s(s(B, s(W, W)), s(s(B, x), y)))))) C-71. [p, 2, 60, [1, 1, 1]] s(s(s(x, s(y, s(z, f(s(s(B, s(W, W)), s(s(B, s(s(B, x), y)), z)))))), s(s(s(B, s(s(B, x), y)), z), f(s(s(B, s(W, W)), s(s(B, s(s(B, x), y)), z))))), s(s(S(B, s(s(B, x), y)), z), f(s(s(B, s(W, W)), s(s(B, s(s(B, x), y)), z))))) != s(f(s(s(B, s(W, W)), s(s(B, s(s(B, x), y)), z))), s(s(s(s(s(B, s(s(B, x), y)) ( z), f(s(s(B, s(W, W)), s(s(B, s(s(B, x), y)), z)))), s(s(s(B, s(s(B, x), y)), z), f(s(s(B, s(W, W)), s(s(B, s(s(B, x), y)), z))))), s(s(s(B, s(s(B, x), y)), z), f(s(s(B, s(W, W)), s(s(B, s(s(B, x), y)), z)))))) C-84. [p, 3, 71, [1, 1]] s(s(s(s(x, s(y, f(s(s(B, s(W, W)), s(s(B, s(s(B, W), x)), y))))), s(s(s(B, s(s(B, W), x)), y), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), x)), y))))), s(s(s(B, s(s(B, W), x)), y), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), x)), y))))), s(s(s(B, s(s(B, W), x)), y), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), x)),
A Case Study in Automated Theorem Proving
737
y))))) != s(f(s(s(B, s(W, W)), s(s(B, s(s(B, W), x)), y))), s(s(s(s(S(B, s(s(B, W), x)), y), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), x)), y)))), s(s(s(B, s(s(B, W), x)), y), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), x)), y))))), s(s(s(B, s{s(B, W), x)), y), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), x)), y)))))) C-85. [p, 2, 84, [1, 1]] s(s(s(x, f(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), x)))), s(s(s(s(B, s(s(B, W), B)), x), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), x)))), s(s(s(B, s(s(B, W), B)), x), f(s(s(B, s(W, W)), s{s(B, s(s(B, W), B)), x)))))), s(s(s(B, s(s(B, W), B)), x), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), x))))) != s(f(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), x))), s(s(s(s(s(B, s(s(B, W), B)), x), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), x)))), s(s(s(B, s(s(B, W), B)), x), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), x))))), s(s(s(B, s(s(B, W), B)), x), f(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), x)))))) C-86. [2,85] □ Note the following points about Proof C. • The unit conflict (C-85 versus C-2) instantiates the argument of all occur rences of / in clause C-85 to s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), B)), or, in standard notation, ((B(WW)){{B((BW)B))B)). This new sage was named the K sage. • The first seven steps (through B-60/C-60) of proofs B and C are identical. The difference in the eighth steps (clauses B-70/C-71) is that the into terms are different—the into term in B-60 is a subterm of the into term in clause C-60. The final two steps of Proof B are nearly the same as the last two steps of Proof C; the from clauses and the into positions are the same, but, of course, the into clauses and paramodulants are different. Proofs B and C were easily inverted into forward proofs by inverting each individual step. Then steps in the inverted proofs were rearranged so that the clauses in the proofs would have fewer symbols. The results are Proof D and Proof E. (Again, the input clauses have been flipped. Paramodulation continues to be from the lefthand sides of equalities.) Proof D. Forward input proof of J sage: ((B(WW))((BW)((BB)B))) D-2. s(x, s(y, z)) = s(s(s(B, x), y), z) D-3. s(s(x, y), y) = s(s(W, x), y) D-4. s(f(x), s(x, f(x))) != s(x, f(x)) D-5. [p, 2, 2, [2, 1]] s(x, s(s(y, z), u)) = s(s(s(s(B, s(B, x)), y), z), u) D-6. [p, 3, 5, [2, 1]] s(x, s(s(y, y), z)) = s(s(s(W, s(B, s(B, x))), y), z) D-7. [p, 2, 6, [2, 1, 1, 2]] s(x, s(s(y, y), z)) = s(s(s(W, s(s(s(B, B), B), x)), y), z) D-9. [p, 2, 7, [2, 1, 1]] s(x, s(s(y, y), z)) = s(s(s(J, x), y), z) D-ll. [p, 3, 9, [2]] s(x, s(s(y, y), y)) = s(s(W, s(J, x)), y) D-13. [p, 3, 11, [1, 2]] s(x, s(s(W, y), y)) = s(s(W, s(J, x)), y)
738
Collected Works of Larry Wos
D-15. [p, 3, 13, [1, 2]] s(x, s(s(W, W), y)) = s(s(W, s(J, x)), y) D-17. [p, 2, 15, [1, 2]] s(x, s(s(s(B, s(W, W)), y), z)) = s(s(W, s(J, x)), s(y, z)) D-19. [p, 3, 17, [2]] s(x, s(s(s(B, s(W, W)), J), x)) = s(s(W, W), s(J, x)) D-21. [p, 2, 19, [2]] s(x, s(s(s(B, s(W, W)), J), x)) = s(s(s(B, s(W, W)), J), x) D-23. [4, 21] D / * abbreviations */ J = s(s(B,W),s(S(B,B),B)) Proof E. Forward input proof of K sage: ((B(WW))((B((BW)B))B)) E-2. s(x, s(y, z)) = s(s(s(B, x), y), z) E-3. s(s(x, y), y) = s(s(W, x), y) E-4. s(f(x), s(x, f(x))) != s(x, f(x)) E-5. [p, 2, 2, [2, 1]] s(x, s(s(y, z), u)) = s(s(s(s(B, s(B, x)), y), z), u) E-6. [p, 3, 5, [2, 1]] s(x, s(s(y, y), z)) = s(s(s(W, s(B, s(B, x))), y), z) E-8. [p, 2, 6, [2, 1, 1]] s(x, s(s(y, y), z)) = s(s(s(s(s(B, W), B), s(B, x)), y), z) E-10. [p, 2, 8, [2, 1, 1]] s(x, s(s(y, y), z)) = s(s(s(K, x), y), z) E-12. [p, 3, 10, [2]] s(x, s(s(y, y), y)) = s(s(W, s(K, x)), y) E-14. [p, 3, 12, [1, 2]] s(x, s(s(W, y), y)) = s(s(W, s(K, x)), y) E-16. [p, 3, 14, [1, 2]] s(x, s(s(W, W), y)) = s(s(W, s(K, x)), y) E-18. [p, 2, 16, [1, 2]] s(x, s(s(s(B, s(W, W)), y), z)) = s(s(W, s(K, x)), s(y, z)) E-20. [p, 3, 18, [2]] s(x, s(s(s(B, s(W, W)), K), x)) = s(s(W, W), s(K, x)) E-22. [p, 2, 20, [2]] s(x, s(s(s(B, s(W, W)), K), x)) = s(s(s(B, s(W, W)), K), x) E-24. [4, 22] D /* abbreviations */ K = s(s(B,s(s(B,W),B)),B) Note the following points about Proofs D and E. • Proof D constructs the J sage (Statman's sage), and Proof E constructs the new sage K. • The proofs are forward input proofs in which each clause is derived by paramodulating the lefthand side of either 2 or 3 into the preceding clause. • All derived clauses are of the form s(x, tl) = tl for some terms t\ and t2. • The differences between the two proofs are analogous to the differences between Proofs B and C. The first two steps of the two proofs are the same, the third steps are different only because of the into position, and with the exception of the difference between the abbreviated terms J and K, the remaining eight steps of the two proofs are the same.
A Case Study in Automated Theorem Proving
5
739
Searching for More Sages
The next phase of the study consisted of searching with ITP for more sages. Searches were conducted with strategies and restrictions such that any proofs that might be found would have some of the "nice" properties of Proofs B, C, D, and E. The backward searches were conducted under the following strategy and restrictions. • Orient the input clauses as they are in Proofs B and C: (1) x — x (2) s(s(s(B,x),y),z) = s(x,s{y,z)) (3) s{s(W,x),y) = s(s{x,y),y) (4)s(x,f(x))^s(f(x),s(xJ(x))) • The initial set of support consists of clause (4). Paramodulate from the lefthand sides only of clauses (2) and (3). • Demodulate all generated clauses with clause (2). Although neither Proofs B nor C make use of demodulation, similar proofs can be obtained when clause (2) is present as a demodulator. • Delete any generated clause that is ground (has no variables). A justifi cation for this restriction is that our intuition says that steps of proofs generated by a computer tend to be less ground (more general) than steps generated by a person. Our justification for these restrictions is simply that they are obeyed by Proofs B and C. No proofs were found with any of the backward searches. The largest search kept approximately 2500 clauses and required about 12 CPU hours on an EN CORE Multimax (1 processor). Several experiments were then conducted to see how far ITP could get toward the backward proof that is the inversion of Proof D. When clause D-9 was included in the input in such a way that it could be used only for the unit conflict test, ITP found a proof within several minutes. Since D-9 is the fourth step of Proof D, and since Proof D has ten steps, the success can be viewed as ITP making six out of ten steps toward the inversion of Proof D. The next search was an attempt at seven steps backward; when clause D-9 was replaced with D-7 (the third step), a proof was found in approximately half an hour of CPU time. The next search was an attempt at eight steps back ward; when clause D-7 was replaced with D-6 (the second step), no proofs were found within several hours. We now turn to the forward searches. The forward searches were conducted with the following strategy and restrictions. • Orient the input clauses as they are in Proofs D and E:
Collected Works of Larry Wos
740
(1) x = x (2) s(x,s(y,z))
= s(s(s(B,x),y),z
(3) s(s(x,y),y)
=
s(s(W,x),y)
(4)8{f(x),s(x,f(x)))*8(x,f(x))
• Paramodulate from the lefthand sides only of clauses (2), (3), and those clauses that had at one time been focal clauses (those clauses on which ITP had focused its attention earlier in the run). (Paramodulation from previously focal clauses results in a noninput search. At the time of these experiments, ITP did not have the capability of forward input searches. That option was installed later in the study.) • The initial set of support consists of clause (2). • Do not demodulate. • Delete all generated clauses that are not of the form s(x,tl) = tl. No proofs were found with any of the forward searches. The largest search kept approximately 4500 clauses and required about 12 CPU hours on an EN CORE Multimax (1 processor). Clause D-6 of Proof D was not among-the 4500 clauses; in particular, the search had not progressed even two steps toward Proof D. (Of course, the search may have been further along toward a different proof.) Clauses on which to focus during the search (the focal clauses) were chosen by symbol count, and clause D-5, although generated early in the search, was never chosen as the focal clause because it has too many symbols. Having approximately 2500 negative equalities from a backward search and approximately 4500 positive equalities from a forward search, our next step was to determine if any unit conflicts existed among those 7000 clauses. Each unit conflict results in a bidirectional proof of the theorem in question. A simple (but rather lengthy) ITP run was made to find all unit conflicts among the more than 11 million combinations. The result was that 16 unit conflicts were found. A study of the variable substitutions of the unit conflicts revealed that five different sages, including the previously known J and K sages, had been found. The three new sages were named L, M, and N. One of the 4500 positive equalities conflicted with five of the 2500 negative equalities to produce the five sages, and we decided to focus on those five proofs of the five sages. The positive clause is ■» 31. 8(x,8{3(W,W),y))*L
s(s(W,s(W,s(£s(B,x)))),y).
The five negative clauses that conflict with clause 31 to produce, respectively, sages J, K, L, M, and N, are 253. s(f(s(s(B, s(W, x)% s(s(B, y), s(s(B,'z), w)))), s(s(W, x), s(y, s(z, s(w, f(s(s(B, s(W, x)), s(s(B, y), s(s(B, z), w))))))))) != s(s(x, s(y, s(z, s(w, f(s(s(B,
A Case Study in Automated Theorem Proving
741
s(W, x)), s(s(B, y), s(s(B, z), w)))))))), s(y, s(z, s(w, f(s(s(B, s(W, x)), s(s(B, y),s(s(B,z),w)))))))) 255. s(f(s(s(B, s(W, x)), s(s(B, s(s(B, y), z)), w))), s(s(W, x), s(y, s(z, s(w, f(s(s(B, s(W, x)), s(s(B, s(s(B, y), z)), w)))))))) != s(s(x, s(y, s(z, s(w, f(s(s(B, s(W, x)), s(s(B, s(s(B, y), z)), w))))))), s(y, s(z, s(w, f(s(s(B, s(W, x)), s(s(B, s(s(B, y), z)), w))))))) 274. s(f(s(s(B, s(s(B, s(W, x)), s(s(B, y), z))), w)), s(s(W, x), s(y, s(z, s(w, f(s(s(B, s(s(B, s(W, x)), s(s(B, y), z))), w))))))) != s(s(x, s(y, s(z, s(w, f(s(s(B, s(s(B, s(W, x)), s(s(B, y), z))), w)))))), s(y, s(z, s(w, f(s(s(B, s(s(B, s(W, x)), s(s(B, y), z))), w)))))) 272. s(f(s(s(B, s(s(B, s(W, x)), y)), s(s(B, z), w))), s(s(W, x), s(y, s(z, s(w, f(s(s(B, s(s(B, s(W, x)), y)), s(s(B, z), w)))))))) != s(s(x, s(y, s(z, s(w, f(s(s(B, s(s(B, s(W, x)), y)), s(s(B, z), w))))))), s(y, s(z, s(w, f(s(s(B, s(s(B, s(W, x)), y)), s(s(B, z), w))))))) 423. s(f(s(s(B, s(s(B, s(s(B, s(W, x)), y)), z)), w)), s(s(W, x), s(y, s(z, s(w, f(s(s(B, s(s(B, s(s(B, s(W, x)), y)), z)), w))))))) != s(s(x, s(y, s(z, s(w, f(s(s(B, s(s(B, s(s(B, s(W, x)), y)), z)), w)))))), s(y, s(z, s(w, f(s(s(B, s(s(B, s(s(B, s(W, x)), y)), z)), w)))))) In order to have more readable proofs with shorter clauses, the five proofs were transformed into forward input proofs. The deduction of clause 31 was transformed into an input deduction, and for each of the five negative clauses, the individual steps were inverted to produce a forward input proof. The results are Proofs J, K, L, M, and N. Note the following points about the proofs. • The five proofs share the same first five steps—the deduction of clause 31. Proofs J and K consist of 10 steps, Proofs L and M consist of 11 steps, and Proof N consists of 12 steps. Only small variations exist among the second parts of the five proofs. • The clauses in Proofs J and K have fewer symbols than the clauses in proofs D and E. (This is not surprising, because ITP was directed to focus on clauses with fewer symbols.) Proof J. Transformed ITP proof of J sage: ((B(WW))((BW)((BB)B))) J-2. s(x, s(y, z)) = s(s(s(B, x), y), z) J-3. s(s(x, y), y) = s(s(W, x), y) J-4. s(f(x), s(x, f(x))) ! - s(x, f(x)) J-5. [p, 3, 2, [1, 2]] s(x, s(s(W, y), z)) = s(s(s(B, x), s(y, z)), z) J-6. [p, 3, 5, [1, 2]] s(x, s(s(W, W), y)) = s(s(s(B, x), s(y, y)), y) J-7. [p, 2, 6, [2, 1]] s(x, s(s(W, W), y)) = s(s(s(s(B, s(B, x)), y), y), y) J-8. [p, 3, 7, [2, 1]] s(x, s(s(W, W), y)) = s(s(s(W, s(B, s(B, x))), y), y) J-31. [p, 3, 8, [2]] s(x, s(s(W, W), y)) = s(s(W, s(W, s(B, s(B, x)))), y) J-35. [p, 2, 31, [2, 1, 2, 2]] s(x, s(s(W, W), y)) = s(s(W, s(W, s(s(s(B, B), B), x))), y)
742
Collected Works of Larry Wos
J-69. [p, 2, 35, [2, 1, 2]] s(x, s(s(W, W), y)) = s(s(W, s(s(s(B, W), s(s(B, B), B)), x)), y) J-93. [p, 3, 69, [2]] s(x, s(s(W, W), s(s(s(B, W), s(s(B, B), B)), x))) = s(s(W, W), s(s(s(B, W), s(s(B, B), B)), x)) J-121. [p, 2, 93, [1, 2]] s(x, s(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), B))), x)) = s(s(W, W), s(s(s(B, W), s(s(B, B), B)), x)) J-122. [p, 2, 121, [2]] s(x, s(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), B))), x)) = s(s(s(B, s(W, W)), s(s(B, W), s(s(B, B), B))), x) J-130. [4, 122] □ Proof K. Transformed ITP proof of K sage: ((B(WW))((B((BW)B))B)) K-2. s(x, s(y, z)) = s(s(s(B, x), y), z) K-3. s(s(x, y), y) = s(s(W, x), y) K-4. s(f(x), s(x, f(x))) != s(x, f(x)) K-5. [p, 3, 2, [1, 2]] s(x, s(s(W, y), z)) = s(s(s(B, x), s(y, z)), z) K-6. [p, 3, 5, [1, 2]] s(x, s(s(W, W), y)) = s(s(s(B, x), s(y, y)), y) K-7. [p, 2, 6, [2, 1]] s(x, s(s(W, W), y)) = s(s(s(s(B, s(B, x)), y), y), y) K-8. [p, 3, 7, [2, 1]] s(x, s(s(W, W), y)) = s(s(s(W, s(B, s(B, x))), y), y) K-31. [p, 3, 8, [2]] s(x, s(s(W, W), y)) = s(s(W, s(W, s(B, s(B, x)))), y) K-36. [p, 2, 31, [2, 1, 2]] s(x, s(s(W, W), y)) = s(s(W, s(s(s(B, W), B), s(B, x))), y) K-60. [p, 2, 36, [2, 1, 2]] s(x, s(s(W, W), y)) = s(s(W, s(s(s(B, s(s(B, W), B)), B), x)), y) K-86. [p, 3, 60, [2]] s(x, s(s(W, W), s(s(s(B, s(s(B, W), B)), B), x))) = s(s(W, W), s(s(s(B, s(s(B, W), B)), B), x)) K-119. [p, 2, 86, [2]] s(x, s(s(W, W), s(s(s(B, s(s(B, W), B)), B), x))) = s(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), B)), x) K-120. [p, 2, 119, [1, 2]] s(x, s(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), B)), x)) = s(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), B)), x) K-129. [4, 120] D Proof L. Transformed ITP proof of L sage: ((B((B(WW))((BW)B)))B) L-2. s(x, s(y, z)) = s(s(s(B, x), y), z) L-3. s(s(x, y), y) = s(s(W, x), y) L-4. s(f(x), s(x, f(x))) != s(x, f(x)) L-5. [p, 3, 2, [1, 2]] s(x, s(s(W, y), z)) = s(s(s(B, x), s(y, z)), z) L-6. [p, 3, 5, [1, 2]] s(x, s(s(W, W), y)) = s(s(s(B, x), s(y, y)), y) L-7. [p, 2, 6, [2, 1]] s(x, s(s(W, W), y)) = s(s(s(s(B, s(B, x)), y), y), y) 1^8. [p, 3, 7, [2, 1]] s(x, s(s(W, W), y)) = s(s(s(W, s(B, s(B, x))), y), y) L-31. [p, 3, 8, [2]] s(x, s(s(W, W), y)) = s(s(W, s(W, s(B, s(B, x)))), y) L-36. [p, 2, 31, [2, 1, 2]] s(x, s(s(W, W), y)) = s(s(W, s(s(s(B, W), B), s(B, x))), y)
A Case Study in Automated Theorem Proving
743
L-65. [p, 3, 36, [2]] s(x, s(s(W, W), s(s(s(B, W), B), s(B, x)))) = s(s(W, W), s(s(s(B, W), B), s(B, x))) L-114. [p, 2, 65, [1, 2]] s(x, s(s(s(B, s(W, W)), s(s(B, W), B)), s(B, x))) = s(s(W, W), s(s(s(B, W), B), s(B, x))) L-115. [p, 2, 114, [2]] s(x, s(s(s(B, s(W, W)), s(s(B, W), B)), s(B, x))) = s(s(s(B, s(W, W)), s(s(B, W), B)), s(B, x)) L-127. [p, 2, 115, [1, 2]] s(x, s(s(s(B, s(s(B, s(W, W)), s(s(B, W), B))), B), x)) = s(s(s(B, s(W, W)), s(s(B, W), B)), s(B, x)) L-128. [p, 2, 127, [2]] s(x, s(s(s(B, s(s(B, s(W, W)), s(s(B, W), B))), B), x)) = s(s(s(B, s(s(B, s(W, W)), s(s(B, W), B))), B), x) L-133. [4, 128] D Proof M. Transformed ITP proof of M sage: ((B((B(WW))W))((BB)B)) M-2. s(x, s(y, z)) = s(s(s(B, x), y), z) M-3. s(s(x, y), y) = s(s(W, x), y) M-4. s(f(x), s(x, f(x))) != s(x, f(x)) M-5. [p, 3, 2, [1, 2]] s(x, s(s(W, y), z)) = s(s(s(B, x), s(y, z)), z) M-6. [p, 3, 5, [1, 21] s(x, s(s(W, W), y)) = s(s(s(B, x), s(y, y)), y) M-7. [p, 2, 6, [2, lj] s(x, s(s(W, W), y)) = s(s(s(s(B, s(B, x)), y), y), y) M-8. [p, 3, 7, [2, 1]] s(x, s(s(W, W), y)) = s(s(s(W, s(B, s(B, x))), y), y) M-31. [p, 3, 8, [2]] s(x, s(s(W, W), y)) = s(s(W, s(W, s(B, s(B, x)))), y) M-35. [p, 2, 31, [2, 1, 2, 2]] s(x, s(s(W, W), y)) = s(s(W, s(W, s(s(s(B, B), B), x))), y) M-76. [p, 3, 35, [2]] s(x, s(s(W, W), s(W, s(s(s(B, B), B), x)))) = s(s(W, W), s(W, s(s(s(B, B), B), x))) M-101. [p, 2, 76, [1, 2]] s(x, s(s(s(B, s(W, W)), W), s(s(s(B, B), B), x))) s(s(W, W), s(W, s(s(s(B, B), B), x)))
M-106. [p, 2, 101, [2]] s(x, s(s(s(B, s(W, W)), W), s(s(s(B, B), B), x))) = s(s(s(B, s(W, W)), W), s(s(s(B, B), B), x)) M-123. [p, 2, 106, [1, 2]] s(x, s(s(s(B, s(s(B, s(W, W)), W)), s(s(B, B), B)), x)) = s(s(s(B, s(W, W)), W), s(s(s(B, B), B), x)) M-124. [p, 2, 123, [2]] s(x, s(s(s(B, s(s(B, s(W, W)), W)), s(s(B, B), B)), x)) = s(s(s(B, s(s(B, s(W, W)), W)), s(s(B, B), B)), x) M-131. [4, 124] D Proof N. Transformed /TP proof of N sage: ((B((B((B(WW))W))B))B) N-2. s(x, s(y, z)) = s(s(s(B, x), y), z)a N-3. s(s(x, y), y) = s(s(W, x), y)
N-4. N-5. N-6. N-7. N-8.
s(f(x), s(x, f(x))) != s(x, f(x)) [p, 3, 2, [1, 2]] s(x, s(s(W, y), z)) = s(s(s(B, x), s(y, z)), z) [p, 3, 5, [1, 2]] s(x, s(s(W, W), y)) = s(s(s(B, x), s(y, y)), y) [p, 2, 6, [2, 1]] s(x, s(s(W, W), y)) = s(s(s(s(B, s(B, x)), y), y), y) [p, 3, 7, [2, 1]] s(x, s(s(W, W), y)) = s(s(s(W, s(B, s(B, x))), y), y)
Collected Works of Larry Wos
744
N-31. [p, 3, 8, [2]] s(x, s(s(W, W), y)) = s(s(W, s(W, s(B, s(B, x)))), y) N-41. [p, 3, 31, [2]] s(x, s(s(W, W), s(W, s(B, s(B, x))))) = s(s(W, W), s(W, s(B, s(B, x)))) N-55. [p, 2, 41, [1, 2]] s(x, s(s(s(B, s(W, W)) ( W), s(B, s(B, x)))) = s(s(W, W), s(W, s(B, s(B, x)))) N-56. [p, 2, 55, [2]] s(x, s(s(s(B, s(W, W)), W), s(B, s(B, x)))) = s(s(s(B, s(W, W)), W), s(B, s(B, x))) N-112. (p, 2, 56, [2]] s(x, s(s(s(B, s(W, W)), W), s(B, s(B, x)))) = s(s(s(B, s(s(B, s(W, W)), W)), B), s(B, x)) N-113. [p, 2, 112, [1, 2]] s(x, s(s(s(B, s(s(B, s(W, W)), W)), B), s(B, x))) = s(s(s(B, s(s(B, s(W, W)), W)), B), s(B, x)) N-125. [p, 2, 113, [1, 2]] s(x, s(s(s(B, s(s(B, s(s(B, s(W, W)), W)), B)), B), x)) = s(s(s(B, s(s(B, s(W, W)), W)), B), s(B, x)) N-126. [p, 2, 125, [2]] s(x, s(s(s(B, s(s(B, s(s(B, s(W, W)), W)), B)), B), x)) = s(s(s(B, s(s(B, s(s(B, s(W, W)), W)), B)), B), x) N-132. [4, 126] D
6
A Bidirectional Search
We wished ITP to find a proof of the theorem in one search rather than in three separate runs. We wished also to find a bidirectional search that mimicked the strategies of the three separate runs. In particular, the forward part of the search (focusing on positive equalities) should use a different strategy than the backward part of the search (focusing on negative equalities). This required three minor extensions to ITP. First, an option to require that paramodulation be from the right sides of equalities was installed; second, a conditional quit command (to be used in batch mode) was installed; third, an option to require that searches be input searches was installed. With these new features, an ITP search was initiated with the following strategy. • Orient the input clauses as they are in Proofs B and C: (1) (2) (3) (4)
x =x s(s(s(B, x), y), z) = s(x, s(y, z)) s(s(W,x),y) = s(s(x,y),y) s(x,f(x))\ = s(f(x),s(x,f(x)))
• The initial set of support consists of clauses (2) and (4). • Alternate between backward and forward searching: in each cycle, focus on ten negative clauses, then five positive clauses. (This ratio was chosen because the branching factor for positive focal clauses was on the order of twice that for negative focal clauses.) • When searching backward, paramodulate from the lefthand sides only of
A Case Study in Automated Theorem Proving
745
clauses (2) and (3), demodulate all generated clauses with clause (2), and delete any generated clause that is ground (has no variables). • When searching forward, paramodulate from the righthand sides only of clauses (2) and (3), do not demodulate, and delete all generated clauses that are not of the form £1 = s(x, tl). A proof was found with the preceding strategy after approximately one hour of CPU time on a SUN 3. The proof required the generation of 2651 clauses of which 1086 were retained. The proof is bidirectional—three steps forward and six steps backward (one step was saved by demodulation). The proof constructs the J sage, and after transformation to a forward proof, it is very similar to Proof J.
7
Properties of t h e Sages
The five sages are J sage: ((B(WW))({BW)((BB)B))) /* Statman's sage */ K sage: ((B(WW)){{B((BW)B))B)) L sage: {{B{{B(WW))((BW)B)))B) M sage: {(B{{B(WW))W))((BB)B)) N sage: ((B((B{(B{WW))W))B))B) We wrote to Smullyan with the objective of determining whether or not our four new sages were of interest to experts in combinatory logic. Smullyan responded positively, and he observed several interesting properties of the sages. First, the sages contain a number of important and well known combinators as subterms. 1. ((BB)B) is the blackbird B\. The blackbird occurs in the J and M sages, and it satisfies [VxVyVzVu;] ((({Blx)y)z)w) 2. Let A be (B(WW)).
=
(z((yz)w)).
A occurs in all five sages, and it satisfies
[VxVy]((Ax)y) = (((xy)(xy))(xy)). 3. Let C be {{BW)B\. C occurs in the J sage, and it satisfies [VxVyVz](((Cx)y)*) = (x((yy)z)). 4. {{BW)B) is the lark L. The lark occurs in sages K and L, and it satisfies [VxVy]((Lx)y) = (x(yy)). With the preceding combinators, the sages can be rewritten as
Collected Works of Larry Wos
746 J sage: (AC) /* Statman's sage */ K sage: (A{(BL)B)) L sage: ((B(AL))B) Msage: ((B(AW))Bi) N sage: ((B((B(AW))B))B)
The extensionality axiom is VxVz((Vj/(a:2/) = (zy) —» x = z. Smullyan pointed out that C=((BL)B) holds in the presence of extensionality, and therefore, the J and K sages are equal when extensionality is assumed. He also observed that [Vx]((Bx)Bl) = {(B((Bx)B))B) holds in the presence of extensionality, and therefore, sages M and N are equal when extensionality is assumed. Due to the similarities among Proofs J, K, L, M, and N, we immediately conjectured that all five sages are equal in the presence of extensionality. The corresponding proofs were easily derived with the aid of the proof checker. We demonstrate that, in the presence of extensionality, sages J and K are equal by refuting the following set of clauses, where the symbol | means or. (1) x = x (2) s(s{s(B,x),y),z) = s(x,s(y,z)) (3)s(s{W,x),y) = s(s(x,y),y) (4) s(x,g(x,z)) / s(z,g(x,z)) \x = z (5) S(s(B, s(W, W)), S(s(B, W), s(s(B, B), B))) ? s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), B)) The refutation is not difficult. Resolve clauses (4) and (5) to deduce (6) s(s(s(B, s(W, WO), s(s(B, W), s(s(B, B), B))), x) ± s(s(s(B, s(W, W)), s(s(B, s(s(B, W), B)), B)), x) then demodulate with clause (2) to produce (7) s{s(W, W), s{W, s(B, s(B, x)))) ^ s(s(W, W), s(W, s(B, s(B, x)))). Clause (7) contradicts clause (1), and the proof is complete. (Note that the warbler, clause (3), is not used in the proof.) An almost identical proof exists for each pair of the five sages. To see this, observe that, if one starts with any of the five sages, say (, and next forms the term s(t,x), and then demodulates with (2), the result is the term s(s(W,W),s(W,s(B,s(B,x)))).
A Case Study in Automated Theorem Proving
8
747
Conclusion
The study presented in this article provides evidence of the value of relying heav ily on the assistance of various automated theorem-proving programs. In par ticular, the use of demodulation and the inference rule paramodulation proved most suitable for our study of combinators. This study also demonstrates that the use of automated theorem-proving programs sometimes enables researchers to answer open questions from fields in which they have very little knowledge. We approached the problem of constructing new combinators from given combinators from a syntactic point of view for several reasons. First, we know very little about combinatory logic. Had we known more, we might have used the B\, A, C, or L combinators of the preceding section. Second, the automated theorem-proving paradigm with which we operate is syntactically oriented. Fi nally, previous syntactic studies of open questions—for example, the studies in equivalential calculus presented in [6]—proved successful. Since studying, transforming, and mimicking a known proof of Statman's sage may have prevented us from finding substantially different sages, a course for future research is to seek still more sages. We close with an open question from Smullyan [4]: can one derive a sage from a bluebird and a mockingbird? M is a mockingbird if M satisfies the equation [Vx] (Afi) = (xx).
References [1] Glickfeld, B. and Overbeek, R., 'A Foray Into Combinatory Logic,' Journal of Automated Reasoning 2(4), 419-431 (1986). [2] Lusk, E. and Overbeek, R., 'The automated reasoning system ITP,' ANL84-27, Argonne National Laboratory (April, 1984). [3] Smullyan, R., To Mock a Mockingbird, Alfred A. Knopf, New York (1985). [4] Smullyan, R., Private Communication, April, 1986. [5] Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: Intro duction and Applications, Prentice-Hall, Englewood Cliffs, New Jersey (1984). [6] Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., 'A new use of an automated reasoning assistant: open questions in equivalential calculus and the study of infinite domains,' Artificial Intelligence 22, 303-356 (1984).
Challenge Problems Focusing on Equality and Combinatory Logic: Evaluating Automated Theorem-Proving Programs*
Larry Wos and William
McCune
Mathematics and Computer Science Division Argonne National Laboratory Argonne, IL 60439-4844 Abstract In this paper, we offer a set of problems for evaluating the power of au tomated theorem-proving programs and the potential of new ideas. Since the problems published in the proceedings of the first CADE conference proved to be so useful, and since researchers are now far more disposed to implementing and testing their ideas, a new set of problems is in or der to complement those that have been widely studied. In general, the new problems provide a far greater challenge for an automated theoremproving program than those in the first set do. Indeed, to our knowledge, five of the six problems we propose for study have never been proved with a theorem-proving program. For each problem, we give a set of statements that can easily be translated into a standard set of clauses. We also state each problem in its mathematical and logical form. In many cases, we provide a proof of the theorem from which a problem is taken so that one can measure a program's progress in its attempt to solve the prob lem. Two of the theorems we discuss are of especial interest in that they answer previously open questions concerning the constructibility of two types of combinator. We also include a brief description of a new strategy for restricting the application of paramodulation. All of the problems we propose for study emphasize the role of equality. This paper is tutorial in nature. •This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under contract W-31-109-Eng-38. Reprinted with permission from the Proceedings of Ninth International Conference on Automated Deduction, Lecture Notes in Computer Science, Vol. 310, ed. E. Lusk and R. Overbeek, Springer-Verlag, New York, pp. 714-729 (May 1988).
Challenge Problems Focusing on Equality and Combinatory Logic
1
749
Introduction
To estimate the possible value and power of an automated theorem-proving program or of a new approach, one needs various test problems. One cannot simply make diverse computations in the abstract about CPU cycles, conclusions drawn and discarded, conclusions drawn and retained, and such. Rather, one must attempt to solve problems from various areas—mathematics and logic, for example—with one's program or with the new approach. After all, the value of a discovery such as an inference rule or strategy rests mainly with its effectiveness for problem solving. To determine how well a given program is doing in its attempt to prove some given theorem or solve some specified problem, one usually requires access to a proof or solution to measure the program's progress. For, without knowing what the answer is, how can one estimate how close the program is to solving the assigned problem? Therefore, to facilitate and encourage the needed experi mentation, we offer in this paper various test problems, and for each we include a solution for measuring progress. All of the problems we present emphasize the role of equality. Each problem focuses on a theorem taken from combinatory logic. In general, the problems we propose for study are far more challenging than those usually used for evaluating a theorem-proving program or a new concept. As evidence of their difficulty, for almost all of them (from what we know) no proof has ever been obtained with a theorem-proving program. These problems are not only hard for a computer program to solve but, in many cases, also hard for a person to solve. One of the theorems (Theorem C3) answers a question that had been open, a question that concerns the constructibility of a particular type of combinator. Theorem C3 is also of interest in that it illustrates the excellent meld between automated theorem proving and combinatory logic, for its proof depends on various properties of unification. For each problem, we shall first state it as a logician would. To make the pre sentation self-sufficient, we shall, where necessary, give the needed background. Except in Section 2.1, our discussion of the required concepts will be terse. In that section, we do give a rather lengthy treatment of the problem under discus sion. We take this action in part to provide a sample of how one can proceed and to focus on various strategies for restricting paramodulation [RobinsonG69]— especially for those who are new to automated theorem proving—and in part to promote a sharp increase in experimentation in general. In particular, we include three short proofs of a simple theorem (Theorem Cl.l) to illustrate the role of different strategies. We conjecture that, with the rapid growth in the interest in automated theorem proving, and with the new breed of researcher who is far more excited about implementing and testing ideas, the field is eager for a set of problems that includes some perhaps beyond the capability of any program now in existence. To complement the mathematical and logical statement of a problem, we
750
Collected Works of Larry Wos
shall give a set of statements—abbreviated clauses—that can be used to sub mit the problem for attack by a theorem-proving program. If the paradigm on which a particular program is based does not rely on the use of clauses, the mathematical description that we give for each problem will make it possible to map the problem accordingly. In all cases, we shall supply a mathematical proof, an outline of such a proof, or a proof in abbreviated clause notation—sometimes, more than one of the three. Since almost all of the problems we pose have the property that no proof, as far as we know, has ever been obtained with a theorem-proving program, we include no statistics concerning an attempt to obtain a solution with one of our programs. We would, of course, be very interested in any statistics obtained by a researcher who is successful in solving one of the posed problems—if the solu tion is obtained with a program. Such statistics provide an important measure of a problem's difficulty and of a program's effectiveness. As an example, the statistics found in the earlier paper [McCharen76]—that focusing on problems and experiments and published in the first CADE conference proceedings—have proved most useful. In addition to our primary goal of encouraging researchers to test and eval uate programs, we have the secondary goal of causing others to supply various problems for this purpose. Although an earlier attempt to stimulate such con tributions clearly did not succeed, the changes evidenced in the past four years may be of sufficient magnitude that this new attempt will in fact succeed. Con sistent with our stated goals, we plan to make available some time in the future a database of test problems, including those presented in this paper and others we use for study. This database will be accessible by electronic mail. We focus on problems heavily emphasizing equality, in part because of the importance of this relation to so many possible applications of automated the orem proving, and in part because of a view we have concerning the history of automated theorem proving. In particular, were we sipping brandy and having a pleasant conversation with friends, we would suggest that automated theorem proving would have progressed far more rapidly had it not been for the dominant practice of treating equality as just another relation. Indeed, until relatively re cently, a large fraction of the discussion, research, and experimentation focusing on problems in which equality naturally plays a vital role (from the viewpoint of mathematics and logic) was in terms of the so-called P-formulation. For exam ple, to avoid the obstacles presented by directly coping with equality, the axiom of left identity in a group was almost always represented as P(e,x,x) rather than as f(e,x) = x which is unfortunate. Perhaps this practice was justified by the fact that the field had been in existence for only a few years; on the other hand, perhaps researchers should have been more aggressive. Now, at any rate, we recommend that, when the equality relation naturally dominates the description of a problem
Challenge Problems Focusing on Equality and Combinatory Logic
751
domain, the P-formulation be avoided where possible. With this introduction in hand, let us now turn to a brief discussion of no tation, and then to the field of combinatory logic from which we have taken the problems. Combinatory logic, one of the deepest areas of mathematics and logic, offers many problems to test—and perhaps surpass—a theorem-proving program's capacity to solve problems. This field also offers many opportuni ties to use such a program to make important contributions to mathematics and logic, and challenges one to add to the techniques used in automated theo rem proving. With regard to contributions to mathematics and logic, we include problems taken from our successful attack on various previously open questions. To illustrate how one can add to the power of automated theorem-proving pro grams, we include a brief discussion of a new strategy which was formulated to increase the effectiveness of our programs when used for studying combinators of various types. The object of the new strategy is to sharply restrict the ap plication of paramodulation. Since the strategy did in fact prove very useful for our studies of combinatory logic, it or a variant of it might be of use for studies of other fields of mathematics or logic.
2
Combinatory Logic
Before we discuss the first problem, let us supply the needed background, be ginning with notation. In all of the problems we offer, as commented earlier, we heavily emphasize equality and equality-oriented notation. Because we wish to emphasize that the equality relation is treated as a built-in relation, we write = or != between the arguments of a literal, rather than using a predicate such as EQUAL or -EQUAL followed by its two arguments. In other words, we do not precisely present clauses to characterize each problem but, instead, use ab breviated clauses, which we simply call clauses. One can, of course, attack the problems we present within ordinary first-order predicate calculus, which is ob viously necessary if one's program lacks the facility for treating equality as built in. Nevertheless, we strongly recommend that, if possible, the problems be con sidered within the extended first-order predicate calculus where equality does not require axiomatization. If one chooses to follow our recommendation, then one must of course include reflexivity as an axiom if paramodulation is the in ference rule to be used. We in fact did use paramodulation heavily in our studies of combinatory logic, the field from which we have taken the problems. Combinatory logic [Curry58,Curry72,Smullyan85,Barendregt81] is particu larly significant for mathematics and logic because it is concerned with the most fundamental aspects of both fields. This field is also of potential interest to automated theorem proving because it challenges the researcher to formulate new strategies to control the reasoning needed to solve problems focusing on combinators and their various properties. In addition, combinatory logic offers one the intriguing opportunity of attempting to answer a number of currently
752
Collected Works of Larry Wos
open questions, many of which are amenable to attack with a theorem-proving program playing the role of research assistant. To pique one's curiosity, we shall list some of these open questions. Combinatory logic can be viewed as an alternative foundation for mathematics— which was Curry's proposal—or viewed as a programming language. On the one hand, the logic offers the same generality and power as set theory in the sense that essentially all of mathematics can be embedded in it. On the other hand, any computable function can be expressed in combinatory logic, and the logic can be used as an alternative to the Turing machine. In fact, combinators have been used as the basis for the design of computers. This logic is concerned with the abstract notion of applying one function to another. For a more formal definition, we can borrow from Barendregt who defines combinatory logic as a system satisfying the combinators S and K (defined shortly) with S and K as constants, and satisfying reflexivity, symmetry, transi tivity, and two equality substitution axioms for the function that exists implicitly for applying one combinator to another. In other words, since the majority of combinatory logic can be studied strictly within the first-order predicate calcu lus, this logic is clearly within the province of automated theorem proving. Even further, although one can clearly operate within ordinary first-order predicate calculus and rely on inference rules such as hyperresolution and UR-resolution, we recommend that one instead study combinatory logic within the extended calculus and use paramodulation as the inference rule. (Of course, one might prefer to rely on an alternative inference rule for building in equality.) Therefore, to study the entire logic, we need only choose an appropriate function symbol, such as a to stand for "apply", and supply the axiom for reflexivity and those for the combinators S and K. x= x a(a(a(S,x),y),z) = a(a(x,z),a(y,z)) a(a(K,x),y) = x Even though one can study all of combinatory logic in terms of S and K, one can also study the field or subsets of it by choosing other combinators to replace S and K. Indeed, our focus will shift from one set of combinators to another, depending on the type of problem to be studied. For each combinator of interest, we supply an equation that gives the behavior of the combinator. In such an equation, the combinator appears as a constant. Strictly speaking, a combinator is a member of a class of objects that exhibits the behavior given by its equation. For example, were we being more rigorous, we would say that if the combinator E satisfies (Ex)y = x for all combinators x and y, then E is a K since K satisfies (Kx)y = x,
Challenge Problems Focusing on Equality and Combinatory Logic
753
which we stated earlier in clause form. Therefore, when a problem asks for the construction of a combinator E from a set P of combinators, the object is to find an expression in terms of the elements of P that exhibits the behavior that E does. The solvability of such problems is one of the reasons that the system consisting of S and K alone is studied, for one can always succeed in finding the required expression. Formally, one says that the set consisting of S and K alone is complete. To complete the background—especially for those who are new to auto mated theorem proving—we point out that, if one follows our recommendation of using paramodulation as the inference rule, one will directly encounter the impressive obstacle of coping with equality-oriented reasoning. Overcoming the difficulties inherent when equality plays a vital role is one of the most impor tant research areas in the field, which is one reason for illustrating (with three proofs of Theorem Cl. I) the use of different restriction strategies. The strategies for controlling the application of paramodulation include allowing or preventing paramodulation from a variable, into a variable, from the left side of an equality, from the right side of an equality, and into terms satisfying some given condi tion concerning their relative position within a statement. Since the advantages and disadvantages vary widely depending on which combination of strategies is employed, by discussing this aspect in the context of different proofs, we may succeed in increasing the interest in the corresponding research.
2.1
Problem 1
For the first problem in this section, we focus on one of the interesting properties, the weak fixed point property, that is sometimes present and sometimes absent for some given set P of combinators. From what we can tell, Raymond Smullyan deserves credit as the one to introduce and then study this property. His book To Mock a Mockingbird [Smullyan85] is an excellent source for problems and open questions, and a delight to read. We therefore need the following definition. Definition. If P is a given set of combinators, then the weak fixed point property holds for P if and only if for all combinators x there exists a combinator y such that y = xy. For this paper, because of the complexities that would otherwise be intro duced, we can give only the following small hint about why the weak fixed point property and the to-be-defined strong fixed point property are of interest. Godel's self-referential sentence and Kleene's recursion theorem can be inter preted as applications of fixed point combinators [Barendregt81]. Also, fixed point combinators were known as paradoxical combinators in the early days of combinatory logic, because the Russell Paradox and other paradoxes can be formulated in terms of fixed point combinators. To study a combinator of the type in which we are interested in here, we need an equation giving the behavior of the combinator. We restrict our attention to combinators that are called proper, a combinator is proper if the left side of
754
Collected Works of Larry Wos
its equation is left associated and consists of the combinator followed by some nonempty list of distinct variables, and the right side consists of some or all of the variables that occur on the left side. For example, the combinator S is defined with the equation ((Sx)y)z = (xz)(yz), which explains why we can, when studying S, use the second clause of the four clauses given earlier, where the function a is given explicitly to show that one combinator is being applied to another. Theorem C l . The weak fixed point property holds for the set P consisting of the combinators S and K alone, where ((Sx)y)z = (xz)(yz) and (Kx)y = x. Problem 1 asks for a proof of Theorem Cl. The following clauses, in abbre viated notation, characterize this problem. (In contrast, combinatory logic does not explicitly employ a function symbol such as a and observes the convention that all expressions are left associated unless otherwise indicated.) x = x a(a(a(S,x),y),z) = a(a(x,z),a(y,z)) a(a(K,x),y) = x y != a(f,y) If one assigns a chosen automated theorem-proving program the task of finding a proof for some specific theorem—in particular, for Theorem Cl—with the object of testing and evaluating the program, some means must exist for measuring the program's progress. The most obvious means—and perhaps the only significant one—focuses on what percentage of a proof has been found by the program. One must, therefore, have a proof in hand, or be able to complete a proof by using whatever information the program has found. To meet this requirement for Theorem Cl, we shall, as promised earlier, supply our own proof. Before we give that proof, let us focus on some simpler problems to provide additional information that might prove useful for attacking Theorem Cl in various ways—Problem 1 admits a number of distinct solutions—and, even more, might prove useful for formulating general strategies. These simpler problems illustrate some of the interesting aspects of the coupling of strategy and inference rule. Each of the simpler problems focuses on proving Theorem Cl.l, but proving it under different restrictions. Theorem C l . l . The weak fixed point property holds for the set P consisting of the combinators S, B, C, and I, where ((Sx)y)z = (xz)(yz), ((Bx)y)z = x(yz), ((Cx)y)z = (xz)y, and Ix = x. As part of the background, one might find it interesting and useful to note that, just as S and K form a complete set of combinators for combi natory logic, S, B, C, and I form a complete set for that part of the logic known as noneliminating. One can find other complete sets of combinators for noneliminating combinatory logic by reading a general text on the subject [Curry58,Curry72,Smullyan85,Barendregt81]. A combinator is noneliminating if all of the variables that appear on the left side of its equation also appear at least once on the right side. In other words, from the set consisting of S, B, C, and I, one can construct a combinator of any desired type from these four
Challenge Problems Focusing on Equality and Combinatory
Logic
755
combinators provided, of course, that the combinator to be constructed is noneliminating. Naturally, when a given set of combinators is complete for the entire logic or for a large fraction of the logic, one should expect to encounter various hazards when focusing on such a set. Among these hazards are the propensity for requiring the use of long expressions to complete a desired construction, the need to strongly consider permitting paramodulation from a variable, and the need to strongly consider permitting paramodulation into a variable. Each of the simpler problems focusing on proving Theorem C l . l , which we discuss on the path to giving a proof of Theorem C l , illustrates some of these obstacles. The following six clauses can be used. (l)x = x (2) a(a(a(S,x),y),z) = a(a(x,z),a(y,z)) (3) a(a(a(B,x),y),z) = a(x,a(y,z)) (4) a(a(a(C,x),y),z) = a(a(x,z),y) (5) a(I,x) = x (6) y != a(f,y) From this set of clauses, we can quickly and easily give three proofs of Theo rem C l . l . Each of the proofs satisfies some given restriction on paramodulation and corresponds to one of the simple problems we promised to examine. We include all three proofs to illustrate the use of different strategies that one might consider using in other studies. Note that, in the first of the three, we use paramodulation in a fashion that is contrary to our usual recommendations for its application—in particular, paramodulation both from and into variables occurs. As compensation, we do not allow paramodulation from the left side of any equality, and only terms in negative clauses are allowed to be into terms. In other words, from a technical viewpoint, we place clause (6) only in the set of support and require every paramodulation to be related to what is called in combinatory logic an expansion. For the first proof, in fact, the strategy consists of using set of support and restricting paramodulation to expansions into terms confined to the second argument of an inequality. P r o o f 1 of T h e o r e m C l . l (1) (2) (3) (4) (5) (6)
x - x a(a(a(S,x),y),z) = a(a(x,z),a(y,z)) a(a(a(B,x),y),z) = a(x,a(y,z)) a(a(a(C,x),y).z) = a(a(x,z),y) a(I,x) = x y != a ( f , y )
from the second argument of clause (3) into term a(f,y) of clause (6) (7) a(y,z) != a(a(a(B,f),y),z)
Collected Works of Larry Wos
756
from the second argument of clause (5) into the second occurrence of the term z in clause (7) (8) a(y,z) !- a(a(a(B,f),y),a(I,z))
Clause (8) and clause (2) form a unit conflict, which can be seen by letting the variables in clause (2) be x, u, and v in the order in which they occur, and applying the substitution a(B,f) for x, I for u, and a(a(S,a(B,f)),I) for v, y, and z. Therefore, a contradiction is obtained, and the proof is complete. Proof 1 shows that indeed the weak fixed point property holds for the set P consisting of S, B, C, and I. Note that the combinator C plays no role in this proof. To use the proof of Theorem Cl.l to obtain the value for the existentially quantified variable y that occurs in the definition of the weak fixed point prop erty, one can adjoin the ANSWER literal—in this case, the literal ANSWER(y)— to the clause corresponding to the denial of the theorem. The ANSWER literal will contain at each point in the proof the current instantiation of the universally quantified variable y that exists because of assuming Theorem Cl.l false. One simply takes the argument of the ANSWER literal when unit conflict is found and, taking into account that we began by assuming the theorem false, replaces the constant / by the variable x. Summarizing, an examination of the unifica tion that establishes unit conflict, the negation of the conclusion of Theorem Cl.l, and the path that leads to the unit conflict shows that, for the existentially quantified y that one is seeking, one can choose the square of ((S(Bx))I). As we see in the second proof we give shortly, we can avoid paramodulation from and into variables if we allow paramodulation from the left sides of the various clauses—allow paramodulations related to what are called reductions in combinatory logic. The avoidance of paramodulating from and into variables is often essential for—as is known to those how have experimented with paramod ulation or other approaches to building in equality—allowing from terms or into terms to be variables usually destroys the effectiveness of a theorem-proving pro gram. The reason for such total destruction, for those who may be new to this aspect of the field, is that variables always unify with any chosen expression. This property of never failing to unify would not necessarily be so damaging if a pro gram could separate the needed deductions from the unneeded, but no one has come close as yet to discovering a strategy that produces anything resembling such a separation. Such a discovery would deserve and receive overwhelming acclaim, if it were ever made. Proof 2 of Theorem C l . l (1) (2) (3) (4)
x » x a(a(a(S,x),y),z) = a(a(x,z),a(y,z)) a(a(a(B,x),y),z) = a ( x , a ( y , z ) ) a(a(a(C,x),y),z) - a ( a ( x , z ) , y )
Challenge Problems Focusing on Equality and Combinatory Logic
757
(5) a(I,x) - x (6) y !- a(f,y) from the second argument of clause (3) into term a(f,y) of clause (6) (7) a(y,z) != a(a(a(B.f),y),z) from the second argument of clause (2) into term a(a(a(B,f),y),z) of clause (7) (8) a(v,a(u,v)) != a(a(a(S,a(B,f)),u),v) from the first argument of clause (5) into term a(u,v) of clause (8) (9) a(v,v) != a(a(a(S,a(B,f)),I),v)
Clause (9) unit conflicts with clause (1), and the proof is complete. We can even get a proof that prevents paramodulation from using variables as from terms or as into terms, and also restricts it to the use of expansions only. However, where the first two proofs fail to use C, the third proof fails to use I. Proof 3 of Theorem C l . l (1) (2) (3) (4) (5) (6)
x = x a(a(a(S,x),y),z) - a(a(x,z),a(y,z)) a(a(a(B,x).y),z) = a(x,a(y,z)) a(a(a(C,x),y),z) = a(a(x,z),y) a(I,x) =• x y !- a(f,y)
from the second argument of clause (3) into term a(f,y) of clause (7) a(y,z) != a(a(a(B,f),y),z) from the second argument of clause (4) into term a(a(a(B,f),y),z) of clause (7) (8) a(z,y) != a(a(a(C,a(B,f)),y),z)
Clause (8) unit conflicts with clause (2)—which can be seen by naming the variables in clause (2) x, u, and v, and by substituting a(C,a(B,f)) for x, a(S,a(C,a(B,f))) for u, v, and y, and a(a(S,a(C,a(B,f))),a(S,a(C,a(B,f)))) for z—and the proof is complete. An analysis of this third proof shows that, for the y that must exist for the weak fixed point property to hold for Theorem Cl.l, one can choose the cube of S(C(Bx)) in contrast to the square of ((S(Bx))I) which was found in the first two proofs. Because the set of combinators consisting of S and K alone is complete, we could use either value of y to lead us to a proof of Theorem Cl by expressing
758
Collected Works of Larry Wos
certain combinators in terms of S and K. In particular, we could construct two combinators that, respectively, act like B and I, or two that, respectively, act like B and C. One would then use either value of y found by proving Theorem Cl.l, but replace the appropriate combinators by the corresponding expressions in terms purely of S and K. However, this indirect path is not what we have in mind when we suggest proving Theorem Cl as the first problem posed in this paper. That indirect path depends on either making a good guess about which other sets of combinators are (sufficiently) complete—for example, the set consisting of S, B, C, and I—or making a good guess about which sets have the weak fixed point property. Because we had found the two given values of y in other studies, we were able to pursue the indirect path to proving Theorem Cl quickly and easily with the program ITP. But that is not the objective of Problem 1. Instead, we suggest that the theorem-proving program one is evaluating should attempt to prove Theorem Cl directly—using as axioms that for S, that for K, and that for reflexivity—by simply denying that the weak fixed point property holds for the set P consisting of S and K alone. Our attempt to obtain a computer proof of Theorem Cl along this direct path of inquiry failed, which is one reason why we consider Problem 1 to be an interesting challenge. Since we are suggesting problems as challenges for various theorem-proving programs rather than for theorem-proving people, we shall complete a proof of Theorem Cl rather than assigning that task to the researcher. We shall use Theorem Cl.l in our proof despite the preceding remarks. We take this action to increase the likelihood of independent and uninfluenced experimentation and, as one might suspect, because of certain pedagogical considerations. We shall employ algebraic notation rather than clause notation for this proof. A Proof of Theorem C l From Proof 1 of Theorem Cl.l, one can conclude that (1) ((S(Bx))I)((S(Bx))I) = x(((S(Bx))I)((S(Bx))I)) is true for all x. One can check this equality by simply applying the equations (given as clauses (2), (3), and (5) in Section 2.1) for S, B, and I to the left side of (1) to obtain the right side. Next, one can prove that (2) ((SK)K)x = x for all x, which translates to the statement that (SK)K is an I, or, equivalently, (SK)K behaves as I does. Then one can show that (3) ((((S(KS))K)x)y)z = x(ya) for all x, y, and z. Equation (3) says that (S(KS))K is a B, or, equivalently, be haves like B. Because of equations (2) and (3) and the remarks made concerning their meaning, we can in effect substitute into equation (1) for both B and I to obtain (4) ((S(((S(KS))K)x))((SK)K))((S(((S(KS))K)x))((SK)K)) = x(((S(((S(KS))K)x))((SK)K))((S(((S(KS))K)x))((SK)K))), which holds for all x, and the proof of Theorem Cl is complete. We can improve on the result contained in the proof of Theorem Cl by
Challenge Problems Focusing on Equality and Combinatory Logic
759
presenting a simpler value for the y that must exist satisfying y = xy, the equation that defines the weak fixed point property. In particular, if we let y be the square of (S(S(Kx)))((SK)K), we can apply the equations for S and for K and show that this y also satisfies the equation for the weak fixed point property. The simpler y can be found by taking the term Bx in the square of (S(Bx))I and using equation (3) to write B in terms of S and K, then reducing both occurrences of the replaced term with S, and finally using equation (2) to write I in terms of S and K. We therefore have two solutions to Problem 1, and could even obtain a third by focusing on the cube of S(C(Bx)). In the context of Problem 1 and its given solutions, we can immediately pose one of the promised open questions. Does the second solution contain the shortest expression for a y satisfying the weak fixed point property, where y is expressed purely in terms of S, K, and a variable? Having finished with Problem 1, we can turn in the next section to the sec ond problem we suggest for testing and evaluating theorem-proving programs. However, in contrast to the treatment we have just given Problem 1, we shall be far briefer from here on, confining the discussion in most cases to the state ment of the problem and a short proof in logical or mathematical terms. The copious details we have given regarding Theorem Cl.l can be used as a guide for interpreting the clauses obtained when attempting to solve later problems. They are included also to provide an example of how one can map a logical or mathematical proof into clause notation.
2.2
Problem 2
The second problem we pose asks one to use an automated theorem-proving program to find a proof of Theorem C2, which we state after introducing another new concept. For this problem, we need the definition of the strong fixed point property. Definition. If P is a given set of combinators, then the strong fixed point property holds for P if and only if there exists a combinator y such that, for all combinators x,yx — x(yx). Theorem C2. The strong fixed point property holds for the set P consisting of the combinators B and W alone, where ((Bx)y)z = x(yz) and (Wx)y = (xy)y. To add to the background for studying problems from combinatory logic, we note that the presence for P of the strong fixed point property implies the presence of the weak fixed point property. The converse is not true, as one can see by considering the combinator L with (Lu)v = u(vv), noting that the expression (Lx)(Lx) is a y that satisfies the equation for the weak fixed point property which establishes that that property holds for the set P consisting of L alone, and by using Theorem C3 to show that the strong fixed point property does not hold for this set P. The following clauses can be used in the attempt to have a theorem-proving
Collected Works of Larry Wos
760 program solve Problem 2. (1) (2) (3) (4)
x= x a(a(a(B,x),y),z) = a(x,a(y,z)) a(a(W,x),y) = a(a(x,y),y) a(y,f(y)) != a(f(y),a(y,f(y)))
Even though we recommend this set of clauses for studying Problem 2, we now give a proof more in the style that an algebraist might give. A Proof of Theorem C2 Let N = ((B((B((B(WW))W))B))B). Since, with the following sequence of equalities, we can show that Nx = x(Nx) for all a;, we can set y equal to N to complete our proof. To obtain the sequence, we begin with Nx, occasionally abbreviate (W(B(Bx))) to R, apply the reduction corresponding to B or that corresponding to W depending on the leading symbol of the expression under consideration, and substitute from an intermediate result to deduce the final step. Nx = ((B((B((B(WW))W))B))B)x = ((B((B(WW))W))B)(Bx) = ((B(WW))W)(B(Bx)) = (WW)(W(B(Bx))) = (W(W(B(Bx))))(W(B(Bx))) = ((W(B(Bx)))(W(B(Bx))))(W(B(Bx))) = (RR)R = (((B(Bx))R)R)R = ((Bx)(RR))R = x((RR)R) = x(Nx) Here we have an example of how automated theorem proving differs sharply from mathematics. Specifically, a theorem-proving program has no way to mag ically offer an expression, such as N, for use in completing a proof. The math ematician, on the other hand, often exhibits the disarming capacity to make such offers; the offers are based on experience, intuition, and who knows what else. This dichotomy between the approach that apparently must be taken by a theorem-proving program and that which is frequently taken by a mathemati cian is precisely why the two make a powerful team for solving problems and answering open questions. Indeed, the combinator N, which answered a ques tion that was once open, is just such an example of effective teamwork. This combinator was discovered while we were studying B and W with the assistance of various theorem-proving programs designed and implemented by members of our group. That same study also led us to formulate a new strategy, mentioned earlier, for sharply restricting the application of paramodulation. The strategy restricts paramodulation to considering an into term only if its position vector consists of all l's; we express this restriction by saying that all paramodulation steps must satisfy the l's rule. The position vector of a term gives the position of the term within a literal. For example, the position vector [2,3,1] says that the corresponding term is the first subterm of the third subterm of the second argument. For a concrete illustration of the use of position vectors, the third occurrence of the constant W in the equality a(a(B,a(a(B,a(a(B,a(W,W)),W)),B)),B) = N
Challenge Problems Focusing on Equality and Combinatory Logic
761
has the position vector [1,1,2,1,2,2]. (The fixed point combinator N played a vital role in our discovery of what turned out to be an astoundingly large family of combinators.) We find this strategy of restricting into terms to be chosen from those whose position vector consists of all l's to be very effective for our studies of combinatory logic. The strategy, as we discovered some time after its formulation, focuses on a generalization of what is known in combinatory logic as a head reduction.
2.3
Problem 3
For the third problem, we focus on Theorem C3, a theorem we proved to answer a previously open question concerning the possible constructibility, from the combinators B and L alone, of a fixed point combinator. For the problem under discussion, we depart rather sharply from our usual practice of focusing on proof by contradiction by suggesting instead that an automated theorem-proving pro gram be used to find a model pertinent to Theorem C3. If the program succeeds in finding such a model, then, in a sense that will become obvious \ipon read ing the statement of Theorem C3, the program will have found a proof of that theorem. Theorem C3. The strong fixed point property fails to hold for the set P con sisting of the combinators B and L alone, where ((Bx)y)z = x(yz) and (Lx)y = x(yy). Equivalently, from B and L alone, one cannot construct a Q such that Qx = x(Qx) for all x. A Proof of Theorem C3 Assume, by way of contradiction, that the strong fixed point property holds for B and L. Then there exists a combinator Q, which is constructed from B and L alone, such that, for an arbitrary combinator / , Qf = f(Qf). (We use the constant / rather than F to be consistent with our notational convention when denying some theorem is true.) By the Church-Rosser property for combinatory logic, there exists a combinator E such that Qf reduces to E and f(Qf) also reduces to E. (The reductions that are used are paramodulations from the left sides of B and L.) Since f(Qf) reduces to E, and since the first occurrence of / cannot be affected by any reduction with B or L, E must be of the form fT for some combinator T. Therefore, Qf reduces to fT for that same T. The combination Qf obviously has the form CD, where C contains no occurrences of / . Let us consider a one-step reduction of CD and show by case analysis that the result CD is such that C contains no occurrences of / . Case 1. The reduction involves C only or D only. Obvious. Case 2. The reduction is with B and involves both C and D. Then C must unify with (Bx)y, D must unify with z, C must be the image of x, and D must be the image of yz. Therefore, C must be a subterm of C, which implies that C contains no occurrences of / . Case 3. The reduction is with L and involves both C and D. Then C must
Collected Works of Larry Wos
762
unify with Lx, D must unify with y, C must be the image of x, and D must be the image of yy. Therefore, C must be a subterm of C, which implies that C contains no occurrences of / . We can conclude that, regardless of the number of reductions we apply start ing with CD = Qf, we can never obtain a combinator of the form C*D* with C* containing an occurrence of / . In particular, we can never reduce Qf to fT, and we have arrived at a contradiction. In other words, the strong fixed point property fails to hold for the set P consisting of B and L alone. The object of Problem 3 is to find a model that satisfies B and L but fails to satisfy the strong fixed point property. Of course, such a model would show that indeed the strong fixed point property does not hold for the set consisting of B and L alone. Problem 3 has added interest since, as far as we know, no one has yet succeeded in finding such a model—in other words, Problem 3 is an open problem. Of course, since we have just proved Theorem C3, a model with the desired properties must exist. Before we had proved Theorem C3, as commented earlier, the question focusing on the constructibility of a fixed point combinator from B and L alone was open. An alternative to Problem 3 asks for an automated theorem-proving program to find a proof of Theorem C3 directly, starting with its denial and proceeding in the standard fashion in our field. Such an achievement would be of great interest since the proof we give is outside first-order predicate calculus. However, various researchers in the field have discussed the possibility of using an automated theorem-proving program to prove theorems of this type—theorems whose proof depends on properties of unification, and theorems about unification.
2.4
Problem 4
For Problem 4, we focus on one of the systems of combinators that is known to be complete. As commented earlier, the set P consisting of the combinators S and K is one of those systems—given a combinator E and an equation that char acterizes its behavior, one can construct from S and K alone a combinator that behaves as E does. For such a construction, one can apply the well-known algo rithm found in Smullyan's book. Alternatively—as is standard in our field—one could have a theorem-proving program attempt such a construction by denying that any expression exists satisfying the equation given for the combinator E under study. If the program succeeds with this approach, then—as occurred in the various proofs of Theorem Cl.l—the desired construction is obtained by analyzing the unifications upon which the proof rests. The object of Problem 4 is to construct from S and K alone, by following the standard approach in automated theorem proving rather than by applying the well-known algorithm for such constructions, a combinator that behaves as the combinator U does, where the equation (Ux)y = y((xx)y) gives the behavior of U for all x and all y. The idea is to proceed as we illustrated
Challenge Problems Focusing on Equality and Combinatory Logic
763
in Section 2.1 and extract the construction from a proof by contradiction. One can use the following clauses. (l)x = x (2) a(a(a(S,x),y),z) = a(a(x,z),a(y,z)) (3) a(a(K,x),y) = x (4) a(a(z,f(z)),g(z)) != a(g(Z),a(a(f(z),f(z)),g(z))) Similar to our earlier approach, we shall simply give two answers to Problem 4, rather than giving a proof relying on these four clauses. If one affixes the variables x and y to either of the following expressions, and if one then reduces with S and K, one can see that both expressions do indeed behave like U. ((S((S(KS))K))((S(K(S((S((SK)K))((SK)K)))))K)) ((S(K(S((SK)K))))((S((SK)K))((SK)K))) The first of the two expressions can be found with the algorithm for using S and K for such constructions; the second can be found by noting that the com bination LO behaves like U, and then reducing a combinator that behaves like LO, where (Lx)y = x(yy) and (Ox)y = y(xy). Question: Is there a combinator, expressed purely in terms of S and K, containing fewer than 13 symbols that satisfies the equation for U?
2.5
Problem 5
Problem 5 focuses on the combinators S and W. ((Sx)y)z = (xz)(yz) (Wx)y = (xy)y
Problem 5, as with Problem 3, has the object of finding a model. The model one is seeking must satisfy S and W and fail to satisfy the weak fixed point property. The following clauses can be used to search for such a model. (1) (2) (3) (4)
x - x a(a(a(S,x),y),z) * a(a(x,z),a(y,z)) a(a(V,x),y) = a ( a ( x , y ) , y ) y != a ( f , y )
Rather than giving a complete proof of the theorem that corresponds to Problem 5, we are content with the following outline. To see that the set con sisting of S and W alone does not satisfy the weak fixed point property, we again rely on the Church-Rosser property for combinatory logic. In particular, if the weak fixed point property does hold, then there must exist an E and a T such that both T and fT reduce to E, where / is an arbitrary combinator. The number of leading / ' s in T is one less than the number in fT. Each socalled reduction with S or W does not increase the number of leading / ' s in
Collected Works of Larry Wos
764
T. Therefore, even with different reduction paths, no expression can exist such that both T and fT reduce to it, which contradicts the existence of E, and the proof outline is complete. Both the proof we have just outlined and the result concerning S and W, as far as we know, represent a new result in combinatory logic.
2.6
Problem 6
Problem 6 focuses on the combinators S and K. ((Sx)y)z = (xz)(yz) (Kx)y = x The object of Problem 6 is to prove that the strong fixed point property holds for the set P consisting of S and K alone. An appropriate combinator can be found by obtaining a refutation of the following clauses. (1) (2) (3) (4)
x = x a(a(a(S,x),y),z) = a(a(x,z),a(y,z)) a(a(K,x),y) = x a(y,f(y)) \(!« a(f(y),a(y,f(y)))
We give three fixed point combinators that are in effect solutions to Problem 6. We know of no shorter combinator than the one we list third. For readability, we use abbreviated notation with the following abbreviations. I = (SK)K, M = (SI)I, B = (S(KS))K, W = (SS)(SK). Here are the three solutions. ((S(K((SI)I)))((S(KW))B)) ((S(KM))((SB)(KM))) ((S(K(((SS)I)W)))B)
3
Conclusions
One of the most important activities in automated theorem proving is that of experimenting with various problems taken from mathematics and logic. Exper imentation is essentially the only way to measure the power of an automated theorem-proving program or the value of a new idea for increasing that power. In this paper, for such experiments, we focused on problems taken from combi natory logic, a field that is unusually amenable to attack with a theorem-proving program. Other areas from which problems can profitably be taken include ring theory (associative and nonassociative), lattice theory, and the algebra of regular expressions. We also have included various open questions since such questions often promote and provoke experimentation. Our emphasis throughout this pa per is on equality. Coping effectively with the equality relation is still one of the major obstacles in the field of automated theorem proving.
Challenge Problems Focusing on Equality and Combinatory Logic
765
References [Barendregt81] Barendregt, H. P., The Lambda Calculus: Its Syntax and Seman tics, North-Holland, Amsterdam (1981). [Curry58] Curry, H. B., and Feys, R., Combinatory Logic I, North-Holland, Amsterdam (1958). [Curry72] Curry, H. B., Hindley, J. R., and Seldin, J. P., Combinatory Logic II, North-Holland, Amsterdam (1972). [McCharen76] McCharen, J., Overbeek, R., and Wos, L., "Problems and exper iments for and with automated theorem proving programs", IEEE Transactions on Computers C-25, pp. 773-782 (1976). [RobinsonG69] Robinson, G., and Wos, L., "Paramodulation and theorem-proving in first-order theories with equality", pp. 135-150 in Machine Intelligence 4, ed. B. Meltzer and D. Michie, Edinburgh University Press, Edinburgh (1969). [Smullyan85] Smullyan, R., To Mock a Mockingbird, Alfred A. Knopf, New York (1985).
AUTOMATED THEOREM PROVING AND LOGIC PROGRAMMING: A NATURAL SYMBIOSIS*f LARRY WOS AND WILLIAM McCUNE t> We present a detailed review of the elements of automated theorem prov ing, emphasizing certain aspects of especial interest to the logic programming community. In particular, we focus heavily on how an automated theoremproving program can treat equality in a natural and yet effective manner, and how such a program can use strategy to control its reasoning in a sophisticated fashion. With the objective of increasing the scope of logic programming in a significant way, perhaps some unusually inventive researcher can adapt various procedures we review in this article, and adapt them in a way that preserves the vast majority of the speed offered by logic programming. Conversely, although our expertise rests far more in the field of automated theorem proving, we nev ertheless include certain observations concerning the value of logic programming to automated theorem proving in general. In other words, a natural symbiosis between automated theorem proving and logic programming exists, which nicely completes the circle since logic programming was born of automated theorem proving. <]
1
MOTIVATION
Occasionally one discovers that two fields, with apparently widely separate aims, in fact offer each other useful elements of theory and powerful techniques of implementation. In other words, a natural symbiosis exists. The two fields we have in mind are automated theorem proving and logic programming. At the most general level, the natural symbiosis between automated theorem proving and logic programming rests with three factors. 1. Historically, the study of logic programming stems from the study of au tomated theorem proving, especially from the research of the early 1960s. Address correspondence to Larry Wos, Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL 60439-4801. Received May 1989. *Invited paper. ■*■ This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38 Reprinted from the Journal of Logic Programming, Vol. 11, no. 1, pp. 1-53 (1991). All rights reserved. This reproduction is by special permission for this publication only.
Automated Theorem Proving and Logic Programming
767
2. After approximately twenty-five years, automated theorem proving can again play an important role for logic programming by offering what is needed to address two important aspects, that focusing on the effective treatment of equality, and that focusing on the sophisticated use of a variety of strategies. 3. Logic programming can in turn offer to automated theorem proving imple mentation techniques to sharply reduce the CPU time required to complete assignments. Although we leave a direct treatment of the first factor to various authors (see, in particular, the informative article by Elcock [9]), we do provide in Section 2 a review of automated theorem proving. A reading of the review may complete one's understanding of the roots of logic programming. Indeed, with binary resolution [25] (Section 2.2.1) as the basis, logic programming in the obvious sense is born of theorem proving. Of more immediate and practical value is our treatment of the second and third factors just cited. In particular, we provide solutions for the problems of how to effectively cope with equality (Sections 2.2.2 and 2.4) and how to materially broaden the scope of logic programming by using more powerful strategies (Section 2.3). To complete the picture, we discuss in some detail where the advances in logic programming will benefit automated theorem proving. In short, we show why the term symbiosis is appropriate and—for some—why symbiosis is the perfect term. Both automated theorem proving and logic programming are empirical sci ences, equally dependent on theory, implementation, and application. In addi tion, and perhaps more important, both fields are primarily interested in logical reasoning. And yet, from a global perspective, an essential difference exists be tween the two fields (see Section 3). Automated theorem proving is oriented to logical reasoning that might be termed unfocused and unalgorithmic—to borrow from our colleague Ross Overbeek—while logic programming is oriented toward focused and algorithmic reasoning. Indeed, the former is concerned with generalpurpose and often deep reasoning systems, while the latter is concerned—with certain exceptions—with programming languages and far less deep reasoning. Included among the exceptions are the applications of logic programming to deductive databases, expert systems, and theorem proving—applications that obviously can require deep reasoning. Especially, but not exclusively, for researchers interested in such applications, we shall show why the use of some version of the procedures that are so vital to automated theorem proving and that we discuss in Section 2 is indispensable. Indeed, the greater the depth of reasoning that is desired, the greater the need for the use of techniques like those employed in automated theorem proving. Of course, without doubt, logic programming does offer excellent features for symbolic manipulation, but—and here we have an issue that we address more fully in Sections 2 and 5—far more is needed to provide a firm foundation on
768
Collected Works of Larry Wos
which to build a deductive system for first-order logic, with or without equal ity. One of the most important features that is needed for effective automated theorem proving but that is lacking in logic programming as currently defined is the heavy use of different types of strategy, a fact that is often overlooked by researchers who wish to rely—almost solely—on logic programming for building a powerful theorem prover. Despite these differences, each field offers the other important benefits (Sec tion 4). To see that this view is shared by members of the logic programming community, we quote from F. Pereira's article [22]: "As researchers in automated deduction come up with new deductive procedures and strategies that happen to fit the requirements of logic programming, in equality reasoning for exam ple, the generality of the idea of logic programming is widened; and conversely, developments in logic programming—as, for example, the efficient implementa tion techniques for Prolog—can be generalized to help automated deduction." The latter has already occurred, as evidenced in the work of Overbeek and his colleagues [5] and the work of Stickel [28]; the time for the former to occur is now. Appropriately, our explicit objective is to encourage researchers to adapt features from automated theorem proving to extend the usefulness and increase the power of logic programming. Among the features to adapt are an effective built-in treatment of equality and, more important, a sophisticated use of semantically oriented strategy. Indeed, that is the nature of the suggestions we make throughout this article—to add to, not to replace, the features of logic programming. Of course, because we are still fascinated with automated theo rem proving even after more than twenty-five years of research, we also have the implicit and not-so-secret goal of acquainting (or, for those who already have some knowledge, more fully acquainting) members of the logic programming community with the elements of automated theorem proving. The main reason for pursuing the explicit objective of encouraging the recom mended research rests with the recognition that the adaptation of procedures from one field to another often results in important insights, extensions, and improvements for both fields. Should such occur, we would have a beautiful ex ample of ideas borrowed by one field from another, followed by a return with interest—from automated theorem proving to logic programming and back. The benefits for the logic programmer in studying the elements of automated theo rem proving rest with the insight gained from reviewing the historical connection of the two fields and with the increased familiarity with (possibly new) concepts that merit adaptation. With regard to how one might make the desired adaptations, we can only suggest the merest beginning. Specifically, one might begin by closely examining the elements that appear to provide the keys to the successes for automated theorem proving, at least the successes reported here (Section 1.2.1). One of the keys for much of the success of the researchers at Argonne National Laboratory rests with the natural and yet effective way in which equality is treated. Part of
Automated Theorem Proving and Logic Programming
769
that treatment rests with the use of an inference rule (paramodulation [24,38]) that enables a reasoning program to treat equality as if it is "understood". By using paramodulation, a program can reason directly deep within an expression, making the desired substitutions in a single step without need of the usual axioms for equality (Section 2.2.2). Perhaps some enterprising researcher can extend logic programming by adapting paramodulation in an effective manner. For a second example of how logic programming can be extended, perhaps a way can be found to use demodulation [40], a procedure for automatically canonicalizing expressions by applying the appropriate equalities as rewrite rules. The use of demodulation, like the use of paramodulation, sharply increases the power of automated theorem-proving programs. Their use by logic program ming might markedly increase the usefulness of the corresponding programs. In Sections 2.2.2 and 2.4, we provide the details to enable one to understand more fully why our built-in treatment of equality affects the performance of a theorem-proving program so dramatically. With regard to how one might begin the adaptation of the types of strategy used in automated theorem proving—strategy to restrict and also strategy to direct a program's reasoning—one might start by examining the material of Section 2.3 where we discuss the current use by logic programming of a limited form of the set of support strategy [39]. That the set of support strategy, which plays such a vital role in automated theorem proving, also plays an important role for logic programming may come as a surprise to many researchers. To aid the suggested research, we also discuss in Section 2.3 how the use of this semantically oriented strategy might be profitably extended. By extending the way in which the set of support strategy is used, logic programming can offer the user the opportunity of having the corresponding program reason recursively from just those statements that should be the focus of attention. Even more than an effective treatment of equality, a greatly expanded use of strategy will materially increase the power and usefulness of logic programming. If, in addition, someone finds a means to give logic programming access to the weighting strategy [17] (Section 2.3) for directing the reasoning and access to subsumption [25] (Section 2.5) for substantially reducing the paths to explore in search of a desired answer, then logic programming will have taken advan tage of much of what automated theorem proving has to offer. On the other hand, without employing strikingly more powerful strategy than that typically found in logic programming, hard problems, especially interesting theorems from mathematics and logic, will in general be out of reach. In particular, to have the power to prove even fairly difficult theorems, an automated theorem-proving program based on logic programming will require the incorporation of semanti cally oriented strategy. Postponing the presentation of the details and the discussion of additional suggestions to later sections, let us immediately focus on our qualifications and general outlook.
Collected Works of Larry Wos
770
1.1
Our General Outlook
To remove all doubts regarding our placement of automated theorem proving be fore logic programming in the title of this article, we note that our expertise lies in the field of automated theorem proving and not in logic programming. Indeed, the serious study at Argonne National Laboratory of the possibility of automat ing theorem proving began in 1963, and has continued without a break since then. We are deeply engrossed in that study and, as is so evident throughout this article, fascinated with the prospects and results. Therefore—predictably— this article will feature automated theorem proving far more than it does logic programming. Nevertheless, from various discussions with colleagues, we have learned enough to permit us to comment on both fields, and to focus on the potential value each has for the other. We view logic programming as "the study and use of carefully controlled deductive procedures as computing mechanisms" [22]. We also agree with F. Pereira [21] that the restriction to Horn clauses (clauses containing at most one positive literal) can be more than an inconvenience. Fortunately, the recogni tion of that fact by various members of the logic programming community has in fact led to studies focusing on dialects that are not restricted to the use of Horn clauses. Nevertheless, although we do not consider logic programming as identified with any of its incarnations—such as Prolog— many of our re marks are oriented toward Prolog and Prolog-like systems. Similarly, although we do not consider all of automated theorem proving to be identified with the approach taken at Argonne National Laboratory, nevertheless many of our re marks are oriented toward automated theorem-proving programs designed and implemented by researchers at this laboratory, programs such as AURA [27], ITP [15,16], and OTTER [18]. Despite the successes of and our attachment to the Argonne approach, we openly recognize various formidable obstacles to overcome and research prob lems to solve [34]. A strategy to sharply curtail the fecundity of paramodulation is needed. A strategy that recursively extends the power of the set of support strategy would be welcomed. A more effective treatment of set theory is re quired. We have virtually no idea of what to do about definition expansion and contraction. Our programs as yet do not offer induction. More generally, and common to the cited obstacles and others not mentioned here, is the obstacle of CPU time. The recognition of this obstacle of execution speed is, of course, one of the key factors in motivating various studies in logic programming. In particular, the desire to sharply reduce this obstacle may be the main cause for the interest in theorem-proving programs based on logic programming technology. Unfortunately, that approach to the automation of theorem proving merely replaces one obstacle, CPU time, by another, inaccessi bility to retained information. Of course, one might say that such inaccessibility is not an obstacle; rather, it is the key to the power offered by logic program ming. We shall discuss in Section 2 why such an assertion misses the point, why
Automated Theorem Proving and Logic Programming
771
the retention of information is essential—at least when the application focuses on solving hard problems or proving even moderately interesting theorems. For such applications, the need for information retention rests in part with the fact that a program cannot afford to continually rediscover key lemmas, facts, and relationships. For a taste of what is to be discussed regarding this need, we note that, without the retention of some intermediate information, an attempt at solving a hard problem will ordinarily lead to the pursuit of an inordinately large number of unprofitable paths. In contrast, the retention of information gives the program access to the use of demodulation, subsumption, and powerful strategies, with the result that many of those unprofitable paths are never considered. Naturally, the key question to answer focuses on the type of information to retain, which is one of the reasons we discuss in Section 2.2.3 linked inference and its possible implementation based on adapting techniques from logic programming. Summarizing, especially (but not exclusively) if the goal is to rely on logic programming to solve ever harder problems, one might study our case for in formation retention, our treatment of equality, and, most important, our use of strategy. Such a study, even if not completely persuasive, may lead to the insights needed to extend logic programming in important ways. Of course, we believe we have found the best path to pursue, no doubt greatly influenced by our successful use of various automated theorem-proving programs. Even if we are in error, we can quickly and easily present a number of causes for optimism.
1.2
Causes for Optimism
To set the stage for the material covered in the succeeding sections, let us briefly present our current position and prepare one for the obvious optimism— and sometimes wild excitement—that pervades this article. At the top level— although other factors exist—our optimism rests chiefly on 1. the successes—by relying heavily on a computer program that reasons logically—with answering open questions and verifying computer pro grams; 2. the availability of portable theorem-proving programs—some of which are in the public domain—mthat offer impressive power and, if run on a PC, offer enough power to solve small problems; 3. the sharp increase in the willingness—often eagerness—of researchers to experiment; and 4. access to a variety of computers that rely on parallel processing, and the significance of the advances occurring now in automated theorem proving and in logic programming.
772
Collected Works of Larry Wos
Keeping in mind that advances in both automated theorem proving and logic programming rely equally on developments in theory, implementation, and application, let us immediately focus on the four causes—in the order given—for our optimism and excitement. 1.2.1. Answering Open Questions and Verifying Computer Programs. Rather than a full understanding of the various successes, the nature of each achieve ment is the key for this diverse audience. Therefore, since the details are available elsewhere, we shall—in all but the case focusing on combinatory logic—simply touch on the open questions that have been answered and the computer pro grams that have been verified. The significance of answering open questions with the assistance of an auto mated theorem-proving program rests with the fact that, ordinarily, such ques tions can be answered only by an expert. Therefore, when one can demonstrate that a computer program played an important role, we have strong evidence that such a program can reason—not only logically, but very effectively. The achievement becomes even more impressive when one realizes that eminent lo gicians such as Lukasiewicz asserted in 1948 that a formalized proof cannot be "discovered mechanically", but can only be "checked mechanically" [14]. In contrast, the significance of verifying computer programs with the aid of an automated theorem-proving program rests with the importance of knowing that computer programs do in fact perform as they are intended to perform. Many well-known researchers still consider this activity—despite the existing achievements—to be essentially doomed. In fact, many well-known researchers consider the activity of proving theorems with a computer also to be doomed. The next few years will prove both views to be even more in error. We say "even more in error" because of the following evidence. In 1967, an automated theorem-proving program made its first contribu tion to mathematics; SAM's Lemma was proved. Next, although the effort was spread over an entire decade (starting in 1977), a number of open questions were answered, and answered with substantial assistance from an automated theorem-proving program. The first of those questions was taken from ternary Boolean algebra. The question focuses on the possible independence of each of the first three axioms for such an algebra. This question offered an important degree of piquancy since it was posed by A. A. Grau, who invented ternary Boolean algebra. With S. Winker's formulation of a technique for generating models with a theorem-proving program [30], proofs of the independence of each of the three axioms were obtained. Of those answered in the period beginning in 1977, the second open ques tion focuses on finite semigroups. The question—posed by the algebraist I. J. Kaplansy—asks about the existence of a finite semigroup that admits, in a nontrivial way, one type of mapping but avoids another type. By finding a semigroup of order 83—containing 83 elements—a theorem-proving program answered the question in the affirmative. To do so, the program was instructed
Automated Theorem Proving and Logic Programming
773
to cope with the problem of studying generators and relations [32], rather than attempting to employ a brute-force method. A brute-force approach was unten able because there exist more than 800,000 semigroups of order 7. The approach that succeeded did not take advantage of any expertise in the particular area of mathematics from which the problem was selected; the researchers studying the problem had none. The third open question was taken from an area of logic known as equivalential calculus. The question—brought to our attention by the logician J. Kalman—asks if any of seven given formulas is strong enough to serve by itself as an axiom for the entire calculus. An automated theorem-proving program provided invaluable assistance in proving that five of the seven are too weak, where the proof rests on a total characterization of the theorems that can be deduced from each of the five. To obtain the characterizations, the program employed a new methodology based on the use of schemata [42]. The same program proved—contrary to conjecture—that the other two formulas are each strong enough to serve as a single axiom. Before completing our discussion of open questions that were answered with the assistance of a theorem-proving program, let us pause to focus on the use of such a program to verify some given computer program. We take this action because the final questions to be discussed are also relevant to programming languages, at least in a distant sense. To define program verification, we quote Boyer and Moore, from their contribution to the first issue of the Journal of Au tomated Reasoning [4]: "Computer programs may be regarded as formal math ematical objects whose properties are subject to mathematical proof. Program verification is the use of formal, mathematical techniques to debug software and software specifications." (The article from which this quote is taken pro vides an excellent introduction to program verification and other applications of automated reasoning.) Of the various efforts focusing on using an automated theorem-proving pro gram for program verification, that of Boyer and Moore deserves the most ac claim. Their approach was to design and implement a program whose main pur pose is to verify algorithms and computer code, in contrast to programs designed to be general-purpose. They refer to their program as a theorem prover, simply because its use is based on proving one theorem after another. The theorems submitted to the Boyer-Moore program [2] are obtained from the attempt to prove that some given algorithm fulfills its intended purpose or from the attempt to prove that some given computer program satisfies the claims made for it. As the following list of successes shows, Boyer and Moore have indeed designed a powerful program, a program that demonstrates that automated theoremproving can be and has been most useful for program verification. Among the program's successes are proofs of • the invertibility of the Rivest, Shamir, and Adleman public key encryption algorithm [3];
Collected Works of Larry Wos
774
• the soundness and completeness of a propositional calculus decision pro cedure; • the soundness of an arithmetic simplifier; • the termination of Takeuchi's function; • the correctness of many elementary list and tree-processing functions; • the properties of many recursive functions; and • the verification conditions for various small Fortran programs, including a fast string-searching algorithm, an integer square root algorithm using Newton's method, and a linear-time majority vote algorithm. Significantly larger programs have been verified with an automated theoremproving program. For example, the Stanford Verifier by D. Luckham and his students at Stanford University [11] was used to verify a 3000-line Pascal com piler, and the Gypsy Verification Environment GVE by D. Good [10] was used to verify a 4200-line communications interface to a computer network. For the latter effort, some 2600 verification conditions were proved, using a theorem prover adapted from one by Bledsoe [1]. We close this discussion on the application of automated theorem-proving to program verification with one final citation. The success under consideration— obtained by Smith, Wojcik, Chisholm, and Kljaich [6,7,12,13]—concerns the verification of software, hardware, and their interface in a system designed by Draper Laboratories to replace certain failing sensors in a nuclear reactor at Argonne National Laboratory. The reactor in question was designed in the late 1950s with the expectation of being used for approximately fifteen years, and, therefore, the fact that its sensors are failing is no surprise. Since the reactor still provides much useful data, the software/hardware replacement system merits serious study. The automated theorem-proving program ITP [15,16] played the key role in the verification of the fault-tolerant (replacement) system designed by Draper. In particular, ITP proved that the appropriate properties are present in the Draper system; in addition, by examining the work performed by that reasoning program, researchers found important simplifications that could be made to the design of the system. The success of Smith and his colleagues is, in an obvious sense, one of the best examples of the use of an automated reasoning program to verify the claims made, at the highest level, for a system. We now return to the topic of answering open questions with the assistance of an automated theorem-proving program; our focus here is on combinatory logic. This topic nicely combines aspects of pure mathematics and logic with the practical objective of producing programs free of bugs. Researchers (for example, D. Turner [29]) are most interested in compiling high-level applicative languages into combinators—combinators that are the machine instructions executed by the computer (see Sections 2.4 and 5 for examples of combinators and how they
Automated Theorem Proving and Logic Programming
775
behave); in fact, such computers have been designed and built. In our studies of combinatory logic, we have been able to answer questions concerning the presence or absence, for some given set of combinators, of what are called the weak and the strong fixed point properties (see Section 5 for their definitions). To appreciate the difficulty of such questions, one might try to answer the first two challenge questions we pose at the beginning of Section 5. We were able to answer those questions and many other similar questions, and the key is the use of our new global strategy, called the kernel method [36], for systematically searching for fixed point combinators. That success still startles us, especially since it marks a singular event for automated theorem proving. In particular, there now exists an area (the study of the presence or absence of either fixed point property) in a deep field (combinatory logic) such that randomly selected questions can be quickly answered with a high probability by submitting them to a theorem-proving program. The kernel method has proved to be very powerful, especially when applied by our recently designed automated theorem-proving program OTTER [18]—which brings us naturally to the topic of the next section, portable automated theorem-proving programs. 1.2.2. Portable Automated Theorem-Proving Programs. Each of the two fields, automated theorem proving and logic programming, is empirical in nature. Therefore, for the needed advances to occur, experimentation is essential. In deed, the likelihood and the frequency of significant advances are each directly dependent on the amount of experimentation. As an illustration from a totally unrelated field, one can show that the rapid progress made in the area of lin ear algebra resulted directly from numerous experiments by various researchers with different computer programs. Unfortunately, the comparable and needed amount of experimentation did not occur in the first twenty years of automated theorem proving. Although suspect, one reason that was frequently given was the lawk of access to a theoremproving program. The lack no longer exists. Indeed, we know of three automated theorem-proving programs that are portable and in the public domain. For program verification, one can use the Boyer-Moore theorem-proving pro gram [2]. The program, written in LISP, relies heavily on the use of induction and is specifically designed to verify the correctness of computer programs and algorithms. One can obtain the program by electronic mail. For the details, one should write by electronic mail to [email protected] or by surface mail to the Computer Science Department of the University of Texas. The second theorem-proving program, ITP [15,16], is a general-purpose pro gram and, therefore, not tailored to any specific application. This program, written in Pascal, permits one to use it in interactive or in batch mode. Use of ITP gives one access to a wide variety of inference rules and strategies- —some of which we shall discuss in Section 2—but this program does not offer induction. VAX/UNIX, VAX/VMS, and IBM/CMS versions are available by contacting either of the following two sources.
776
Collected Works of Larry Wos
Numerical Algorithms Group, Inc. Suite 200 1400 Opus Place Downers Grove, IL 60515-5702 phone: 312-971-2337 fax 971-2706 National Energy Software Center Argonne National Laboratory Argonne, IL 60439 phone: 312-972-7172 The third portable automated theorem-proving program of interest is the very recently designed program OTTER [18]. OTTER, written in C, is a generalpurpose theorem-proving program. Like ITP, it offers a wide range of inference rules and strategies, but does not offer induction. Among all of the theoremproving programs of which we know, this new program runs faster than all but AURA [27]; AURA is faster at applying hyperresolution, UR-resolution, and nonunit subsumption, and OTTER is faster at applying paramodulation, demodulation, and forward unit subsumption. Perhaps more significant—since experimentation of many types by many people is so valuable—OTTER can be used with a personal computer. Currently, for the details for obtaining a copy of OTTER, one should contact William McCune, by electronic mail [email protected], or by surface mail in the Mathematics and Computer Sci ence Division at Argonne National Laboratory. However, very shortly, one will be able to obtain a copy of OTTER by contacting either of the sources cited for obtaining ITP. 1.2.3. Researchers and Their Willingness to Experiment. The field of auto mated theorem proving and the field of logic programming are now beginning to emerge as significant areas of study and application, and that emergence can be traced directly to the new attitude toward experimentation. Specifically, researchers are far more willing now than ever before to test their ideas with actual problems and with existing computer programs. Even further, when the appropriate computer program or routine is unavailable—when compared to the preceding many years—researchers are willing, and even eager, to design and implement what is needed. In other words, until recently, the field of automated theorem proving suf fered from an unwillingness to experiment. We are certain that this lack of a desire to test ideas with an existing program or—when such a program was not available—resistance to writing such a program was far less common in logic programming. Nevertheless, perhaps the research in logic programming was hampered by a related phenomenon—an unfamiliarity with what has been occurring in automated theorem proving. If that is the case, then this article may serve in part as an antidote, .pp Indeed, by being presented with new ideas
Automated Theorem Proving and Logic Programming
111
or variations on old ideas, those interested in logic programming may—at least catalytically—be stimulated to enhance existing programs or, even better, de sign and implement even more powerful and versatile ones than now exist. In particular, an examination of the material presented in Section 2, where we re view the elements of automated theorem proving, may permit some researcher to adapt one or more of those elements to logic programming. Although we sus pect that such an adaptation presents a formidable challenge, we cannot help but wonder what might result. Of course, one of the key questions focuses on timing, on when to consider attempting to make the suggested adaptations. How astute F. Pereira was when he commented: "It is fortunate that the originators of logic programming had the courage to ditch equality in developing the concepts and techniques of logic programming ... premature concern with generality would have prevented the development of the very efficient implementations that characterize current logic programming practice" [22]. But Pereira was accurately discussing logic programming in its beginning, and we are focusing on 1989 and what is possible now. Therefore, especially in view of the high quality of current research in logic programming, perhaps the field is ready and able to employ, more fully, some of the features offered by the more powerful automated theorem-proving programs. In particular, as in its beginning, perhaps logic programming is ready to experiment heavily with techniques currently used in automated theorem proving, ready to experiment with incorporating the use of strategy far more powerful than currently used and with incorporating a more practical treatment of equality. The corresponding experiments would be most intriguing to us. Because we prefer to see and perhaps use the results of those experiments sooner rather than later, the prudent course of action is to attempt to add to the current willingness and eagerness to experiment, and even attempt to increase the number of researchers involved in experimentation. In the remainder of this section, therefore, let us focus on the need for experimentation and also on some of the advances that have occurred directly because of experimentation. With regard to the need for experimentation—recognizing that we are re peating ourselves, but also believing that this point deserves emphasis—most important of all, automated theorem proving and logic programming are each empirical sciences. Specifically, although advances in theory and advances in implementation play an equal and vital role—since the objective of both fields is that of diverse application—everything must be thoroughly tested, and tested by numerous users. The need for thorough testing is obvious. The need for nu merous users rests with the fact that it is far too easy to develop a bias toward some approach. For one of the less publicized examples of a bias that can be present, one can easily focus on questions, problems, or theorems from one area heavily, not realizing that such a focus may distort one's evaluation. Equally—and also not discussed frequently—one can be inordinately swayed about the power of
778
Collected Works of Larry Wos
an approach, by its success with relatively simple problems or theorems. For an example of a simple theorem, one can study the theorem from group theory that asserts that the group is commutative whenever the square of every element x is the identity. For an example of a theorem that is not simple or easy to prove, one might study the commutator theorem of group theory (see Section 2.6), which we pose as a challenge problem in Section 1.2. In contrast to testing an idea by a few individuals, if many individuals experiment with an idea—one of theory, implementation, or application—then the likelihood of a distortion occurring is sharply reduced. With regard to advances in automated theorem proving that can be traced directly to experimentation, three that might be useful to logic programming immediately come to mind. Although we shall highlight these three in Section 2, let us quickly focus on each here. First, the set of support strategy (see Section 2.3) was discovered because of experiments focusing on theorems from group theory, experiments designed and implemented to test the power of a program designed in the early 1960s by D. Carson of Argonne National Laboratory; the story of its discovery is given in Chapter 2 of [34]. As we shall learn, the object of the set of support strategy is to restrict the reasoning to information that is closely connected to the specific question under investigation. In a sense that we shall discuss in Section 2.3, logic programming employs a very restricted version of this strategy. The second advance resulting from experimentation was the discovery of the procedure called demodulation (see Section 2.4). That procedure was formulated to cope with the disappointing performance of a later version of the Argonne program when that program was asked to prove a simple lemma in number the ory; see Chapter 2 of [34]. The object of demodulation is to rewrite information into a canonical form. We shall discuss in Section 2.2.3 the possible usefulness of this procedure to logic programming. The third advance that can be traced to experimentation is the formulation of the weighting strategy (see Section 2.3) [17]. This contribution of Overbeek resulted from his attempts to have his theorem-proving program find a proof of the commutator theorem. From our viewpoint, the object of the weighting strat egy is mainly to enable the user to give a program hints about which information is significant and should, therefore, be keyed upon, and which is insignificant and should, therefore, be discarded. From Overbeek's viewpoint, the object of weighting is to circumscribe the terms that are conjectured to be relevant. We shall discuss in Section 4 the possible usefulness to logic programming of both the weighting and the set of support strategy. With virtually no subtlety, we are suggesting that experimentation must be encouraged in as many ways as one can, and by as many people as one can interest. Fortunately—and here we again visit one of the factors that makes us so optimistic—the current group of researchers is willing and, often, eager to experiment. Although the explanation for this dramatic change might rest with the simple fact that many people now conducting research have grown up with
Automated Theorem Proving and Logic Programming
779
computers, we prefer to believe that the explanation rests with an understanding of the importance of experimentation. 1.2.4- Recent Advances. With the advent of parallel processing, the future looks even more enticing, and the opportunities are many. One prediction as serts that, by 1993, the Hypercube will offer 1024 processors, each of which will deliver 100 MIPS- and, in parallel. Parallel-processing automated theoremproving programs may be drawing 10,000 significant conclusions per second of CPU time; 10 MIPS may be required to draw a significant conclusion. To fully grasp the importance of such an achievement, one might note that drawing a significant conclusion is equivalent to many LIPS (logical inferences per second). It would be incorrect to say that logic programming can already draw 10,000 conclusions a second, for LIPS should not be confused with con clusions per second. Indeed, one "logical inference" for logic programming is somewhat equivalent to an attempt at one successful application of binary reso lution, and it is difficult for a mathematician or logician to consider, for example, the concatenation of two lists as drawing many conclusions. Therefore, the term LIPS is a rather unfortunate choice of terminology, at least for mathematicians and logicians and the like. With the sharp increase in the rate of conclusion drawing that results from the use of parallelism, with the advances that we expect in logic programming that also depend on parallel processing, and with the already-existing evidence that automated theorem proving can borrow from logic programming ^see oection 4), one can easily understand why access to this relatively new type of computer produces so much optimism for us. In addition to the increase in speed directly resulting from the use of parallel processing, even greater speed may be possible, depending on the results of certain research now in progress in logic programming—especially that under the aegis of the Gigalips project. We already have excellent examples of the value for automated theorem proving of some of the advances in logic programming. In the new program OTTER, the demodulation procedure (discussed in Section 2.4) for rewriting information into a canonical form employs techniques borrowed from logic programming. We shall give some of the pertinent details in Section 4 of this article. For a second example, an implementation of linked inference, which we shall introduce and discuss in some detail in Section 2.2.3, would also benefit from the use of certain techniques whose nature is reminiscent of logic programming. For two other important advances, one might study the excellent research that focuses on compiling logic programs into efficient code, and also study the work of Overbeek and his colleagues [5] focusing on the use of Prolog technology to implement a parallel-processing version of the inference rule hyperresolution. With regard to the former, we in some unpublished experiments obtained some impressive speed by compiling demodulators (see Section 2.4 for a discussion of that concept), an approach formulated directly because of the success in
780
Collected Works of Larry Wos
compiling logic programming code. With regard to the latter, the full value of using logic programming technology for aspects of automated theorem proving must wait some years, but such use already appears to offer a great deal for an implementation of linked inference rules. 1.3. A Challenge and a Caveat. For those researchers who naturally ques tion our enthusiasm concerning the various procedures on which a number of theorem-proving programs rest, we offer the following challenge problem. The challenge asks one to prove a theorem, called the commutator theorem (see Sec tion 2.6 for more details), from abstract algebra but, most important, to prove it strictly by means of logic programming. In particular, one is asked to seek a proof without using paramodulation, demodulation, subsumption, and weight ing. The theorem to prove asserts that if the cube of every element x in the group is the identity e, then [[x, y],y] = e for all x and y, where the commuta tor, [x, y], of any two elements x and y of a group is the product of x, y, the inverse of x, and the inverse of y. Obtaining a proof of this theorem without using the key procedures dis cussed in Section 2 should provide a substantial challenge. Among the benefits that will accrue to one who accepts the challenge are a deeper understanding and appreciation of why automated theorem proving requires the use of such complicated procedures as it relies upon and, perhaps, an impetus to attempt to adapt those same procedures for logic programming. To aid one in assess ing progress in an attempt to meet the challenge, in Section 2.6 we supply two proofs of the commutator theorem. Let us now turn to a review of automated theorem proving. For that review, although various paradigms exist for this field, we focus on that based on the use of the clause language (see Section 2.1) and—in many respects—focus heavily on how we at Argonne treat automated theorem proving. We note that one of the authors (Wos) strongly favors the paradigm presented in Section 2 because the lack of richness of that language—which is considered a weakness by some— contributes, in his view, to a sharp increase in the probability of formulating effective inference rules and powerful strategies to control their application. We also note that, after discussing for a number of years the various approaches to automated theorem proving, it is Wos's opinion that the paradigm of Section 2 is far more promising than the paradigms based on natural deduction, connection graphs, logic programming, and a nonclausal approach. Indeed, we conjecture that far more has been accomplished within the clause paradigm than within any other. Therefore, as one reads Section 2, one might keep in mind that, although what we discuss applies to various paradigms for the automation of theorem proving and hence is not limited to our approach to automated theorem prov ing, the discussion is slanted in that direction. During that reading, one might also keep in mind the already-discussed essential difference between automated theorem proving and logic programming; the former is oriented toward unalgo-
Automated Theorem Proving and Logic Programming
781
rithmic reasoning and the latter toward algorithmic. Nevertheless, as we shall espouse—especially in Section 4—a natural symbiosis exists between the two fields.
2
A REVIEW OF AUTOMATED T H E O R E M PROVING
As one reads this rather extensive review of automated theorem proving, one may see many connections with logic programming; a more complete treatment of the larger field—automated reasoning—can be found in [37] or in [34]. Indeed, the basis for logic programming can be traced to Robinson's formulation of the inference rule binary resolution [25] (Section 2.2.1). Throughout the remainder of this article, we shall touch on other connections between logic programming and automated theorem proving, and pose questions concerning a possible closer connection that could exist between the two fields. At the highest level, automated theorem proving—at least the paradigm that is our preference—can be viewed as imitating (in certain respects) mathemat ics by beginning its attack on a given question or problem by accruing various lemmas and conclusions. By retaining such information, automated theorem proving immediately departs from the usual practice in logic programming. The motive for information retention rests with the notion that, to succeed in an swering deep questions and solving hard problems, the program cannot afford to continually rediscover the needed lemmas, facts, or relationships. The decision to retain information—as will become clear in this review of automated theo rem proving—virtually requires the program to rely on a number of procedures that might otherwise be unneeded, procedures for canonicalbsation, for infor mation purging, and for restricting and directing its reasoning. However—as we shall suggest—avoiding the retention of information, and therefore bypassing the need for the additional procedures, sharply reduces the likelihood of success when the assignment concerns deep questions and hard problems. Since unrestrained accrual of information is almost always doomed to fail ure, the program applies various types of strategy to restrict such accrual. In addition, different from mathematics—since we as yet know of no way to avoid various types of redundancy—the theorem-proving program purges conclusions that are captured by more general information. Also unlike mathematics, the program applies types of reasoning that we would advise no person to apply— reasoning, such as paramodulation for generalizing equality substitution (see Section 2.2.2), that is tailored to the properties of a computer. Finally—as logic programming in effect does—in the vast majority of cases, the typical theoremproving program seeks to prove the conjectured theorem by seeking a proof by contradiction. In other words, if one quickly reviews the preceding remarks, one sees that,
782
Collected Works of Larry Wos
although similarities exist, automated theorem proving does indeed approach problem solving in a manner that is distinctly different in many respects from that found in logic programming. To gain some insight into why automated theorem proving—at least the paradigm that has worked for us—is so successful, to study the precise nature of each of its components, and to learn how strong our case for automated theorem proving is, let us review the basic elements. We shall begin the review by briefly focusing on representation, specifically, on the clause language so familiar to researchers in logic programming. We must spend a little time on this topic because we observe conventions different from those of logic programming. We shall then turn to some of the types of reasoning offered by many theorem-proving programs, briefly touching on the already-mentioned and familiar-to-many inference rule binary resolution, heav ily focusing on paramodulation and its use for "building in equality", and also heavily focusing on linked inference rules and their use for avoiding many triv ial intermediate deductions. We focus heavily on paramodulation because this inference rule, in our view, offers a most attractive approach for coping with equality and all of the attendant difficulties. We wonder whether there exists a way to use this inference rule to extend the power of logic programming with out interfering with its impressive efficiency. We focus on linked inference rules because one of them, linked hyperresolution, provides—in terms that are used in automated theorem proving—a convenient way of discussing the reasoning applied in logic programming. A glance at linked inference rules might, at least catalytically, result in some interesting developments. After completing our discussion of inference rules, we next turn to strategy of various kinds. Even more than the treatment of equality, in our view the area of automated theorem proving that offers substantial power for logic program ming is that of strategy. We shall focus on strategies that restrict a program's reasoning, and also on strategies that direct it. It is through the use of strategy that automated theorem proving derives much of its power. The next topics in our review are demodulation, a procedure for rewriting information into a canonical form, and subsumption, a procedure for discarding a particular type of logically weak information. Just as the use of strategy is cru cial, a program that attempts to answer deep questions or solve hard problems is almost always doomed to failure without the use of demodulation. Subsump tion, whose use is also vital, might at first appear to hold little or no interest for the logic programming community. Nevertheless, a discussion of this pro cedure and its relation to theorem-proving programs implemented in the spirit of logic programming may—at least for some individuals—prove exceedingly provocative. To provide at least a taste of all of the key elements of automated theorem proving, we close our review with a discussion of proof by contradiction. This topic is in an obvious sense very familiar to the experienced researcher in logic programming. Nevertheless, some of the examples might be of some interest, especially that focusing on the commutator theorem as an example of a rather
Automated
Theorem Proving and Logic
Programming
783
difficult theorem to prove. Indeed, that theorem exemplifies the various points we make in this section, and provides the type of challenge (Section 1.3) that might prove stimulating, for consideration of the theorem shows why many of the procedures we discuss are needed. To prepare for our treatment of each of the specific elements of automated theorem proving, in which we rely mainly on examples rather than on formal definitions, let us immediately summarize the actions taken by a typical theorem-proving program. The fields of mathematics and logic from which a theorem may be taken include algebra, geometry, topology, set theory, and combinatory logic. The most widely used approach for proving theorems—or for solving any problem or answering any question—with a theorem-proving program focuses on searching for a proof by contradiction. Therefore, to enable a program using such an approach to attempt to prove a proposed theorem of the form if P t h e n Q, one is required to define the field from which the theorem is taken, to give the special hypothesis (which may be the empty set) of the theorem, and to assume that the theorem is in fact false. By the special hypothesis, we mean that which remains of the if conditions of a theorem when one ignores the axioms of the theory from which the theorem is taken and also ignores any lemmas that the user supplies. We also use the term denial of the conclusion to refer to those statements—or clauses—that arise from assuming the theorem false. As we discuss in Section 2.3, the special hypothesis and the denial of the conclusion each play an important role in the use of a powerful strategy, the set of support strategy. To begin its attack on the given problem, the theorem-proving program draws conclusions—some of which it retains—by applying one or more sound inference rules chosen by the researcher. The retention of conclusions markedly increases the effectiveness of a theorem-proving program and also permits one to use such a program to explore a new theory, and then display some of the properties of that theory. The application of each rule is restricted by one type of strategy and directed by another type. When a conclusion is drawn, the program rewrites it into a canonical form by applying rules {demodulators [40]) supplied by the researcher or discovered by the program. The result is then tested (with the use of subsumption [25]) to see whether it is a trivial corollary of information the program already has, and should, therefore, be discarded. The result can also be tested—by using weighting [17] (see Section 2.3)—to see whether it satisfies criteria (weights), supplied by the researcher, for measuring significance; if the conclusion fails the test, it is discarded. As expected, the goal is to deduce some new conclusion that contradicts a conclusion drawn earlier or contradicts some input statement. When such a deduction is made, a proof by contradiction has been found, and the automated theorem-proving program in use "knows" t h a t the given assignment has been completed. Using the preceding summary of the program's actions as an outline for this section, let us sample each of the main areas, beginning with representation—a discussion of how one specifies the problem to be considered. Of course, for the
784
Collected Works of Larry Wos
experienced researcher in logic programming, this first topic will be in the main a familiar one. 2.1. Representation. In this section, we mainly use the notation and con ventions employed in the two books we recommend for further study [37,34], a notation that is consistent with the formal language—the clause language—most commonly used in automated theorem proving and so familiar to logic program ming. We include some discussion because our notation and conventions differ from those frequently used in logic programming. Our conventions require variables to be chosen from among terms whose first symbol is one of lowercase u through z (which contrasts with the upper case notation used in various dialects of logic programming). Each variable is implicitly universally quantified (meaning "for all"), and each variable is rele vant only to the clause in which it occurs. Also by convention, functions and constants are (almost always) written in lower case, and relations (predicates) written in upper case. In addition—and this convention is most important—by writing EQUAL for the equality relation, the program is able to treat equality as "understood" or "built in". Finally, the symbol - means not, and the symbol | means or. In other words, one encounters another notational difference from logic programming, for we explicitly use a symbol for logical or and for logical not. As in logic programming, existence is not represented with variables; in stead, appropriate functions and constants are employed. Different from logic programming, the logical operator and never occurs within a clause. Some of the differences between the standard Prolog notation and that we use now in automated theorem proving are captured by the following example. grandparent(X.Y) :- parent(X.Z), parent(Z.Y). GRANDPARENT(x,y) I -PARENT(x.z) I -PARENT(z.y). The first of the two given clauses is in Prolog notation, and the second is in the notation we (usually) employ in automated theorem proving. Of course, as is well known, one of the key differences between typical logic programming and automated theorem proving is the latter's use of clauses that contain as many positive literals as desired. By not being restricted to the use of Horn clauses (clauses containing at most one positive literal), one can rely on a more natural representation. In our next example of the notation and conventions we use, we shall encounter clauses that are not Horn. It may well be—even though we would like to believe otherwise—that the successes of logic programming are so dependent on the restriction to the use of Horn clauses that all other options are unacceptable in the vast majority of cases. For the final difference between logic programming and automated theorem proving, we note that (in the latter) the denial of a theorem might be represented with clauses each of which contains positive literals only. Obviously (for logic programming) such a clause cannot be used as a goal clause, which can force one to use an axiom, for example, as the goal clause. As we comment later,
Automated Theorem Proving and Logic
Programming
785
basing a search for information entirely on an axiom can be disastrous. Let us now turn to more interesting examples. To illustrate our notation, to provide an example t h a t might be challenging to consider for logic programming, and to exemplify (in Section 2.2) various inference rules, let us consider the following theorem from abstract group theory: If a subgroup O has index 2 in a group G, then O is a normal subgroup. (For the axioms of a group—first in a notation t h a t avoids in the main the use of equality and second in a notation that emphasizes equality—one can turn to the commutator theorem in Section 2.6.) By definition, a subgroup O has index 2 in the group G if and only if G/O (G mod O) consists of two left cosets, the elements in O and the elements not in O. Also by definition, a subgroup O is a normal subgroup if and only if the product of x, y, and the inverse of x is an element of O for all x in the group and all y in O. Where equality is axiomatized rather than built in, the following clauses can be used—if one also uses clauses (GT-1) through (GT-17) of Section 2.6—to present the theorem under discussion to an automated theorem-proving program. 0 i s a subgroup: (SIT-1) 0(e) (SIT-2) - 0 ( x ) I 0 ( i n v ( x ) ) (SIT-3) - 0 ( x ) I - 0 ( y ) I - P ( x , y , z )
I 0(z)
0 has index 2: (SIT-4) 0 ( x ) 1 0(y) I P ( x , i ( x , y ) , y ) (SIT-5) 0 ( x ) I 0(y) 1 0 ( i ( x , y ) ) d e n i a l of (SIT-6) (SIT-7) (SIT-8) (SIT-9)
the conclusion: P(b,inv(a),c) P(a,c,d) 0(b) -0(d)
For a proof of this theorem in clause notation, see Section 6.1.1 of [34]—which completes our discussion of the index 2 theorem. To show how equality can be treated to enable the program to "understand" that concept, let us turn to examples from ordinary arithmetic—or, alterna tively, from group theory written additively. To express the fact that there exists a left identity, 0 + x = x for all x, we write EQUAL(sum(0,x),x) as the corresponding clause. To express the existence of an additive (right) inverse, for all x there exists a y such that
Collected Works of Larry Wos
786
x + y = 0, we write EQUAL(sum(x,minus(x)),0) as the clause. Having dispensed with representation, let us now turn to the types of rea soning that can be offered by an automated theorem-proving program.
2.1
Inference Rules
In this section, we focus on some of the inference rules that the more versatile automated theorem-proving programs offer. We begin with binary resolution [25]—because researchers in logic programming are so familiar with it, and be cause it plays such an important role for logic programming—UR-resolution [17], and hyperresolution [26]. We next turn to paramodulation [24,38], the inference rule that can be used to enable a theorem-proving program to treat equality sis if it is "understood". We close this section by focusing on two linked inference rules, linked UR-resolution and linked hyperresolution [41]. To provide an overall comparison of the inference rules discussed here, we note that—in contrast to binary resolution—both UR-resolution and hyperreso lution can each consider simultaneously two or more clauses at a time, providing that certain conditions are met. The use of UR-resolution emphasizes the role of unit clauses (clauses with one literal), and the use of hyperresolution emphasizes the role of positive clauses (clauses without negative literals). Paramodulation— which is the best example of a computer-oriented inference rule, and one that a person probably should not apply by hand—generalizes the usual notion of equality substitution (see the third example in Section 2.2.2) and requires the use of the clause EQUAL(x,x) for reflexivity, but requires no other clauses for that relation. Because of the importance of coping with equality, among the inference rules we discuss here, paramodulation may be of greatest interest to logic program ming. Indeed, to attempt to solve hard problems from mathematics, a program is often required to reason within deeply nested expressions, which paramodu lation does and does so without being forced to process all of the intermediate expressions that must be processed when equality is treated with the usual set of axioms. Linked UR-resolution and linked hyperresolution—the latter of which will be seen to capture the type of reasoning used in logic programming— generalize the corresponding inference rule, and are designed to avoid deducing certain types of intermediate and trivial information. 2.2.1. Binary Resolution, UR-Resolution, and Hyperresolution. Because an understanding of the inference rule paramodulation does not come easily, and
Automated Theorem Proving and Logic Programming
787
because we consider a built-in treatment of equality to be crucial for auto mated theorem proving, let us begin by focusing on simpler inference rules. As promised, we can use the theorem that asserts that subgroups of index 2 are normal. For our first three examples, we can use the following clauses. (SIT-2) -0(x) I 0(inv(x)) (SIT-3) -0(x) I -0(y) I -P(x,y,z) I 0(z) (SIT-4) 0(x) I 0(y) I P ( x , i ( x , y ) , y ) (SIT-8) 0(b) (SIT-9) -0(d) (GT-7) P(x,y,prod(x,y)) The last clause is sometimes called the closure axiom, and asserts the totality of the function prod. As is well known to the people in logic programming, at each step on each path designed to solve a subgoal, the reasoning employed by logic programming is in effect an attempt to successfully apply a single binary resolution step. For example, by applying binary resolution to clauses (SIT-8) and (SIT-2), we obtain 0(inv(b)) as the conclusion, which would also be obtained by applying UR-resolution or hyperresolution to this pair of clauses. For a more interesting example of the use of UR-resolution—one that cap tures the spirit of the rule—we simultaneously consider clause (SIT-4) and two copies of clause (SIT-9) to obtain P(d,i(d,d),d) as the conclusion. The; inference rule UR-resolution considers a nonunit clause (the nucleus) and, with the exception of one literal, attempts to simultaneously unify each of its literals with a unit clause (a satellite) and, if successful, produces a unit clause as the conclusion. The use of UR-resolution, therefore, permits the program to deduce a negative unit clause as well as a positive unit clause, and— in contrast to hyperresolution— to focus on a set of hypotheses involving more than one clause containing negative literals. The inference rule hyperresolution considers a nonpositive clause (the nu cleus) and attempts to simultaneously unify each of its negative literals with a literal in a positive clause (a satellite) and, if successful, produces a positive clause (possibly the empty clause) as the conclusion. For hyperresolution to ob tain the conclusion P(d,i(d,d),d) from the same hypotheses, two steps would be required. In particular—although not in the spirit of hyperresolution, which encourages the deduction of clauses some of whose positive literals come from the clause containing the negative literals to be removed—the program could first apply the inference rule to clauses (SIT-9) and (SIT-4) to obtain
788
Collected Works of Larry Wos
0(y) I P ( d , i ( d , y ) , y ) which, with a second application of hyperresolution, is then used with clause (SIT-9) to again reach the conclusion for which UR-resolution required but one deduction step. For an application of hyperresolution that is more typical, we apply the rule to the simultaneous consideration of clauses (SIT-3), (SIT-8), (SIT-8), and (GT-7) to obtain 0(prod(b,b)) as the conclusion. We note that neither UR-resolution nor hyperresolution, as the examples show, is restricted to the consideration of Horn clauses. Unless purged with some procedure such as subsumption (see Section 2.5) or weighting (see Section 2.3), the cited conclusions would be retained. Retention of clauses—as one no doubt realizes—is motivated by the desire to use them later in the attempt to complete the given assignment, and by the desire to save the CPU time, which might be as much as 15 CPU minutes, needed to obtain them. A less obvious motivation for the retention of clauses rests with the side effect of avoiding numerous undesirable paths, which we discuss in Section 2.2.3. The tricky part, as is obvious, is to decide which information to retain and which to purge, or treat as implicitly present—an additional topic we address in Section 2.2.3 when we discuss linked inference rules. Just in case one is skeptical about the need to retain any information versus the desire to save CPU time, we suggest that one examine the commutator theorem from group theory and its two proofs, which we give in Section 2.6. Of course, to save all conclusions is madness. Indeed, one motivation for using hyperresolution or UR-resolution or some linked inference rule is to sharply reduce the number of conclusions to be retained. Although hyperresolution, for example, can be viewed and programmed as a sequence of binary resolution steps, it can also be programmed—as Overbeek did in AURA [27]—without generating any intermediate clauses. In the same sense, linked inference rules can be viewed and programmed as a sequence of binary resolution steps, but we are almost certain that a far better choice is to borrow from logic programming to implement such rules. In other words, we have an excellent example of how logic programming can be of use to automated theorem proving. For the converse, let us now turn to a discussion of an inference rule—paramodulation—whose use directly addresses the difficulties presented by equality. 2.1.2. Paramodulation, Defined with Examples. We now come to one of the two areas that we conjecture offers the most for logic programming, one be ing our treatment of the equality relation (see Sections 2.2.2 and 2.4), the other being strategy (see Section 2.3). There now appears to be ample evi dence that treating equality as a built-in concept is far superior than an ax iomatic approach. In particular, by using paramodulation—which we feature in this section—an automated theorem-proving program can reason directly within
Automated
Theorem Proving and Logic
Programming
789
deeply nested expressions rather than touching the various so-called intermedi ate points. For a trivial example, paramodulation can use the fact that a = b to immediately deduce in one step that Q(f(g(h(b)))) from the fact that Q(f(g(h(a)))) without deducing the intermediate conclusions that would be deduced by ap plying the appropriate axioms for equality. The key is that paramodulation is a term-oriented inference rule rather than a literal-oriented rule. This rule is def initely computer-oriented rather than person-oriented. Although the need for strategies to control the application of this inference rule is great, its use often yields impressive results, as we comment on in Section 2.6 when we discuss the commutator theorem of group theory—a proof of which was obtained in less than 3 CPU seconds by using paramodulation. Rather than giving a formal definition of paramodulation, we shall, as in the preceding section, rely on examples. The first example illustrates the use of the simplest and most familiar form of equality substitution. The second illustrates a slightly more complex form of substitution—a form that will immediately seem reasonable—in that variables occur in one of the hypotheses, in the into clause. The third example, substantially more complex, is by far the most interesting, for it shows how paramodulation generalizes the standard notion of equality substitution. For the first example, paramodulation applied to both the equation a + (—a) = 0 and the statement a + (-a) is congruent to b yields in a single step the conclusion or statement 0 is congruent to b. In clause form, from EQUAL(sum(a,minus(a)) ,0) into CONGRUENT(sum(a,minus(a)),b) one obtains the clause CONGRUENT(0,b) by paramodulation. For the second example, paramodulation applied to both the equation a + (—a) = 0 and the statement x + (—a) is congruent to x yields in a single step the conclusion or statement 0 is congruent to a. In clause form, from EQUAL(sum(a,minus(a)),0) into
790
Collected Works of Larry
Wos
CONGRUENT(sum(x,minus(a)),x) the clause CONGRUENT(0,a) is obtained. This example illustrates some of the complexity of paramodulation; in particular, the second occurrence of the variable x in the into clause becomes the constant o in the conclusion, but the term containing the first occurrence of x becomes the constant 0 in the conclusion. Although the unification of the first argument of the from clause with the first argument of the into clause temporar ily requires both occurrences of the variable x to be replaced by the constant a, paramodulation then requires an additional term replacement justified by equality substitution, the replacement of a + (—a) by 0. Finally, for the third and complex example, paramodulation applied to both the equation x 4- (-x) = 0 and the equation y + (-y + z) = z yields in a single step the conclusion y + 0 = — (—y). In clause form, from EqUAL(sum(x,minus(x)),0) into EQUAL(sum(y,sum(minus(y),z)),z) the clause EQUAL(sum(y,0).minus(minus(y))) is obtained by paramodulation. To see that this last clause is in fact a logical consequence of its two parents, one unifies the argument sum(:r,minus(:r)) with the term sum(minus(j/),z), ap plies the corresponding substitution to both the from and into clauses, and then makes the appropriate term replacement justified by the typical use of equality. The substitution found by the attempt to unify the given argument and given term requires substituting minus(j/) for x and minus(minus(y)) for z. To prepare for the (standard) use of equality in this third example—and here we encounter a key feature of paramodulation—a nontrivial substitution for variables in both the from and the into clauses is required, which illustrates how paramodulation generalizes the usual notion of equality substitution. In contrast, in the stan dard use of equality substitution, one does not apply a nontrivial replacement for variables in both the from and the into statements. Summarizing, a successful use of paramodulation combines in a single step the process of finding the (in an obvious sense) most general common domain for which both the from and into clauses are relevant and applying standard equality substitution to that common domain. The complexity of this inference rule rests in part with (1) its unnaturalness (if viewed from the type of reasoning people employ), in part with (2) the fact that the rule is permitted to apply
Automated
Theorem Proving and Logic
Programming
791
nontrivial variable replacement to both of the statements under consideration, and in part with (3) the fact that different occurrences of the same expression can be transformed differently. As an illustration of the third factor contributing to the complexity of paramodulation, in the last example we gave of its use, the (term containing the) first occurrence of z is transformed to 0, but the second occurrence of z is transformed to minus(minus(j/)). The third example illustrates what we mean when we say that paramodulation is a term-oriented inference rule that generalizes equality substitution. A single application of paramodulation can lead to the deduction of an in teresting conclusion that the usual mathematical reasoning requires more than one step to yield. In contrast to paramodulation, the mathematician or logician picks the instances—the substitutions of terms for variables—that might be of interest, and then applies (the usual notion of) equality substitution. Paramod ulation, on the other hand, picks the (maximal) instances of the from and into clauses automatically and—rather than deducing intermediate conclusions by applying the corresponding replacement of terms for variables—combines the instance picking with a standard application of equality substitution. As with logic programming, avoiding the retention of intermediate conclu sions can contribute markedly to the performance of a theorem-proving program. The instances that a person chooses may be far less general than those chosen by the theorem-proving program in its attempt to apply paramodulation. As a result, the program may deduce a conclusion that is far more general than a person might deduce. Again the program benefits, for its efficiency often in creases by having access to general conclusions rather than specific ones; people do not require such generality in most cases. Summarizing, the inference rule instantiation—replacing variables by terms in a statement to deduce a corollary—is frequently used, and used wisely, in mathematics and logic. For example, a mathematician might use instantiation to deduce t h a t (yz)(yz) = e (the identity in a group) from the hypothesis that (xx) = e, and then use the new conclusion as a key step in proving that the type of group under study is commutative. A typical theorem-proving program would not draw such a conclusion since instantiation is ordinarily not an inference rule offered by such a program, for no known strategy exists for wisely choosing appropriate instances even though mathematicians and logicians do have that ability. To give a second illustration of the power offered by paramodulation—if combined with a procedure (demodulation, see Section 2.4) used by theoremproving programs to simplify expressions—we consider the following example so typical of mathematics. In the example, the conclusion that is reached with a string of equalities—if one applies the usual type of reasoning that occurs in mathematics—is drawn by a theorem-proving program in a single deduction step. 2 = 0 + 2 = (x + (-x))
+ z = x 4- ( ( - x ) + z)
792
Collected Works of Larry Wos
This string of equalities constitutes a proof of an obvious but useful lemma in arithmetic and in group theory, the lemma that asserts the equality of the first and last expressions in the string of equalities. In clause notation, from right inverse EQUAL(sum(x,minus(x)),0)
into associativity EQUAL(sum(sum(u,v),z),sum(u,sum(v,z))) the program can deduce EQUAL(sum(0,z),sum(x,sum(minus(x),z))) which it can then automatically simplify (see Section 2.4) to EQUAL(z,sum(x,sum(minus(x),z)))
without producing any intermediate results. To gain some insight into the power of paramodulation and to experience its usefulness, one can compare the two proofs of the commutator theorem that we give in Section 2.6. Even further, one might attempt to obtain a proof of this theorem with whatever program is available. If that program is based strictly on logic programming—especially since the sets of clauses for each proof consist of Horn clauses--then the attempt may yield important information. 2.1.3. Linked Inference Rides. At this point, in contrast to focusing on a single inference rule, we turn to a class of inference rule—linked inference rules [41]. As we discuss linked inference rules, those who are familiar with logic pro gramming may experience pleasure at recognizing certain properties shared by these inference rules and the type of reasoning employed in logic programming. It may also be interesting to note that part of the motivation for the formulation of these rules is clearly reminiscent of one of the forces that caused logic pro gramming to come into existence—the desire to curtail information retention. Let us begin with a touch of history. From approximately twenty years of experimentation, we concluded—not with a rigorous proof—that one important source of ineffectiveness for auto mated theorem-proving programs is the retention of far too much information, especially the intermediate information that is used mainly to bridge the gaps between more interesting bits of information. The notion was that bridging clauses are in an important sense less significant and should, therefore, be pre vented from playing an equal and active role in the program's reasoning; in fact, such clauses should be present implicitly only. To achieve this end, we chose to switch the focus of attention from the bridging (less significant) clauses to certain of their parents. For example (taken from the "jobs puzzle" discussed later in this section), rather than considering the bridging clause
Automated
Theorem Proving and Logic
Programming
793
-MALE(Roberta) as the focus of attention, we switched the focus to the parent clause -FEMALE(x) I -MALE(x) from which the literal in the bridging clause is descended. By switching the focus of attention, we could force bridging clauses—which are not necessarily unit clauses—to be present implicitly only. We began to think of parent clauses of the type just given as links or linking clauses—not to be confused with the term links as used in connection graphs. The objective was to restrict the role of linking clauses, requiring them to play a subordinate role in any deduction step in which they are present by using them only to connect other pairs of clauses. To impose the desired restriction, we formulated the class of inference rules, linked inference rules, on which we focus in this section. Although somewhat hidden, as part of the objective in formulating these new rules was the desire to generalize more familiar inference rules and the desire to permit a theoremproving program to retain significant bits of information, rather than avoiding information retention entirely. Simply stated, the need to retain some new information rests with the desire to use an automated theorem-proving program to attack deep questions and hard problems, many of which are taken from mathematics. In mathematics, one often needs to repeatedly apply various lemmas to prove the theorem under study, and some of those lemmas require many CPU minutes to prove. In such a case, one cannot afford to repeatedly prove the needed lemmas. A perhaps more important reason for the retention of information rests with the potential for pursuing a huge number of paths in search of a proof. To sharply reduce that number—and perhaps to sharply reduce the amount of backtracking— a program can employ demodulation (Section 2.4) and subsumption (Section 2.5). To see how demodulation is useful, how its use sharply reduces a search for information, and how its use increases the effectiveness of a search for a proof, let us imagine that we are studying group theory. Among the demodulators (rules for rewriting information into a canonical form) that we recommend for inclusion in the input for such a study is the axiom for left identity EQUAL(prod(e,x),x) with e denoting the identity of a group. If clauses are retained and demodulation is used, then the program will never consider a path involving the clause ELEMENT(prod(e,a) ,h) (the product of e and a is an element of the set H) once it has considered the clause ELEMENT(a,h)
794
Collected Works of Larry Wos
because the first of the two clauses in the predicate ELEMENT will be demod ulated to the second, and then discarded by using subsumption; the two clauses correspond to versions of the essentially same fact. Even more annoying than pursuit of the type of path just illustrated is the case in which the program discovers that a = 6, but then either fails t o demodulate one to the other be cause no equivalent of demodulation is in use, or cannot demodulate one to the other—as occurs when clauses are not retained. In contrast to what we conjec ture is crucial for attacking problems from mathematics and logic—namely, the retention of clauses—without demodulation, various versions of the essentially same fact will be available to cause the program to pursue corresponding paths. With regard to subsumption by itself, if the program deduces EQUAL(a,a) as a fascinating conclusion, the use of subsumption will immediately cause the discarding of that clause in the presence of EQUAL(x,x) and thus avoid various paths of inquiry. This last clause—reflexivity of equality— is always present when equality is relevant, even when paramodulation is used. Without retaining clauses and using demodulation and subsumption, we thus see how a program can pursue numerous paths that would otherwise be avoided. In contrast to the situation in which one wishes a program to assist in an swering some deep question or some hard problem that requires a general search for information, we know of two cases in which the choice to avoid information retention seems a very wise choice. The first case focuses on reasoning that is algorithmic in character. When one knows the precise paths to pursue to reach the desired answer or t o obtain the desired proof, then, indeed, why retain any intermediate information—why not consider all clauses that are in the input but are not nuclei or satellites as links to the desired result? (The terms nucleus and satellite are informally defined in Section 2.2.1, and examples relevant to linked UR-resolution and to linked hyperresolution are given in the discussion of the "jobs puzzle" found later in this section.) We in fact applaud logic programming for taking this approach when presented with problems for which one can find an appropriate algorithm to apply. The second case concerns the proof of extremely simple theorems. For such theorems, one can profitably apply a simple strategy (see Section 2.3) and can afford t o pursue a few distinct paths before completing a proof; backtracking can be kept to a minimal use. After all, if the theorem under study is easy to prove, then the program's chance of succeeding may indeed be high and may require the traversal of only short paths, and not very many of those either. Unfortunately, one seldom knows before the fact whether a theorem is easy to prove. Therefore—and let us be explicit in this regard—we strongly favor the ap proach that retains a number of clauses when the assignment concerns the proof
Automated Theorem Proving and Logic Programming
795
of some theorem; we conjecture that automated theorem-proving programs that avoid essentially all retention of new information will prove to offer insufficient power. We shall say more about this issue in Section 5. However, since the needed experimental data for validating or refuting our conjecture is still lacking, we are pleased to note that researchers are studying the approach to theorem proving that is based on the spirit of logic programming. Given our view concerning the need to retain information—and noting that, although we have found standard inference rules like those discussed in Section 2.2.1 to be useful, their use often causes a program to retain too many clauses— the question to answer focuses on what to do next. One obvious answer is to generalize, and one clue as to how to make appropriate generalizations rests with the desire to give an automated theorem-proving program the capacity to "jump to conclusions", providing that the conclusions follow logically. For example, if in some puzzle one knows that the job of nurse is held by a male and that Roberta has the job of teacher or nurse, one jumps correctly to the conclusion that Roberta is not a nurse. Of course—in addition to the missing fact that Roberta must be female—the key missing fact asserts that people who are female are not male. In particular, the clause -FEMALE(x)
I -MALE(x)
links the clause FEMALE(Roberta) to the clause -HASAJ0B(x,nurse)
|
MALE(x)
to draw the correct conclusion that Roberta is not the nurse. We say "jumps to the conclusion" because the person ordinarily does not explicitly conclude -or even notice that an intermediate conclusion has been drawn—that Roberta is not male. We surmised—with no stroke of brilliance— that, if an automated theorem-proving program could reason similarly, then the program would be more effective in its reasoning. Therefore, we formulated linked inference rules accordingly—rules that would treat certain bits of triv ial information as present implicitly only, rather than having such information explicitly present in the database of facts and relations. For our first illustration—to remove any distractions resulting from a lack of familiarity with the problem domain—we focus on a fragment from the "jobs puzzle" (see Chapter 3 of [37]), delaying the presentation of a far more interest ing example of deductive reasoning until Section 2.6. The jobs puzzle concerns four people (Roberta, Thelma, Steve, and Pete) and eight jobs (actor, boxer, chef, guard, nurse, police officer, teacher, and telephone operator). Each person holds two jobs. You are asked to determine which jobs are held by which peo ple. Among the clues, you are told that Roberta is not the chef, and that the husband of the chef is the telephone operator.
Collected Works of Larry Wos
796
One immediately and correctly deduces—jumps to the conclusion—that Thelma must be the chef. A brief examination of the following five clauses shows t h a t UR-resolution can be used to reach the same conclusion, but three steps are required rather than the one t h a t appears to be sufficient. On the other hand, as we shall show, by applying linked UR-resolution, one step is in fact enough. In addition, where standard UR-resolution (with the given clauses) requires the program to key on a general fact (J-5) rather than on the specific fact ( J - l ) that should initiate the deduction, linked UR-resolution behaves as one prefers by using the better choice to initiate the deduction as one would hope—by keying on clause (J-l). Let us consider the following five clauses, and then focus on standard URresolution versus linked UR-resolution. Roberta i s not t h e chef. (J-l) -HASAJOB(Roberta,chef) I f a j o b i s h e l d by a f e m a l e , t h e n t h e female i s R o b e r t a o r Thelma. ( J - 2 ) -FEMALE(jobholder(y)) I HASAJOB(Roberta.y) I HASAJOB(Thelma,y) If a person i s a wife, then t h a t person i s female. ( J - 3 ) -HUSBAND(x.y) | FEMALE(y) The p e r s o n who h o l d s t h e j o b of t e l e p h o n e o p e r a t o r i s t h e husband of t h e p e r s o n who h o l d s t h e j o b of chef. ( J - 4 ) -HASAJOB(x.telop) | HUSBAND(x,jobholder(chef)) For every j o b , t h e r e i s a p e r s o n h o l d i n g t h a t j o b . (J-5) HASAJOB(jobholder(y),y) UR-resolution suffices to yield the desired conclusion (J-8) in three steps. From clause (J-5) as satellite and clause (J-4) as nucleus, (J-6)
HUSBAND(jobholder(telop),jobholder(chef))
is obtained. From clause (J-6) as satellite and clause (J-3) as nucleus, (J-7)
FEMALE(jobholder(chef))
is obtained. And finally, from clauses (J-7) and (J-l) as satellites with clause (J-2) as nucleus, (J-8)
HASAJOB(Thelma,chef)
is deduced as the desired result. A person solving this puzzle fragment would simply and naturally conclude clause (J-8) by (simultaneously) considering the information contained in clauses
Automated Theorem Proving and Logic
Programming
797
(J-1) through (J-5). The information contained in clauses (J-6) and (.1-7) would not exist, at least explicitly. One variant of linked UR-resolution would also immediately deduce clause (J-8), but by simultaneously considering clauses (J1) through (J-5) and without deducing clauses (J-6) and (J-7). In particular, in the terminology sometimes used in discussing linked inference [41], the user could instruct a reasoning program to choose clause (J-1) as the "initiating satellite" and the predicate HASAJOB as the "target". With those choices, clause (J-2) is the "nucleus", and clauses (J-3) and (J-4) are "linking clauses" that "link" clause (J-2) to the "satellite", clause (J-5). Clauses (J-6) and (J-7) are present implicitly only. For a simple example of linked hyperresolution—and, because the clause on which we focus consists solely of negative literals, one that reflects some of the spirit of logic programming—we can again borrow from the jobs puzzle, but with a slight twist. We consider clauses (J-9) through (J-12) t h e j o b of n u r s e i s h e l d by a male ( J - 9 ) -HASAJ0B(x,nurse) I MALE(x) everyone i s n o t female or n o t male ( J - 1 0 ) -FEMALE(x) j -MALE(x) R o b e r t a i s female (J-ll) FEMALE(Roberta) R o b e r t a has t h e j o b of n u r s e (J-12) HASAJOB(Roberta,nurse) letting clause (J-10) be the nucleus—the clause whose negative literals are to be removed—or, using the terminology of logic programming, the goal clause. The object—which is the slight twist—is to prove that Roberta is not the nurse, which explains the presence of clause (J-12). With linked hyperresolution, clause (J-10) could be used to initiate the search, and thus play the role of an "initiating nucleus". Alternatively, clause ( J - l l ) could be used as an initiating satellite to unify with one of the literals of clause (J-10), and clause (J-9) could be used both to unify with the other literal of clause (J-10) and to link clause (J-10) to clause (J-12). This example illustrates how linked hyperresolution generalizes ordinary hy perresolution, for one of the negative literals of clause (J-10)—instead of being removed with a positive clause—is removed with a clause containing a negative literal, which in turn is removed with a positive clause. We note the parallel to the preceding example—-used to illustrate linked UR—which showed how the requirement to remove literals with the use of unit clauses was relaxed. For a second parallel, just as the example of linked UR-resolution treats certain infor mation as present implicitly only, the example of linked hyperresolution treats the fact that Roberta is not male as being present implicitly only.
798
Collected Works of Larry Wos
Linked inference rules, as can be seen from the two examples, offer various advantages over the corresponding standard versions and over logic program ming. First, information that would ordinarily be retained explicitly is, instead, retained implicitly, an important property so well recognized in logic program ming. Second, from the viewpoint of strategy (Section 2.3), the use of linked inference rules permits one to make better choices for the clause or clauses on which to base the entire attack on a given problem. In particular—in the spirit of the set of support strategy (Section 2.3)—clause (J-l) is a far more effective choice than clause (J-5), and clause (J-12) is a far more effective choice than clause (J-10). In contrast, the use of standard UR-resolution in the first example would en courage one to key the attack on clause (J-5), and the use of logic programming would force one to key the attack on clause (J-10). Clauses (J-5) and (J-10) are not particularly satisfying choices because of their generality. As we discuss in the section on strategy, the use of information that is specific to the prob lem is a far better choice. Finally, rather than complete avoidance of such new information—as in logic programming—the use of linked inference rules allows the user to specify the types of intermediate information to retain. For example, the user can specify a predicate, such as HASAJOB, that is of interest, and have the program retain all clauses in which the only predicate that occurs is that which is chosen by the user. At this point, if one revisits the example of linked hyperresolution, one can see how it does indeed generalize the type of reasoning employed in logic pro gramming. In both, one is allowed to use clauses containing both positive and negative literals to remove a negative literal from the initiating nucleus or goal clause. These mixed clauses link the goal clause to satellites—as they are called for hyperresolution—or positive clauses. In other words, just as linked hyperres olution gives the program the added latitude of using mixed clauses as links— which parallels the added latitude in linked UR-resolution of allowing the use of nonunit clauses as links—logic programming uses such mixed clauses. Of course, since the retention of information is crucial to many applications of automated theorem proving—in contrast to the single goal clause used in logic programming—the use of linked hyperresolution will typically involve a number of initiating nuclei or a number of nuclei each called into play because of the use of a number of initiating satellites. Also, as already mentioned, logic program ming does not adhere to the spirit of hyperresolution—that of focusing on clauses as nuclei that contain positive literals—where linked hyperresolution typically does, even allowing the use of nuclei that are not Horn clauses. Nevertheless, one more connection between logic programming and automated theorem proving exists, and—if one of the many researchers in logic programming studies linked inference rules and gains some as-yet unseen insight—perhaps an extension to logic programming will result that exhibits an even closer connection between the two fields.
Automated Theorem Proving and Logic Programming
2.2
799
Strategy
Despite our obvious enthusiasm about various inference rules and their potential value to logic programming—for example, the use of paramodulation—we can not overemphasize the need for strategy to control their application. Indeed, by applying the obvious metarule about getting nothing free, one can easily predict that, when a powerful procedure is used—such as paramodulation—hazards will be encountered. The key is to use strategy—strategy to restrict reasoning, and strategy to direct reasoning. The need for strategy is clearly recognized in logic programming as evidenced by the use of a depth-first search strategy and a left-to-right ordering strategy for solving subgoals. However, we suspect that very few people in logic programming know that the field relies on a very restricted use of a well-known strategy in automated theorem proving, the set of support strategy, that was introduced in 1965 [39]. In this section, we focus heavily on that strategy, and discuss it in its most general form. We shall also discuss a strategy—the weighting strategy [17]—that permits the user to impose knowledge and intuition on an automated theorem-proving program's attack on a problem. Perhaps researchers in logic programming can find a way to use the set of support strategy more fully than it is used now, and can also find a way to use the weighting strategy. Certainly— from our viewpoint- the current use of strategy in logic programming appears to be insufficient, if the goal is to use logic programming to answer deep questions or solve hard problems from mathematics. Indeed, perhaps the most significant issue raised in this article is that focusing on the use and importance of strategy. In fact, even with the power offered by an inference rule such as paramodulation— which enables a theorem-proving program to treat equality as "understood" — the use of strategy is essential. Simply stated—from the viewpoint of automated theorem proving—without strategy, the program can deduce far too many con clusions and too easily proceed in an unprofitable direction. From the viewpoint of logic programming—especially if the question under study is deep—without a sophisticated use of strategy, a program written in, say, Prolog can too easily pursue a huge number of paths before finding an answer, if indeed it ever does. For a taste of the power of paramodulation that shows why the use of strategy of various kinds is absolutely necessary—even though an examination of our example may, for some, (mistakenly) weaken our case for treating equality as a "built in" concept—let us briefly focus on the equation that gives the actions of the combinator W in combinatory logic. (Wx)y = [xy)y If one applies reasoning in the spirit of equality substitution—more accurately, if one applies paramodulation—to W with itself, one deduces the following sixteen clauses. &(W((Wx)y))z = (((xy)y)z)z& &(Vx)((Wy)z) = (x((yz)z))((yz)z)&
800
Collected Works of Larry Wos
&(W)x - (xx)x& ft(W((xy)y))z = (((Wx)y)z)z& fe(Wx)((yz)z) = (x((Wy)z))((yz)z)& &(V(xy))y - ((Wx)y)yfc &(Vx)((yz)z) - (x((yz)z))((Wy)z)& ft(Wx)y - (Wx)yft &(V((xy)y))z = (((Wx)y)z)z& &(Wx)((yz)z) = (x((Wy)z))((Wy)z)& &(xy)y = (xy)y& &(W((Wx)y))z = (((xy)y)z)z& &(Wx)((Wy)z) = (x((yz)z))((Wy)z)& &(W(Wx))y - ((xy)y)y& fc(Wx)((Wy)z) = (x((Wy)z))((yz)z)& fc(WW)x = (xx)x& Of the sixteen given clauses, the first eight are obtained by paramodulating from the right side of the equation for W into various terms, and the last eight are obtained by paramodulating from the left side. One can imagine how many additional conclusions would be drawn were we to continue reasoning by focus ing on pairs of those sixteen conclusions—the members of the first generation of descendants of W with itself—and then reason by focusing on the second generation. To avoid the flood of conclusions that can result if reasoning is uncontrolled, an automated theorem-proving program can use various types of strategy. On the one hand, some types of strategy are designed to restrict the reasoning; on the other, some types are designed to direct it. From a different perspective, some types of strategy are general in the sense that they apply to all inference rules, and others are specific in the sense that they apply only to a single inference rule. Of those of a general nature, the most powerful restriction strategy that an automated theorem-proving program can use is called the set of support strategy [39]. That strategy restricts the program's reasoning with the intention of sharply retarding the generation of irrelevant conclusions. To use the set of support strategy, one is required to choose a subset T of the set S of (input) clauses given to the program to describe the problem to be studied. The program then draws a conclusion only if it is recursively traceable to T, Therefore, at the beginning of the program's attack on a problem—from a procedural viewpoint— an inference rule is applied to a subset of clauses from S only if at least one of its members is in T. Any clause that is retained is automatically given the power of the clauses that are members of T. Thus, after additional clauses have been retained, an inference rule can be applied to a subset of clauses if one of them is a clause not in S—a clause that is not an input clause. Stated another way, with the set of support strategy, the program is not allowed to apply an
Automated Theorem Proving and Logic Programming
801
inference rule to a subset of clauses all of which are in S —T. To see that logic programming does indeed rely on the use of a restricted form of the set of support strategy, let us consider the recommended ways to use this strategy. We recommend either of two uses of the strategy. For each, let any given set of clauses that is used to present a question or problem to a theorem-proving program be divided into three sets, (1) those that correspond to the axioms of the underlying theory and any lemmas that are to be used, (2) those (the special hypotheses) that correspond to the extra assumptions (if any), and (3) those (the denial of the conclusion) that correspond to assuming that the theorem is false. For example, let us consider the theorem that asserts that, in a group, if the square of every element is the identity, then the group is commutative. By applying our rules for partitioning the set of clauses used to present a problem, set (1) would consist of those clauses that correspond to the axioms of a group and any lemmas to be used, set (2) would consist of those clauses that correspond to the assertion that the square of every element is the identity, and set (3) would consist of those clauses that correspond to assuming that the group is not commutative. Our first recommendation for the use of the set of support is to choose for the set T (see the informal definition given earlier) the union of the special hypothesis and the denial of the conclusion. Our second—and less preferred— recommendation is to choose for the set of support T only those clauses that correspond to the denial of the conclusion of the theorem under study. One should note that, since the clauses that are present because of assuming the theorem false may in fact include clauses free of -(not), even by following our second recommendation one does not necessarily precisely imitate what occurs in logic programming. The reason is obvious—in logic programming, the goal clause must be negative. For example, the goal clause for the illustration of linked hyperresolution (Section 2.2.3) would be (J-10)
-FEMALE(x)
I
-MALE(x)
if logic programming were given this puzzle fragment to solve. As commented, such a choice is unfortunate since it permits a program to delve deeply into background information rather than focusing on the specific problem to solve— in particular, such a choice does not reflect the spirit of the set of support strategy. We can now summarize to see how logic programming does indeed rely on the use of the set of support strategy. One simply adds a single clause—the goal clause—all of whose literals are in effect negative literals, and requires that all of the program's reasoning be recursively traceable to that single clause. Phrased in terms of automated theorem proving, one chooses for the set of support a single clause containing no positive literals. Ordinarily, the clause selected for the set of support would be one of the clauses that are present because of assuming the theorem under consideration false. However, for those cases in which each of those clauses contains at least one positive literal, the actions one
802
Collected Works of Larry Wos
is forced to take in logic programming are not in the spirit of automated theorem proving. In particular, in logic programming, one must try various clauses from the problem description, requiring, of course, that each is in effect a negative clause. By taking such an action, one is still relying on the use of the set of support strategy, for the program is not allowed to apply its reasoning to a set of clauses none of which is traceable to the selected clause. Unfortunately—from the viewpoint of automated theorem proving and the intent of the set of support strategy—this action risks the danger of using an axiom as the set of support. We shall return to this issue later in this article. At present, if one is contemplating the study of deep questions or hard prob lems by using an approach that closely imitates that taken in logic programming, the following analysis might merit serious thought. In the best case—if viewed from the perspective of the set of support strategy—the reasoning employed by logic programming mirrors that applied by an automated theorem-proving program when the assumption that the theorem is false leads to the addition of exactly one clause, and that clause consists of all negative literals. In the worst case—by using a set of support that consists of a single clause and one that corresponds to an axiom of the theory from which the problem is taken—the reasoning employed by logic programming diverges sharply from that employed by a theorem-proving program. For deep questions or hard problems, such a choice for the set of support is at best unwise. Indeed, when the difficulty is high, the probability is also high that the program—to succeed- -will be forced to pursue a number of paths more or less independently. The need to pursue independent paths is tightly coupled with access to the presence in the initial set of support of at least a few clauses—certainly more than one. More important, such serious studies must not be burdened with reasoning that stems from the axioms of a theory. Rather, the needed reasoning must be severely restricted to focusing on the information that is outside of that which corresponds to axioms and lemmas. This last observation explains why our recommended use of the set of support strategy asks the user to place in the set of support—in addition to those that are present because of assuming the theorem false—those clauses that correspond to the special hypothesis. If one were to follow our recommendation, and if one were to attempt to use a program to prove the commutator theorem relying on the P-formulation (Sec tion 2.6), then one would place in the set of support clauses (COM-1) through (COM-8). In contrast, if one were to attack this theorem in the spirit of logic programming, then the set of support would consist of clause (COM-8) only. With this choice—rather than even following our second recommendation con cerning the set of support strategy—one would be using only part of the de nial of the conclusion. Indeed, the denial consists of clauses (COM-3) through (COM-8). Although any attempt to prove the commutator theorem should prove exciting—to experience playing against long odds—one might attempt to ob tain a computer proof by forcing the set of support to consist of clause (COM-8) only. We conjecture that disaster will occur.
Automated Theorem Proving and Logic Programming
803
If, instead of relying on the P-formulation, one were to attempt to prove the commutator theorem using the notation that emphasizes equality, then one would use clauses (COMEQ-1) through (COMEQ-3)—if the intent was to follow our preference. On the other hand, were one using a theorem-proving program based on logic programming technology, then one would use clause (COMEQ3) only. One might find it challenging to make such an attempt. Again we conjecture that disaster will occur. Our conjecture becomes even more piquant when one notes that we did in fact succeed in proving the commutator theorem with one of our programs—the program TPO, which executes rather slowly compared to our other programs—and with only clause (COMEQ-3) in the set of support; however, the program relied on the use of the inference rule negative hyperparamodulation [35]. The proof was obtained in 193 CPU seconds on a Sun 3/75, generating 405 clauses and retaining 115. In contrast, by using paramodulation and following our recommendation for the use of the set of support strategy, a proof was obtained with an earlier program in 3 CPU seconds on a computer that is five to ten times more powerful. Although we heartily endorse a variety of approaches to serious studies, and often learn from different paradigms for automated theorem proving, we regret tably conjecture that—without substantial data to the contrary— an approach to studies focusing on deep questions from mathematics, if based primarily on logic programming technology, must fail. Of course, for simple theorems such a technology may indeed prove fruitful. Because one should attempt to at least provide an example when using a nebulous concept—such as simple theorem—let us immediately do so. We in clude among simple theorems that which asks one to prove commutativity for groups for which one knows that the square of every element is the identity. This theorem was proved in 1965 with binary resolution and the set of sup port strategy and without demodulation (see Section 2.4) on a Control Data Corporation 3600 in less than 3 CPU seconds. The theorem is referred to as a classroom exercise by algebraists, but it does serve well for illustrating concepts and approaches. In contrast, we include among somewhat difficult theorems to prove the commutator theorem, which in Section 2.6 we present, discuss, and prove—in two different ways. We consider it important to exercise great care when estimating the power of an automated theorem-proving program, especially when the estimate is based on proving simple theorems. On the other hand, if one has designed a program that proves simple theorems in very little CPU time (say, less than 5 CPU seconds per proof) and with a high degree of success, then that person is indeed justified to claim an important achievement. To complement the objective of the set of support strategy —for a gen eral strategy that can be used to direct, rather than restrict, the program's reasoning—one can use the weighting strategy. To use this strategy, one as signs priorities, called weights, to the various concepts, relations, and terms. The weights can be based simply on symbol count, or they can be based on a
804
Collected Works of Larry Wos
set of elaborate templates. The theorem-proving program uses the weights to choose from among the various clauses that on which to focus its attention. In other words, by using the weights to select which path of reasoning to follow, the program directs its reasoning. For example, for the commutator theorem, one could instruct the program to prefer expressions containing one occurrence of the function inv to all other expressions; one simply assigns a low weight to inv and higher weights to all other functions and constants. Similarly, in the "jobs puzzle" and its variants, one can assign a low weight to Roberta, a slightly higher weight to Thelma, and the like—if one wishes the program to focus on information about Roberta in preference to focusing on information about Thelma. For a more detailed discussion of using weighting and the set of support strategy, one can browse in [37] or in [34]. In addition to using the set of support strategy, which is a general strat egy designed to restrict the application of any inference rule, an automated theorem-proving program can also use a number of others that are specific in that they are designed with the express purpose of restricting the application of paramodulation. First, the program can be restricted from paramodulating from or into a variable. This restriction prevents a myriad of conclusions from being drawn. Such a restriction strategy is, in most cases, mandatory. After all, paramodulating from or into a variable will always yield a conclusion since the corresponding unification can never fail. Second, the program can be required to paramodulate only from a specified side of each equality. In some cases, all applications of paramodulation are required to be from the left side only; in others, all are required to be from the right only. Because of our desire to further pique the interest of researchers in logic programming, and because we explicitly recognize that far more control over reasoning is required for automated theorem proving to reach its potential, we close this section on strategy with a few incomplete notions about additional possibilities. One strategy that might merit exploration concerns choosing the path for an attempt at solving a subgoal based on the number of literals in the clause to be used, with a preference for unit clauses. A second strategy focuses on choosing the subgoal to attempt to solve based on the likelihood of failure. Either of the two strategies could take into account or ignore the current partial instantiation. A third strategy—which might be considered as a generalization of "assert" in Prolog—would permit a user to give criteria for the program to apply to decide which items of information to retain. For a fourth strategy—one that might prove useful for enabling logic programming to rely more on a natural representation, as occurs to some degree in the theorem on index 2 (Section 2.1)—one could consider the use of automated tautology adjunction followed by case splitting. For example, if we borrow from an approach commonly taken in mathematics, the two natural cases to consider for the index 2 theorem focus, respectively, on the case in which a is an element of the subgroup O and on the case in which o is not an element of the subgroup. As one no doubt guesses,
Automated Theorem Proving and Logic Programming
805
currently it is not clear to us how to complete this approach to cope with nonHorn clauses. Nevertheless, because the use of strategy is vital to attacking deep questions and hard problems, consideration of the preceding incomplete notions as well as the others presented in this section might prove challenging.
2.3
Demodulation
The next topic for this review of automated theorem proving is that of canonicalization, which is available to automated theorem-proving programs through the use of demodulation [40] (see the two proofs in Section 2.6). In many ar eas of mathematics and logic, one often rewrites each new item of information into a canonical form. In automated theorem proving, a similar action can be taken. Of course, if as in logic programming no new clauses are retained, then one might conclude that canonicalization is of no interest. We suspect that such a position has hidden flaws in it, as we discussed in Section 2.2.3. Indeed, not only is demodulation essential for automated theorem proving, its use might also merit serious consideration for logic programming, which we briefly discussed in Section 2.2.3. With regard to canonicalization, a sharp difference, however, exists between mathematics and automated theorem proving. In the former, one uses canoni calization when it seems convenient and appropriate. In the latter, one cannot in most cases exercise such freedom, for—without automatically requiring each conclusion to be rewritten into a canonical form—the program will drown in information. Of course, some conclusions will be unaffected by the particular choice of demodulators [40] in a given problem. One other difference exists between the use of canonicalization by a mathe matician or logician and its use by a theorem-proving program. When a person uses various equalities for canonicalization, the equalities are applied only to the expressions chosen by the person; when a program applies such equalities, all expressions to which the equalities are applicable are in fact rewritten into a canonical form. Now, let us examine some typical uses of canonicalization. One might, for example, uniformly replace -(—t) by t for any term t, or replace r(s + t) by rs + rt for terms r, s, and t. For such term replacements, many automated theorem-proving programs offer the mechanism demodulation, referred to earlier, which automatically rewrites expressions into a canonical form based on some set of rewrite rules called demodulators. The demodulators can be included among the input clauses, or the program can be asked to find potentially useful ones. For the two given examples, the demodulators EQUAL(minus(minus(x)),x) and
EQUAL(prod(x,sum(y,z)),sum(prod(x,y),prod(x,z))) can be used, respectively.
Collected Works of L&rry Wos
806
As one might predict, care must be taken in the choice of which equality clauses to attempt to use as demodulators. In particular, an unwise choice can cause the program to loop. To see how looping can occur, let us consider what will happen when the equation for the combinator W is used as a demodulator and when the program encounters a term of a certain type. In particular, when the clause (W)
EqUAL(a(a(W,x),y),a(a(x,y),y))
is used as a demodulator and the term WWW is encountered, this term will be transformed to itself repeatedly without ever terminating. For a more interesting example, let us consider the expression T = a{a(W, a(B, *)), o(W, a(B, x))) and what occurs when the two demodulators (for the combinators W and B) (W)
EqUAL(a(a(W,x),y),a(a(x,y),y))
and (B)
EQUALCa(a(a(B,x),y),z),a(x,a(y,z)))
are applied to Y with the object of producing a canonical form. Demodulation begins by successfully applying W, then B, to obtain a{x,T) which leads to another successful application of W followed by B to obtain a(x,a(x, T) which of course leads to yet another success and, in fact, to a nonterminating sequence of successful applications of W and B. Nevertheless, as long as one is careful about the choice of demodulators, the use of demodulation can sharply increase the effectiveness of a theorem-proving program in its search for assignment completion. Even further, for many studies, without the use of demodulation the program will simply require an inordinate amount of computer time to complete rather simple assignments. For those familiar with functional programming, demodulation is similar to reduction in which the reduction rules are the demodulators. In fact, de modulation (in the context of automated theorem proving) has been used as a general-purpose functional programming language [31].
2.4
Subsumption
We now come to the next-to-the-last topic of this section, subsumption, a mecha nism that—like demodulation—is almost always essential for a theorem-proving
Automated Theorem Proving and Logic Programming
807
program to be effective. Such a mechanism might also merit study for logic programming, as we briefly touched on in Section 2.2.3. Although the use of various types of strategy does indeed contribute markedly to the efficiency of an automated theorem-proving program, such a program continues to deduce conclusions that are trivial and unneeded corollaries of existing clauses. For ex ample, if the program paramodulates from the second argument of the clause equivalent of Wx)y = (xy)y into the first subargument of the second argument of the clause equivalent of (W(Wx))y
= ((xy)y)y,
the program deduces the clause equivalent of (W(Wx)y
= ((Wx)y)y,
which is a trivial corollary, in fact an instance, of (Wx)y = (xy)y and is, therefore, immediately discarded. The procedure for discarding such deductions is subsumption [25]. The clause A subsumes the clause B if there exists a uniform replacement of terms for variables in A that produces a clause that is a subclause of B. For a second example of subsumption, an example that might not be ex pected, let us consider the two clauses P(x)
I
P(y)
and P(x) and recall that a variable is relevant only to the clause in which it occurs. That the second clause subsumes the first follows immediately from the definition of subsumption. However, as it turns out, the first also subsumes the second, as can be seen by replacing y by x in the first to produce P(x) since a clause, by definition, does not allow duplicate literals: technically, a clause is defined as a set of distinct literals. As an aside, if we wished to have our program use instantiation as an inference rule to permit the program to imitate the corresponding type of reasoning (discussed in Section 2.2) that is often used in mathematics, we would be forced to protect the instances that were deduced so that subsumption would not immediately discard them. Of especial use is the role of subsumption for removing clauses that assert the equality of a term with itself; such an assertion is, needless to say, usually of little interest and seldom useful. To remove such trivial clauses, the clause
Collected Works of Larry Wos
808
EqUAL(x.x) for reflexivity of equality is used to subsume many clauses that would otherwise be kept. This clause, which must be included in the input if paramodulation is the chosen rule of inference, is also important in that a proof often terminates with the deduction of a clause of the form -EQUAL(t,t) for some term t.
2.5
Examples of Proof by Contradiction
In the interest of addressing all of the major elements of automated theorem proving, here we focus on proof by contradiction. We are content with focus ing on two proofs of a theorem, the commutator theorem, from group theory. This focus fulfills our promise, made in Section 1.3, of supplying proofs for the challenge problem posed there. For other interesting examples of such proofs, we recommend the two books cited earlier [37,34]. A study of proofs of theo rems that are not considered trivial theorems can be most instructive and, more important, can lead to an appreciation of what has been achieved, why certain mechanisms are used, and what is needed but not yet available. Consideration of the commutator theorem illustrates (1) the need for using demodulation, (2) the need for using subsumption, (3) the need for retaining clauses, and (4) the need for using powerful strategies. In short, the theorem we now consider—whose proof we give so that one can measure the performance of one's program—provides an example of why we conjecture that shortcuts to producing a program that offers sufficient power must fail. Although we ordinarily prefer a notation that emphasizes the role of equality, for this theorem we shall rely instead on the so-called P-formulation. One might note that the clauses we give for this problem are in fact Horn clauses, which means that the theorem is—theoretically—in reach of logic programming. One need not be familiar with group theory to study this theorem—especially since we give its proof. However, one's understanding is increased by noting that the commutator, [x, y], of any two elements x and y of a group is the product of x, y, the inverse of x, and the inverse of y. The theorem to prove asserts that if the cube of every element x in the group is the identity e, then [\x, y],y] = e for all x and y. The following set of twenty-five clauses includes a subset that provides a com plete characterization for abstract group theory—in the first seventeen. Those twenty-five clauses can be used to present one notational version of the theorem to be proved. For those interested in the fine points of a theory, one can dispense with ten of the seventeen clauses if one wishes to rely on a set containing no dependent clauses; indeed, the set consisting of clauses (GT-1), (GT-3), (GT-5), (GT-6), (GT-7), (GT-8), and (GT-14) provides a complete characterization for abstract group theory.
809
Automated Theorem Proving and Logic Programming
left identity: (GT-1) P(e,x,x) right identity: (GT-2) P(x,e,x) left inverse: (GT-3) P(inv(x),x,e) right inverse: (GT-4) P(x,inv(x),e) associativity: (GT-5) -P(x,y,u) (GT-6) -P(x,y,u)
I -P(y,z,v) I -P(y,z,v)
I -P(u,z,u) I -P(x,v,w)
| P I P
closure (perhaps, more accurately, totality): (GT-7) P(x,y,prod(x,y)) product is well defined: (GT-8) -P(x,y,u) I -P(x,y,v)
I EQUAL(u.v)
equality is reflexive: (GT-9) EQUAL(x.x) equality is symmetric: (GT-10) -EQUAL(x,y) 1
EQUAL(y.x)
equality is transitive: (GT-11) -EQUAL(x,y) 1
-EQUAL(y.z)
equality (GT-12) (GT-13) (GT-14) (GT-15) (GT-16) (GT-17)
substitution: -EQUAL(u.v) 1 -EQUAL(u,v) I -EQUAL(u.v) 1 -EQUAL(u,v) I -EQUAL(u,v) I -EQUAL(u.v) 1
I EQUAL(x.z)
-P(u,x,y) I P(v,x,y) -P(x,u,y) I P(x,v,y) -P(x,y,u) I P(x,y,v) EQUAL(prod(u,x),prod(v,x)) EQUAL(prod(x,u),prod(x,v)) EQUAL(inv(u).inv(v))
ie identity e: the cube of every x is the J>x,e) (C0M-1) -P(x,x,y) I P(y,x,e) x.y.e) (COM-2) -P(x,x,y) I P(x,y,e) denial of the conclusion:
Collected Works of Larry Wos
810
(COM-3) (COM-4) (COM-5) (COM-6) (COM-7) (COM-8)
P(a,b,c) P(c,inv(a),d) P(d,inv(b),h) P(h,b,j) P(j.inv(h),k) -P(k,inv(b),e)
For the proof we shall give, we use hyperresolution [26], a set of demodula tors in the input, and demodulators that are found by the program during its search for a proof. The demodulators found by the program are used to back demodulate—rewrite—clauses already present, as well as demodulate clauses deduced after the program adjoins these new demodulators. In the following proof, the clause numbers are taken directly from the successful proof search. P r o o f 1 of t h e C o m m u t a t o r T h e o r e m closure ( t o t a l i t y ) : (PC0M-1) P ( x , y , p r o d ( x , y ) ) left inverse: (PCOM-4) P ( i n v ( x ) , x , e ) right inverse: (PCOM-5) P(x.inv(x),e) associativity: (PCOM-6) -P(x,y,u) (PCOM-7) -P(x,y,u)
I -P(y,z,v) I -P(y,z,v)
I -P(u,z,w) I -P(x,v,w)
product is well defined: (PC0M-11) -P(x,y,u) I -P(x,y,v)
| EQUAL(u.v)
left cancellation: (PCOM-18) -P(x,u,y)
| EQUAL(u.v)
I -P(x,v,y)
(another form of) the cube of x is e: (PCOM-20) P(x,prod(x,x),e) denial of the conclusion: (PCOM-21) P(a,b.c) (PCOM-22) (PCOM-24) (PCOM-26)
P(c.inv(a),d) P(h,b,j) -P(k,inv(b),e)
I P(x,v,w) I P(u,z,w)
Automated Theorem Proving and Logic Programming
demodulators: (PCOM-27) EQUAL(prod(e,x),x) (PCOM-28) EQUAL(prod(x,e),x) (PCOM-31) EQUAL(prod(prod(x.y),z),prod(x,prod(y,z))) (PCOM-37) EQUAL(prod(a,b),c) (PCOM-40) EQUAL(prod(h,b),d) (PCOM-41) EQUAL(prod(d,inv(h)),k) from clauses 21, 6, 1, and 1 (PCOM-42) P(a,prod(b,x),prod(c,x)) from clauses 21, 6, 4, and 1, with demodulation by 27 (PCOM-48) P(inv(a),c,b) from clauses 24, 11, and 1, with demodulation by 40 (PCOM-58) EQUAL(d.j) from clause 58 back demodulating clause 41 (PCOM-68) EQUAL(prod(j,inv(h)),k) from clause 58 back demodulating clause 22 (PCOM-70) P(c,inv(a),j) from clauses 48, 11, and 1 (PCOM-104) EQUAL(prod(inv(a),c),b) from clauses 70, 7, 4, and 1, with demodulation by 28 (PCOM-137) P(j,a,c) from clauses, 70, 6, 21, and 1 (PCOM-147) P(a,prod(b,inv(a)),j) from clauses 20, 6, 1, and 1, with demodulation by 27 (PCOH-190) P(x,prod(x,prod(x,y)),y) from clauses 20, 18, and 5 (PCOM-199) EQUAL(inv(x).prod(x.x)) from clauses 20, 6, 24, and 1 (PCOM-211) P(h,prod(b,prod(j,j)),e) from clauses 20, 6, 137, and 1 (PCOM-213) P(j,prod(a,prod(c,c)),e)
Collected Works of Larry Wos
812
from clause 199 back demodulating clause 147 (PCOM-224) P(a,prod(b,prod(a,a)),j) from clause 199 back demodulating clause 104, with demodulation by 31 (PCOM-241) EQUAL(prod(a,prod(a,c)),b) from clause 199 back demodulating clause 48 (PCOM-242) P(prod(a,a),c,b) from clauses 199 back demodulating clause 26 (PCOM-265) -P(k,prod(b,b),e) from clauses 199 back demodulating clause 68 (PCOM-285) EQUAL(prod(j,prod(h,h)),k) from clauses 242, 6, 1, and 1 (PCOM-375) P(a,prod(a,c),b) from clauses 42, 11, and 1 (PCOM-498) EQUAL(prod(a,prod(b,x)),prod(c,x)) from c l a u s e s 2 1 1 , 18, and 20 (PCOM-1092) EQUAL(prod(b,prod(j,j)),prod(h,h)) from c l a u s e s 2 1 3 , 18, and 20 (PCOM-1117) EQUAL(prod(a,prod(c,c)),prod(j,j)) from c l a u s e s 224, 7 , 190, and 3 7 5 , w i t h d e m o d u l a t i o n by 3 1 , 3 1 , 2 4 1 , 3 7 , 3 1 , 3 1 , 4 9 8 , 1117, and 1092 (PCOM-1161) P(j,prod(h,h),b) from c l a u s e s 1161, 1 1 , and 1, w i t h d e m o d u l a t i o n by 285 (PCOM-1214) EQUAL(b.k) from c l a u s e 1214 back d e m o d u l a t i n g c l a u s e 265 t w i c e (PCOM-1589) -P(k,prod(k,k),e) Clause (PCOM-1589) c o n t r a d i c t s c l a u s e (PCOM-20) , and t h e proof complete.
is
For experiments that produce proofs like the preceding and like the following, we prefer to employ some or all of the following clauses as demodulators. This set of ten clauses is a complete set of reductions for group theory—more accurately, for free groups (see Chapter 5 of [34]). For the theorem under discussion, we
Automated Theorem Proving and Logic Programming
813
used the first seven only. EQUAL(prod(e,x),x) EQUAL(prod(x,e),x) EQUAL(prod(inv(x),x),e) EQUAL(prod(x,inv(x)),e) EQUAL(prod(prod(x,y),z),prod(x,prod(y,z))) EQUAL(inv(inv(x)),x) EQUAL(inv(e),e) EQUAL(inv(prod(x,y)),prod(inv(y),inv(x))) EQUAL(prod(inv(x),prod(x,y)),y) EQUAL(prod(x,prod(inv(x),y),y))
Let us stay with the commutator theorem just a bit longer to show how it can be proved by using paramodulation and an equality-oriented notation. To study abstract group theory, but with an emphasis on the use of equality, one can use the following clauses. left identity: (GTEQ-1) EQUAL(prod(e,x),x) right identity: (GTEQ-2) EQUAL(prod(x,e),x) left inverse: (GTEq-3) EQUAL(prod(inv(x),x),e) right inverse: (GTEQ-4) EQUAL(prod(x,inv(x)),e) associativity: (GTEQ-5) EQUAL(prod(prod(x,y),z),prod(x,prod(y,z))) reflexivity: (GTEq-6) EQUAL(x.x)
One might note that—as expected—the only axiom for equality itself that we include is that for reflexivity. To have an automated theorem-proving program attempt to prove the com mutator theorem, one can add the following clauses. the cube of every $x$ i s the i d e n t i t y e: (COMEQ-1) EQUAL(prod(x,prod(x,x)),e) d e f i n i t i o n of commutator: (COMEQ-2) EQUAL(com(x,y),prod(x,prod(y,prod(inv(x),inv(y)))))
Collected Woris of Larry Wos
814
denial of the conclusion: (COMEQ-3) -EQUAL(com(com(a,b),b),e) So that one can study how paramodulation works on a hard problem, so that one can see how effective this inference rule is, and so that one can measure one's experiments against what we have obtained, we give the following proof based on paramodulation. We use as input demodulators the same seven we used for the P-formulation. Proof 2 of the Commutator Theorem associativity: (PCOMEq-5) EQUAL(prod(prod(x,y),z),prod(x,prod(y,z))) provable lemma in group theory: (PCOMEq-8) EQUAL(inv(prod(x,y)),prod(inv(y),inv(x))) provable lemma in group theory: (PCOMEQ-10) EQUAL(prod(inv(x).prod(x.y)),y) reflexivity: (PCOMEQ-11) EQUAL(x.x) the cube of $x$ is the identity e: (PCOMEQ-12) EQUAL(prod(x,prod(x,x)),e) denial of the conclusion, after demodulation with definition of commutator: (PCOMEQ-13) -EQUAL(prod(a,prod(b,prod(inv(a),prod(b, prod(a,prod(inv(b),prod(inv(a),inv(b)))))))),e) demodulators: (PCOMEQ-14) EQUAL(prod(e,x),x) (PCOMEQ-15) EqUAL(prod(x,e),x) (PCOMEq-18) EQUAL(prod(prod(x,y),z),prod(x,prod(y,z))) from clause 12 into clause 5, with demodulation by 18, 18, and 18 (PCOMEQ-24) EQUAL(prod(x,prod(y,prod(x,prod(y,prod(x,y))))),e) from clause 12 into clause 10, with demodulation by 15 (PCOMEq-27) EqUAL(inv(x).prod(x.x)) from clause 12 into clause 5, with demodulation by 18 and 14
Automated Theorem Proving and Logic
(PCOMEQ-28)
Programming
815
EqUAL(prod(x,prod(x,prod(x,y))),y)
from clause 27 into clause 8, with demodulation by 27, 18, 27, and 18 (PCOMEQ-30) EQUAL(prod(x,prod(x,prod(y,y))), prod(y,prod(x,prod(y,x)))) from clause 27 into clause 13, with demodulation by 27, 27, 18, 27, 18, 18, 30, and 28 (PCOMEQ-31) -EQUAL(prod(a,prod(b,prod(a,prod(a,prod(b, prod(a,prod(a,prod(b,a)))))))),e) from clause 24 into clause 5, with demodulation by 18, 18, and 18 (PCOMEQ-33) EQUAL(prod(x,prod(y,prod(z,prod(x,prod(y,prod(z, prod(x,prod(y,z)))))))),e) from c l a u s e 33 back d e m o d u l a t i n g c l a u s e 31 (PCOMEQ-35) -EQUAL(e.e) C l a u s e (PCOMEQ-35) c o n t r a d i c t s c l a u s e (PC0MEQ-11), and t h e proof i s c o m p l e t e . One who enjoys historical highlights might find it interesting to note that reading in 1970 about this problem and its binary resolution and paramodulation proofs (obtained by hand) motivated R. Overbeek to become interested in automated theorem proving. Overbeek obtained a computer proof with hyperresolution in 1975, a proof requiring 100 CPU seconds on an IBM 370/195 with a program he designed and implemented. With that same program on the same computer, its proof was obtained with paramodulation in 1976 in less than 3 CPU seconds. A study of the two given proofs, or an attempt to obtain one of them, may amply demonstrate why automated theorem proving relies heavily on the use of the set of support strategy, demodulation, and subsumption. Such a study or an attempt may also provide one with excitement and a challenge. Regard less of the outcome, theorems like the commutator theorem provide directly and indirectly excellent illustrations of some of the fundamental differences be tween logic programming and automated theorem proving. Nevertheless, each field offers the other many important ideas to consider and techniques to adapt (discussed in Section 4), and a good case can be made for the existence of a natural symbiosis. Having completed our lengthy review of automated theorem proving, having made certain comparisons with logic programming, and desiring to focus on that possible symbiosis, let us now turn to collecting some of the important
816
Collected Works of Larry Wos
similarities and some of the important differences between the two fields. This action will set the stage for discussing the possible benefits each field offers the other, which is the topic of Section 4.
3
SIMILARITIES AND DIFFERENCES
Although in some sense it may seem odd to compare logic programming and automated theorem proving—since they address fundamentally different issues, namely, programming language versus general-purpose deduction—nevertheless, we find such a comparison of interest. In particular—especially for those who are new to logic programming and automated theorem proving—the comparison may remove certain points of confusion regarding the possible use of the former for the latter. The most obvious similarity between logic programming and automated the orem proving—at least, if one focuses on the clause language paradigm—is the language that one uses to communicate a problem. Of course, the syntax may vary, and most dialects of logic programming require the use of Horn clauses. Nevertheless, both fields rely on the use of clauses. In automated theorem prov ing, however, some programs honor a "built in" treatment of equality in the full sense of the term. For example, use of the predicate EQUAL causes such pro grams to "know" that the corresponding statement refers to equality. Because of our obvious vested interest, we are delighted that familiarity with logic pro gramming is rapidly growing, for—eventually—the vast majority of computer scientists will know what a clause is. The second important similarity between logic programming and automated theorem proving rests with the fact that the type of reasoning employed by the former is one of the types of reasoning that can be employed by the latter. That reasoning at the top level, as we discussed in Section 2.2.3, corresponds to linked hyperresolution. At the lower level, every reasoning step of each path that solves a subgoal is a successful application of binary resolution. In addition to sharing certain aspects of representation and inference rule, logic programming and automated theorem proving share certain aspects of the use of strategy. Specifically, both rely heavily on the use of the set of support strategy (see Section 2.3). However, logic programming uses a very restricted version of this strategy. Finally, in the sense discussed in Section 2.6, both fields rely on proof by con tradiction. Even further—just as logic programming constructs or discovers the particular object or objects of concern—automated theorem proving can do the same by using the ANSWER literal. Of course—to be precise—logic program ming in effect uses such a literal by its employment of the goal clause. In con trast, automated theorem proving, when desired, explicitly uses the ANSWER literal whose arguments—upon completion of the given assignment—contain the sought-after information.
Automated Theorem Proving and Logic Programming
817
With regard to the differences between logic programming and automated theorem proving, at least four crucial ones immediately come to mind, and a number of lesser ones can be given. First—in the typical approach—logic programming restricts representation by requiring that all clauses but the goal clause contain exactly one positive literal. This restriction is a tightening of that which asks for all clauses to be Horn clauses, clauses that contain no more than one positive literal. In automated theorem proving, no restriction is placed on the clauses to be used in presenting a question or a problem. Second, in logic programming—and in theorem-proving based on a similar paradigm, for example [28]—no new clauses are retained during an attack on a question or problem. This lack of retention clearly is one important source of the impressive speed offered by this programming language. Automated the orem proving, on the other hand—with the exception of the program already mentioned and similar ones—relies heavily on the retention of new informa tion. Although such retention (when all other considerations are ignored) can be expensive—for deep questions and hard problems—we conjecture that it is absolutely necessary for effectiveness, a point we address in Section 2.2.3. In fact, for those who doubt this necessity—in addition to our recommendation of attempting to prove the commutator theorem—we shall give some challenge problems in Section 5. The third important difference focuses on the use of strategy. Although logic programming—as we have observed—does use strategy, its use is extremely lim ited when compared to the rich and sophisticated use of strategy in automated theorem proving. Though the limitation of logic programming to a single search strategy contributes to performance—even more than avoiding the occurs check does—to confine the use of strategy only to a depth-first and left-to-right search and to a very limited form of the set of support strategy appears to us to cheat logic programming of much of its potential. Indeed, for logic programming to dramatically widen its scope of application to include the consideration of deep questions from mathematics, we conjecture that a far more sophisticated use of strategy is required. For one example, logic programming might consider using a broader form of the set of support strategy (as discussed in Section 2.3). For a second example, giving logic programming access to a strategy such as the weighting strategy, which allows the user to give hints about what is important, also appears to us to be a move that would add to the effectiveness of logic programming. After all, since the intent in logic programming is to enable one to apply an algorithm and in the context of logical reasoning, it seems natural to also permit the user to give hints. The fourth significant difference between logic programming and automated theorem proving is their respective treatment of equality in its fullest meaning. From what we know, no satisfactory and fully general treatment currently exists in logic programming. If this is the case, an outside observer should understand why, for the obstacles presented by equality are clearly most formidable. Indeed, although we are very partial to the treatment given to equality by the use of the
818
Collected Works of Larry Wos
inference rule paramodulation, we openly recognize that this inference rule does not—by itself—solve all of the problems that accompany a natural treatment of equality. As a result, we are still actively searching for ever-more powerful strategies to control the application of paramodulation. In contrast to using paramodulation—to study formal semantics—logic pro gramming has considered building equality into unification [8], more or less in the style of E-resolution [20]. Such an approach, which goes even further than using associative/commutative unification, has actually been tried in automated theorem proving, and the practical results are very disappointing. A number of researchers in logic programming would in fact have predicted such an outcome, believing that building equality into unification has little practical value. Given these observations, we conjecture that logic programming—to fulfill its potential—must address equality directly and in its full generality, either by using a form of paramodulation or by some other means. Among the other noteworthy differences is the absence of the occurs check in most of logic programming in contrast to its constant presence in automated theorem proving. Yes, we do understand and accept that its absence contributes in an important way to the excellent speed that is offered, but offering the option—not to be confused with requirement—of using the occurs check seems to merit serious consideration. Other differences worth mentioning focus on the use, in automated theorem proving, of demodulation to produce canonical forms for information and the use of subsumption to remove information captured by more powerful statements. Of course, neither of these procedures is relevant when no new information is retained. Finally, in the strictest sense—with the exceptions concerning deductive databases, expert systems, and limited aspects of theorem proving—logic pro gramming is a programming language, designed to efficiently execute well-tuned algorithms, especially those in which logical reasoning plays an important role. In contrast, an automated theorem-proving program is a collection of procedures that, taken together, form a reasoning system designed to attack problems for which one does not know of an effective algorithm to apply. Unfortunately, the danger exists for confusing the two, logic programming and automated theorem proving. In particular, one should not attempt to take a shortcut to producing a system with the needed power offered by some theorem-proving programs—a shortcut of the form in which a small modification is made to logic programming, or one inference rule is adjoined. After all, if one considers how impressively mathematicians and logicians apply logical reasoning to questions and problems, one should expect that no shortcut exists to producing a computer program that can compete with such powerful minds or that can be used to effectively assist such minds. For example—and we borrow from experiences as a poker player— simple strategies produce small results. Continuing with the analogy, if one's play is governed solely by the probabilities that can be found in the appropriate tables, then one will win at poker only if the other players are very weak. The
Automated Theorem Proving and Logic Programming
819
other players in the game of science—the open questions to answer and problems to solve—are not very weak; indeed, to win in a contest with them, heavy use of strategy—as well as other complex procedures—is required. In addition to our total conviction concerning the need to use strategy, we also strongly favor a computer-oriented approach to automated theorem proving—in contrast to a person-oriented approach that attempts, for example, to emulate some great mathematician. However, despite our comments that some—unfortunately—might consider negative, we are convinced that each of the two fields, logic programming and automated theorem proving, offers the other a great deal. Therefore, let us now turn to that topic, and to the symbiosis that could exist—and, in fact, that already does in part exist.
4
SYMBIOSIS: BENEFITS EACH FIELD OF FERS THE OTHER
As the titles of this article and section suggest, we conjecture that the two fields of automated theorem proving and logic programming, even more than complementing each other, offer each other various important features—to the point that a possible symbiosis exists. We shall be content with merely sampling what is possible, since we have made corresponding observations throughout this article. With regard to a general way in which logic programming complements au tomated theorem proving, there exist many problems with the property that certain aspects of an attack on them should be treated algorithmically, while other aspects cannot. For example, in program verification and, even more so, in Godel's finite axiomatization of set theory (see Chapter 6 of [34]), certain literals in various input and various deduced clauses have the property that they are shared. Of these literals, many correspond to conditions that must be checked routinely to see if they are satisfied. One promising approach to increasing the effectiveness of an automated theorem-proving program would have logic pro gramming address the removal of these literals in an algorithmic manner while the theorem-proving program itself applies the general, less focused reasoning to the remaining literals. As evidence that supports the feasibility of such an approach—although we in no way recommend the imitation of the way people solve problems—consideration of various proofs produced by a person (in con trast to those produced by a computer) suggests that some of what occurs is indeed algorithmic, where most of what occurs cannot be treated algorithmi cally. For an example of a more specific benefit logic programming offers to auto mated theorem proving—and here we draw on one of the implementation tech niques found in OTTER, our newest theorem-proving program—demodulation
820
Collected Works of Larry Wos
can be far less expensive in CPU time if, instead of the commonly used ap proach of applying substitutions and copying clauses, one replaces those two operations with the manipulation of pointers, as occurs in logic programming. For an example based on conjecture, various resolution-based linked inference rules might be implemented by compiling the linking clauses and nuclei in the way that logic programs are compiled; the result might indeed offer one or two orders of magnitude faster execution. For examples of using logic programming technology as the basis for automated theorem proving in general, one might study the work of Stickel [28] or the work of Plaisted [23]. With regard to possible benefits that automated theorem proving offers logic programming—and, as expected, we can and do say more on this topic, for this is our field of expertise—two main areas merit investigation. The first, the treat ment of equality, must be addressed in its fullest if logic programming is to fulfill the vision of its zealots, which in no way implies that this programming lan guage is anything but impressive. Obviously, equality plays such a vital role in so many questions and problems that a means must be found to more than adequately cope with the obstacles equality presents. Perhaps a study of how equality is treated in the clause language paradigm—specifically, the ways dis cussed in Sections 2.2.2 and 2.4—will provide a clue, or even provide the key. Our preference—as we have made abundantly clear—is to use the inference rule paramodulation. As evidence of its power, we cite our most recent successes in combinatory logic [19,36]. Paramodulation, in addition to generalizing the usual notion of equality substitution, also permits a program to reason deep within nested expressions directly. Although logic programming often appears reluctant to use nested expressions—except, of course, where the expressions can be treated algorithmically and where equality is avoided—if one wishes to attack open questions and hard problems, one must expect to encounter deeply nested expressions. For equational programming and for a combination of equational and logic programming, certain aspects of paramodulation have already been proposed [8]. The second area of automated theorem proving whose study might offer researchers in logic programming substantial reward is that concerning the use of various types of strategy. As discussed in Section 2.3, the set of support strategy can be used to restrict the reasoning to conclusions that are recursively traceable to the information chosen to support the entire investigation, and the weighting strategy can be used to direct reasoning by permitting the user to play an active advice-giving roie. In addition to other existing strategies that might be of use, perhaps researchers in logic programming can formulate new ones. If so, then researchers and implementors in automated theorem proving must examine the new results. In other words, although our treatment is perhaps too brief, strong evidence exists for the position that the two fields complement each other. Even further, strong evidence exists that—even more than at the implementation level—the two fields offer each other ideas to consider, enough ideas to suggest that sym-
Automated Theorem Proving and Logic Programming
821
biosis between automated theorem proving and logic programming does exist.
5
CONCLUSIONS, RECOMMENDATIONS— AND CHALLENGES
Before turning to our conclusions and recommendations—suspecting that most researchers enjoy challenges—we close on a high note by presenting the following questions for logic programming and also for automated theorem proving. Let the set P consist of the two combinators B and N which, respectively, satisfy the following two equations. &((Bx)y)z - x(yz)& &((Nx)y)z » ((xz)y)z& The first two challenge questions ask whether the set P satisfies the weak or the strong fixed point property. Definition. Where P is a given set of combinators, the weak fixed point ■property holds for P if and only if for all combinators x there exists a combinator y such that &y = xyfc, where y is expressed purely in terms of the combinators in P and the variable x. Definition. Where P is a given set of combinators, the strong fixed point property holds for P if and only if there exists a combinator y such that, for all combinators x, foyx = x{yx)k., where y is expressed purely in terms of combinators'in P. In clause form, we can use -EQUAL(y,a(f,y)) to deny that the weak fixed point property holds, and we can use -EQUAL(a(y,g(y)),a(g(y), a (y,g(y)))) to deny that the strong fixed point property holds, where / is a Skolem constant, and g is a Skolem function. Since we know the answers to these two questions (see [36]), and since one might prefer an open question to study, let us consider the set P* consisting of the two combinators B and 5, where &((Sx)y)z = (xz)(yz)&. The third and fourth challenge questions ask whether P* satisfies the weak or the strong fixed point property. Since we have kept our promise concerning challenges by giving four ques tions to consider—noting that many research questions focusing directly on automated theorem proving can be found in [34]—let us next turn to our view of the present and the future. We are more optimistic now than at any other
Collected Works of Larry Wos
822
time since 1963, when we first became interested in the automation of logical reasoning—the term automated reasoning was not introduced until seventeen years later. The advent of parallelism, the design of new theorem-proving pro grams such as OTTER, the occurrence of numerous advances in logic program ming and in automated theorem proving, all tell the same story. The future is indeed bright, and the opportunities to contribute in a significant way are greater than at any time in the history of either field. Therefore, we recommend that, although the amount of experimentation is substantially greater than it was even five years ago, far more experiments be conducted. We also recommend that researchers in logic programming strongly consider offering users some or all of the options we have discussed in this article, among which is the use of a variety of strategies, a built-in and practical treatment of equality, and access to requiring the occurs check. We even suggest that, since we wish to encourage the use of natural representation within the clause language paradigm, the restriction to Horn clauses be relaxed. Indeed, as we have been told by F. Pereira, such a relaxation would be of substantial value to those interested in language parsing and language translation. Obviously, we wish to encourage the corresponding difficult but potentially significant research focusing on the variety of topics discussed in this article, and—taking a big chance—we predict that many extensions of the type we have discussed will exist shortly. Of the various options discussed in this article, we note that the occurs check must be offered—or some other guarantee of the soundness of the reasoning be given—if logic programming is to be used as a deductive system. Although all researchers in logic programming are fully aware of the potential for drawing an unsound conclusion, we were startled at how easy it was to construct the following entertaining example illustrating the need for the occurs check. First, one is given the assertion that for all x there exists a y with x less than y. Then, unexpectedly, one is asked to prove that there exists an x such that for all y y is less than x. For the first of the two statements, one can use the clause LESSTHAN(x,f(x)) and for the second, when assumed false, one can use the clause -LESSTHAN(g(x),x) where / and g are appropriate Skolem functions. Given these two clauses—if the occurs check is ignored—a program will decide that a proof by contradiction has been found. Unfortunately, such a discovery proves that the existence of ever larger integers—which almost everyone accepts as true—implies the existence of a smallest integer, which, amazingly!, many people doubt. To close this section—and we are concerned that the observations we are about to repeat may disappoint or, worse, may annoy too many people—certain positions must be challenged, and challenged strongly. The most difficult for us to challenge—difficult because we have such great respect for some who hold
Automated Theorem Proving and Logic Programming
823
the position—concerns a particular paradigm for automated theorem proving. Succinctly stated, we conjecture that one cannot design and implement an au tomated theorem-proving program based on the current paradigms for logic programming, if that program is to be used to attack deep questions or hard problems. We are not being self-contradictory, for we do feel that one can prof itably borrow from logic programming. Our conjecture is based on twenty-five years of experimentation—we certainly would like to believe that we are not simply being old-fashioned—and on our conviction that strategy of a complex nature is required and that many clauses must be retained. We in fact more fully addressed this issue in Section 2.2.3, focusing on the need for clause retention and for the use of both demodulation and subsumption. The next position we must challenge is that which in effect asserts that small modifications or simple fixes will suffice to extend logic programming to a theorem-proving program that offers substantial power. The difficulty of in teresting questions from mathematics and logic makes it virtually impossible for such an easy and quick solution to work. Also—and here we pay appropri ate tribute to various system designers—Boyer and Moore, on the one hand, and Overbeek and company, on the other, have devoted and still devote many hundreds of hours to the consideration of implementing a very powerful theoremproving program. Rtsearchers of their caliber could not have overlooked such a simple solution to the problem of implementation. The third and final position we must challenge is that which implies that logic programming as it now stands offers sufficient power to attack deep questions and solve hard problems. Although we laud the achievements of this field, and although we expect to see far more impressive ones in the future, such a position is, in most cases, doomed to disappointment. After all, logic programming is primarily a programming language, and not a deep reasoning system. However—preferring that the preceding comments have not caused too many to simply cease reading—the two fields do complement each other, and each potentially offers the other a great deal. Among the offerings are certain im plementation techniques, a rather pleasing treatment of equality, various types of strategy, and far more. For those researchers who prefer a definite position concerning which field offers which the most—at least in our opinion —currently, automated theorem proving offers more to logic programming than conversely. More important than this comparison is the natural symbiosis that exists be tween the two fields and the pursuit of the common goal of an effective automa tion of logical reasoning.
REFERENCES 1. Bledsoe, W. W., and Bruell, P., A Man-Machine Theorem-proving System, Artificial Intelligence 5:51-72 (1974).
824
Collected Works of Larry Wos
2. Boyer, R.S., and Moore, J S., A Computational Logic, Academic, New York, 1979. 3. Boyer, R.S., and Moore, J S., Proof Checking the RSA Public Key Encryp tion Algorithm, American Mathematical Monthly 91,3:181-189 (1984). 4. Boyer, R.S., and Moore, J S., Program Verification, J. Automated Rea soning 1,1:17-23 (1985). 5. Butler, R., Lusk, E., McCune, W., and Overbeek, R., Paths to HighPerformance Automated Theorem Proving, in: J. Siekmann (ed.), Proceed ings of the Eighth Conference on Automated Deduction, Springer-Verlag Lecture Notes in Computer Science, Vol. 230, Springer-Verlag, New York, 1986. 6. Chisholm, G., Kljaich, J., Smith, B., and Wojcik, A., An Approach to the Verification of a Fault-tolerant, Computer-based Reactor Safety System— A Case Study Utilizing Automated Reasoning, NP-4924 and RP-2686-1 Final Report, Electric Power Research Institute, Palo Alto, California, 1986. 7. Chisholm, G.H., Kljaich, J., Smith, B.T., and Wojcik, A.S., Towards For mal Analysis of Ultra-reliable Computers—A Total Systems Approach, in: Proceedings of the Seventh Digital Avionics Systems Conference, AIAA/IEEE, 1986. 8. DeGroot, D. and Lindstrom, G. (eds.), Logic Programming: Functions, Relations, and Equations, Prentice-Hall, Englewood Cliffs, New Jersey, 1986. 9. Elcock, T.K., Absys: The First Logic Programming Language—A Ret rospective and Commentary, Technical Report 210, Dept. of Computer Science, University of Western Ontario, London, Ontario, 1988. 10. Good, D.I., The Proof of a Distributed System in Gypsy, Technical Report 30, Institute for Computing Science, University of Texas at Austin, Austin, Texas, 1982. 11. Igarashi, S., London, R.L., and Luckham, D.C., Automatic Program Veri fication I: A Logical Basis and Its Implementation, Report ISI/RR-73-11, Information Science Institute, University of Southern California, 1973. 12. Kljaich, J., Smith, B.T., and Wojcik, A.S., Formal Verification of Fault Tolerance Using Theorem-proving Techniques, IEEE Transactions on Com puters 38,3: 366-376 (1989).
Automated Theorem Proving and Logic Programming
825
13. Kljaich, J., Wojcik, A.S., and Smith, B.T., Formal Verification of Proper ties of Digital Systems Using an Automated Reasoning System, in: Pro ceedings of the Sixth Annual IEEE Phoenix Conference on Computers and Communications, IEEE, 1987. 14. Lukasiewicz, J., The Shortest Axiom of the Implicational Propositional Calculus, Proc. of the Royal Irish Academy 52A,3:25-33 (1948). 15. Lusk, E. and Overbeek, R., The Automated Reasoning System ITP, Tech nical Report ANL-84-27, Argonne National Laboratory, Argonne, Illinois, 1984. 16. Lusk, E. and Overbeek, R., Logic Machine Architecture Inference Mechanisms— Layer 2 User Reference Manual Release 2.0, Technical Report ANL-82-84, Rev. 1, Argonne National Laboratory, Argonne, Illinois, 1984. 17. McCharen, J., Overbeek, R., and Wos, L., Complexity and Related En hancements for Automated Theorem-proving Programs, Computers and Mathematics with Applications 2:1-16 (1976). 18. McCune, W., OTTER User's Guide, Technical Report ANL-88-44, Ar gonne National Laboratory, Argonne, Illinois, 1989. 19. McCune, W. and Wos, L., A Case Study in Automated Theorem Proving: Finding Sages in Combinatory Logic, J. Automated Reasoning 3,1:91-108 (1987). 20. Morris, E., E-resolution: An Extension of Resolution to Include the Equal ity Relation, in: Proceedings of the International Joint Conference on Ar tificial Intelligence, 1969. 21. Pereira, F., Private Communication (1984). 22. Pereira, F., Logic Programming, J. Automated Reasoning 1,1:9-13 (1985). 23. Plaisted, D.A., Non-Horn Clause Logic Programming without Contrapositives, J. Automated Reasoning 4,3:287-325 (1988). 24. Robinson, G. and Wos, L., Paramodulation and Theorem-proving in FirstOrder Theories with Equality, in: B. Meltzer and D. Michie (eds.), Machine Intelligence 4, Edinburgh U.P., Edinburgh, 1969. 25. Robinson, J., A Machine-oriented Logic Based on the Resolution Principle, J. ACM 12:23 -41 (1965). 26. Robinson, J., Automatic Deduction with Hyper-Resolution, International J. Computer Mathematics 1:227-234 (1965).
826
Collected Works of Larry Wos
27. Smith, B., Reference Manual for the Environmental Theorem Prover, An Incarnation of AURA, Technical Report ANL-88-2, Argonne National Laboratory, Argonne, Illinois, 1988. 28. Stickel, M., A Prolog Technology Theorem Prover, J. Automated Reason ing 4,4:353-380 (1988). 29. Turner, D.A., A New Implementation Technique for Applicative Lan guages, Software—Practice and Experience 9:31-49 (1979). 30. Winker, S., Generation and Verification of Finite Models and Counterex amples Using an Automated Theorem Prover Answering Two Open Ques tions, J. A CM 29:273-284 (1982). 31. Winker, S. and Wos, L., Procedure Implementation through Demodulation and Related Tricks, in: D. W. Loveland (ed.), Proceedings of the Sixth Conference on Automated Deduction, Lecture Notes in Computer Science, Vol. 138, Springer-Verlag, New York, 1982. 32. Winker, S., Wos, L., and Lusk, E., Semigroups, Antiautomorphisms, and Involutions: A Computer Solution to an Open Problem, I, Mathematics of Computation 37:533-545 (1981). 33. Wojcik, A., Formal Design Verification of Digital Systems, in: Proceedings of the Twentieth Design Automation Conference, IEEE, 1983. 34. Wos, L., Automated Reasoning: 33 Basic Research Problems, PrenticeHall, Englewood Cliffs, New Jersey, 1987. 35. Wos, L. and McCune, W., Negative Paramodulation, in: J. Siekmann (ed.), Proceedings of the Eighth International Conference on Automated Deduction, Springer- Verlag Lecture Notes in Computer Science, Vol. 230, Springer-Verlag, New York, 1986. 36. Wos, L. and McCune, W.W., Searching for Fixed Point Combinators by Using Automated Theorem Proving: A Preliminary Report, Technical Re port ANL-88-10, Argonne National Laboratory, Argonne, Illinois, 1988. 37. Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: In troduction and Applications, Prentice-Hall, Englewood Cliffs, New Jersey, 1984. 38. Wos, L. and Robinson, G., Maximal Models and Refutation Completeness: Semidecision Procedures in Automatic Theorem Proving, in: W. Boone, F. Cannonito, and R. Lyndon (eds.), Word Problems: Decision Problems and the Burnside Problem in Group Theory, North-Holland, New York, 1973.
Automated Theorem Proving and Logic
Programming
827
39. Wos, L., Robinson, G., and Carson, D., Efficiency and Completeness of the Set of Support Strategy in Theorem Proving, J. ACM 12:536-541 (1965). 40. Wos, L., Robinson, G., Carson, D., and Shalla, L., T h e Concept of De modulation in Theorem Proving, J. ACM 14:698-709 (1967). 41. Wos, L., Veroff, R., Smith, B., and McCune, W., The Linked Inference Principle, II: The User's Viewpoint, in: R. E. Shostak (ed.), Proceedings of the Seventh International Conference on Automated Deduction, Lecture Notes in Computer Science, Vol. 170, Springer-Verlag, New York, 1984. 42. Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., A New Use of an Automated Reasoning Assistant: Open Questions in Kquivalential Calculus and the Study of Infinite Domains, Artificial Intelligence 22:303356 (1984).
Subsumption, a Sometimes Undervalued Procedure Larry Wos, Ross Overbeek, and Ewing Lusk
1
Motivation and Background
Rarely do circumstances permit one to simultaneously acknowledge a colleague's contributions, evaluate the relative importance of the basic elements of a field, and compare various paradigms for attacking a class of problems. However, through a fortuitous set of occurrences, we have that opportunity. We shall, therefore, take full advantage of the situation by presenting an evaluation of J. A. Robinson's contribution of subsumption [RobinsonJ65a] to the field of automated reasoning. We shall also take the opportunity to compare various approaches to the automation of reasoning, citing evidence to support the position that those paradigms that do not rely on the use of subsumption suffer a severe disadvan tage when compared to those paradigms that do. The evidence, which we cite in section 4, is gleaned from a number of experiments that focus on a set of the orems of increasing difficulty. Even though we sprinkle this article throughout with observations some of which may be considered philosophy, we recognize that data of the type we present in section 4 is the final and ultimate test. In particular, when measuring the power of a given paradigm or a given auto mated reasoning program, the most important question concerns the likelihood of success when one attempts to obtain a proof or complete an assignment. The second most important question focuses on the ease, usually measured in CPU time, of obtaining the proof or completing the assignment. In addition to establishing the vital nature of subsumption—recognizing the danger of our intention—we intend in this article to correct history for some, and perhaps for many. Specifically, although Robinson is best known for his formulation of binary resolution [RobinsonJ65a] and next known for his introduction of hyperresolution [RobinsonJ65b], his contribution of subsumption [RobinsonJ65a] proves to be, in the context of automated reasoning circa 1989, his most important. We address this topic more fully in section 2. Of the various arguments one might give to substantiate such a—in the minds of some—radical claim concerning the relative importance of Robinson's contributions, the simplest rests on the fact that no substitute for subsump tion exists that offers nearly comparable power, which contrasts with the fact Reprinted from Festschrift for J. A. Robinson, ed. J.-L. Lassez and Gordon Plotkin, MIT Press, Cambridge, Mass., pp. 3-40 (1991). Published with permission of the MIT Press, Cambridge, Mass., 1991.
830
Collected Works of Larry Wos
that a number of inference rules now exist that offer far more power than does either binary resolution or hyperresolution. Not only does the use of subsumption purge the database of information that is logically weaker than existing information and information that is therefore not needed (because of the way unification works), even more important, the use of subsumption prevents the spawning of descendants (immediate and later) of the unneeded information. Granted, Robinson's formulation of binary resolution and hyperresolution laid the foundation for much research focusing on inference rules, and he deserves substantial credit in that regard. But where would automated reasoning pro grams be now (in 1989) were it not for subsumption? In this article we shall show why the correct answer is that such programs would be essentially nowhere, and, in particular, we strongly suggest that approaches that do not take advantage of subsumption suffer accordingly. Before turning (in sections 2 through 4) to the meat of this article, let us first provide in this section the basis for a deep appreciation of the impor tance of subsumption. We note that, although we frequently focus on clauses as the form in which information is retained, comparable remarks apply for other paradigms for the automation of reasoning. To complete one's appreciation for the importance of subsumption, we discuss in section 2 subsumption in relation to the size of deduction steps, and then in section 3 we give some history to set the stage for the experimental evidence we present in section 4. In addition to that evidence, we shall also offer (in Section 4) certain challenges to those researchers interested in testing the power of their programs and also to those researchers who prefer a paradigm (for the automation of reasoning) based on logic programming. A full appreciation of the importance of subsumption begins with the ob servation that when one is relying on the assistance of an automated reasoning program, one frequently encounters a common annoyance, an occurrence that can waste a considerable amount of computer time; specifically, a reasoning pro gram can deduce the same piece of information many, many times. A case in point is a lemma from lattice theory, a lemma called SAM's lemma, which is an acronym for "semiautomated mathematics" (see test problem 12, section 6.4.1 of [Wos87]). When a successful attempt was made to prove that lemma using hyperresolution and a notation that deemphasizes the role of equality, more than 6,000 clauses identical to retained clauses were generated and then dis carded. (This lemma, discovered by Guard's program [Guard69], is considered to be the first example of a contribution to mathematics made by a reasoning program; later contributions include the work on complete sets of reductions begun in the middle 1970s and the studies that led to answering specific open questions from mathematics [Chou88, Winker79, Winker81, Wos85] and from logic [Wos83, Wos84b, Wos88].) The deduction of information that is already known certainly produces no satisfaction. Perhaps less annoying but in most cases more likely—although not in the case of the cited example focusing on SAM's lemma—is the deduction of a
Subsumption, a Sometimes Undervalued Procedure
831
trivial instance of some already-deduced fact. For example, far too frequently, 0 + a = a, 0 + 6 = 6, and the like are deduced and then discarded as instances of the already-present fact that 0 + x = x. Indeed, during the successful attempt to prove SAM's lemma just cited, almost 5,000 additional clauses were discarded because they were proper instances of clauses already retained. Both classes of information—identical copies and proper instances of retained information—are classified as redundant information (see section 2.3 of [Wos87]). Incidentally, for those who might be curious about why our figures concerning the number of clauses that are subsumed are higher than various figures pub lished elsewhere, the explanation rests with the omission in earlier experiments of closure (totality) axioms. For example, in group theory when the chosen nota tion is the so-called P formulation, the axiom (in clause form) P(x, y,prod(x, y)), sometimes referred to as the closure axiom, is often omitted from the presen tation of a problem to an automated reasoning program. Because one cannot in general know a priori which axioms are required for a proof of a given the orem, no justification exists—at least in our view—for the omission of axioms that are independent of the others that are included, and closure axioms are usually independent of the other axioms for a theory. Removal of the axiom P(x,y,prod(x, y)) from the P formulation of the axioms for group theory—a practice often encountered—coupled with the addition of clauses used to at tempt to prove the commutator theorem (see section 4) in fact produces a satisfiable set of clauses. In other words, without the closure axiom, one cannot prove the commutator theorem (in the P formulation). Therefore, we find the practice of omitting the appropriate closure axioms without an excellent defense to be unjustified and often to produce misleading information. In particular, one can be misled about the possible provability of some given result. Even worse, one can be misled about the power of some chosen automated reasoning program. If a method could be found to discourage deducing redundant information— for more reasons than the fact that subsumption would come into play far less— the effectiveness of automated reasoning programs would be sharply enhanced. The enhancement would not result directly from the CPU time saved by gen erating far fewer clauses, for clause generation in itself is not that expensive. Instead, the enhancement would result from sharply reducing the CPU time consumed by subsumption, demodulation, and the like, each applied to a clause after it is generated. One of the most appealing approaches to saving the CPU time consumed by processing redundant information focuses on formulating an appropriate strategy to sharply curtail, if not actually eliminate, the generation of such clauses (see research problem 6 of [Wos87]). Until such a strategy is found—in view of the cited results from the experi ment with SAM's Lemma and from the experiments we shall present in section 4, which establish that some means must be employed to avoid wasting a great dpal of CPU time—an automated reasoning program requires some means to cdpe with redundant information. Neither of the following two approaches—both of which obviously differ sharply from the use of subsumption—is remotely satis-
832
Collected Works of Larry Wos
factory. In one approach, the program is simply instructed to retain the redun dant information—the duplicate clauses and those that are instances of other clauses—in the database of information. In the other approach, essentially no new information is retained. In other words, the program considers the assign ment in the spirit of logic programming. Although logic programming is clearly a remarkable aid for solving problems and answering questions of a certain type—those that are algorithmic in character—without the sophisticated use of strategy and the use of procedures such as subsumption and demodulation, in most cases this powerful programming language does not offer the needed char acteristics for proving even moderately difficult theorems from mathematics. To see what can go wrong with the first of the two given approaches, one can imagine instructing an automated reasoning program to solve a problem in which equality is present, where the chosen program simply retains each item of deduced information even if redundant. With such an approach to coping with redundant information, a reasoning program can fail to complete assignments that are quite trivial, where the failure is due directly to the extra information that serves no real purpose. At the most obvious level, the extra and unneeded information—for example, a = a, product(6, c) — product(6, c), and inverse(c) = inverse(c)—can easily be chosen as the focus of attention, sending the pro gram on one fruitless path after another. In contrast, by using subsumption, the clause equivalents of such unneeded information would be purged, for the clause EQUAL(i, x) for reflexivity of equality would typically be present, and that clause would subsume the unneeded clauses. As a consequence, the program would be prevented from even considering the corresponding fruitless paths. If the second approach to coping with redundant information is adopted— that of retaining no intermediate information—a quite different hazard is en countered. In particular, failure to retain information (such as that correspond ing to powerful lemmas) can cause a program to pursue a vast number of worth less paths in search of the key result. For example, if the program that does not retain new information, and hence does not use subsumption, in effect deduces that inverse(inverse(a)) = a or a clause containing the equivalent literal, then that program is free to pursue the corresponding path in search of potentially valuable results. In contrast, with subsumption, the deduction and retention of the lemma asserting that the inverse of the inverse of x is equal to x would result in the immediate purging of those clauses that lead to the type of fruitless path under discussion. An example of the approach that retains no new information—and one that is currently receiving substantial attention—relies on a paradigm based on logic programming. With such a paradigm—although the corresponding analysis is not quite so straightforward, in part because lemmas that take the form of a positive unit clause are not encountered—the lack of clause retention and the in accessibility to subsumption can result in the pursuit of many fruitless paths. For example, an attempt to solve the subgoal -P(prod(x, y),prod(inv(j/),inv(x)),e) may result in attempting to solve a second subgoal that is an identical copy of
Subsumption, a Sometimes Undervalued Procedure
833
the first subgoal or a proper instance of that subgoal. When such occurs, the secondary task should be abandoned, somewhat in the spirit of subsumption. Without clause retention and the use of subsumption, a paradigm based on logic programming is subject to pursuing a large number of paths of the type just exemplified (discussed in more detail in section 2.3). In other words, one cannot simply bypass, without cost, the need to cope with redundant information. (For a rather detailed discussion of this topic, see section 2.2.3 of [Wos89]). Regardless of how one approaches the automation of reasoning, when at tempting to answer a deep question or solve a hard problem, some way must exist for coping with the myriad conclusions that will inevitably be drawn. Therefore, an automated reasoning program should be given the capacity to retain new information, such as general lemmas that it has found, and yet be in a position to purge its database of information that is captured by other bits of information already present. Robinson's contribution of subsumption—although, just at the surface, a simple and obvious notion—is the best solution for purging a database of un wanted information. In addition, discarding redundant information meshes beau tifully with inference rules that enable an automated reasoning program to focus directly on statements involving universally quantified variables with the objec tive of deducing, where possible, statements in which such variables occur. By purging information captured by existing information, an automated reasoning program cannot be led astray by the captured information; more important, it cannot be led astray by all of the descendants—immediate and later—of such information. In short, as we shall show throughout this article, Robinson's con tribution of subsumption merits the highest accolades, especially if viewed in the context of automated reasoning circa 1989, for the use of subsumption is essential for the study of even moderately difficult questions from mathematics and logic. One might immediately point out that subsumption can be very costly. In deed, many experiments with different reasoning programs have shown this cost can be substantial—until now. William McCune, with his formulation of dis crimination trees [McCune89], has reduced the cost of forward subsumption—at least with regard to unit clauses—to a far less significant figure. For example, in an experiment focusing on the formula XHK, XHK= e(i, e(e(y, z), e(e(x, z),y))), a formula that provides a complete axiomatization for equivalential calculus, the use of discrimination trees by McCune's program OTTER [McCune90] reduced the time used by forward subsumption by a factor of 95. Even more important than the obvious improvement in program performance is the second-order ef fect on one's experimentation and research. In particular, by completing each of a number of experiments in less than 10 CPU minutes, in contrast to the more than 4 CPU hours that each would have required, we succeeded in formulating a systematic approach for the pertinent study, an approach that might easily have eluded us were it not for the dramatically improved turnaround. Soon—or so it appears—the cost for back subsumption will also be reduced correspondingly
834
Collected Works of Larry Wos
by relying on an extension of McCune's use of discrimination trees. In other words, one of the main objections, and perhaps the only serious one, to the use of subsumption will soon be sharply reduced in importance. Why then—as dis cussed in research problem 6 of [Wos87]—is it still important to find a strategy for avoiding or sharply reducing the generation of redundant information? The answer rests with the various processes applied to each newly generated clause or newly drawn conclusion. Among such processes are those for canonicalization (demodulation [Wos67]), for evaluating significance (weighting [McCharen76]), for index building, and for information integration. Those additional processes, which should be applied to newly generated clauses because their use is more beneficial than their cost, are nevertheless expensive. In other words, although clause generation is not in itself particularly expensive, and although subsumption—if all goes as planned—may become relatively inexpensive, auto mated reasoning programs would be considerably more efficient if the generation of redundant information were substantially reduced. The remarkable efficiency that many reasoning programs already exhibit—as we shall discuss throughout the remainder of this article—rests in part with the use of subsumption.
2
Subsumption in Its Relation to the Size and Nature of the Deduction Step
At this point we focus on the need for subsumption in the context of different types of reasoning and different approaches to the automation of reasoning. At one extreme, a program can attempt to imitate the manner in which people frequently reason, for example, relying heavily on instantiation (see chapter 4 of [Wos87]). At the other extreme, a program can reason in a manner that a person might well find unnatural or even unpleasant, for example, relying heavily on paramodulation [RobinsonG69, Wos73, Wos87] for treating equality as if it is "understood". Prom a different perspective, at one end of the reasoning spectrum, a program can rely on an inference rule such as binary resolution, which takes deduction steps of essentially an identical size, and rather small ones at that. Near the other end of the spectrum is linked inference [Wos84a], which gives the user the option of setting the size of the deduction step and the option of using semantic criteria. And at the end of the spectrum is an approach based on logic programming [Stickel88], which entirely avoids the retention of new information. Depending on the particular approach to the automation of reasoning, the direct need for and the obvious value of subsumption vary widely. For an example of an approach for which subsumption appears to be irrelevant, we need only look to automated reasoning programs based on emulating logic programming. Since such approaches typically retain no information, subsumption plays no (direct) role; in section 2.3 we shall see that this issue is cloudier than it first
Subsumption, a Sometimes Undervalued Procedure
835
appears. However, in those cases where subsumption appears to be of little or no value, one discovers that such approaches often lack the needed power for attacking deep questions and hard problems, especially if the questions and problems come from mathematics or logic. To develop this point and related points more fully and to amplify our com ment in section 1 that when viewed in the context of automated reasoning circa 1989, Robinson's contribution of subsumption is far more important than either his contribution of binary resolution or his contribution of hyperresolution, we pose the following six questions, which we answer in this article. 1. Why not design and implement an automated reasoning program whose rea soning imitates a person's? For example, what obstacles are presented by the use of instantiation? After all, in the classical approach to artificial intelligence and in certain efforts currently advocated, one finds an emphasis on the emulation of people for the reasoning aspects of problem solving. 2. Why not rely heavily on binary resolution? After all, experiments and intu ition each suggest that binary resolution is far superior to instantiation. 3. In contrast to using binary resolution with the potential of retaining a great deal of information, why not rely on an approach based on logic programming— an approach currently receiving substantial attention—and have the reasoning program retain no new information? 4. What are the strengths and weaknesses of hyperresolution, the inference rule introduced by Robinson [RobinsonJ65b] with the object of offering substantially more power than binary resolution does? 5. Is there some point on the reasoning spectrum between retaining too much information (as often occurs when the reasoning program relies heavily on using binary resolution) and retaining no information (as occurs with an approach based on logic programming) where the user of the reasoning program can play an active role in deciding what types of information to retain and what size of deduction step to take? 6. Finally, one of the most important questions, Why do we consider subsump tion to be Robinson's most important contribution to automated reasoning circa 1989? Let us consider and answer the six questions in the order given. Then let us turn (in section 3) to some history and comparative analyses to complete the stage setting for presenting (in section 4) the results of our experiments concerning the value of, and even further the need for, subsumption.
836
2.1
Collected Works ofL&rry Wos
Person-Oriented Reasoning
Our treatment of the first question—that concerning the weakness of relying mainly on person-oriented reasoning—will clearly be in part philosophical. Nev ertheless, because automated reasoning is already receiving rapidly growing in terest and soon will offer substantial power and wide applicability, we take this opportunity to address the subject of person-oriented versus computer-oriented reasoning. By discussing this dichotomy, which will entail some elementary ob servations, we can take a brief but hard look at one extreme point on the spec trum for the automation of reasoning. This discussion will also provide some of the material that shows why we prefer the paradigm on which we rely for our experiments, and it will also provide the basis for one of the many reasons we give for the indispensability of subsumption. Our discussion is in part motivated by the desire to briefly focus on the dif ference in emphasis found in classical artificial intelligence versus that found in automated reasoning. We also wish to provide some hints concerning the weak ness resident in approaches—designed to solve the deep and difficult problem of how to effectively automate reasoning—that are based on an inexpensive or quick or simply appealing solution. We provide further hints in this regard when we give our answer to the third question, that focusing on the use of a paradigm based on logic programming. Finally, our discussion is also motivated by the desire to pay tribute to Robinson for his emphasis on the use of universally quantified variables and on the corresponding use of unification. Before we give our answer to the question under discussion, let us make clear that, although we are not in favor of the approach taken in classical artificial in telligence, we nevertheless are convinced that a study of how people reason may indeed lead to the discovery of useful clues to increasing the effectiveness of au tomated reasoning programs. The error, in our view, is to mistake the discovery of such clues for a strong suggestion that automated reasoning programs are best designed if they emulate a person's reasoning. A far more promising course is to use those clues—and any others one may find—to suggest computer-oriented methods of reasoning, possibly including methods that capture and generalize certain aspects of person-oriented reasoning. Therefore, we heartily endorse a wide range of studies, including the study of person-oriented reasoning; the use ful clues are clearly hard to find, and one should look for clues wherever one's intuition dictates. The simplest answer to the first question—and a partial explanation of why we do not endorse the approach taken in classical artificial intelligence—is that people and computers are totally different entities, and, to us, no obvious justi fication exists for attempting to imitate, in contrast to studying, a person's rea soning. Given our view, no surprise will be produced by our lack of endorsement for the classical approach to artificial intelligence with its emphasis on emulation of methods that people employ. Instead, although the better mathematicians— Hilbert, Godel, and von Neumann, for example—are justly revered for the power
Subsumption, a Sometimes Undervaiued Procedure
837
of their minds, we prefer to concentrate on designing and implementing an au tomated reasoning program that complements a person. In contrast, if one were to focus on designing a program relying on person-oriented reasoning, then the inference rule instantiation might come heavily into play. With some elementary examples, let us quickly illustrate two weaknesses of that inference rule. The first and obvious weakness of using instantiation rests with its fecun dity. In particular, compared to binary resolution and the reliance on universally quantified variables and unification, a program using instantiation and syllogis tic reasoning at the ground level can deduce an inordinately large number of conclusions. For example, from "if x is a mother then x is female" and "if x is female then x is not male", the use of binary resolution yields the equivalent of the obvious fact that "if x is a mother then x is not male". In contrast, with instantiation, an automated reasoning program can deduce myriad instances of each of the two given facts and also—with ground-level syllogistic reasoning— of the given obvious conclusion, an instance for every person mentioned in the problem under consideration and also for every relative of those people, and more. How marvelous of Robinson to change the emphasis in 1963 from the consideration of ground clauses to the consideration of clauses in which univer sally quantified variables are present. Even further, how significant to move the focus—by emphasizing the use of unification—to the deduction of clauses con taining variables of the same type. With regard to the given example, what an achievement for Robinson—to formulate the inference rule binary resolution to deduce a single conclusion that captures all of those conclusions that would oth erwise result from using instantiation coupled with syllogistic reasoning. Even further in the direction of capturing unneeded information, but with the ob jective of discarding such, we have Robinson's more significant contribution of subsumption for which no substitute currently exists. Of course, binary resolution usually does not go far enough—does not offer enough deductive power—which is why Robinson later formulated hyperresolution. On the other hand, as we discuss in section 2.3, one can go too far, for example, by relying on one of the dialects of logic programming in which no new information is retained. The second weakness of relying on instantiation rests with the lack of an ef fective strategy for choosing instances that are fairly likely to play a useful role. For a simple example, if asked to prove commutativity for groups in which the square of every element x is the identity e, the mathematician wisely chooses the instance (yz)(yz) = e on which to base a proof. In contrast to the given example of the mathematician's ability, currently no strategy exists that enables an auto mated reasoning program to choose—with sufficient wisdom—from among the myriad instances presented by even fairly difficult theorems. But, for controlling binary resolution and the other inference rules commonly used in many auto mated reasoning programs, fairly powerful strategies are frequently employed, which makes the use of such inference rules far more effective than the use of instantiation. The need for strategy that restricts and for strategy that directs a
838
Collected Works of Larry Wos
program's reasoning can hardly be doubted if one attempts to prove even mod erately difficult theorems from mathematics or logic. However, for those who are skeptical of this need, we offer the challenge of trying to obtain—without using a restriction strategy such as the set of support strategy [Wos65] or a direction strategy such as weighting [McCharen76]—proofs of the theorems we cite in Section 4. If that challenge is accepted by thoroughly testing the power of reasoning programs that rely on a paradigm based on logic programming, we conjecture that one will discover that such programs are not ordinarily adequate for attacking deep questions.
2.2
Binary Resolution in 1989
In addition to answering the second of the six questions posed earlier—that con cerning reasons for not relying heavily on binary resolution—the material in this section supports one of the key aspects of our position that Robinson's contri bution of subsumption is his most important, at least for automated reasoning of today. Specifically, in this section we briefly focus on why binary resolution is no longer Robinson's most significant contribution. Robinson's introduction of binary resolution in its full generality in the summer of 1963 at Argonne National Laboratory marked a singular advance in automated reasoning, then known as mechanical theorem proving. Indeed, Robinson's emphasis on the use of unification played—and still plays—a key role in the entire history and rapid advance of automated reasoning. We note that, in contrast to the published version of binary resolution [RobinsonJ65a], Robinson—when he first presented the rule in its full generality at Argonne— also introduced the inference rule factoring [see Chapter 4 of Wos87]; we return to this topic shortly. Binary resolution, which nicely captures and generalizes both modus ponens and syllogism, provides an excellent example of the type of reasoning that emphasizes the importance of drawing general conclusions, extends the type of reasoning people sometimes employ, and adapts well to computers. Paramodulation, which (by generalizing equality substitution) also extends the type of reasoning people sometimes employ, provides an even more striking example of computer-oriented reasoning that is not person-oriented—a type of reasoning, in fact, that a person ordinarily finds unnatural. Unfortunately, Robinson's pub lished version of binary resolution—in contrast to the version that he presented in the summer of 1963 and that appeared earlier in a preprint—hides the need for the inference rule factoring, at least from the viewpoint of implementation. In particular, the published version of binary resolution permits more than one literal in one clause to be unified with more than one literal in the other clause under consideration. In contrast, in the preprint, binary resolution was required to focus on exactly one literal in each of the two chosen clauses, and factoring was defined to fill the void. To illustrate how the published version in effect hides the need for factoring,
Subsumption, a Sometimes Undervalued Procedure
839
we need only consider the canonical example consisting of the following two clauses. P(x) I P(y) -P(w) I -P(z) If one restricts the reasoning to applying only the version of binary resolution that appeared in the preprint—which is the version found in the majority of automated reasoning programs that offer the rule—then no proof can be found starting with the given set of two clauses even though that set is unsatisfiable. However, as is well known, if one is allowed the use of factoring, then a proof is quickly obtained, for factoring applied to the first clause yields the clause P(a;), whose use leads, in one binary resolution step, to unit conflict. On the other hand, if one revisits the given set of two clauses but restricts the reasoning to the version of binary resolution in which more than one literal can be unified in each of the two chosen clauses, then one can obviously unify both literals in the first clause with both literals in the second to obtain the empty clause. Such an action, however, in effect relies on factoring each of the two clauses in order to unify two literals in one with two literals in the other. The given example is in fact representative of what in effect occurs if one implements the published version of binary resolution. As is obvious, the analysis does not involve, in any way, the distinction of proof termination based on unit conflict versus that based on the use of the empty clause. Regardless of which definition of binary resolution one prefers, the important point about this inference rule is that its use enables a reasoning program to reason directly from statements containing universally quantified variables to yield (depending on the nature of the corresponding unification) statements containing such variables. Although this inference rule provided an excellent beginning for the field and is still useful in certain situations, in the context of automated reasoning circa 1989, the rule is far less useful than other available inference rules. For example, UR-resolution [McCharen76] with its emphasis on unit clauses and hyperresolution [RobinsonJ65b], with its emphasis on positive clauses, are ordinarily far more useful and far more powerful. Nevertheless, just as the electron was thought to be a basic particle of physics, similarly early in the history of the field one might have thought that binary resolution would be the basis for automated reasoning. Although not the case, binary resolution can be thought to be a basic element of which many, but not all, inference rules are composed. Of course, even more than binary resolution, the common strand throughout automated reasoning is the use of unification. The reason that binary resolution is no longer so useful rests with the size of the deduction step a reasoning program makes when this rule is successfully applied. Simply stated, the step is almost always too small—too small in the sense that the corresponding information is only a fragment of the conclusion one is seeking. For example, if stated in ordinary linguistic terms, the deduction of
840
Collected Works of Larry Wos
if (Q and R) t h e n S from P and if (P and Q and i?) t h e n S is typically a fragment of the desired conclusion S. Indeed, as the experienced researcher in automated reasoning recognizes, the given example is in effect an example of a hyperresolution step and one of the three binary resolution steps that one can take to produce the corresponding conclusion. Not to be unkind but rather to give some insight, in many cases hyperres olution is to binary resolution as binary resolution is to instantiation: binary resolution simply lacks the power needed to reason efficiently in the context of most applications today. It is in part this observation that causes us to take the position that binary resolution is no longer Robinson's most significant contri bution to automated reasoning.
2.3
The Logic-Programming Paradigm for the Automation of Reasoning
Before resuming our primary case for the fact that subsumption is the most significant contribution made by Robinson—and a contribution that is indeed outstanding—we turn to the third question, that concerning the reasons for not relying on an approach based on logic programming. We must address this issue with some delicacy, for we have high regard for some of the researchers who advocate such an approach. Nevertheless, because this paradigm is currently re ceiving substantial interest [Stickel88, Plaisted88], because good science requires that researchers with evidence and experience speak openly about the strengths and weaknesses of new trends, and because subsumption is not obviously rel evant for this paradigm, we devote a separate subsection to the value of logic programming to the automation of reasoning. In our view, if one wishes to attack deep questions and hard problems— especially if the questions come from mathematics or logic—then reliance on a paradigm heavily based on logic programming is an unwise choice. In contrast, for problems in which one has an algorithm that quickly homes in on a solution rather than searching for the needed information, logic programming does indeed offer excellent performance. Unfortunately, for most of mathematics and logic, one does not have the luxury of such an algorithm. Instead, one is forced to search—preferably with the aid of a sophisticated strategy—a potentially large space of conclusions. Indeed, it is the size of this search space that causes W. W. Bledsoe [Bledsoe87] to assert that too many of the questions in mathematics will still be out of reach if all that is changed is access to a computer 1,000 times faster than the fastest currently available—a view we share. Perhaps part of the appeal of a paradigm based on logic programming rests with its clean lines. For example, with such a paradigm, no effort is required to implement and no CPU cycles are required to execute subsumption (to purge re dundant information), demodulation (to canonicalize information), and weight-
Subsumption, a Sometimes Undervalued Procedure
841
ing (to choose where next to focus the program's attention). When all is equal, the cleaner and simpler the design of a program the better. Unfortunately, for automated reasoning, all is not equal. The nature of deep questions and hard problems whose answers or solutions depend on logical reasoning typically requires—for their answers or solutions—the use of subsumption, demodulation, and strategy of various types. Since this article focuses heavily on subsumption, let us briefly discuss an automated reasoning program's need for subsumption when the program is as sisting in a serious study of mathematics or logic. Simultaneously, let us show why the avoidance of subsumption by programs relying on a paradigm based on logic programming materially weakens their effectiveness. We begin our dis cussion with the case in which the automated reasoning program retains no intermediate clauses—in the style of logic programming. On the surface, one might say that the subject of subsumption is irrele vant for such a program, but such a position is flawed. In particular, if such a program—while considering, for example, a theorem from elementary group theory—attempts to solve -P(inv(prod(inv(a;),2/)),inv(rE),inv(j/)) as a subgoal, the program may later attempt to solve -P(inv(prod(inv(a),6)),inv(a),inv(6)) as another subgoal, then solve -P(inv(prod(inv(c),d)),inv(c),inv(d)) as a third subgoal, and then other numerous instances of the more general subgoal. Potentially, what a waste of considerable computer time, even to the point of possibly preventing completion of the given assignment! Indeed, as our experiments cited in section 4 show, without subsumption, our programs are subject to a similar disaster. With subsumption, on the other hand, the retention of intermediate clauses would enable an automated reasoning program based on logic programming to avoid pursuing so many fruitless paths. The efficiency would be increased even more dramatically if demodulation were also employed. Recognizing the value of retaining intermediate clauses, some reasoning pro grams employ a modification of the paradigm based on (pure) logic program ming. For such programs, subsumption—as shown by our experiments—plays a vital role by discarding redundant information, copies of and instances of ex isting clauses. However, if a program does not also use demodulation to rewrite information into a desired canonical form, then a class of information—related to what we are calling redundant—is encountered. For example, again borrowing from group theory, once a program has solved -P(o,6,c) as a subgoal, the program should not be forced to solve each of -P(prod(e,o),6,c) and -P(a,prod(e,6),c) and
842
Collected Works of Larry Wos
-P(prod(e,prod(e,a)),fc,c) and the like as subgoals. Without a procedure such as demodulation—as without subsumption—we again have the potential of extreme ineffectiveness. In contrast, with demodulation and specifically the demodulator EQUAL(prod(e,x),i) among the input clauses, a far different story is told. For those who enjoy history, we recommend chapter 2 of [Wos87] which contains an anecdote describing how demodulation was discovered, an anecdote that focuses on an example nearly identical to that just cited. Of course, subsumption again comes into play in a vital way, for its use purges various clauses that result from demodulating a clause to produce a copy or an instance of an existing clause. Since we are obviously building our case against the use of a paradigm based on logic programming—at least when the objective is assistance with answering deep questions and solving hard problems—and at the same time building a case for the retention of clauses, let us look at a third class of information one might wish to avoid. We recall that the first class of information consists of clauses that are purged by subsumption because they are copies of or instances of existing clauses; the user's actions and tastes have essentially no effect on the purging. On the other hand, the user's actions and tastes can play an indirect role in the decision to purge the members of the second class of information, those clauses that are rewritten with demodulation and then purged with sub sumption. The user's choice of demodulators provides the indirect means for purging. In contrast to the members of the first two classes of information, the purging of the members of the third class of information is solely at the direct discretion of the user of the automated reasoning program. In particular, by setting the weights (priorities [McCharen76]) appropriately, one can cause the automated reasoning program to purge information that one, on the basis of knowledge or intuition, deems undesirable. A review of the preceding material shows why we strongly conjecture that to be effective for solving difficult problems, an automated reasoning program must retain intermediate clauses. The retention of information virtually requires—as our experiments strongly suggest—the use of both subsumption and demodula tion. Indeed, even among those researchers who prefer a paradigm based on logic programming, there exist individuals who advocate clause retention. We find it natural to conjecture that, especially for those interested in a logic program ming paradigm, the trend toward accepting the need for retaining intermediate information will grow, and that the recognition of the need for subsumption and demodulation will also soon follow—perhaps to the point of rediscovering a general-purpose automated reasoning program. We also predict that, among those individuals who accept our challenge of attempting to prove the theorems we discuss in section 4, many will come to the conclusion we espouse, a paradigm for the automation of reasoning that is based on logic programming in its purest form offers inadequate power for attacking deep questions. Our preceding remark does not imply that we consider the effort devoted
Subsumption, a Sometimes Undervalued Procedure
843
to such a paradigm to be of little or no use. Quite the contrary. For simple theorems and for well-focused reasoning, such a paradigm is indeed attractive. In addition, some of the technology that has evolved because of the study of such paradigms is proving useful for paradigms not based on logic programming. For example, the use of pointers in place of substitution application materially speeds up demodulation [McCune88]. Also, we expect that clause compilation will prove extremely important to the implementation of linked inference rules (discussed in section 2.5; see also [Wos84a]). Even without these examples, we applaud efforts devoted to diverse paradigms for the automation of reasoning. Diverse and unrelated or distantly related ap proaches must be studied if a field is to reach its full potential. However, good science requires that software designers inform potential users of the weaknesses of a program. For example, when software is suspected of lacking the power for attacking difficult problems or proving deep theorems, an explicit warning should be issued. Such a warning can save researchers substantial time and en ergy devoted to the development and extension of systems based on a paradigm that lacks the desired properties. To summarize, although the paradigm (for the automation of reasoning) based on logic programming is intellectually seductive and attractively simpler than, for example, the paradigm on which the reasoning programs developed at Argonne are based, the logic-programming paradigm does not work well enough for attacking deep questions and hard problems.
2.4
Hyperresolution, Its Strengths and Weaknesses
To complete the aspect of our case asserting that subsumption has turned out to be even more important than Robinson's work on inference rules, we need to discuss the inference rule hyperresolution. This discussion also answers the fourth question posed earlier, that focusing on the strengths and weaknesses of hyperresolution. Just as Robinson exhibited excellent insight by introducing binary resolution to move the domain of discourse from the emphasis on ground expressions to an emphasis on expressions in which universally quantified variables occur, he again exhibited powerful insight by introducing hyperresolution, which moves the em phasis from small deduction steps to larger ones. Hyperresolution, which can be viewed—and even implemented—as combining a sequence of binary resolution steps into a single step, was the first of a number of such inference rules. Robin son, therefore, deserves substantial credit for introducing the notion of inference rules that skip over less important intermediate conclusions. Other examples of such inference rules—influenced by Robinson's success—include Overbeek's UR-resolution [McCharen76] and Wos's linked inference rules [Wos84a]. The most obvious strength of hyperresolution is its use to enable an auto mated reasoning program to avoid deducing numerous intermediate and partial conclusions, conclusions of the type produced by using binary resolution. The
844
Collected Works of Larry Wos
absence of such conclusions usually contributes— in most cases markedly—to the effectiveness of a reasoning program. By requiring that all conclusions obtained with hyperresolution consist of positive literals only, this inference rule has the additional strength of offer ing certain strategic advantages. In particular, the search space is materially reduced—especially for those problems for which such positive information plays the key role. However, even when a significant reduction in the size of the search space does occur, subsumption still plays a vital role. Evidence of this fact was given in section 1 where we discussed the successful attempt to prove SAM's lemma; additional evidence will be given in section 4. The emphasis on positive clauses—while offering the cited strategic advantage— also presents an important weakness of this inference rule. Specifically, keying on syntactic criteria is far less attractive and far less powerful than keying on semantic criteria. For example, if one writes the clause -LT(a, 6) | EVEN(a) with LT meaning less than and with the intention of having an automated reasoning program focus heavily on the corresponding fact, then hyperresolution will indeed consider this clause as a nucleus. On the other hand, if one writes GTE(a,6) jEVEN(o) with GTE meaning greater than or equal—obtaining an equivalent statement— then hyperresolution will not consider this clause as a nucleus. Little imagination is required to generalize this example to see that the user of a reasoning program can be forced into a not necessarily preferred representation of information. A solution that appeals to us focuses on the replacement of syntactic criteria by semantic criteria (see research problems 5 and 10 of [Wos87]). Specifically, rather than keying on positive and negative literals as hyperresolution does, we conjecture that it would be far better to key on if literals and t h e n literals, defined by the user for each problem. Then with the so-called semantic version of hyperresolution, the program would be required to remove from a nucleus all if literals and to introduce no new if literals. With semantic hyperresolution applied to the example cited earlier to illustrate the weakness of (syntactic) hyperresolution, one's actions would be forced in no way, for one could simply declare -LT(o,6) or, equally, GTE(a,6) to be an if literal. Hyperresolution also suffers in many cases from the important strategic weakness of inadequate use of the denial of the conclusion to be proved. Specif ically, there typically exist, among those clauses that are present because the desired result is assumed to be false in order to prepare the way for searching for a proof by contradiction, clauses containing no positive literals. Even further, many of those nonpositive clauses are unit clauses. Such clauses, by defini tion, cannot be used as satellites, and frequently such clauses cannot be used as nuclei, because the needed satellites are lacking. Therefore, the nonpositive clauses that are present in the presentation of a problem are often ignored by hyperresolution—ignored until the final step of the proof search. In other words,
Subsumption, a Sometimes Undervalued Procedure
845
from a global perspective, the use of hyperresolution as the sole rule of inference forces an automated reasoning program, in far too many cases, to prove a theo rem under consideration by, so to speak, finding the conclusion of that theorem, simply completing the search for a proof by contradiction by merely noting that the conclusion that was found happens to contradict the input assumption that the conclusion is false. The search for a proof should not complete simply because the desired result was discovered more or less by accident—because a clause was finally deduced that happens to conflict with the denial. Indeed, far more effec tive than relying on such a find is to key the search for a proof by contradiction on the assumption that the theorem is false. Although hyperresolution—as well as, to a slightly lesser extent, paramodulation—suffers from an inadequate use of the denial of the conclusion of the theorem under consideration, Robinson deserves much credit for introducing inference rules that combine in one step a number of less significant conclusions. Although not precisely a weakness of hyperresolution, we note that in many cases hyperresolution does not take large enough steps and, obviously, the size of the steps it takes is not directly a function of the user's instructions. To see what we mean by this remark, let us now turn to the fifth question.
2.5
Linked Inference Rules
In this section we answer the fifth question, a question that asks about some type of reasoning that gives the user of an automated reasoning program the opportunity of playing an active role in deciding what kinds of information to retain and also gives the user the option of determining the size of the deduction steps that are taken. Without doubt, the idea for the inference rules (linked inference rules [Wos84a]) discussed in this section stemmed from a familiarity with hyperresolution and UR-resolution. Indeed, in imitation of Robinson's recognition of the importance of combining a number of small deduction steps in one large deduction step, the first linked inference rule (linked UR-resolution [Wos84a]) was formulated by Wos and introduced in 1982. The motivation for the formulation of linked inference rules rests to some extent with the interest in taking deduction steps larger than those offered by hyperresolution, to a greater extent with the need to circumvent the syntactic constraints present in various standard inference rules, and to the greatest extent with the desire to permit the user to define which information is significant enough to merit retention. The idea is to relegate certain information to being implicit, information that would ordinarily be retained explicitly. Indeed, just as hyperresolution—if appropriately implemented [Overbeek75]—relegates to being implicitly present the so-called intermediate clauses that would otherwise arise by taking the cor responding binary resolution steps, linked inference rules equally avoid the gen eration of certain intermediate conclusions. In other words, linked inference rules share an important property with the reasoning found in a number of well-known
846
Collected Works of Larry Wos
inference rules and also in logic programming. On the other hand, in contrast to logic programming, linked inference rules are designed to permit the user to instruct an automated reasoning program to retain information that the user deems significant. From a different perspective, where binary resolution (too often) takes deduc tion steps that are too small, and where logic programming (too often) takes deduction steps that are too large, linked inference rules give the user con trol over their size. Taking very small deduction steps introduces—with a high probability—a great deal of unneeded information, which results in a marked degradation of program effectiveness. Although far less obvious, taking very large deduction steps has too high a potential of skipping over key information, again resulting in a sharp degradation of program effectiveness [Wos89]. Linked inference rules include generalizations of well-known inference rules such as hyperresolution and UR-resolution. The generalizations typically rest on a relaxation of the constraints found in the standard version. For example, a literal in a nucleus for UR-resolution can be removed—in the linked version—by a nonunit clause. In addition, the user can affect the size of the deduction step taken and is permitted to decide what criteria are to be used for determining the successful completion of a linked inference rule. The completion criteria typically take the form of some semantic requirement, such as "accept a conclusion only if it is a unit clause in the predicate FEMALE". To illustrate how linked inference rules work and how information is relegated to being implicit, let us consider the statements "Gail is female", "everyone who is female is not male", and "the job of nurse is held by a male". If we apply linked UR-resolution to the corresponding clauses (1) (2) (3)
FEMALE(Gail) -FEMALE(x) I -MALE(x) -HASAJ0B(x,nurse) I MALE(x)
with the instruction that the clauses to be retained must consist of literals in the predicate HASAJOB, then the clause (4)
-HASAJOB(Gail,nurse)
will be deduced. In contrast to the standard version of UR-resolution, which would permit an automated reasoning program to deduce (5)
-MALE(Gail)
from clauses (1) and (2), linked UR-resolution treats clause (5) as being only implicitly present, using clause (2) to link clause (1) to clause (3). In particular, if a program considers clauses (1) and (3) as the only hypotheses, no conclusion results, but clause (2) provides the needed literals to link the two hypotheses together to permit the deduction of clause (4). One can construct similar ex amples that even more closely capture the spirit of logic programming, a topic addressed in detail in [Wos89].
Subsumption, a Sometimes Undervalued Procedure
847
Preliminary experiments indicate that the use of subsumption, even for linked inference rules that take large deduction steps, will prove very signifi cant. Still further, subsumption may prove most useful during the application of a linked inference rule—even before its completion. Although early experi ments suggested such a use would be rather expensive, a new approach offers the possibility of sharply reducing this cost. That new approach will be based in part on the use of McCune's discrimination trees and in part on an order ing strategy currently under formulation. We also expect to borrow from logic programming by employing clause compilation. Additional experiments will be required to determine when it is wise to invoke subsumption during an attempt to complete an application of a linked inference rule.
2.6
Subsumption as Robinson's Most Significant Contribution
We close section 2 with our answer to the sixth question, that focusing on why we consider subsumption to be—in the context of automated reasoning circa 1989—Robinson's most significant contribution to the field. For any or all of the following four reasons, one might not share our view that subsumption is Robinson's most important contribution to automated rea soning as it is practiced today. First, one might not have examined appropriate experimental data. Second, one might consider Robinson's work on binary reso lution or on hyperresolution more significant. Third, one might prefer to rely on a paradigm for which subsumption is irrelevant. Fourth and finally, one might be misled by the naturalness, or even simplicity, of the notion of subsumption. Let us discuss these four factors in reverse order. From a general viewpoint, we consider that subsumption is to automated reasoning as the wheel is to transportation. For us, this analogue holds the keys to defusing the fourth cited factor. In particular, one might consider the wheel to be an obvious solution to overcoming the friction one would encounter without it, say when dragging one's burden over uneven terrain. Such a view might quickly mislead one into giving little credit to the inventor of the wheel. Of course, as it has turned out to this point, unless one is airborne or seaborne, no substitute for the wheel has yet been found, and the wheel works most effectively. Subsumption has the following analogous properties: its formulation is an obvious solution (to coping with unwanted copies and unwanted instances of existing statements), no substitute for subsumption has yet been found, and subsumption does the job nicely. As for the third given factor—although our analogue might seem rather sharp—the preference for reliance on a paradigm for which subsumption is ir relevant is like having a preference for avoiding gravity. Indeed, although places exist in which gravity is negligible and—as in the case of a paradigm based on logic programming—there exist many problems for which clause retention is un necessary and, therefore, subsumption is irrelevant, for planetary living and for
848
Collected Works of Larry Wos
attacking deep questions and hard problems, gravity and, respectively, clause retention and the use of subsumption must be accepted. With regard to the second factor—that concerning the relative significance of Robinson's other contributions—here we encounter an area for possible de bate. After all, moving the domain of discourse from the ground level to the variable level, as evidenced in binary resolution, marked an important advance. Then the move from deduction steps in the spirit of syllogism and modus ponens to deduction steps that combine a number of such steps—as evidenced in hyperresolution—was itself an excellent move, and it set the trend for much work that followed in the area of inference rule. Indeed, one can make a case for the value—historic and other—of the corresponding research. Nevertheless, since small deduction steps introduce too many insignificant conclusions, since semantics should be emphasized far more than syntax, since there now exist inference rules more powerful than either binary resolution or hyperresolution, and since no substitute has yet been found for clause retention coupled with the use of subsumption and demodulation, we find the case clear for evaluating subsumption to be the most significant of Robinson's contributions to automated reasoning circa 1989. Finally, for the factor focusing on experimentation, rather than citing results at this point, we instead devote all of section 4 to such results. There we also issue specific challenges for researchers who are dubious about the need for subsumption, the need for demodulation, and the need for clause retention. However, before we present experimental results and issue our challenges, to complete the setting and to further strengthen the case for clause retention and hence for subsumption, we turn in section 3 to pertinent history and a perspective concerning problem difficulty.
3
History and Problem Difficulty
To put into perspective many of the observations made in earlier sections, let us examine the nature of various experiments and the attitude toward those ex periments from the virtual inception of the field until now. Near the beginning in 1963, when the field was called mechanical theorem proving, the ability to solve a test problem called the Davis-Putnam example received some acclaim. A glance at the example by a researcher who has entered the field after 1970 will likely produce substantial puzzlement at finding that any satisfaction was derived from coping with the example. After all, one can correctly classify the Davis-Putnam example as trivial and uninteresting, at least by today's stan dards. This correct classification does not imply that the early researchers were easily impressed; instead, the more accurate observation asserts that early in the history of a field, researchers typically have few achievements, and those that they have are usually unimpressive after but a few years. Even more important,
Subsumption, a Sometimes Undervalued Procedure
849
binary resolution had not yet been formulated when the Davis-Putnam example was first studied. Prom a global perspective, this example provides an excellent illustration of how a few years of research can dramatically affect a field. In the case of automated reasoning, the introduction of binary resolution enabled a program to cope immediately and easily with an example that had required, at one time, approximately thirty minutes of hand computation and had also been out of reach of an existing reasoning program employing an entirely unrelated approach. Here are the corresponding clauses (with a change of notation from the original) for the Davis-Putnam example. If an attempt to cope with this example meets with the slightest difficulty, then one has discovered an overwhelming weakness in the corresponding reasoning program. •0 P(*,V) -P(y,f(x,y)) ■P(v,f(x,v))
| -P(f(x,y),f(x,y)) | Q(x,y) I -P(/(*,y)./(*,v)) I -Q(x,f(x,y))
| -Q(/(z,y),/(*,y))
Beginning in 1963 and during the next two decades of automated theorem prov ing, most of the problems for experimentation were taken from algebra. Those most frequently offered as challenge problems were from group theory, ring the ory, and Henkin models [McCharen76]. Indeed, one of the first interesting theo rems that was proved asserts that groups in which the square of every element is the identity are Abelian. (For those who enjoy history, in chapter 2 of [Wos87] one can read about the interesting connection this theorem has to the discovery of the set of support strategy.) Even though this theorem has always been cor rectly classified as a simple classroom exercise, the first proof of this theorem obtained with a computer program nevertheless produced substantial excite ment. After all, its proof had actually appeared in a journal on mathematics, and proving a theorem that had appeared in the literature did at that time mark a singular advance. Far more interesting and deserving of exuberance was the successful proof that in groups in which the cube of every element is the identity, certain commutators are equal to the identity. We suggest in section 4 that this theorem provides an interesting challenge problem, one that appears to require the use of both subsumption and demodulation to obtain a proof. Especially in the first decade of experimentation, the attacks on the problems frequently studied shared the following properties. • The deductions leading to a proof were in most cases "unfocused". No al gorithm existed—nor does one yet exist—for determining a priori precisely which formulas hold the key to the proof, and programs progressed by me thodically exploring what could be derived from (in general) progressively more complex formulas. • Goal reduction mechanisms, such as SL resolution or model elimination, did not work well. Although these inference mechanisms were later to
850
Collected WorAs of Larry Wos be used with stunning success in areas in which the deductions could legitimately be highly structured, they have never been successfully used to attain a proof of any of the more difficult challenge problems from algebra.
• The essential key to success in attacking the various challenge problems was (and still appears to be) to contain the combinatoric explosion usu ally encountered when seeking the corresponding proof—a feat that many researchers continue to regard as fundamentally hopeless. In the order of discovery, the four basic mechanisms found to be most effective in control ling the potential explosion were subsumption, the set of support strategy, demodulation, and weighting. Certainly the choice of inference rule proved to be important. However, the actions of purging redundant information (with subsumption), increasing the likelihood of drawing useful conclu sions (with the set of support strategy), simplifying those conclusions (with demodulation), and restricting the set of terms being considered (with weighting) all seemed—and still seem—essential to success. Not long after the discovery of logic programming, a sharp reversal in em phasis occurred. The selection of problems was restricted, for many researchers, to those solvable with "algorithmic deduction". In this context, exceedingly long chains of inference, made at previously unheard of speeds, produced impressive results. One key to such high performance was the elimination of the overhead of deriving new clauses and, more important, the overhead of attempting to simplify clauses with demodulation and the overhead of attempting to discard clauses with subsumption. Goal solving offered exactly the right paradigm for reasoning in the context of solving problems that admit of an algorithmic attack. Today a number of researchers, including members of the automated rea soning group at Argonne, are investigating the integration of the two highly disparate styles of deduction, that focusing on a paradigm in which clause re tention is deemed essential and that focusing on a paradigm based on logic pro gramming. In particular, we are studying the adaptation of various techniques resident in logic programming to enhance our current approach. To successfully merge the two disparate paradigms, we conjecture that one must keep in mind the characteristics of problems for which algorithmic reasoning does not suffice versus those for which it does. For example, a logic programmer might be most amused if someone began with the axioms append([],L,L) append([H|T],L,[H|T2]) : - append(T.L.T2) and the goal :- append([a,b,c],[d.e.f],L) and, instead of relying on logic programming, proceeded to derive a proof by contradiction using, say, UR-resolution in a system relying on the use of sub-
Subsumption, a Sometimes Undervalued Procedure
851
sumption, demodulation, and weighting. To use these complex mechanisms for such a simple task would correctly be considered a serious error. Conversely, if one relies mainly on logic programming when searching for proofs of theorems of even moderate difficulty, then one is committing, in our view, an equally serious error. If such is the case, then how do we account for the current obvious eagerness to use logic programming as the basis for the design of programs whose object is to prove theorems? The explanation rests in part with the understandable wish to find a shortcut to producing a program with the appropriate degree and type of power but, more important, rests also with the confusion concerning how to measure program performance (see [Wos89] for a discussion of both factors). In particular, logic programming systems are frequently rated in terms of LIPS (logical inferences per second), a measure that is almost always based on a single benchmark—reversing a list (the "naive reverse" benchmark). Unfortunately, from the viewpoint of a mathematician or logician, the corresponding operations do not measure logical inferences—such a term is clearly misleading. Indeed, anyone marketing a system that could do no useful computation more difficult than reversing a list of 1,000 elements would probably not gain a major share of the market. Similarly, marketing a theorem-proving program that could prove simple the orems but no more would not inspire much excitement, except for those applica tions for which proving simple theorems is one of the main activities. Program verification is one such important application, as both Boyer and Moore have repeatedly said. Unfortunately, some of the earlier mentioned confusion has re sulted from overestimating the significance of success with this type of theorem. For example, success in proving the simple theorem called (by other researchers) WoslO has caused and continues to cause researchers confusion regarding the power of the program used to obtain a proof of this theorem. The theorem, which asks one to prove commutativity for groups in which the square of every element x is the identity e, was widely used to measure program performance. In addition, with all programs designed and implemented at Argonne, as well as with programs designed at many other centers throughout the world, this theorem was used to debug and evaluate systems early in their development. This simple theorem, although providing an excellent example for illustration, does not provide much of a test of the value of a new idea or of a new pro gram. Therefore, the glee that sometimes accompanies an announcement of a successful attempt to obtain a proof of this theorem is not warranted. As evidence of the difficulty presented by WoslO, even with a complete axiomatization of groups—seventeen clauses in a notation that does not emphasize the role of equality (see chapter 6 of [Wos87])—the theorem was proved in less than 5 CPU seconds in the mid 1960s on an IBM 704 without the use of demod ulation. With currently available programs, running on a Sun 3 workstation, a proof is obtained in less than 2 CPU seconds. This theorem is but the first of a set of ever more difficult theorems that we discuss in section 4, where we present
852
Collected Works of Larry Wos
experimental results and offer challenges. To obtain a far more accurate measure of the value of a new idea or new program, we offer the following three theorems of increasing difficulty, theorems that have also been used to test and evaluate automated reasoning programs; indeed, the first and second are included among the five theorems on which we focus in section 4. 1. In a ring, if (for all x) the square of x is x, then the ring is commutative. 2. In a group, if (for all x) the cube of x is the identity e, then the equation [[x, y], y] = e holds, where [x, y] is the product of x, y, the inverse of x, and the inverse of y. 3. In a ring, if (for all x) the cube of x is x, then the ring is commutative. In automated reasoning, a still frequent but unfortunate practice is to eval uate the effectiveness and power of a program by its performance on WoslO and with complete disregard for whether the program can be used to solve more difficult problems. This practice is one of the forces that causes us to issue the challenges presented in section 4. Since the potential for combinatoric explosion increases sharply as the difficulty of the problem under consideration increases, especially new researchers in the field of automated reasoning should be warned that WoslO is a trivial problem. For evaluating the power of a new technique or a reasoning program, the far more accurate test is how well the technique or program copes with the combinatoric explosion that is encountered with more difficult problems (such as the three just listed), and not with how much faster the technique or program solves a trivial problem.
4
Experimental Results and Challenges
What still impresses us—"amazes" is probably a more accurate word—is the lack of universal acceptance and endorsement of experimentation as the only true test of the power and value of paradigms and programs. Certainly in the first decade of the field (1963-1973), automated reasoning—although it was not called that—suffered severely from inadequate experimentation. Today the inadequacy often takes a subtler form: too often, experiments are not concerned with moderate to difficult theorems and problems. If such are avoided, then how can the field discover—and eventually overcome—the obstacles to having access to a powerful automated reasoning colleague (see chapter 2 of [Wos87] for a discussion of those obstacles)? Almost from the beginning there existed reasoning programs designed and used for experimentation. Typical of progress in science, the results of those ex periments have been analyzed, and a fair amount of "folk wisdom" has emerged; in some cases, theoretical results from complexity analysis have reinforced cen tral observations. Within that folk wisdom one finds several widely accepted tenets that are misleading, misleading at least in the sense that they hold far
Subsumption, a Sometimes Undervalued Procedure
853
less often than commonly accepted. Among those tenets, the following three— the first two of which we also espoused at various times—merit consideration. A. The growth of the space of clauses to be searched is inescapably exponential. B. If one cannot obtain a proof in the first few minutes, then success will never occur. C. Insights gained from experimenting with simple theorems normally apply to a study of more complex theorems. We suspect that the folk wisdom embodied in these three assertions is funda mentally flawed. To substantiate our suspicion, we present a graduated set of theorems for experimentation, theorems we proved by using hyperresolution as the chosen inference rule. What makes the experiments we discuss of particu lar relevance to the primary issue in this article is the evidence they provide of the importance of subsumption to automated reasoning. The following five theorems form the graduated set on which we experimented and which we also propose as challenge problems. 1. In a group, if (for all elements x) the square of x is the identity e, then the group is commutative. 2. In a group, if (for all x) the cube of x is the identity e, then the equation [fc, 2/]i2/]=e holds, where [x, y] is the product of x, y, the inverse of a;, and the inverse of y. 3. In a ring, if (for all x) the square of x is x, then the ring is commutative. 4. The formula XGK = e(x, e(e(y, e(z, x)), e(z, y))) is a shortest single axiom for the equivalential calculus. 5. The formula i(i(i(x,y),z),i(i(z,x),i(u,x))) implicational calculus.
is a shortest single axiom for the
Proofs of each of these five theorems have been obtained by one or more existing automated reasoning programs; in the appendix we include a proof of each of the five theorems. To encourage others to try the same experiments, let us examine certain statistical aspects of the five proofs (table 1). A study of these statistics supports our suspicion concerning tenets A, B, and C. (In the appendix to this article we include the precise clauses that we submitted to OTTER [McCune90] to obtain the proofs.)
Collected Works of Larry Wos
854
Table 1 Statistical aspects of the proofs of theorems 1 to 5 Theorem
Length of proof
No. kept clauses
1 2 3 4 5
4 23 31 51 89
6 826 408 28,392 20,341
No. subsumed clauses
136 20,402 50,742 482,119 4,319,586
time (sec. ) on Sun 3) 1.16
242 637 29,486 41,130
The statistics we cite show that one can obtain proofs that are far longer than one would think possible if the growth of the search space were inescapably exponential. In particular, in the last case the 89 hyperresolvents correspond to 177 binary resolvents, and the proof completes at level 39—the proof tree is 39 levels deep. Clearly these results contradict the publicly expressed intuitions (concerning tenet A) of many researchers in the field, including ourselves at an earlier time. From a different perspective—that of computation time—we note that to prove the fourth theorem requires approximately eight CPU hours on a Sun 3 workstation, while to prove the fifth requires over 11 CPU hours. As is obvious— but often not admitted—proofs can be obtained after an exceedingly impressive amount of computation time has been expended, which supports our rejection of tenet B. For the record, we conjecture that proofs of twice the length and complexity of the fifth theorem will be obtained within the next five years. We also conjecture that, at first, those longer proofs will require orders of magnitude more computation time than was required to obtain a proof of the fifth theorem. With regard to our position concerning the importance of using subsumption, let us now examine more closely the results of our experiments. Our objective, of course, is to show that subsumption plays a vital role in obtaining these proofs. Let us consider some data pertinent to the first theorem in our sequence of five (table 2). The first and obvious conclusion one can draw from this data is that sub sumption plays a significant role. Nevertheless, we must point out that sub sumption is not the whole answer to conducting a successful attack for obtaining proofs of theorems of varying difficulty. Indeed, in the results presented earlier, we noted that six clauses were deduced and kept in the proof generated by OTTER.
855
Subsumption, a Sometimes Undervalued Procedure Table 2 Data from the first two levels of theorem 1 Type of clause Clauses generated during level 1: Clauses deleted by an identity check: Clauses that could be deleted by a complete subsumption check: Clauses deleted at level 2 (using the 206 - 138 = 68 clauses that survived a subsumption check at level 1): Clauses kept at level 2 (those that passed a subsumption test):
No. 206 125 138
37,560 22,318
One might well ask how such a result is possible, given that 68 + 22,318 new clauses can be generated and pass a subsumption test by level 2. The answer, in this case, lies in the use of demodulation and weighting. Actually, for difficult problems, we have found that a number of techniques must all be employed simultaneously for proofs to be obtained. In particular, for most difficult prob lems, subsumption, demodulation, the set of support strategy, and weighting are all required. Our challenge to researchers is the following: find a system that can prove any of theorems 2 through 5, without using subsumption. We doubt that such a system currently exists. If we are correct, we will have shown that the use of subsumption is indeed indispensable and also that the introduction of subsumption to automated reasoning is Robinson's most significant contribution.
5
Conclusions
When Robinson turned his attention to the problem of proving theorems with a computer program, he clearly recognized that what was needed was a means to reason, and reason logically. However, obviously an important distinction exists between what is needed and how to fulfill that need. To reason logically but with the intention of offering adequate power, Robinson introduced the full version of binary resolution. He noted that one means to obtain the desired power was to avoid deducing unneeded conclusions, conclusions of the type yielded by relying on instantiation coupled with syllogistic reasoning. But, as it turns out and as discussed earlier, in most cases binary resolution yields too many small conclusions when compared to what is needed and what is possible. Indeed, compared to binary resolution, Robinson's hyperresolution does a better job of avoiding the deduction of unneeded conclusions. Unfortunately, hyperresolution relies on syntactic rather than semantic criteria, and for many cases even this inference rule does not take large enough deduction steps. One might then conclude that a paradigm that totally avoids the retention
856
Collected Works of Larry Wos
of new information is clearly the best approach of all, for it is the limiting case. However, as our experiments strongly suggest, such is not the case—at least if one is attacking deep questions and hard problems. Rather, the retention of information coupled with the use of subsumption, demodulation, and various types of strategy provide the basis for a powerful and general-purpose paradigm for the automation of reasoning. Subsumption in particular, as our experiments show, is vital for attacking deep questions and hard problems with the assistance of an automated reasoning program. Therefore, although we compliment J. A. Robinson for his excellent research focusing on inference rules, in our view, he deserves even more acclaim for his contribution of subsumption. Indeed, because information retention is crucial for certain types of inves tigation, because redundant information must be purged, and because no sub stitute for subsumption currently exists—in contrast to the fact that inference rules exist that offer more power than either binary resolution or hyperresolution does—we consider Robinson's contribution of subsumption to be his most important, at least for automated reasoning circa 1989.
Appendix: Clauses Submitted to and Proofs Found by OTTER for Theorems 1 through 5 The OTTER theorem prover, as a research vehicle, has a large number of usersettable options in order to provide the user with extensive control over its operations. At the same time, proofs of difficult theorems can be obtained with out fine-tuning OTTER to individual problems. As an illustration, the proofs of all five theorems here were obtained with the same set of simple options, specified to OTTER in the following way: set(hyper_res). 7, use hyperresolution only set(back.demod). '/, enable back demodulation set(atom_wt_max_args). '/, compute weight by symbol count, 7, using t h e maximum instead of sum '/, of argument weights assign(max.weight,N). '/, apply a weight cutoff for 7. keeping new clauses The max_weight parameter N varies from problem to problem. In each case the statistics given in the paper are taken from the run with the lowest value of N that allowed the proof to be completed. The appropriate N was determined through an iterative deepening process. (For the not symbol, in place of "-" OTTER requires the use of "-".) THEOREM 1:
Subsumption,
a Sometimes
Undervalued Procedure
*/a P ( x , y , z ) means t h a t the product of x and y i s z . assign(max_weight,2). list(axioms). 7, e i s a two-sided i d e n t i t y . P(e,x,x). P(x,e,x). '/, g(x) is a two-sided inverse for x. P(g(x),x,e). P(x,g(x),e). '/, closure P(x,y,f(x,y)). 7. associativity -P(x,y,u) I -P(y,z,v) I -P(u,z,w) I P(x,v,w). -P(x,y,u) I -P(y,z,v) I -P(x,v,w) I P(u,z,w), 7, Product is well defined. -P(x.y.u) I -P(x,y,v) I EQUAL(u.v). '/. equality axioms EQUAL(x,x). -EqUAL(x.y) I EQUAL(y.x). -EQUAL(x.y) I -EQUAL(y.z) I EQUAL(x.z). 7a e q u a l i t y s u b s t i t u t i o n axioms -EQUAL(u.v) I - P ( u , x , y ) I P ( v , x , y ) . -EQUAL(u.v) I - P ( x , u , y ) I P ( x , v , y ) . -EQUAL(u.v) I - P ( x , y , u ) | P ( x , y , v ) . -EQUAL(u,v) I E q U A L ( f ( u , x ) , f ( v , x ) ) . -EQUAL(u.v) I E Q U A L ( f ( x , u ) , f ( x , v ) ) . -EqUAL(u.v) I EQUAL(g(u),g(v)). end_of_list. list(sos). 7a The square of every x is the identity. P(x,x,e). 7a Denial: there exist two elements that do not commut
857
Collected Works of Larry Wos
858
P(a,b,c). -P(b,a,c). end_of_list. Proof of theorem 1 1 [] P ( e , x , x ) . 2 [] P ( x , e , x ) . 6 [] - P ( x , y , u ) | - P ( y , z , v ) I - P ( u , z , w ) 7 [] - P ( x , y , u ) I - P ( y , z , v ) I - P ( x , v , w ) 18 [] P ( x , x , e ) . 19 [] P ( a , b , c ) . 20 [] - P ( b , a , c ) . 21 [ h y p e r , 1 9 , 7 , 1 8 , 2 ] P ( c , b , a ) . 22 [ h y p e r , 1 9 , 6 , 1 8 , 1 ] P ( a , c , b ) . 23 [ h y p e r , 2 1 , 6 , 1 8 , 1 ] P ( c , a , b ) . 25 [ h y p e r , 2 3 , 7 , 2 2 , 1 9 ] P ( b , a , c ) . 26 [ b i n a r y , 2 5 , 2 0 ] .
I P(x,v,w). I P(u,z,w).
THEOREM 2: assign(max_weight,4). list(axioms). 7. e i s a t w o - s i d e d i d e n t i t y . P(e,x,x). P(x,e,x). 7. g(x) is a two-sided inverse for x. P(g(x),x,e). P(x,g(x),e). 'I, closure P(x,y,f(x,y)). '/, associativity -P(x,y,u) I -P(y,z,v) | -P(u,z,w) I P(x,v,w). -P(x,y,u) | -P(y,z,v) | -P(x,v,w) I P(u,z,w). % Product is well defined. -P(x.y.u) I -P(x,y,v) | EQUAL(u.v).
Subsumption,
a Sometimes
Undervalued
Procedure
'/, equality axioms EQUAL(x.x). -EQUAL(x,y) I EQUAL(y,x). -EQUAL(x.y) I -EQUAL(y.z) I EQUAL(x.z), '/, equality substitution axioms -EQUAL(u.v) I -P(u,x,y) I P(v,x,y) -EQUAL(u.v) I -P(x,u,y) | P(x,v,y) -EqUAL(u.v) I -P(x,y,u) I P(x,y,v) -EQUAL(u.v) I EQUAL(f(u,x),f(v,x)) -EQUAL(u.v) I EQUAL(f(x,u),f(x,v)) -EqUAL(u.v) I EQUAL(g(u),g(v)). end_of_list. list(sos). '/. x cubed is e -P(x,x,y) I P(x,y,e). -P(x,x,y) I P(y,x,e). '/, Denial: for some a and b, [[a,b],b] is not e. P(a,b,c). P(c,g(a),d). P(d,g(b),h). P(h.b.j). P(j,g(h),k). -P(k,g(b),e). end_of_list. Proof of theorem 2 1 [] 2 [] 3 [] 5 [] 6 [] 7 [] 8 [] 18 [] 19 [] 20 []
P(e,x,x). P(x,e,x). P(g(x),x,e). P(x,y,f(x,y)). -P(x,y,u) I -P(y,z,v) I -P(u,z,w) | P(x,v,w). -P(x,y,u) I -P(y,z,v) I -P(x,v,w) | P(u,z,w). - P ( x , y , u ) I - P ( x , y , v ) I EQUAL(u.v). -P(x,x,y) I P(x,y,e). -P(x,x,y) I P(y,x,e). P(a,b,c).
859
860
Collected Works of Larry Wos
21 [] P ( c , g ( a ) , d ) . 22 Q P ( d , g ( b ) , h ) . 23 [] P ( h , b , j ) . 24 [] P ( j , g ( h ) . k ) . 25 [] - P ( k , g ( b ) . e ) . 29 [ h y p e r , 2 0 , 7 , 5 , 5 ] P ( f ( x . a ) , b , f ( x , c ) ) . 37 [ h y p e r , 2 0 , 6 , 5 , 5 ] P ( a , f ( b . x ) , f ( c . x ) ) . 61 [ h y p e r , 2 1 , 7 , 3 , 2 ] P ( d , a , c ) . 64 [ h y p e r , 2 1 , 6 , 2 , 5 ] P ( c , g ( a ) , f ( d , e ) ) . 76 [ h y p e r , 6 1 , 6 , 5 , 5 ] P ( d , f ( a . x ) , f ( c , x ) ) . 85 [ h y p e r , 2 2 , 7 , 3 , 2 ] P ( h , b , d ) . 9 0 , 8 9 [ h y p e r , 8 5 , 8 , 2 3 ] EqUAL(j.d). 98 [ h y p e r , 8 5 , 6 , 5 , 6 1 ] P ( h , f ( b . a ) , c ) . 103 [back_demod,24,demod,90] P ( d , g ( h ) , k ) . 154 [ h y p e r , 1 0 3 , 7 , 3 , 2 ] P ( k , h , d ) . 220 [ h y p e r , 1 8 , 5 ] P ( x , f ( x , x ) , e ) . 221 [ h y p e r , 1 9 , 5 ] P ( f ( x , x ) , x , e ) . 259,258 [ h y p e r , 6 4 , 8 , 2 1 ] EQUAL(f(d,e),d). 296 [ h y p e r , 9 8 , 7 , 1 5 4 , 5 ] P ( d , f ( b , a ) , f ( k , c ) ) . 434 [ h y p e r , 2 2 0 , 7 , 2 9 , 2 ] P ( f ( x , c ) , f ( b , b ) , f ( x . a ) ) . 437 [ h y p e r , 2 2 0 , 7 , 5 , 2 ] P ( f ( x . y ) , f ( y . y ) , x ) . 438 [ h y p e r , 2 2 0 , 7 , 3 , 2 ] P ( e , f ( x , x ) , g ( x ) ) . 459 [hyper,221,7,76,5,demod,259] P ( f ( c , a ) , a , d ) . 679,678 [ h y p e r , 4 3 8 , 8 , 1 ] EQUAL(g(x),f(x,x)). 704 [back.demod,25,demod,679] - P ( k , f ( b , b ) , e ) . 711 [ h y p e r , 4 5 9 , 6 , 3 7 , 2 9 6 ] P ( f ( c , a ) , f ( c , a ) , f ( k , c ) ) . 791 [hyper,711,19] P ( f ( k . c ) , f ( c , a ) , e ) . 880 [ h y p e r , 7 9 1 , 7 , 4 3 7 , 4 3 4 ] P ( k , f ( b . b ) , e ) . 881 [ b i n a r y , 8 8 0 , 7 0 4 ] . THEOREM 3: assign(max_weight,4). list(axioms). 7, 0 is an additive identity. S(0,x,x). S(x,0,x). '/, g(x) is an additive inverse for x. S(g(x),x,0). S(x.g(x).0). 7, closure of addition
Subsumption, a Sometimes Undervalued Procedure
861
S(x,y,j(x,y)). % associativity of addition. -S(x,y,u) I -S(y,z.v) I -S(u,z,w) | S(x,v,v). -S(x,y,u) I -S(y,z,v) | -S(x,v,w) | S(u,z,w). '/, Addition is well defined. -S(x,y,u) I -S(x,y,v) I EQUAL(u.v). '/. equality axioms EQUAL(x,x). -EQUAL(x.y) I EQUAL(y.x). -EQUAL(x.y) I -EQUAL(y.z) I EQUAL(x.z). '/, equality -EQUAL(u.v) -EQUAL(u.v) -EQUAL(u.v) -EQUAL(u.v) -EQUAL(u,v) -EQUAL(u.v)
substitution axioms I -S(u,x,y) I S(v,x,y). I -S(x,u,y) | S(x,v,y). I -S(x,y,u) | S(x,y,v). I EQUAL(j(u,x),j(v,x)). I EQUAL(j(x,u),j(x,v)). I EQUAL(g(u),g(v)).
'/, commutativity of addition -S(x,y,z) I S(y,x.z). '/. multiplication by 0 P(0,x,0). P(x,0,0). 7, closure for multiplication P(x,y,f(x,y)). '/, associativity of multiplication -P(x,y,u) I -P(y,z,v) I -P(u,z,w) I P(x,v,w). -P(x,y,u) I -P(y,z,v) I -P(x,v,w) | P(u,z,w). '/, distributive laws -P(x,y,vl) I -P(x,z,v2) -P(x,y,vl) I -P(x,z,v2) -P(y,x,vl) I -P(z.x,v2) -P(y,x,vl) I -P(z,x,v2)
i I | I
-S(y,z,v3) -S(y,z,v3) -S(y,z,v3) -S(y,z,v3)
'/, Multiplication is well defined. -P(x,y,u) I -P(x,y,v) I EQUAL(u.v).
I I I I
-P(x,v3,v4) I S(vl,v2,v4). -S(vl,v2,v4) I P(x,v3,v4). -P(v3,x,v4) I S(vl.v2,v4). -S(vl,v2,v4) I P(v3,x,v4).
862
Collected Works of Larry Wos
V, e q u a l i t y s u b s t i t u t i o n axioms -EQUAL(u,v) -P(u,x,y) I P(v,x,y) -EQUAL(u,v) -P(x,u,y) I P(x,v,y) -EQUAL(u.v) -P(x,y,u) I P(x,y,v) -EQUAL(u,v) EQUAL(f(u,x),f(v,x)) -EQUAL(u,v) EQUAL(f(x,u),f(x,v)) end_of_list. list(sos). 7, The square of every x is x. P(x,x,x). '/, Denial: there exist elements that do not commute. P(a,b,c). -P(b,a,c). end_of_list. Proof of theorem 3 1 [] S ( 0 , x , x ) . 2 [] S ( x . 0 , x ) . 3 [] S ( g ( x ) , x , 0 ) . 5 [] S ( x , y . j ( x , y ) ) . 6 [] - S ( x , y , u ) | - S ( y , z , v ) | - S ( u , z , w ) I S ( x , v , w ) . 7 [] - S ( x , y , u ) I - S ( y , z , v ) I - S ( x , v , w ) | S ( u , z , w ) . 19 [] P ( 0 , x , 0 ) . 21 [] P ( x , y , f ( x , y ) ) . 22 [] - P ( x , y , u ) | - P ( y , z , v ) I - P ( u , z , w ) I P ( x , v , w ) . 23 [] - P ( x , y , u ) I - P ( y , z , v ) I - P ( x , v , w ) I P ( u , z , w ) . 24 [] - P ( x , y , v l ) I - P ( x , z , v 2 ) | - S ( y , z , v 3 ) I - P ( x , v 3 , v 4 ) I S(vl,v2,v4). 25 [] - P ( x . y . v l ) | - P ( x , z , v 2 ) | - S ( y , z , v 3 ) I - S ( v l , v 2 , v 4 ) I P(x,v3,v4). 27 [] - P ( y . x . v l ) I - P ( z , x , v 2 ) I - S ( y , z , v 3 ) I - S ( v l . v 2 , v 4 ) I P(v3,x.v4). 28 [] - P ( x , y , u ) I - P ( x , y , v ) | EQUAL(u.v). 31 [] -EQUAL(u.v) | - P ( x , y , u ) | P ( x , y , v ) . 34 [] P ( x , x , x ) . 35 [] P ( a , b , c ) .
Subsumption,
a Sometimes
Undervalued
Procedure
36 [] - P ( b , a , c ) . 39 [ h y p e r , 3 4 , 2 7 , 3 4 , 5 , 5 ] P ( j ( x , x ) , x , j ( x . x ) ) . 44 [ h y p e r , 3 4 , 2 7 , 1 9 , 5 , 5 ] P ( j ( 0 , x ) , x , j ( 0 , x ) ) . 45 [ h y p e r , 3 4 , 2 7 , 1 9 , 5 , 1 ] P ( j ( 0 , x ) , x , x ) . 50 [ h y p e r , 3 4 , 2 7 , 1 9 , 5 . 5 ] P ( j ( x , 0 ) , x , j ( x , 0 ) ) . 51 [ h y p e r , 3 4 , 2 7 . 1 9 , 5 , 2 ] P ( j ( x , 0 ) , x , x ) . 82 [ h y p e r , 3 5 , 2 7 , 3 4 , 5 , 5 ] P ( j ( b , a ) , b , j ( b , c ) ) . 96 [ h y p e r , 3 5 , 2 5 , 3 4 , 5 , 5 ] P ( a , j ( b , a ) , j ( c , a ) ) . 101 [ h y p e r , 3 5 , 2 3 , 3 5 , 3 4 ] P ( c , b , c ) . 104 [ h y p e r , 3 5 , 2 3 , 2 1 , 2 1 ] P ( f ( x , a ) , b , f ( x , c ) ) . 108 [ h y p e r , 3 5 , 2 2 , 3 4 , 3 5 ] P ( a , c , c ) . 152 [ h y p e r , 1 0 8 , 2 5 , 3 5 , 5 , 5 ] P ( a , j ( b . c ) , j ( c , c ) ) . 161 [ h y p e r , 1 0 8 , 2 3 , 2 1 , 2 1 ] P ( f ( x , a ) , c , f ( x . c ) ) . 173 [ h y p e r , 3 9 , 2 4 , 3 9 , 5 , 3 4 ] S ( j ( x , x ) , j ( x , x ) , j ( x , x ) ) . 185,184 [ h y p e r , 4 5 , 2 8 , 4 4 ] EQUAL(j(0.x),x). 190,189 [ h y p e r , 5 1 , 2 8 , 5 0 ] EQUAL(j(x,0),x). 204 [ h y p e r , 8 2 , 2 2 , 3 4 , 8 2 ] P ( j ( b , a ) , j ( b , c ) , j ( b , c ) ) . 209 [ h y p e r , 9 6 , 2 3 , 9 6 , 3 4 ] P ( j ( c . a ) , j ( b , a ) , j ( c , a ) ) . 213 [ h y p e r , 1 0 4 , 2 3 , 2 1 , 3 4 ] P ( f ( b , c ) , a , f ( b , a ) ) . 240 [ h y p e r , 1 7 3 , 7 , 3 , 3 ] S ( 0 , j ( x , x ) , 0 ) . 267 [hyper,240,27,19,152,5,demod,185] P ( a , j ( b , c ) , 0 ) . 303 [hyper,240,7,5,5,demod,185] S ( x , x , 0 ) . 312 [hyper,303,7,5,5,demod,190] S ( j ( x , y ) , y , x ) . 317 [hyper,303,6,5,5,demod,185] S ( x , j ( x . y ) , y ) . 325 [ h y p e r , 3 1 2 , 2 7 , 2 0 9 , 9 6 , 3 0 3 ] P ( c , j ( b . a ) , 0 ) . 326 [hyper,312,27,204,267,5,demod,190] P ( b , j ( b , c ) , j ( b , c ) ) . 342 [hyper,325,25,101,317,5,demod,190] P ( c . a . c ) . 353 [ h y p e r , 3 4 2 , 2 2 , 1 6 1 , 2 1 3 ] P ( f ( b , a ) , c , f ( b , a ) ) . 359 [ h y p e r , 3 2 6 , 2 5 , 3 4 , 3 1 7 , 3 1 7 ] P ( b , c , c ) . 3 6 4 , 3 6 3 [ h y p e r , 3 5 9 , 2 8 , 2 1 ] EQUAL(f(b,c),c). 404 [hyper,353,28,161,demod,364] EQUAL(f(b,a),c). 459 [ h y p e r , 4 0 4 , 3 1 , 2 1 ] P ( b , a , c ) . 460 [ b i n a r y , 4 5 9 , 3 6 ] . THEOREM 4: assign(max_weight,20). list(axioms). '/, condensed detachment -P(x) I - P ( e ( x , y ) ) I P(y). end_of_list.
863
Collected Works of Larry Wos
864
list(sos). '/, the formula XGK P(e(x,e(e(y,e(z,x)),e(z,y)))). V, the negation of PYO, which is a known single axiom -P(e(e(e(a,e(b,c)),c),e(b,a))). end_of_list.
Proof of theorem 4 1 [] -P(x) I - P ( e ( x , y ) ) I P(y).
2 [] P(e(x,e(e(y,e(z,x)),e(z,y)))). 3 [] - P ( e ( e ( e ( a , e ( b , c ) ) , c ) , e ( b , a ) ) ) . 4 [hyper,2,1,2] P ( e ( e ( x , e ( y , e ( z , e ( e ( u , e ( v , z ) ) , e ( v , u ) ) ) ) ) , e ( y , x ) ) ) . 5 [hyper,4,1,2] P ( e ( e ( e ( e ( x , e ( y , z ) ) , e ( y , x ) ) , e ( z , u ) ) , u ) ) . 6 [hyper,5,1,5] P ( e ( x , x ) ) . 9 [hyper,6,1,2] P ( e ( e ( x , e ( y , e ( z , z ) ) ) , e ( y , x ) ) ) . 12 [hyper,9,1,5] P ( e ( x , e ( e ( e ( y , e ( z , u ) ) , e ( z , y ) ) , e ( u , e ( x , e ( v , v ) ) ) ) ) ) . 14 [hyper,9,1,2] P ( e ( e ( x , e ( x , y ) ) , y ) ) . 15 [hyper,9,1,5] P ( e ( e ( x , x ) , e ( y , y ) ) ) . 17 [hyper,9,1,2] P ( e ( e ( x , e ( y , e ( e ( z , e ( u , e ( v , v ) ) ) , e ( u , z ) ) ) ) , e ( y , x ) ) ) . 23 [hyper,14,1,9] P ( e ( x , e ( y , e ( y , e ( x , e ( z , z ) ) ) ) ) ) . 25 [hyper,14,1,2] P ( e ( e ( x , e ( y , e ( e ( z , e ( z , u ) ) , u ) ) ) , e ( y , x ) ) ) . 27 [hyper,15,1,2] P ( e ( e ( x , e ( y , e ( e ( z , z ) , e ( u , u ) ) ) ) , e ( y , x ) ) ) . 61 [hyper,23,1,4] P ( e ( x , e ( y , e ( y , x ) ) ) ) . 81 [hyper,61,1,2] P ( e ( e ( x , e ( y , e ( z , e ( u , e ( u , z ) ) ) ) ) , e ( y , x ) ) ) . 344 [hyper,25,1,14] P ( e ( x , e ( y , e ( y , e ( x , e ( e ( z , e ( z , u ) ) , u ) ) ) ) ) ) . 607 [hyper,81,1,2] P ( e ( e ( e ( x , e ( x . y ) ) , e ( y , z ) ) , z ) ) . 940 [hyper,344,1,4] P ( e ( x , e ( y , e ( e ( z , e ( z , y ) ) , x ) ) ) ) . 978 [hyper,940,1,607] P ( e ( e ( x , e ( x , y ) ) , e ( z . e ( z , y ) ) ) ) . 992 [hyper,940,1,5] P ( e ( e ( x , e ( x , y ) ) , e ( e ( z , e ( u , y ) ) , e ( u , z ) ) ) ) . 993 [hyper.940,1,4] P ( e ( x , e ( e ( y , e ( z , e ( u , e ( u , x ) ) ) ) , e ( z , y ) ) ) ) . 1008 [hyper,978,1,4] P ( e ( x , e ( y , e ( y , e ( e ( z , e ( u , x ) ) , e ( u , z ) ) ) ) ) ) . 1593 [hyper,992,1,25] P ( e ( e ( x , e ( e ( y , e ( y , x ) ) , z ) ) , e ( u , e ( u , z ) ) ) ) . 1597 [hyper,993,1,81] P ( e ( e ( e ( x , e ( x , y ) ) , e ( y , e ( z , e ( z , u ) ) ) ) , u ) ) . 4308 [hyper,17,1,1008] P ( e ( e ( e ( x , y ) , e ( e ( y , e ( x , z ) ) , e ( u , u ) ) ) , z ) ) . 4312 [hyper,17,1,978] P ( e ( e ( x , e ( y , e ( z , z ) ) ) , e ( u , e ( u , e ( y . x ) ) ) ) ) . 4326 [hyper.17.1.2] P ( e ( e ( e ( x . y ) , e ( e ( y , e ( x , e ( z , z ) ) ) , u ) ) , u ) ) . 4706 [hyper,4312,1.25] P ( e ( e ( x , e ( x , e ( y , z ) ) ) , e ( z , e ( y , e ( u , u ) ) ) ) ) . 4711 [hyper.4312.1,4] P ( e ( x , e ( e ( y , z ) , e ( e ( z , e ( y , x ) ) , e ( u , u ) ) ) ) ) . 5248 [hyper,4326,1,1593] P ( e ( e ( e ( e ( x , e ( x , y ) ) , z ) , e ( y , e ( u , u ) ) ) , z ) ) .
Subsumption,
a Sometimes Undervalued
Procedure
865
5255 [hyper.4326,1,12] P ( e ( x , e ( e ( y , e ( e ( z , z ) , e ( y , x ) ) ) , e ( u , u ) ) ) ) . 5354 [hyper,4711,1,4326] P ( e ( e ( e ( x , e ( y , y ) ) , e ( z , e ( x , z ) ) ) , e ( u , u ) ) ) . 5357 [hyper,4711,1,1597] P ( e ( x , e ( y , e ( z , e ( z , e ( y , x ) ) ) ) ) ) . 5627 [hyper,5248,1,4308] P ( e ( e ( e ( x , y ) , e ( x , e ( y , e ( z , z ) ) ) ) , e ( u , u ) ) ) . 5730 [hyper,5255,1,27] P ( e ( e ( x , e ( e ( y , y ) , e ( x , z ) ) ) , z ) ) . 5897 [hyper,5354,1,4706] P ( e ( e ( x , e ( y , x ) ) , e ( e ( y , e ( z , z ) ) , e ( u , u ) ) ) ) . 6338 [hyper,5627,1,5730] P ( e ( e ( x , y ) , e ( x , e ( y , e ( z , z ) ) ) ) ) . 6373 [hyper,6338,1,6338] P ( e ( e ( x , y ) , e ( e ( x , e ( y , e ( z , z ) ) ) , e ( u , u ) ) ) ) . 6945 [hyper,6373,1,27] P ( e ( e ( x , e ( y , e ( z , z ) ) ) , e ( x , y ) ) ) . 6951 [hyper,6945,1,5897] P ( e ( e ( x , e ( y , x ) ) , e ( y , e ( z , z ) ) ) ) . 7300 [hyper,6951,1,6945] P ( e ( e ( x , e ( y , x ) ) , y ) ) . 7445 [hyper,7300,1,5357] P ( e ( x , e ( y , e ( y , e ( x , e ( e ( z , e ( u , z ) ) , u ) ) ) ) ) ) . 7688 [hyper,7300,1,2] P ( e ( e ( x , e ( y , e ( e ( z , e ( u , z ) ) , u ) ) ) , e ( y , x ) ) ) . 9403 [hyper,7445,1,4] P ( e ( x , e ( y , e ( e ( z . e ( y , z ) ) , x ) ) ) ) . 9647 [hyper,9403,1,607] P ( e ( e ( x , e ( y , x ) ) , e ( z , e ( z , y ) ) ) ) . 9908 [hyper,9647,1,4] P ( e ( x , e ( y , e ( e ( e ( z , e ( u , x ) ) , e ( u , z ) ) , y ) ) ) ) . 10860 [hyper,7688,1,2] P ( e ( e ( x , e ( e ( y , e ( x , y ) ) , z ) ) , z ) ) . 10996 [hyper,10860,1,4711] P ( e ( e ( e ( x , y ) , e ( y , x ) ) , e ( z , z ) ) ) . 11273 [hyper,10996,1,7300] P ( e ( e ( x , y ) , e ( y , x ) ) ) . 11323 [hyper,10996,1,992] P ( e ( e ( x , e ( y , e ( e ( z , u ) , e ( u , z ) ) ) ) , e ( y , x ) ) ) . 15435 [hyper,11323,1,9908] P ( e ( e ( e ( x , y ) , e ( y , e ( x , z ) ) ) , z ) ) . 21396 [hyper,15435,1,11273] P ( e ( x , e ( e ( y , z ) , e ( z , e ( y , x ) ) ) ) ) . 28393 [hyper,21396,1,4] P ( e ( e ( e ( x , e ( y , z ) ) , z ) , e ( y , x ) ) ) . 28395 [binary,28393.3] .
THEOREM 5: assign(max.veight,20). list(axioms). '/, condensed detachment -P(x) I - P ( i ( x , y ) ) | P(y). end_of_list. list(sos). '/, formula suspected of being a single axiom P(i(i(i(x,y),z),i(i(z,x),i(u,x)))). '/, the negation of a known single axiom -P(i(i(a,b),i(i(b.c),i(a,c)))). end_of_list.
866
Collected Works of Larry Wos
Proof of theorem 5 1 [] - P ( x ) I - P ( i ( x . y ) ) I P( y ) 2 [] P ( i ( i ( i ( x , y ) . z ) , i ( i ( zz,,: c ) , i ( v . x ) ) ) ) . 3 [] - P ( i ( i ( a , b ) , i ( i ( b , c ) , i a , c ) ))). 4 [ h y p e r , 2 , 1 , 2 ] P ( i ( i ( i ( i (x y ) . i ( z . y ) ) , i ( y . u ) ) , i ( v , i ( y , u ) ) ) ) . 5 [ h y p e r , 4 , 1 , 4 ] P ( i ( x , i ( i (y z ) , i ( z . i ( y . z ) ) ) ) ) . 7 [ h y p e r , 5 , 1 , 2 ] P ( i ( i ( i ( i (x y ) . i ( y , i ( x , y ) ) ) , z ) , i ( u , z ) ) ) . 12 [ h y p e r . 7 , 1 , 2 ] P ( i ( x , i ( i ( : L(y.i ( z , y ) ) , z ) , i ( u , z ) ) ) ) . 15 [ h y p e r , 1 2 , 1 , 2 ] P ( i ( i ( i ( i U ( x , i ( y . x ) ) , y ) , i ( z , y ) ) , u ) , i ( v , u ) ) ) . 99 [hyper, 1 5 , 1 , 4 ] P ( i ( x , i ( i : y , z ) , i ( u , i ( y , z ) ) ) ) ) . 101 [ h y p e r , 9 9 , 1 , 9 9 ] P ( i ( i (x y ) . i ( z . i ( x . y ) ) ) ) . 126 [hyper,101, ,2] P ( i ( i ( i j c , i ( y , z ) ) , y ) , i ( u . y ) ) ) . 132 [hyper,126, ,2] P ( i ( i ( i *.y> , i ( z . i ( y , u ) ) ) , i ( v , i ( z , i ( y , u ) ) ) ) ) . 166 [hyper,132, ,101] P ( i (x K y . i ( z , z ) ) ) ) . 172 [hyper,166, ,166] P ( i (x i ( y . y ) ) ) . 174 [hyper,166, ,2] P ( i ( i ( i ( x , i ( y . y ) ) . z ) . i ( u , z ) ) ) . 175 [hyper,172, ,172] P ( i (x x ) ) . 176 [hyper,172, ,2] P ( i ( i ( i ( x , x ) , y ) , i ( z , y ) ) ) . 177 [hyper,175, ,2] P ( i ( i ( i ( :x,y) , x ) , i ( z , x ) ) ) . 182 [hyper,176, ,4] P ( i ( x , i : y , i ( z , y ) ) ) ) . 186 [hyper,182, ,2] P ( i ( i ( i ' x , i ( y , x ) ) , z ) , i ( u , z ) ) ) . 187 [hyper,177, ,2] P ( i ( i ( i x . y ) , i ( y , z ) ) , i ( u , i ( y , z ) ) ) ) . 204 [hyper,187, ,2] P ( i ( i ( i x , i ( y , z ) ) , i ( u , y ) ) , i ( v , i ( u , y ) ) ) ) . 226 [hyper,204, ,2] P ( i ( x , i i ( i ( i ( y . z ) . u ) . z ) , i ( y , z ) ) ) ) . 228 [hyper,204, ,2] P ( i ( i ( i x , i ( y , z ) ) , i ( u , i ( z , v ) ) ) , i ( w , i ( u , i ( z , v ) ) ) ) ) . 229 [hyper,226, ,226] P ( i ( i i ( i ( x . y ) , z ) , y ) , i ( x , y ) ) ) . 232 [hyper,229, ,2] P ( i ( i ( i x . y ) , i ( i ( x . y ) , z ) ) , i ( u , i ( i ( x , y ) , z ) ) ) ) . 290 [hyper,232, ,186] P ( i (x i ( i ( i ( y . i ( z , y ) ) , u ) , u ) ) ) . 292 [hyper,232, ,177] P ( i (x i ( i ( i ( y . z ) , y ) , y ) ) ) . 293 [hyper,232, ,176] P ( i (x i ( i ( i ( y , y ) , z ) , z ) ) ) . 294 [hyper,232, ,174] P ( i (x i ( i ( i ( y , i ( z , z ) ) . u ) , u ) ) ) . 301 [hyper,232, ,126] P ( i (x i ( i ( i ( y , i ( z , u ) ) , z ) , z ) ) ) . 308 [hyper,292, ,292] P ( i (i< i ( x , y ) . x ) , x ) ) . 310 [hyper,308, ,2] P ( i ( i (x i ( x , y ) ) , i ( z , i ( x , y ) ) ) ) . 311 [hyper,293, ,308] P ( i ( i i ( x , x ) , y ) . y ) ) . 313 [hyper,290, ,311] P ( i ( i i ( x , i ( y , x ) ) , z ) , z ) ) . 315 [hyper,294, ,313] P ( i ( i ( i ( x , i ( y . y ) ) . z ) . z ) ) . ,315] P ( i 317 [hyper,301, (i( i ( x , i ( y . z ) ) , y ) . y ) ) . ,2] P ( i ( i 319 [hyper,317, (x i ( y . i ( x . z ) ) ) , i ( u . i ( y . i ( x , z ) ) ) ) ) . ,310] P ( i 324 [hyper,310, (x i ( i ( y . i ( y , z ) ) , i ( y , z ) ) ) ) . 326 [ h y p e r , 3 2 4 , 1 , 3 2 4 ] P ( i ( i x , i ( x , y ) ) , i ( x . y ) ) ) .
Subsumption,
a Sometimes Undervalued
Procedure
867
336 342 347 351
[hyper,326,1,204] P ( i ( i ( i ( x , i ( y , z ) ) , i ( u , y ) ) , i ( u , y ) ) ) . [hyper,326,1,187] P ( i ( i ( i ( x , y ) , i ( y , z ) ) , i ( y , z ) ) ) . [hyper,326,1,132] P ( i ( i ( i ( x , y ) , i ( z , i ( y , u ) ) ) , i ( z , i ( y , u ) ) ) ) . [hyper,342,1,2] P ( i ( i ( i ( x , y ) , i ( z , x ) ) , i ( u , i ( z , x ) ) ) ) .
378 380 415 428 432
[hyper,351,1,326] P(i(i(i(x,y),i(z,x)),i(z,x))). [hyper,351,1,229] P(i(x,i(y,i(z,x)))). [hyper,380,1,2] P(i(i(i(x,i(y,i(z,u))),z),i(v,z))). [hyper,415,1,326] P(i(i(i(x,i(y,i(z,u))),z),z)). [hyper,428,1,2] P(i(i(x,i(y,i(z,i(x,u)))),
i(v,i(y,i(z,i(x,u)))))). [hyper,319,1,2] P ( i ( x , i ( i ( y , z ) , i ( i ( i ( z , u ) , y ) , z ) ) ) ) . [hyper,319,1,326] P ( i ( i ( x , i ( y , i ( x , z ) ) ) , i ( y , i ( x , z ) ) ) ) . [hyper,470,1,470] P ( i ( i ( x , y ) , i ( i ( i ( y , z ) , x ) , y ) ) ) . [hyper,474,1,380] P ( i ( i ( i ( i ( x , i ( y , z ) ) , u ) , z ) , i ( x , i ( y , z ) ) ) ) . [hyper,474,1,310] P ( i ( i ( i ( i ( x , i ( y , z ) ) , u ) , i ( y , i ( y , z ) ) ) , i(x,i(y,z)))). 511 [ h y p e r , 4 7 4 , 1 , 1 7 7 ] P ( i ( i ( i ( i ( x , y ) , z ) , i ( i ( y , u ) , y ) ) , i ( x , y ) ) ) . 514 [ h y p e r , 4 7 4 , 1 , 1 2 6 ] P ( i ( i ( i ( i ( x , y ) , z ) , i(i(u,i(y,v)),y)),i(x,y))). 921 [ h y p e r , 2 2 8 , 1 , 2 ] P ( i ( x , i ( i ( i ( y , z ) , u ) , i ( z , u ) ) ) ) . 925 [ h y p e r , 9 2 1 . 1 . 9 2 1 ] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . 930 [ h y p e r , 9 2 5 , 1 . 2 ] P ( i ( x , i ( i ( x , y ) , i ( z , y ) ) ) ) . 939 [ h y p e r , 9 3 0 , 1 , 4 7 4 ] P ( i ( i ( i ( i ( i ( x , y ) , i ( z , y ) ) , u ) , x ) , i(i(x,y),i(z,y)))). 944 [ h y p e r , 9 3 0 , 1 , 2 ] P ( i ( i ( i ( i ( i ( x , y ) , z ) , i ( u , z ) ) , x ) , i ( v . x ) ) ) . 1005 [ h y p e r , 9 4 4 , 1 , 3 2 6 ] P ( i ( i ( i ( i ( i ( x , y ) , z ) , i ( u , z ) ) , x ) , x ) ) . 1009 [hyper,1005,1,514] P ( i ( i ( i ( i ( i ( x , i ( i ( y , z ) , u ) ) , i(y,z)),v),z),i(y,z))). 1196 [ h y p e r , 4 3 2 , 1 , 3 2 6 ] P ( i ( i ( x , i ( y , i ( z , i ( x , u ) ) ) ) , i(y,i(z,i(x,u))))). 2020 [hyper,1009,1,511] P ( i ( i ( i ( x , i ( i ( i ( y , z ) , y ) , u ) ) , i(i(y,z),y)),y)). 2106 [hyper,2020,1,939] P ( i ( i ( x , y ) , i ( i ( i ( x , z ) , x ) , y ) ) ) . 2115 [hyper,2106,1,930] P ( i ( i ( i ( x , y ) , x ) , i ( i ( x , z ) , i ( u , z ) ) ) ) . 2150 [hyper,2115,1,503] P ( i ( x , i ( i ( x , y ) , y ) ) ) . 2151 [hyper,2115,1,485] P ( i ( x , i ( y , i ( i ( x , z ) , i ( u , z ) ) ) ) ) . 2439 [hyper,2150,1,2106] P ( i ( i ( i ( x , y ) , x ) , i ( i ( x , z ) , z ) ) ) . 2460 [hyper,2150,1,474] P ( i ( i ( i ( i ( i ( x , y ) , y ) , z ) , x ) , i ( i ( x . y ) , y ) ) ) . 2509 [hyper,2151,1,925] P ( i ( x , i ( y , i ( i ( i ( z , x ) , u ) , i ( v , u ) ) ) ) ) . 2546 [hyper,2439,1,485] P ( i ( x , i ( y , i ( i ( x , z ) , z ) ) ) ) . 2552 [ h y p e r , 2 4 3 9 , 1 , 2 ] P ( i ( i ( i ( i ( x , y ) , y ) , i ( x , z ) ) , i ( u , i ( x , z ) ) ) ) . 2607 [hyper,2546,1,925] P ( i ( x , i ( y , i ( i ( i ( z , x ) , u ) , u ) ) ) ) . 3233 [hyper,2552,1,326] P ( i ( i ( i ( i ( x , y ) , y ) , i ( x , z ) ) , i ( x , z ) ) ) . 3285 [hyper,3233,1,2607] P ( i ( x , i ( i ( i ( y , i ( i ( x , z ) , z ) ) , u ) , u ) ) ) . 470 472 474 485 503
868
Collected Works of Larry Wos 3288 3290 3335 3339 3379 3618
[hyper,3233,1,2509] P ( i ( x , i ( i ( i ( y , i ( i ( x , z ) , z ) ) , u ) , i ( v , u ) ) ) ) . [hyper,3233,1,2151] P ( i ( x , i ( i ( i ( i ( x , y ) , y ) , z ) , i ( u , z ) ) ) ) . [hyper,3285,1,378] P ( i ( i ( i ( x , i ( i ( i ( y , z ) , u ) , u ) ) , y ) , y ) ) . [hyper,3285,1,336] P ( i ( i ( i ( x , i ( i ( i ( y , i ( z , u ) ) , v ) , v ) ) , z ) , z ) ) . [hyper,3290,1,472] P ( i ( i ( i ( i ( x , y ) , y ) , z ) , i ( x , z ) ) ) . [hyper,3335,1,2460] P ( i ( i ( x , i ( i ( i ( x , y ) , z ) , z ) ) . i(i(i(x,y),z),z))). 5069 [hyper,3288,1,347] P ( i ( i ( i ( x , i ( i ( i ( y , z ) , u ) , u ) ) , v ) , i ( z , v ) ) ) . 5152 [hyper,3339,1,939] P ( i ( i ( x , y ) , i ( i ( i ( z , i ( x , u ) ) , y ) , y ) ) ) . 7789 [hyper,5069,1,939] P ( i ( i ( i ( x , y ) , z ) , i ( i ( i ( u , x ) , z ) , z ) ) ) . 10734 [hyper,3618,1,5152] P ( i ( i ( i ( i ( x , y ) , i ( x , z ) ) , y ) , y ) ) . 10828 [hyper,10734,1,7789] P ( i ( i ( i ( x , i ( i ( y , z ) , i ( y , u ) ) ) , z ) , z ) ) . 11223 [hyper,10828,1,939] P ( i ( i ( x , i ( y , z ) ) , i ( i ( y , x ) , i ( y , z ) ) ) ) . 11723 [hyper,11223,1,2151] P ( i ( i ( x , y ) , i ( x , i ( i ( y , z ) , i ( u , z ) ) ) ) ) . 15438 [hyper,11723,1,3379] P ( i ( x , i ( i ( x , y ) , i ( i ( y , z ) , i ( u , z ) ) ) ) ) . 20335 [hyper,15438,1,1196] P ( i ( i ( x , y ) , i ( i ( y , z ) , i ( x , z ) ) ) ) . 20344 [binary,20335,3] .
Acknowledgments This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38.
References [Bledsoe87] Bledsoe, W. W., private communication (1987). [Chou88] Chou, S. C , Mechanical Geometry Theorem Proving, D. Reidel, Dor drecht, Holland (1988). [Guard69] Guard, J., Oglesby, F., Bennett, J., and Settle, L., "Semi-automated mathematics", Journal of the ACM 16:49-62 (1969). [McCharen76] McCharen, J., Overbeek, R., and Wos, L., "Complexity and re lated enhancements for automated theorem-proving programs", Computers and Mathematics vnth Applications 2:1-16 (1976). [McCune88] McCune, W., unpublished information (1988). [McCune89] McCune, W., unpublished information (1989).
Subsumption, a Sometimes Undervalued Procedure
869
[McCune90] McCune, W., "OTTER 2.0 users guide", technical report ANL90/9, Argonne National Laboratory, Argonne, 111. (1990). [Overbeek75] Overbeek, R., "An implementation of hyper-resolution", Comput ers and Mathematics with Applications 1:201-214 (1975). [Plaisted88] Plaisted, D. A., "Non-Horn clause logic programming without contrapositives", Journal of Automated Reasoning 4, no. 3:287-325 (1988). [RobinsonG69] Robinson, G., and Wos, L., "Paramodulation and theorem-proving in first-order theories with equality", pp. 135-150 in Machine Intelligence, vol. 4, ed. B. Meltzer and D. Michie, Edinburgh U.P., Edinburgh (1969). [RobinsonJ65a] Robinson, J., "A machine-oriented logic based on the resolution principle", Journal of the ACM 12:23-41 (1965). [RobinsonJ65b] Robinson, J., "Automatic deduction with hyper-resolution", In ternational Journal of Computer Mathematics 1:227-234 (1965). [Stickel88] Stickel, M., "A Prolog technology theorem prover: Implementation by an extended Prolog compiler", Journal of Automated Reasoning 4, no. 4:353380 (1988). [Winker79] Winker, S., and Wos, L., "Automated generation of models and counterexamples and its application to open questions in ternary Boolean al gebra", pp. 251-256 in Proceedings of the Eighth International Symposium on Multiple-Valued Logic, IEEE and ACM, Rosemont, 111. (1978). [Winker81] Winker, S., Wos, L., and Lusk, E., "Semigroups, antiautomorphisms, and involutions: A computer solution to an open problem, I", Mathematics of Computation 37:533-545 (1981). [Wos65] Wos, L., Robinson, G., and Carson, D., "Efficiency and completeness of the set of support strategy in theorem proving", Journal of the >4CA/12:536-541 (1965). [Wos67] Wos, L., Robinson, G., Carson, D., and Shalla, L., "The concept of demodulation in theorem proving", Journal of the ACM 14:698-709 (1967). [Wos73] Wos, L., and Robinson, G., "Maximal models and refutation complete ness: Semidecision procedures in automatic theorem proving", pp. 609-639 in Word Problems: Decision Problems and the Burnside Problem in Group Theory, ed. W. Boone, F. Cannonito, and R. Lyndon, North-Holland, New York (1973). [Wos83] Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., "Ques-
870
Collected Works of Larry Wos
tions concerning possible shortest single axioms in equivalential calculus: An application of automated theorem proving to infinite domains", Notre Dame Journal of Formal Logic 24:205-223 (1983). [Wos84a] Wos, L., Veroff, R., Smith, B., and McCune, W., "The linked inference principle. II: The user's viewpoint," pp. 316-332 in Proceedings of the Seventh International Conference on Automated Deduction, vol. 170, Lecture Notes in Computer Science, ed. R. E. Shostak, Springer-Verlag, New York (1984). [Wos84b] Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., "A new use of an automated reasoning assistant: Open questions in equivalential calculus and the study of infinite domains", Artificial Intelligence 2:303-356 (1984). [Wos85] Wos, L., "Automated reasoning," American Mathematical Monthly 92:8592 (1985). [Wos87] Wos, L., Automated Reasoning: S3 Basic Research Problems, PrenticeHall, Englewood Cliffs, N.J. (1987). [Wos88] Wos, L., and McCune, W. W., "Searching for fixed point combinators by using automated theorem proving: A preliminary report", technical report ANL-88-10, Argonne National Laboratory, Argonne, 111. (1988). [Wos89] Wos, L., and McCune, W., "Automated theorem proving and logic programming: A natural symbiosis", Journal of Logic Programming (to appear).
APPLICATIONS OF AUTOMATED REASONING LARRY WOS
1
A BEGINNING Less than 25 years ago, mathematicians and computer scientists gen erally believed there was only a remote possibility of designing a com puter program to reason in the sense that scientists use the word. The obstacles of representing the problem to the program, of formulating sufficiently general ways of reasoning, and of devising strategies to adequately control the reasoning so that the program would function effectively appeared truly formidable. However, because of the po tential value of successfully overcoming these obstacles, studying the possibility of having a computer reason was adopted as a long-range mathematical research area (Wos, 1987b).
In this chapter, using the quote above as the beginning, we shall focus on the rest of the story—a story that tells how the field of automated reasoning was founded, why it was extended, and what caused it to grow to maturity. In addition, we shall focus on various successes of this field, giving an up-to-date account of the kinds of assistance that a reasoning program can provide. The successful applications of automated reasoning include program verification, cir cuit design and validation, assembly line scheduling, and programming language (combinatory logic). To complete the picture, we shall also provide a rather ex tensive introduction to the elements of automated reasoning, a discussion of the obstacles still to be overcome, and a brief treatment of what the future offers. Since portable automated reasoning programs (discussed in Section 7) are now available—programs that in fact run on personal computers—and since an easyto-read book (Wos et al., 1984) exists that discusses in detail the way reasoning Reprinted with permission from Knowledge Engineering, Vol. II: Applications, ed. H. Adeli, McGraw-Hill, New York, 1990, pp. 56-83.
872
Collected Works of Larry Wos
programs work and the successes achieved with their assistance, and another book (Wos, 1987a) offers specific research problems to solve, we conjecture that the future of automated reasoning is limited only by the time and energy that will be devoted to it.
1.1
The Objective of Automated Reasoning
The explicit objective of the field of automated reasoning is to design and imple ment a computer program that reasons logically and effectively. To possess each of these two vital properties—being logical and being effective—the program must have access to a variety of procedures. Although we shall discuss these procedures more fully in Section 2, let us briefly touch on them here. To reach the objective of automated reasoning requires specific inference rules, ways of reasoning, that are sound. An inference rule is sound if its appli cation always yields a conclusion that follows inevitably from the hypotheses to which the rule is applied. Without sound inference rules, the program cannot reason logically. However, sound ways of reasoning are not enough. Indeed, to be effective, a reasoning program must also rely on the use of strategy. If strategy is not employed—to restrict the reasoning, and also to direct the reasoning—the pro gram will draw entirely too many conclusions in most situations. An effective reasoning program must also rely on the use of rules—supplied by the user or found by the program itself—for rewriting information into the desired canonical form. Without such rules, called demodulators (Wos et al., 1967), a reasoning program will perform too poorly in most cases. The poor performance arises from the myriad of ways a fact or relationship can be stated. Finally, to be effective, a reasoning program must employ some means for discarding infor mation that is captured by existing information; the procedure subsumption (Robinson, 1965) suffices. Since attempting to reach the objective of having access to a computer pro gram that reasons both logically and effectively might indeed be a formidable task—which was the opinion of scientists in the early 1960s—one might naturally ask for a practical justification for making such an attempt. The justification rests with the fact that one can easily list problems that would be very difficult to solve, or impossible to solve, without the power that a computer offers. Of course, because of the typical use of a computer, the problems one might think of first are numerical in character. However, with a little extra thought, if an appropriately powerful reasoning program were available, one can quickly sug gest problems requiring deep reasoning, problems not only from mathematics and logic but also from the areas of program verification, circuit design, and real-time systems control. We thus have our practical justification—the desire to have access to an automated reasoning assistant and, if all goes as planned, access to an automated reasoning colleague.
Applications of Automated Reasoning
1.2
873
The History of Automated Reasoning
The main effort directed toward producing a program that could reason logically was begun in the early 1960s at a small number of universities and laboratories. Each of these separate efforts focused on the area now known as automated theorem proving. As the name suggests, the essentially sole application in the early 1960s was that of proving theorems from various areas of mathematics and logic. The early programs, as one might expect, were unable to prove even the simplest of theorems. Nevertheless, some of the ideas on which those early programs were based did lead indirectly to important breakthroughs. One of the groups that became interested in the area early in the game was based at Argonne National Laboratory. Using the problem of proving elementary theorems from algebra as a test application, researchers focused simultaneously on the formulation of strategies to control reasoning and the design of a com puter program to reason subject to those strategies. In fact, it was this research that introduced the notion of strategy to the field then known as mechanical theorem proving. The introduction of strategy changed the entire course of this area of computer science. The first program that resulted from that early re search proved to be far more powerful than any other program available at the time, and for years to come. Proofs of algebraic theorems from group theory and ring theory, two areas of abstract mathematics, were obtained in seconds with the Argonne program on an IBM704, in contrast to being unprovable with other programs. Fifteen years of research beyond that initial effort—years dedicated to ex tending the power of "automated theorem-proving" programs—culminated in 1980 with the introduction of the name "automated reasoning" and in the de sign and implementation of even more powerful automated reasoning programs. The name was introduced because no longer were reasoning programs essentially confined to proving theorems from mathematics. Such programs were being used for model generation, conjecture formulation, and hypothesis testing. The areas of application, originally mathematics and logic, had expanded to include pro gram verification, circuit design and validation, robotics, and organic chemical synthesis. Those 15 years of research, in addition to producing very powerful reasoning programs, also produced a number of very effective strategies and related pro cedures. Many of those strategies (for example, the set of support strategy) and procedures (for example, paramodulation and demodulation) have been adopted as fundamental features by other program developers in the rapidly expanding field of automated reasoning. Some of these deceptively simple strategies direct the reasoning effectively, while—even more important—others restrict the rea soning to paths relevant to the given assignment. The objectives of the various types of strategy are to cause the reasoning programs to give first priority to expressions with the least complexity, to focus on the more pertinent informa tion about a problem rather than general background information, to retain
874
Collected Works of Larry Wos
more general conclusions in preference to more limited information, and to au tomatically produce and use a simplified form of each conclusion that is drawn. Without these strategies, reasoning programs will typically wander aimlessly through an enormous set of possible conclusions and, after far too much time, usually fail. For example, in problems from abstract algebra and set theory, a program without the set of support strategy can draw 20,000 conclusions yet fail to find a solution; but with the strategy, a program may draw only 200 conclusions before solving the given problem. The final occurrence or, technically, set of occurrences we cite in the his tory of automated reasoning—the occurrence that brought the field to some maturity—concerns an unexpected success. Before this occurrence, with one ex ception, automated reasoning programs had not contributed new information to science. However, between 1978 and 1982, with heavy assistance from an au tomated reasoning program, open questions were answered. Even further, the questions were taken from three unrelated areas: ternary Boolean algebra, fi nite semigroups, and equivalential calculus. To have obtained the answers with an automated reasoning program marked a significant point in the history of automated reasoning. Indeed, the success with answering open questions was resumed in 1986, and still continues, in the field of combinatory logic. When in later sections we turn to applications of even greater interest, one might keep in mind that, were it not for those significant achievements at the end of the 1970s and during the early 1980s, perhaps the needed zeal to attack the other applications would have been lacking.
2
A REVIEW OF AUTOMATED REASONING
At this point, to provide readers with a feel for the subject, we turn to a rather extensive review of some of the pertinent aspects of automated reasoning, and show how an automated reasoning program can provide valuable assistance for various types of research. The elements to be covered in this review are repre sentation of information (by use of the clause language), reasoning (the specific inference rule binary resolution and the specific inference rule paramodulation for building in equality), strategies (including the set of support strategy) of various types for controlling the reasoning, a procedure (demodulation) for rewriting in formation into a canonical form, a procedure (subsumption) for discarding trivial corollaries, and a means (proof by contradiction) for the program to determine that the given assignment has been completed. For a more complete treatment, see Wos et al. (1984). As the name implies, automated reasoning focuses on the formulation and implementation of techniques that permit a computer program to reason. Al though not implied by the name, the reasoning of main interest is logical in character. Even though automated reasoning programs have uses that do not focus on proof finding, the main use is in fact that of finding a proof. Of the
Applications of Automated Reasoning
875
applications for automated reasoning, that which has produced the greatest suc cess concerns proving some theorem from mathematics or logic. Nevertheless, when we turn to a detailed discussion of applications, as we do in later sections, we shall focus on applications outside of mathematics and logic. However, at this point in the chapter—to avoid the continual addition of qualifying remarks—we shall talk mainly about theorems, noting that the observations we make natu rally extend to problems and questions other than those that focus on proving some theorem. The fields of mathematics from which a theorem may be taken include al gebra, geometry, topology, set theory, and combinatory logic. The most widely used approach for proving theorems, or for solving any problem or answering any question, with a reasoning program focuses on searching for a proof by con tradiction. Therefore, to enable a program using such an approach to attempt to prove a proposed theorem of the form if P then Q, one is required to define the field from which the theorem is taken, to give the special hypothesis (defined in Section 2.6) of the theorem, and to assume that the theorem is in fact false. If one is having a reasoning program attempt to answer some question whose form is not that of a theorem, then, predictably, one assumes that the desired answer is false and has the program seek a proof by contradiction. (In those cases in which one is not able to suggest an answer or prefers not to, the program can be used to draw conclusions that follow from the statement of the question, and the user can search among them for the desired answer.) To fulfill the requirement of setting the stage for seeking a proof by contradiction—whether attempting to prove a theorem or to answer a question—one writes a set of statements of the form P and (not Q), where P corresponds to the axioms of the underlying theory, the special hypothesis of the theorem, and any lemmas one might wish to supply, and where Q corresponds to the conclusion of the theorem. This set of statements is then given to the automated reasoning program in use, which applies logical reasoning in an attempt to complete the assignment of finding a proof by contradiction. To reason logically—and thus begin its attack on the given problem—the reasoning program draws conclusions by applying one or more sound inference rules chosen by the researcher. The application of each rule is directed by one type of strategy and restricted by another type. When a conclusion is drawn, the program rewrites it into a canonical form by applying rules [demodulators (Wos et al., 1967)] supplied by the researcher or discovered by the program. The result is then tested [with the use of subsumption (Robinson, 1965)] to see whether it is a trivial corollary of information the program already has and should therefore be discarded. The result can also be tested to see whether it satisfies criteria, supplied by the researcher, for measuring significance; if the conclusion fails the test, it is discarded. The goal is to deduce some new conclusion that contradicts a conclusion drawn earlier or contradicts some input statement. When such a discovery is made, a proof by contradiction has been found, and the automated reasoning program in use "knows" that the given
Collected Works of Larry Wos
876
assignment has been completed. Using the preceding summary of the program's actions as an outline for this section, let us sample each of the main areas, beginning with a discussion of how one specifies the problem to be considered.
2.1
Representation
In this section, we mainly use the notation that is consistent with that found in Wos et al. (1984) and in Wos (1987a), one that is an acceptable notation for the formal language—the clause language—most commonly used. Without doubt, the various languages of mathematics and logic are usually easier to read than the clause language. However, since one of our objectives is to introduce automated reasoning to mathematicians, logicians, and other scientists, we shall provide a limited treatment of the clause language, the language in which one usually converses with a reasoning program. Our first example will be a de ductive database query, and then we shall turn to ordinary arithmetic for our next examples to show how a reasoning program can treat equality as if it is "understood". The conventions require variables to be chosen from among terms whose first symbol is one of lowercase u through z, functions and constants to be written in lower case, and relations (predicates) to be written in upper case. Also by convention, each variable is implicitly universally quantified (meaning "for all"), and each variable is relevant only to the clause in which it occurs. In addition, by writing EQUAL for the equality relation, the program is able to treat equality as "understood" or "built in". Finally, the symbol - means not, and the vertical bar symbol | means or. For the statements in which or occurs, the expressions separated by | are called literals. As we shall see, existence is not represented with variables; but, instead, appropriate functions and constants are employed. In addition, we shall see that the logical operator and never occurs within a clause and is always assumed to be present implicitly between clauses. As for the operator if-then, its place is taken by the use of not and or, using the equivalence of if P then Q to not P or Q. Let us now turn to some examples. We begin with an example that is representative of a trivial database query but that is also a very simple puzzle to solve. Roberta, who is unmarried, has the job of teacher or nurse, and the job of nurse is held by a male. What is Roberta's job? A question of this type often contains hidden information. For example, people are female or male, and husbands are male, and Roberta is female. To submit the given question to an automated reasoning program, one typically selects a possible answer and assumes that the answer is false. This action sets the stage for the program to seek a proof by contradiction. Let us take the correct answer, Roberta is a teacher, and assume that she is in fact not one. The following clauses suffice.
Applications of Automated Reasoning
877
Roberta is assumed not to be the teacher (1) -HASAJOB(Roberta,teacher) Roberta is a teacher or a nurse (2) HASAJOB(Roberta,teacher) I HASAJOB(Roberta,nurse) The job of nurse is held by a male (3) -HASAJOB(x,nurse) I MALE(x) Everyone is not female or not male (4) -FEMALE(x) | -MALE(x)
Roberta i s female (5) FEMALE(Roberta) We shall return to this simple puzzle when we study inference rules in Section 2.2, and again when we study proof by contradiction in Section 2.6. Now let us turn to examples from ordinary arithmetic. To express the fact that 0 +x = x for all x, we write EQUAL(sum(0,x),x) where x is treated implicitly as a universally quantified variable ranging over all numbers and 0 is treated as a constant; formally, 0 is a Skolem constant. To express the existence of an additive (right) inverse, for all x there exists a y such that x + y = 0, we write the clause EQUAL(sum(x,minus(x)),0) where x implicitly ranges over all numbers and where minus is an appropriate Skolem function. A Skolem constant is used for expressing the existence of some element that does not depend on the universally quantified variables—for example, there ex ists a y such that for all x, y + x = z, which is, of course, closely related to the earlier example regarding 0. A Skolem function is used for existentially quan tified variables that do depend on other universally quantified variables—for example, for all x there exists a y such that x + y = 0. A Skolem constant names the element in question, and a Skolem function names a function and, by its arguments, expresses the appropriate dependence. The respective equiva lents, given earlier in which the predicate EQUAL occurs, of the two arithmetic laws are called clauses.
Collected Works of Larry Wos
878
2.2
Inference Rules
A general-purpose reasoning program offers a wide variety of inference rules. We shall focus on two of them in this chapter. The first, binary resolution (Robin son, 1965), is in an important sense the least complicated to apply; the second, paramodulation (Robinson and Wos, 1969; Wos and Robinson, 1973), is the most complicated to apply, at least for a person. Paramodulation enables an automated reasoning program to treat equality as if it is "understood" in the sense that no axioms other than reflexivity (x = x) need to be included when a problem is submitted for consideration. In particular, when paramodulation is applied to two clauses satisfying the appropriate conditions, a conclusion is obtained in the spirit of equality substitution. Actually, as we shall see, paramod ulation generalizes the usual notion of equality substitution. For the actions of binary resolution and paramodulation to be easily un derstood, we need one concept, that of unification (Robinson, 1965; Wos et al., 1984; Wos, 1987a). This concept is also required for other aspects of automated reasoning presented later in this section. To unify two expressions, the program must find terms to replace the vari ables in each such that the two resulting expressions are identical (possibly with the exception of sign). When unification is applied to two expressions that are both clauses, the program always treats the two expressions as having no vari ables in common; the program is allowed to take this action because a variable is relevant only to the clause in which it occurs. The most general replacement for variables is always preferred, as evidenced in the third example of paramod ulation to be given shortly. The object is to maintain generality where possible, which adds markedly to the efficiency of the reasoning program. An automated reasoning program's preference for generality is but one dif ference between computer-oriented and person-oriented reasoning. In particular, since people often prefer to use a specific instance of a general fact rather than the fact itself, we see that a typical reasoning program does not usually reason as a person does. Paramodulation, as we shall see, is an excellent example of the kind of reasoning used by reasoning programs that can hardly be said to imitate a person's reasoning. On the other hand, for the kind of reasoning a person often uses but that a typical reasoning program does not, we can turn to that area of mathematics known as group theory. For example, where the identity of a group is denoted by c, the reasoning that permits deducing (yz)(yz) = e from the hypothesis that xx = e is not used by such programs, although such reasoning is quite typical of math ematics. The view of many experts in the field of automated reasoning is that using this type of reasoning, called instantiation, would markedly decrease the efficiency of reasoning programs, even though mathematicians obviously use it very effectively.
Applications
of Automated
Reasoning
879
Because unification is at the heart of so much of what occurs in an auto mated reasoning program, and because an understanding of the inference rule paramodulation does not come easily, let us first give an example of the infer ence rule binary resolution to illustrate unification and prepare the way for the discussion of paramodulation. As promised, we can use the simple puzzle given in the preceding section for our illustration, focusing on clauses (4) and (5). Everyone i s n o t female or n o t male (4) -FEMALE(x) I -MALE(x) R o b e r t a i s female (5) FEMALE(Roberta) From the two statements to which clauses (4) and (5) correspond, one can obviously conclude that Roberta is not male. A reasoning program can reach the same conclusion by applying binary resolution to clauses (4) and (5). To do so, the program unifies the first literal in clause (4) with the only literal in clause (5)—which it does by uniformly replacing the variable x in clause (4) by Roberta—and cancels the literal in clause (5) with the replaced literal in clause (4). The resulting conclusion -MALE(Roberta) is obtained. 2.2.1 P A R A M O D U L A T I O N D E F I N E D W I T H E X A M P L E S . Rather than giving a formal definition of paramodulation, we shall, as in the preced ing section, rely on examples. The first example illustrates the use of the sim plest and most familiar form of equality substitution. The second illustrates a slightly more complex form of substitution in that variables occur in one of the hypotheses. The third example, substantially more complex, is by far the most interesting, for it shows how paramodulation generalizes the standard notion of equality substitution. For the first example, paramodulation applied to both the equation a + (—a) = 0 and the statement a + (—a) is congruent to 6 yields in a single step the conclusion or statement 0 is congruent to 6. In clause form, from EQUAL(sum(a,minus(a)),0) into CONGRUENT(sum(a,minus(a)),b) one obtains the clause CONGRUENT(O.b)
Collected Works of Larry Wos
880
by paramodulation. For the second example, since variables such as x mean "for all", one can show that the following example of equality-oriented reasoning is logically correct— logically sound. Paramodulation applied to both the equation a + (—a) = 0 and the statement x + (—a) is congruent to x yields in a single step the conclusion or statement 0 is congruent to a. In clause form, from EQUAL(sum(a,minus(a)),0) into CONGRUENT(sum(x,minus(a)),x) the clause CONGRUENT(0,a) is obtained. This example illustrates some of the complexity of paramodulation; in particular, the second occurrence of the variable x in the into clause becomes the constant a in the conclusion, but the term containing the first occurrence of x becomes the constant 0 in the conclusion. Although the unification of the first argument of the from clause with the first argument of the into clause temporar ily requires both occurrences of the variable x to be replaced by the constant a, paramodulation then requires an additional term replacement justified by equal ity substitution. In particular, in this second example, paramodulation requires the replacement of a + (—a) by 0. Finally, for the third and complex example, paramodulation applied to both the equation x + (—x) = 0 and the equation y + (—y + z) = z yields in a single step the conclusion y + 0 = — (—y). In clause form, from EQUAL(sum(x,minus(x)),0) into EQUAL(sum(y,sum(minus(y),z)),z) the clause EQUAL(sum(y,0).minus(minus(y))) is obtained by paramodulation. To see that this last clause is in fact a logical consequence of its two par ents, one unifies the argument sum(a;,minus(a;)) with the term sum(minus(j/),z), applies the corresponding substitution to both the from and into clauses, and then makes the appropriate term replacement justified by the typical use of equality. The substitution found by the attempt to unify the given argument and given term requires substituting minus(y) for x and minus(minus(j/)) for z. To prepare for the (standard) use of equality in this third example, a nontrivial substitution for variables in both the from and the into clauses is required,
Applications of Automated Reasoning
881
which illustrates how paramodulation generalizes the usual notion of equality substitution. In contrast, in the standard use of equality substitution, one does not apply a nontrivial replacement for variables in both the from and the into statements. Summarizing, a successful use of paramodulation combines in a single step the process of finding the (in an obvious sense) most general common domain for which both the from and the into clauses are relevant and applying standard equality substitution to that common domain. The complexity of this inference rule rests in part with its unnaturalness if viewed from the type of reason ing people employ, in part with the fact that the rule is permitted to apply nontrivial variable replacement to both of the statements under consideration, and in part with the fact that different occurrences of the same expression can be transformed differently. As an illustration of the third cited property, in the third example of paramodulation, the (term containing the) first occur rence of z is transformed to 0, but the second occurrence of z is transformed to minus(minus(j/)). 2.2.2 THE POWER OF PARAMODULATION. A single application of paramodulation can lead to the deduction of an interesting conclusion that the usual mathematical reasoning requires more than one step to yield. In contrast to paramodulation, the mathematician or logician picks the instances—the sub stitutions of terms for variables—that might be of interest and then applies (the usual notion of) equality substitution. Paramodulation, on the other hand, picks the (maximal) instances of the from and into clauses automatically and, rather than deducing intermediate conclusions by applying the corresponding replacement of terms for variables, instead combines the instance picking with a standard application of equality substitution. Avoiding the retention of inter mediate conclusions can contribute markedly to the performance of a reasoning program. The instances that a person chooses may be far less general than those chosen by the reasoning program in its attempt to apply paramodula tion. As a result, the program may deduce a conclusion that is far more general than a person might deduce. Again the program benefits, for its efficiency of ten increases by having access to general conclusions rather than specific ones; people do not require such generality in most cases. Summarizing, the infer ence rule instantiation—replacing variables by terms in a statement to deduce a corollary—is frequently used, and used wisely, in mathematics and logic. In stantiation is not an inference rule offered by the typical reasoning program, for no known strategy exists for wisely choosing appropriate instances even though mathematicians and logicians do have that ability. To give a second illustration of the power offered by paramodulation—if combined with a procedure (demodulation) used by reasoning programs to sim plify expressions—we consider the following example so typical of mathematics. In the example, the conclusion that is reached with a string of equalities—if one applies the usual type of reasoning that occurs in mathematics—is drawn by a
882
Collected Works of Larry Wos
reasoning program in a single deduction step. z = 0 + z=(x + (-x)) + 2 = x + ((-x) + z) This string of equalities comprises a proof of an obvious but useful lemma in arithmetic and in group theory, the lemma that asserts the equality of the first and last expressions in the string of equalities. In clause notation, we have that from right inverse EQUAL(sum(x,minus(x)),0) into associativity EQUAL(sum(sum(u,v),z),sum(u,sum(v,z))) the program can deduce EQUAL(sum(0,z),sum(x,sum(minus(x),z))) which it can then automatically simplify (see Section 2.4) to EQUAL(z,sum(x,sum(minus(x),z))) without producing any intermediate results.
2.3
Strategy
Since, from the preceding section, we know that an automated reasoning pro gram has access to individual inference rules, such as paramodulation, that combine a number of mathematical reasoning steps into one step, the need for strategy to control such reasoning may be puzzling. However, when one discov ers that, from certain single axioms in combinatory logic, 16 conclusions can be drawn by applying paramodulation, then the puzzlement quickly disappears. In particular, the axiom for the combinator W with {Wx)y = (xy)y is just such an axiom. One can imagine how many additional conclusions would be drawn were we to continue reasoning by focusing on pairs of those 16 con clusions, which comprise the first generation of descendants of W with itself, and then reason by focusing on the second generation. To avoid the flood of conclusions that can result if reasoning is uncontrolled, an automated reason ing program can use various types of strategy. On the one hand, some types of strategy are designed to direct the reasoning; on the other hand, some types are designed to restrict it. Prom a different perspective, some types of strategy are general in the sense that they apply to all inference rules, and others are specific in the sense that they apply to only a single inference rule. Of those of a general nature, the most powerful restriction strategy that an automated reasoning program can use is called the set of support strategy (Wos et al., 1965). That strategy restricts the program's reasoning with the intention of sharply retarding the generation of irrelevant conclusions. To use the set of
Applications of Automated Reasoning
883
support strategy, one is required to choose a subset T of the set S of clauses given to the program to describe the problem to be studied. The program then draws a conclusion only if it is recursively traceable to T. Therefore, at the beginning of the program's attack on a problem (from a procedural viewpoint) an inference rule is applied to a pair of clauses from S only if at least one of them is in T. Any clause that is retained is automatically given the power of the clauses that are members of T. For example, an inference rule can be applied to a pair of clauses if one of them is a clause not in S. Stated another way, with the set of support strategy, the program is not allowed to apply an inference rule to a pair of clauses that are both in S — T. Of those of a specific nature—in addition to the set of support strategy, which can be used to restrict the application of any inference rule—an automated reasoning program can also use a number of strategies designed with the express purpose of restricting the application of paramodulation. First, the program can be restricted from paramodulating from or into a variable. This restriction prevents a myriad of conclusions from being drawn. Such a restriction strategy is, in most cases, mandatory. After all, paramodulating from or into a variable will always yield a conclusion, because the corresponding unification can never fail. Second, the program can be required to paramodulate only from a specified side of each equality. In some cases, all applications of paramodulation are required to be from the left side only; in others, all are required to be from the right only.
2.4
Demodulation
The next topic for this review of automated reasoning is that of canonicalization, which is available to automated reasoning programs through the use of demodulation (Wos et al., 1967). In many areas of mathematics and logic, one often rewrites each new item of information into a canonical form. In auto mated reasoning, a similar action can occur. A sharp difference, however, exists between mathematics and automated reasoning. In the former, one uses canonicalization when it seems convenient and appropriate. In the latter, one cannot in most cases exercise such freedom, because, if each conclusion is not required to be automatically rewritten into a canonical form, the program will drown in information. Of course, some conclusions will be unaffected by the particular choice of demodulators (Wos et al., 1967) in a given problem. One other difference exists between the use of canonicalization by a math ematician or logician and its use by a reasoning program. When a person uses various equalities for canonicalization, the equalities are applied only to the expressions chosen by the person; when a program applies such equalities, all expressions to which the equalities are applicable are in fact rewritten into a canonical form. Now, let us examine some typical uses of canonicalization. One might, for example, uniformly replace -(—t) by t for any term t, or replace r(s+t) by rs+rt for terms r, s, and t. For such term replacements, many
884
Collected Works of Larry Wos
automated reasoning programs offer the mechanism demodulation, referred to earlier, which automatically rewrites expressions into a canonical form based on some set of rewrite rules called demodulators. The demodulators can be included among the input clauses, or the program can be asked to find potentially useful ones. For the two given examples, the demodulators EQUAL(minus(minus(x)),x) and EQUAL(prod(x,sum(y,z)),sum(prod(x,z),prod(y,z)))
can be used, respectively. As one might predict, care must be taken in the choice of which equality clauses to attempt to use as demodulators. In particular, an unwise choice can cause the program to loop. To see how looping can occur, let us consider what will happen when the equation for W is used as a demodulator and when the program encounters a term of a certain type. In particular, when the clause (W)
EQUAL(a(a(W,x),y),a(a(x,y),y))
is used as a demodulator and the term WWW is encountered, this term will be transformed to itself repeatedly without ever terminating. For a more interesting example, let us consider the expression T = o(o(W, a(B, x)), a(W, a(B, x))) and what occurs when the two demodulators (W)
EQUAL(a(a(W,x),y),a(a(x,y),y))
(B)
EQUAL(a(a(a(B l x),y),z),a(x,a(y,z)))
and
are applied to T with the object of producing a canonical form. Demodulation begins by successfully applying W, then B, to obtain
a(x,r) which leads to another successful application of W followed by B to obtain a(x, a(x, T)) which of course leads to yet another success and, in fact, to a nonterminating sequence of successful applications of W and B. Nevertheless, as long as one is careful about the choice of demodulators, the use of demodulation can sharply increase the effectiveness of a reasoning program in its search for assignment completion. Even further, for many studies, without the use of demodulation the program will simply require an inordinate amount of computer time to complete rather simple assignments.
Applications of Automated Reasoning
2.5
885
Subsumption
We now come to the next-to-the-last topic of this section, a mechanism that is almost always essential for a reasoning program to be effective. Although the use of various types of strategy does indeed contribute markedly to the efficiency of an automated reasoning program, such a program continues to deduce conclusions that are trivial and unneeded corollaries of existing clauses. For example, if the program paramodulates from the second argument of the clause equivalent of (Wx)y = (xy)y into the first subargument of the second argument of the clause equivalent of {W{Wx))y = ((xy)y)y the program deduces the clause equivalent of {W{Wx))y = {{Wx)y)y which is a trivial corollary, in fact an instance, of {Wx)y = (xy)y and is therefore immediately discarded. The procedure for discarding such de ductions is subsumption (Robinson, 1965). The clause A subsumes the clause B if there exists a uniform replacement of terms for variables in A that produces a clause that is a subclause of B. For a second example of subsumption, an example that might not be ex pected, let us consider the two clauses P(x)
I
P(y)
and P(x) and recall that a variable is relevant only to the clause in which it occurs. That the second clause subsumes the first follows immediately from the definition of subsumption. However, as it turns out, the first also subsumes the second, as can be seen by replacing y by x in the first to produce P(x) since a clause, by definition, does not allow duplicate literals; technically, a clause is defined as a set of distinct literals. As an aside, if we wished to have our program use instantiation as an inference rule to permit the program to imitate the corresponding type of reasoning (discussed in Section 2.2) that is often used in mathematics, we would be forced to protect the instances that were deduced so that subsumption would not immediately discard them. Of especial use is the role of subsumption for removing clauses that assert the equality of a term with itself; such an assertion is, needless to say, usually of little interest and seldom useful. To remove such trivial clauses, the clause EQUAL(x,x)
886
Collected Works of Larry Wos
for reflexivity of equality subsumes many clauses that would otherwise be kept. This clause, which must be included in the input if paramodulation is the chosen rule of inference, is also important in that a proof often terminates with the deduction of a clause of the form -EQUAL(t,t) for some term t.
2.6
Proof by Contradiction
In keeping with the introductory nature of this chapter, we give only a simple proof by contradiction. For far more interesting examples of such proofs, we recommend the two books cited earlier (Wos et al., 1984; Wos, 1987a). For our example, we return to the trivial puzzle. Roberta, who is unmarried, has the job of teacher or nurse, and the job of nurse is held by a male. What is Roberta's job? An automated reasoning program can solve this puzzle by being given the as sumption that asserts that the correct answer is in fact false. The inference rule binary resolution suffices for finding a proof by contradiction. A Proof by Contradiction (1) (2)
-HASAJOB(Roberta,teacher) HASAJOB(Roberta,teacher) I HASAJOB(Roberta,nurse) (3) -HASAJOB(x,nurse) I MALE(x) (4) -FEMALE(x) I -MALE(x) (5) FEMALE(Roberta) from (1) and (2), canceling two literals, (6) HASAJOB(Roberta,nurse) from (6) and (3), uniformly substituting Roberta for x and canceling two literals, (7) MALE(Roberta) from (7) and (4), uniformly substituting Roberta for x and canceling two literals,
(8) -FEMALE(Roberta) Clause (8) contradicts clause ( 5 ) , and the proof by contradiction i s complete. In addition to providing a specific example of proof by contradiction, the given proof also illustrates the use of strategy. In particular, this same proof would be found by an automated reasoning program using the set of support strategy in one of the recommended ways. One recommendation for the use of
Applications of Automated Reasoning
887
this strategy is to select for the set of support those input clauses that correspond to the union of the special hypothesis and the denial of the conclusion. By definition, the special hypothesis is the information (if any) that is added, to the underlying axioms and to the lemmas that are supplied, to form the hypothesis of the theorem. In other words, when a theorem is of the form if P t h e n Q, the special hypothesis (if any) is that part of P that remains after one ignores the axioms of the underlying field and all lemmas that have been supplied. In this simple puzzle, no special hypothesis exists, and the denial of the conclusion— the assumed false answer to the question—is represented with clause (1) only. A quick glance at the given proof shows that at no point is binary resolution applied to two clauses that are both from the input clauses, if clause (1) is ignored. Put another way, the entire proof is recursively traceable to clause (1), the only clause in the set of support when the program begins its attack on the question. We have completed our review of automated reasoning. Therefore, we now turn to some of the applications of the field. As we shall see, an automated reasoning program has provided valuable assistance in a number of ways and in a number of areas.
3
PROGRAM VERIFICATION
Of the frequently cited applications of automated reasoning, we have received the greatest satisfaction from proving theorems in mathematics and logic. Never theless, many believe that program verification is the application that will have the greatest impact. To define program verification, we quote Boyer and Moore (1985): "Computer programs may be regarded as formal mathematical objects whose properties are subject to mathematical proof. Program verification is the use of formal, mathematical techniques to debug software and software spec ifications." (The article from which this quote is taken provides an excellent introduction to program verification and other applications of automated rea soning.) Given the incentive for applying automated reasoning to the proof that com puter programs satisfy the claims made for them—the application we refer to as program verification—one is immediately presented with two sharply opposite possibilities. On the one hand, since computer programs can be large, com plicated, and highly disorganized, one might conjecture that, in general, it will never be possible to produce formal proofs establishing that computer programs fulfill their claims. On the other hand, in view of Boyer and Moore's quoted po sition, since automated reasoning programs have already succeeded in proving theorems that are clearly difficult to prove, one might conjecture that program verification is indeed a viable application. Fortunately, to resolve the debate, we need not be content with mere specu lation. Instead, we can cite a number of successes with existing algorithms and
888
Collected Works of Larry Wos
computer codes. Because of the impressiveness of some of these achievements, because of the obvious sharp increase in the power of automated reasoning programs, and because of the trend toward carefully written computer pro grams, we are now certain that program verification is far more than a viable application. To support this position, let us turn to specific successes. Some of these achievements are sufficiently impressive that we are convinced that, as the power of reasoning programs grows and as the style of computer programming improves, the interest in and the number of successes with automated reasoning will increase sharply. Of the various efforts focusing on using an automated reasoning program for program verification, that of Boyer and Moore deserves the most acclaim. Their approach was to design and implement a program whose main purpose is in fact to verify algorithms and computer code. They refer to their program as a theorem prover, simply because its use is based on proving one theorem after another. The theorems submitted to the Boyer-Moore program (Boyer and Moore, 1979) are obtained from the attempt to prove that some given algorithm fulfills its intended purpose or from the attempt to prove that some given computer program satisfies the claims made for it. As the following list of successes shows, Boyer and Moore have indeed designed a powerful program, a program that demonstrates that automated reasoning can be and has been most useful for program verification. Among the theorems proved by the Boyer-Moore theorem prover are the invertibility of the Rivest, Shamir, and Adleman public key encryption algorithm (Boyer and Moore, 1984), the soundness and completeness of a propositional calculus decision procedure, the soundness of an arithmetic simplifier (actually used in their program), the termination of Takeuchi's function, and the cor rectness of many elementary list and tree processing functions. They have also used their program to prove properties of many recursive functions. The BoyerMoore theorem-proving program has also been used successfully to prove the correctness of various Fortran programs—more precisely, to prove the verifica tion conditions for such programs. Among the Fortran programs proved correct are a fast string-searching algorithm, an integer square root algorithm using Newton's method, and a linear-time majority vote algorithm. These programs are each relatively small, requiring no more than a page of code. Nevertheless, the correctness arguments are fairly deep. If, in contrast to the small Fortran programs that we have just cited, one wishes examples of rather larger programs that have been verified, they can be found among the successes obtained with two other reasoning programs. The two systems—the Stanford Verifier by David Luckham (Igarashi et al., 1973) and his students at Stanford University and the Gypsy Verification Environment by Don Good (1982) and his colleagues at the University of Texas at Austin—were designed for the express purpose of program verification. These two verification systems present the user with an integrated set of tools and specially tailored programming languages designed to make verification more convenient.
Applications
of Automated
Reasoning
889
The programming language supported by the Stanford Verifier is a variant of Pascal. T h e theorem prover used in the system is a rewrite-rule-based simplifier built on a decision procedure by Oppen and Nelsonn. The Stanford system was used to verify a compiler for Pascal by Polak consisting of approximately 3000 lines of executable code. The Gypsy Verification Environment (GVE) supports the programming language Gypsy, a derivative of Pascal, which provides con currency and a somewhat cleaner semantics. The theorem prover used in GVE was adapted from a prover by Bledsoe (Bledsoe and Bruell, 1974). G V E was used to verify a communications interface to a computer network consisting of over 4200 lines of executable code; some 2600 verification conditions were proved in that effort. GVE has also been used to verify a "message flow modulator", which can be viewed as a switch on a communications line that shunts messages with certain properties to a branch line. We close this section on the application of automated reasoning to program verification with one final citation. The success under consideration, obtained by Smith, Wojcik, Chisholm, and Kljaich (Chisholm et al., 1986; Kljaich et al., 1987, 1988), concerns the verification of software, hardware, and their interface in a system designed by Draper Laboratories to replace certain failing sensors in a nuclear reactor at Argonne National Laboratory. The reactor in question was designed in the late 1950s with the expectation of being used for approximately fifteen years, and therefore the fact that its sensors are failing is no surprise. Since the reactor still provides much useful data, the software/hardware replace ment system merits serious study. The automated reasoning program I T P (Lusk and Overbeek, 1984a, 1984b) played the key role in the verification of the faulttolerant (replacement) system designed by Draper. In addition to proving t h a t the appropriate properties are present in the Draper system—by examining the work performed by the reasoning program ITP—researchers found important simplifications that could be made to the design of the system. The success of Smith and his colleagues is, in an obvious sense, one of the best examples of the use of an automated reasoning program to verify the claims made, at the highest level, for a system.
4
CIRCUIT DESIGN AND VALIDATION
Because of the similarity of circuit validation to program verification, let us first focus on the use of an automated reasoning program for validation before focus ing on its use for design. Hunt (1986), using the Boyer-Moore theorem prover, validated a 16-bit, microprogrammed microprocessor similar in complexity to a PDP-11. T h e proof that this microprocessor, named FM8501, possesses the ap propriate properties involved approximately 100 proofs by induction about n-bit hardware devices. In addition, by induction, Hunt (1985) proved the correctness of wait loops in the microprogram used to control FM8501. At this point—especially for those who have access to an automated reason-
890
Collected Works of Larry Wos
ing program, but a program that lacks a mechanism for induction—one might wonder whether circuit validation is a viable application of automated reason ing without the use of induction. Indeed it is. For example, a 297-step proof validating the correctness of the design of a 16-bit adder was obtained (Wojcik, 1983) in less than 20 seconds of CPU time on an IBM 3033 by the reasoning program AURA (Smith, 1988), and without the use of induction. That proof would have been tedious, and perhaps out of reach, for a person to find, working unaided. In contrast to the close relationship that exists between circuit validation and program verification, the application of automated reasoning to circuit de sign presents sharply different obstacles to overcome. Fortunately, preliminary evidence strongly suggests that, despite these obstacles, circuit design is in deed a viable application. For an example, rather than again focusing on some problem selected from the real world, let us instead offer a puzzle to solve by discussing a problem taken from an exam given to engineers. The puzzle asks one to design a circuit that will return the signals not(x), not(y), and not(z), when x, y, and z are input to it. The task would be trivial were it not for one important constraint. One can use as many AND and OR gates as one wishes, but one cannot use more than two NOT gates. For those who are not familiar with circuit design and the various types of gates, we give the following equiv alent problem, but phrased in terms of assembly language programming: One is asked to write a program that will store in locations U, V, and W the Is complement of locations x,y, and z. One can use as many COPY, OR, and AND instructions as one wishes, but one cannot use more than two COMP (Is complement) instructions. This circuit design problem (equivalently, programming problem) has been solved by the automated reasoning program ITP. Its solution and a discussion of circuit design and of circuit validation as applications of automated reasoning are given in Wos et al. (1984, Chapters 7 and 8). One of the distinct advantages offered by an automated reasoning program for circuit design is the program's ability to automatically apply rules of canonicalization. For those who might not be familiar with circuit design, a common practice is to rewrite expressions for a circuit into some preferred form where, for example, the NOT gates are migrated to the innermost possible place. Whatever one prefers, a reasoning program can effortlessly accommodate one's preference. One simply gives the program the appropriate rules—called demodulators (Wos et al., 1967)—for canonicalization, and the program applies them where they should be applied.
Applications of Automated Reasoning
5
891
RESEARCH AID FOR FINDING PRACTICAL SOLUTIONS
One of the applications for automated reasoning that is seldom discussed con cerns its use in finding some technique that serves as a practical solution to some given problem. To illustrate what can occur, we focus on an actual problem on which we worked, a problem posed by one of the major car manufacturers. The problem concerns assembly line scheduling. The cars that come off an assembly line for a car manufacturer have a variety of options: air conditioning or not, sun roof or not, power windows or not, and others. Even more obvious, cars come in many colors. On any given day, the people responsible for running the assembly line know how many cars are expected to come off the line, and they also know the complete list of options and colors for each car. Those responsible must choose an order for the cars to be sent through the assembly line. If the sequencing of cars is poorly chosen, then the assembly line may fail to meet its quota, and fail badly. One of the time-consuming operations appears to be the installation of air conditioning. If those who install this feature are asked to complete the corre sponding job for, say, ten cars in a row with no car passing their station without requiring air conditioning, the station may be incapable of meeting this heavy and continuous demand. Of course, because the appropriate information is not given out lightly, we can use only hypothetical figures. The important point is that, when the capacity of some aspect of an assembly line is exceeded, the line will not function as intended. We were told of the scheduling problem in a general way by the car manufac turer and asked whether we could find some way to produce a "good" algorithm for sequencing the day's cars, given the features required for each of those cars. Our response was to suggest that, since much of the pertinent data is propri etary and, more important, since technology continues to advance, what the manufacturer might actually desire is some means to experiment on demand with new algorithms. In other words, the solution that was most desirable, from a very practical viewpoint, was to find a means for the manufacturer to research various algorithms easily and to resume that research whenever improved tech nology called for it. We did, in fact, provide such a means. We designed an approach for using the automated reasoning program ITP to take a given set of cars with assigned features and produce different sequences of those cars, where the sequence is determined by the user's choice of various parameters and the choice of the priorities for the various features (Parrello et al., 1986). The mechanism that ITP uses to determine a sequence is based on a number of parameters and on a penalty system. If the user wishes to experiment to see what would result from changing priorities or, in effect, changing the algorithm for assigning the order of cars for the assembly line, essentially what is required is to change
892
Collected Works of Larry Wos
the various parameter settings and penalties. When a good algorithm is found, then the suggestion is to take that algorithm and write a computer program in a high-level language to execute the algorithm. Even further, when and if the technology changes or when and if somebody has a new approach to try, all that is required is to again use ITP to conduct the appropriate experiments. In other words, we designed an environment—whose main component is the use of an automated reasoning program—that enables the user to search for a practical solution to a given problem. Although the given problem that prompted our research was that of assembly line scheduling, one might easily imagine that—given an entirely unrelated problem to solve—the results of our research could be modified and imitated (where appropriate) to design a similar environment. From a larger perspective, we demonstrated that an automated reasoning program can indeed be used as a research aid for finding practical solutions.
6
PROGRAMMING LANGUAGE AND COMBINATORY LOGIC
To complement the preceding material, at this point we turn to material so current that it rests to some extent on supposition. We are in part motivated by our view that, when possible, a chapter covering a variety of topics stimulates interest in a field when the chapter includes a challenge—a challenge in the form of questions that have just been posed. Therefore, we include the following discussion of the use of an automated reasoning program for the study of certain aspects of programming language. Because this chapter is but one of a number of chapters on a variety of subjects, only a taste of the subject can be given here. Nevertheless, we shall give sufficient evidence to support the position that the application of automated reasoning to the area of programming language— specifically, to combinatory logic—is indeed far more than a viable application. One of the more interesting developments in the area of programming lan guage is that focusing on the use of combinatora as the basic instruction set. Of course, since programming with combinators is rather like programming with a Turing machine, the notion is not that of having a person use combinators directly. Rather, as David Turner (1979) explains, the intention is for the pro grammer to write code in some high-level language and then have that code compiled into combinators. In other words, combinators would comprise the in struction set for the computer. Such computers have in fact been designed and built, which brings us to the point of this section—to the discussion of an area that may be pure supposition. The notion we have is that, if a computer is to use combinators as its in structions, then—as with any assembly language—one must make a choice about which combinators to use. In particular, just as with many sets of machine in-
Applications of Automated Reasoning
893
structions, combinators have the property that one combinator can be expressed in terms of others, depending of course on the combinator to be expressed and on those available for producing the expression. The following simple example illustrates how it can work and at the same time provides a very small taste of combinatory logic. Just as one specifies the actions of some machine instruction by saying what the instruction does to its arguments, one specifies the actions of a combinator by giving an equation that gives its effect on other combinators. Let us consider the following three combinators, where the variables x, y, and z implicitly range over all combinators. ((Bx)y)z = x{yz) (Wx)y = (xy)y (Lx)y = x(yy) Now let us consider how (W)B acts on other combinators. By using the given equations for B and W', we can prove that {{{BW)B)x)y = (W(Bx))y = ((Bx)y)y = x(yy) for all x and y. In other words, (BW)B acts exactly as L does. Therefore, from the viewpoint of programming language, if the computer offers as instructions B and W, then it also in effect offers the instruction L by using the combination (BW)B. To complete the stage setting for presenting the challenge, stating the newly posed questions, and focusing directly on the application of automated reason ing to combinatory logic, we turn to the topic of fixed point combinators. By definition, if the combinator 0 satisfies ex = x<0x) for all combinators x, then 0 is called a fixed point combinator. Fixed point combinators are relevant to programming language because each can be used to remove recursion. As various logicians have informed us, the construction of fixed point combinators can be an extremely arduous task. The precise construction problem asks whether, given a set of combinators, one can find an expression purely in terms of those combinators such that the found expression is a fixed point combinator. If one can construct such a combinator for a given set P of combinators, then, by definition, the set P satisfies the strong fixed point property. In other words, using the given definitions, one can correctly conclude that the problem of determining whether a given set P satisfies the strong fixed point property can be very difficult to solve. To illustrate how difficult the construction problem can be, let us first give a simple case to solve and then give its opposite. If we consider the set P consisting only of the combinator L and the combinator S with {(Sx)y)z = (xz){yz) we can easily prove that P satisfies the strong fixed point property. All we need do is focus on the combinator 0 = (SL)L. Using the equations for L and for S, we can quickly show that 0 is a fixed point combinator—in fact, one that is well
894
Collected Works of Larry Wos
known. On the other hand, if we instead consider the set P consisting of B and W alone, then a proof that P satisfies the strong fixed point property—which in fact it does—is far more difficult to supply. To gain some insight into how difficult this problem is to solve, one might pause immediately and try for, say, one hour to find an appropriate fixed point combinator; such a combinator does exist. For those who have made an attempt to find such a combinator and for those who have continued on without pausing, we now give our favorite solution to the problem. We let 0 = ((B((B((B(WW))W))B))B). We found this new fixed point combinator in late 1986, published the corre sponding research in McCune and Wos (1987), and note that we would not have succeeded were it not for substantial assistance from an automated reasoning program. We are now ready to issue the challenge, pose some questions, and focus directly on the application of automated reasoning to combinatory logic. The challenge is a friendly one. We wish to know of fixed point combinators with unusual properties, and we wish to know of a number of other uses for such combinators. With regard to the newly posed questions—to be succinct—we simply ask, How useful would it be to have access to an automated procedure for searching for expressions that define one combinator in terms of some given set of combinators? For example, would such a procedure—which would rely heavily on the use of an automated reasoning program—be very useful for deciding which instructions to implement for a computer executing combinators as its instruction set? As for the final aspect of this section—the excellence of using an automated reasoning program to study combinatory logic—we offer the following evidence. We have formulated (what appears to be) the first systematic method for search ing for fixed point combinators (Wos and McCune, 1988). The method is espe cially effective when applied by an automated reasoning program. With its use, we have succeeded in answering a number of previously open questions. We have also developed an approach that is very effective for a large class of problems whose object is to define one combinator in terms of some given set of combinators. With its use, we have succeeded in answering a number of previously open questions. Our success suggests that an automated reasoning program could be used, applying our approach, to study various possible sets of machine instructions for a computer using combinators. Such a study would be very useful—and this is supposition on our part—as an aid in deciding which combinators to implement.
Applications of Automated Reasoning
7
895
PORTABLE AUTOMATED REASONING PROGRAMS
For a field to advance markedly, when its nature is essentially empirical, its tech nology must be tested under a variety of circumstances. Unfortunately, in many cases, the needed variety of use has been hampered by inaccessibility. Such is not the case—now. Three portable automated reasoning programs are available. Boyer and Moore's program written in Lisp, whose main use is program verifi cation, can be obtained electronically; for the appropriate details, either of these researchers can be contacted in the Computer Science Department of the Uni versity of Texas. The general-purpose automated reasoning program ITP and the library LMA of underlying subroutines, both written in Pascal and designed and implemented by Lusk, McCune, and Overbeek, can be easily obtained on tape; the precise details can be found in Appendix A of Wos (1987a). (Obtaining the codes electronically is impractical because of their size.) The third portable automated reasoning program, OTTER, written in C and designed and imple mented by McCune in recent months, is expected to be available electronically or available on tape or diskette; details can be obtained from McCune in the Mathematics and Computer Science Division at Argonne National Laboratory. For the following reasons, OTTER deserves particular attention. Although this program is not a replacement for the well-distributed program ITP, since the latter permits interactive use and automatic connection to Prolog, nevertheless it offers certain advantages over ITP. OTTER runs from eight to fifteen times faster than ITP and, for many problems, uses much less memory. OTTER runs on PCs, a feature not to be taken lightly, as many will agree. Even when run on a PC, this program has solved rather difficult problems. Finally, OTTER is the subject of a parallel-processing effort in automated reasoning within the Mathematics and Computer Science Division at Argonne National Laboratory; the results of that effort may be available by 1991.
8
THE FUTURE OF AUTOMATED REASONING
When one is a researcher in a field, the obvious expectation is that such a person will be optimistic. Since—to be candid—"optimistic" is too weak for our present state of mind, let us simply and quickly list the reasons for our view. For fields like automated reasoning—which rely equally on theory, applica tion, and implementation—progress occurs in direct proportion to the number of enthusiastic people who test and question the developments. The most sig nificant test for this field rests with the results of using the reasoning programs that have been designed and implemented. For the appropriate amount of test ing, questioning, and use of reasoning programs to occur—and, therefore, for
896
Collected Works of Larry Wos
advances to occur rapidly—certain items must be in place or nearly in place, and fortunately they are. There must exist material that is easily read, as in Wos et al. (1984); research problems presented with a means to test solutions to them, as in Wos (1987a); a journal in which to publish, such as the Jour nal of Automated Reasoning; an organization for exchanging information, such as the Association for Automated Reasoning; and, perhaps most important, a program with the appropriate attributes. The program must be portable, conve nient to use, easy to modify, and very fast; and it must offer the main elements of automated reasoning. In addition, the desirable program must be continu ally updated to take advantage of new developments. We consider McCune's program OTTER to fulfill all of the given requirements. The other factors that produce our sharply positive view about the future of automated reasoning rest with the mounting successes and the work in par allel processing. Ever deeper theorems are being proved with a program playing the role of automated reasoning assistant. Markedly more involved computer programs are being verified with a reasoning program. In general, harder prob lems are being solved, and harder questions being answered, where the needed information is obtained from the use of an automated reasoning program. Fi nally, of all of the areas in computer science with which we are familiar, au tomated reasoning—more than any other—is amenable to parallel processing (Wos, 1987a, Chapter 7). Of course, many obstacles still exist [see Wos (1987a, Chapter 2)] that pre vent automated reasoning programs from being far more powerful. For example, too often a reasoning program strays from the relevant path, too many copies of the same conclusion are drawn, and too frequently the needed clauses for studying a new area are unavailable. With regard to the first of these three obstacles, a reasoning program can deduce 10,000 conclusions, using fewer than 20 in the sought-after proof. Although all of those 10,000 conclusions follow log ically from the problem description, obviously almost all of them are unneeded. With regard to the second obstacle, we have examples of theorems from lattice theory with the property that the program, during its successful search for a proof, draws more than 3000 conclusions which are immediately discarded be cause they are already present. As for the study of new areas, frequently one finds that the needed axioms in clause form are unavailable, which presents a third obstacle to overcome. In addition to the three cited obstacles, too little is currently known about how to take full advantage of parallelism. For example, can one formulate a strategy that partitions the conclusions that are drawn into small subsets such that a reasoning program can focus its reasoning on the set of subsets in parallel and then pool its results to reduce the time to find proofs by a factor of 1000? But, despite many obstacles to overcome—even with the current state of the art—the number of successes continues to grow. The necessary ingredients for a future that is brilliant and exciting exist now—except, possibly, for the most vital of all. That key ingredient is a vast amount of experimentation by inquisitive and eager researchers attempting to
Applications of Automated Reasoning
897
extend the power of automated reasoning programs and constantly seeking new applications. Since we conjecture that such researchers finally exist and exist in growing numbers, we predict that within ten years, rather than functioning as automated reasoning assistants—as various reasoning programs do now— such programs will begin to function as automated reasoning associates and, eventually, as colleagues.
ACKNOWLEDGMENT This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38.
REFERENCES Bledsoe, W. W., and Bruell, P. (1974). A Man-Machine Theorem-Proving Sys tem. AI 5:51-72. Boyer, R. S., and Moore, J S. (1979). A Computational Logic. Academic Press, New York. Boyer, R. S., and Moore, J S. (1984). Proof Checking the RSA Public Key Encryption Algorithm. Am. Math. Monthly 91(3):181-189. Boyer, R. S., and Moore, J S. (1985). Program Verification, J. Autom. Reasoning l(l):17-23. Chisholm, G., Kljaich, J., Smith, B., and Wojcik, A. (1986). An Approach to the Verification of a Fault-Tolerant, Computer-Based, Reactor Safety System— A Case Study Utilizing Automated Reasoning. NP-4924 and RP-2686-1 Final Report. Electric Power Research Institute, Palo Alto, Calif. Good, D. I. (1982). The Proof of a Distributed System in Gypsy. Technical Re port 30. Institute for Computing Science, University of Texas at Austin, Austin, Texas. Hunt, W. (1985). FM8501: A Verified Microprocessor. Technical Report 47. University of Texas at Austin, Austin, Texas. Hunt, W. (1987). The Mechanical Verification of a Microprocessor. In: From HDL Descriptions to Guaranteed Correct Circuit Designs (D. Borrione, ed.). North-Holland, New York. Igarashi, S., London, R. L., and Luckham, D. C. (1973). Automatic Program
898
Collected Works of Larry Wos
Verification I: A Logical Basis and Its Implementation. Report ISI/RR-73-11. Information Science Institute, University of Southern California, Los Angeles. Kljaich, J., Wojcik, A. S., and Smith, B. T. (1987). Formal Verification of Prop erties of Digital Systems, Using an Automated Reasoning System. In: Proceed ings of the Sixth Annual IEEE Phoenix Conference on Computers and Commu nications (0. Friesen and F. Golshani, eds.). IEEE, New York, pp. 486-491. Kljaich, J., Smith, B. T., and Wojcik, A. S. (1988). Formal Verification of FaultTolerance Using Theorem-Proving Techniques. IEEE Trans. Compu. 38(3):366376. Lusk, E., and Overbeek, R. (1984a). The Automated Reasoning System ITP. Technical Report ANL-84-27. Argonne National Laboratory, Argonne, 111. Lusk, E., and Overbeek, R. (1984b). Logic Machine Architecture Inference Mechanisms—Layer 2 User Reference Manual Release 2.0. Technical Report ANL-82-84, Rev. 1, Argonne National Laboratory, Argonne, 111. McCune, W., and Wos, L. (1987). A Case Study in Automated Theorem Prov ing: Finding Sages in Combinatory Logic. J. Autom. Reasoning 3(1):91-108. Parrello, B., Kabat, W., and Wos, L. (1986). Job-Shop Scheduling Using Au tomated Reasoning: A Case Study of the Car-Sequencing Problem. J. Autom. Reasoning 2(l):l-42. Robinson, G., and Wos, L. (1969). Paramodulation and Theorem-Proving in First-Order Theories with Equality. In: Machine Intelligence, Vol. 4 (B. Meltzer and D. Michie, eds.). Edinburgh University Press, Edinburgh, pp. 135-150. Robinson, J. (1965). A Machine-Oriented Logic Based on the Resolution Prin ciple. J. A CM 12:23-41. Smith, B. (1988). Reference Manual for the Environmental Theorem Prover, An Incarnation of AURA. Technical Report ANL-88-2. Argonne National Labora tory, Argonne, 111. Turner, D. A. (1979). A New Implementation Technique for Applicative Lan guages. Software—Prac. Exper. 9:31-49. Wojcik, A. (1983). Formal Design Verification of Digital Systems. Proceedings of the Twentieth Design Automation Conference (Miami Beach, Fl.). IEEE, New York, pp. 228-234. Wos, L. (1987a). Automated Reasoning: 33 Basic Research Problems. PrenticeHall, Englewood Cliffs, N.J.
Applications of Automated Reasoning
899
Wos, L. (1987b). Department of Energy brochure on Basic Energy Sciences accomplishments (to appear). Wos, L., and McCune, W. W. (1988). Searching for Fixed Point Combinators by Using Automated Theorem Proving: A Preliminary Report. Technical Report ANL-88-10. Argonne National Laboratory, Argonne, 111. Wos, L., and Robinson, G. (1973). Maximal Models and Refutation Complete ness: Semidecision Procedures in Automatic Theorem Proving. In: Word Prob lems: Decision Problems and the Burnside Problem in Group Theory (W. Boone, F. Cannonito, and R. Lyndon, eds.). North-Holland, New York, pp. 609-639. Wos, L., Overbeek, R., Lusk, E., and Boyle, J. (1984). Automated Reasoning: Introduction and Applications, Prentice-Hall, Englewood Cliffs, N.J. Wos, L., Robinson, G., and Carson, D. (1965). Efficiency and Completeness of the Set of Support Strategy in Theorem Proving. J. ACM 12:536-541. Wos, L., Robinson, G., Carson, D., and Shalla, L. (1967). The Concept of De modulation in Theorem Proving. J. A CM 14:698-709.
Problem
Corner:
Meeting the Challenge of Fifty Years of Logic* LARRY WOS Mathematics and Computer Science Division, Argonne National Argonne, IL 60439-4801
Laboratory,
(Received: 22 January 1990) In this article, we tell a story of good fortune; The good fortune concerns the discovery of a systematic approach to compress fifty years of excellent research in logic into a single day's use of an automated reasoning program. The discovery resulted from a colleague's experiment with a new representation and a new use of the weighting strategy. The experiment focused on an attempt—which I knew would fail—to prove one of the benchmark theorems that had eluded us for years. Fortunately, I was wrong; my colleague's attempt was successful, and a proof was found. That proof led to proving in one day thirteen theorems, theorems that resulted from fifty years of excellent research in logic. We present these theorems as intriguing problems to test the power of a reasoning program or to evaluate the effectiveness of a new idea. In addition to the challenge problems, we discuss a possible approach to finding shorter proofs and the results achieved with it. Key words. Equivalential calculus, theorem proving
1
Setting the Stage
In the early 1920s, the eminent logician Lukasiewicz began a study of equivalence in which Tarski also took an interest. By the end of that decade, other logicians had joined the investigation, with the aim of finding axioms for the field t h a t grew out of that study, a field of logic (discussed in some detail almost immedi ately) known as equivalential calculus. By 1933, they had succeeded; they had found nine formulas, each of which is sufficiently powerful that it alone provides a complete axiomatization. Of the nine, eight consist of 15 symbols, and one (found by Lukasiewicz in 1933) consists of 11. Lukasiewicz also proved t h a t no shorter formula can serve as a single axiom for this area of logic [2]. EQUIVALENTIAL CALCULUS, AN I N T U I T I V E D E S C R I P T I O N "This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted from the Journal of Automated Reasoning, Vol. 6, pp. 213-232 (1990) with kind permission from Kluwer Academic Publishers.
Meeting the Challenge of Fifty Years of Logic
901
Before telling the rest of the story (in Section 2) and before presenting the theorems we offer (in Section 5) as challenges for automated reasoning programs and for tests of new ideas, let us discuss equivalential calculus in an intuitive manner. Indeed, let us provide essentially all that is needed for one to feel at home in this area of logic. The elements to be studied are formulas that one can produce with the two-place function e (for equivalent) and the variables x, y, z, ... . Among such formulas, we have (1) e(x,x), (2) e(e(x,y),e(y,x)), and (3) e(e(x,y),e(e(y,z),e(x,z))). It is no coincidence that we selected these three formulas; they were chosen because they will remind one, respectively, of reflexivity, symmetry, and tran sitivity, properties naturally associated with "equivalence". In fact, these three formulas taken together provide a complete axiomatization for equivalential cal culus, for which in Section 3 we supply proofs obtained with our newest program OTTER [4]. If one prefers a smaller axiom set, although hardly intuitive, one discovers that there exist thirteen formulas (given in this article) each of which is sufficiently powerful by itself to provide a complete axiomatization for the calculus; each of the thirteen consists of eleven symbols, excluding commas and parentheses, and no shorter formula by itself axiomatizes the calculus. As it turns out—although not obviously, but easily proved—the first of the three given formulas (reflexivity) can be proved from the other two; we shall give that proof in Theorem 1 of Section 3. (We were unprepared for the fact that reflex ivity is a dependent axiom, for such a fact is for us counterintuitive. Indeed, for equality, reflexivity cannot be proved from symmetry and transtivity. As my col league R. Veroff observes, the formula thought of as transitivity in equivalential calculus is far more powerful than is its counterpart in equality, for the former acts like an if and only if statement, in contrast to the latter which has the form of a one-way implication.) Conversely, these three formulas can each be proved as a theorem of the calculus—not to be confused with a theorem about the calculus, which is the main study in this article—if one starts with any of the thirteen shortest single axioms. For this study, theorems (of the calculus) are those formulas in which variables occur exactly twice. An immediate question to ask focuses on what means of proof is available for making deductions in equivalential calculus. Indeed, one way in which areas of logic often differ from areas of mathe matics concerns the use of a specific inference rule. Equivalential calculus is no exception, for it can be studied with the inference rule called condensed detach ment. Condensed detachment considers two formulas, e(A, B) and C, and, if C unifies with A, yields the formula D, where D is obtained by applying to B the unifier of C and A. For example, if we apply condensed detachment to e(x,e(x,e(y,y)))
902
Collected Works ofL&rry Wos
and e(z,z) with the second formula playing the role of C, we obtain e(e(z,z),e(y,y)). If we reverse the roles of the two formulas and apply condensed detachment, we obtain a copy of the first formula. To gain a fuller appreciation of the intricacy of using condensed detachment, one might by hand attempt to produce the conclusion obtainable from applying the inference rule to two copies of (4) e(e(e(e(x,e(y,z)),e(y,x)),e(z,u)),u). If one succeeds in the suggested attempt, one finds that the conclusion is simply the appropriate instance of the second occurrence of the variable u. One can easily see why this is so by considering the clause - P ( e ( x , y ) ) I -P(x) I P(y) which one can use to enable a reasoning program to apply condensed detach ment. In particular, the unification of the clause equivalent of (4) with the first literal of the given three-literal clause causes the second occurrence of u to become the argument of the positive literal. To obtain the actual conclusion, one completes a hyperresolution step by unifying (a second copy of) the clause equivalent of (4) with the instantiated second literal of the three-literal clause to obtain e(x,x). Obviously, unification is not a radically new idea to the logicians who have studied equivalential calculus. The property just witnessed—that of deducing a short formula from two rather longer ones—and the propensity for deducing a formula longer than either of its two parents clearly plays havoc with an attempt to design an approach for showing that some given set of formulas can serve as a complete axiomatization of equivalential calculus. Nevertheless, as we shall discuss in Section 2, it can be done—at least for each of the thirteen formulas presented in Section 5. In Theorem 2 of Section 3, we shall select one of those formulas and give a proof obtained with our newest program OTTER that the selected formula can serve as a complete axiomatization. In Theorem 1 of Section 3, as promised, we shall prove that reflexivity can be deduced from the set consisting of symmetry and transitivity. However, before turning to those proofs and to others given later, let us complete the stage setting by telling the rest of the story leading to the challenge presented here.
2
A Story of Good Fortune
By the late 1970s, Meredith [5], Kalman [1], Peterson [6, 7], and other logicians succeeded in finding (in addition to the formula found by Lukasiewicz in 1933 [2]) ten additional formulas of length 11, each of which can serve as a single axiom. At
Meeting the Challenge of Fifty Years of Logic
903
that point, seven formulas remained—of the 630 possible candidates—of length 11 that had resisted classification. (From here on, because the theorems we do not consider are obtainable by substituting terms for variables, it is sufficient to be concerned only with formulas in which variables that occur in them occur exactly twice.) A most believable conjecture existed that all of the shortest single axioms had indeed been found. In other words, the conjecture asserted that each of the seven unclassified formulas was too weak to serve by itself as a complete axiomatization of equivalential calculus. At Kalman's suggestion—no doubt motivated by his success with his own theorem-proving program—Wos and Winker took an interest in the study. Us ing the automated reasoning program AURA [8] designed and implemented by researchers at Argonne National Laboratory, Wos and Winker devised a method to study the seven remaining unclassified formulas, each consisting of 11 sym bols. The method [10] relies on the use of schemata to attempt to obtain a complete characterization of all deducible theorems. (For this study, the theo rems of the calculus are precisely those formulas in which variables occur twice. Rather than these theorems, the focus here is on theorems about the calculus, for example, the assertion that the formula XHK which is given shortly is a shortest single axiom.) With the method relying on the use of schemata, Wos and Winker showed that five of the seven formulas are indeed each too weak to serve as a single axiom, a fact that is consistent with the conjecture made by the various logicians. However, rather than showing that the other two formulas (known as XHK and XHN, given shortly) are each inadequate for serving as a single axiom, Winker [personal communication]—with many weeks of study and many runs with AURA—refuted the conjecture by discovering that each is in fact a shortest single axiom for the calculus. The Argonne study led to the establishment of two benchmark problems for the field of automated reasoning. The object of the benchmark problems is to have an automated reasoning program prove, in single and separate runs, that each of XHK and XHN provides a complete axiomatization for equivalential calculus. (XHK) e(x,e(e(y,z),e(e(x,z),y))) (XHN) e(x,e(e(y,z),e(e(z,x),y))) The emphasis on single runs is in contrast to the many runs coupled with the excellent guidance provided by Winker when he succeeded in the autumn of 1980. As an indication of the difficulty offered by the two benchmark theorems, Winker's 83-step proof for XHK relies on the use of a formula of length 71, and his 159-step proof for XHN relies on the use of a formula of length 103. Since there exist more than 100,000,000,000 expressions consisting of 27 symbols— expressions that are called theorems, where each variable in an expression occurs exactly twice—one immediately sees why it might be extremely difficult for a program to prove, unaided and in a single run, either of the theorems that focus on the axioms XHK and XHN. Indeed, for more than eight years, all attempts to obtain a proof of either
904
Collected Works of Larry Wos
theorem in a single run with one of the Argonne programs failed, and failed under a variety of attacks with different strategies and diverse procedures. Prom the viewpoint of automated reasoning, it appeared that, without something like Winker's insight and study of the results of many computer runs, the two theorems were simply too tough for an unaided reasoning program to prove. At least, that was our view in the autumn of 1980 when Winker—with great assistance from AURA—produced the two proofs, and that was still our view in February of 1989. In fact, were it not for one fortuitous occurrence, we would still hold that view; we would still predict that to obtain—with an automated reasoning program—a proof that XHK or that XHN is a single axiom for equivalential calculus would require substantial intervention, guidance, and assistance from some bright and insightful researcher. The fortuitous occurrence concerns the conjunction of three forces, namely, (a) the study of a particular approach to applying the weighting strategy [3, 9, 11], (b) the use of a new representation (which turned out to be irrelevant to obtaining the results), and (c) access to the recently completed automated reasoning program OTTER [4]. (The full story will be presented in a future paper, "A Measure of Success for Automated Reasoning", featuring the history of the successful study of XHK and XHN.) The use of weighting turned out to be the key to obtaining the results. The weighting strategy provides a means for assigning priorities to clauses to enable a program to choose where next to focus its attention, and also provides a means for deciding that a conclusion is too complex to be of interest. At the simplest end of the spectrum, the priorities (weights) can be computed solely in terms of the number of symbols present. In contrast, one can use weights that emphasize certain chosen subexpressions to be the sole basis of priority assignment. For example, one can have a program prefer expressions in which the function c occurs three times in succession, or prefer some specific formula, or base its preference on a chosen argument of a formula. The conclusions that are kept are placed on a list from which our program OTTER chooses for the focus of attention, choosing the clause with the smallest weight. One can also use weighting to cause a program to discard a specific formula if ever encountered or discard formulas whose weight exceeds some given input value. McCune decided to have OTTER prefer to focus on formulas with a short tail, where the tail of a formula is the second argument of the leftmost occurrence of the function e. For example, in the formulas (PYM) e(e(e(x1e(y)z)),y),e(2)x)) and (XGK) e(x,e(e(y,e(z,x)),e(z,y))), the first formula has as its tail e(z, x), and the second has all but the leading a: as a tail. McCune's reason for emphasizing the role of the tail of a formula rests with the fact that—as we learned in Section 1 when we focused on the inference rule condensed detachment that can be used in equivalential calculus— the conclusions yielded by applying that inference rule to a pair of formulas are
Meeting the Challenge of Fifty Years of Logic
905
obtained from the appropriate instantiation of the tail of one of the formulas. OTTER, using the new approach to weighting and the new representation, won the first round. In a single run of approximately 8 CPU minutes on a Sun 3/60 workstation, OTTER found a proof that XHK is a single axiom for equivalential calculus. In contrast to the 83-step proof found by Winker with AURA (where the input clauses do not contribute to the count), OTTER's proof con sists of 40 steps. Where the Winker proof requires the use of formulas containing as many as 71 symbols, the OTTER proof requires formulas containing no more than 47. Correctly recognizing the importance of his success, McCune next asked OTTER to again use his approach in an attempt to prove that XHN is also a single axiom. Unfortunately—if we keep in mind the precise nature of the objective—in the strictest sense, OTTER did not succeed. Rather than finding a proof in a single run, OTTER required two runs, the first designed to accumulate some long formulas that could be used by the second under the condition that the second would not keep any additional long formulas it found. Even though McCune was forced to slightly broaden the rules to permit two runs—because OTTER does not yet offer dynamic weighting adjustment—we still give the second round to OTTER. After all, the program did find a proof for XHN in just over 90 CPU minutes on an Encore Multimax using an NS32332 processor, and a proof quite unlike Winker's. (The switch to the Encore was caused by the need for additional memory.) The OTTER proof consists of 84 steps; the Winker/AURA proof consists of 159 steps. The OTTER proof requires formulas no longer than 47 symbols in length; the Winker/AURA proof relies on the use of a formula of length 103. One of the two benchmark problems had fallen—the other almost had—and fallen much sooner than we would have predicted. In addition, OTTER had found shorter and simpler proofs. The fact that a program finds proofs that are both shorter and simpler than those found earlier does not imply that the CPU time to obtain the newer proofs must have been less than that for the longer and more complex ones, as one can see from the examples we give in Section 4. Indeed, were one to predict a sharp increase in effectiveness—finding the proofs in 8 and 90 CPU minutes, respectively—merely because the new proofs are shorter and simpler, then one might find the results of various experiments rather startling. Where the level of an input clause is 0, the level of a clause is one greater than the levels of the immediate parents of that clause, and the level of a proof is the maximum of the levels of all of the clauses in the proof, the explanation rests with the fact that the number of steps in a proof and the complexity of those steps do not tell the full story, for the level of a proof also materially affects the CPU time that may be required to obtain it. A study of the interplay of these three aspects of proof should prove most intriguing and challenging. Finding proofs far shorter and far simpler than Winker's does not detract from his achievement in any way. After all, we had the advantage of knowing
906
Collected Works of Larry Wos
that each of XHK and XHN is an axiom; in contrast, Winker was faced with the prospect that the conjecture of the logicians was probably correct and, therefore, that each of the formulas XHK and XHN was too weak to be proved an axiom. Of substantial importance, in no way did McCune use either of the Winker/AURA proofs. On the other hand, from a broader perspective, his success is another example of what the group theorist Reinhold Baer once said: "It is far easier to prove a theorem when one knows that a proof exists than when one is uncertain." The full story of how Winker succeeded must wait for the promised long paper. By chance—in the sense that I considered McCune's experiment with XHK mainly to be a test of ideas, fully expecting it to fail—I found that an auto mated reasoning program could obtain unaided proofs of the corresponding two benchmark theorems. I had expected failure because all of the attempts made over the preceding eight years had been unsuccessful. Nevertheless, McCune's decision to have OTTER seek a proof was an excellent one, for—among other reasons—one occasionally makes a useful discovery even when the immediate goal is not reached. Since, in this case, the goal was reached, we were ready to attempt to meet the challenge of fifty years of excellent research in logic. THE CHALLENGE The challenge for us—and the one we offer in Section 5 for those researchers who enjoy challenges and who wish to test their own programs and their own ideas for adding to the power of automated reasoning programs—is to prove the thirteen theorems accumulated over more than fifty years, beginning with the contributions made in the early 1930s. These theorems respectively establish that each of thirteen formulas is so powerful that it can serve by itself as a complete axiomatization for equivalential calculus. (In Section 1, we provided an intuitive understanding of that calculus, and in Section 5 we give the thirteen theorems to be proved.) By accepting the challenge, we decided that we must answer the following specific questions. 1. How many of the thirteen theorems could OTTER prove without substan tial guidance of a researcher? 2. How long in CPU time and real time would it take? 3. How much memory would be required? 4. How many runs must we make? 5. Perhaps most important, how much must we modify the approach we used to prove that each of XHK and XHN is a single axiom? Here is what occurred. In a single day, OTTER succeeded in finding proofs of all thirteen theorems that establish that each of the appropriate thirteen formulas of length 11 is a
Meeting the Challenge of Fifty Years of Logic
907
(shortest) single axiom. Further, the method of attack—although it is a broad ening of the approach McCune used for XHK and XHN—is systematic and general, not tuned to each of the corresponding thirteen theorems. Specifically, the approach consists of using McCune's weighting of formulas to prefer those with shorter tails, and then, if not successful in 15 CPU minutes on a Sun 3/60 workstation, using a weighting strategy based on symbol count, and finally, if that also fails in 15 CPU minutes, then using weighting to prefer formulas with short tails or short heads. In other words, except for the use of a general weight ing strategy, the thirteen proofs were obtained by OTTER without substantial intervention, guidance, and assistance from a researcher. To produce the thirteen proofs required approximately 320 CPU minutes of the computer's time—mostly on a Sun 3/60 workstation, but partly on an Encore Multimax using an NS32332 processor—spread over 12 hours of our time. The number of steps in the thirteen proofs is 403. The required memory varies from 0.1 to 20 megabytes. Almost 5,000,000 clauses were generated during the successful searches, and we were forced to abandon as useless nine of the twenty-two runs we made with OTTER. If we quickly revisit the results of our recent study of equivalential calculus, we cannot help but sense a sharp increase in the value of using an automated reasoning program. Indeed, in just over eight years after Winker and AURA's impressive completion of the search for shortest single axioms—a search that began in the late 1920s—we showed that an automated reasoning program could start and finish the search for the corresponding thirteen proofs, and in a single day. In no way did our effort rely on knowledge of the structure of the existing proofs. In fact, we had seen only two such proofs, Winker's proofs for XHK and XHN. On the other hand, we did have the advantage over Winker and over the logi cians who had studied equivalential calculus—and clearly an important advantage— of knowing which thirteen formulas, from among the 630 to be considered, have the property of being so powerful that each provides a complete axiomatization of equivalential calculus. Unfortunately, one cannot simply try to prove that a randomly selected formula—from among the 630 that are too weak—is a single axiom, for such an action will result in the deduction of an ever-growing set of conclusions with virtually no clue that failure awaits one. Incidentally, during the writing of this article, we succeeded in obtaining a proof in a single run of the XHN theorem, but we did intervene substantially by choosing a somewhat complex weighting strategy strongly influenced by Mc Cune's 84-step proof just mentioned. However—rather than reproducing the 84-step proof, as one might predict—we instead found a 65-step proof; more details are given when we discuss in Section 4 methods for obtaining shorter proofs. In addition, rather than requiring the use of a formula of length 47, the new proof relies on formulas no longer than 39 symbols in length. Without ac cess to McCune's success in studying both XHK and XHN, we would not have known where to begin.
908
CoJiected Works of Larry Wos
As further evidence of the depth of this study of shortest single axioms, we note that Lukasiewicz appeared to believe in the late 1940s that only one such axiom existed, rather than the thirteen that do. We say this because he referred to "the shortest single axiom" [2]. In addition, Meredith [5] in 1963 incorrectly claimed that the formula XG J can serve as a complete axiomatization for equivalential calculus. (XGJ) e(x>e(e(y,e(z,x)),e(y,z))) Therefore, if one has less success than desired when one tackles the theorems we present in Section 5, one might keep in mind the difficulties experienced by eminent logicians during the comparable study.
3
Four Theorems Proved by O T T E R
THEOREM 1. In equivalential calculus, the axiom of reflexivity is dependent on the axioms of symmetry and transitivity. Proof. Let us assume by way of contradiction that reflexivity cannot be de duced from symmetry and transitivity. We therefore have four input clauses— the clause to capture condensed detachment, the clause to deny the conclusion of the theorem, and the clauses for symmetry and transitivity. Using hyperresolution as the inference rule, we obtain the following proof from OTTER in which the number of a clause reflects the order in which it was input or deduced. In the proofs below, the input clauses occur above the horizontal line; derived clauses below. The only clauses used are those that appear in the proof. The clause numbers give some indication of the density of the proof within the set of clauses that are derived and not subsumed. The triple of numbers in brackets gives in order the clause driving the inference, the nucleus of the step, and the other clause used to complete the deduction. 1 2 3 4
- P ( e ( x , y ) ) I -P(x) I P(y). -P(e(a,a)). P(e(e(x,y),e(y,x))). P(e(e(x,y),e(e(y,z),e(x,z)))).
5 [hyper,4,1,3] P ( e ( e ( e ( x , y ) , e ( z , y ) ) , e ( z , x ) ) ) . 9 [hyper,5,1,3] P ( e ( x , x ) ) . Clause (9) contradicts clause (2), and the proof i s complete. THEOREM 2. The formula YQL (YQL) e(e(x,y),e(e(z,y),e(x,z))) can serve as a complete axiomatization for equivalential calculus.
909
Meeting the Challenge of Fifty Years of Logic
Proof. We assume by way of contradiction that YQL is not a single axiom for the calculus. This assumption asserts that none of the known single axioms for equivalential calculus is implied by YQL; indeed, if any formula that is a single axiom for the calculus were implied by YQL, then YQL would itself be a single axiom also. Therefore, we assume that none of the following eight formulas, proved by various logicians to be single axioms, is implied by YQL. e(e(e(x,e(y,z)),e(e(z,u),u)),e(x,y)) e(e(e(e(x,y),z),u),e(u,e(x,e(y,z)))) e(e(x,e(y,z)),e(e(y,e(u,z)),e(u,x))) e(e(x,e(y,z)),e(e(y,e(z,u)),e(u,x))) e(e(u,e(x,e(y,z))),e(e(x,y),e(z,u))) e(e(x,e(y,z)),e(e(x,e(z,u)),e(u,y))) e(e(x,e(y,z)),e(e(x,e(u,z)),e(u,y))) e(e(x,e(y,z)),e(e(x,e(z,u)),e(y,u))) The following proof that YQL implies the last of the eight given single axioms was found by OTTER. 1 -P(e(x,y))
I -P(x) I P(y).
2 -P(e(e(a,e(b.c)),e(e(a,e(c,d)),e(b,d)))). 3 P(e(e(x,y),e(e(z,y),e(x,z)))). 4 6 7 12 28 22336
[hyper,3,1,3] [hyper,4,1,3] [hyper,6,1,3] [hyper,7,1,3] [hyper,12,1,3] [hyper,28,1,4]
P(e(e(x,e(e(y,z),e(u,y))),e(e(u,z),x))). P(e(e(x,y),e(x,y))). P(e(e(x,e(y,z)),e(e(y,z),x))). P(e(e(e(x,y),e(z,x)),e(z,y))). P(e(e(x,e(y,z)),e(e(e(u,z),e(y,u)),x))). P(e(e(x,e(y,z)),e(e(x,e(z,u)),e(y,u)))).
Clause (22336) c o n t r a d i c t s c l a u s e ( 2 ) , and t h e proof i s c o m p l e t e . For our third example of O T T E R ' s usefulness and power, let us prove that the set of formulas consisting of symmetry and transitivity provides a complete axiomatization for equivalential calculus. Our method of proof is similar to that for Theorem 2; namely, we prove that the use of the clauses for symmetry and transitivity leads to a deduction of a formula that itself is a complete axiomati zation. We give two proofs obtained with O T T E R , a short one and a long one. They were found by using O T T E R ' s capacity to find more than one proof in a single run. We included among the input clauses the negations of the thirteen shortest single axioms and the negations of the eight axioms of length 15 given earlier. T H E O R E M 3. The axioms of symmetry axiomatization for equivalential calculus.
and transitivity
provide a complete
Collected Works of Larry Wos
910
Proof. We proceed as in Theorem 2 by assuming by way of contradiction that the theorem is false. The first proof shows that the single axiom YQL is deducible, and the second that the single axiom YRO is deducible.
1 2 23 24
- P ( e ( x , y ) ) I -P(x) I P(y). -P(e(e(a,b),e(e(c,b),e(a.c)))). P(e(e(x,y),e(y,x))). P(e(e(x,y),e(e(y,z),e(x.z)))).
25 [hyper,24,1,24] P(e(e(e(e(x,y),e(z,y)),u),e(e(z,x),u))). 27 [hyper,24,1,23] P(e(e(e(x,y),z),e(e(y,x),z))). 9792 [hyper,25,1,27] P(e(e(x,y),e(e(z,y),e(x,z)))). Clause (9792) contradicts clause (2), and the first proof is complete. 1 -P(e(x,y)) I -P(x) I P(y). 9 -P(e(e(a,b),e(c,e(e(c,b),a)))). 23 P(e(e(x,y).e(y.x))). 24 P(e(e(x,y),e(e(y,z),e(x,z)))).
25 26 27 28 30 33 39 58 124 133 215 377 1342 2278 3059 9725 9767 9812 15190
[hyper,24,1,24] P ( e ( e ( e ( e ( x , y ) , e ( z , y ) ) , u ) , e ( e ( z , x ) , u ) ) ) . [hyper,24,1.23] P ( e ( e ( e ( x , y ) , e ( z . y ) ) , e ( z , x ) ) ) . [hyper,24,1,23] P ( e ( e ( e ( x . y ) , z ) , e ( e ( y , x ) , z ) ) ) . [hyper,26.1,26] P ( e ( x , e ( e ( x , y ) , y ) ) ) . [hyper,26,1,24] P ( e ( e ( e ( x . y ) , y ) , x ) ) . [hyper,28.1,24] P ( e ( e ( e ( e ( x , y ) , y ) , z ) , e ( x , z ) ) ) . [hyper,30,1,24] P ( e ( e ( x . y ) , e ( e ( e ( x , z ) , z ) , y ) ) ) . [hyper,27,1,27] P ( e ( e ( x , e ( y , z ) ) , e ( e ( z , y ) , x ) ) ) . [hyper,33,1,27] P ( e ( x , e ( e ( y , x ) , y ) ) ) . [hyper,124,1,24] P ( e ( e ( e ( e ( x , y ) , x ) , z ) , e ( y , z ) ) ) . [hyper,39,1,27] P ( e ( e ( x , y ) , e ( e ( e ( y , z ) , z ) , x ) ) ) . [hyper,58,1,58] P ( e ( e ( x , e ( y , z ) ) , e ( x , e ( z , y ) ) ) ) . [hyper,133,1,27] P ( e ( e ( x , e ( e ( y , z ) , y ) ) , e ( z . x ) ) ) . [hyper,215,1,58] P ( e ( e ( x , e ( e ( y , z ) , z ) ) , e ( x , y ) ) ) . [hyper,377,1,133] P(e(e(efe(x,y) ,x) ,z) , e ( z , y ) ) ) . [hyper,25,1,3059] P ( e ( e ( e ( x . y ) , e ( y , z ) ) , e ( x , z ) ) ) . [hyper,25,1,1342] P ( e ( e ( e ( x , y ) , z ) , e ( y , e ( z , x ) ) ) ) . [hyper,9725,1,2278] P ( e ( e ( e ( e ( x , y ) , z ) , e ( z , y ) ) , x ) ) . [hyper,9812,1,9767] P ( e ( e ( x , y ) , e ( z , e ( e ( z , y ) , x ) ) ) ) .
Clause (15190) contradicts clause ( 9 ) , and the second proof i s complete.
We close this section by turning our attention to one of the earliest axiomatizations of equivalential calculus. In 1929, Lesniewski [2] presented an axiomatization of equivalential calculus consisting of the formulas
Meeting the Challenge of Fifty Years of Logic
911
e(e(e(x,y),e(z,x)),e(y,z)) and e(e(x,e(y,z)),e(e(x,y),z)), the first of the two being a form of transitivity and the second the commuted form of associativity. The proof that this set axiomatizes the calculus rests with an appeal to natural language. In 1932, Wajsberg and Lesniewski [2] presented four simpler sets of axioms, one of which consists of symmetry and associativity. e(e(x,y),e(y,x)) e(e(e(x,y),z),e(x,e(y,z))) Let us immediately give a proof, obtained with OTTER, that one can derive one of the shortest single axioms, YQL, from symmetry and associativity, and give in Section 4 a proof that this pair of formulas implies the initial set of axioms given by Lesniewski. Let us also give OTTER's proofs of YRM and transitivity, using symmetry and associativity, respectively. Regarding the three proofs we are about to give, a comparison of the first two with their correspondents given earlier—where the axioms are symmetry and transitivity—suggests that establishing that symmetry and transitivity axiomatize equivalential calculus is somewhat easier than establishing that symmetry and associativity do. We find that evaluation rather pleasing, if accurate, for the set of formulas consisting of reflexivity, symmetry, and transitivity should—in some sense of naturalness—be a good choice for that area of logic focusing on equivalence. Of course, as we proved earlier, the axiom of reflexivity is deriv able from symmetry and transitivity. As for the third proof we shall give, its appeal rests with the fact that symmetry and transitivity—with reflexivity— are the most obvious choices for an axiomatization of this calculus. Therefore, one might indeed prefer to establish that symmetry and associativity provide a complete axiomatization by deriving transitivity, rather than deriving some shortest single axiom. If one examines all three proofs together, one finds that all derived steps consist of exactly 11 symbols—a fact that, although we cannot explain our reaction, we find intriguing. In contrast, if one replaces associativity with tran sitivity and then prevents OTTER from keeping any formula of length greater than 11—but allows it to use formulas of length less than or equal to 11—one cannot derive any of the thirteen shortest single axioms from symmetry and transitivity alone. OTTER derives e(x, x), fourteen of the fifteen formulas of length seven—skipping only e(e(x, y), e(x, y))—and 432 of the 630 formulas of length 11 (in which each variable occurs exactly twice). At that point, the set of support becomes empty, which in effect asserts that nothing more is accessible and all thirteen shortest single axioms are out of reach when one prevents the use of all formulas of length greater than 11. Here are the three promised proofs. THEOREM 4. The axioms of symmetry and associativity provide a complete axiomatization for equivalential calculus.
Collected Works of Larry Wos
912
Proof. We proceed as in Theorem 3 by assuming that the theorem is false. We therefore add to the input, in addition to clauses for symmetry and associativity, clauses that correspond to the negation of the thirteen shortest single axioms and the negation of transitivity. The clause for the negation of transitivity permits OTTER to seek to obtain the three promised proofs in a single run. We also include clauses corresponding to the negation of eight single axioms, each of length 15, because that is our standard approach in these studies. We extract the following three proofs of YQL, YRM, and transitivity, respectively. 1 2 24 25 26 27 28 29 30 34 39 48 63 75 155 455 650
- P ( e ( x , y ) ) I -P(x) I P(y). -P(e(e(a,b),e(e(c,b),e(a.c)))). P(e(e(x,y),e(y,x))). P(e(e(e(x,y).z).e(x,e(y,z)))). [hyper,25,1.25] [hyper,25,1,24] [hyper,26,1,25] [hyper,26,1,24] [hyper,26,1,24] [hyper,28,1,24] [hyper,30,1,27] [hyper,34.1,25] [hyper,39,1.39] [hyper,39,1,25] [hyper,48,1,29] [hyper,155,1,75] [hyper.455,1,63]
P(e(e(x,y),e(z,e(x,e(y,z))))). P(e(e(x,e(y,z)),e(e(x,y),z))). P(e(x,e(y,e(z.e(x,e(y,z)))))). P(e(e(x,e(y,e(z,x))),e(y,z))). P(e(x,e(e(y,z),e(e(z,y),x)))). P(e(e(x,e(y,e(z,e(x,y)))),z)). P(e(e(x,e(y,z)),e(e(z,y),x))). P(e(x,e(e(y,e(z,e(x.y))),z))). P(e(e(x,e(y,z)),e(x,e(z,y)))). P(e(e(e(x,y),z),e(e(z,x),y))). P(e(e(x,e(e(y,z),e(z,x))),y)). P(e(e(x,y),e(e(x,z),e(z.y)))). P(e(e(x,y),e(e(z.y),e(x,z)))).
Clause (650) contradicts clause (2), and the proof of YQL is complete. 1 -P(e(x,y)) I -P(x) I P(y). 9 -P(e(e(a,b),e(c,e(e(c,b),a)))). 24 P(e(e(x.y),e(y,x))). 25 P(e(e(e(x,y),z),e(x,e(y,z)))). 26 27 30 33 39 63 68 220
[hyper,25,1,25] [hyper,25,1,24] [hyper,26,1,24] [hyper,27,1,25] [hyper,30,1,27] [hyper,39,1,39] [hyper,39,1,33] [hyper,68,1,63]
P(e(e(x,y),e(z,e(x,e(y,z))))). P(e(e(x.e(y,z)),e(e(x,y),z))). P(e(x,e(e(y.z),e(e(z,y),x)))). P(e(e(e(e(x,y),z),x),e(y,z))). P(e(e(x,e(y,z)),e(e(z,y),x))). P(e(e(x,e(y,z)),e(x,e(z,y)))). P(e(e(x,y),e(e(e(z,y),x),z))). P(e(e(x,y),e(z,e(e(z,y),x)))).
Clause (220) contradicts clause (9), and the proof of YRM is complete.
Meeting the Challenge of Fifty Years of Logic 1 23 24 25 26 27 28 30 33 34 39 47 74 75 150 453 641
913
-P(e(x,y)) I -P(x) I P(y). -P(e(e(a,b),e(e(b,c),e(a,c)))). P(e(e(x,y),e(y,x))). P(e(e(e(x,y),z),e(x.e(y,z)))). [hyper,25,1,25] [hyper,25,1.24] [hyper,26,1,25] [hyper,26,1,24] [hyper,27,1,25] [hyper,28,1,24] [hyper,30,1,27] [hyper,34,1,33] [hyper,39,1,26] [hyper,39,1,25] [hyper,47,1,39] [hyper,150,1,74] [hyper,453,1.75]
P(e(e(x,y),e(z,e(x,e(y,z))))). P(e(e(x,e(y,z)),e(e(x,y),z))). P(e(x,e(y,e(z,e(x,e(y,z)))))). P(e(x,e(e(y,z),e(e(z,y),x)))). P(e(e(e(e(x,y),z),x),e(y,z))). P(e(e(x,e(y,e(z,e(x,y)))),z)). P(e(e(x,e(y,z)),e(e(z,y),x))). P(e(x,e(y,e(z,e(e(z,x),y))))). P(e(e(e(x,e(y,z)),z),e(x,y))). P(e(e(e(x,y),z),e(e(z,x),y))). P(e(e(e(x,e(e(x,y),z)),z),y)). P(e(e(x,e(e(x,y),e(z,y))),z)). P(e(e(x,y),e(e(y,z),e(x,z)))).
Clause (641) contradicts clause (23), and t h e proof of t r a n s i t i v i t y i s complete.
4
Seeking Shorter Proofs
In this section, we focus on one of the questions occasionally asked by mathe maticians and logicians, that of finding a shorter proof than has been found so far. The frequency of such a question being posed appears to increase sharply when one is presented with a proof obtained with an automated reasoning pro gram. No doubt the questioner, recognizing the arduousness of conducting the corresponding search by hand but encouraged by the success of a computer pro gram, conjectures that some way must exist to effectively assign the task to a computer. In principle the conjecture is correct, for such a way does exist. One can simply have one's reasoning program conduct a level-saturation run through level k, where k is the length of the shortest known proof. We recall that the level of a clause is one greater than the levels of the immediate parents of that clause, and the level of a proof is the maximum of the levels of all of the clauses in the proof. Unfortunately, for most studies, a level-saturation run is virtually untenable, for the size (the number of clauses) of succeeding levels grows very rapidly. Nevertheless, consideration of using an automated reasoning program in the attempt to find shorter proofs should not simply be rejected. In fact, our entrance into the field of equivalential calculus was mostly prompted by a suggestion from the logician Kalman that we seek a proof that
914
Collected Works of Larry Wos
the formula XGK implies the formula PYO—each of which is a shortest sin gle axiom—but attempt to find a proof shorter than the one he found [1]. As we reported in an earlier paper [10], we did succeed—actually, Brian Smith de serves full credit for this success. Smith, using the automated reasoning program AURA, found a 23-step proof [10]; Kalman's proof consists of 43 steps. (We very recently found a 10-step proof with OTTER using an approach based on level saturation; the result duplicates a proof first obtained by Marien using one of Stickel's programs.) Despite this success—until now—we have had little to contribute when asked about how one might systematically use an automated reasoning program for seeking shorter proofs. In fact, although we provide some hints in this section about how one might proceed, we must point out that we have gained little un derstanding of the precise nature of the mechanisms we discuss, and we consider our discoveries to be mostly good fortune. The change that has occurred, during the writing of this article, resulted simply from curiosity. We examined McCune's proof that XHN is a single axiom, noting that—after the deduction of e(x,x)—almost all of the steps in the proof have a short tail or a short head. Obviously, his emphasis of short tails was an excellent choice, leading to the superior proofs for XHK and XHN. Therefore, we decided to go even further in that direction. In particular, with weighting, we instructed OTTER to emphasize the use of formulas whose head or tail was no longer than three symbols. Our goal was to obtain McCune's proof for XHN, but obtain it in a single run. After 4 CPU hours on an Encore, the attempt was judged a failure and terminated. However, an examination of the output revealed a most unexpected find—a far shorter proof of e(x,x). Where the McCune/OTTER proof takes 29 derived steps, the new proof takes 13; where the McCune/OTTER proof relies on a formula of 47 symbols, the new proof requires formulas containing no more than 39 symbols. The immediate question we asked focuses on using some weighting strategy that would produce in a single run a (new) proof of XHN, where the proof would begin by producing the 13-step deduction of e(x, x). We had already changed the rules; we were still in pursuit of a single-run proof of XHN, but we were also after a proof shorter than that found by McCune. The attempt failed, failed because OTTER used unwanted steps on its way to deducing e(x, x), which made that proof longer than we intended. However, because weighting permits one to assign a weight to a clause—whose pattern of e's is unwanted—in such a way that clauses of the unwanted type are discarded, we were able to add to the weighting templates and avoid the unwanted clauses. Our attempt succeeded in reaching both goals. OTTER found a proof that XHN is a single axiom, and the proof is 65 steps in length as compared with McCune's proof of 84 steps. In addition, the shorter proof is less complex— the longest formula used in it consists of 39 symbols, compared to the use of formulas consisting of 47 symbols for the longer proof. Other experiments that led to finding shorter proofs rest on instructing OT-
Meeting the Challenge of Fifty Years of Logic
915
TER to block the use of formulas with weight greater than some chosen bound, and also block the use of formulas with weight less than another chosen bound. Since the latter is not directly available in OTTER, to achieve the desired re striction, we were forced to employ an indirect means—to add templates that purge certain types of formulas. We also succeeded in finding shorter proofs with an entirely different approach, that of interchanging the order of the two negative literals in the nucleus for condensed detachment. This approach was discovered purely by chance, for we were simply trying for a uniform set of proofs, each placing the role of the e(x, y) literal first. The result was the dis covery by OTTER of a proof for XHN consisting of 63 steps instead of 65. Other experiments are planned. Summarizing, we have discovered by chance the beginning of an approach for systematically seeking shorter proofs with the assistance of an automated reasoning program. One aspect of the approach rests on choosing some type or types of formulas to be avoided, and then using weighting to purge unwanted clauses. The clauses to be avoided are typically present in a known proof, and the object is to prevent the program from finding that proof. The other aspect of the approach focuses on the use of various orderings of the literals in the nucleus or nuclei from which conclusions are drawn—drawn by using hyperresolution, URresolution, or some other inference rule. The object of this aspect is to perturb the search space enough to cause the program to concentrate on conclusions in sharply different sequences. Again, as in the results reported in earlier sections, we are indebted to McCune for providing the needed beginning. We close this section with some promised observations and two proofs rele vant to the relation between finding shorter proofs and the corresponding CPU time that is required. The experiments and proofs focus on proving that the combination of symmetry and associativity axiomatize equivalential calculus, where the proof depends on deducing the commuted form of associativity and an odd form of transitivity. In particular, we prove that the axioms first given by Lesniewski in 1929 are derivable from a second set given in 1932 [2]. Since the commuted form of associativity is easily derivable from symmetry and as sociativity, all that remains is the two proofs of Theorem 5—two are needed to illustrate that shorter proofs can indeed take far longer to find. THEOREM 5. The axioms of symmetry and associativity completely axiomatize equivalential calculus; in particular, their use leads to the deduction of e(e(e(x ,y) ,e(z,x)) ,e(y,z)), which, with symmetry, forms a complete axiomatization of the calculus. Proof. As usual, we assume by way of contradiction that the theorem is false, which explains the presence of the negative unit clause in the following two proofs. 1 -P(e(x,y)) I -P(x) I P(y).
916
Collected Works of Larry Wos
3 -P(e(e(e(a,b),e(c,a)),e(b,c))). 4 P(e(e(x,y),e
[hyper,5,1,4] P ( e ( e ( x , e ( y , z ) ) , e ( e ( x , y ) , z ) ) ) . [hyper,5,1.4] P ( e ( x , e ( y , e ( y , x ) ) ) ) . [hyper,7,1,4] P ( e ( e ( x , e ( x , y ) ) , y ) ) . [hyper,9,1,5] P ( e ( x , e ( e ( x , y ) , y ) ) ) . [hyper,9,1,7] P ( e ( x , x ) ) . [hyper,11,1,7] P ( e ( x . e ( x , e ( y , y ) ) ) ) . [hyper,10,1,10] P ( e ( e ( e ( x , e ( e ( x , y ) , y ) ) , z ) , z ) ) . [hyper,10,1,7] P ( e ( e ( e ( x , e ( y , e ( y . x ) ) ) , z ) , z ) ) . [hyper,12,1,4] P ( e ( e ( x , e ( y , y ) ) , x ) ) . [hyper,28,1,5] P ( e ( e ( e ( x , y ) , x ) , y ) ) . [hyper,38,1,4] P ( e ( x . e ( e ( y , x ) , y ) ) ) . [hyper,41,1,41] P ( e ( e ( x , e ( y , e ( e ( z , y ) , z ) ) ) , x ) ) . [hyper.41,1,18] P ( e ( e ( x , e ( y , e ( z , e ( z , y ) ) ) ) , x ) ) . [hyper.41,1,14] P ( e ( e ( x , e ( y , e ( e ( y , z ) , z ) ) ) , x ) ) . [hyper,6,1,5] P ( e ( e ( e ( e ( x , y ) , z ) , x ) , e ( y , z ) ) ) . [hyper,405.1,69] P ( e ( e ( e ( x , y ) , e ( e ( y , z ) , z ) ) , x ) ) . [hyper,405,1,67] P ( e ( e ( e ( x , y ) , e ( z , e ( z , y ) ) ) , x ) ) . [hyper,405.1.59] P ( e ( e ( e ( x . y ) , e ( e ( z , y ) , z ) ) , x ) ) . [hyper,440,1,433] P ( e ( e ( e ( x , e ( y . e ( y , z ) ) ) , x ) , z ) ) . [hyper,440.1.431] P ( e ( e ( e ( x , e ( e ( y , z ) , z ) ) , x ) , y ) ) . [hyper,617,1,5] P ( e ( e ( x , e ( y , e ( y , z ) ) ) , e ( x , z ) ) ) . [hyper,619.1.5] P ( e ( e ( x . e ( e ( y . z ) , z ) ) , e ( x , y ) ) ) . [hyper,777.1.405] P ( e ( e ( e ( e ( x , y ) , e ( y , z ) ) , x ) , z ) ) . [hyper,1472.1,5] P ( e ( e ( e ( x , y ) , e ( y , z ) ) , e ( x , z ) ) ) . [hyper.784,1.405] P ( e ( e ( e ( e ( x , e ( y , z ) ) , z ) , x ) , y ) ) . [hyper,1637,1,5] P ( e ( e ( e ( x , e ( y , z ) ) , z ) , e ( x , y ) ) ) . [hyper,1536,1,784] P ( e ( e ( e ( e ( x , y ) , z ) , e ( z , y ) ) , x ) ) . [hyper,2229,1,1536] PCeCeCe'CeCeCx.y) ,z) ,y) ,x) , z ) ) . [hyper.1707.1.2248] P ( e ( e ( e ( e ( e ( x . y ) , z ) , y ) , z ) , x ) ) . [hyper,2498.1.1707] P ( e ( e ( e ( e ( x , y ) , e ( z , x ) ) , y ) , z ) ) . [hyper,2569,1,5] P ( e ( e ( e ( x , y ) , e ( z , x ) ) , e ( y , z ) ) ) .
Clause (2727) contradicts clause (3), and the first proof is complete. 1 3 4 5
-P(e(x,y)) I -P(x) I P(y). -P(e(e(e(a,b),e(c,a)),e(b,c))). P(e(e(x,y).e(y,x))). P(e(e(e(x,y),z),e(x,e(y,z)))).
6 [hyper,5,1,5] P(e(e(x,y),e(z,e(x,e(y,z))))).
Meeting the Challenge of Fifty Years of Logic
7 8 12 16 127
917
[hyper,5,1,4] P(e(e(x,e(y,z)),e(e(x,y),z))). [hyper,5,1,4] P{e(x,e(y,e(y,x)))). [hyper,8,1,4] P(e(e(x,e(x,y)),y)). [hyper,12,1,5] P(e(x,e(e(x,y),y))). [hyper,6.1,4] P(e(e(x,e(y.e(z,x))),e(y.z))).
138 [hyper,6,1,16] P ( e ( x , e ( y , e ( e ( e ( y , z ) , z ) , x ) ) ) ) . 142 [hyper,6,1,4] P ( e ( x , e ( e ( y , z ) , e ( e ( z , y ) , x ) ) ) ) . 159 [hyper,7,1,5] P ( e ( e ( e ( e ( x , y ) , z ) , x ) , e ( y , z ) ) ) . 1421 [hyper,138,1,7] P ( e ( e ( x , y ) , e ( e ( e ( y , z ) , z ) , x ) ) ) . 1493 [hyper,142,1,7] P ( e ( e ( x , e ( y . z ) ) , e ( e ( z , y ) , x ) ) ) . 1704 [hyper.159,1,127] P ( e ( x , e ( y , e ( z , e ( e ( y , z ) , x ) ) ) ) ) . 3118 [hyper,1421,1,4] P ( e ( e ( e ( e ( x , y ) , y ) , z ) , e ( z , x ) ) ) . 3604 [hyper,1493,1,127] P ( e ( e ( x , y ) , e ( z , e ( y , e ( x , z ) ) ) ) ) . 4589 [hyper.1704,1,7] P ( e ( e ( x , y ) , e ( z . e ( e ( y , z ) , x ) ) ) ) . 9613 [hyper,3604,1,7] P ( e ( e ( e ( x , y ) , z ) , e ( y , e ( x , z ) ) ) ) . 10395 [hyper,4589,1,3118] P ( e ( e ( x , e ( e ( y , x ) , e ( z , y ) ) ) , z ) ) . 17286 [hyper,10395,1,9613] P ( e ( e ( e ( x , y ) , e ( z , x ) ) , e ( y , z ) ) ) . Clause (17286) c o n t r a d i c t s clause ( 3 ) , and the second proof i s complete.
To obtain the second and shorter proof required approximately seven times as much CPU time as was required to obtain the first. Both proofs were obtained on a Sun 3/60 workstation.
5
Challenge Problems
The object of the challenge problems we offer is to prove with an automated reasoning program that each of the following thirteen formulas is by itself a complete axiomatization of equivalential calculus. (YQL) e(e(x,y),e(e(z,y),e(x,z))) (YQF) e(e(x,y),e(e(x, Z ),e( Z ,y))) (YQJ) e(e(x,y),e(e(z,x),e(y,z))) (UM) e(e(e(x,y),z),e(y,e(z,x))) (XGF) e(x,e(e(y,e(x,z)),e(z,y))) (WN) e(e(x,e(y,z)) 1 e(z,e(x > y))) (YRM) e(e(x,y),e(z,e(e(y,z),x))) (YRO) e(e(x,y),e(z,e(e(z,y),x))) (PYO) e(e(e(x,e(y, Z )),z),e(y,x)) (PYM) e(e(e(x,e(y, Z )),y),e(z,x)) (XGK) e(x,e(e(y,e( Z ,x)),e(z,y))) (XHK) e(x,e(e(y,z),e(e(x,z),y))) (XHN) e(x,e(e(y,z),e(e(z,x),y)))
Collected Works of Larry Wos
918
For the clauses that are ordinarily needed to produce an unsatisfiable set, one might begin with the negations of the eight axioms of length 15 given in Section 3. In the promised long paper mentioned in Section 2, we shall include proofs—each obtained with OTTER—that each of the thirteen formulas that are the object of the challenge problems is indeed a single axiom for equivalential calculus. In that paper, to produce a sound argument and avoid the circularity of simply proving that, say, A implies B implies C implies A, we present a tree of implications rooted in the first set of two axioms in turn proved (in 1929 by Lesniewski [2]) to axiomatize equivalential calculus, where Lesniewski's argument rests on the already-mentioned appeal to natural language. For additional test problems, one might seek a proof with an automated reasoning program of any or all of the theorems proved in this article—perhaps a different proof from that given here. For the final test problem, one might try to obtain a proof with an automated reasoning program that symmetry and transitivity e(e(x,y),e(y,x)) e(e(x,y),e(e(y,z),e(x,z))) together imply associativity e(e(e(x,y),z),e(x,e(y,z))). This theorem provides the missing piece in the discussion of reflexivity, symme try, transitivity, and associativity.
6
Conclusions
We have discovered—in part by chance, as so often occurs in science—a sys tematic approach that an automated reasoning program can use for proving that each of thirteen formulas is by itself a single axiom for all of equivalential calculus. The thirteen proofs are of particular interest since no other formula from among the 630 of length 11 has sufficient power to axiomatize, by itself, this area of logic. The approach for obtaining these proofs and others like them relies heavily on the use of the weighting strategy, a strategy that permits the user to assign priorities to formulas and subformulas; those priorities are used to direct a reasoning program in its choice of where next to focus attention, and are also used by the program to discard unwanted conclusions. To put into perspective the research reported here, we first note that proofs of the corresponding thirteen theorems were originally obtained with approxi mately 50 years of excellent research by logicians and other scientists in a period beginning in the late 1920s and ending in 1980. In contrast, OTTER was able to prove the thirteen theorems in a single day of use, which—rather than in any way suggesting that all of the theorems are easy to prove—may mark a significant advance for automated reasoning. Although we did have the distinct advantage of knowing which thirteen—of the possible 630 formulas—to study, in no way did our effort rely on or benefit from knowledge about the specific
Meeting the Challenge of Fifty Years of Logic
919
existing proofs. In fact, when we began the study, we had seen only two such proofs, the two impressive results Winker had found for the formulas known as XHK and XHN; neither proof was used in any way during the investigation. On the other hand, when we began our search for shorter proofs than those found by McCune in his use of OTTER, we did gain important insight about what to try from reading his proofs. In addition to discovering a general approach to proving the thirteen tightly coupled theorems, the proofs we found by using OTTER exhibit unexpected improvements. Specifically, although McCune's proofs—establishing that XHK and XHN are each a single axiom for equivalential calculus—are, respectively, far shorter and far less complex than those found by Winker in 1980, the proofs we then found exhibit a further reduction in length and complexity. Our suc cess suggests that we may have discovered some mechanisms for finding shorter proofs. In particular, to seek a new proof, one can select a step of a known proof and assign such a high weight to the corresponding clause that the reasoning program is prevented from ever focusing on that clause; if, in addition, the assigned weight does not exceed the maximum weight permitted for retained conclusions, then all instances of the chosen clause will be purged with subsumption, preventing the program from using them in a proof. In contrast to this action which blocks the exploration of a given proof, one can encourage the exploration of a path that appears promising by taking one or more steps on that path and assigning such low weights to the corresponding clauses that the program will choose them as the focus of attention before any other retained conclusion. As well as providing evidence of the progress occurring in automated rea soning and of the power of our newest program OTTER, the material presented in this article contains a number of challenge problems. These problems offer a wide spectrum of difficulty and can be used to test new programs and new approaches.
References 1. Kalman, J., 'A shortest single axiom for the classical equivalential calcu lus', Notre Dame J. Formal Logic 19, 141-144 (1978). 2. Lukasiewicz, J., 'The equivalential calculus', pp. 250-277 in Jan Lukasiewicz: Selected Works, L. Borkowski, ed., North-Holland, Amsterdam (1970). 3. McCharen, J., Overbeek, R., and Wos, L., 'Complexity and related en hancements for automated theorem-proving programs', Computers and Mathematics vrith Applications 2, 1-16 (1976). 4. McCune, W., 'OTTER Users' Guide', Technical Report ANL-88-44, Argonne National Laboratory, Argonne, Illinois (1989).
920
Collected Works of Larry Wos
5. Meredith, C , and Prior, B., 'Notes on the axiomatics of the propositional calculus', Notre Dame J. Formal Logic 4, 171-187 (1963). 6. Peterson, J., 'Shortest single axioms for the equivalential calculus', Notre Dame J. Formal Logic 17, 267-271 (1976). 7. Peterson, J., 'An automatic theorem prover for substitution and detach ment systems', Notre Dame J. Formal Logic 19, 119-122 (1978). 8. Smith, B., 'Reference Manual for the Environmental Theorem Prover, An Incarnation of AURA', Technical Report ANL-88-2, Argonne National Laboratory, Argonne, Illinois (1988). 9. Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: In troduction and Applications, Prentice-Hall, Englewood Cliffs, New Jersey (1984). 10. Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., 'A new use of an automated reasoning assistant: Open questions in equivalential calculus and the study of infinite domains', Artificial Intelligence 22, 303356 (1984). 11. Wos, L., Automated Reasoning: S3 Basic Research Problems, PrenticeHall, Englewood Cliffs, New Jersey (1987).
Note The absence and the presence of fixed point combinators* William McCune and Larry Wos Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, Illinois 60439-4801, USA Communicated by C. Bohn Received June 1989 Rrevised May 1990 Abstract McCune, W., and L. Wos, The absence and presence of fixed point combinators, Theoretical Computer Science 87 (1991) 221-228. In this article we give some classes of fragments of weak combinatory logic and show that they fail to admit various fixed point properties. We also present the results of a new technique, the kernel method, for using an automated theorem-proving program to search for fixed point combinators within a given fragment. A key aspect of the work is that experimentation with the kernel strategy led indirectly to proofs of theorems concerning the absence of the fixed point properties.
1
Introduction
The problem of the existence of fixed point combinators (fixed point finders) for a given fragment of weak combinatory logic can be difficult. After successfully attacking many of the exercises in [12] with our automated theorem-proving programs, we began an attack on an open question given to us by Smullyan [11]: Does the fragment from {M, B } , with M x = xx and Bxyz = x(yz), contain fixed point combinators? The interest in the question concerns the existence of normal forms and the solvability of certain term equations [?]. Although we have not answered the question, our study of it has led to a tech nique, the kernel strategy (Section 4), for searching for fixed point combinators either by hand or with an automated theorem-proving program. Experimenta tion with the kernel strategy on many fragments, and close examination of the output of the program when it failed to find fixed point combinators, led to 'This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted from Theoretical Computer Science, Vol. 87, W. McCune and L. Wos, The Absence and the Presence of Fixed Point Combinators, pp. 221-228, 1991, with permission from Elsevier Science.
Collected Works of Larry Wos
922
formulations and proofs of theorems (Section 3) on the absence of fixed point combinators. The completeness of the kernel strategy rests on the following property. If 0 is a fixed point combinator, then there exists a term T such that 6F—»T—>* FT. Although the property fails to hold in general [10], we conjecture (Section 3) that it holds for all fragments given by sets of non-permuting combinators. This class includes the fragment {M, B}. The report [14] contains a full account of the material summarized in this article.
2
Preliminaries
The fragments and related concepts we review in this section follow the normal development of weak combinatory logic (WCL) [4, 5, 2], except that we consider arbitrary finite sets of proper combinators as the basis instead of {S, K} (We use "proper" in the original sense of Curry et al. [4].) 2.1. Language and notation Constants are written as A, B, C, . . . ; variables are written as o, b, c, . . . ; terms are written as 8 , A, B, C, ...; and sets of constants are written as A, B, C An applicative term has a left component and a right component. The term C\ ■ ■ ■ Cn has n components if C\ is atomic. We use "—»" and "«—" for the underlying notions of weak reduction and weak expansion, respectively, in the fragment under consideration. By abuse of language, we sometimes identify a basis with the fragment of WCL it determines. For all examples in this article, we choose from proper combinators defined by the equations in Table 1. Table 1 List of proper combinators Bxyz = x(yz) Lxy = x(yy) Cxyz = xzy Mx = xx Hxyz = xyzy fixyz = xzyz Ix = x Qxyz = y(xz) Kxy = x
Qixyz - x(zy) Sxyz = xz(yz) Wxj/ = xyy Wlxy = yxx
We consider two fixed point properties. A fragment satisfies the weak fixed point property if V/ 3t [t = ft], and it satisfies the strong fixed point property if 3 6 Vz [Gx = x(0x)]
The Absence and the Presence of Fixed Point Combinators
923
(© is called a fixed point combinator). For example, SLL is a fixed point com binator because SLLx —» x(Lx(Lx)) «— x(SLLx). Note that the weak fixed point property follows immediately from the strong fixed point property.
3
The Absence of Fixed Point Properties
We show in this section that several classes of applicative systems fail to satisfy the weak or the strong fixed point property. Definition. A proper combinator is called an isolator if the right side of its reduction rule is either a variable or a term whose left component is a variable. Definition. Consider two terms T and F. The term T has 0 leading F's if F is not the left component of T. The term FT has n + 1 leading F's if T has n leading F's. Lemma 1. If X is a variable, then reduction can never decrease the number of leading X's, and if reduction increases the number of leading X's; then one step of the reduction must be with an isolator. The proof is not difficult and is omitted. Lemma 2. 7/0 is a fixed point combinator, and F is any term, then there exists a sequence of terms T0, Ti, T2, • • • such that 0 F - » T o - » F 7 i - » F ( F T 2 ) - » • • •. The proof, which follows from the Church-Rosser theorem for fragments of WCL, is omitted. Theorem 1. If V is a set of proper combinators in which M is the only isolator, then V fails to satisfy the weak (and therefore the strong) fixed point property. Proof. Assume, by way of contradiction, that M is the only isolator in V a nd that the weak fixed point property holds. Then VF3T[T = FT}. I^et F be a variable. By the Church-Rosser theorem, there exists a term which by Lemma 1 must be of the form FT' for some V, such that T-»FT'«-FT. Therefore, T'<^-T-»FT'. The term FT has one more leading F than T, so by Lemma 1, reduction with an isolator must occur in T—»FT'. The isolating reduction must be F(F(- ■ ■ F(MF) ••■))-» F(F(- ■ ■ F(FF) ■ ■ ■)). Therefore, T' is irreducible, which by the Church-Rosser theorem contradicts
V = FT', a Definition. A proper combinator is called left restricted if the last variable on
924
Collected Works of Larry Wos
the left side of its reduction rule does not occur in the left component of the right side of its reduction rule. For example, B, L, Q, and Qi are left restricted. Theorem 2. If V is a set of proper combinators, and all members ofV are left restricted, then V fails to satisfy the strong fixed point property. Proof. Assume, by way of contradiction, that 0 is a fixed point combinator. Let F be a variable not occurring in ©. By Lemma 2, there exists a term T such that QF-~FT. QF has the form CD, where C is free of F. We show that if a one-step reduction with a left restricted combinator is applied to a term CD, where C is free of F, then the result is a term CD1, where C is free of F. Case 1. The redex is entirely within C or entirely within D. Obvious. Case 2. The redex involves both C and D. The reduction rule for a leftrestricted combinator has the form A.xi • ■ • xn = LR, where L is free of xn. C matches Axi • • Xn-ii and D matches xn. Since L is constructed from nothing more than x\ ■ ■ -x n _i, C", which is an instance of L, is con structed from nothing more than subterms of C. In particular, F does not occur in C". Since 0 is free of F, we conclude that QF does not reduce to FT, for any T. □ Remark 1. Note that, by Theorem 2, {B, L, Q, Qj} fails to satisfy the strong fixed point property. This result answers two questions posed by Smullyan [11] concerning the existence of fixed point combinators in {B, L} and in {L, Q}. Remark 2. Statman's result [13] on the nonconstructibility of a fixed point combinator from a single regular combinator follows from Theorem 2. Definition. A proper combinator is called right terminating if the last variable on the left side of its reduction rule is the only variable that occurs in the right component of the right side of its reduction rule. For example, L, M, N, and W are right terminating. Theorem 3. If V is a set of proper combinators and all members of V are right terminating, then V fails to satisfy the strong fixed point property. Proof. Assume, by way of contradiction, that © is a fixed point combinator. Let F be a variable not occurring in 0 . By Lemma 2, there exists a term T such that QF—»FT. QF has the form CD, where D contains nothing more than occurrences of F. We show that if a one-step reduction with a right-terminating combinator is applied to a term CD, where D contains nothing more than occurrences of F, then the result is CD', such that D1 contains nothing more than occurrences of F. Case 1. The redex is entirely within C. Obvious. STOP
Tie Absence and the Presence of Fixed Point Combinators
925
Case 2. The redex involves both C and D. The reduction rule for a leftrestricted combinator has the form Axi • • • xn = LR, where L is free of x„. C matches A s i • • •!„_!, and D matches xn. Since L is constructed from nothing more than x\ • • -xn-\, C", which is an instance of L, is con structed from nothing more than subterms of C. In particular, F does not occur in C". Since 0 is free of F, we conclude that OF does not reduce to FT, for any T. □ Remark 4. Note that by Theorem 3, {B, L, Q, Qi} fails to satisfy the strong fixed point property. This answers two questions posed by Smullyan [11] con cerning the existence of fixed point combinators in {B, L} and in {L, Q}. We present Statman's result [13] on the nonconstructibility of a fixed point combinator from a single regular combinator as Theorem 4. The result follows from Theorem 3. Theorem 4. If a set V of proper combinators consists of a single regular com binator, then V fails to satisfy the strong fixed point property. Proof. Let A be a regular combinator, and assume by way of contradiction that the strong fixed point property holds for {A}. By Theorem 1, A must be a replicator and an isolator. The reduction rule for A has the form Ax\ ■ ■ ■ xn = xiR. (R is not empty because A is a replicator, and n > 1 because xi does not occur in R.) A is left-restricted because xn does not occur in the left component, which is x\. Therefore, by Theorem 3, the strong fixed point property fails to hold. D Definition. A proper combinator is called right terminating if the last variable on the left side of its reduction rule is the only variable that occurs in the right component of the right side of its reduction rule. For example, L, M, N, and W are right terminating. Theorem 5. If V is a set of proper combinators, and all members of V are right terminating, then V fails to satisfy the strong fixed point property. Proof. Assume, by way of contradiction, that © is a fixed point combinator. Let F be a variable not occurring in ©. By Lemma 2, there exists a term T such that QF—»FT. QF has the form CD, where D contains nothing more than occurrences of F. We show that if a one-step reduction with a right-terminating combinator is applied to a term CD, where D contains nothing more than occurrences of F, then the result is CD", such that D' contains nothing more than occurrences of F. Case 1. The redex is entirely within C. Obvious. Case 2. The redex is entirely within D. This case cannot occur, because D
926
Collected Works of Larry Wos
contains nothing more than occurrences of F. Case 3 . The redex involves both C and D. The reduction rule for a rightterminating combinator has the form A.x\ • • ■ x„ = LR, where R contains nothing more than occurrences of xn. C matches A i i • • -Zn-i. and D matches xn. D' consists of nothing more than occurrences of D, which in turn consists of nothing more than occurrences of F ; therefore, D' consists of nothing more than occurrences of F. Therefore, all terms to which 0 F reduces have a right component that consists of nothing more than occurrences of F. Since F is a variable, the right components are all irreducible, which contradicts 9F-»FTi-»F(FT2). □ Theorem 6. The set V = {L, H, M, N, W , W 1 } fails to satisfy the strong fixed point property. Proof. Assume, by way of contradiction, that 0 is a fixed point combinator. Let F be a variable not occurring in 0 . By Lemma 2, there exist terms T\ and T2 such that © F - » F 7 I - H F ( F T 2 ) . Let T be such that QF^FT' is a head reduction, with T'—»Ti. The last step of the head reduction must be with an isolator, because F is a variable. The only isolators are M and L; if the last step is with M, then V = F , which contradicts F r ' - » F ( F r 2 ) ; therefore, the last step of the head reduction is with L. Consider the corresponding head expansion from FT' to ©F. The first step is with L, to produce LFG, for some G. Any number of subsequent expansions with L produces LF'G', in which F ' has the form L(L(- • • (LF) • • •)), where the number of leading L's is the number of subsequent expansions with L. We may therefore assume that the current term is LF'G' and that the next step is not with L. Consider the next step of the head expansion. Case 1. A head expansion with M produces M(LF'), which cannot be further head expanded with any member of V. Case 2. A head expansion with W produces W L F ' , which cannot be further head expanded. Case 3. A head expansion with W 1 produces W 1 F ' L , which cannot be further head expanded. Case 4. Head expansion cannot occur with N or with H, because each has a reduction rule with four components on the right side, and LF'G' has only three components. The only term of the form © F that can be obtained by expansion is W L F by Case 2; but WL is not a fixed point combinator. D
The Absence and the Presence of Fixed Point Combinators
927
Remark 5. Theorem 6 can be easily extended to cover other combinators and classes of combinator. For example, by Case 4, we can include any combinator whose reduction rule has a right side with more than three components. Conjecture 1 [11]. The set {M, B} fails to satisfy the strong fixed point prop erty. For two years we had conjectured that if © is a fixed point combinator, and F is any term, then there exists a term T such that QF—»T—»FT. However, Jacopini [10] provided a counterexample which we present here (with slight modifications due to Piperno and the authors). Let U", L, and W be proper combinators with reduction rules U"xyz = z(xx(yx)z) Lxy = x(yy) Wxy = xyy. Then U"U"(LW(LW)U") is a fixed point combinator: U"U"(LW(LW)U")F - » F(U"U"(LW(LW)U"U")F) « - F(U"U"(LW(LW)U")F). To see that there is no term T such that U"U"(LW(LW)U")F-»T-».FT, note that whenever F is replicated, U" is also replicated. We now weaken the original conjecture on reducibility by restricting it to combinators with no permutative effect. Of course, more general than our con jecture is the open question that asks for the exact domain within combinatory logic for which the kernel method is complete. Definition. Let P be a proper combinator with reduction rule Px\ ■■ ■ xn = T. P is said to have a permutative effect if T contains two variables Xi and Xj, with i < j , such that in T, Xi occurs to the right of Xj. For example, in Table 1 the combinators with permutative effect are C, H, N, Q, Qi, S, and W 1 . Conjecture 2. If 9 is a fixed point combinator constructed entirely from com binators without permutative effect, and if F is any term, then there exists a term T such that QF-»T-»FT.
4
Searching for Kernels and Fixed Point Combinators
We used the general-purpose automated theorem-proving programs OTTER [7] and ITP [6] to search for fixed point combinators within given applicative sys tems. The programs are resolution/paramodulation theorem provers that oper ate on first-order Skolemized conjunctive-normal-form formulas (clauses). They
928
Collected Works of Larry Wos
offer a variety of inference rules and search strategies, and they are generally directed to attempt proofs by contradiction. See [15] for an introduction to this type of automated theorem-proving program. The clauses for the fixed point studies are simply equalities and negated equalities. The only inference rule required is paramodulation [15], a rule that combines the operations of instantiation and equality substitution into a single step, generalizing the usual concept of equality substitution. For an example of paramodulation, consider two copies of the equation for the combinator B: (1) Bzj/2 = x(yz) and (2) Buinu = u(vw). Paramodulation from the right argument of (1) into the term Bu of (2) constructs the most general unifier {B/x, yz/u) (the most general instantiation that causes x(yz) and Bu to be identical), and in a single step produces BByztnu = yz(vw) by substituting the corresponding instance of the left argument of (1) into the corresponding instance of (2). Paramodulation, although usually unnatural for mathematicians, is amenable to computer implementation and is sometimes effective in proving theorems by computer. In our first substantial fixed point experiments with ITP, we used a simple strategy to attempt to prove the strong fixed point property for the system {B, W } . Each proof constructs a fixed point combinator. After many attempts and many CPU hours on a medium-sized desk-top computer, ITP found Statman's fixed point combinator B(WW)(BW(BBB)) and the following four new, closely related fixed point combinators (all five are equal in the presence of extensionality) [8]. B(B(B(WW)W)B)B B(B(WW)W)(BBB) B(B(WW)(BWB))B B(WW)(B(BWB)B) We next observed that all fixed point combinators © we had found in every applicative system we had considered have the property that for every term F, there exists a term T such that 6F—»T—»FT. The term T is called a reducible fixed point of F [14] or (informally) a kernel of F. The reduction GF-»T-»FT suggested to us a two-stage strategy for searching for fixed point combinators. Stage 1 searches for terms T (kernels) such that T—»FT, where F is a variable, and Stage 2 applies expansions to the kernels T in search of terms 8 , free of the variable F, such that QF—»T. Each such 9 , if any, is a fixed point combinator for the applicative system under study. This two-stage strategy is called the kernel method. With the kernel method, the five fixed point combinators listed above for {B,W} can be found within a few seconds of CPU time. Further details of the kernel method can be found in [14]. We illustrate the kernel method with the result of a search that finds the fixed point combinator B(B(B(WW)W)B)B. The input for Stage 1 consists of four
The Absence and the Presence of Fixed Point Combinators
929
clauses from which we seek a refutation: reflexivity of equality, the equations for the proper combinators B and W , and the denial that the weak fixed point property holds. The assumption that the weak fixed point property fails to hold implies the existence of a combinator F such that Fv =£ v. Stage 1 refutation: X = X 1. 2. Bxyz = x(yz) 3. Wxy = xyy 4. Fv^v 5. (from 2 into 4) BFyz / yz 6. (from 2 into 5) B(BF)uvz jt uvz 7. (from 3 into 6) W(B(BF))vz ? vvz 8. (resolve 1 and 7) D
Fix-pt-F(u) Fix-pt-F(yz) Fix-pt-F(uvz) Fix-pt-F(w.z) Fix-pt-F(W(B(BF)) (W(B(BF)))s)
The symbol F in clause 4 is a Skolem constant—an object for which no fixed point exists. The literal Fix-pt-F(tz) in clause 4 has no logical significance—it is merely a trick (an answer literal) to record the instantiation of the variable in clause 4. If a refutation is found (clause 8 in this example), the answer literal contains a fixed point of F. Each of clauses 5, 6, and 7 is obtained by paramodulating the right argument of either 2 or 3 into the left argument of the preceding clause. Paramodulation with these restrictions guarantees that if we find T, a fixed point of F, then T^»FT; in other words, T is a kernel of F. Note that in this example, the fixed point of F has a free variable z. Stage 2 starts with a kernel of F found in Stage 1 and attempts to expand the kernel into a term GF, in which G contains no occurrences of F. Any such G is a fixed point combinator. The expansions are paramodulation inferences from the right sides of the reduction rules, clauses 2 and 3 in this example. Stage 2: 8. 9. (from 3 into 8) 10. (from 3 into 9) 11. (from 2 into 10) 12. (from 2 into 11) 13. (from 2 into 12)
Fix-pt-F(W(B(BF))(W(B(BF)))z) Fix-pt-F(W(W(B(BF)))(W(B(BF)))) Fix-pt-F(WW(W(B(BF)))) Fix-pt-F(B(WW)W(B(BF))) Fix-pt-F(B(B(WW)W)B(BF)) Fix-pt-F(B(B(B(WW)W)B)BF)
Clause 13 has the desired form, so B(B(B(WW)W)B)B is a fixed point com binator. We note in a final remark about the operation of the kernel method that the searches are not in the spirit of reduction. The Fix-pt-F clauses in Stage 2 are usually free of variables, so the paramodulation inferences in Stage 2 are in the spirit of expansion, but in contrast to reduction, there exist many more expansion paths from a given term. In the Stage 1 searches, the variables
Collected Works of Larry Wos
930
in the negated equalities add additional complexity because of the ability of paramodulation to instantiate variables as it draws inferences. Therefore, in contrast to reduction, the kernel method in general has far more paths to explore at each step. We have applied the kernel method to many applicative systems. In one systematic study, we had the program OTTER search for fixed point combinators from pairs of combinators consisting of B and one other proper combinator. The reduction rule for B is IZxyz = x{yz)\ the other combinator was required to be noneliminating and required to replicate one of its variables once. Of the cases in which the other combinator is regular, we considered those of orders 1, 2, and 3 (the order of a proper combinator is the number of variables on the left side of its reduction rule); there exist none of order 1, two (W and L) of order 2, and 30 (including S, N, and H) of order 3. Of the cases in which the other combinator is irregular, we considered those of orders 1 and 2; there exist one (M) of order 1, and 10 (including O, and W 1 ) of order 2. The total computer time for the study was about 15 CPU minutes. Tables 2 and 3 summarize the results of the study for the regular and ir regular combinators, respectively. In each table, the right column contains a representative fixed point combinator constructed from B and the other com binator, a reason why no fixed point combinator exists, or a question mark indicating that we do not know whether the strong fixed point property holds. Details of the study can be found in [14].
5
Conclusion
We have shown that various applicative systems, including {C, H, M, N, S, W , W 1 } are too weak to satisfy the weak fixed point property and that others, including {B, L, Q, Qi} and {L, H, M, N, W, W 1 } , while satisfying the weak fixed point property, fail to satisfy the strong fixed point property. (See Table 1 for the definitions of these combinators.) Because of the interest in and importance of the combinator S, we have as a corollary that the applicative system consisting of S alone lacks sufficient power to satisfy even the weak fixed point property. The proofs were suggested to us by examining the results of a theorem-proving program that was attempting to prove that the fixed point properties hold. We have also presented an overview of the kernel method, a technique for searching for fixed point combinators within given applicative systems. The ker nel method consists of two stages, first searching for fixed points of an arbitrary combinator (the weak fixed point property), then trying to extend the fixed points into fixed point combinators (the strong fixed point property). The ker nel method is much more efficient than other techniques we have tried—it often finds complex fixed point combinators (as in Section 4, Tables 2 and 3) within a few seconds of computer time. Two questions we have not answered are in Conjectures 1 and 2, Section 3.
The Absence and the Presence of Fixed Point Combinators
Table 2 Regular Combinators with B Combinator/Rule Fixed Point Combinator with B Wxy = xyy Lxy = x(yy) Nxyz = xzyz Hxyz = xyzy Nixyz = xyyz N^xyz = xzzy VTxyz = xyzz N3xyz = xzyy N+xyz = x(yz)z
B(B(B(WW)W)B)B none exists (Theorem 3) B(B(B(N(BNB)v)N)B)B a H(B(H(HB)B)B)(HH) none exists (Theorem 3) B(B(N 2 N 2 (N 2 N 2 ))B)B B(B(W(W*(W*B))B)(W*B))B B(B(B(N 3 BB)(N3(N3N 3 N3)))B)B B(B(N4(N4(N 4 B)(N4(N 4 B)))N4)B)B
NBXJ/Z = x(zy)z
Nexyz = x(zz)y N7xyz = x(yy)z Nsxyz = x(zy)y N3xyz = x(yz)y Sxyz = xz (yz) Sixyz = xz(zy) S&yz = xz(yy) S3xyz = xy(yz) S4xyz = xy(zy) Ssxyz = xy(zz) .xyz = x( ) -xyz ~ x(.(. .)) "v is any term
none exists (Theorem 3) ?
none exists (Theorem 3) none exists (Theorem 3) none exists (Theorem 3) (6 cases) none exists (Theorem 3) (6 cases) none exists (Theorem 3)
931
932
Collected Works of Larry Wos
Table 3 Irregular Combinators with B Combinator/Rule Fixed Point Combinator with B M i = xx Woxy = xyx W1xy = yxx W2xy = yxy W3X2/ = yyx W4XJ/ = xxy Oxy = y(xy) Lixy = x(yx) L 2 xy = y(xx) Lsxy = x(xy) L 4 xy = y(ya;) a
? ? B(B(B(W1W1)(BW1))B)B B(W a w(B(BWa)W 2 ))B a ? none exists (Theorem 3) ? none exists (Theorem 3) ? none exists (Theorem 3) ?
u is any term
Conjecture 1, raised by Smullyan [11], asks whether {M, B} with Mx = xx and Bxyz = x(yz), satisfies the strong fixed point property. (The term M ( B F M ) is a fixed point of F, which shows that {M, B} satisfies the weak fixed point property.) Conjecture 2 concerns the completeness of the kernel method for nonpermutative fragments: If 0 is a fixed point combinator constructed from nonpermutative combinators, and F is any term, then there exists a term T such that 9F—»T—»FT. If Conjecture 2 holds, then the kernel method (with an appropriate search strategy) is an efficient semi-decision procedure for the existence of a fixed point combinator in nonpermutative applicative systems. We have shown [9] that Conjecture 1 follows from Conjecture 2. An aspect of the work reported in [14] but not visited in this paper is a study of the properties of kernels and of a related concept, superkernels. The applicative systems {B,W} and {B,N} are studied in detail in [14], where we give nontrivial enumerations of kernels, superkernels, and fixed point combina tors for those two applicative systems. The report [14] concludes with several additional conjectures about the kernel method and the existence of kernels and fixed point combinators. We believe that the work presented in this paper and in [14] adds new evi dence to the position that automated theorem-proving programs are becoming useful vehicles for research in mathematics and logic, not only in the tedious aspects of the work, but also in some of the insightful aspects.
The Absence and the Presence of Fixed Point Combin&tors
933
Acknowledgment Many thanks go to our colleague Ross Overbeek, who introduced us to combinatory logic and who made practical many of the automated deduction techniques we use. We also thank Raymond Smullyan for suggesting questions to study and for encouraging our effort.
References [1] H. P. Barendregt, correspondence (1987). [2] H. P. Barendregt, The Lambda Calculus: Its Syntax and Semantics (North Holland, Amsterdam, 1981). [3] C. Bohm, correspondence (1989). [4] H. B. Curry, R. Feys, and W. Craig, Combinatory Logic I (North Holland, Amsterdam, 1958). [5] H. B. Curry, J. R. Hindley, and J. P. Seldin, Combinatory Logic II (North Holland, Amsterdam, 1972). [6] E. Lusk and R. Overbeek, The automated reasoning system ITP, Report ANL-84-27, Argonne National Laboratory, Argonne, IL (1984). [7] W. McCune, OTTER user's guide, Report ANL-88-44, Argonne National Laboratory, Argonne, IL (1989). [8] W. McCune and L. Wos, A case study in automated theorem proving: Find ing sages in combinatory logic, J. Automated Reasoning 3(1) (1987) 91-108. [9] W. McCune and L. Wos, unpublished notes (1988). [10] A. Piperno, correspondence (1989). [11] R. Smullyan, correspondence (1986). [12] R. Smullyan, To Mock a Mockingbird (Knopf, New York, 1985). [13] R. Statman, correspondence with Smullyan (1986). [14] L. Wos and W. McCune, Searching for fixed point combinators by using automated theorem proving: A preliminary report, Report ANL-88-10, Ar gonne National Laboratory, Argonne, IL (1988). [15] L. Wos, R. Overbeek, E. Lusk, and J. Boyle, Automated Reasoning: Intro duction and Applications (Prentice-Hall, Englewood Cliffs, NJ, 1984).
RESOLUTION, BINARY Binary resolution (J. Robinson, 1965b), often referred to as resolution, is a for mal inference rule whose use permits computer programs to "reason logically". Specifically, as the examples in the next sections show, a computer program relying on resolution and related inference rules can find new facts and new relationships that follow logically from given facts and relationships. The in troduction of binary resolution (in 1963 at Argonne National Laboratory)— although preceded by a number of approaches to the automation of deductive reasoning—initiated a significant broadening of computer science and the use of computers. Indeed, the research stemming from a study of binary resolution eventually culminated in the formulation of far more powerful inference rules and sophisticated strategies to control their application (Wos and co-workers, 1991; Wos, 1987). These inference rules and strategies form the basis of computer programs, called "automated reasoning programs", that now (in 1991) provide valuable assistance for various types of research and diverse applications. Of the reasoning programs currently in use, the program OTTER (Organized Tech niques for Theorem-proving and Effective Research) is of particular interest (McCune, 1990). Its attractiveness rests with its portability, power, generality, and availability; near the end of this article, the focus is on OTTER and how one can obtain (without cost) this most interesting program. Automated reasoning programs (Lusk and Overbeek, 1984; Smith, 1988; McCune, 1990) can be used to answer open questions from mathematics (Winker and Wos, 1978; Winker and co-workers, 1981; Winker, 1982) and logic (Wos and co-workers, 1983; Wos and co-workers, 1984a; McCune and Wos, 1987; Wos and McCune, 1988), to design superior logic circuits (Wojciechowski and Wojcik, 1983), to validate existing circuit designs (Wojcik, 1983), and to verify various properties claimed for existing computer programs (Boyer and Moore, 1985). Were it not for the formulation of binary resolution and the research it spawned, such programs—and even the field of automated reasoning itself—might not exist today. To provide a complete picture, the article begins with an informal treatment of how resolution works, followed by the formal definitions and properties of resolution and related inference rules. Since automated reasoning programs are not effective without the use of mechanisms to control the application of the inference rules, the focus is on strategy to restrict the reasoning and strategy to direct it. Various reasoning programs, with OTTER as the feature, and curReprinted with permmission from "Resolution, Binary: Its Nature, History, and Impact on the Use of Computers", L. Wos and R. Veroff, in Encyclopedia of Artificial Intelligence, John Wiley & Sons, New York, pp. 1341-1353 (1992). An earlier version appeared in the same encyclopedia, pp. 891-902 (1987).
Resoiution, Binary
935
rent applications are discussed. However, before addressing the various topics, a comparison of a resolution-based approach with the approach that preceded it is presented.
INTRODUCTION AND HISTORICAL SIGNIFICANCE By 1960, various logicians and mathematicians had expressed interest in the objective of using the computer to prove theorems from diverse areas of mathe matics. Computer programs (Davis and Putnam, 1960; Gilmore, 1960; Prawitz and co-workers, 1960; Wang, 1960) had been implemented that could prove ex tremely simple theorems. The most popular approach at the time was to use a particular language of logic (discussed later) and rely on Herbrand instantiation (discussed later). Rather than deducing new facts and relationships from given statements, the Herbrand instantiation approach draws conclusions by merely substituting for the variables in the given statements to yield trivial conse quences of them. In contrast, applications of resolution can yield new informa tion, and hence the reasoning it affords is more substantial. With both Herbrand instantiation and resolution, the object is to consider some given statement cor responding to a purported theorem of the form "if P, then Q" and attempt to prove that the statement is in fact a theorem. With either approach, rather than the given statement, the statement actually considered corresponds to assuming P true and Q false. This choice is made because the approach seeks a "proof by contradiction". For a brief illustration of the instantiation approach, a simple theorem from abstract algebra will suffice—an example, incidentally, that is beyond the power of those early theorem-proving programs that depend on instantiation. A fa vorite example from 1965 until this writing (in 1991) is the theorem "in a group, if the square of every element is the identity, then the group is commutative". Let the theorem be represented symbolically as "if P, then Q", where P consists of the set of axioms for a group together with the special hypothesis that the square of every element is the identity, and where Q is the conclusion that states that the group is commutative. The instantiation procedure begins by assuming the conclusion Q false, and therefore replaces Q with the denial or negation of the conclusion. In particular, it is assumed that (at least) two elements a and 6 exist such that the product ab is not equal to the product 6a. The procedure next calls for the statements of P and those resulting from assuming Q false all to be represented in the "clause language" (Chang and Lee, 1973; Wos and co-workers, 1991). For example, the clause EQUAL(prod(prod(x,y),z),prod(x,prod(y,z))) is an acceptable way to express the associativity of product, (xy)z — x(yz) for all x, y, and z. Let S denote the set of clauses that is thus produced. Then, by
936
Collected Works of Larry Wos
substituting (Herbrand) terms (discussed later) for the variables in the clauses in S, the procedure generates ever-expanding sets of variable-free clauses in search of a set that can be proved truth-functionally unsatisfiable. A set of variable-free clauses is "truth-functionally unsatisfiable" if the set evaluates to false for every consistent assignment of true or false to the elements that make up the clauses in the set. The basic result from logic (Herbrand, 1930, 1967) on which the procedure rests says that if the starting set 5 of clauses does in fact correspond to assuming an actual theorem false, then one of the variable-free sets of clauses considered by the instantiation procedure will be truth-functionally unsatisfiable, and conversely. (As shown later, resolution also relies on the same basic result.) As it turns out, this procedure of considering ever-expanding sets obtained by Herbrand instantiation and then testing for truth-functional unsatisiiability has two undesirable properties. First, the sets of variable-free clauses become very large very early in the consideration, which in turn causes the test for unsatisfiability to become very cumbersome. Second, the generality that often contributes to efficiency in searching for a proof is lacking. In particular, the procedure must cope with many instances of a fact rather than coping with the fact itself. For example, if the purported theorem under investigation were about arithmetic, then the procedure under discussion might be forced to consider 0 + o = oa 0 + (o + o) = (a + a) 0 + -a = -o
rather than coping with 0 + x = x (for all x) which captures the preceding instances as trivial corollaries. Computer programs employing this Herbrand instantiation procedure are not able to prove very interesting theorems. In addition to offering only the most elementary type of reasoning, they typically suffer from employing a levelsaturation search for the desired unsatisfiable set. (The search is called level saturation because all Herbrand terms of level 1 are first considered for substi tution, then those of level 2, and so on.) By formulating the inference rule of binary resolution, Robinson (J. 1965b) provided an important advance over the Herbrand instantiation approach. What he did, directly and indirectly, was provide a means for computers to reason far more effectively than was previously possible. Resolution focuses on gen eral statements rather than on trivial instances of them. In addition, its use avoids truth-functional analysis. Finally, and perhaps most important, Robin son's work led to the formulation of more effective inference rules (J. Robinson, 1965a; Slagle, 1967; G. Robinson and Wos, 1969; Loveland, 1970; Luckham, 1970; Boyer, 1971; Kuehner, 1972; Henschen and Wos, 1974; McCharen and co-
ResoJution, Binary
937
workers, 1976a; Wos and co-workers, 1984b) and to the discovery of powerful strategies (Wos and co-workers, 1964b, 1965; McCharen and co-workers, 1976a) to control the application of inference rules. Such research was prompted by the observation that an approach relying solely on binary resolution is simply not effective for solving most problems. Its application yields too many conclusions, each representing too small a step of reasoning. The need for inference rules that take larger reasoning steps and for strategies to control the reasoning can easily be established with experimentation (McCharen and co-workers, 1976b). The significance of the research triggered by the formulation of resolution is amply demonstrated by the successes achieved with a number of automated reasoning programs (Wos and co-workers, 1964a; Guard and co-workers, 1969; Allen and Luckham, 1970; Bledsoe and Bruell, 1974; Lusk and Overbeek, 1984; Smith, 1988; McCune, 1990) which are based on the results of that research. (Logic programming, and especially Prolog, can be traced to the formulation of resolu tion; see Logic Programming.) The fact that the successes range from answering previously open questions (Winker and Wos, 1978; Winker and co-workers, 1981; Winker, 1982; Wos and co-workers, 1983, 1991; McCune and Wos, 1987; Wos and McCune, 1988) to designing superior logic circuits (Wojciechowski and Wojcik, 1983) establishes that resolution-based reasoning programs are useful in a number of unrelated areas. From the historical perspective, the research that was well under way by 1960 caused an entire field to come into existence. Robinson's contribution of resolution represented an important step forward for that field. (Although the actual paper on resolution was not published until 1965, Robinson formulated the rule in 1963.) The objective of "proving theorems" with a computer program gave the name to the field at the time. It was first called "mechanical theorem proving", then "automatic theorem proving", and finally by 1968 "automated theorem proving" (see Theorem Proving). In 1980, noting that, in addition to finding proofs, the uses of such computer programs include finding models and counterexamples (Winker, 1982), testing hypotheses, and designing circuits, the name "automated reasoning" (Wos and co-workers, 1991) was introduced for the expanded field. Because of the excitement and interest engendered by this new field of automated reasoning, and because resolution plays such a vital role, resolution-based reasoning programs will continue to be the focus of attention for the foreseeable future.
INFORMAL TREATMENT OF BINARY RESOLUTION To gain a feeling for the actions of binary resolution, recall how both modus ponens and syllogism work. Modus ponens applied to the (variable-free) state ments
938
Collected Works of Larry Wos
Nan is female and Nan is not female or Nan is not male yields Nan is not male as the conclusion. Syllogism applied to the (variable-free) statements Nan is French or Nan is Irish and Nan is not Irish or Nan is Spanish yields
Nan is French or Nan is Spanish as the conclusion. If binary resolution is applied to either of the two examples, where the examples are expressed in the clause language, then the conclusions just cited will also be drawn. For example, if the clauses FEMALE(Nan) -FEMALE(Nan)
I
-ALE(Nan)
are considered simultaneously by resolution, then the clause -MALE(Nan)
is obtained as the logical conclusion, where "-" is read as not and "|" is read as or. The conclusion is obtained by "canceling" FEMALE(Nan) in the first clause with -FEMALE(Nan) in the second. In addition to "canceling" part of one clause against part of another, binary resolution relies on "substituting" expressions for variables within a clause. For example, where the symbol x is a variable, the clause -FEMALE(x)
I
-MALE(x)
says that "x is not female or x is not male" for (implicitly) all x. If binary resolution considers this clause simultaneously with the earlier clause FEMALE(Nan) again the conclusion is -MALE(Nan)
939
Resolution, Binary
stating that Nan is not male. In effect, the conclusion is obtained by first sub stituting Nan for the variable x to obtain the temporary clause -FEMALE(Nan)
I -MALE(Nan)
and then canceling as before. Although the actions of binary resolution for this last example have been ex plained as a two-step process, in reality the inference rule has the useful property of drawing conclusions in one step without generating such temporary clauses. (The name "binary resolution" suggests the nature of the inference rule. First, the rule always simultaneously considers two clauses from which to attempt to draw a conclusion, hence "binary". Second, the rule attempts to resolve the question of what is the maximum common ground covered by obvious conse quences of the two clauses, hence "resolution".) In the first of the two examples of applying binary resolution, no effort is required to find the common ground; no substitution for variables is necessary to permit an obvious cancellation. In the second example, however, to find the common ground requires substituting Nan for the variable x in the second clause. A more important property of resolution is the generality of the conclusions yielded by its application. For example, from the clauses -HASAJ0B(x,nurse)
|
MALE(x)
(for all x, x is not a nurse or x is male) -FEMALE(y) I -MALE(y) (for all y, y is not female or y is not male)
binary resolution yields the clause -HASAJOB(x,nurse) I -FEMALE(x) (for a l l x, x i s not a nurse or x i s not female) as the conclusion. It does not yield -HASAJOB(Kim,nurse) I -FEMALE(Kim) (Kim i s not a nurse or Kim i s not female) which also follows logically from the two given clauses. This last conclusion simply lacks the generality that is so vital to the effectiveness of the various automated reasoning programs now in use. In addition to the "generality" property, binary resolution has a vital logical property. The inference rule is "sound"—the conclusions drawn with it follow inevitably from the two statements to which it is applied. Thus the arguments produced by relying solely on resolution are flawless; any flawed piece of in formation must come from a faulty hypothesis. To complement the property of soundness, a desirable property possessed by some inference rules (or some sets of inference rules) is that of "refutation completeness". If an inference rule is refutation complete, then, for any set of clauses corresponding to the denial
940
Collected Works of Larry Wos
(or negation) of a theorem, there exists a procedure employing that inference rule that guarantees to find a proof of the inconsistency of that set eventually. Binary resolution, if augmented by the inference rule of "factoring" (discussed later), has that property. Unfortunately, possession of the properties of soundness and refutation com pleteness does not imply that the inference rule (or set of inference rules) is effective. In fact, binary resolution (even if augmented with factoring) is not effective in most problem domains. The inference rule usually yields too many conclusions, each representing too small a step of reasoning. Nevertheless, pro grams employing binary resolution and factoring as their sole inference rules are far superior to those relying on Herbrand instantiation. Resolution-based programs do actually "reason" rather than merely drawing trivial conclusions by instantiating (substituting for variables) the given information. In particu lar, they deduce new facts and new relationships from existing ones. Since the information deduced with resolution exhibits the generality property discussed earlier, the formulation of resolution represents an important step forward in the quest for computer programs that could and would find proofs of purported theorems. That quest in fact culminated in the implementation of very useful programs (discussed later). Those programs rely on research that can be directly traced to the discovery of binary resolution. In particular, the study of binary resolution led to the formulation of far more effective inference rules and the discovery of powerful strategies for controlling the inference rules.
FORMAL TREATMENT OF BINARY RESOLUTION AND RELATED INFERENCE RULES Binary resolution and related inference rules possess important logical proper ties. These properties contribute to the impetus for using such formal rules. Not only are the arguments produced with such rules logically sound, but, when certain conditions are met, their use guarantees that a "proof by contradiction" can be found. In order to give the precise conditions and discuss "proof by contradiction", certain theorems from logic and various formal definitions are required. Since inference rules are designed to draw conclusions—to operate on statements to produce other statements—a discussion of a language sufficient for representing many problems is also needed.
Representation The most commonly used language for representing information when using binary resolution and related inference rules is the "clause language" (Chang and Lee, 1973; Wos and co-workers, 1991), a language directly descended from
Resolution, Binary
941
the pure first-order predicate calculus. The following definitions briefly formalize the clause language. Definition. A "term" is a constant, a variable, or an n-ary function symbol followed by n arguments all of which are terms. Definition. An "atom" is an n-ary predicate symbol followed by n argu ments all of which are terms. Definition. A "literal" is an atom or the negation of an atom. Definition. A "clause" is a finite disjunction of zero or more distinct literals. All variables in a clause are (implicitly) universally quantified, and their scope is just the clause in which they occur. Definition. A "clause set" is the (implicit) conjunction of a set of clauses. For example, a clause set might consist of the following three clauses. -FEMALE(x) I -MALE(x) FEMALE(x) I MALE(x) -HASAJOBCx,nurse) I MALE(x) An implicit logical and exists between the first and second clauses and also between the second and third. Although the variable x occurs in all three clauses, replacing x by the variable y in the second and replacing x by the variable z in the third produces a logically equivalent set of clauses. (Clauses are treated as having no variables in common.) The literal -MALE(x) is the negation of the atom MALE(x), which itself is a literal. Statements can be represented in the clause language by first representing them (where possible) with a formula in the first-order predicate calculus and then transforming them with a well-known procedure (Chang and Lee, 1973). The procedure first transforms a formula to prenex normal form and then to con junctive normal form and finally removes each existentially quantified variable by instead employing an appropriate function or constant. The functions and constants that are employed are called "Skolem functions" (Davis and Putnam, 1960). The remaining quantifiers are then dropped to yield the set of clauses. Although the procedure does not necessarily produce a logically equivalent for mula, the needed logical properties for proof finding are preserved (discussed later). For example, the clause EqUAL(sum(y,minus(y)),0) is an acceptable translation of the statement "there exists z such that for all y there exists x such that the sum of y and x equals z". This clause employs the Skolem function minus and the Skolem constant (function of no variables) 0, and, although not logically equivalent to the formula from which it is obtained, it conveys the required meaning. The clause language does not accept statements
942
Collected Works of Larry Wos
employing such logical operators as if-then and equivalent, but instead relies on transformations that replace such statements with others that are logically equivalent to them and that use not, or, and (implicitly) and.
Proof Finding The most common use of a resolution-based computer program is to find a proof of some purported theorem. The typical proof found by such a program is a "proof by contradiction". To seek such a proof, a formula in the first-order predicate calculus is written (if possible) that corresponds to assuming the pur ported theorem false. As discussed earlier, the formula is then transformed into a corresponding set of clauses. The definitions and theorems of this section estab lish that, if the first-order formula does in fact represent the denial (or negation) of a theorem, then the resulting set of clauses possesses the needed logical prop erties to permit a proof by contradiction to be found. Before turning to the precise formalism, a trivial example given earlier will serve as an illustration. The specific fact that Nan is female and the general fact that everyone is not female or not male together obviously imply that Nan is not male. If the goal were to have a reasoning program find a proof of this obvious conclusion, the approach calls for assuming the conclusion false. FVom the corresponding clauses 1. 2. 3.
FEMALE(Nan) -FEMALE(x) I -MALE(x) MALE(Nan)
a one-step proof can easily be obtained. By applying binary resolution to clauses 2 and 3, clause 4 4.
-FEMALE(Nan)
is deduced, which obviously contradicts clause 1. Clause 1 is the special hy pothesis, clause 2 the only axiom, and clause 3 the denial (or negation) of the conclusion. With this simple example of a proof by contradiction in view, the formalism that justifies the underlying approach can now be given. Definition. An "interpretation" of a variable-free set of clauses is a uniform assignment of either t r u e or false to each of the literals in the clause set. The assignment must be consistent; if literal L is assigned the value t r u e , then the negation of L must be assigned the value false. Definition. A set of variable-free clauses is "truth-functionally satisfiable" if there exists an interpretation such that the conjunction of the clauses evaluates to t r u e . A set of variable-free clauses is "truth-functionally unsatisfiable" if no interpretation exists that establishes the set to be truth-functionally satisfiable.
Resolution,
943
Binary
D e f i n i t i o n . The "Herbrand universe" for a set S of clauses consists of all well-formed terms that can be composed from the function symbols and individ ual constants that are present in S. When no constants are present, the constant c is supplied. Definition. An "Herbrand interpretation" of a set 5 of clauses is a consistent assignment of either t r u e or false to each of the well-formed expressions that can be composed from the predicates of S and the terms from the Herbrand universe. For the next definition, note that a set 5 of clauses, some of which may contain variables, can be evaluated to t r u e or to false for a given Herbrand interpretation. Such an evaluation can be made by considering the full set of variable-free clauses obtainable by substituting terms from the Herbrand uni verse into the clauses in S. The full set is considered, for recall that the variables in a clause are (implicitly) assumed to mean "for all". Definition. A set 5 of clauses is "satisfiable" if there exists an Herbrand interpretation of S for which S evaluates to true. A set S of clauses is "unsatisfiable" if no Herbrand interpretation exists that establishes the set to be satisfiable; in other words, S evaluates to false for every Herbrand interpreta tion. The following definitions and theorem establish a much simpler criterion for determining the unsatisfiability of a set of clauses. Definition. A "substitution" is a set of ordered pairs U/vi, where the U are terms and the Vi are distinct variables. A substitution is applied to a clause by simultaneously replacing each Vi with the corresponding U. Definition. The clause C" is an "instance" of the clause C if C" can be obtained from C by applying a substitution. Definition. An instance of the clause C is "ground" if C" is variable-free. Theorem. A set 5 of clauses is unsatisfiable if and only if there exists a finite set of (Herbrand) ground instances of S that is truth-functionally unsatisfiable (Herbrand, 1930, 1967; Chang and Lee, 1973; Wos and co-workers, 1991). For example, the unsatisfiability of the set consisting of the clauses P(a,y) -P(x,c)
I
P(b,y)
can be established by considering the clauses P(a,c) -P(a,c) -P(b,c)
I
P(b.c)
which are a truth-functionally unsatisfiable set of ground instances of the pre ceding set of two clauses. Note that there are two distinct instances of the second
944
Collected Works of Larry Wos
clause. One final theorem is needed to justify the approach for finding proofs by relying on the use of the language of clauses. Theorem. A formula of the first-order predicate calculus is unsatisfiable if and only if its representation in clause form is unsatisfiable (Chang and Lee, 1973).
Binary Resolution and Related Inference Rules To define binary resolution, the following definitions are needed. Definition. A "most general common instance" (MGCI), if one exists, of expressions E\ and E% is an expression E such that E is an instance of both E\ and E? and such that, if E' is an instance of both E\ and E2, then E' is an instance of E. Definition. The literals L\ and L2 are said to "unify" if there exists a substi tution that, when applied to both Lj and L2, produces L\ and L^\ respectively, such that L[ = L%. The literals are then said to be "unifiable". A substitution that, when applied, yields an MGCI of two unifiable literals is called a "most general unifier" (MGU). Definition. The inference rule "binary resolution" (J. Robinson, 1965b) yields the clause C from the clauses A and B (implicitly assumed to have no variables in common) when A contains the literal L\, B contains the literal L2, one of L\ and Lz is a positive and the other a negative literal, and (ignoring sign) L\ and Lv are unifiable. The clause C is obtained by finding an MGU of L\ and Li (ignoring sign), applying the MGU to both A and B to yield A' and B\ respectively, and forming the disjunction (without duplicate literals) of A' — {L\Y (A minus a single occurrence of the literal L\) and B' — {£2}'-) The clause C is termed a "resolvent" of A and B, and A and B are termed the "parents" of C. For example, binary resolution applied to the two clauses -P(x) I Q(x,y) P(a) I P ( f ( b . z ) ) yields two clauses Q(a,y) I P ( f ( b , z ) ) Q(f(b,z),y) I P(a) as binary resolvents, depending on which literals are chosen in the parents, the first pair of clauses. On the other hand, binary resolution applied to the clauses Q(y.y) -Q(x,f(x))
Resolution, Binary
945
yields no clauses. The two literals (ignoring sign) cannot be unified. In order to be useful for proof finding, an inference rule should possess the logical properties of "soundness" and "refutation completeness". Definition. An inference rule is "sound" if any clause deduced by applying the rule is a logical consequence of the clauses to which the rule is applied. Theorem. Binary resolution is a sound inference rule (J. Robinson, 1965b). To establish the unsatisfiability of a set of clauses, it is sufficient to deduce a contradiction from that set, which is why the property of refutation completeness is relevant. The following definitions characterize the notion of contradiction in the context of clause sets. Definition. A clause with exactly one literal is called a "unit clause" (or simply a "unit"). Definition. Two clauses are termed "contradictory unit clauses" if each of the two clauses contains a single literal, if the two are opposite in sign, and if the two literals (ignoring sign) can be unified. When two such clauses have been obtained, "unit conflict" has been found. Contradiction can also be defined in terms of the "empty clause", where the empty clause is the empty set of literals. The empty clause can be interpreted as having the value false. The connection between the two notions of contradiction is established by noting that the resolution of two conflicting units yields the empty clause. Given a set of clauses, a deduction of unit conflict (or of the empty clause) with sound rules of inference completes a proof by contradiction of the unsatisfiability of that set of clauses. Definition. An inference rule (or set of inference rules) is "refutation com plete" if for every unsatisfiable set of clauses there exists a procedure relying solely on that inference rule (or set of inference rules) such that a proof by contradiction can be obtained by using the procedure. Although binary resolution is a sound inference rule, it is not by itself refuta tion complete. The following unsatisfiable set of two clauses is a counterexample to its refutation completeness. P(x) I P(y) -P(x) I -P(y) All clauses that can be obtained by repeatedly applying binary resolution, start ing with the two given clauses, contain exactly two literals. However, if binary resolution is employed together with the inference rule "factoring" (Wos and coworkers, 1964b), then the resulting set of inference rules is refutation complete. Definition. The inference rule "factoring" yields the clause C" from the clause C when C contains two literals L\ and L2 that have the same sign and that can be unified. The clause C", called a "factor", is obtained by applying to
946
Collected Works of Larry Wos
C a most general unifier that unifies L\ and Li- In addition, all factors of factors of C are themselves factors of C and are said to be obtained by factoring. For example, the previous two clauses have factors POO and -P(x) respectively, which conflict as units. For another example, the clause P(f(y))
I
-q(f(y))
is a factor of the clause P(x)
I P(f(y))
I
-Q(x)
which can be seen by unifying the first two literals of the second clause. Theorem. Factoring is a sound inference rule. Theorem. The combination of binary resolution and factoring is refutation complete (J. Robinson, 1965b; Chang and Lee, 1973). This theorem might suggest that there exists a decision procedure employing binary resolution and factoring—a procedure that will always correctly identify unsatisfiable and satisfiable sets of clauses. Unfortunately, such is not the case. In fact, no such procedure exists, regardless of which inference rules and strate gies are employed. This deep and complex result is based on theorems of Church (1936) and Turing (1936). In particular, for any given algorithm, finite sets of clauses exist that are satisfiable, but for which the algorithm will be unable to establish that fact in a finite amount of time. This lack of a decision procedure is not critical, however, when the objective is to prove theorems (in contrast to deciding whether some statement is or is not a theorem). Indeed, since the corresponding objective is to prove that some given set of clauses is in fact un satisfiable, the important considerations for an inference rule (or set of inference rules) are soundness, refutation completeness, and effectiveness. Although using binary resolution is not effective for solving most problems, its formulation did lead to the discovery of other closely related and more effec tive inference rules. Definition. The inference rule "hyperresolution" (J. Robinson, 1965a) yields the clause C by considering simultaneously the clause N and the clauses A^. The clauses N and At are assumed pairwise to have no variables in common. For hyperresolution to apply, the clause N must contain at least one negative lit eral, and the clauses Ai must each contain only positive literals. If successful, hyperresolution yields a clause C containing only positive literals. The clause
947
Resolution, Binary
C is obtained by finding an MGU that (ignoring sign) simultaneously unifies one positive literal in each of the Ai with a distinct negative literal in N, ap plying the MGU to yield JV' and Ai, and taking the disjunction of all literals in the Ai and in N' that do not participate in the unification. The clause N is termed the "nucleus" and the clauses Ai the "satellites" for that application of hyperresolution. The clause C is termed a "hyperresolvent". Hyperresolution applied to the 4 clauses 1. 2. 3.
-P(x,y) P(a,x) P(b,c)
4.
Q(x)
|
I -P(y,z)
I
-Q(z)
I
R(x,z)
S(x)
yields R(a,c) I
S(c)
as a hyperresolvent by resolving clause 2 with the first literal of clause 1, clause 3 with the second literal, and clause 4 with the third literal. Where the inference rule of hyperresolution focuses on the signs of the liter als to be present in the conclusion, "UR-resolution" (McCharen and co-workers, 1976a) focuses on the number of literals to be present. Similar to the definition of hyperresolution, the definition of UR-resolution (unit-resulting resolution) can be obtained by observing the following constraints. When the satellites are required to be (positive or negative) unit clauses and the nucleus is constrained to have exactly one more literal than the number of satellites and the con clusion is required to be a unit clause (positive or negative), the definition of UR-resolution is obtained. Other variations of binary resolution include unit res olution (Kuehner, 1972; Henschen and Wos, 1974), semantic resolution (Slagle, 1967), linear resolution (Loveland, 1970; Luckham, 1970), and lock resolution (Boyer, 1971). None of the cited inference rules applies to that case in which the inten tion is to treat equality as "built in". To address that case, the inference rule "paramodulation" (G. Robinson and Wos, 1969) was formulated. Definition. An "equality literal" is a literal whose predicate is to be in terpreted as "equal". The inference rule "paramodulation" yields the clause C from the clauses A and B (implicitly assumed to have no variables in common) when A contains a positive equality literal K and B contains a term t that unifies with one of the arguments of K. Assume without loss of generality that the chosen equality literal K has the form EQUAL(r,s) for terms r and s, and that the first argument is that which is being unified with the chosen term t in B. The clause C is obtained from A and B with the following procedure. First, find an MGU for the argument r and the term t. Second, apply the MGU to A and B, yielding A\ B\ K\ and V as the respective correspondents of A, B, K, and t. Third, generate B" from B' by replacing V by s\ where K' is of the
948
Collected Works of Larry Wos
form EQUAL(r'.s'). Finally, form the disjunction of B" and A' - K' (A* minus a single occurrence of if'). Clause A is called the "from clause", clause B the "into clause", and clause C a "paramodulant". For a trivial example, paramodulation applied to the equation "a + —a = 0" and the statement "o + -a is congruent to b" yields in a single step "0 is congruent to 6". In clause form, from EQUAL(sum(a,minus(a)),0) into CONGRUENT(sum(a,minus(a)),b) the clause CONGRUENT(0,b) is obtained by paramodulation. For a slightly more interesting example, recalling that variables such as x mean "for all x", paramodulation applied to the equation "o H—a = 0" and the statement "x + —o is congruent to x" yields in a single step "0 is congruent to a". In clause form, from EQUAL(sum(a,minus(a)),0) into C0NGRUENT(sum(x,minus(a)),x) the clause CONGRUENT(0,a) is obtained. Finally, for a complex and surprising example, paramodulation ap plied to the equations "x H—x = 0" and "y + (—y + z) = z" yields in a single step "y + 0 = -(—y)". In clause form, from EQUAL(sum(x,minus(x)),0) into EQUAL(sum(y ( sum(minus(y),z)),z) the clause EQUAL(sum(y,0).minus(minus(y))) is obtained by paramodulation. To see that this last clause is in fact a logical consequence of its two parents, unify the argument sum(x,minus(x)) with the term sum(minus(i/),z), apply the corresponding MGU to both the "from" and "into" clauses, and then make the appropriate term replacement.
Resolution, Binary
949
Where resolution combines in a single step the operations of substitution for variables and cancellation of literals, paramodulation combines in a single step the operations of substitution for variables and replacement of (equal) terms. In contrast to binary resolution, paramodulation operates at the term level rather than at the literal level. Consequently, the use of paramodulation often yields shorter and more natural proofs than the use of binary resolution does. In particular, when a proof calls for the substitution of one term for its equal, the use of binary resolution usually requires several deductions to arrive at the desired conclusion. The use of paramodulation, on the other hand, requires but one deduction to perform the substitution. The difference in the number of deductions is explained in part by the fact that resolution treats each predicate syntactically in contrast to paramodulation which treats certain predicates semantically. Specifically, if a predicate is used to mean equality, then paramodulation treats that predicate as if it were "understood" ("built in"). In fact, as is especially evident in the third example of how paramodulation works, this inference rule generalizes the usual notion of equality substitution. Although the use of paramodulation has many advantages, because of oper ating at the term level rather than at the literal level, uncontrolled application can yield far too many clauses. In particular, if the rule is applied to a pair of clauses where the "into clause" contains many terms, many conclusions may be drawn from that single pair of clauses alone. Binary resolution, on the other hand, if applied to that pair will usually yield far fewer conclusions. Simply put, clauses usually contain far fewer literals than terms. Even when all clauses contain only a few terms, uncontrolled application of paramodulation—and, for that matter, of any known inference rule—has the potential of causing a rea soning program to be extremely ineffective. The potential ineffectiveness results from two causes. First, a reasoning program can easily get lost, spending its time focusing on one unwisely chosen clause after another. Second, a reasoning program can easily draw many conclusions that are irrelevant to the question under investigation. What is needed to cope with this potential ineffectiveness is strategy—strategy to direct the reasoning, and strategy to restrict the rea soning.
STRATEGY With the formal treatment of inference rules completed, the focus of attention shifts to strategies to control the various inference rules. Although the inference rules of hyperresolution (J. Robinson, 1965a), UR-resolution (McCharen and coworkers, 1976a), and paramodulation (G. Robinson and Wos, 1969) each give reasoning programs potentially far more reasoning power than is available with binary resolution, their (uncontrolled) individual or collective use is not effective for solving most problems. In most cases, effectiveness is sharply increased with the use of strategy—strategy to direct the reasoning, and strategy to restrict
950
Collected Works of Larry Wos
the reasoning. The first strategy—in fact, the notion of strategy in the context of auto mated theorem proving—was introduced by researchers at Argonne National Laboratory in 1964 (Wos and co-workers, 1964b). That strategy, called "unit preference", directs theorem-proving and reasoning programs to prefer applica tions of binary resolution to some pair of clauses in which at least one of the clauses is a unit clause—a clause that contains one literal. The intuitive justifica tion for the value of this approach is the intention of increasing the probability of producing unit clauses. (Resolving two clauses, one of which is a unit clause and one of which is not, produces a resolvent with at least one less literal than the nonunit clause.) Unit clauses in part derive their importance from the fact that almost all proofs by contradiction can be completed by finding two "conflicting units". (A natural extension of the unit preference strategy can be applied to inference rules other than binary resolution.) Although the introduction in 1964 of the unit preference strategy enabled theorem-proving programs to prove simple theorems that had not previously been proved with such programs, the strategy was discovered to be inadequate for most proof searches. The inadequacy stems from the potential size of the clause set that the program might be forced to search. Even for simple problems, the number of clauses that might be considered can be enormous. Since the unit preference and similar strategies are designed to direct the reasoning, a need also exists for strategies that restrict the reasoning. In general, strategies that restrict the application of inference rules are far more powerful than strategies that direct their application. In response to the need for restriction strategies, the "set of support strategy" (Wos and co-workers, 1965) was formulated in 1965. (Although the strategy was originally formulated to restrict the application of binary resolution, it is cur rently used to effectively control other inference rules employed by automated reasoning programs.) For binary resolution, certain clauses are in effect marked as inadmissible for consideration pairwise by the reasoning program. In partic ular, the marked clauses are not allowed to act together to deduce additional clauses. Any marked clause can, however, participate in a deduction step if the other clause is not marked. Formally, to employ the set of support strategy, the user chooses a (not necessarily proper) subset T of the set S of clauses that rep resents the theorem to be proved or problem to be solved. For a pair of clauses in S to be considered for the application of resolution, at least one of the two clauses must be in T. When a clause deduced with resolution is added to the set of clauses, with respect to the set of support strategy, the clause is treated as if it were an element of the set T. Such clauses can then be considered with any clause from S for possible applications of resolution. The pairs of clauses that are not admissible are those clauses A and B where both A and B are in S-T. From one viewpoint, the intent of using the set of support strategy is to block the reasoning program from drawing conclusions that may have nothing
Resolution, Binary
951
to do with the task at hand. From the opposite viewpoint, the object of using the set of support strategy is to cause the reasoning program to focus on certain clauses, using the other clauses merely to complete some deduction step. If the focal clauses are well chosen, then the conclusions that are drawn will be relevant to the problem under study. In effect, the set of support strategy permits the user to designate certain clauses as key to the study being made. For example, if S — T consists of the basic axioms for the theory from which the problem under study is taken, then the program is prohibited from exploring the underlying theory. One effective choice for T consists of the clauses corre sponding to the special hypothesis of the theorem to be proved together with the clauses resulting from assuming the purported theorem false. For the group theory problem cited earlier, T would then consist of the clause EQUAL(prod(x,x),e) stating that the square of every element is the identity e, and the clause -EQUAL(prod(a,b),prod(b,a)) stating that (at least) two elements exist that do not commute. A second effective choice for T consists of just those clauses resulting from the assumption that the purported theorem is false. For the example from group theory, the clause -EQUAL(prod(a,b),prod(b,a))
would be the only element of T. An analysis of either of the two generally de scribed choices for T shows that the strategy is designed to force a reasoning program to draw conclusions that are relevant to some proof of the theorem under consideration. From a more general viewpoint, recalling that a proof by contradiction is the usual goal, the strategy seeks to take advantage of the known consistency of that set of clauses corresponding to the axioms—those clauses that characterize the underlying theory from which the problem has been selected. After all, applying sound inference rules to a consistent set will yield additional consistent information, but a proof of inconsistency is the goal. The set of support strategy is still considered to be the most powerful strat egy available to reasoning programs. The strategy is "refutation complete", as established with the following theorem. Set of Support Theorem. If S is an unsatisfiable set of clauses, and if T is a subset of S such that S—T is satisfiable, then the imposition of the set of support strategy on the combination of binary resolution and factoring preserves the property of refutation completeness for that combination (Wos and co-workers, 1965). A third strategy, known as the "weighting strategy" (McCharen and coworkers, 1976a), enables the user to direct the reasoning of the computer pro gram according to the user's knowledge and intuition. The user assigns values to the various concepts and symbols in the problem to be solved, and the pro gram chooses where to focus its attention according to priorities based on those
952
Collected Works of Larry Wos
values. The program also purges information from its database when that in formation has a computed value larger than some preassigned limit for retained information. The weighting strategy has proved very useful and in general more effective than the unit preference strategy for directing the reasoning. Two other procedures, "subsumption" (J. Robinson, 1965b) and "demodu lation" (Wos and co-workers, 1967), are in many cases indispensable when using a reasoning program. With subsumption, the clause B is discarded in the pres ence of the clause A when there exists a substitution for the variables in A such that, when applied to A, the result is a subclause of B. For example, the clause P(x) subsumes the clause P(a) in view of the admissible replacement of x by a. Subsumption can be termed a "deletion" strategy although, when it was formulated, the notion of strategy had not yet been introduced to the field of automated theorem proving. Its use purges the database of trivial consequences of existing information. In the cited example, an instance of a clause is subsumed by the clause itself. A more interesting example is provided by the pair of clauses P(x) PCa)
I
Q(b)
in which the first clause subsumes the second. Ironically, subsumption acts in opposition to the earlier procedure based on Herbrand instantiation; the former purges instances, and the latter generates them. Demodulation, on the other hand, rather than removing or adding informa tion to the database, rewrites information by simplifying and canonicalizing it. The corresponding procedure attempts to apply various equality unit clauses, called "demodulators" (Wos and co-workers, 1967), that have been designated for that purpose. As an example of simplification, the clause EQUAL(sum(0,a),b) is immediately rewritten to EQUAL(a,b) in the presence of EQUAL(sum(0,x),x) if the last of the three clauses has been designated a demodulator. As an example of canonicalization, the clause EQUAL(prod(prod(a,x),b),c)
Resolution, Binary
953
is immediately rewritten to EQUAL(prod(a,prod(x,b)),c) in the presence of EQUAL(prod(prod(x,y),z),prod(x,prod(y,z))) if the last of these three has been designated a demodulator. The formulation of demodulation and paramodulation eventually led to the study of complete sets of reductions (Knuth and Bendix, 1970) and rewrite rules.
REASONING PROGRAMS The first resolution-based computer program was designed and implemented by D. Carson (Wos and co-workers, 1964a), and, until 1973, it was considered the most powerful theorem-proving program available. The program was designed to prove theorems, most of which were taken from abstract algebra. It relied heavily on the use of strategy. Experiments with Carson's program led to the discovery of the set of support strategy (Wos and co-workers, 1965) and the concept of demodulation (Wos and co-workers, 1967). In contrast to that first resolution-based program, which was usable only in batch mode, Allen and Luckham (1970) designed and implemented a program that could be used in batch or interactive mode. Their program, also relying on resolution, proved a number of theorems from mathematics. Other useful programs extant in the late 1960s include Green's question-answering program (Green, 1969), Bledsoe's program (Bledsoe and Bruell, 1974), and Guard's pro gram (Guard and co-workers, 1969). Guard's program deserves special mention, for—in addition to offering interactive capability—its use led to finding a new result in mathematics, the lemma from lattice theory known as SAM's lemma. The use of an automated reasoning program to find new results in mathemat ics would not occur again until 1978 when the program AURA (Smith, 1988) was used to answer a previously open question in algebra (Winker and Wos, 1978). AURA, written in IBM assembly language, was designed and implemented by Overbeek with contributions from Smith, Winker, and Lusk. Although the use of AURA led to a number of useful results in mathematics and logic, its lack of portability proved to be a serious disadvantage. Therefore, LMA (Lusk and co-workers, 1982a, 1982b), which is a collection of subroutines written in Pascal for the purpose of implementing automated reasoning programs tailored to the user's specification, was designed and implemented in 1980 by Overbeek, Lusk, and McCune. LMA was used to produce the program ITP (Lusk and Overbeek, 1984) now used by more than 100 institutions for various types of research and diverse applications. Despite the interest shown in ITP, McCune—correctly recognizing that sub stantial changes could be made to produce an even better program—designed
Collected Works of Larry Wos
954
and implemented the program OTTER (McCune, 1990). OTTER (written in C) runs with impressive speed on a wide variety of computers, including per sonal computers. Evidence shows that its performance does not deteriorate with time or with the number of kept clauses; OTTER continuously deduces approxi mately 2000 conclusions per CPU-second on a SPARCstation 1+. Among its in ference rules, OTTER offers binary resolution, hyperresolution, UR-resolution, paramodulation, and various linked inference rules (Wos and co-workers, 1984b). To restrict the actions of the inference rules with the object of increasing the likelihood of drawing relevant conclusions, OTTER offers the set of support strategy. For focusing its reasoning according to the user's dictates, OTTER relies on the weighting strategy. It uses demodulation to automatically simplify and canonicalize information, and uses subsumption to purge its database of certain types of logically weaker information. Potential users of OTTER might find it interesting to note that certain tasks that had required 4 CPU hours (on a SPARCstation 1+) to complete now require approximately 2 CPU minutes (Wos, 1990). The most efficient means to obtain a copy of OTTER (without cost) is electronically. The details can be obtained from its designer, Dr. William McCune, either by electronic mail, mccuneQmcs.anl.gov, or by surface mail, Dr. William McCune Mathematics and Computer Science Division Argonne National Laboratory Argonne, IL 60439-4844.
CURRENT APPLICATIONS The current applications (in 1991) of resolution-based reasoning programs in clude research in mathematics and formal logic (Winker and Wos, 1978; Winker and co-workers, 1981; Winker, 1982; Wos and co-workers, 1983, 1984a; McCune and Wos, 1987; Wos and McCune, 1988), design and validation of logic cir cuits (Wojciechowski and Wojcik, 1979,1983; Wojcik, 1983; Kabat and Wojcik, 1985), verification of claims made for computer programs, database inquiry, and the reasoning required by various expert systems. A number of successes in these diverse areas have been achieved with the assembly-language program AURA (Smith, 1988), which, before the design and implementation of the pro gram OTTER (McCune, 1990), was considered to be the most powerful rea soning program available. With the assistance of AURA, open questions were solved in ternary Boolean algebra (Winker and Wos, 1978), in finite semigroup theory (Winker and co-workers, 1981), and in equivalential calculus (Wos and co-workers, 1983,1984a). Some of the circuits designed (Wojciechowski and Wo jcik, 1983) by relying on this program are superior (with respect to transistor
Resoiution, Binary
955
count) to those previously known. The design of a 16-bit adder was validated (Wojcik, 1983) with AURA. Two recent successes merit particular attention, each achieved with the new program OTTER. The first success focuses on the formulation of the first sys tematic strategy for finding (when they exist) fixed point combinators. With this strategy, known as the kernel strategy, OTTER was used to answer a series of open questions (McCune and Wos, 1987; Wos and MCune, 1988). As evidence of the effectiveness of the new strategy and the power of this new program, we note that some of the questions were answered in less than 1 CPU second on a Sun 3 workstation. The second recent success focuses on a general approach to finding shorter proofs. Using the feature in OTTER that permits the program to compare the lengths of different deductions of the same conclusion, shorter proofs of various theorems of equivalential calculus have been obtained (Wos, 1990).
SUMMARY The formulation in 1963 of the inference rule binary resolution by J. A. Robin son (J. Robinson, 1965b) changed the course of automated theorem proving and, eventually, had a dramatic impact on the use of computers. Briefly, binary reso lution is a way of reasoning that considers two statements in the clause language and attempts to deduce some new fact or new relationship. Since the reason ing programs under study before 1963 (Davis and Puptnam, 1960; Gilmore, 1960) merely substituted terms for the variables in a statement to deduce triv ial consequences, Robinson's formulation of resolution represented a promising development. In one sense, that promise was not fulfilled since, for most problems, applica tion of resolution yields too many steps, each representing too small a reasoning step. On the other hand, the promise was more than fulfilled, for the formula tion of binary resolution did in fact lead to the discovery of other, more effective inference rules (J. Robinson, 1965a; Slagle, 1967; G. Robinson and Wos, 1969; Loveland, 1970; Luckham, 1970; Boyer, 1971; Kuehner, 1972; Henschen and Wos, 1974; McCharen and co-workers, 1976a; Wos and co-workers, 1984b) and to the discovery of powerful strategies (Wos and co-workers, 1964b, 1965; Mc Charen and co-workers, 1976a) to control those rules. For resolution—as well as for all other currently available inference rules—to be effective, strategy to restrict and strategy to direct its application are required. An accurate evaluation of the full significance of the discoveries that can be directly traced to the formulation of resolution cannot be made until var ious objectives have been attained. However, one important goal has already been reached. Now (in 1991) computers can be used to assist in the reasoning required in many areas of research and for many applications. To be able to instruct a single computer program to "reason" from given facts and relation-
956
Collected Works of Larry Wos
ships and have it obey the instructions sufficiently well that desired proofs and models and counterexamples are found gives individuals primarily interested in research access to a valuable assistant. Equally, to have that same program rea son sufficiently well that important information is provided for solving problems in design, validation, control, and testing gives individuals primarily interested in some specific application that same advantage. The effectiveness of a computer program that functions as an automated reasoning assistant is proportional to the types of inference rule and strat egy it offers and to the excellence of its design and implementation. Excellent resolution-based reasoning programs (Lusk and Overbeek, 1984; Smith, 1988; McCune, 1990) are in fact now being used for various kinds of research and diverse applications. The evidence of the preceding few years already shows that the work begun more than 30 years ago has in fact culminated in success. The previously open questions that were answered (Winker and Wos, 1978; Winker and co-workers, 1981; Winker, 1982; Wos and co-workers, 1983, 1984a; Wos and Winker, 1984; Wos and McCune, 1988; McCune and Wos, 1987), the superior circuits that were designed (Wojciechowski and Wojcik, 1983), and the existing circuit designs that were validated (Wojcik, 1983) are examples of what has been achieved with the assistance of a resolution-based reasoning program. The goal pursued by mathematicians and logicians and (eventually) by various other scientists has been reached. Computer programs are now available that function effectively as automated reasoning assistants. The future of automated theorem proving and automated reasoning is by far brighter than at any other time in its history. There now exists (in 1991) the excellent program OTTER, which is easily obtained and which runs with impressive speed on a variety of computers including personal computers. In addition, to complement the book (Wos and co-workers, 1991) which provides a complete introduction to the subject with detailed discussions of various ap plications, there now exists a book (Wos, 1987) presenting in detail research problems to solve. This second book also includes test problems for evaluat ing research ideas and program performance, and the clauses needed to study various areas including set theory. In an important sense, the excellent state of automated reasoning today can be traced to J. A. Robinson's formulation of binary resolution (J. Robinson, 1965b).
BIBLIOGRAPHY W. Bledsoe and P. Bruell, "A Man-Machine Theorem-Proving System", Artif. Intell. 5, 51-72 (1974). R. Boyer, Locking: A Restriction on Resolution, Ph.D. Thesis, University of Texas, Austin, Texas, 1971.
Resolution, Binary
957
R. Boyer and J Moore, "Program Verification", J. Autom. Reas. 1, 17-23 (1985). C. Chang and R. Lee, Symbolic Logic and Mechanical Theorem Proving, Academic Press, New York, 1973. A. Church, "An Unsolvable Problem of Number Theory", Am. J. Math. 58, 345-363 (1936). M. Davis and H. Putnam, "A Computing Procedure for Quantification Theory", JACM7, 201-215 (1960). P. Gilmore, "A Proof Method for Quantification Theory: Its Justification and Realization", IBM J. Res. Devel. 4, 28-35 (1960). C. Green, "Theorem Proving by Resolution as a Basis for Question-Answering Systems", inB. Meltzer and D. Michie, eds., Machine Intelligence, Vol. 4, American Elsevier, New York, 1969, pp. 183-205. J. Guard, F. Oglesby, J. Bennett, and L. Settle, "Semi-Automated Math ematics", JACM 16, 49-62 (1969). L. Henschen and L. Wos, "Unit Refutations and Horn Sets", JACM 21, 590-605 (1974). J. Herbrand, "Recherches sur la Theorie de la Demonstration", Travaux de la Sociite des Sciences et des Lettres de Varsovie, Classe III Science Mathematique et Physiques, University of Paris, 1930. J. Herbrand, "Investigations in Proof Theory: The Properties of Proposi tions", in J. can Heijenoort, ed., From Prege to Godel: A Source Book in Mathematical Logic, Harvard University Press, Cambridge, Mass., 1967, pp. 525-581. W. Kabat and A. Wojcik, "Automated Synthesis of Combinational Logic Using Theorem Proving Techniques", IEEE Trans. Comput. C-34, 610628 (1985). D. E. Knuth and P. B. Bendix, "Simple Word Problems in Universal Al gebras", in J. Leech, ed., Computational Problems in Abstract Algebra, Pergamon Press, New York, 1970, pp. 263-297. D. Kuehner, "Some Special Purpose Resolution Systems", in B. Meltzer and D. Michie, eds., Machine Intelligence, Vol. 7, American Elsevier, New York, 1972, pp. 117-128. D. W. Loveland, "A Linear Format for Resolution", Proceedings of the 1968 IRIA Symposium on Automatic Demonstration, Springer-Verlag, New York, 1970, pp. 147-162.
958
Collected Works of Larry Wos D. Luckham, "Refinements in Resolution Theory", Proceedings of the 1968 IRIA Symposium on Automatic Demonstration, Springer-Verlag, New York, 1970, pp. 163-190. E. Lusk, W. McCune, and R. Overbeek, "Logic Machine Architecture: Kernel Functions", in D. W. Loveland, ed., Lecture Notes in Computer Science, Vol. 138, Springer-Verlag, New York, 1982a, pp. 70-84. E. Lusk, W. McCune, and R. Overbeek, "Logic Machine Architecture: In ference Mechanisms", in D. W. Loveland, ed., Lecture Notes in Computer Science, Vol. 138, Springer-Verlag, New York, 1982b, pp. 85-108. E. Lusk and R. Overbeek, The Automated Reasoning System ITP, Tech nical Report ANL-84-27, Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, 111., 1984. J. McCharen, R. Overbeek, and L. Wos, "Complexity and Related En hancements for Automated Theorem-Proving Programs", Comput. Math. Appl. 2, 1-16 (1976a). J. McCharen, R. Overbeek, and L. Wos, "Problems and Experiments for and with Automated Theorem Proving Programs", IEEE Trans. Comput. C-25, 773-782 (1976b). W. McCune, OTTER 2.0 Users Guide, Technical Report ANL-90/9, Math ematics and Computer Science Division, Argonne National Laboratory, Argonne, 111., 1990. W. McCune and L. Wos, "A Case Study in Automated Theorem Proving: Finding Sages in Combinatory Logic", J. Autom. Reas. 3, 91-107 (1987). D. Prawitz, H. Prawitz, and N. Voghera, "A Mechanical Proof Procedure and Its Realization in an Electronic Computer", JACM7,102-128 (1960). G. Robinson and L. Wos, "Paramodulation and Theorem Proving in FirstOrder Theories with Equality", in B. Meltzer and D. Michie, eds., Machine Intelligence, Vol. 4, American Elsevier, New York, 1969, pp. 135-150. J. Robinson, "Automatic Deduction with Hyper-Resolution", Int. J. Com put. Math. 1, 227-234 (1965a). J. Robinson, "A Machine-Oriented Logic Based on the Resolution Princi ple", JACM12, 2 3 ^ 1 (1965b). J. Slagle, "Automatic Theorem Proving with Renamable and Semantic Resolution", JACM 14, 687-697 (1967).
Resoiution, Binary
959
B. Smith, Reference Manual for the Environmental Theorem Prover, An Incarnation of AURA, Technical Report ANL-88-2, Mathematics and Com puter Science Division, Argonne National Laboratory, Argonne, 111., 1988. A. Turing, "On Computable Numbers, with an Application to the Entscheindungs Problem", Proc. Lond. Math. Soc. 42, 230-265 (1936). H. Wang, "Towards Mechanical Mathematics", IBM J. Res. Devel. 4, 224-268 (1960). S. Winker, "Generation and Verification of Finite Models and Counterex amples Using an Automated Theorem Prover Answering Two Open Ques tions", JACM 29, 273-284 (1982). S. Winker and L. Wos, "Automated Generation of Models and Coun terexamples and Its Application to Open Questions in Ternary Boolean Algebra", Proceedings of the Eighth International Symposium on MultipleValued Logic, IEEE, Rosemont, 111., 1978, pp. 251-256. 5. Winker, L. Wos, and E. Lusk, "Semigroups, Antiautomorphisms, and Involutions: A Computer Solution to an Open Problem, I", Math. Computat. 37, 533-545 (1981). W. Wojciechowski and A. Wojcik, "Multiple-Valued Logic Design by The orem Proving", Proceedings of the Ninth International Symposium on Multiple-Valued Logic, IEEE, New York, 1979, pp. 196-199. W. Wojciechowski and A. Wojcik, "Automated Design of Multiple-Valued Logic Circuits by Automatic Theorem Proving Techniques", IEEE Trans. Comput. C-32, 785-798 (1983). A. Wojcik, "Formal Design Verification of Digital Systems", Proceedings of the Twentieth Design Automation Conference, Miami Beach, Fla., 1983, pp. 228-234. L. Wos, Automated Reasoning: S3 Basic Research Problems, Prentice-Hall, Englewood Cliffs, N.J., 1987. L. Wos, "Meeting the Challenge of Fifty Years of Logic", J. Autom. Reas. 6, 213-232 (1990). L. Wos and W. McCune, Searching for Fixed Point Combinators by Us ing Automated Theorem Proving: A Preliminary Report, Technical Re port ANL-88-10, Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, 111., 1988.
Collected Works of Larry Wos
960
L. Wos and S. Winker, "Open Questions Solved with the Assistance of AURA", in W. W. Bledsoe and D. Loveland, eds., Automated Theorem Proving: After 25 Years, American Mathematical Society, Providence, R.I., 1984, pp. 73-88. L. Wos, G. Robinson, and D. Carson, Some Theorem-Proving Strategies and Their Implementation, Technical Memo 72, Mathematics and Com puter Science Division, Argonne National Laboratory, Argonne, 111., 1964a. L. Wos, D. Carson, and G. Robinson, "The Unit Preference Strategy in Theorem Proving", Proceedings of the Fall Joint Computer Conference, 1964, Thompson Book Co., New York, 1964b, pp. 615-621. L. Wos, D. Carson, and G. Robinson, "Efficiency and Completeness of the Set of Support Strategy in Theorem Proving", JACM 12, 536-541 (1965). L. Wos, G. Robinson, D. Carson, and L. Shalla, "The Concept of Demod ulation in Theorem Proving", JACM14, 698-704 (1967). L. Wos, S. Winker, R. Veroff, B. Smith, and L. Henschen, "Questions concerning Possible Shortest Single Axioms in Equivalential Calculus: An Application of Automated Theorem Proving to Infinite Domains", Notre Dame J. Form. Log. 24, 205-223 (1983). L. Wos, S. Winker, R. Veroff, B. Smith, and L. Henschen, "A New Use of an Automated Reasoning Assistant: Open Questions in Equivalential Calculus and the Study of Infinite Domains", Artif. Intell. 22, 303-356 (1984a). L. Wos, R. Veroff, B. Smith, and W. McCune, "The Linked Inference Principle, II: The User's Viewpoint", in R. E. Shostak, ed., Lecture Notes in Computer Science, Vol. 170, Springer-Verlag, New York, 1984b, pp. 316-332. L. Wos, R. Overbeek, E. Lusk, and J. Boyle, Automated Reasoning: In troduction and Applications, 2nd ed., McGraw-Hill, New York, 1991. General References R. Boyer and J Moore, A Computational Logic, Academic Press, New York, 1979. R. Boyer and J Moore, A Computational Logic Handbook, Academic Press, San Diego, 1988. D. Loveland, Automated Theorem Proving: A Logical Basis, North-Holland, New York, 1978.
Resolution, Binary
961 L. Wos Argonne National Laboratory R. VEROFF
University of New Mexico
Automated Reasoning Contributes to Mathematics and Logic* L. Wos, S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens Mathematics and Computer Science Division Argonne National Laboratory Argonne, IL 60439-4844 R. Butler Division of Computer and Information Science University of North Florida Jacksonville, FL 32216
Abstract In this article, we present some results of our research focusing on the use of our newest automated reasoning program OTTER to prove theorems from Robbins algebra, equivalential calculus, implicational calculus, combinatory logic, and finite semigroups. Included among the results are answers to open questions and new shorter and less complex proofs to known theorems. To obtain these results, we relied upon our usual paradigm, which heavily emphasizes the role of demodulation, subsumption, set of support, weighting, paramodulation, hyperresolution, and UR-resolution. Our position is that all of these components are essential, even though we can shed little light on the relative importance of each, the coupling of the various components, and the metarules for making the most effective choices. Indeed, without these components, a program will too often offer inadequate control over the redundancy and irrelevancy of de duced information. We include experimental evidence to support our position, examples producing success when the paradigm is employed, and examples pro ducing failure when it is not. In addition to providing evidence that automated reasoning has made contributions to both mathematics and logic, the theorems we discuss also serve nicely as challenge problems for testing the merits of a new 'This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38, and by the National Science Foundation under grant CCR-8810947. Reprinted with permission from the Proceedings of the Tenth International Conference on Automated Deduction, Lecture Notes in Artificial Intelligence, Vol. 449, ed. M. E. Stickel, Springer-Verlag, Berlin, 1990, pp. 485^499.
Automated Reasoning Contributes to Mathematics and Logic
963
idea or a new program and provide interesting examples for comparing different paradigms.
1
Objectives and Organization
Consistent with our primary research objectives of contributing to mathematics and logic, designing ever more effective programs, and stimulating additional research, from the preceding year's experiments with our newest program OT TER [5], we select and present certain new results and then focus on the key elements of the underlying paradigm [11] and various implied and as yet unan swered questions. The contributions include new theorems, answers to open questions, shorter proofs, and less complex proofs. They were obtained with a variety of approaches, discussed here, relying to various extents on the use of demodulation, subsumption, the set of support strategy, and weighting. The new results concern Robbins algebra, equivalential calculus, implicational calcu lus, combinatory logic, and finite semigroups. Because of space limitations, we omit the clause proofs and various other details—which are presented in a far more comprehensive Argonne report in preparation [14]—but include the input clauses for each problem. Regarding additional research in automated reasoning itself, we discuss the given experimental data in the context of the control of redundancy and irrel evancy. For example, without the use of demodulation and subsumption, the growth of redundant information will ordinarily be so large that assignment completion can be made impossible. Since we can shed little light on the precise nature and importance of the individual components of the paradigm underly ing our research, and since we understand very little concerning the coupling of these components, the implied questions provide the basis for future research in the field. The evidence we present strongly suggests that paradigms that do not avail themselves of all four major components—demodulation, subsumption, the set of support strategy, and weighting—will, for most studies, offer inade quate power. Even further, the problems on which we focus present challenges for and tests of ideas, approaches, paradigms, and programs. They also provide interesting examples for comparing different paradigms for the automation of reasoning. Regarding additional research in mathematics and logic—whether the goal is to attempt to answer an open question, find a new proof for a known theorem, or simply obtain (possibly the first) computer proof of some theorem—we present various approaches, each within the given paradigm. Among the approaches, we focus on one that relies on a weighting scheme based simply on symbol count, one based on a scheme emphasizing the "tail" of expressions, and one in which the use of weighting is replaced by level saturation. Since we currently cannot explain when and why one approach will be far more successful than another, implicit in this discussion is the basis for research both in automated reasoning
Collected Works of L&rry Wos
964
and in mathematics and logic. A source of additional research rests with the incomplete results we include concerning questions in mathematics that are still open. The thesis throughout this article is that to make contributions to mathe matics and logic by relying on an automated reasoning program, one must have a means to control the deduction of redundant information and also a means to control the deduction of irrelevant information. The means the program OTTER employs consists of the use of demodulation, subsumption, the set of support strategy, and weighting. However, even with reasonable control of redundancy and irrelevancy, one must currently rely on a variety of approaches, for example, by varying the choice of inference rule, of set of support, and of demodulators. One of the different approaches we present here may provide the basis for re search that leads to the answer to an open question, a new and shorter proof, or a computer proof that had not been found earlier.
2
Robbins Algebra
The first area for discussion is Robbins algebra, an area that presents a question that is still open. Is every Robbins algebra a Boolean algebra? A Robbins algebra is a nonempty set satisfying the following three axioms in which the function o can be interpreted as plus and the function n as negation. (Rl) o(x,y) = o(y,x) (R2) o(o(x,y),z) = o(x,o(y,z)) (R3) n(o(n(o(x,y)),n(o(x,n(y))))) = x A Boolean algebra is a nonempty set S with two operations, plus and times, and a 0 and a 1. Each operation is commutative, and each distributes over the other. The 1 is a multipicative identity, and the 0 is an additive identity. In addition, for every x, the negation of x exists with x plus its negation equal to 1 and x times its negation equal to 0. An alternative axiomatization of Boolean algebra consists of Rl, R2, and Huntington's axiom [3]. (H3) o(n(o(n(x),y)),n(o(n(x),n(y))))
=x
Therefore, a way to prove a Robbins algebra Boolean is to derive H3 from R l R3. This question has obviously interested mathematicians, for Tarski and his students studied it [2]. It has been proved that every finite Robbins algebra is a Boolean algebra. Our contributions focus on the addition of one or more properties to see whether the resulting system can be shown to be Boolean. For example, some years previous, we proved that the addition of the single equality o(x, x) = x to the Robbins axioms yields a Boolean algebra. Also, the addition of a 0 such that o(x, 0) = x, or a 1 such that o(x, 1) = 1 suffices. But weaker axioms can be added and still yield a Boolean algebra. For example, the addition of the
Automated Reasoning Contributes to Mathematics and Logic
965
equality o(a,a) = a for some constant a suffices. Even weaker, the addition of o(a, b) = a for some a and 6 suffices. We call these properties sufficiency properties [14]. For this last result, in contrast to the preceding results, our proof required substantial intervention, direction, and a number of runs by Winker using one of our programs. Here we select from recent research two new results concerning the addition of a single equality that guarantees, when considered with the axioms of a Robbins algebra, the properties of a Boolean algebra. Theorem RA-1, near miss equality. If there exist elements a and 6 in a Robbins algebra that satisfy n(o(n(o(a,o(a,b))),n(o(a,n(b))))) = a (which is syntactically similar to R3), the resulting algebra is Boolean. Theorem RA-2. If the equality n(o(x, y)) = i(n(x),n(y)) is adjoined to R1-R3, the resulting algebra is Boolean. (Although intersection has not been defined, the given equality is reminiscent of De Morgan's law.) To attempt to prove that a Robbins algebra is not Boolean, two ways to proceed are (1) find a (infinite) model of R1-R3 that fails to satisfy one of the known sufficiency properties, or (2) prove that from R1-R3, one cannot derive one of the known sufficiency properties.
3
Calculi
In this section, we focus on theorems concerned with possible axiom systems for various logical calculi. The calculi to be visited are equivalential calculus, implicational calculus, and the R-calculus. We begin with equivalential calculus.
3.1 Equivalential Calculus The study of equivalential calculus can be confined to the consideration of for mulas involving variables and a two-place function e such that, in each formula, every variable occurs twice [12]. In addition, the single inference rule condensed detachment suffices; this inference rule permits the deduction of the formula d from the formulas e(a, 6) and c when c and a unify, with d the corresponding instance of 6. If hyperresolution is used, the clause - P ( e ( x , y ) ) I -P(x) I P(y) suffices to encode condensed detachment. Equivalential calculus can be axiomatized with formulas quite reminiscent of reflexivity, symmetry, and transitivity. The following three clauses serve nicely. P(e(x,x)) P(e(e(x,y),e(y,x))) P(e(e(x,y),e(e(y,z),e(x,z)))) In place of this perhaps more natural axiomatization, it can be proved that there exist single formulas each of which provides a complete axiomatization.
966
Collected Works of Larry Wos
The shortest consists of eleven symbols, excluding parentheses and commas, and thirteen such formulas exist. Theorem EC-1. The formula (XHN) e(x, e(e(y, z), e(e(z, x), y))) provides a complete axiomatization for equivalential calculus. Our proof, requiring approximately 443 CPU seconds on a Sun 3, rests on de riving the formula (UM) e(e(e(x,y),z),e(y,e(z,x))) which itself is known to be a single axiom for this area of logic [7]. The question regarding the axiomatic status of XHN was open until Winker obtained a proof in the early 1980s. His original (never published) proof con sisting of 159 derived formulas, the longest of which consists of 103 symbols, was obtained over a period of weeks from a number of runs with one of our earlier programs. We have recently obtained a proof consisting of 23 derived formulas, the longest of which consists of 39 symbols, and in a single run with OTTER. Our approach was one of level saturation combined with a technique for comparing and preferring shorter derivations of each deduced formula. Theorem EC-2. The formula (XHK) e(x,e(e(y,z),e(e(x,z),y))) provides a complete axiomatization for equivalential calculus. Our proof, requiring approximately 461 CPU seconds, rests with the derivation of (YRO) e(e(x>y),e(z,e(e(z,y),x))) which is known to be a single axiom for the calculus. The corresponding open question was first answered by Winker in the early 1980s when he obtained a proof consisting of 83 derived formulas, the longest of which consists of 71 symbols. As with XHN, he extracted the proof from a series of runs with an earlier program. We recently obtained a 35-step proof, the longest formula of which consists of 47 symbols, and in a single run with OTTER. In contrast to the use of level saturation, which led to the cited proof of XHN, for XHK we employed a weighting strategy that emphasizes the consideration of formulas whose righthand major argument is short.
3.2
Implicational Calculus
As with equivalential calculus, there exist single formulas that serve as com plete axiomatizations for implicational calculus; the inference rule of condensed detachment is used. In the preceding CADE conference, one of the challenge problems that was posed asks one to find a computer proof of a theorem by Lukasiewicz concerning such a single axiom [8]. The calculus can be axiomatized with the following three formulas. i(x,i(y,x)) i(i(i(x,y),x),x)
(Simplification) ( P e i r c e ' s Law)
Automated Reasoning Contributes to Mathematics and Logic i(i(x,y),i(i(y,z),i(x,z)))
967
(Hypothetical Syllogism)
Theorem IC-1. The formula i(i(i(x.y), z), i(i(z,x),i(u,x))) plete axiomatization for implicational calculus.
provides a com
Our proof rests with deriving each of the given three axioms, requiring approx imately 11 CPU hours. Our approach involved weighting formulas by symbol count and used hyperresolution as the inference rule.
3.3
R-Calculus
The R-calculus also admits axiom systems that consist of a single formula [7]; condensed detachment again is the inference rule. Indeed, any of the following three formulas, by itself, provides a complete axiomatization. (QYF) (YQM) (WO)
e(e(e(x,y),e(x,z)),e(z,y)) e(e(x,y),e(e(z,y),e(z,x))) e(e(x,e(y,z)),e(z,e(y,x)))
Both of theorems RC-1 and RC-2 answer, respectively, open questions; the two proofs were obtained by Winker in the early 1980s. Theorem RC-1. The following formula is a new shortest single axiom for the R-calculus. {XGJ) e(x,e{e(y,e(z,x)),e{y,z))) Our proof rests with a derivation of the formula WO. Theorem RC-2. The formula (XEH)e(x,e(e{y,e(e(y,z),x)),z)) is not a single axiom for the R-calculus. Our proof rests with producing a complete characterization of the formulas deducible from XEH and showing that none of the given single axioms can be so deduced.
4
Combinatory Logic
In this section we focus on combinatory logic, a field that offers a variety of problems for testing, and sometimes exceeding, the power of an automated rea soning program. Barendregt [1] in effect defines combinatory logic as an equational system satisfying the combinators S and K (defined shortly) with S and K as constants. Noting that expressions are assumed to be left associated un less otherwise indicated, the actions of S and K are given by the following two equations. Sxyz = xz(yz) Kxy = x
968
Collected Works of Larry Wos
If one uses paramodulation as the inference rule, problems from combinatory logic in its entirety can be submitted to the program OTTER with the following axioms. x= x a(a(a(S,x),y),z) = a(a(x,z),a(y,z)) a(a(K,x),y) = x Rather than focusing on combinatory logic as a whole, here we study various fragments, subsets of the logic in which S and K are replaced by other combinators of which the basis of the fragment under consideration consists. In this article, we confine the discussion to the search for what are called combinations. By definition, when given a specific combinator F, a combination from the basis B of the fragment is an expression that satisfies the equation for P. Also, by definition, the length of a combination is the number of occurrences of the basis elements. For a simple example of the type of question under consideration in this section, let us focus on the combinator L with Lxy = x(yy) and the fragment whose basis B consists of the combinators B and W with Bxyz = x(yz) Wxy = xyy Given this basis B, a search for a combination satisfying the equation for L will succeed, finding the combination BWB. For a proof of success, one simply notes that BWBxy = W{Bx)y = Bxyy = x(yy). Given the preceding material as background, let us now turn to some of the theorems we succeeded in proving in our study of combinations. Based on correspondence with Raymond Smullyan, we understand that the theorems presented here make a contribution to combinatory logic, by answering questions that were open concerning the existence, minimal length, and number (of that length) of various combinations. Rather than a complete proof, for each theorem we simply give one of the corresponding combinations and certain additional information, reserving the details (including the precise clauses and parameter settings) for the far more comprehensive Argonne report [14]. We also include some of the pertinent statistics (to permit one to judge the difficulty of the theorem), the input for OTTER, and a summary of the approach we used. These theorems, if viewed as challenge problems for testing programs, ap proaches, or paradigms, do not ask one to verify that the combination that we give fulfills its requirements. Instead, the more interesting challenge is to begin with an appropriate set of axioms—which might include those for equality, espe cially when no mechanism exists for equality-oriented reasoning—and the denial that a combination of the desired type exists. Using as an example the B, W, and L problem discussed earlier—purely for illustration and for a template of
Automated Reasoning Contributes to Mathematics and Logic
969
how to attack the various theorems presented shortly—with one of the notations acceptable to OTTER, one could have the input consist of the following. x= x a(a(a(B,x),y),z) = a(x,a(y,z)) a(a(W,x),y) = a(a(x,y),y) a(a(x,f(x)),g(x)) * a(f(x),a(g(x),g(x))) In contrast, were one simply attempting to have OTTER prove that BWB is a combination that behaves as L does, one would replace the given inequality by the following. a(a(a(a(B,W),B),f),g) != a(f,a(g,g)) The presence of Skolem constants in place of Skolem functions makes the cor responding problem, in general, far easier to solve. Here is a list of the combinators [10] relevant to this section. (B) Bxyz = x(yz) (Q) Qxyz = y(xz) (C) Cxyz = xzy (QO d x y z = x(zy) (F) Fxyz = zyx (T) Txy = yx (G) Gxyzw = xw(yz) (V) Vxyz = zxy (L) Lxy = x(yy) (W) Wxy = xyy (P) Pxyyz = xy(xyz) Theorem CL-1. From the basis consisting of B and T, a combination can be found that satisfies the equation for Q. A proof of the theorem rests with an examination of either of the following two combinators, both found in less than 6 CPU seconds. B(TB)(BBT)
B(B(TB)B)T
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 6. Theorem CL-2. From the basis consisting of B and T, a combination can be found that satisfies the equation for Ql. A proof of the theorem rests with an examination of either of the following two combinators, both found in less than 14 CPU seconds. B(TT)(BBB)
B(B(TT)B)B
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 6. Theorem CL-3. From the basis consisting of B and T, a combination can be found that satisfies the equation for C. A proof of the theorem rests with an examination of either of the following two combinations, both found in less than 19 CPU seconds.
970
Collected Works of Larry Wos
B(T(BBT))(BBT)
B(B(T(BBT))B)T
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 8. Theorem CL-4. From the basis consisting of B and T, a combination can be found that satisfies the equation for F. A proof of the theorem rests with an examination of any of the following five combinations, all found in less than 50 CPU seconds. B(TT)(BB(BBT)) B(B(TT)B)(BBT) B(TT)(B(BBB)T)
B(B(TT)(BBB))T B(B(B(TT)B)B)T
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 8. Theorem CL-5. From the basis consisting of B and T, a combination can be found that satisfies the equation for V. A proof of the theorem rests with an examination of any of the following ten combinations, all found in less than 248 CPU seconds. B(T(BBT))(BB(BBT)) B(B(T(BBT))B)(BBT) B(T(BBT))(B(BBB)T) B(B(T(BBT))(BBB))T B(B(B(T(BBT))B)B)T
B(T(BBT))(BB(BTT)) B(B(T(BBT))B)(BIT) B(T(BBT))(B(BBT)T) B(B(T(BBT))(BBT))T B(B(B(T(BBT))B)T)T
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 10. Theorem CL-6. From the basis consisting of B and T, a combination can be found that satisfies the equation for G. Rather than giving a combination of the desired type, we instead observe that five of length 10 do exist, and no smaller ones suffice. Theorem CL-7. From the basis consisting of B, Q, and W, a combination can be found that satisfies the equation for P with Pxyyz = xy{xyz). A proof of the theorem rests with an examination of either of the following two combinations, both found in less than 11 CPU seconds. QQ(W(Q(QQ)))
B(W(Q(QQ)))Q
In contrast to our approach to proving the preceding six theorems, for this theo rem, we replaced the restriction of paramodulating from the left sides of equali ties into the left sides of inequalities with the restriction of paramodulating from the right sides into the right sides. Moreover, the shortest such combination that we have found in which all three combinators occur, measured in occurrences of
Automated Reasoning Contributes to Mathematics and Logic
971
B, Q, and W, has length 6, and we have also found a combination of length 6 in which B is absent. Our approach to finding appropriate combinations relies heavily on paramodulation and the set of support strategy. In addition, for this type of problem, we frequently restrict paramodulation to be from the left side of positive equalities only and into the left side of the inequalities. We use the ANSWER literal to extract (from each proof) the desired combination.
5
Finite Semigroups
The basic operations of a theorem prover like OTTER can be used to carry out a variety of algebraic operations. For example, given a subset 5 of a set T and a binary operation / on T, it is easy to get OTTER to compute the subset of T generated by S and / . One merely lists the elements of S: P(a) P(b) where p(x) means "x is an element of the set generated by S and / " , and where the elements a, b, ... are the elements of S. One also needs a "closure" axiom -p(x) I -p(y) I p ( f ( x , y ) ) and a definition of / , which can be given as a demodulator f(x.y) Then the standard algorithm of OTTER, computing as it does the logical closure of its input, computes the closure of S in T under / [9]. Optimizations are possible, also within the OTTER framework, if / is associative. Recently we have applied this outlook to the computation of the sizes of certain finite semigroups whose sizes were previously unknown. A semigroup is a set with an associative binary operation. We start by defining the 5-element Brandt semigroup B2 by the following multiplication table: 0 0 0 0 0 0
e 0 e 0 0 b
/ 0 0 / a 0
a 0 a 0 0 /
6 0 0 b e 0
An interesting semigroup, because it plays a key role in classifying other semigroups with certain properties (see [4]) is F2B2, which can be described as follows: Consider all 25-tuples of the form xl ... x25, where xi is in B2. Let
Collected Works of Larry Wos
972
gl = (0,0,0,0,0,e,e,e,e,e,f,f,f,f,f,a,a,a,a,a,b,b,b,b,bR) g2 = (O,e,f,a,b,0,e,f,a,b,0,e,f,a,b,0,e,f,a,b,0,e,f,a,b) (It will be useful to denote these by 0 5 e 5 / 5 a 5 6 5 and (Oefab)5, respectively.) Define F2B2 to be the semigroup generated by gl and g2 under componentwise multiplication in B2 and the "inverse" operation in B2. (The elements 0, e, and / are their own inverses, and a and b are mutual inverses.) Although F2B2 is clearly finite, there are potentially 525 = 298,023,223,876,953,125 elements. In [4], an automated theorem prover similar to OTTER was used to compute that it actually had only 71 elements and to reveal other information about its internal structure. Since the operation in a semigroup is associative, it was possible to take advantage of the optimization cited above, so the input to OTTER consisted of the following clauses, where p(x) is construed to mean that x is an element of F2B2. Axioms g(tup(0,0,0,0,0,e,...,b,b)) g(tup(0,e,f,a,b,0,...,a,b)) g(tup(0,0,0,0,0,e,...,a,a)) g(tup(0,e,f,b,a,0,...,b,a)) -g(x) I -p(y) I p(f(x,y))
Set of Support p(tup(0,0,0,0,0,e,...,b,b)) p(tup(0,e,f,a,b,0,...,a,b)) p(tup(0,0,0,0,0,6,...,a,a)) p(tup(0,e,f,b,a,0,...,b,a))
Demodulators f(tup(xl,x2,...,x25),tup(yl,y2,...,y25)) tup(m(xl,yl),m(x2,y2),...,m(x25,y25)) m(0,x) - 0
m(b,b) - a
In this case the deduction is small enough that almost any theorem prover is adequate. However, related questions are more difficult. The first of these is to compute the size of F3B2, where B2 is as above and F3B2 is the corresponding set of 125-tuples generated by 0 2 5e 2 5/ 2 5a 2 56 2 5 (05e5/Va565)5 (0e/a6) 2 5 and their inverses. This has a potential size of 5supl25. We used OTTER to compute that its actual size was 1435. A semigroup closely related to B2 is the semigroup 521 obtained by ad joining an identity element 1 to B2. One then asks for the sizes of F2B21 and F3J321. The size of F2B21 was readily calculated to be 223. One was left with the following table:
Automated Reasoning Contributes to Mathematics and Logic
B2 £21
F2 71 223
973
F3 1435 ?
Despite the fact that the F3B21 appeared within reach, it turned out to be much larger than expected, and resisted attempts to calculate it until OTTER was moved to a large-memory machine and specially tuned for this problem by adding a special intrinsic for calculating products and some modifications to the underlying data structures to conserve memory. The potential number of elements is 636. Finally, on a Sequent Symmetry with 120 megabytes of memory, the answer 102,303 was obtained. The run was a substantial one, involving generation of 613,818 clauses altogether, of which 511,521 were subsumed in a run lasting more than 7 hours. The most essential feature of OTTER used was its extremely fast forward-subsumption technique. The run also computed substantial information on the internal structure of F3B21. This will be reported on separately.
6
T h e A r t of Exploring Huge Search Spaces
Problems of the sort discussed in this paper vividly illustrate the need to dra matically prune the search space. The programs that we have created to pro duce proofs of such problems are directly based on a number of techniques that address different aspects of redundancy control and search prioritization. In particular, we have made use of subsumption, the set of support strategy, demodulation, and weighting. In this section, we discuss each of these tech niques, pointing out specific problems that illustrate why we believe that each is required.
6.1
S ubsumpt ion
Subsumption offers a straightforward attempt to eliminate redundancy by dis carding clauses that are obviously "weaker" than other existing clauses. Debates have existed for years about the cost of performing subsumption tests, and it is not completely clear that a complete subsumption test is always required. For example, one might test only for cases in which the subsuming clause is a unit, since that test can be performed quickly. Similarly, one can frequently avoid the use of back subsumption (the subsumption of already existing clauses by a newly derived clause) without disastrous consequences. However, we doubt that any system will automatically derive a proof of the following problem from the implicational calculus (posed as a challenge problem by Frank Pfenning at CADE-9 [8]) without using subsumption: - P ( i ( x , y ) ) I -P(x) I P(y) P(i(i(i(x,y),z),i(i(z,x),i(v,x))))
974
Collected Works of Larry Wos
-P(i(i(a,b)li(i(b,c)li(a,c)))) A typical run of our system to demonstrate that this set of clauses is, in fact, unsatisfiable generates over 6,000,000 clauses, of which well over 90 It is worth noting, in the context of subsumption, that we recently wrote a paper [13] with (what we thought were) a graduated set of five problems illustrating the utility of subsumption. To our surprise, Andre Marien was able to solve the fourth problem in the set using a "Prolog Technology Theorem Prover" which did not use subsumption. Mark Stickel has verified his result (by reproducing it on his system). The specific problem asks one to prove that the formula XGK is a single axiom for equivalential calculus, by deriving the formula PYO.
6.2
The Set of Support Strategy
The set of support strategy is not, in fact, a mechanism for redundancy control. Rather, it is used to avoid generation of general lemmas, when a more focused search often produces a proof far more quickly. Examples of the general utility of this strategy are widely available in the literature. Indeed, serious debates have revolved around how best to choose the clauses to be put into the set of support. As always, we encourage the reader to experiment and observe the results on a wide class of problems. To emphasize the utility of the set of support strategy (for some, but certainly not all problems), we propose the following problem: x= x a(a(a(Q,x),y),z) = a(y,a(x,z)) a(a(W,x),y) = a(a(x,y),y) a(a(a(a(x,f(x)),g(x)),g(x)),h(x))!=a(a(f(x),g(x)),a(a(f(x),g(x)),h(x))) This problem is an encoding of a theorem in combinatory logic that states the following: A combinator A can be constructed from the combinators Q and W such that Axyyz = xy(xyz), for arbitrary x, y, and z. It should be noted that this is actually a more general version of a problem proposed in the context of relevance logics by Ohlbach and Wrightson at CADE7 [6]. In our experiments, using paramodulation with minimal constraints (in particular, no paramodulation from or into variables), we found that the use of the set of support strategy (putting just the last clause in the set of support) allowed a proof in less than 10 seconds (on a Sun 4); without the use of set of support, no proof was produced in 10 minutes. A proof produced in less than 30 seconds that did not rely on the use of set of support would be of interest to us.
Automated Reasoning Contributes to Mathematics and Logic
6.3
975
Demodulation
Demodulation is used to control redundancy by performing two distinct func tions: 1. When two apparently distinct terms have been proven equal, it is fre quently critical that one of the references be removed from the set of cur rent clauses. For example, in problems in group theory, one might always wish to rewrite i(i{x)) as x (where i(x) is the inverse of x). 2. In some cases, demodulation is used to rewrite a term into a known canon ical representation (for example, one might wish to right-associate a term in which the function is known to be associative). Clearly, the two uses are closely related, and deeper insights into the basic theory of rewriting have emerged over the last decade. A problem that clearly illustrates the practical role of demodulation can easily be found within the context of Robbins algebras: Input Clauses x = x o(x,y) = o(y,x) o(o(x,y),z) » o(x,o(y,z)) n(o(n(o(x,y)),n(o(x,n(y))))) «= x n(g(x)) = x o(E,E) - E o(n(o(A,n(B))),n(o(n(A),n(B)))) != B n(n(C)) !- C
'/, '/, '/. '/. '/, '/, '/,
Robbins axiom R3 lemma hypothesis denial of Huntington axiom H3 denials of sufficiency properties
o(D,D) !■» D o(x,n(x)) !» x Demodulators
o(x,y) = o(y,x) o ( o ( x , y ) , z ) » o(x,o(y,z)) n(o(n(o(x,y)),n(o(x,n(y))))) « x n(g(x)) » x o(E,E) = E
V, Robbins axiom R3 '/, lemma '/. hypothesis
Our experiments using paramodulation produce computer proofs in a few min utes, and demodulation apparently plays a major role. Again, we would be quite interested in having anyone produce a proof without making heavy use of rewriting.
CoJiected Works of Larry Wos
976
6.4
Weighting
Versions of weighting have now been in use for almost twenty years. The essential notion is that one circumscribes the set of terms that are allowed to appear in clauses, or that one limits the complexity of the clauses that are retained. To do this, a mechanism is used to estimate the complexity of terms and clauses. For example, the most common (and quite useful) measure is just to count the symbols that occur in the term or clause. Various schemes use weighting to discard generated clauses and to prioritize the search by using weighting to dictate when clauses become candidates for use by inference rules. The use of weighting to discard generated clauses that exceed some desig nated complexity can dramatically limit the number of clauses that must be retained. However, the more critical use appears often to be the use of weight ing to order the selection of clauses from the set of support (in particular, the selection of the next clause used to generate new resolvents or paramodulants). We should note that a very simple weighting scheme (such as symbol count) is often adequate. Occasionally, it is very useful to be able to use specialized weighting schemes to produce desired effects. For example, one might preferen tially weight equality clauses that had "heavy" left arguments, but "light" right arguments, to produce rewrite rules that simplify generated clauses. To illustrate the utility of something as simple as symbol count, we urge the reader to consider the problem from the implicational calculus cited earlier under the topic of subsumption. We believe that weighting and subsumption are the two key redundancy control mechanisms required to derive a proof for that problem. Perhaps a more interesting phenomenon is represented by the following problem from the equivalential calculus. -P(e(x,y)) I -P(x) I P(y) -P(e(e(a,b),e(c,e(e(c,b),a)))) P(e(x,e(e(y,z),e(e(x,z),y))))
'/. denial of YRO '/. XHK
A proof that this set is unsatisfiable is straightforward, if preference is given to clauses of the form P(e(tl,t2)) in which the complexity of t2 is less than the complexity of tl (and greater emphasis is placed upon clauses in which the difference is greatest).
6.5
Summary
Our view that effective theorem proving hinges on successful redundancy control is probably an overgeneralization. There are almost certainly interesting theo rems for which proofs can be acquired more quickly by foregoing the cost of the techniques we employ. On the other hand, we seriously doubt that approaches with minimal redundancy control will be at all "robust" in that most of the theorems that can be proven with the techniques of redundancy control cannot be proven without such techniques.
Automated Reasoning Contributes to Mathematics and Logic
7
977
Conclusions
The objectives of this article are three: (1) to present some of the results of our research forays into various areas of mathematics and logic; (2) to offer exper imental data supporting our position concerning essential components for the automation of reasoning when the goal is the proof of interesting theorems; and (3) to suggest challenge problems for measuring the value and power of con cepts, paradigms, and programs. Consistent with these objectives, we began by giving evidence of the value of using an automated reasoning program for mak ing contributions to mathematics and logic. The contributions briefly discussed here include answers to open questions, new theorems, and proofs (of existing results) that are far shorter and far less complex than those previously known. The fields of interest are Robbins algebra, various logical calculi, combinatory logic, and finite semigroups. Focusing on the results of the earlier sections, we discuss the need for using the set of support strategy, demodulation, subsumption, and weighting. Our conjecture is that, without all of these components, a paradigm or program will offer inadequate power when the goal is proving theorems of even moderate difficulty or of attacking open questions. Because of the growing interest in automated reasoning, evidence to the contrary is most welcome. From the viewpoint of challenge problems, whereas some of the theorems discussed here focus on equality-oriented reasoning, for others, such reasoning is irrelevant. These problems vary widely in difficulty; for us to solve them, they required a number of approaches, of course all within our usual paradigm.
References [1] Barendregt, H.P. The Lambda Calculus: Its Syntax and Semantics, NorthHolland, Amsterdam, 1981. [2] Henkin, L., J. Monk, and A. Tarski. Cylindric Algebras, Part I, NorthHolland, Amsterdam, 1971. [3] Huntington, E. New sets of independent postulates for the algebra of logic, with special reference to Whitehead and Russell's Principia Mathematica, Trans. ofAMS 35 (1933), 274-304. [4] Lusk E. and R. McFadden. Using automated reasoning tools: a study of the semigroup F2B2, Semigroup Forum 36, 1 (1987), 75-88. [5] McCune, W. OTTER 2.0 Users Guide, Argonne National Laboratory Report ANL-90/9, 1990.
978
Collected Works of Larry Wos
[6] Ohlbach, H.-J. and G. Wrightson. Solving a problem in relevance logic with an automated theorem prover, Proc. of CADE-7, Springer-Verlag Lecture Notes in Computer Science, Vol. 170, ed. R. Shostak, New York, 1984, 496-508. [7] Peterson J. The Possible Shortest Single Axioms for EC-Tautologies, Aukland University Department of Mathematics Report Series No. 105, 1977. [8] Pfenning, F. Single axioms in the implicational propositional calculus, Proc. of CADE-9, Springer-Verlag Lecture Notes in Computer Science, Vol. 310, ed. E. Lusk and R. Overbeek, New York, 1988, 710-713. [9] Slaney, J. K. and E. Lusk. Parallelizing the closure computation in automated deduction, to appear in the proceedings of CADE-10, 1990. [10] Smullyan, R. To Mock o Mockingbird, A. Knopf, New York, 1985. [11] Wos, L., R. Overbeek, E. Lusk, and J. Boyle. Automated Reasoning: Intro duction and Applications, Prentice-Hall, New York, 1984. [12] Wos, L., S. Winker, B. Smith, R. Veroff, and L. Henschen. A new use of an automated reasoning assistant: open questions in equivalential calculus and the study of infinite domains, Artificial Intelligence 22 (1984), 303-356. [13] Wos, L., R. Overbeek, and E. Lusk. Subsumption, a sometimes undervalued procedure, preprint MCS-P93-0789, Argonne National Laboratory, Argonne, 111., July 1989. [14] Wos, L., S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, and R. Butler. OTTER Experiments Pertinent to CADE-10, Argonne National Labo ratory Report ANL-89/39, to appear.
Automated Reasoning and Bledsoe's Dream for the Field 1 Larry Wos Mathematics and Computer Science Division Argonne National Laboratory Argonne, Illinois
Abstract In one sense, this article is a personal tribute to Woody Bledsoe. As such, the style will in general be that of private correspondence. However, since this article is also a compendium of experiments with an automated reasoning program, researchers interested in automated reasoning, mathematics, and logic will find pertinent material here. The results of those experiments strongly suggest that research frequently benefits greatly from the use of an automated reasoning program. As evidence, I select from those results some proofs that are better than one can find in the literature, and focus on some theorems that, until now, had never been proved with an automated reasoning program, theorems that Hilbert, Church, and various logicians thought significant. To add spice to the article, I present challenges for reasoning programs, including questions that are still open.
1 Coming Attractions Woody, before getting deeply into the material, I feel certain that you would like to have a brief review of what is to come in this letter/article. I think I know you fairly well, and I think you know me fairly well. But, in the lattice of knowledge that one person has about another, greater than my knowledge of you and your knowledge of me is my knowledge of me—or, with regard to the focus of this article, of my research. Mathematics does indeed offer the use of some appropriate—or farfetched—metaphors. 1 This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted from Automated Reasoning: Essays in Honor of Woody Bledsoe, ed. R. S. Boyer, Kluwer Academic Publishers, Dordrecht, 1991, pp. 297-345, with kind permission from Kluwer Academic Publishers.
980
Collected Works of Larry Wos
I think of this document as a letter/article because it is partly a personal tribute to you—and hence, the style is often that of private correspondence— and partly a compendium of experiments with an automated reasoning program. At least to me, the results of those experiments strongly suggest that research frequently benefits greatly from the use of an automated reasoning program. Even the most skeptical should be rather startled at what can now be done with a reasoning program. Especially for you, I promise to select from those results some proofs that are better than one can find in the literature. I also promise to focus on some theorems that, until now, had never been proved with an automated reasoning program—theorems that Hilbert, Church, and various logicians thought worth their attention. Since—as you so well know—I also wish to interest others in what the field has to offer, some of my remarks and observations are directed to researchers in general. The focus of this article is a significant fraction of your grand dream for automated reasoning. From your entrance into the field of automated reasoning until the present, you have daydreamed about a computer friend. Rather than the whole of your grand dream—which will take many years to realize, if ever—I shall concentrate on those aspects that are now a reality, reached far sooner than anyone could have guessed but two decades ago. Although these aspects—also present from the beginning in my dream for the field of automated reasoning— focus on but a fraction of your grander dream, nevertheless the fraction is itself a significant dream to have. You envision an automated reasoning program that will, when instructed for the first time to prove one or more theorems, frequently succeed, and succeed without the researcher playing a key role. You dream of reasoning programs that contribute to mathematics or logic—by finding a better proof than expected, or producing a shorter proof than previously known, or answering an open question. And you hope to see mathematicians and logicians using reasoning programs as assistants in their research. In this article—although you will be hard to convince—I show that this significant fraction of your dream is in fact a reality. As evidence, I outline a fragment of the history of automated reasoning from its birth (approximately 1960) to the present, drawing mainly from experiences with automated reasoning programs designed by colleagues at Argonne National Laboratory. You and I both know that I shall focus mainly on recent results obtained with McCune's powerful program OTTER [17]; I reserve my comments concerning other programs for Note 6. Even in your terms, I may succeed in staying with the truth—we shall see, yes? Rather than a detailed account of people and places, the presentation consists of a sequence of snapshots showing how the effectiveness of automated reasoning gradually increased. The snapshots focus on individual questions, problems, and theorems, and the successes and failures resulting from their consideration by some automated reasoning program. By discussing some of the recent advances in theory, implementation, and application, I answer those who assert the im possibility of the effective automation of reasoning. How can such skeptics still
Automated Reasoning and Bledsoe's Dream for the Field
981
exist? To address the three cited objectives of your and my dream for an automated reasoning program and to illustrate how far automated reasoning has advanced, 1 give examples, examples of successfully proving theorems on the first try— and without much guidance from the user. A second set of examples focuses on finding better proofs than were expected, producing shorter proofs than were known, and answering open questions. The final examples concern the current use of an automated reasoning program by mathematicians and logicians. The rate of recent advances suggests—certainly to me—that still more of your dream is within reach, as the field continues to offer intriguing challenges. Presented here are some of those challenges, including questions—still open— that are amenable to attack with an automated reasoning program. Although the progress is accelerating, there will always exist challenges for research in various areas of theory, implementation, and application. Now at this point I can hear you saying, "Larry, I hear you; my students hear you; the world hears you. But, although I shouldn't be giving advice, I will. Tell me more, and tell the others who might be curious about the new results—expand on what you have just said, and don't mind a little repetition. And, oh yes, let me see in writing some of your opinions and biases, so we can all have a crack at them."
2 Motivation, Dedication, and Organization As in any course, article, book, or mead, certain preliminaries are in order before the entree is served. However, if you prefer to feast immediately, you might simply faat-forward to the next section. The choice of subject for this letter/article is based in part on many stimu lating and enlightening conversations I have had with you, Woody, and is based in part on some recent successful experiments with McCune's automated reason ing program OTTER. By anticipating what you might say, let me now expand somewhat on the three cited goals that are part of your dream for automated reasoning. As will be shown with various examples, regarding those important goals, your dream is now a reality. First, you and I envision an automated reasoning program that will, when instructed for the first time to prove one or more theorems, frequently succeed, and succeed without the researcher playing a key role. Yes, I agree with the thought I am certain you have at this moment, the key point concerns the degree to which the success depends on the researcher's guidance. After all, you and I aim at a program that can function as a colleague—for example, finding a proof with little more than a hint from us. As evidence that this goal has been reached, I shall discuss (in Section 4) a successful attempt to use OTTER to
prove 68 theorems suggested by Dana Scott, and (in Section 5) I shall include a new axiom system auid a shorter proof. If you were focusing on your grand dream, you would at this point comment that we still do poorly with a randomly
982
Collected Works of Larry Wos
selected theorem from a typical advanced mathematics text, and you would be right. But think of it: 68 theorems in one run with OTTER, with no knowledge of any of the corresponding proofs and—of at least fair significance—theorems suggested by Scott. You and I also dream of reasoning programs that contribute to mathematics or logic—by finding a better proof than expected, or producing a shorter proof than previously known, or—best of all—answering an open question. I shall give you examples of each of the three types of contribution. When you read the full story—which I include in this article—of how that already-mentioned new axiom system was actually found, I suspect you will consider the episode as evidence of contributing a bit to mathematics and logic. On the other hand, I suppose the story could also be used as evidence that at least one person interested in automated reasoning conducts research in an odd way. Some gambles win, and some lose—and, sometimes, it is hard to tell which has occurred. And of course you and I hope to see mathematicians and logicians using rea soning programs as assistants in their research. Well, they now do, occasionally, use such programs, and some occurrences are briefly discussed. Since I cannot with certainty rank the given three goals, I shall organize this article by simply considering them in the order cited. The promised outline of a fragment of the history of automated reasoning from its birth (approximately 1960) to the present will provide an appropriate perspective for a full apprecia tion of the significance of reaching the three objectives. Although from today's perspective the beginning was not particularly impressive or promising—I think you share this view—you may find that the evidence offered here shows that we have made impressive advances. The examples have been chosen to reflect the state of the art at various points between 1960 and 1990, beginning with an example that today's re searcher would correctly classify as offering no challenge, and ending with ex amples that—at least some—mathematicians and logicians consider interesting theorems. Far more interesting to me than history is the current state of the art, for it demonstrates that research does benefit greatly from the use of an au tomated reasoning program. The examples will occasionally be accompanied by personal commentary concerning their significance. To answer those who assert the impossibility of the effective automation of reasoning, I also consider some of the recent advances in theory, implementation, and application. For many of the examples, the corresponding input clauses are included and often even the clauses that illustrate a successful completion of the prob lem under study. To aid you in judging whether the dice were loaded or the deck stacked—even you might be a bit skeptical—I occasionally discuss the particular approach that was used to succeed, the parameter settings, and the reasons for choosing that approach. Again, occasional commentary is given. Fi nally, to stimulate research, I include problems that I consider challenging—or even surpassing-—the limits of current automated reasoning programs, and offer questions—still open—that are amenable to attack with some existing program.
Automated Reasoning and Bledsoe's Dream for the Field
983
Throughout this article, in addition to proving theorems, I also discuss di verse ways in which a general-purpose, automated reasoning program can aid research; I focus mainly on McCune's marvelous and portable program OT TER. As you know, this program is based on the paradigm common to the programs designed by colleagues at Argonne. The lesser-known uses include the checking of given proofs, the discovery of problems for testing programs and ideas, the systematic search for shorter proofs, and the identification of errors in the chosen axiom system. Appropriate examples will be included here. For the more familiar use of proving theorems, examples will be given to show how a researcher can move from one attack to another in search of that which is sufficiently effective, thus illustrating the versatility offered by some automated reasoning programs. For the final item of this section, I note that, throughout this article, I express various unsupported opinions, opinions based mostly on experimentation from 1964 to the present. I do so at your repeated encouragement. Indeed, when in conversation I have commented that I can give neither proof nor overwhelming data as the basis for certain utterances, you have replied that I need only issue an appropriate warning. So, Woody, here goes: This article contains commentary that is little more than opinion, and perhaps even bias. The commentary might add spice—for some, the taste of jalapeno peppers—to the presentation (in the following sections) of shorter proofs, new proofs, a new axiom system, new results, new techniques, and new uses of an automated reasoning program.
3 A Fragment of A u t o m a t e d Reasoning from B i r t h t h r o u g h Adolescence This small taste of history provides a perspective for the following sections. In those sections I focus on the new material, and in them I give the hard evidence that three goals of your grander dream have been reached, at least to an important extent. The history presented in this section will also permit others to see how far away those goals were—even a few years ago—how far we have come, and (to some extent) how we got where we are. The first problem (the Davis-Putnam example [2]) I identify with the field is, by today's standards, not very impressive. The Davis-Putnam example asks for a proof of the unsatisfiability of the following set of clauses. (For this and succeeding examples, the notation for clauses is that used to present a problem to OTTER, where "-" means not and "I" means or.) P(x,y). - P ( y , f ( x , y ) ) I - P ( f ( x . y ) , f ( x , y ) ) I Q(x,y). - P ( y , f ( x , y ) ) | - P ( f ( x , y ) , f ( x , y ) ) I -Q(x,f(x,y) I -Q(f(x,y),f(x,y)). Before the introduction of binary resolution [21], this problem was accepted as a challenge for reasoning programs. On the other hand, with the use of
984
Collected Works of Larry Wos
binary resolution, a proof was obtainable in 1963 in essentially no CPU time. Of course, rather than deprecating the quality of the early research, the simplicity of the Davis-Putnam example illustrates what little power was offered by the programs existing before 1963. The problem did serve nicely as a beginning, and—more important to me—the ease with which it was solved with a reasoning program motivated my attempt to obtain computer proofs of theorems from the mathematics literature. The first theorem that was tried is a simple classroom exercise: If in a group the square of every element x is the identity e, the group is commutative. The attempt to prove the theorem failed; after 2,000 clauses were retained, memory was exhausted (on an IBM 704 computer). Since the failure led to the formu lation of the set of support strategy [31], I am still fond of the theorem, even though I recognize its utter simplicity. Since the importance of strategy in gen eral and of the set of support strategy in particular has been repeatedly proven [34], I am continually disappointed at the lack of research directed to that aspect of automated reasoning. To stimulate such research—which was, I admit, one reason I wrote my second book [36]—you and I could pool our personal resources and offer a $20 prize for a significant contribution in the area of strategy. The first attempt to prove that, in a ring, the product of — x and —yisxy also failed. The failure led to the use of lemma adjunction, specifically, the lemmas that assert that the product in either order of 0 and x is 0. The first attempt to prove that subgroups of index 2 are normal failed. To succeed, a primitive form of case analysis was used; one case focused on an element in the subgroup, the other case on an element outside the subgroup. I find this theorem appealing, for it offers some difficulty for a person to prove, and it is somewhat significant from the viewpoint of mathematics. The index 2 problem has added appeal for me, for the attack that succeeded is representative of the way I prefer case analysis to be treated, rather than, say, by automatically splitting every ground clause into its individual literals. Even at the end of the sixties—because of the lack of power offered by the then-current reasoning programs—I knew it was futile to attempt to seek a computer proof of the "commutator theorem": If in a group the cube of every i is the identity e, then [[z,y],{(] = e for all x and y, where the commutator [x,y] of any two elements x and y of a group is the product of x, y, the inverse of x, and the inverse of y. Indeed, although I presented this theorem as an example of the potential use of paramodulation [20], its included clause-notation proof was obtained by hand. As it turned out, the first computer proof of the theorem was obtained with hyperresolution [22]; the first paramodulation proof by computer was not obtained until approximately six years after the problem was suggested. This theorem is now, and will always be, important to me, for its study solidified my interest in paramodulation [33], an interest that has never diminished. The theorem also holds special meaning for me, for Ross Overbeek's reading of the corresponding paper prompted him to enter the field; any estimate of the value of that occurrence falls short of the mark.
Automated Reasoning and Bledsoe's Dream for the Field
985
The four theorems and the results were typical of the 1960s, at least of the research I shared with colleagues. Failure was the expected outcome, and we were seldom disappointed. In other words, the first of your goals for the field of automated reasoning—succeeding moderately often on the first attempt to prove a theorem not tried before—was far in the future, if reachable at all. As it turned out, and as I shall exemplify in the next section, two decades after the close of the 1960s would see the attainment of this goal. Examples of success on the first attempt include theorems of interest to Hilbert, Church, Frege, Bernays, Lukasiewicz, and Tarski. The second goal—a reasoning program making contributions to mathematics and logic—brings me even more excitement than does the first goal. However, except for a brief consideration in the late 1960s of attempting to answer an open question concerning the independence of the first three axioms of the five for a ternary Boolean algebra [30], I was not involved in such an activity un til the late 1970s. In fact, except for the discovery by Guard and associates of SAM's lemma [4], I was almost certain such contributions would not occur in my lifetime. Clearly—and most fortunately—I was in error, for the period from 1978 to the present witnessed the answering of open questions from various fields of mathematics and logic, where the answers were obtained with substantial as sistance from an automated reasoning program. The fields include combinatory logic, finite semigroups, ternary Boolean algebra, Robbins algebra, equivalential calculus, and various areas of logic related to implicational calculus. As for your third goal—the actual use by mathematicians and logicians of automated reasoning programs—until the early 1980s, the only item that oc curs to me concerns Paul Halmos and his visit to the University of Texas. On that visit—and I checked this with Halmos—you and Halmos, using a theorem prover, were able to prove a theorem from Naive Set Theory [5]. Unfortunately, my best recollection says that the theorem occurs between pages 43 and 45; per haps you can supply the needed details. I am not sure this early 1970s incident actually qualifies for "use of an automated reasoning program by a mathemati cian", but it is in the vicinity. On the other hand, without doubt, Kalman's use at Argonne of the pro gram ITP [12, 13] during his stay in the early 1980s clearly qualifies; Kalman was studying various aspects of equivalential calculus, in part in the context of group theory. Kalman continues to conduct research with the aid of a reasoning program; he is now using OTTER for additional studies in group theory. For a second example, Scott has just successfully used OTTER (on his Macintosh) to obtain a proof of the completeness of a Lukasiewicz axiom system for sentential calculus. History is treating our goals well—or do you remain understandably skepti cal? Resist if you can, but I suggest such skepticism may be difficult to maintain when you see what happened here in August 1990, research prompted by Scott's stimulating communication by email. Of course, there will always exist research problems to solve in various areas of automated reasoning. We would not wish
Collected Works of Larry Wos
986
it any other way, for we have each spent a major fraction of our lives in this field. We have certainly shown that the automation of careful reasoning is far more than feasible, contrary to those who assert its impossibility. Although the type of reasoning found in mathematics is indeed deep and beyond complete capturing, we have come much closer than I would have guessed when I entered the field in 1963. Clearly—and this remark is particularly appropriate when addressed to me— care must be exercised to control the obvious enthusiasm; the last time I exer cised such care occurred in approximately 1802. Yes, I am aware that your grand dream is far from realized and that many graduate students could outperform the best of the existing automated reasoning programs if the competition cen tered on randomly selected theorems from mathematics texts. But how many of those students have answered an open question—even further, a question posed by Kaplansky? As you well know, such a question—as well as other open questions—has been answered with crucial assistance from one of Argonne's reasoning programs. Exercising my usual conservative approach, which brings to eye, ear, and mind a herd of stampeding elephants—just between you and me—the results of the next two sections are truly exciting and beautiful!
4 Successes on the First Try: Goal 1 In this and succeeding sections—finally getting to new results and new uses—I am going to emphasize the most recent experiences I have had with OTTER, experiences involving theorems suggested by Dana Scott. The theorems are from various logical calculi, such as sentential calculus. Beginning in 1879, such the orems have occupied the attention of Frege, Russell, Hilbert, Tarski, Bernays, Lukasiewicz, Church, and others of their stature; two books that contain per tinent material are [10, 11]. I shall try hard to tell the truth about how the successes occurred, under what conditions, in what order, and how easily for my colleague McCune and me. However, when I am experimenting and not in the presence of one of my colleagues, I can easily lose the fine details. But, you need not worry; most, if not all, of what I present can be independently verified, so the loss of some of the minute history is not devastating. When Scott returned home after a visit to Argonne in August 1990, he sent by email 68 theorems for OTTER's attempt at proof. The theorems (whose nega tions are given shortly) are numbered 4 through 71 in a study by Lukasiewicz; they are provable from the following three axioms expressed in clause notation. The first of the three can be thought of as transitivity, (x —► y) —» ((y —» z) —» (x —» z)). The second can be read as (-<x —» x) —» x, and the third as x —> (->x —► y). (LI) (L2) (L3)
P(i(i(jc,y),i(i(y,z),i(x,z)))). P(i(i(n(x),x),x)). P(i(x,i(n(x),y))).
Automated Reasoning and Bledsoe's Dream for the Field
987
The rule of inference is condensed detachment, captured with the following clause when hyperresolution is the chosen inference rule. -P(i(x,y))
I -P(x) I P ( y ) .
Lukasiewicz accurately claims that the given three axioms are complete for sentential calculus. An axiom set is complete for sentential calculus if the set of formulas that can be deduced from it with the use of condensed detachment and instantiation is precisely the set of formulas (in effect, unit clauses) that are true under all assignments of true and false, with implication and negation used as logicians use these terms. Therefore, the following 68 theorems, presented as negations to seek a contradiction, must hold. Frequently, throughout the remainder of this article, the theorems in the unnegated form will be referred to as theses. Frequently also, the ANSWER literal (which is ignored by the program when applying an inference rule) is appended to a clause to indicate the role of the clause. The ANSWER literal will usually be abbreviated with "SANS", the word "thesis" with "th", the word "negated" with "neg", and the word "binary" with "bin". i ( i ( i ( q , r ) , i ( p , r ) ) , s ) , i ( i ( p , q ) , s ) ) ) I $ANS(neg_th_04). i ( p , i ( q , r ) ) , i ( i ( s , q ) , i ( p , i ( s , r ) ) ) ) ) | $ANS(neg_th_05). i ( p , q ) , i ( i ( i ( p , r ) , s ) , i ( i ( q , r ) , s ) ) ) ) I $ANS(neg_th_06). i(t,i(i(p,r).s)).i(i(p,q),i(t,i(i(q,r),s))))) $ANS(neg_th_07). i ( q , r ) , i ( i ( p , q ) , i ( i ( r , s ) , i ( p , s ) ) ) ) ) | $ANS(neg_th_08). i ( i ( n ( p ) , q ) , r ) , i ( p , r ) ) ) I $ANS(neg_th_09). p . i ( i ( i ( n ( p ) , p ) , p ) , i ( i ( q , p ) , p ) ) ) ) I $ANS(neg_th_10). i ( q , i ( i ( n ( p ) , p ) , p ) ) , i ( i ( n ( p ) , p ) , p ) ) ) I $ANS(neg_th_ll). t , i ( i ( n ( p ) , p ) , p ) ) ) I $ANS(neg_th_12). i ( n ( p ) , q ) , i ( t , i ( i ( q . p ) . p ) ) ) ) I $ANS(neg_th_13). i ( i ( t , i ( i ( q , p ) , p ) ) l r ) , i ( i ( n ( p ) , q ) l r ) ) ) | $ANS(neg_th_14) i ( n ( p ) , q ) , i ( i ( q , p ) , p ) ) ) I $ANS(neg_th_15). p , p ) ) I $ANS(neg_th_16). p , i ( i ( q , p ) , p ) ) ) I $ANS(neg_th_17). q , i ( p , q ) ) ) I $ANS(neg_th_18). i ( i ( p , q ) l r ) , i ( q , r ) ) ) I $ANS(neg_th_19). : p , i ( i ( p , q ) , q ) ) ) I $ANS(neg_th_20). i ( p , i ( q , r ) ) , i ( q , i ( p , r ) ) ) ) I $ANS(neg_th_21). i ( q , r ) , i ( i ( p . q ) , i ( p , r ) ) ) ) I $ANS(neg_th_22). i ( i ( q , i ( p , r ) ) , s ) . i ( i ( p , i ( q , r ) ) , s ) ) ) I $ANS(neg_th_23). i ( i ( p , q ) , p ) , p ) ) I $ANS(neg_th_24). i ( i ( p , r ) , s ) , i ( i ( p , q ) , i ( i ( q , r ) , s ) ) ) ) I $ANS(neg_th_25). i ( i ( p , q ) , r ) , i ( i ( r , p ) , p ) ) ) I $ANS(neg_th_26). i ( i ( p , q ) , q ) , i ( i ( q , p ) , p ) ) ) I $ANS(neg_th_27). i ( i ( i ( r , p ) , p ) . s ) , i ( i ( i ( p , q ) , r ) , s ) ) ) | $ANS(neg_th_28).
988
Collected Works of Larry Wos
Ci(i(i(p,q),r),i(i(p,r),r))) I $ANS(neg_th_29). (i(i(p,i(p,q)),i(p,q)» I $ANS(neg_th_30). (i(i(p,s),i(i8))) I $ANS(neg_th_58). (i(i(n(p),r),i(i(q,r),i(i(p,q),r)))) I $ANS(neg_th_59). (i(i(s,i(n(p),r)),i(s,i(i(q,r),i(i(p,q),r))))) | $ANS(neg_th_60). (i(i(p,r),i(i(q,r),i(i(n(p),q),r)))) I $ANS(neg_th_61). (i(i(n(n(p)),q),i(p,q))) I $ANS(neg_th_62). (i(q,i(p,p))) I $ANS(neg_th_63). (i(n(i(p,p)),q)) I $ANS(neg_th_64). (i(i(n(q),n(i(p,p))),q)) | $ANS(neg_th_65). (i(n(i(p,q)),p)) I $ANS(neg_th_66). (i(n(i(p,q)),n(q))) | $ANS(neg_th_67). (i(n(i(p,n(q))),q)) I $ANS(aeg_th_68). (i(p,i(n(q),n(i(p,q))))) | $ANS(neg_th_69). (i(p,i(q,n(i(p,n(q)))))) I $ANS(neg_th_70).
Automated Reasoning and Bledsoe's Dream for the Field
989
- P ( n ( i ( i ( p , p ) , n ( i ( q , q ) ) ) ) ) I $ANS(neg_th_71). My esteemed colleague McCune, with whom I have conducted most of the experiments reported here, immediately submitted the 68 theorems to OTTER. He chose hyperresolution as the only inference rule; he placed the clause for condensed detachment in the axioms, the three Lukasiewicz axioms in the set of support, and the 68 negations in the passive list—a list that is inactive except for both testing for the completion of a proof by detecting unit conflict and checking for forward subsumption [21]. For the weighting strategy [15, 34, 36]— the strategy used by OTTER to decide where next to focus its attention—he chose to use symbol count. The motivation was to approach the theorems as simply as possible, keying on the three Lukasiewicz axioms, using the 68 nega tions only to detect the corresponding proofs (if found), and causing OTTER's search for proofs to be directed by focusing at any given point on the shortest formula available. OTTER proved 33 of the theorems before it was decided that more CPU time would yield little additional. A similar attempt with ROO, a parallel version of OTTER, produced 48 proofs. Motivated by the strong urge to demonstrate OTTER's power by sending proofs of all 68 theorems at once to Scott, I decided to make one additional at tempt. The attempt was based on replacing the use of symbol count (to direct OTTER in its choice of where next to focus its attention) by a set of 68 weight templates, each matching the corresponding pattern of occurrences of the func tion i in one of the theorems under attack. I reasoned—hazarded is probably more accurate—that, if the 68 theorems were the steps in a proof of a desired result, then each merited emphasis if and when deduced. It worked, and better than I would have guessed; OTTER proved all 68 theorems in less than 16 CPU minutes on a SPARCstation. As it turned out, Scott was interested mainly in eight of the theses: 16, 18, 24, 21, 35, 39, 40, and 49. He wished to have a single proof of all eight, rather than piecing eight separate results together and tediously removing duplicate steps and such, which he could compare to the Lukasiewicz proof for style differences. A ploy that succeeded focuses on taking the disjunction of the corresponding eight negations and placing it among the axioms; the desired proof is found when the empty clause is generated with the disjunction playing the role of nucleus. He informed me that the resulting 46-step proof more or less matches the style of that given by Lukasiewicz. But the story does not end there. Its ending is given in the next section, where it properly belongs, as an example of a small contribution to logic made by an automated reasoning program. Although three attempts were required to obtain all 68 proofs, the study led to the formulation of an approach—not scientifically justified—that was used on the following example. The theorem in question asks for a proof that the third axiom (FL3) of the Frege/Lukasiewicz axiom system FL (presented by Church) follows from the six axioms (Fl) through (F6), Frege's original axiom
990
CoJiected Works of Larry Wos
system F for sentential calculus. (The first two of the three axioms—theses 18, 35, and 49—of which FL consists are, respectively, the first and second of F.) When OTTER considered the following seven clauses, coupled with the clause for condensed detachment, it found the desired proof on the first try. (Fl th_18) P ( i ( x , i ( y , x ) ) ) . (F2 th_35) P ( i ( i ( x , i ( y , z ) ) , i ( i ( x , y ) , i ( x , z ) ) ) ) . (F3 th_21) P ( i ( i ( x , i ( y , z ) ) , i ( y , i ( x , z ) ) ) ) . (F4 th_39) P ( i ( i ( x , y ) , i ( n ( y ) , n ( x ) ) ) ) . (F5 th_40) P ( i ( n ( n ( x ) ) , x ) ) . (F6 th_46) P ( i ( x , n ( n ( x ) ) ) ) . (FL3 neg_th_49) - P ( i ( i ( n ( p ) , n ( q ) ) , i ( q , p ) ) ) I $ANS(step_FL3). The approach was again to rely on the weight templates whose pattern of the function t matches the 68 theses just discussed. At this point, you might properly wonder what possible explanation I can give for such an action, especially since I was seeking but one of the 68 proofs, that of 49. Explanation: if the use of those 68 patterns as weight templates enabled McCune and me to send to Scott the proofs of the test problems he suggested, then those patterns must be good ones, good ones for other theorems in this area of logic;—even if the axioms (hypotheses) were changed. Reasoning of this type accounts for the fact that some gamblers win great sums; it also accounts for the fact that most gamblers lose their entire stake. As it turned out, the sought-after proof was obtained in less than 1 CPU second, a proof of 14 steps. Since the proof was obtained on the first attempt, do we not have overwhelming evidence of the realization of the first goal, or is the evidence—at least to this point—underwhelming? I then took for weight templates the patterns suggested by the 14 steps of the proof, set the appropriate flags to instruct OTTER to seek possibly shorter proofs of (FL3), and obtained in one run the following 11-step proof in 6 CPU seconds. (In Note 5, I have more to say concerning the importance of seeking shorter proofs and the use of weight templates.) The number in the first field gives the corresponding position of the clause among those retained during OTTER's attempt. The expression hyper,x,y,z typically denotes that x is the clause in focus, y is the nucleus, z is the other satellite (for condensed detachment), and hyperresolution is the inference rule. 1 2 3 4 5 6 7 8
G [] [] [] [] [] [] []
-P(i<x,y)) 1 -P(x) I P(y). P(i(x,i(y,x))). P(i(i(x,i(y,z)),i(i(x,y),i(x,z)))). P(i(i(x.i(y,z)),i(y,i(x,z)))). P(i(i(x,y),i(n(y),n(x)))). P(i(n(n(x)),x)). P(i(x,n(n(x)))). - P ( i ( i ( n ( p ) , n ( q ) ) , i ( q , p ) ) ) I $ANS(step_FL3).
Automated Reasoning and Bledsoe's Dream for the Field
991
22 [hyper,4,1,3] P ( i ( i ( x , y ) , i ( i ( x , i ( y , z ) ) , i ( x , z ) ) ) ) . 25 [hyper,5,1,4] P ( i ( n ( x ) , i ( i ( y , x ) , n ( y ) ) ) ) . 33 [hyper,6,1,2] P ( i ( x , i ( n ( n ( y ) ) , y ) ) ) . 50 [hyper,22,1,7] P ( i ( i ( x , i ( n ( n ( x ) ) , y ) ) , i ( x , y ) ) ) . 56 [hyper,25,1,2] P ( i ( x , i ( n ( y ) , i ( i ( z , y ) , n ( z ) ) ) ) ) . 61 [hyper,33,1,3] P ( i ( i ( x , n ( n ( y ) ) ) , i ( x , y ) ) ) . 86 [hyper,56,1,50] P ( i ( x , i ( i ( y , n ( x ) ) , n ( y ) ) ) ) . 523 [hyper,61,1,2] P ( i ( x , i ( i ( y , n ( n ( z ) ) ) , i ( y , z ) ) ) ) . 541 [hyper,523,1,3] P ( i ( i ( x , i ( y , n ( n ( z ) ) ) ) , i ( x , i ( y , z ) ) ) ) . 675 [hyper,86,1,4] P ( i ( i ( x , n ( y ) ) , i ( y , n ( x ) ) ) ) . 708 [hyper,675,1,541] P ( i ( i ( n ( x ) , n ( y ) ) , i ( y , x ) ) ) . Clause (708) contradicts clause (8), and the proof is complete. I have no idea whether this proof is the same as, equivalent to, or better than that to be found in the literature. The motivation for studying the next theorem—another example of succeed ing on the first try—was simple curiosity on my part. If Scott was satisfied that OTTER proved the completeness of the three-axiom system of Lukasiewicz by proving the eight theses, 16, 18, 24, 21, 35, 39, 40, and 49, then an obvious theorem to attempt to prove is the converse: from these eight axioms, one can deduce each of (LI), (L2), and (L3). (As we later learned, for a complete system, one need consider only the second, fifth, and eighth; in other words, the other five are dependent on these three.) The same approach was used again, directing OTTER's search for the desired three proofs by using the 68 weight templates. The theses were proved in a single run, in the order (L3), (LI), and (L2). The proofs were obtained in the interval of CPU seconds between 97 and 101. You might find the following example of particular interest, for it dramati cally demonstrates how far we have come and exhibits OTTER's nearly linear performance with respect to clause generation. The theorem to prove asserts that the third of the following six axioms, Frege's system for sentential calculus, is dependent on the remaining five. (Fl (F2 (F3 (F4 (F5 (F6
th_18) th_35) th_21) th_39) th_40) th_46)
P(i(x,i(y,x))). P(i(i(x,i(y,z)),i(i(x,y),i(x,z)))). P(i(i(x,i(y,z)),i(y,i(x,z)))). P(i(i(x,y),i(n(y),n(x)))). P(i(n(n(x)),x)). P(i(x,n(n(x)))).
Using the approach described in this section, but with a smaller set of weight templates, OTTER succeeded in proving—on the first attempt—that the third axiom is indeed dependent on the other five. For the following reasons, this first-attempt success is (to me) both stimulat ing and enlightening. The proof was obtained (on a SPARCstation) in just under
992
Collected Works of L&rry Wos
19 CPU hours. The proof was completed upon retention of a clause numbered 11331, after generating over 30,000,000 clauses. The performance of OTTER was nearly linear; during the first few CPU seconds, clauses were generated at the rate of 550 per CPU second, and during the last few CPU seconds, clauses were generated at the rate of 460 per CPU second. I could not resist letting OTTER run for additional time to see what would happen to the generation rate. At the 43 CPU hour mark, after generating just under 66,000,000 clauses, the rate had finally dropped to 300 clauses per CPU second—pretty impressive to see such small degradation over such a long period of time. A fast, tireless, and accurate assistant, OTTER provides a nice complement to the researcher with insight. The mathematician or logician might make marvelous discoveries, after mastering and then using this program. The proof OTTER found consists of 74 steps, not counting, of course, the five (input) axioms, all of which are used. I have a tag or postscript to the discussion of this Frege dependence theorem. As OTTER was searching for a proof that the third axiom is dependent on the other five, my colleague McCune informed me (after browsing in one of Lukasiewicz's books) that the dependence could be proved from the first two axioms alone. On a second computer, OTTER was asked to search for such a proof. We were motivated, of course, by curiosity about which run would finish first—the long run just discussed, or this second attempt—and by the wish to compare the two proofs, should they be found. The second attempt succeeded first, in under 52 CPU seconds, finding a proof consisting of 11 steps. Yes, for this newer theorem, one attempt was again sufficient. Considered together, the two results suggest that the presence of unneeded but usable axioms can sharply detract from a program's effectiveness. The final detailed example of success on the first try concerns proving the completeness of the axiom system consisting of (the unnegated form of) the ses 19, 37, and 59. McCune informed me of this system from his reading of Lukasiewicz. Scott has commented to me that the system is indeed interesting— and he can explain why—but that Lukasiewicz does not explain why nor does he give the corresponding proofs. OTTER's proof that theses 19, 37, and 59 form a complete system rests on the deduction of (FL1), (FL2), and (FL3), mentioned earlier as a complete system. Since these proofs may not exist in the literature, OTTER's proofs are included here. The following three proofs are, respectively, for the deduction of (FL1), (FL2), and (FL3); the third required approximately 406 CPU seconds, and the first two required less than 1 CPU second. 1 [] - P ( i ( x , y ) ) I -P(x) I P(y). 2 [] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . 21 [] - P ( i ( q , i ( p , q ) ) ) I $ANS(step_th_18). 35 [hyper,2,1,2] P ( i ( x , i ( y , x ) ) ) . Clause (35) contradicts clause (21), and the proof is complete.
Automated Reasoning and Bledsoe's Dream for the Field 1 G - P ( i ( x , y ) ) I -P(x) I P(y). 2 [] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . 3 [] P ( i ( i ( i ( x , y ) , z ) . i ( n ( x ) , z ) ) ) . 4 [] P ( i ( i ( n ( x ) , z ) , i ( i ( y , z ) , i ( i ( x , y ) , z ) ) ) ) . 24 [] - P ( i ( i ( p , i ( q , r ) ) , i ( i ( p , q ) , i ( p , r ) ) ) ) I $ANS(step_th_35). 35 [hyper.2,1,2] P ( i ( x . i ( y , x ) ) ) . 43 [hyper,35,1,3] P ( i ( n ( x ) , i ( y , i ( x , z ) ) ) ) . 44 [hyper,35,1,2] P ( i ( x , i ( y , i ( z , x ) ) ) ) . 68 [hyper,43,1,4] P ( i ( i ( x , i ( y , i ( z , u ) ) ) , i ( i ( z , x ) , i ( y , i ( z , u ) ) ) ) ) . 72 [hyper,68,1,35] P ( i ( i ( x , i ( x , y ) ) , i ( z , i ( x , y ) ) ) ) . 79 [hyper,72,1,43] P ( i ( x , i ( n ( y ) , i ( y , z ) ) ) ) . 81 [hyper,79,1,79] P ( i ( n ( x ) , i ( x , y ) ) ) . 87 [hyper,81,1,4] P ( i ( i ( x , i ( y , z ) ) , i ( i ( y , x ) , i ( y , z ) ) ) ) . 98 [hyper.87,1,44] P ( i ( i ( x , y ) , i ( x , i ( z , y ) ) ) ) . 299 [hyper.98,1,68] P ( i ( i ( x , i ( y , z ) ) , i ( y , i ( x , z ) ) ) ) . 338 [hyper,299,1,98] P ( i ( x , i ( i ( x , y ) , i ( z , y ) ) ) ) . 1127 [hyper,338,1,68] P ( i ( i ( x , y ) , i ( i ( y , z ) , i ( x , z ) ) ) ) . 1208 [hyper,1127,1,299] P ( i ( i ( x , y ) , i ( i ( z , x ) , i ( z , y ) ) ) ) . 1285 [hyper,1208,1,68] P ( i ( i ( x , i ( y , z ) ) , i ( i ( x , y ) , i ( x , z ) ) ) ) . Clause (1285) contradicts clause (24), and the proof is complete. 1 [] 2 [] 3 [] 4 [] 27 []
- P ( i ( x , y ) ) I -P(x) I P(y). P(i(i(i(x,y),z),i(y,z))). P(i(i(i(x,y).z),i(n(x),z))). P(i(i(n(x),z),i(i(y,z),i(i(x,y),z)))). - P ( i ( i ( n ( p ) , n ( q ) ) , i ( q , p ) ) ) I $ANS(step_th_49).
35 [hyper,2,1,2] P ( i ( x , i ( y , x ) ) ) . 42 [hyper,35,1,4] P ( i ( i ( x , i ( y , n ( z ) ) ) , i ( i ( z , x ) , i ( y , n ( z ) ) ) ) ) . 43 [hyper,35,1,3] P ( i ( n ( x ) , i ( y , i ( x , z ) ) ) ) . 44 [hyper,35,1,2] P ( i ( x , i ( y , i ( z , x ) ) ) ) . 48 [hyper,42,1,35] P ( i ( i ( x , n ( x ) ) , i ( y , n ( x ) ) ) ) . 68 [hyper,43,1,4] P ( i ( i ( x , i ( y , i ( z , u ) ) ) , i ( i ( z , x ) , i ( y , i ( z , u ) ) ) ) ) . 72 [hyper,68,1,35] P ( i ( i ( x , i ( x , y ) ) , i ( z , i ( x , y ) ) ) ) . 79 [hyper,72,1,43] P ( i ( x , i ( n ( y ) , i ( y , z ) ) ) ) . 81 [hyper,79,1,79] P ( i ( n ( x ) , i ( x , y ) ) ) . 87 [hyper,81,1,4] P ( i ( i ( x , i ( y , z ) ) , i ( i ( y , x ) , i ( y , z ) ) ) ) . 98 [hyper,87,1,44] P ( i ( i ( x , y ) , i ( x , i ( z , y ) ) ) ) . 101 [hyper,87,1,35] P ( i ( i ( x , y ) , i ( x , y ) ) ) . 104 [hyper,101,1,87] P ( i ( i ( x , i ( x , y ) ) , i ( x , y ) ) ) . 111 [hyper,104,1,48] P ( i ( i ( x , n ( x ) ) , n ( x ) ) ) . 112 [hyper,104,1,35] P ( i ( x , x ) ) .
993
994
Collected Works of Larry Wos
299 [hyper,98,1,68] P ( i ( i ( x , i ( y , z ) ) , i ( y , i ( x , z ) ) ) ) . 338 [hyper,299,1,98] P ( i ( x , i ( i ( x , y ) , i ( z , y ) ) ) ) . 1127 [hyper,338,1,68] P ( i ( i ( x , y ) , i ( i ( y , z ) , i ( x , z ) ) ) ) . 1203 [hyper,1127,1,1127] P ( i ( i ( i ( i ( x , y ) , i ( z , y ) ) , u ) , i ( i ( z , x ) , u ) ) ) . 1208 [hyper,1127,1,299] P ( i ( i ( x , y ) , i ( i ( z , x ) , i ( z , y ) ) ) ) . 1234 [hyper,1127,1,299] P ( i ( i ( i ( x , i ( y , z ) ) , u ) , i ( i ( y , i ( x , z ) ) , u ) ) ) . 1257 [hyper,1203,1,1203] P ( i ( i ( x , i ( y , z ) ) , i ( i ( u , y ) , i ( x . i ( u , z ) ) ) ) ) . 1260 [hyper,1203,1,1127] P ( i ( i ( x , y ) , i ( i ( i ( x , z ) , u ) , i ( i ( y , z ) , u ) ) ) ) . 1321 [hyper,1208,1,4] P ( i ( i ( x , i ( n ( y ) , z ) ) , i(x,i(i(u,z),i(i(y,u),z))))). 1492 [hyper,1257,1,1234] P ( i ( i ( x , i ( y , z ) ) , i ( i ( u , x ) , i ( y , i ( u , z ) ) ) ) ) . 1517 [hyper,1260,1,299] P ( i ( i ( i ( x , y ) , z ) , i ( i ( x , u ) , i ( i ( u , y ) , z ) ) ) ) . 1640 [hyper,1321,1,3] P ( i ( i ( i ( x , y ) , z ) , i ( i ( u , z ) , i ( i ( x , u ) , z ) ) ) ) . 2266 [hyper,1640,1,1492] P ( i ( i ( x , i ( i ( y , z ) , u ) ) , i(i(v,u), i(x,i(i(y,v),u))))). 2269 [hyper,1640,1,299] P ( i ( i ( x , y ) , i ( i ( i ( z , u ) , y ) , i ( i ( z , x ) , y ) ) ) ) . 2751 [hyper,2269,1,112] P ( i ( i ( i ( x , y ) , z ) , i ( i ( x , z ) , z ) ) ) . 3002 [hyper,2751,1,1517] P ( i ( i ( i ( x , y ) , z ) , i ( i ( z , u ) , i ( i ( x , u ) , u ) ) ) ) . 3204 [hyper,3002,1,111] P ( i ( i ( n ( x ) , y ) , i ( i ( x , y ) , y ) ) ) . 3331 [hyper,3204,1,299] P ( i ( i ( x , y ) , i ( i ( n ( x ) , y ) , y ) ) ) . 3544 [hyper,3331,1,2266] P ( i ( i ( x , y ) , i ( i ( z , y ) , i ( i ( n ( z ) , x ) , y ) ) ) ) . 3879 [hyper,3544,1,299] P ( i ( i ( x , y ) , i ( i ( z , y ) , i ( i ( n ( x ) , z ) , y ) ) ) ) . 3982 [hyper,3879,1,35] P ( i ( i ( x , i ( y , z ) ) , i ( i ( n ( z ) , x ) , i ( y , z ) ) ) ) . 4126 [hyper,3982,1,81] P ( i ( i ( n ( x ) , n ( y ) ) , i ( y , x ) ) ) . Clause (4126) contradicts clause (27), and the proof is complete. In 1923, Hilbert offered as a complete axiom system for sentential calculus that consisting of theses 18, 21, 22, 30, 3, and 54. Later, it was proved that 30 is dependent on the remaining axioms in Hilbert's system. On the first try, OTTER proved (with a 3-step proof) the dependence of 30 in less than 2 CPU seconds and, in that same run, proved the completeness of Hilbert's system. The first completeness proof proceeds by deducing the system consisting of theses 19, 37, and 59, completing a 9-step proof in just over 7 CPU seconds. In just under 17 CPU seconds, OTTER found a different 28-step proof of complete ness by deducing the system FL consisting of theses 18, 35, and 49. However, later in the same run, a far shorter proof was found in approximately 1,733 CPU seconds, a- proof consisting of 12 steps. Still in the same run, a 30-step proof of the completeness of Hilbert's system was found by deducing FVege's system F (excluding the dependent axiom) in approximately 143 CPU seconds. A shorter 16-step proof was then found in approximately 3,706 CPU seconds. A 6-step proof of the Lukasiewicz system was obtained in approximately 961 CPU seconds, and a 5-step proof in approximately 1,848 CPU seconds. A few observations concerning these results are now in order. The way OT TER can be used is strikingly different from the approach typically taken with
Automated Reasoning and Bledsoe's Dream for the Field
995
a colleague; Notes 4 and 7 elaborate on this point. In the latter case, a deci sion is made concerning which single path is best to pursue; for example, if the completeness of the Hilbert axiom system is the objective, the decision might be to attempt to prove the Lukasiewicz system or, instead, to attempt to prove Prege's. In contrast, with OTTER as your assistant, a good approach consists of asking this program to consider simultaneously a number of possible paths to a completeness proof; more comments are given in Note 5. Indeed, as evidenced in the preceding paragraph, that approach was markedly successful—one run pro duced a number of different completeness proofs for the axiom set under study. Among those many proofs, some differ in the intermediate steps but are alike in that each completes by deducing all the members of a given complete system. In contrast, other proofs obtained in that single run complete by deducing the members of a totally different complete system. To me it seems clear that, at least in some areas, all has changed from the early 1960s, from the mid-1970s, and even from five years ago. Indeed, as the following summary suggests—and it may not convince you, for you can drive a hard bargain—certain important aspects of your dream for the field are now a reality. An unsophisticated approach in which one chooses the obvious inference rule and obvious weights to direct the search (by symbol count) yields many proofs on the first try. With a little bit of sophistication, an approach can be formulated, based on the study of one set of theorems, and then used to obtain on the first try proofs of theorems that merited the attention of great minds. You and I know that in no way do the results of the cited experiments lessen the achievements of the various logicians involved in the studies beginning with Frege in 1879. Instead —at least I would like to find that this is the case—the successes with OTTER mark a singular achievement for automated reasoning and suggest that the field has indeed advanced significantly.
5 Contributions to Mathematics and Logic: Goal 2 Since this article is in part written for you, to add a special touch, I present new material and, further, material obtained during the writing of this article. The new results include an axiom system that may not have been seen before, and what appears to be a proof far shorter than is found in the literature; each was obtained with the aid of the program OTTER. To complement the new material and to give additional evidence of the possible value of automated reasoning to mathematics and logic, I shall begin by briefly reviewing some open questions that were answered with the assistance of a reasoning program. Some of these questions might prove challenging and useful for those who wish to compare the effectiveness of various programs, to evaluate the potential of a new approach, or—by attempting to answer the questions unaided by a computer friend—to gain an appreciation for how far the field has come. Of course, I can now hear you asking one of your provocative questions.
996
Collected Works ofL&rry Wos
"Larry, before you give your review of the past ten or so years, how far has the field come?" The accurate answer to your question, it seems to me, depends on whether the focus is on how far we have traveled or on how far we have to travel. To graphically see what I mean, we can look to the space program. In particular, the man in the moon is no longer a myth; indeed a person has walked on it. But the distance to the moon is dwarfed by the distance to the outermost planet, which is in turn miniscule when compared to the distance to another galaxy. So, how far has the space program advanced? Four decades ago, I would have doubted that we would reach the moon; two decades ago, I did doubt that an automated reasoning program would play a key role in answering open questions. Those two misplaced doubts have not shaken me; I still have doubts. For one example, if Texas is larger than Illinois—and, mind you, I said if—it is to make room for taller people, for tall Texans. As you know, beginning in 1978, automated reasoning programs designed by members of the Argonne group have been used to answer various open questions, in finite semigroups posed by Kaplansky [29], in equivalential calculus posed by Kalman [35], in ternary Boolean algebra posed by Grau [30], in finite semigroups posed by McFadden [14], and in combinatory logic posed by Smullyan [24, 25, 37]. In my opinion, the successes in combinatory logic provide the most powerful evidence that automated reasoning has made contributions of note. Barendregt [1] defines combinatory logic as an equational system satisfying the combinators S and K, where the respective actions of the constants S and K are given by the following two clauses. EQUAL(a(a(a(S,x),y),z),a(a(x,z),a(y,z))). EQUAL(a(a(K,x),y),x). The Smullyan questions (answered by my colleague McCune and me) focus on what are called fragments of combinatory logic, and not the logic in its entirety. One of Smullyan's questions concerns finding, if such exists, an appropriate combinator to be used with the combinator B (defined with the following clause) to construct a fixed point combinator. EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). The combinator 0 is a fixed point combinator if and only if, for all combinators x, the equation 0 x = x(Gx) holds. The strong fixed point property holds for the fragment with basis B if and only if there exists a fixed point combinator © such that 0 is expressed purely in terms of the elements of B. Statman answered Smullyan's question in the affirmative [26] by using the combinator W, defined by the following clause. EQUAL(a(a(W,x),y),a(a(x,y),y)). In addition to Statman's combinator, the fourth in the following list of five, McCune and I found four others by using an automated reasoning program [16].
Automated Reasoning and Bledsoe's Dream for the Field 0! 02 03 04 05
= = = = =
997
B(B(B(WW)W)B)B B{B(WW)W){BBB) B{B{WW){BWB))B B(WW)(BW(BBB)) B(WW){B{BWB)B)
Smullyan did indeed seem impressed by the discovery of the additional four. Later, by using the kernel strategy [37] applied by OTTER, we found an infinite class of infinite sets of such combinators. That result is still extremely gratify ing to me, especially in my role as mathematician. Indeed, to find such richness where, just one year earlier, it was not known whether any appropriate combi nators existed, and then to make the discovery because of formulating a new strategy that could be effectively applied by an automated reasoning program, signaled to me a significant advance in the field. If you are curious and immediately wonder whether we simply built on Statman's combinator, I can accurately report that we did not; indeed, we found other combinators to act in the place of W. In particular, recalling that expres sions in combinatory logic are assumed to be left associated unless otherwise indicated, our combinator N and the combinator H serve well. Nxyz = xzyz Hxyz = xyzy The proofs—obtained with OTTER applying the kernel strategy—that the frag ments with respective bases of combinators B and N and of B and H satisfy the strong fixed point property were completed by finding the following [37]. B(B(N{BB(N{BBN)N))N)B)B H{B(H(HB))B)B(HH) The combinator N may merit further study, for—in addition to offering as much (or more) power as W tor constructing fixed point combinators—BN(BB) acts as S does. The significance of this comment rests with the fact that S plays a vital role in the study of combinatory logic as a whole—S and K form a complete axiom system for the logic. Without the Argonne program OTTER and the kernel strategy, the combinator N might have remained undiscovered. Smullyan then posed corresponding questions about the presence of the strong fixed point property for the fragments with respective bases of com binators B and L and of Q and L, defined by the following equations. Lxy = x(yy) Qxyz = y(xz) McCune and I proved that neither fragment could satisfy the strong fixed point property [18]; OTTER again played a key role. Smullyan also posed questions concerning the existence of combinations, an expression involving some given set of combinators that behaves as some other
Collected Works of Larry Wos
998
given combinator does. When an appropriate combination exists, he wished also to know the length (in symbol count) of the smallest and how many of such there are. The questions McCune and I answered focus on the following combinators. (B) Bxyz = x(yz) (C) Cxyz = xzy (F) Fxyz = zyx (G) Gxyzw = xw(yz)
(Q) (Qi) (T) (V)
Qxyz = y{xz) Qixyz = x{zy) Txy = yx Vxyz = zxy
From the theorems proved in the study, the following summarizes the im portant results [39]. The combinators to be used for attempting to find an ap propriate combination are B and T. Two combinations exist that act as Q does, each of length 6, and no shorter exists. Two combinations exist that act as Qi does, each of length 6, and no shorter exists. Two combinations exist that act as C does, each of length 8, and no shorter exists. Five combinations exist that act as F does, each of length 8, and no shorter exists. Ten combinations exist that act as V does, each of length 10, and no shorter exists. Five combinations exist that act as G does, each of length 10, and no shorter exists. Questions of either type—those focusing on fixed point combinators and those focusing on combinations—might prove challenging and useful for evalu ating a new reasoning program or a new idea. A full appreciation of the power offered by today's automated reasoning program can be gained by accepting the challenge of attempting to answer the questions just discussed, and to do so unaided by a computer program. What satisfaction you and I might derive— especially me with my experiences at the poker table—from witnessing a per son's reaction to accepting the challenge, when said person is one of those who still considers automated reasoning at best to have the significance of a mouse eating a grain of wheat! Since you might be curious, paramodulation was the chosen inference rule for both studies of combinatory logic, and the set of support strategy played a key role. The time required to find fixed point combinators is frequently less than 5 CPU seconds, when the kernel strategy is used. Except for the combinator G, the respective times in CPU seconds for the studies of combinations are 6, 14, 19, 50, and 248. For G, the results were obtained from a Prolog program used in a generate-and-test mode; that Prolog program is not a reasoning program. In addition to finding the appropriate combinations for the combinator G, the Prolog program was used to show that no smaller combinations exist. Since attempts with OTTER did not succeed, we have an opportunity for the big stakes players. And now for the new material gathered during the writing of this article: a possibly new axiom system for sentential calculus, a sharply shorter proof of the completeness of the axiom system proposed by Lukasiewicz (consisting of LI, L2, and L3), and some related items. The following story, showing precisely how the axiom system was discovered, provides powerful evidence of the value of having the program OTTER as a member of a research team. The use of
Automated Reasoning and Bledsoe's Dream for the Field
999
OTTER dramatically reduced the turnaround time and facilitated the immedi ate verification of a conjecture. The story centers on an episode of temporary miscommunication that was the primary force in the discovery of the axiom set to be introduced. At the same time, the story provides another example of the serendipity of research. After McCune and I dispatched the 68 theorems suggested by Dana Scott in an email, Scott and I began an email exchange of ideas and results. He played the role of logician, bringing knowledge of various calculi into play; I played the role of computer scientist, supplying knowledge relevant to the varied uses of OTTER. Scott's contributions included suggestions of theorems for OTTER to try to prove and suggestions of where to find other theorems for OTTER to try to prove. My contributions were to respond to Scott's suggestions by including input files, designed to enable OTTER to perform effectively, and proofs, obtained from OTTER using the various input files. Because the third attempt (at proving the 68 theses) succeeded in proving all 68 and in less than 16 CPU minutes on a SPARCstation, we were off and running. As indicated earlier, among those 68 theses numbered 4 through 71 (with 1 through 3 being the complete axiom system proposed by Lukasiewicz), the set consisting of theses 18, 35, and 49 can be proved to be another complete axiom system, namely, FL. In other words, our success with Scott's original suggestion included a proof of the completeness of the Lukasiewicz system. Therefore, an obvious challenge was to attempt to have OTTER prove the converse, that the system consisting of theses 18, 35, and 49 is complete, where the proof would rest on deducing theses 1, 2, and 3. It worked, and on the first try; theses 2 and 3 were proved in approximately 2 and 4 CPU seconds, respectively. However, as it turned out, the deduction of the remaining thesis, 1, proved more difficult. In fact, were it not for the ability to run OTTER in the background—permitting me to write this article and simultaneously conduct research—and were it not for successes in the preceding years reached only after substantial CPU time had been used, the attempt to complete the desired proof might have been abandoned. Instead, thesis 1 was proved after 26,600 CPU seconds. The natural move next was to follow another of Scott's suggestions by study ing other known axiom systems, which, as it turned out, led to the earliermentioned episode of miscommunication. Buried in the text of one of the papers by Lukasiewicz is the mention of the complete system consisting of theses 19, 37, and 59; no proof of its completeness is given, nor does he give any discus sion of the importance of this system. Again, on the first try, OTTER proved it complete in less than 7 CPU seconds, with a 29-step proof in which the known system consisting of theses 18, 35, and 49 is deduced. Flushed with pleasure at this new success, I immediately sent the proof to Scott by email. However, as became clear from Scott's return email, I had miscommunicated—I had left the impression that this system, consisting of theses 19, 37, and 59, was a new ax iom system, whose discovery belonged to me and, of course, to OTTER. What
1000
Collected Works of Larry Wos
to do?—instant notification of my error, which I sent, certainly seemed hardly enough. After all, I had in effect been congratulated—which I obviously did not deserve—and, perhaps equally disturbing, Scott had expressed interest in the axiom system. What was called for—if it could be found—was a genuinely new axiom sys tem. The preferred way to rectify my communication error was to present—if at all possible—Scott with an axiom system that was genuinely new, not already in the literature. Unfortunately, I had no intuitive grasp of the elements of senten tial calculus, and no knowledge of how its study had proceeded. Therefore, on the surface, the idea of making such a search was out of the question—unless a guess and reliance on the ever-present and valued assistant OTTER could save the day. The morning after the episode of miscommunication, noting that various complete systems existed each consisting of three theses—1 and 2 and 3, 18 and 35 and 49, and 19 and 37 and 59—I read through the 68 originally suggested by Scott. My objective was to replace one of theses 19, 37, and 59, for Scott had liked that system. Influenced by the apparent relation of 37 to 59, the placement and occurrence of their variables and the function n, the thesis that appealed to me above the rest was 60. Therefore, the system to try to prove complete was that consisting of theses 19, 37, and 60.1 selected the naive approach of seeking a deduction of thesis 59, since both systems share 19 and 37. Such an approach is naive, for it might actually be easier to deduce another system entirely, say that consisting of theses 18, 35, and 49; I must admit that I did not even consider that possibility. Again OTTER succeeded on the first try; an 11-step deduction of thesis 59 was obtained in less than 3 CPU seconds. Rather than sending that proof to Scott, I then had OTTER seek a shorter proof, which it found. Here is the 8-step proof that I sent to Scott, found by OTTER in just under 5,000 CPU seconds; a shorter proof exists, which will also be given. As observed earlier, the number in the first field indicates the corresponding position among the retained clauses. 1 [] - P ( i ( x , y ) ) I -P(x) I P(y).
8 [] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . 9 [] P ( i ( i ( i ( x , y ) , z ) , i ( n ( x ) , z ) ) ) . 10 [] P ( i ( i ( u > i ( n ( x ) , z ) ) , i ( u , i ( i ( y , z ) , i ( i ( x , y ) , z ) ) ) ) ) . 25 [] - P ( i ( i ( n ( p ) , r ) , i ( i ( q , r ) , i ( i ( p , q ) , r ) ) ) ) | $ANS(step_th_59). 34 [hyper,8,1.8] P ( i ( x . i ( y , x ) ) ) . 40 [hyper,10,1,9] P ( i ( i ( i ( x , y ) , z ) , i ( i ( u , z ) , i ( i ( x , u ) , z ) ) ) ) . 59 [hyper,40.1,34] P ( i ( i ( x , i ( y , i ( z , u ) ) > , i ( i ( z , x ) , i ( y , i ( z , u ) ) ) ) ) . 63 [hyper,59,1,34] P ( i ( i ( x , i ( x , y ) ) , i ( z , i ( x . y ) ) ) ) . 68 [hyper,63.1,63] P ( i ( x , i ( i ( y , i ( y , z ) ) . i ( y . z ) ) ) ) . 30752 [hyper,68,1,68] P ( i ( i ( x , i ( x . y ) ) , i ( x , y ) ) ) . 30758 [hyper,30752,1,34] P ( i ( x , x ) ) .
Automated Reasoning and Bledsoe's Dream for the Field
1001
30954 [hyper.30758,1,10] P ( i ( i ( n ( x ) , y ) , i ( i ( z , y ) , i ( i ( x , z ) , y ) ) ) ) . Clause (30954) contradicts clause (25), and the proof is complete. Scott noted that this new axiom system, in which 59 is replaced by 60, offers less appeal, but the proof of 59 is interesting. He then suggested a way to shorten the proof, which OTTER succeeded in doing. Where the preceding 8-step proof is organic, meaning that none of the steps (theses) of the proof contains a subthesis that is true under all assignments of true and false, the following 7-step proof is inorganic. 1 [] - P ( i ( x , y ) ) | -P(x) | P(y). 2 [] - P ( i ( i ( n ( p ) , r ) , i ( i ( q , r ) , i ( i ( p ) q ) > r ) ) ) ) I $ANS(step_th_59). 3 [] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . 4 [] P ( i ( i ( i ( x , y ) , z ) , i ( n ( x ) , z ) ) ) . 5 [] P ( i ( i ( u , i ( n ( x ) , z ) ) , i ( u , i ( i ( y , z ) , i ( i ( x , y ) , z ) ) ) ) ) . 6 [hyper,3,1,3] P ( i ( x , i ( y , x ) ) ) . 10 [hyper,5,1,4] P ( i ( i ( i ( x , y ) , z ) , i ( i ( u , z ) , i ( i ( x , u ) , z ) ) ) ) . 18 [hyper,10,1,6] P ( i ( i ( x , i ( y , i ( z , u ) ) ) , i ( i ( z , x ) , i(y,i(z,u))))). 21 [hyper,18,1,6] P ( i ( i ( x , i ( x , y ) ) , i ( z , i ( x , y ) ) ) ) . 26 [hyper,21,1,6] P ( i ( x , i ( y , y ) ) ) . 27 [hyper,26.1,26] P ( i ( x , x ) ) . 33 [hyper,27,1,5] P ( i ( i ( n ( x ) , y ) , i ( i ( z , y ) , i ( i ( x , z ) , y ) ) ) ) . Clause (33) contradicts clause (2), and the proof is complete. It appears that the two proofs are the shortest that exist among, respectively, the organic and inorganic. A review of this anecdote suggests correctly how a dialogue between researchers can be sharply enhanced by access to an automated reasoning program of OTTER's type. The preceding story has an interesting postscript, showing, among other things, that wild guesses coupled with OTTER's power and rapid turnaround can lead to additional advances. Roughly a week after the discovery of the system consisting of theses 19, 37, and 60, Scott suggested yet another possible axiom system. He suggested replacing thesis 60 by the following thesis, to be called 60a. P(i(i(i(i(y,z),i(i(x,y),z)),u),i(i(n(x),z),u))). In approximately 47 CPU seconds, OTTER proved (on the first try) the com pleteness of Scott's system by deducing thesis 59 with the following 8-step proof. 1 [] - P U ( x . y ) ) I -P(x) I P(y).
8 [] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . 9 [] P ( i ( i ( i ( x , y ) , z ) , i ( n ( x ) , z ) ) ) .
1002
Collected Works of Larry Wos
10 [] P ( i ( i ( i ( i ( y . z ) , i ( i ( x , y ) , z ) ) . u ) , i ( i ( n ( x ) , z ) , u ) ) ) . 25 [] - P ( i ( i ( n ( p ) , r ) , i ( i ( q , r ) , i ( i ( p , q ) , r ) ) ) ) I $ANS(step_th_59). 27 [hyper,8,1,8] P ( i ( x , i ( y , x ) ) ) . 30 [hyper,9,1,8] P ( i ( n ( i ( x , y ) ) , i ( y , z ) ) ) . 35 [hyper,27.1,10] P ( i ( i ( n ( x ) , y ) , i ( z , i ( i ( u , y ) , i(i(x,u),y))))). 176 [hyper,35,1,30] P ( i ( x , i ( i ( y , i ( z , u ) ) , i ( i ( i ( v , z ) , y ) , i(z,u))))). 193 [hyper,176,1,176] P ( i ( i ( x , i ( y , z ) ) , i ( i ( i ( u , y ) , x ) , i(y,z)))). 213 [hyper,193,1,8] P ( i ( i ( i ( x , y ) , i ( i ( z , y ) , u ) ) , i ( y , u ) ) ) . 253 [hyper,213,1,10] P ( i ( x , x ) ) . 273 [hyper.253,1,10] P ( i ( i ( n ( x ) , y ) , i ( i ( z , y ) , i(i(x,z),y)))). Clause (273) contradicts clause (25), and the proof is complete. OTTER also obtained a completeness proof of the Scott system by deducing the three axioms of FL\ the 33-step proof was obtained in approximately 89 CPU seconds. In approximately 94 CPU seconds, an 11-step deduction of thesis 60 was obtained. Of the completeness proofs focusing on the (independent) Prege system, a 31-step proof was obtained in approximately 2,912 CPU seconds. Hilbert's system was deduced with a 24-step proof in approximately 921 CPU seconds. In approximately 2,677 CPU seconds, the Lukasiewicz axiom system was obtained with a 24-step proof. As is so typical of the experiments presented in this article, all of the completeness proofs for the Scott system were obtained in a single run. A post postscript: I have just found a 4-step, organic proof of thesis 59 from theses 19, 37, and 60; therefore, earlier, I should have said "it appeared that ..."—this article does indeed have the character of a letter. When I notified Scott of this 4-step proof, his reaction, given by email, was that it might indeed be "a very neat proof that would not be obvious to a human investigator". He explained that it is not particularly easy to do unification in one's head—and is he ever right! (Note 1 is relevant to the preceding.) Here is the proof. 1 [] - P ( i ( x , y ) ) I -P(x) | P(y). 8 [] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . 9 [] P ( i ( i ( i ( x . y ) , z ) , i ( n ( x ) , z ) ) ) . 10 [] P ( i ( i ( u , i ( n ( x ) , z ) ) , i ( u , i ( i ( y , z ) , i ( i ( x , y ) , z ) ) ) ) ) . 25 [] - P ( i ( i ( n ( p ) , r ) , i ( i ( q , r ) , i ( i ( p , q ) . r ) ) ) ) I $ANS(step_th_59). 33 [hyper,10,1,9] P ( i ( i ( i ( x , y ) , z ) , i ( i ( u , z ) , i ( i ( x , u ) , z ) ) ) ) . 44 [hyper,33.1,8] P ( i ( i ( x , i ( y , z ) ) , i ( i ( i ( u , y ) , x ) , i ( y , z ) ) ) ) .
Automated Reasoning and Bledsoe's Dream for the Field
1003
68 [ h y p e r , 4 4 , 1 , 8 ] P ( i ( i ( i ( x , y ) , i ( i ( z , y ) , u ) ) , i ( y , u ) ) ) . 99 [ h y p e r , 6 8 , 1 , 1 0 ] P ( i ( i ( n ( x ) , y ) , i ( i ( z , y ) , i ( i ( x , z ) , y ) ) ) ) . Clause (99) contradicts clause (25), and the proof is complete. Of course—in keeping with my personality with which you are so famil iar, and because I simply delight in proofs and in successes with OTTER—I would like to include virtually everything learned because of Scott's prompting; I clearly thrive on successful proof finding with OTTER, especially when the impetus is provided by a great scholar. However, since I can hear you giving me the appropriate warning, I shall postpone some items to a later section (Random Notes), omit many, and conclude this section with the promised shorter proof. The theorem in question asserts that the Lukasiewicz system, consisting of theses 1, 2, and 3, is complete for sentential calculus. Scott informs me that the Lukasiewicz proof, deducing the three axioms of FL, is 46 steps in length; using O T T E R on the Macintosh, Scott obtained essentially the same proof. The following 30-step proof, deducing the three theses of FL, is the shortest so far obtained; a somewhat different 30-step proof that is not organic has also been found with OTTER. 1 [] - P ( i ( x , y ) ) I - P ( x ) | P ( y ) . 4 [] - P ( i ( q , i ( p , q ) ) ) I - P ( i ( i ( p , i ( q , r ) ) , i ( i ( p , q ) , i ( p , r ) ) ) ) I -P(i(i(n(p).n(q)),i(q,p))) I $ANS(step_all_Church_FL_18_35_49). 8 [] P ( i ( i ( x , y ) , i ( i ( y , z ) . i ( x , z ) ) ) ) . 9 [] P ( i ( i ( n ( x ) , x ) , x ) ) . 10 [] P ( i ( x , i ( n ( x ) , y ) ) ) . 34 35 38 41 43 52 57 59 66 67
[hyper,8,1,8] P ( i ( i ( i ( i ( x , y ) , i ( z , y ) ) , u ) , i ( i ( z , x ) , u ) ) ) . [hyper,9,1,8] P ( i ( i ( x , y ) , i ( i ( n ( x ) , x ) , y ) ) ) . [hyper,10,1,8] P ( i ( i ( i ( n ( x ) , y ) , z ) , i ( x , z ) ) ) . [hyper,34,1,34] P ( i ( i ( x , i ( y , z ) ) , i ( i ( u , y ) , i ( x , i ( u , z ) ) ) ) ) . [hyper,34,1,8] P ( i ( i ( x , y ) , i ( i ( i ( x , z ) , u ) , i ( i ( y , z ) , u ) ) ) ) . [hyper,38,1,34] P(i(i(x,n(y)),i(y,i(x,z)))). [hyper,38,1,9] P(i(x,x)). [hyper,52,1,38] P ( i ( x , i ( y , i ( n ( x ) , z ) ) ) ) . [hyper,41,1,35] P ( i ( i ( x , i ( n ( y ) , y ) ) , i ( i ( y , z ) , i ( x , z ) ) ) ) . [hyper,43,1,41] P ( i ( i ( x , i ( i ( y , z ) , u ) ) , i ( i ( y , v ) , i(x,i(i(v,z),u))))). 103 [ h y p e r , 5 9 , 1 , 9 ] P ( i ( x , i ( n ( i ( i ( n ( y ) , y ) , y ) ) , z ) ) ) . 272 [ h y p e r , 6 6 , 1 , 1 0 3 ] P ( i ( i ( i ( i ( n ( x ) , x ) , x ) , y ) , i ( z , y ) ) ) . 303 [ h y p e r , 2 7 2 , 1 , 5 7 ] P ( i ( x , i ( i ( n ( y ) , y ) , y ) ) ) . 310 [ h y p e r , 3 0 3 , 1 , 6 7 ] P ( i ( i ( n ( x ) , y ) , i ( z , i ( i ( y , x ) , x ) ) ) ) . 317 [ h y p e r , 3 1 0 , 1 , 6 6 ] P ( i ( i ( i ( i ( x , y ) , y ) , z ) , i ( i ( n ( y ) , x ) , z ) ) ) . 335 [ h y p e r , 3 1 7 , 1 , 3 4 ] P ( i ( i ( x , i ( y , z ) ) , i ( i ( n ( z ) , y ) , i ( x , z ) ) ) ) . 346 [ h y p e r , 3 1 7 , 1 , 5 7 ] P ( i ( i ( n ( x ) , y ) , i ( i ( y , x ) , x ) ) ) .
1004
Collected Works of Larry Wos
350 [hyper,317,1,38] P ( i ( i ( n ( x ) , n ( y ) ) , i ( y , x ) ) ) . 377 [hyper,350,1,38] P ( i ( x , i ( y , x ) ) ) . 416 [hyper,377,1,8] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . 508 [hyper,416,1,350] P ( i ( n ( x ) , i ( x , y ) ) ) . 509 [hyper,416,1,346] P ( i ( x , i ( i ( x , y ) , y ) ) ) . 593 [hyper,508,1,335] P ( i ( i ( n ( x ) , y ) , i ( n ( y ) , x ) ) ) . 644 [hyper,593,1,508] P ( i ( n ( i ( x , y ) ) , x ) ) . 714 [hyper,509,1,41] P ( i ( i ( x , i ( y , z ) ) , i ( y , i ( x , z ) ) ) ) . 765 [hyper,714,1,8] P ( i ( i ( i ( x , i ( y , z ) ) , u ) , i ( i ( y , i ( x , z ) ) , u ) ) ) . 771 [hyper,714,1,346] P ( i ( i ( x , y ) , i ( i ( n ( y ) , x ) , y ) ) ) . 1755 [hyper,771,1,67] P ( i ( i ( n ( x ) , y ) , i ( i ( z , x ) , i ( i ( y , z ) , x ) ) ) ) . 1809 [hyper,1755,1,644] P ( i ( i ( x , i ( y , z ) ) , i ( i ( y , x ) , i ( y , z ) ) ) ) . 1870 [hyper,1809,1,765] P ( i ( i ( x , i ( y , z ) ) , i ( i ( x , y ) , i ( x , z ) ) ) ) . Clauses (377), (1870), and (350), respectively, contradict the literals of clause (4), and the proof is complete.
6 Mathematicians and Logicians as Users of a Program: Goal 3 Although a precise estimation of the value of having many mathematicians and logicians as users of automated reasoning programs is essentially impossible, their use would clearly advance the field markedly. A master of some area, group theory for example, who was also quite familiar with the intricacies of the use of OTTER would almost certainly make significant contributions to that area. I must admit that this observation seems difficult to doubt when you review what has occurred in the past decade regarding the answering of open questions from a variety of fields of mathematics and logic. Granted that none of the long-standing deep problems have been solved; however, the investigators could hardly be classed as masters of any of the disciplines from which the questions were taken. I also agree with you that failure would be the likely outcome if an automated reasoning program were asked to prove a randomly selected theorem from a standard textbook. Given these pluses and minuses, the goal of having mathematicians and logicians counted among the users of such programs is indeed an important goal and—how can it be otherwise!—an important component of your and my dream for automated reasoning. Finally, I can report that the current set of those using an automated reasoning program does now include such researchers. Although I have heard rumors of such uses at the University of Texas and in England—rumors that I have not verified—I prefer to confine my comments to what I know personally. Also, recognizing the lack of a clear distinction between that which is strictly computation and that which contains reasoning steps, I shall, nevertheless, pretend otherwise and cite as my first example John Kalman's research. Kalman is a logician at the University of Auckland in New Zealand. In the late 1970s, he had his own theorem-proving program which he
Automated Reasoning and Bledsoe's Dream for the Field
1005
heavily used for his research in equivalential calculus [8]. Prompted by his desire to become familiar with our efforts in the field, Kalman visited Argonne and suggested leaving with us seven theorems to attempt to prove with our program. He did not have to wait too long before seeing results. Indeed, ten minutes after he presented the seven theorems, he had in his hands five proofs obtained with a version of the program that would eventually be called AURA [23]. After tasting this finest of brandies, he was converted, shortly thereafter becoming a constant and active user of our programs—and still is today. So convinced of their value, he has written an extensive workbook for the use of ITP, a book that contains many gems that merit study [9]. He is currently using OTTER to aid his research in group theory, but in the context of divisional calculus. For some time, copies of OTTER have also been in the hands of Corrado Boehm (combinatory logic) University of Rome, Robert Meyer (relevance logic) Australian National University, R. Goldblatt (mathematics) Wellington Uni versity in New Zealand, and Roger Hindley (logic) University College in Wales. Most recently, we sent a copy of OTTER to Dana Scott (logic) Carnegie Mellon University, which he has successfully used on his Macintosh. Barely a trickle, indeed; but, compared to 1975, a veritable torrent! On the other hand, recognizing that in some sense we have hardly moved from zero, you might find interest in the following excerpts from two phone conversations I had with Irving Kaplansky. Approximately a decade ago, I called him at the University of Chicago to obtain a possible open question to attack with our program. He supplied such a question, the question mentioned earlier regarding the possible existence of certain finite semigroups; Note 3 might be of interest. During that conversation, when automated theorem proving in general was broached, Kaplansky surprised me with the following comments, which I have just checked in a second phone conversation. "You have a friend in court. Should you continue in your research, the mathematics papers written in 2060 or thereabouts will be at a new level of reading, with much of the current level within reach of a theorem-proving program." In our second conversation, prompted by my wish to clear with him my inclusion of his earlier comments, he and I agreed that progress is indeed painfully slow, as it is with programs to automate translation from one language to another. The snail travels fast, thinks the defenseless plant with fear; the snail travels slow, observes the cat eager to play. I believe—of course, you know I actually mean that I am certain—the significant point is that, finally, we are traveling, making recognizable progress. What will you and I witness before we move elsewhere? I wonder, I await, and, most truthfully—how many know that truth takes on numerous possible values?—I thrive on the expectation.
7 New and Old Uses for an A u t o m a t e d Reasoning P r o g r a m At this point—taking you up on your comment that you do not mind a little
1006
Collected Works of Larry Wos
repetition—I shall present a general review of what is possible when using an automated reasoning program, in particular, when using OTTER. At the sim plest level, in addition to the familiar use of a program like OTTER for finding proofs, such a program offers unexpected power for proof checking, as the fol lowing example shows. If a proof has no steps missing, you can take each of its steps and use weight templates to instruct OTTER to prefer expressions that match the pattern of function symbols in the steps of the proof. An example that I just ran focuses on the completeness proof for the system consisting of theses 19, 37, and 60 in which an 8-step deduction of thesis 59 is found. The goal is to have OTTER proof check the given proof. Therefore, OTTER was given the instruction to use symbol count to assign priority (by weight) to all clauses other than those that match one of the following eight weight templates. weight_list(pick_and_purge). veight(P(i(x,i(y,x))), 2). weight(P(i(i(i(x,y),z),i(i(u,z),i(i(x,u),z)))), 2). weight(P(i(i(x,i(y,i(z,u))),i(i(z,x),i(y,i(z.u))))), weight(P(i(i(x,i(x,y)),i(z,i(x,y)))), 2). w e i g h t ( P ( i ( x , i { i ( y , i ( y , z ) ) > i ( y , z ) ) ) ) , 1). w«ight(P(i(i(x,i(x,y)),i(x,y))), 1). veight(P(i(x,x)), 2).
2
).
weight(P(i(i(n(x),y),i(i(z,y),i(i(x,z),y)))), 2). end_of_list.
The flags for seeking shorter proofs were turned off. And here comes an illus tration of the unexpected power when using OTTER in a proof-checking mode; Note 3 is relevant. Instead of verifying by "finding" the expected 8-step proof, OTTER found the 7-step deduction of thesis 59, the same 7-step proof given earlier. The expla nation rests in part with the fact that weight templates of the kind just given are treated as if all variables are indistinguishable. Since step five, just as step one, of the shorter proof matches in its pattern of the function t the first weight template, it is preferred over clauses that do not match one of the templates. OTTER happened to find the shorter proof first and was prevented from com pleting the longer proof because the two proofs share the same last step and forward subsumption was in use. Disappointment seems misplaced; after all, the shorter proof is often the more elegant. On the other hand, were you to insist upon verifying the given 8-step proof, or were you to prefer to avoid proofs that are not organic, OTTER offers most of what is needed. In the first case, if the weight of the fifth and sixth steps is set to 1 rather than to 2, OTTER finds the 8-step proof. If, in addition, back subsumption (which discards any retained clause that is subsumed by a clause retained later) is turned off, and if you instruct OTTER to seek more than one proof, then OTTER finds both proofs.
Automated
Reasoning and Bledsoe's Dream for the Field
1007
In the second case, the avoidance of proofs that are less likely to be organic is achieved with demodulation [32]. Specifically, if the following demodulator list is included in the input, where "$T" is interpreted as "true", then all clauses containing as a proper subexpression i(t, t) for some term t are immediately purged. list(demodulators). (i(i(x,x),y) » discard). (i(y,i(x,x)) » discard). (i(discard.x) = discard). (i(x,discard) « discard). (n(discard) » discard). ( P ( d i s c a r d ) - $T). end_of_list. An analysis of these demodulators shows that the thesis i(x, x) is not discarded, an important observation, for this thesis often plays a key role in a completeness proof for an axiom system for sentential calculus as well as for many other proofs. Of course, if you do not have a proof in its entirety to check, but have instead some steps that are conjectured to be useful (as when hints are given to a starred exercise), then the corresponding weight templates can be included. In other words, for those points between the ends of the spectrum focusing, respectively, on proof checking and proof finding, O T T E R offers much of what is needed. Somewhat related is the use of O T T E R to monitor progress, its own and that of the researcher; I recommend Note 4. For a sample of this use, you can imagine wishing to prove some specific theorem, but finding it difficult to choose between various possible attacks. With one choice of attack, the conjecture asserts that, if lemmas A, B, and C could be proved, then the theorem would be within reach. With a second choice, the key lemmas appear to be D and E. With a third choice, lemmas F, G, and H are thought to offer what is needed. With O T T E R and without much effort, the researcher can pursue simultaneously all three lines of attack. A way to proceed is to represent each of the eight lemmas as a unit clause, negate each, include with each the ANSWER literal with an argument designating which lemma is represented, place the negations in the passive list, and start the run. With Unix, the run can be placed in the background. Then, one simply glances occasionally at the output file to read the occurrences of UNIT CONFLICT. The ANSWER literal, which is ignored by O T T E R when testing for UNIT CONFLICT, is included to facilitate monitoring of the program's progress and of the researcher's chosen attacks. In addition, you can include in the axioms list the disjunction of the appropriate negated lemmas disjoined with an appro priate ANSWER literal and occasionally glance at the output file in search of a desired occurrence of the EMPTY CLAUSE; if the disjunction is placed in the passive list, it will be ignored, thus defeating the purpose of its inclusion. Using
1008
Collected Works of Larry Wos
a disjunction approach is a means for avoiding the tedious piecing together of the various parts of a proof, and is useful for automatically removing duplicate steps from the various parts; in other words, this ploy returns the union of the various parts. In contrast to the preceding uses, you can even use OTTER for the mundane task of detecting errors in the input or errors in the axioms, errors such as a simple typo or an incorrect interchange of symbols. The means for such detection is that of reading the retained clauses resulting from using the input that might contain an error—perhaps unsuspected at that. In fact, I recently had such an experience. The run was motivated by yet another study of a possible axiom system. A proof was found more rapidly than I expected. However, rather than satisfaction, you can imagine my reaction when I found that the proof contained the following undesirable clause. P(x). In the study in question, the clause amounts to asserting that everything is true—obvious nonsense! Fortunately, as exhibited in the proofs given earlier, OTTER supplies, for each deduction, the immediate ancestors from which the deduction is obtained. By tracing backward through the ancestry tree, the flaw in the input was easily found. Even when you are certain that the input is flawless, you might wish to ex amine OTTER's output to decide whether the chosen approach is satisfactory. In particular, one of OTTER's flags can be used to cause the output file to contain all of the generated clauses, including those that are discarded for some reason. An inspection of the generated clauses can lead to the discovery that much of the CPU time is being consumed on what is clearly fruitless considera tion. Especially for the expert in the field from which the problem under study is chosen, such an inspection can prove of immense value; Note 4 is perhaps of interest here. Indeed, it seems to me that, if so many successes can be so readily obtained by someone who is hardly more than conversant with a field, then the possibilities are most promising if the user is instead a master of the discipline under attack. You can also use OTTER to produce test problems of varying difficulty, problems to be used to evaluate the relative strength of a new program or the potential of a new approach. A graduated set of such problems certainly appears to be one of the useful items to have for research in automated reasoning. Such a set should also prove useful as exercises for a course, a book, or an exam. One means for obtaining the desired set of problems, or at least obtaining some of them, is to have OTTER run well past the CPU time needed to complete some simple task. For example, let the task be to prove theses 39 and 40 from the members of FL, 18, 35, and 49. Taken together, theses 39 and 40 can be viewed as asserting, for all x, the equality of n(n(x)) and x. OTTER completes the given assignment in less than 4 CPU seconds, after retaining 156 clauses. If you then take advantage of the fact that OTTER's performance is nearly linear with
Automated Reasoning and Bledsoe's Dream for the Field
1009
regard to the deduction of conclusions and allow the program to run for a few CPU hours, a proof of the dependence of thesis 21 is also obtained. In approxi mately 7.4 CPU hours, OTTER produces a 55-step proof of the dependence of thesis 21 on theses 18, 35, and 49. For those who prefer an approach to automated reasoning based on Prolog technology, this problem appears to offer a small challenge; in particular, a level saturation approach with OTTER obtained an 11-step proof in approximately 9.1 CPU hours. The explanation for finding an 11-step proof rather than the 55-step proof rests with the fact that thesis 21 is dependent on theses 18 and 35 alone; the longer proof relies on the use of thesis 49, thus admitting to the search clauses in which the function n occurs. In fact, 28 of the 55 clauses of the longer proof contain at least one occurrence of n. A bigger challenge for the approach based on Prolog technology focuses on proving thesis 1, the first of the three axioms Lukasiewicz used for sentential calculus, from theses 18, 35, and 49. Clearly, a quick review of the various uses covered here—from those directly related to research to those that might well be considered mundane—correctly suggests that I am captivated by experiments with an automated reasoning program. That I find the program OTTER to be a great companion and a valuable assistant is manifestly obvious. Finally, you are definitely warranted in concluding that—rather than the impossibility of an effective automation of logical reasoning, as has too frequently been suggested in the literature—I am building a case for my view that the field has demonstrated in various ways that we have arrived.
8 Challenges and Open Questions My friend and colleague George Robinson asked me on September 15, 1990, whether the field was still as prone to bs as it was when he and I studied automated theorem proving. I told him that all was sharply changed; many re searchers now welcomed challenges and the opportunity to attack open questions with an existing program. Therefore, in addition to the challenges presented by the theorems discussed so far in this article, others seem in order, including questions that remain open here in 1990. Open Question in Robbins Algebra The following question has been open for decades, receiving attention even from Tarski and his students [6, 27]. Is every Robbins algebra a Boolean algebra? A Robbins algebra is a nonempty set satisfying the following three axioms, expressed in clause notation, in which the function o can be interpreted as plus and the function n as negation. (Rl) (R2) (R3)
EQUAL(o(x,y),o(y,x)). EQUAL(o(o(x,y),z),o(x,o(y,z))). EqUAL(n(o(n(o(x,y)),n(o(x,n(y))))),x).
Collected Works of Larry Wos
1010
A Boolean algebra is a nonempty set S with two operations, plus and times, and a 0 and a 1. Each operation is commutative, and each distributes over the other. The 1 is a multiplicative identity, and the 0 is an additive identity. In addition, for every x, the negation of x exists with i plus its negation equal to 1 and x times its negation equal to 0. An alternative axiomatization of Boolean algebra consists of (Rl), (R2), and Huntington's axiom (H3) [7]. (H3)
EQUAL(o(n(o(n(x),y)),n(o(n(x),n(y)))),x).
Since it is known that every finite Robbins algebra is Boolean, two choices exist. You can attempt to find an infinite model that satisfies the three axioms for a Robbins algebra but violates a property for a Boolean algebra, or you can attempt to prove that Robbins implies Boolean. If you rely on the assistance of an automated reasoning program, with the intention of proving that Robbins does not imply Boolean, an added challenge is presented by the need to cope with infinite sets. If instead you rely on such a program with the objective of proving that Robbins does imply Boolean, then an added challenge focuses on coping with the extremely large number of clauses that will ordinarily be encountered, even if paramodulation is the chosen inference rule. Open Questions in Combinatory Logic Combinatory logic presents a number of open questions of which the follow ing offer intrigue. Does the fragment with a basis consisting of the combinators B and S alone satisfy the strong fixed point property? The first two of the fol lowing three clauses specify the actions of B and S, respectively; the third clause corresponds to the denial of the strong fixed point property. EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). EQUAL(a(a(a(S,x),y),z),a(a(x,z),a(y,z))). -EQUAL(a(y,f(y)),a(f(y),a(y,f(y)))). If paramodulation is the inference rule of choice, then, of course, you must add a clause for reflexivity of equality, x = x. If the inference rule of choice is one of the resolution-based rules, hyperresolution for example, then in addition you must add clauses for symmetry, for transitivity, and for substitutivity in each of the arguments of the function o. For a similar question, does the fragment with a basis consisting of the combinators B and iVi satisfy the strong fixed point property? The behavior of the combinator Ni is given by the following clause. EQUAL(a(a(a(Nl,x),y),z),a(a(a(x,y),y),z)). To further encourage research focusing on the automation of model gener ation, here are two open questions. Does there exist a finite model satisfying the combinators B and L in which the strong fixed point property fails to hold? Does there exist a finite model satisfying the combinators Q and L in which the
Automated Reasoning and Bledsoe's Dream for the Field
1011
strong fixed point property fails to hold? That some (possibly infinite) model of the type under discussion in each of the two questions exists follows from results quoted earlier from the research with my colleague McCune (18). Because of the lack of formal criteria to determine precisely which questions merit the classification of open, I point out that the preceding questions from combinatory logic are my questions. I do not mean to imply that I know the answers, for I do not; nor, as far as I can ascertain, does anyone else. Challenge P r o b l e m from M a n y - V a l u e d Sentential Calculus As for a new problem (from among the theorems whose proof is known) to take the place of the problems previously considered tough for an automated reasoning program to solve, the following theorem from many-valued sentential calculus provides an excellent target. The theorem, sometimes known as the fifth conjecture of Lukasiewicz, asserts that, from the first four of the following five clauses, the fifth can be deduced by using condensed detachment. P(i(x,i(y,x))). P(i(i(x,y),i(i(y,z),i(x,z)))). P(i(i(i(x.y),y),i(i(y,x),x)». P(i(i(n(x),n(y)).i(y,x))). P(i(i(i(x,y),i(y,x)),i(y,x))). The problem asks for an approach that enables an automated reasoning program to prove the Lukasiewicz conjecture, using condensed detachment. Two points to keep in mind are (1) a proof of the conjecture has been obtained where the problem was rephrased as one for equality, and (2) McCune and I have a 63step proof using condensed detachment, a proof obtained by using O T T E R in a mode that is in part proof checking and in part proof finding. Our solution, obtained in a style somewhat reminiscent of t h a t discussed earlier in which you have an outline and O T T E R fills in the holes, does not count, for we relied heavily on the equality-oriented proof that was obtained with OTTER. Challenge P r o b l e m s from S e n t e n t i a l Calculus The last two challenges in this section come from Dana Scott. Both focus on a slightly different notation for sentential calculus, namely, the replacement of n(x) by i(x, F ) , where F is thought of as meaning false. Scott asks whether, among the following five axioms given in clause form, axioms 1, 2, and 4 are complete for sentential calculus, and whether axioms 1, 4, and 5 are. (axiom (axiom (axiom (axiom (axiom
1) 2) 3) 4) 5)
P(i(i(x,y),i(i(y,z),i(x,z)))). P(i(i(i(x,F),x),x)). P(i(x,i(i(x,F),y))). P(i(F,x)). P(i(i(i(x,F),F),x)).
Collected Works of Larry Wos
1012
Axiom 3 is included because its deduction from either set will establish the corresponding completeness result. As it turns out, the following axiom, 2a, is provable from axioms 1, 2, and 3; it is obviously more general than axiom 2. (axiom 2a)
P(i(i(i(x,y),x),x)).
Therefore, the complete axiom system consisting of 1, 2, and 3 is equivalent to that consisting of 1, 2a, and 3.
9 Random Notes For your enjoyment and curiosity, I decided to include the following notes. Some of them express the views we have exchanged; some are simply my unsupported opinions (which you have encouraged me to express). Some of the notes are directly related to the earlier material, some are distantly related, and some are perhaps unrelated. Note 1. That a number of individuals still maintain the impossibility of the effective automation of logical reasoning attests to resistance—and, perhaps, to fear. No automated reasoning program will ever replace the skilled mathe matician or logician. But, in view of the frequency, variety, and ease of success reported here and elsewhere, how can one doubt the value of such a program as an automated reasoning assistant? As my esteemed colleague Bob Boyer has been heard to say, there is no way to cheat when answering an open question. Since a number of such questions have been answered with the claim that an automated reasoning program played a key role, then the only apparent complaint must rest with the belief that the program did very little. If that is the objection, I recommend that the skeptic review the 4-step proof deducing thesis 59 from theses 19, 37, and 60, coupled with Scott's comment. That proof certainly appears to be an example of a proof that a person might not find. For a more impressive result, I recommend that the curious examine Steve Winker's original 159-step proof that establishes that the formula XHNprovides a complete axiomatization of equivalential calculus [38]. Winker's result refuted a long-standing conjecture, and it was obtained with substantial assistance from an automated reasoning program (AURA) designed by colleagues at Argonne National Laboratory. For equally impressive results, but ones that may offer even more depth, I recommend that the difficult-to-persuade examine the research (with my col league McCune) focusing on fixed point problems in combinatory logic [37, 18]. In that context, the kernel strategy, used to find fixed point combinators, is of particular satisfaction; its use provides the most uniform success with randomly selected problems from some area of mathematics or logic. Note 2. Automated reasoning programs can find proofs that a person, even with training and knowledge, might not find; again, the earlier cited 4-step proof of thesis 59 provides an appropriate example. More obvious is the case in which
Automated
Reasoning and Bledsoe's Dream for the Field
1013
an open question was answered, where an automated reasoning program played a key role. Such a program makes no tacit assumptions. Such a program nicely complements the expertise that can be brought to a study by the researcher. The objection that one cannot know a priori which inference rule to use seems spurious; in many computing environments, one can simply try a number of runs, simultaneously. When a person, rather than a program, is one's colleague, the preferred attack is often unclear. On the other hand, the desire for choosing quickly and wisely the best in ference rule and strategy provides an excellent motivation for researchers in our field to propose and test metarules for making such choices. Only, let the testing at least include hard problems and new problems, instead of relying on those t h a t have been repeatedly quoted and that are now easy to solve. Of course, I recommend an occasional attempt to answer an open question; but the tests must focus mainly on known results, for, otherwise, progress cannot be measured. I also give the obvious recommendation that d a t a must be given to support claims, CPU time compared to other programs or approaches, number of conclusions drawn, number retained, and the like. N o t e 3 . To me, it is clear that the field has matured, at least passing through adolescence. Only a few years ago, what chance would we have had with the 68 theorems suggested by Scott? Before O T T E R ' s arrival, what program could perform almost linearly with respect to drawing conclusions? Who would have guessed that, by 1990, a program would exist t h a t could be effectively used (at one end of the spectrum) for proof checking and (at the other end) for finding a new axiom system? If the field moves forward just a bit more, such a program might well ease the burden of refereeing for journals of various types—give such a future program the outline supplied in the paper to be refereed, and instruct it to fill in the gaps. For a distantly related example, O T T E R found that, among the 68 theses of Lukasiewicz sent by Scott, 12 properly subsumes 11, 18 properly subsumes 17, and 26 properly subsumes 27; a pair of this type might occur in a proof to be refereed. Also, when O T T E R was given the obvious eight weight templates and asked recently to proof check the 8-step proof of thesis 59 from theses 19, 37, and 60, the 7-step proof was found first. In other words, O T T E R sometimes finds a better proof than the one under study, and sometimes finds a theorem more general than either of two theorems—neither of which subsumes the other— whose negations are included to permit the program to prove both theorems in one run. N o t e 4. Conducting research with O T T E R is strikingly different from con ducting research with a person. With a person, one is ordinarily forced to choose, from among the possible attacks, the one that seems most promising. It is simply too confusing and too arduous to sit back and try to consider two or more paths of inquiry simultaneously. However, with OTTER, you can pursue many attacks in a single run. I certainly took this approach in my studies of the completeness proofs for various axiom systems.
Collected Works of Larry Wos
1014
It was simple; you choose the axiom system to be proved complete, place its members in the set of support, and, for each other known complete axiom system, place in the axioms the disjunction of the negations of its members. I think it helps to monitor OTTER's progress: you can place the individual negations—each disjoined with an ANSWER literal designating its role—in the passive list, preventing them from participating except for unit conflict and subsumption. Occasional glances at the output file show how things are progressing. Asking about UNIT CONFLICT shows which members of which axiom system have been proved, which is where the ANSWER literal comes into play. Asking about EMPTY CLAUSE shows which systems have been deduced or, equivalently, which completeness proofs have been obtained. The other striking difference focuses on the occurrences of success measured in CPU time or measured in the number of retained clauses. Specifically, proofs often occur in bunches. OTTER often proves some of the theorems under con sideration in the first few CPU seconds and with a small number of retained clauses. Then, often, an isolated proof is found after say 20 CPU minutes and the retention of 3,000 clauses. At that point, sometimes, OTTER seems to go off and hide, for glances at the output file in search of new successes from among the targets yield nothing new. However—and I am just beginning to accept this—after a long gap in time and retained clauses, another desired result is often obtained. For such an example, it suffices to glance at the following results of the successful attempt to prove the dependence of theses 1, 2, 3, 16, 21, 24, 39, and 40 on the set consisting of 18, 35, and 49. UNIT UNIT UNIT UNIT UNIT UNIT
CONFLICT CONFLICT CONFLICT CONFLICT CONFLICT CONFLICT
at 2.02 sec 104 at 3.69 sec 144 at 3.76 sec 149 at 3.87 sec 157 at 4.04 sec 162 at 1288.96 sec 3211 UNIT CONFLICT at 26600 .33 sec 8089 UNIT CONFLICT at 26635,.09 sec 8205
[bin,103,13] [bin,143,18] [bin,148,15] [bin,156,19] [bin,161,14]
$ANS(step_th_2). $ANS(step_th_39). $ANS(step_th_16). $ANS(step_th_40). $ANS(step_th_3).
[bin,3210,16] $ANS(step_th_24). [bin,8088,12] $ANS(step_th_l). [bin,8204,17] $ANS(step_th_21).
N o t e 5. Using OTTER is, to me, often reminiscent of collaborating with a brilliant colleague whose mental processes are complex and sometimes mysteri ous. Rather than simple poetry or worse, I am instead referring to the intricacy and interplay of OTTER procedures and options. For example, let the objective be to find one or more shorter proofs. The obvious approach is to set the flags instructing OTTER to compare derivation lengths and to use back subsumption and thus seek, in a straightforward manner, to measure the lengths of two deductions of the same conclusion, preferring the
Automated Reasoning and Bledsoe's Dream for the Field
1015
shorter. The approach is a good one, but far more can be done, and certain hid den complications exist. Perhaps not so obvious, the shorter proof terminating in clause D may be missed because of encountering on the way two deductions of clause C, where the first deduction has shorter length than the second, but where the second deduction contains clauses that can be used repeatedly on the path from C to D. In other words, the shorter subpath on the way to proving a theorem may lead to pursuing a longer path to the finish. Since the topic of shorter proofs is important—such proofs are often more elegant—I shall simply touch on additional options and other complications that are in part hidden. Rather than instructing OTTER to direct its search based on choosing as the focus of attention the "simplest" clause not yet used, you can instead use level saturation, a breadth-first search. In the context of seeking shorter proofs, the appeal of an approach based on level saturation rests with the correlation between proofs of lower level and shorter proofs. However, you can quickly see that there can exist two proofs with the first having lower level than the second, but with the second being shorter. The level of input clauses is 0, and the level of a deduced clause is one greater than the maximum of the levels of the immediate ancestors used to deduce the clause. A proof can be found at level 4 with a length of 7, in contrast to a second proof of the same result having level 5 and length 5. Therefore, an approach based on level saturation is not guaranteed to find the shortest proof, for, if forward subsumption is used—which is almost always recommended—the second proof can have its last step subsumed, preventing completion. In fact, any form of subsumption, backward or forward, can interfere with finding the shortest proof, for the subsumed clause—although less general than its subsumer—may be the key step in a shorter proof. Nevertheless, when using the ancestor-subsume flag, to avoid retaining many copies of the same clause, the use of back subsumption is recommended. The clause A ancestor-subsumes the clause B if and only if (1) A properly subsumes B or (2) A and B are identical and the derivation length of A is less than or equal to that of B. Just as there can exist clauses A and B that subsume each other, there can also exist two clauses that ancestor-subsume each other. In either case, if forward subsumption is in use, OTTER retains the earlier copy. Rather than asking OTTER to directly seek shorter proofs by comparing derivation lengths, you might instead prefer to use a level-saturation approach with the ancestor-subsume flag turned off. With that choice, you might well decide to use back subsumption to purge less general clauses in favor of newer and more general clauses. However, you should be warned that the use of back subsumption can, unfortunately, interfere with finding a shorter proof. To see how such interference can occur, you can imagine the deduction of two clauses A and B such that B is deduced after A is deduced and such that B back subsumes A. If in addition the path to A is shorter than the path to B, and if the use of A or B could lead in one step to the completion of the desired proof, then the actions of back subsumption can prevent you from finding the shorter proof.
1016
Collected Works of Larry Wos
The use of weighting—which is inescapable with OTTER, for the focus of attention will be based on symbol count or on the input weight templates—can block the discovery of a shorter proof. Indeed, the use of so-called less complex expressions in preference to more complex can force the program to miss a proof that might be shorter though relying on more complex clauses. Perhaps the word "miss" is not the best word in a technical sense; the word "delay" might be better, delay for an inordinate amount of CPU time, for example, so that the proof is in fact missed. In a similar way, the inclusion of dependent clauses—although promoting naturalness and perhaps the imitation of the approach a person might take—can also interfere with finding a shorter proof. For example, the successful attempt to prove thesis 21 dependent on theses 18, 35, and 49 produced a 55-step proof in which all three theses were used; in contrast, a second attempt in which thesis 49 was omitted produced an 11-step proof. Although you might strongly and understandably object, I think we have yet more evidence to support the position that the best approach to the automation of logical reasoning does not emphasize the imitation of the way a person works. Naturalness of proof and of approach is fine; but its absence to some degree or to a total degree may be the key to obtaining the desired result. AH is okay; better to increase the effectiveness of research by complementing the researcher, without the concern of imitation. I was startled by the obvious appeal—to a surprising number of people—coupled with the misleading nature of a recent talk in which the speaker asserted that the successful dispatching of a challenge problem proposed by Frank Pfennig, though laudable, suffered from the fact that Lukasiewicz (the author of the theorem in question) would never have in effect generated the 6,000,000 conclusions that the program did. I am certain that Lukasiewicz did not and would never take such an approach; but the observation is at best irrelevant, if the object is to evaluate the merit of the attack taken by an automated reasoning program. Finally, intuition can get in the way of finding the desired shorter proof. For example, intuition might suggest that the thesis i(x, i(y, x)) is a key to finding a shorter proof. To impose that intuition on OTTER's search, you can use a weight template to give a low weight (high preference) to the following clause. P(i(x,i(y,x))). OTTER would accept the instruction, emphasizing the role of the preceding clause, which might in turn send the program down a long, long path culminating in a proof. The resulting proof might be far longer than that produced if the clause were simply given a weight based on symbol count or, even further, given a high weight to prevent or delay its use. Quite different from the direct approach to seeking a shorter proof with OTTER is that in which a number of targets are given simultaneously. For ex ample, if the objective is to prove that some given set of axioms is complete for some calculus, by including in the axioms clauses each of which is the disjunc-
Automated Reasoning and Bledsoe's Dream for the Field
1017
tion of the negations of a known set of axioms, OTTER can in effect attempt to use each disjunction as a target. If you also set the proofs limit flag to 0, giving OTTER permission to continue to seek proofs until time or memory is exhausted, then the program may in fact succeed in completing a number of different and sometimes unrelated proofs. Then, rather than OTTER compar ing proof lengths, the user makes the comparison. This approach to seeking a shorter proof can, of course, be combined with the direct approach in which OTTER compares derivation lengths of the same deduction. Of course, the beauty—some might say difficulty—of using OTrER is cap tured by the converse; such an emphasis based on the researcher's intuition might be just what is needed to find the shorter proof. Indeed, when Scott suggested that the 8-step proof of thesis 59 from theses 19, 37, and 60 could be shortened and also stated how that could be accomplished, I simply added weight templates to encourage the use of one clause and discourage the use of two others; it did work, as evidenced by the resulting 7-step proof, as he predicted. I view such occurrences as proof that OTTER is an assistant whose value is great—and growing. Conducting research with a person is, in reality, no less complicated. N o t e 6. Just as different mathematicians and different logicians have differ ent strengths, so also is it true for automated reasoning programs. No program compares to the Boyer-Moore program for verifying computer code or verify ing algorithms. The Kapur-Zhang program appears to be the best for solv ing problems in which associative/commutative unification can be used. As for the approach based on Prolog technology, Stickel's program sets the standard. However, for my type of experimentation, no program offers nearly as much as OTTER does. Even further, for serious research in some area of mathematics or logic, I strongly conjecture that nothing that currently exists compares to OTTER. The fact that, with respect to drawing conclusions, this program per forms almost linearly gives it a distinct edge. Even after 19 CPU hours on a SPARCstation, the rate of deductions had changed only from 550 clauses per CPU second to 460. One of McCune's masterful moves was to adapt the use of discrimination trees [19] to the application of forward subsumption, a procedure that is indispensable for serious research [40]. Sometimes, the objective is to find the "best" proof, which may mean the shortest, the most elegant, the most natural, or simply one that the researcher particularly likes. With the use of weighting and the ancestor flag and demodula tion, OTTER often enables one to take a proof and polish it to produce a better proof. A case in point: when Scott suggested that the 8-step proof of thesis 59 from theses 19, 37, and 60 could be shortened to a 7-step proof and showed how, it was trivial to instruct OTTER to follow Scott's suggestions. Later, when the assignment for OTTER was to simply verify that proof to check that no shorter proof existed, the use of level saturation failed in an odd way—a 4-step proof was found instead. N o t e 7. Clearly, the use of OTTER as a team member requires reorientation.
1018
Collected Works of Larry Wos
For one of the more striking examples—when compared to working with another person—no means exists to ask OTTER how it is doing, whether it is close to a proof, or whether it is stuck in a trough. Instead, one notices that the proofs often come in clusters and that the gaps between successes can vary widely. I have often had the urge to truncate a run because of noting that no new proofs had been found in the preceding 3 CPU hours, only to discover, after resisting the urge, that more proofs would be found. For example, in a run being made as I write this section, in which the object is to find a proof of the completeness of a single axiom (found by Meredith) for sentential calculus, one of the desired results was obtained at the 15 CPU-second mark, and the next result was not obtained until the 5,606 CPU-second mark. Also, I find it much easier to wander through OTTER's results than through those of a person; the explanation rests in part with no missing steps, precise history of derivation, and the like. Such wanderings have produced unexpected treasure. For example, before I was told that theses 18, 35, and 49 form a complete axiom system for sentential calculus, I was using OTTER to attempt to prove that the system consisting of theses 16, 18, 21, 24, 35, 39, 40, and 49 was complete. The approach focused on deducing theses 1, 2, and 3, the Lukasiewicz axiom system. In that study, I had also instructed OTTER to seek, where possible, shorter proofs. You can imagine the delight and excitement I experienced at discovering, during my examination of OTTER's success with proving theses 1, 2, and 3, that the shorter proofs did not use theses 24, 39, and 40. In other words, I had a proof that theses 24, 39, and 40 were dependent on theses 18, 35, and 49—possibly, although unlikely, a new result. Even though the result was already known, as it turned out, the example clearly illustrates— at least to me—the potential value of OTTER as a research assistant. The fact that theses 16 and 21 are also dependent—although not discovered in my cited experiment—detracts for me in no way. On the contrary, the experiment now gives me yet another way to seek the existence of dependent axioms.
10 A Sincere Debate At this point, before giving a summary and conclusions, an exchange of views is in order. I move that you and I more or less debate. Since you have lost your vote, for you are not present, the motion carries. However, fear not, for I shall also take your part—at least to the extent of guessing what you might say at various points. In fact, I shall give you first say. "Larry, Larry, you are really confused. There is no way that anyone has come near to fulfilling my dream, not even you, for whom I have the great est respect. You and your colleagues at Argonne are pretty good at solving some mathematics problems, that's for sure. But so is Macsyma and Wu's al gorithm. In all three cases, the problem is that the mainstream of mathematics is just not being addressed. Who cares about little problems like centuries-old geometry theorems, prepositional calculus independence results, or tricky little
Automated Reasoning and Bledsoe's Dream for the Field
1019
integration problems? Who cares? Not any significant portion of the working mathematicians of this world." You raise a number of excellent points in your first salvo. I am certain that your sole motive is to get at the truth, so let me address two of those points. You are indeed correct that your grand dream has hardly been touched, but what about those aspects addressed in this article/letter? We can prove theorems suggested by a well-respected researcher, such as Dana Scott, and do so on the first try. A few mathematicians and logicians are now experimenting with an automated reasoning program, OTTER in particular. And—most significant, at least to me, and I hope to others—we have used our programs to answer open questions, and from a variety of fields. The kernel strategy that McCune and I formulated for answering questions concerning fixed point combinators appears to offer far more power in that area than any person can offer—no disrespect intended to anyone. Who would have thought that by the mid-1980s there would exist an area in which the probability of success was higher than one half when a problem from that area was submitted to an automated reasoning program? And, please note, we usually have the answer in less than 5 CPU seconds. So, we have at least fulfilled one of Ross Overbeek's dreams. Second, as for the mainstream not caring, at least (in alphabetical order) Kalman, Kaplansky, and Scott care some. In fact, Kalman, on a visit to Argonne, told me that the work that Winker and I did added stature to equivalential calculus. I am getting more space than you are. "Larry, you were a mathematics graduate student at two great schools, the University of Chicago and the University of Illinois. Take down the fifteen or so graduate-level mathematics texts that you studied and mastered. Open those 7,000 pages to any page you want. Is there a program on earth that can check that page, even if it is recast in a formalism of your choice? How many of those pages could be processed? I bet not 10. Quaife's splendid work with OTTER shows that to check regular math (for example, set theory or number theory), you have to put in dozens of lemmas to get through a regular math proof with OTTER, say one lemma per line of proof! That is proof checking, not automated theorem proving. So we are probably less than 10/7000th of the way towards fulfilling my dream. And I will bet you any amount of money that my dream will be fulfilled only when machines do as people do, as I have been saying and trying to do for two decades: use analogy, use a huge database of known mathematics, use examples, use domain-specific heuristics." You again score points, and in abundance. You see, I focus on what has been accomplished, rather than on what has not. Indeed, an overwhelming majority of what is found in mathematics books is outside our power—now. But, we cannot begin in the middle; mathematics did not begin there. We have come so far from those early days in the 1960s, but the journey has only begun. Only in the past few years have there existed more than a scant number of researchers trying to do mathematics with a reasoning program. Too many people in the field wasted time early—in my judgment—by focusing exclusively on theory rather
1020
Collected Works of Larry Wos
than experimenting heavily. Granted that much of Quaife's excellent effort is proof checking; however, a study of it might unearth new ideas to replace much of the checking with proof finding. I have the greatest respect for your analysis; but, nevertheless, I do not advo cate having computers approaching mathematics as people do. Instead, I favor a team consisting of a mathematician and an automated reasoning program—a team that may eventually be far more powerful than either could be! In that regard, although our dreams—yours and mine—diverge sharply, we must each believe that the field clearly merits total devotion to it. Proof: the sum of the years you and I have given to the corresponding research approaches half a century! "Larry, I hope I have not been too harsh!" Just harsh enough—not too much, but, more important, not too little. Questioning from those within the field is required—if the field is to advance. However—and I also hope you find my remarks not too harsh—I think that the disappointment and sometimes disapproval regarding the automation of reason ing, especially in the context of mathematics, misses the following fundamental and essential point. In my view, to evaluate the effectiveness of the better au tomated reasoning programs by comparing them to the best of mathematicians and logicians—for example, those who currently hold the position of full profes sor and those who in the past have written some of the standard texts—is the wrong comparison to make. If instead the comparison is with people in general, or even with randomly chosen college students, the more effective reasoning programs now available will receive excellent grades, scoring much higher than the vast majority of people. Indeed, given a set of problems from mathematics and logic, the best of such programs—OTTER is my choice—reason far more effectively than almost all people do. For an example, the ability of OTTER to simplify and canonicalize expressions in most cases dwarfs that of any individ ual I have encountered. OTTER can apply as many as 4,000 demodulators per CPU second; obviously, no person can compete with such performance. Of course, let us not ignore the long-term goal of using an automated rea soning program that does compare favorably with the better mathematicians and logicians. When and if the field has advanced that far, we shall be savoring the finest brandy and perfect raspberries, listening to Mozart and Bix Beiderbecke reborn, and—perhaps more relevant—answering some of the deepest open questions that exist. Were I not familiar with the twists and turns of the mind—learned mainly at the poker table—I would be sitting at this keyboard experiencing amazement at the lack of use, by mathematicians and logicians, of some automated reason ing program. What fun they are missing by not using this powerful, portable program! How sad, for the use of a program like OTTER by even a handful of mathematicians and logicians would materially increase the rate of advance of automated reasoning and—from what I can tell—also of mathematics and logic. Could it possibly be that they simply do not know what a valuable as-
Automated Reasoning and Bledsoe's Dream for the Field
1021
sistant for research OTTER is? With OTTER's availability and with access to today's powerful computers, we may have a mystery here, one focusing on how researchers can resist the temptation to add this program to the team. Such users are, in my opinion, one of the key missing pieces to the rapid advance of our field. The grand objectives are indeed stunning and beautiful—and worth the gamble.
11 Summary, Conclusions, and the Future My congratulations to you, Woody, for winning the 1991 prize for Milestones in Automated Theorem Proving. How poetic it would be if, many years from now, the winner of that prize had found the basis for the corresponding research by reading this article/letter, stimulated by one of the experiments, challenge problems, or open questions presented here! Even further, perhaps this future winner, excited by the demonstration of the marked advance of automated rea soning over the past decade and intrigued by the apparent power of McCune's program OTTER, will have conducted the prizewinning research on a copy of this very program—a copy obtained by anonymous FTP, for example. After all, the challenge problems do provide a wide spectrum of difficulty and are, therefore, useful for testing new programs and evaluating new ideas. Might the impetus come from one of the included problems in which equality plays no role, or might it come from one of the problems in which equality plays the dominant role? I prefer that the impetus be one of the open questions posed here to further stimulate research in automated reasoning and to promote its application to mathematics and logic. Perhaps, at this very moment, our future prize winner is pursuing one of the three goals on which the organization of this article is based. The pursuit might be of the first goal, which focuses on the ability of an automated reasoning pro gram, when given a theorem to consider, to obtain a proof on the first attempt and, of equal importance, without much guidance from the user. The proviso about the lack of guidance addresses the understandable concern of those who wish or might wish to use such a program, but without the requirement of mas tering the various intricacies and subtleties. Perhaps the needed stimulus will be one of the numerous examples given to show that first-attempt success in fact occurs frequently here in 1990. Instead, the target might be the second goal, which concerns contributions to mathematics and logic resulting from the use of an automated reasoning program. In that case, the impetus for research might be one of the contributions discussed here—a shorter proof than can be found in the literature, an answer to an open question, or the new axiom system. How satisfying that the theorems that are the focus of these contributions and those relevant to the first goal include ones meriting the attention (in alphabetic order) of Bernays, Church, Frege, Hilbert, Kalman, Kaplansky, Lukasiewicz, Scott, and Smullyan.
1022
Collected Works of Larry Wos
Unfortunately, compared to the first two goals, less evidence exists for the realization of the third goal, the use by mathematicians and logicians of an automated reasoning program. However, as such use increases—as it assuredly must—automated reasoning will make impressive advances. I eagerly await the succession of open questions that will be answered with the assistance of some automated reasoning program. Will one of those questions be so significant that answering it will merit the awarding of the $100,000 prize you had established for the "first monumental contribution to mathematics made by an automated reasoning program"? Has the evidence cited here begun to persuade you that the three goals that are an important part of your grand dream for automated reasoning are in fact finally a reality? The case is further strengthened if you also consider the recent advances in theory, implementation, and application. With regard to theory, the formulation of the kernel strategy [37] for attacking fixed point problems in combinatory logic and the full development of the formal treatment for linked inference [28] in which equality plays no essential role fit nicely into the picture of a field making important advances. As for implementation, the nearly linear performance of OTTER coupled with its power marks a singular development. In the area of application, among the uses for an automated reasoning pro gram discussed in this article are those of systematically seeking shorter proofs, identifying dependent axioms, checking proofs, finding new axiom systems, and the familiar proving theorems. These varied uses make an automated reasoning program—especially the program OTTER—an excellent research assistant. Its power reduces the turnaround time dramatically, producing a qualitative im provement in the study of the chosen area of mathematics or logic. The added power is in part derived from McCune's adaptation of the use of discrimination trees [19] for the application of forward subsumption [21] and demodulation [32]. Of course, as you know so well, I am somewhat puzzled at the lack of use of an automated reasoning program by mathematicians and logicians. Could the explanation be that people simply are not familiar with the recent develop ments? Is it not known that a program like OTTER can apply as many as 4,000 rewrites rules per CPU second on a SPARCstation to simplify and canonicalize rapidly and accurately? Do few know that, by using weighting [15], the expert's knowledge and intuition can be used to direct such a program in its search for the desired information? More generally, is there little awareness of how well the use of an automated reasoning program complements the way a person works? In unification alone, this complementary aspect is nicely exemplified. Indeed, as Dana Scott observes, unification is neither the most natural nor the easiest process for a person to apply, which explains in part why the use of a reasoning program can lead to finding unexpected and elegant proofs that a person might not discover. An excellent example is provided (in Section 5) by the 4-step proof of thesis 59 from theses 19, 37, and 60 (the new axiom system). Dijkstra has commented on the importance of finding such short and elegant proofs [3]. In summary, to me—and I hope to you—the evidence presented in this ar-
Automated Reasoning and Bledsoe's Dream for the Field
1023
tide strongly suggests that automated reasoning has made significant quanti tative and qualitative advances in the decade from 1980 to 1990. Further, this evidence refutes the position that still exists asserting the impossibility of an effective automation of reasoning. Of course, no program will ever replace the mathematician and logician; but programs do exist that nicely complement such a researcher. That we have barely begun is clear; that challenges will always exist is preferred; that automated reasoning offers intrigue, excitement, and beauty will continually be true.
Acknowledgments My gratitude to William McCune for his impressive program OTTER and for being a splendid colleague, and to Dana Scott for his intriguing and excellent suggestions regarding research.
References [1] H. P. Barendregt (1981): The Lambda Calculus: Its Syntax and Semantics. Amsterdam: North-Holland. [2] M. Davis and H. Putnam (1960): A Computing Procedure for Quantification Theory. J. of the ACM 7, 201-215. [3] E. Dijkstra (1989): Dijkstra's Reply to Comments. In: A Debate on Teaching Computing Science. C. of the ACM 32(12), 1397-1414. [4] J. Guard, F. Oglesby, J. Bennett, and L. Settle (1969): Semi-automated Mathematics. J. of the ACM 16, 49-62. [5] P. R. Halmos (1960): Naive Set Theory. Princeton: D. Van Nostrand Co., Inc. [6] L. Henkin, J. Monk, and A. Tarski (1971): Cylindric Algebras, Part I. Am sterdam: North-Holland. [7] E. Huntington (1933): New Sets of Independent Postulates for the Alge bra of Logic, with Special Reference to Whitehead and Russell's Principia Mathematica. Trans, of the AMS 35, 274-304. [8] J. Kalman (1978): A Shortest Single Axiom for the Classical Equivalential Calculus. Notre Dame J. Formal Logic 19(1), 141-144. [9] J. Kalman (1986): An ITP Workbook, Technical Report. ANL-86-56, Argonne National Laboratory, Argonne, Illinois. [10] J. Lukasiewicz (1963): Elements of Mathematical Logic. Oxford: Pergamon Press. [11] J. Lukasiewicz (1970): The Equivalential Calculus. In: L. Borkowski, ed.: Jan Lukasiewicz: Selected Works. Amsterdam: North-Holland.
1024
Collected Works of Larry Wos
[12] E. Lusk, W. McCune, and R. Overbeek (1982): Logic Machine Architec ture: Kernel Functions. In: D. W. Loveland, ed.: Lecture Notes in Computer Science, Vol. 138. New York: Springer-Verlag. [13] E. Lusk, W. McCune, and R. Overbeek (1982): Logic Machine Architecture: Inference Mechanisms. In: D. W. Loveland, ed.: Lecture Notes in Computer Science, Vol. 138. New York: Springer-Verlag. [14] E. Lusk and R. McFadden (1987): Using Automated Reasoning Tools: A Study of the Semigroup F2B2. Semigroup Forum 36(1), 75-88. [15] J. McCharen, R. Overbeek, and L. Wos (1976): Complexity and Related Enhancements for Automated Theorem-Proving Programs. Computers and Mathematics with Applications 2, 1-16. [16] W. McCune and L. Wos (1987): A Case Study in Automated Theorem Proving: Finding Sages in Combinatory Logic. J. Automated Reasoning 3(1), 91-108. [17] W. McCune (1990): OTTER 2.0 Users Guide, Technical Report. ANL-90/9, Argonne National Laboratory, Argonne, Illinois. [18] W. McCune and L. Wos (1989): The Absence and the Presence of Fixed Point Combinators, Mathematics and Computer Science Division Preprint MCS-P87-0689, Mathematics and Computer Science Division, Argonne Na tional Laboratory, Argonne, Illinois. [19] W. McCune (1990): Experiments with Discrimination-Tree Indexing and Path Indexing for Term Retrieval. J. Automated Reasoning (to appear). [20] G. Robinson and L. Wos (1969): Paramodulation and Theorem-Proving in First-Order Theories with Equality. In: B. Meltzer and D. Michie, eds.: Machine Intelligence 4. Edinburgh: Edinburgh University Press. [21] J. Robinson (1965): A Machine-oriented Logic Based on the Resolution Principle. J. of the ACM, 12, 23-41. [22] J. Robinson (1988): Automatic Deduction with Hyper-Resolution. Interna tional J. Computer Mathematics 1, 227-234. [23] B. Smith (1988): Reference Manual for the Environmental Theorem Prover, An Incarnation of AURA, Technical Report ANL-88-2, Argonne National Laboratory, Argonne, Illinois. [24] R. Smullyan (1985): To Mock a Mockingbird. New York: Alfred A. Knopf. [25] R. Smullyan (1987): Private Correspondence. [26] R. Statman (1986): Private Correspondence with Raymond Smullyan. [27] A. Tarski (1980): Private Communication. [28] R. Veroff and L. Wos (1990): The Linked Inference Principle, I: The Formal Treatment. J. Automated Reasoning (to appear).
Automated Reasoning and Bledsoe's Dream for the Field
1025
[29] S. Winker, L. Wos, and E. Lusk (1981): Semigroups, Antiautomorphisms, and Involutions: A Computer Solution to an Open Problem, I. Mathematics of Computation 37, 533-545. [30] S. Winker (1982): Generation and Verification of Finite Models and Coun terexamples Using an Automated Theorem Prover Answering Two Open Questions. J. of the ACM 29, 273-284. [31] L. Wos, G. Robinson, and D. Carson (1965): Efficiency and Completeness of the Set of Support Strategy in Theorem Proving. J. of the ACM 12, 536-541. [32] L. Wos, G. Robinson, D. Carson, and L. Shalla (1967): The Concept of Demodulation in Theorem Proving. J. of the ACM 14, 698-709. [33] L. Wos and G. Robinson (1973): Maximal Models and Refutation Com pleteness: Semidecision Procedures in Automatic Theorem Proving. In: W. Boone, F. Cannonito, and R. Lyndon, eds.: Word Problems: Decision Prob lems and the Burnside Problem in Group Theory. New York: North-Holland. [34] L. Wos, R. Overbeek, E. Lusk, and J. Boyle (1984): Automated Reasoning: Introduction and Applications. Englewood Cliffs, New Jersey: Prentice-Hall, Englewood Cliffs. [35] L. Wos, S. Winker, R. Veroff, B. Smith, and L. Henschen (1984): A New Use of an Automated Reasoning Assistant: Open Questions in Equivalential Calculus and the Study of Infinite Domains. Artificial Intelligence 22, 303356. [36] L. Wos (1987): Automated Reasoning: 33 Basic Research Problems. Engle wood Cliffs, New Jersey: Prentice-Hall, [37] L. Wos and W. McCune (1988): Searching for Fixed Point Combinators by Using Automated Theorem Proving: A Preliminary Report, Technical Report ANL-88-10, Argonne National Laboratory, Argonne, Illinois. [38] L. Wos, S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, and R. Butler (1991): OTTER Experiments Pertinent to CADE-10. Technical Report. ANL-89/36, Argonne National Laboratory, Argonne, Illinois. [39] L. Wos, S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, and R. Butler (1990): Automated Reasoning Contributes to Mathematics and Logic. In: Lecture Notes in Artificial Intelligence, Vol. 449. New York: Springer-Verlag. [40] L. Wos, R. Overbeek, and E. Lusk (1990): Subsumption, A Sometimes Undervalued Procedure. In: J.-L. Lassez, ed.: Festschrift for J. A. Robinson (to appear).
Logical Basis for t h e Automation of Reasoning: Case Studies 1 Larry W o s and R o b e r t Veroff
Contents 1 Introduction 2 The clause language paradigm 2.1 Components of the clause language paradigm 2.2 Interplay of the components 3 A fragment of the history of automated reasoning from 1960 to 1990 4 Answering open questions 4.1 Equivalential calculus 4.2 Combinatory logic 4.3 Sentential calculus 5 Relation to logic programming and to person-oriented reasoning 5.1 Logic programming 5.2 Person-oriented reasoning 6 Challenge problems for testing, comparing, and evaluating 7 Current state of the art: Basic research problems to solve 8 Programs, books, and a problem database 9 Summary and the future
1
1026 1029 1029 1031 . . . 1033 1035 1037 1038 1043 1044 1044 1047 1048 1052 1054 1056
Introduction
With the availability of computers in the late 1950s, researchers began to en tertain the possibility of automating reasoning. Immediately, two distinctly dif ferent approaches were considered as the possible basis for that automation. In one approach, the intention was to study and then emulate people; in the other, the plan was to rely on logic. In this chapter, we focus mainly on the latter, for logic has proved to provide an excellent basis for the automation of reasoning. Among the various paradigms for automated reasoning that rely on logic, in this chapter we concentrate on the clause language paradigm [Wos, 1987; Wos et al., 1991a]. In addition to relying on the use of clauses to represent 'This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted from Handbook of Logic in Artificial Intelligence and Logic Programming, ed. D. M. Gabbay, C. J. Hogger, and J. A. Robinson, Volume 2, Deduction Methodologies, Oxford University Press, Oxford, 1994, pp. 1-40, with permission of Oxford University Press.
Logical Basis for the Automation
of Reasoning
1027
information, the clause language paradigm—in contrast to paradigms based on logic programming—relies on the retention of deduced conclusions and on the use of a variety of inference rules, diverse strategies, and a number of additional procedures. T h e clause language paradigm is discussed in detail in Section 2. The current state of the clause language paradigm, which continues to evolve, results from the objective of using automated reasoning for research in math ematics and logic. Indeed, the pursuit of that objective prompted numerous experiments that in turn revealed the need for the various components of the paradigm. To provide a perspective for measuring the progress that has occurred in the preceding decade, and to illustrate graphically the value of experimenta tion, we present in Section 3 experiments that directly influenced the evolution of the clause language paradigm. The applications of automated reasoning include research in mathematics and logic, program verification and synthesis, circuit design and validation, and, in general, tasks that depend on logical reasoning. Substantial evidence exists that automated reasoning now occupies a significant position in science, for its use has led to answering open questions in finite semigroups [Winker et ol,. 1981], in equivalential calculus [Peterson. 1977; Kalman, 1978; Wos et ol., 1984], in combinatory logic [Smullyan, 1985; Smullyan, 1987; Wos and McCune, 1988], and in sentential calculus [Scott, 1990]. To assess the scope and significance of the various contributions, we discuss in Section 4 a number of the questions that have been answered by relying heavily on an automated reasoning program. To gain an insight into the possible reasons for the cited successes and also gain an appreciation for how a program based on the clause language paradigm complements the mechanisms on which people rely, we compare in Section 5 the clause language paradigm to both logic programming and person-oriented reasoning. The long-term objectives for automated reasoning all focus on providing an automated reasoning assistant. At the more mundane end of the spectrum, the envisioned assistant can be instructed to function as a logical calculator, carrying out assignments that only barely require reasoning. At the more intriguing end of the spectrum, this assistant can be instructed to function as a colleague, selfanalytically choosing inference rules and strategies, modifying an attack based on current performance, and examining results to highlight those that offer the most significance. The assistant will offer interactive mode, batch mode, and 'collaborative mode'—the latter referring to the style that is present when working with a research colleague in which interaction occurs, but only at the highest level. Despite the marked advances of the preceding decade, there remain many obstacles to overcome before automated reasoning reaches its full potential. In the obvious sense, each obstacle is a source of significant research in the field. Although some of the following obstacles do not directly apply to every paradigm for the automation of reasoning, each in some manner merits study.
1028
Collected Works of Larry Wos
1. Clause Generation: The reasoning program draws far too many conclu sions, many of which are redundant and many of which are irrelevant even though they are not redundant. 2. Clause Retention: The program keeps too many deduced clauses (too many conclusions) in its database of information. 3. Size of the Deduction Steps: The inference rules do not take deduction steps (steps of reasoning) of the appropriate size. 4. Inadequate Focus: The program gets lost too easily. 5. Metarules: No adequate guidelines exist for selecting the appropriate representation, inference rule(s), strategy or strategies, transformations for canonicalization (demodulators), and type of information-discarding procedure (subsumption) to be employed. This obstacle focuses on guide lines for the effective use of an automated reasoning program. 6. Database Indexing: The program requires too much time to find the appropriate information in its database. This obstacle focuses on imple mentation. Far more experimentation is required for the continued evolution of the clause language paradigm and for establishing a metatheory for its most effective use. For this chapter to be complete, it must contain material that permits one to begin or continue research, whether directed to theory, to implementation, or to application. Therefore, we focus in Section 6 on challenge problems for test ing, comparing, and evaluating programs, approaches, and ideas. Some of the included problems remain open at the time of this writing, but we conjecture that these are amenable to attack with an existing automated reasoning pro gram. Since a frequent request concerns research topics—suitable for a doctoral dissertation, for example—we present, in Section 7, basic research problems and discuss the current state of automated reasoning. To further encourage and support research, we include in Section 8 informa tion on appropriate books, on obtaining an automated reasoning program, and on obtaining access to a database of problems of various types. One can now easily obtain by anonymous FTP a portable program [McCune, 1990] that can assist in systematically seeking shorter proofs, identifying dependent axioms, formulating conjectures, checking proofs, finding new axiom systems, and (the familiar) proving theorems. We close the chapter by summarizing what we have covered and focusing on the future.
Logical Basis for the Automation of Reasoning
2
1029
T h e clause language paradigm
The clause language paradigm, as presented in this chapter and as practiced at Argonne National Laboratory since the early 1960s, is one approach to the automation of reasoning. This paradigm includes far more than merely using clauses to present an assignment. Indeed, the clause language paradigm relies on the retention of deduced clauses, and it relies heavily on the use of inference rules to draw con clusions from a problem description, strategy to restrict and strategy to direct the application of the inference rules, demodulation [Wos et al., 1967] to canonicalize and simplify conclusions, and subsumption [Robinson, 1965b] to purge an important class of conclusions that are logically weaker than others present in the set of retained conclusions. To provide the basis for an appreciation of the clause language paradigm and the need for its complexity, we describe in this section the basic components and their interplay. The motivation for developing the clause language paradigm was to prove theorems from various areas of mathematics. No doubt influenced by the practice in mathematics of proving lemmas that are to be used later in the proof of a theorem under study and by the approach taken in earlier paradigms for the automation of reasoning, researchers tacitly assumed that the best approach is to retain deduced conclusions during an attempt to complete a given assignment. From what we know at this time, to do otherwise sharply interferes with the likelihood of success, at least when the assignment concerns proving an even moderately interesting theorem; we include evidence when we turn to the topic of answering open questions in Section 4.
2.1
Components of the clause language paradigm
The decision to retain deduced clauses virtually forces the use of procedures to manage the database of retained clauses. In particular, two procedures, subsumption [Robinson, 1965b] and (when equality is present) demodulation [Wos et al., 1967], are essential components of the clause language paradigm. Subsumption is used to purge the clause B in the presence of the clause A when a (not necessarily proper) subclause of B can be obtained from A by instan tiation, the uniform replacement of variables by terms. Demodulation is used to canonicalize and simplify clauses by applying demodulators (rewrite rules) chosen by the researcher or found by the program. To see that subsumption is required, one need only examine the results of various experiments in which this procedure is absent or suppressed. One imme diately finds clauses that are identical copies of other clauses, and one also finds many clauses that can be obtained from other retained conclusions by instantia tion. Such redundancy, which can dramatically decrease the effectiveness of the automated reasoning program, is not caused by the use of the clause language; instead, it is simply a property of reasoning in general, if not appropriately con-
1030
Collected Works of Larry Wos
trolled. In contrast to the clause language paradigm, in which proper instances of existing information are avoided, one frequently encounters in mathematics books a sequence of steps containing a pair of assertions, the second of which is a proper instance of the first; we expand on this point when we discuss personoriented reasoning versus computer-oriented reasoning in Section 5. The need for the use of demodulation to canonicalize and simplify expres sions is rather less obvious than the need for using subsumption to purge trivial corollaries. However, when one pauses to note that the canonicalization and simplification of expressions often maps many different expressions to a single expression, then one quickly sees how demodulation meshes well with subsump tion to decrease the amount of redundancy in the database of retained clauses. Demodulation also meshes well with the weighting strategy, discussed at the end of this subsection. Of course, more directly, one sees the value of using demod ulation in a manner somewhat reminiscent of mathematics and logic; various significant differences are discussed when we turn to person-oriented reasoning. The use of strategy, one type designed to restrict reasoning and one type to direct it, is as vital to the effectiveness of the clause language paradigm as is the use of both subsumption and demodulation. Apparently, that the use of strategy is essential—certainly for difficult assignments such as proving interest ing theorems—is still not widely recognized. As evidence for this conclusion, we note that research continues to focus on various paradigms for the automation of reasoning that take a simplistic approach, relying on a single, very limited strategy. The appeal of such paradigms rests in part with their simplicity and in part with their execution times for proving extremely simple theorems. Al though experimentation strongly suggests that the vast majority of even mod erately interesting theorems is outside their reach, we note that the use of such paradigms does occasionally result in the discovery of an interesting proof of a difficult theorem [Wos and McCune, 1990]. In contrast to most paradigms, including the majority of dialects of logic pro gramming, the clause language paradigm offers a built-in treatment of equality. Specifically, the predicate EQUAL (or certain abbreviations of that form) is automatically treated as representing an equality relation. Therefore, if the ap propriate inference rules are chosen, one need not include the usual axioms for equality—with the exception of reflexivity, x = x. Among the inference rules on which the clause language paradigm relies are binary resolution [Robinson, 1965b], hyperresolution [Robinson, 1965a], URresolution [McCharen et al., 1976], paramodulation [Robinson and Wos, 1969; Wos and Robinson, 1973], and various linked inference rules [Veroff and Wos, 1990]. Where binary resolution requires the consideration of exactly two (parent) clauses, applications of hyperresolution and UR-resolution may consider several clauses simultaneously. Clauses deduced by applications of hyperresolution con sist of positive literals only. Clauses deduced by applications of UR-resolution are unit clauses—consisting of a single literal, either positive or negative. Paramod ulation is an inference rule for equality-oriented reasoning and relies on the
Logical Basis for the Automation of Reasoning
1031
built-in treatment of equality. Linked inference rules are designed to generalize and extend well-known inference rules. Currently, no formal metarules exist for dictating an effective choice of inference rule(s). Of the strategies on which the clause language paradigm relies, the two most heavily used are the set of support strategy [Wos et al., 1965] to restrict the application of inference rules and weighting [McCharen et al., 1976] to direct their application. Intuitively, the set of support strategy requires one to choose a nonempty subset of the input clauses and restrict the reasoning to lines of inquiry that begin with a clause in the chosen subset. To use the set of support strategy, one partitions the set S of input clauses into two subsets, a nonempty subset T (called the initial set of support) and S — T; the latter may be empty. The set of support strategy restricts the application of an inference rule by disallowing application of the rule to sets of clauses consisting solely of clauses from the set S — T. Put another way, all newly retained clauses are added to T (the set of support), and each set of clauses to which an inference rule is applied must contain at least one clause in T. In contrast to restricting the application of an inference rule, the weighting strategy is used to direct its application. To use this strategy, one assigns prior ities, called weights, to the various concepts, relations, and terms. The weights can be based simply on symbol count, or they can be based on a set of elaborate patterns. The intention is to give the researcher the opportunity of guiding the program's search by giving it hints based on knowledge and intuition. By setting a maximum on the weight of a retained clause, the strategy also permits one to impose a cutoff point on complexity; any generated clause whose weight exceeds the maximum will immediately be purged. We note that the weighting strategy meshes well with demodulation, for consideration of a fact in its simplified form contributes to the ease of determining its significance.
2.2
Interplay of the components
The clause language paradigm functions according to the following constraints. All information must be represented as clauses, and one or more inference rules may be chosen. Among the input clauses, the user must designate a nonempty subset to serve as the initial set of support. (Although technically the set of support strategy must be used, when the chosen subset T is in fact all of the input set S, in the obvious sense one is not using the set of support strategy.) The weighting strategy must also be used; if no weights are assigned by the user, the program implicitly assumes that the weight of any term is its symbol count. The inclusion in the input of a set of demodulators is optional; whichever the choice, one can instruct the program to seek additional demodulators to be used. A distinction is made in the clause language paradigm between forward subsumption and back subsumption. In forward subsumption, a newly deduced clause may be subsumed by a clause in the database of retained clauses; the
1032
Collected Works of Larry Wos
subsumed clause is not added to the database. In back subsumption, a newly deduced clause may subsume a retained clause, causing that clause to be purged from the current database. The clause language paradigm focuses on two primary activities, processing newly deduced clauses and controlling the deduction of new clauses by selecting the clauses to which to apply the chosen inference rule(s). Each clause that is deduced is first rewritten as much as possible with demodulation. The demod ulated form then is weighed to see whether its weight exceeds the maximum allowed and tested for forward and back subsumption. In the special case that the clause is a unit clause (consisting of a single literal) and accepted for re tention in the database, the clause is considered for unit conflict—considered with each existing unit clause that is alike in predicate but opposite in sign to see whether a contradiction has been obtained. If a deduced clause in its fully demodulated form is not subsumed, and if its weight does not exceed the maximum weight allowed, then the clause is added to the database of retained clauses. During an attempt to complete a given assignment, three lists of clauses are maintained: the 'set of support' list, the 'usable' list, and the 'demodulator' list. The set of support list consists of clauses in the set of support that have not yet been chosen as the focus of attention. The usable list consists of clauses that either were input but not in the set of support, or are in the set of support but have already been chosen as the focus of attention. The demodulator list consists of positive equality units that are designated as demodulators. Initially, the set of support list contains just those input clauses chosen to be in the set of support. The main loop for deducing clauses consists of the following steps. 1. The program chooses from the set of support list the clause with the smallest weight and immediately moves it to the usable list. 2. Each of the inference rules that is in use is then applied to every set R of clauses, where R consists of the chosen clause together with some subset of clauses from the usable list. When a clause is deduced and retained, it is placed on the set of support list—available to be chosen later as the focus of attention. 3. When all possible sets R have been considered, a new clause is chosen from the set of support list to be the focus of attention. The program continues to choose clauses from the set of support list, stop ping when the assigned maximum CPU time is exceeded, the maximum allowed memory is exceeded, the maximum number of clauses permitted to initiate rea soning is exceeded, the set of support list becomes empty, or a proof by contra diction is found.A proof by contradiction is found either when two unit clauses have been deduced that are opposite in sign but that unify (unit conflict), or when the empty clause (consisting of no literals) has been deduced.
Logical Basis for the Automation of Reasoning
1033
Reliance on the clause language paradigm does not preclude access to other features—for example, the option of searching for more than one proof in a single run; the choice of various options governing the use of subsumption; and the use of an ANSWER literal to accumulate answers [Green, 1969], capture constructed objects, and otherwise label proofs. Such features are offered in the automated reasoning program OTTER [McCune, 1990], which will be discussed later in this chapter and which relies on the clause language paradigm featured here.
3
A fragment of the history of automated reasoning from 1960 to 1990
A history of the field of automated reasoning would show how far the field has advanced since its beginning, which we mark as approximately 1960.Such a his tory also would show the importance of experimentation to this advancement— specifically, how the field has gradually evolved as a direct consequence of at tempts to solve problems with automated reasoning programs. Rather than pre senting a complete history, which would require an entire volume, we focus on a few selected occurrences. The selected occurrences concern individual ques tions, problems, and theorems, and the successes and failures resulting from their consideration by some automated reasoning program. Indeed, occurrences of the type we present provided the impetus for the development of the pro cedures that are the foundation of the powerful reasoning programs that exist today. The first problem we identify with the field, the Davis-Putnam example [Davis 1960], is not very impressive by today's standards. The Davis-Putnam example asks for a proof of the unsatisfiability of the following set of clauses. (For this and succeeding examples, the notation for clauses relies on '-' for the logical not and '|' for the logical or.) P(x,y). - P ( y , f ( x , y ) ) I - P ( f ( x , y ) , f ( x , y ) ) | Q(x.y). - P ( y , f ( x , y ) ) I - P ( f ( x , y ) , f ( x , y ) ) I -Q(x,f(x,y)) I -q(f(x,y),f(x,y)). When one considers that the field began with a study of this problem and that the original approach was simply to accrue, without direction or restriction, ever-increasing sets of variable-free clauses to be tested for truth-functional unsatisfiability, one might naturally wonder why any of the early researchers believed success with interesting questions was even remotely possible. Indeed, could anything substantial grow from success with this small example coupled with an apparently naive approach? The items we take from history, and the examples we provide throughout this chapter, will in fact show that the field has grown impressively.
1034
Collected Works of Larry Wos
Since the Davis-Putnam problem had been considered a challenge for the reasoning programs in the early 1960s, its immediate solution with the use of binary resolution [Robinson, 1965b] provided the impetus for the study of the orems taken from various areas of mathematics. As for the key to the develop ment of the clause language paradigm featured in this chapter—as the following occurrences graphically show—we need only look to experimentation, experi mentation frequently resulting in (temporary) failure. Such failures provided the force for the formulation and introduction of strategy (of various types), of demodulation (to rewrite conclusions by simplifying and canonicalizing them) [Wos et ol., 1967], and of other important procedures. The first experiment to be discussed concerns proving that groups of ex ponent 2—those in which the square of every element i is the identity e—are commutative. Even with binary resolution as the inference rule, the attempt to prove the theorem failed; after 2,000 clauses were retained, memory was ex hausted (on an IBM 704 computer). An analysis of the experiment revealed that the lack of success did not rest with properties of binary resolution itself but, rather, with its unrestricted application. Indeed, the program had exhausted the allotted memory by retaining conclusions that, rather than having relevance to the specific theorem under study, were pertinent to groups in general. The anal ysis of the failure led to the formulation of the set of support strategy [Wos et al., 1965]. The set of support strategy is a restriction strategy, restricting the application of inference rules to various subsets of clauses.Since the importance of strategy in general and of the set of support strategy in particular has been repeatedly proven [Wos et al., 1991a], this simple classroom exercise, despite its lack of depth, enjoys a significant place in the history of automated reasoning. The first attempt to prove that subgroups of index 2 are normal failed.An analysis of the failed experiment showed that the proof naturally separates into two cases—one for elements in the subgroup, and another for elements not in the subgroup—and that the two cases were being 'mixed' rather than being considered separately. Such mixing of cases is frequently caused by applying an inference rule to a subset of clauses, two of which are nonunit clauses— consisting of more than one literal [Wos et al., 1964]. To succeed with this problem, researchers formulated and used a primitive but natural form of case analysis.By introducing new unit clauses—for example, by splitting over some variable-free tautology—the likelihood of mixing cases is significantly reduced. Obtaining a computer proof of the index 2 theorem marked a clear advance for the field, for the theorem offers some difficulty for a person to prove, and it is somewhat significant from the viewpoint of mathematics. The index 2 problem has added appeal, for the attack that succeeded is representative of the way case analysis should be treated, rather than, say, by automatically splitting every variable-free clause into its individual literals. The third and final experiment to be discussed in this section concerns an attempt to prove a version of the theorem asserting that the square root of a prime number is irrational—another experiment that failed initially.A study
Logical Basis for the Automation of Reasoning
1035
of the 2,000-clause output from the failed experiment revealed the presence of a small number of clauses that exhibited an annoying triviality. Specifically, although the deduction that 0 + a = a for some constant a can be interest ing, far less inspiring is the deduction, in addition, of trivial variations such as 0 + 0 + o = o and 0 4- o + 0 = o. Although the presence of such unwanted clauses among 2,000 is itself not serious, an analysis showed that the removal of those unwanted clauses and their various descendants would reduce the total number of clauses from 2,000 to 61. The formulation of demodulation [Wos et al., 1967] followed shortly as a direct result of the analysis. With this proce dure, by using the appropriate demodulators (rewrite rules), various unwanted clauses exhibiting certain triviality are immediately rewritten to more inter esting clauses.Frequently, the more interesting clauses are already present, with the result that the rewritten clauses are subsumed [Robinson, 1965b] rather than being added to the database of retained clauses. The strategies and procedures inspired by the cited examples—as well as the other components of the clause language paradigm—have proven time and time again to be important advances in the field of automated reasoning. The develop ment of most of these features can be traced, historically, to experimentation— more often than not, to experiments that initially failed.
4
Answering open questions
By including the following material—various questions that have been answered with the assistance of an automated reasoning program relying on the clause language paradigm—we address four issues.First, examination of the material shows that the clause language paradigm with all of its complexity and corre sponding intricacy of implementation offers impressive power. Second, a study of the successes establishes that automated reasoning has indeed contributed to various fields of mathematics and logic. Third, a comparison of problems solved with today's reasoning programs with those solved in the early 1960s graphi cally demonstrates that the field has advanced markedly. Fourth, the evidence we present strongly suggests logic to be a powerful, and perhaps superior, basis for the automation of reasoning. The questions to be reviewed are taken from the theory of finite semigroups, equivalential calculus, ternary Boolean algebra, combinatory logic, and senten tial calculus. The researchers who posed the questions include I. Kaplansky, J. Kalman, Ft. McFadden, A. Grau, R. Smullyan, and D. Scott. All of the posed questions were answered by relying heavily on programs based on the clause language paradigm. As one will see, both the nature of the questions and the fields from which they are taken vary widely. Because the successes with the questions in combinatory logic are the most uniform, and the successes with the questions in sentential calculus are the most recent, we focus on these questions last.
1036
Collected Works of Larry Wos
1. The Kaplansky question concerns the possible existence of a finite semi group admitting a nontrivial antiautomorphism but admitting no nontrivial involutions.By definition, a nontrivial antiautomorphism for the semi group if is a one-to-one mapping / from H onto H such that f(xy) = f{y)f{x) and such that / is not the identity; a nontrivial involution is a nontrivial antiautomorphism whose square is the identity. The assembly language program AURA [Smith, 1988] was used to answer this question, resulting in the discovery of such a semigroup of order 83 [Winker et al., 1981]. Later experiments with AURA showed that the smallest semigroup with the desired properties has order 7 and that four such semigroups exist. 2. The Kalman questions [Peterson, 1977; Kalman, 1978] concern the possible existence of additional shortest single axioms for equivalential calculus. These questions were answered with AURA's assistance by showing that each of the four formulas XJL, XKE, XAK, and BXO is too weak [Wos et al., 1984]; the formula XCB also is too weak (unpublished result); but the formulas XHK and XHN are each strong enough to serve as a complete axiomatization [Winker, 1980; Wos et al., 1991b]. Kalman also posed a question concerning a shorter proof for the formula XGK. This question was answered with AURA by finding a 23-step proof [Wos et. al, 1984]. More recently, Marien [1989] discovered—using Stickel's [1988] program based on logic programming—a 10-step proof, which, of course, is a more satisfying answer to the question. In Section 4.1, we give the clauses needed to study many of the corresponding aspects of this area of logic. 3. The McFadden questions concern the sizes of various finite semigroups, when given their respective generators and rules for determining the value of various products.These questions were answered with the use of OTTER [Lusk and McFadden, 1987]; some of the questions required more than 100 megabytes of memory. The largest semigroup of interest has order 102,303. 4. Grau's question concerns the possible independence of the first three of the five axioms for a ternary Boolean algebra.This question was answered with AURA's assistance by finding appropriate models [Winker, 1982]. 5. Smullyan [1985; 1987] posed a number of questions, all concerning aspects of combinatory logic [Barendregt, 1981]. The questions concern various sets of combinators and include questions about combinations and various fixed point properties, both to be defined and discussed in Section 4.2.In that section, we shall focus on these questions in some depth and on the corresponding success with answering them, in part by relying heavily on a new strategy known as the kernel strategy [Wos and McCune, 1988; McCune and Wos, 1989].
Logical Basis for the Automation of Reasoning
1037
6. The Scott question (posed implicitly) concerns finding a possibly shorter proof for the completeness of Lukasiewicz's axiom system for sentential calculus [Scott, 1990]. Postponing a more detailed treatment to Section 4.3, we note that the Lukasiewicz proof consists of 46 steps, and a proof obtained with OTTER consists of 29 steps [Wos, 1990]; the proof was obtained in slightly less than 2 CPU hours on a Solbourne (with 256 megabytes of memory) after retaining approximately 103,000 clauses.
4.1
Equivalential calculus
Since one can find many theorems to study in the various calculi—for example, in equivalential calculus, in sentential calculus, and in implicational calculus— we include as an illustration clauses that give much of what is needed to study equivalential calculus.The study of equivalential calculus (and of various other calculi) is often based on use of the inference rule condensed detachment, which can be captured by using hyperresolution and the following nucleus as an input clause. - P ( e ( x , y ) ) I -P(x) I P(y). Within this area of logic, there exist thirteen formulas each of which is strong enough to serve by itself as a complete axiomatization. To show that some new formula F is itself a single axiom, one need only prove that some known single axiom is deducible from F.For a specific example, we include clauses sufficient to prove that the formula XGK is strong enough to deduce one of the other twelve known shortest single axioms. '/, condensed detachment - P ( e ( x , y ) ) I -P(x) I P(y). 7. the formula XGK P(e(x,e(e(y,e(z,x)),e(z,y)))). '/, negations of the twelve other s h o r t e s t single axioms -P(e(e(a,b),e(e(c,b),e(a,c)))). 7. Axiom P1_YQL -P(e(e(a,b) ,e(e(a,c) ,e(c,b)))). 7. Axiom P2_YqF -P(e(e(a,b),e(e(c,a),e(b,c)))). 7. Axiom P3_YQJ -P(e(e(e(a,b),c),e(b)e(c1a)))). 7. Axiom P4_UM -P(e(a,e(e(b,e(a,c)),e(c,b)))). 7. Axiom P5.XGF -P(e(e(a,e(b,c)),e(c.e(a,b)))). 7. Axiom P7.WN -P(e(e(a,b),e(c.e(e(b,c),a)))). 7. Axiom P8.YRM -P(e(e(a,b),e(c,e(e(c,b),a)))). 7. Axiom P9.YR0 -P(e(e(e(a,e(b,c)),c),e(b,a))). 7. Axiom PY0 -P(e(e(e(a,e(b,c)),b),e(c,a))). '/. Axiom PYM -P(e(a,e(e(b,c),e(e(a,c),b)))). 7. Axiom XHK -P(e(a,e(e(b,c),e(e(c,a),b)))). 7. Axiom XHN
Collected Works of Larry Wos
1038
4.2
Combinatory logic
Barendregt [1981] defines combinatory logic as an equational system satisfying the combinators S and K, where the respective actions of the constants S and K are given by the following two clauses. EQUAL(a(a(a(S,x),y),z),a(a(x,z),a(y,z))). EQUAL(a(a(K.x),y),x). The function o in this representation can be interpreted as 'applying' one com binator to another—the result is a combinator.For example, the equation for K says that for all combinators x and y, applying combinator K to x results in a combinator that, when applied to y, results in the original combinator x. Observing the convention in combinatory logic that all expressions are left associated unless otherwise indicated, we can write the defining equations for S and K in the following abbreviated form. Sxyz = xz(yz) Kxy = x The significance of S and K is that any proper combinator can be expressed in terms of S and K alone [Barendregt, 1981]—-a combinator is proper if and only if (1) the left side of its equation is left associated and consists of the combinator followed by some nonempty list of distinct variables and (2) the right side consists of some or all of the variables that occur on the left side. Since every computable function can be expressed as a proper combinator, it follows that every computable function can be expressed in terms of S and K. Rather than focusing on combinatory logic as a whole, here we study various fragments of the logic. A fragment is determined by considering sets of (proper) combinators other than S and K\ the chosen set is called the basis of the frag ment under consideration. The following types of question are frequently of interest. 1. Given a basis B and a combinator P, does there exist an expression, solely in terms of the combinators in B, that satisfies the equation for P?Such an expression is called a combination from B. By definition, the length of a combination is the number of occurrences of the basis elements. In the study of combinations, one is also often interested in knowing the length of the shortest desired combination and the number of combinations of that length. 2. Does a given basis B satisfy either the weak fixed point property or the strong fixed point property? The weak fixed point property holds for the fragment with basis B if and only if, for all combinators x, there exists a combination y from B such that y = xy. The strong fixed point property holds for the fragment with basis B if and only if there exists a combination G from B such that for all combinators x the equation 0 x = x(Gx) holds. Such a © is called a fixed point combinator.
Logical Basis for the Automation
4.2.1
of Reasoning
1039
Combinations
For a simple example of the questions to be discussed—one whose answer was already known—let us focus on the combinator L withLary = x(yy) and the fragment whose basis B consists of the combinators B and W with Bxyz = x(yz) and Wxy = xyy. Given this basis B , the combination BWB satisfies the equation for L. For a proof—keeping in mind that combinators are assumed to be left associated unless otherwise indicated—one simply notes that BWBxy = W(Bx)y = Bxyy = x(yy). In addition, it is not difficult to show that the smallest combination of B and W that satisfies the equation for L has length 3, and there exists exactly one combination of that length. Motivated by correspondence with R. Smullyan [1987], we considered certain questions that were open concerning the existence, minimal length, and number (of that length) of various combinations. The following theorems, which answer those questions, are taken from our study. Rather than a complete proof, for each theorem we simply give one or more of the corresponding combinations and certain additional information. The details, including the precise clauses and parameter settings, appear in [Wos et al., 1991b]. We do, however, include sample clauses, a summary of the approach we used, and some of the pertinent O T T E R statistics (to permit one to gain some insight into the difficulty of the theorem).In particular, the respective CPU times for obtaining proofs indicate the relative difficulty of the theorems, at least for O T T E R when using the given approach. Of course, using a different program or even changing the approach used by a given program often changes the relative difficulty of theorems. We note that there is a distinction between finding combinations that sat isfy a property and verifying that some given combination satisfies the property.Using as an example the B, W, and L problem discussed earlier—purely for illustration and for a template of how to attack the various theorems pre sented shortly—with one of the notations acceptable to OTTER, one could have the input consist of the following. 7. r e f l e x i v i t y of EQUAL EQUAL(x,x). 7, b a s i s of i n t e r e s t EQUAL(a(a(a(B,x),y),z),a(x,a(y.z))). EQUAL(a(a(W,x),y),a(a(x,y),y)) . '/, d e n i a l of t h e theorem t h a t t h e r e '/, e x i s t s a combination f o r L -EQUAL(a(a(x,f(x)),g(x)),a(f(x),a(g(x),g(x))))
I $ANSWER(x).
Upon completion of a proof, O T T E R would have as the argument of the AN SWER literal in the final step a(a(B,W) ,B).In contrast, were one simply at tempting to prove that BWB is a combination that behaves as L does, one
Collected Works of Larry Wos
1040
would replace the given inequality by the following. '/, denial of the theorem t h a t BWB i s a combination for L -EQUAL(a(a(a(a(B,W),B),1),g),a(f,a(g,g))). In general, finding appropriate combinations is a much more difficult and in teresting challenge. The following theorems were posed and solved in the more challenging context. Here is a list of the combinators relevant to this section. (B) Bxyz = x{yz) (C) Cxyz = xzy (F) Fxyz = zyx (G) Gxyzw = xw(yz) (L) Lxy = x(yy) (P) Pxyyz = xy{xyz)
(Q) Qxyz = y(xz) (Qi) Q\xyz = x(zy) (T) Txy = yx (V) Vxyz = zxy (W) Wxy = xyy
Our approach to finding appropriate combinations relies heavily on paramodulation and the set of support strategy. In addition, for this type of problem, we frequently restrict paramodulation to be from the left side of positive equalities only and into the left side of the inequalities. In each case, we use the ANSWER literal to extract (from a proof) the desired combination.Our experiments were run on a SPARCstation 1+. Theorem CL-1. Prom the basis consisting of B and T, a combination can be found that satisfies the equation for Q. A proof of the theorem rests with an examination of either of the following two combinators, both found in less than 6 CPU seconds. B(TB)(BBT)
B(B(TB)B)T
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 6. Theorem CL-2. Prom the basis consisting of B and T, a combination can be found that satisfies the equation for Qi. A proof of the theorem rests with an examination of either of the following two combinators, both found in less than 14 CPU seconds. B(TT)(BBB)
B(B(TT)B)B
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 6. Theorem CL-3. Prom the basis consisting of B and T, a combination can be found that satisfies the equation for C. A proof of the theorem rests with an examination of either of the following two combinations, both found in less than 19 CPU seconds. B(T{BBT))(BBT)
B{B{T{BBT))B)T
Logical Basis for the Automation of Reasoning
1041
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 8. Theorem CL-4. Prom the basis consisting of B and T, a combination can be found that satisfies the equation for F. A proof of the theorem rests with an examination of any of the following five combinations, all found in less than 50 CPU seconds. B(TT)(BB{BBT)) B{B(TT)B){BBT) B{TT)(B{BBB)T)
B(B(TT)(BBB))T B(B(B(TT)B)B)T
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 8. Theorem CL-5. Prom the basis consisting of B and T, a combination can be found that satisfies the equation for V. A proof of the theorem rests with an examination of any of the following ten combinations, all found in less than 248 CPU seconds. B{T(BBT)){BB(BBT)) B{B(T{BBT))B)(BBT) B{T{BBT)){B(BBB)T) B{B{T{BBT)){BBB))T B{B{B{T(BBT))B)B)T
B{T(BBT))(BB(BTT)) B(B{T(BBT))B)(BTT) B(T(BBT))(B(BBT)T) B(B(T(BBT)){BBT))T B(B(B(T(BBT))B)T)T
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 10. Theorem CL-6. Prom the basis consisting of B and T, a combination can be found that satisfies the equation for G. A proof of the theorem rests with an examination of any of the following five combinations, all found in less than 156 CPU seconds. B(B(BB{T(BBT)))B)T B{BB(T{BBT))){BBT) BB(B{T(BBT))(BBT))
B(BB(B(T(BBT))B))T BB(B{B(T{BBT))B)T)
In addition, no shorter combination exists with the desired properties, nor does any other exist of length 10. Theorem CL-7. Prom the basis consisting of B, Q, and W, a combination can be found that satisfies the equation for P. A proof of the theorem rests with an examination of either of the following two combinations, both found in less than 11 CPU seconds. QQ(W(Q(QQ)))
B(W(Q(QQ)))Q
In contrast to our approach to proving Theorems CL-1 through CL-6, for this last theorem we replaced the strategical restriction of paramodulating from the left sides of equalities into the left sides of inequalities with the strategical re striction of paramodulating from the right sides into the right sides. The shortest
Collected Worlcs of Larry Wos
1042
such combination that we have found in which all three combinators occur— measured in occurrences of B, Q, and W—has length 6. 4.2.2
Fixed Point Properties
Let us now turn to open questions focusing on the two given fixed point prop erties for various fragments.The typical question asks about the presence or absence, for a given basis B, of either the weak or the strong fixed point prop erty. Let us consider, for an example focusing on the strong fixed point property, the easily answered question for the fragment with basis B consisting of S and L. That this fragment satisfies the strong fixed point property can be seen by con sidering the combinator SLL and noting that SLLx = Lx(Lx) = x(Lx(Lx)) = x(SLLx). Since a combinator 8 that establishes the presence of the strong fixed point property for any fragment is called a fixed point combinator, we have also proved that SLL is a fixed point combinator. When the strong fixed point prop erty holds for a fragment, the weak fixed point property must also hold, for if 0 is a fixed-point combinator, then Ox satisfies the weak fixed point property for any x. We thus see that the weak fixed point property holds for the fragment with basis consisting of S and L. The weak fixed point property does not imply the strong. For example, we consider the fragment whose basis consists of L alone. By noting that Lx(Lx) = x{Lx{Lx)), we see that the weak fixed point property holds. Specifically, Lx(Lx) satisfies the weak fixed point property for any x. We also note that L is a regular combinator—a combinator is regular if and only if (1) the combinator is proper and (2) the first variable on the right side of its equation appears precisely once and is identical to the first variable occurring on the left side of its equation.Since one cannot construct, from a single regular combinator, a fixed point combinator (Statman 1986; McCune and Wos 1989)—a result that answered an open question posed by Smullyan (1985)—the fragment under consideration cannot satisfy the strong fixed point property. For a fragment that fails to satisfy even the weak fixed point property, we offer—although the proof is not obvious—the fragment whose basis is S alone; see Theorem 1 of (McCune and Wos 1989). A far richer and more interesting fragment than that with a basis consist ing of S and L is that with a basis consisting of B and W. In particular, rather than the single fixed point combinator SLL constructive in the former fragment—which we believe to be the only such combinator in that fragment— in the latter, by having OTTER apply the kernel strategy, one can construct an infinite number of fixed point combinators (Wos and McCune 1988; McCune and Wos 1989). The first fixed point combinator constructible from B and W alone, B{WW){BW{BBB)), was found by Statman (1986) in response to a question posed by Smullyan (1985). When this question was attacked with the assistance of an automated reasoning program—rather than merely duplicating Statman's success—OTTER found four additional combinators of the desired
Logical Basis for the Automation of Reasoning
1043
type (McCune and Wos 1987). This result, obtained a few months before the formulation of the kernel strategy, illustrates the usefulness of automated rea soning programs for research. For a glimpse of the power offered by a program such as OTTER, es pecially when applying the kernel strategy, we note that—in contrast to the 20 CPU hours required for the original success in finding the five fixed point combinators—all five are obtained with the new approach in less than 3 CPU seconds.Of the infinite number of such combinators constructible from B and W, the smallest has length 8, and the number of that length is five. 0i 62 e3 94 65
4.3
= B(B(B{WW)W)B)B = B(B{WW)W)(BBB) = B{B{WW)(BW B))B = B(WW)(BW(BBB)) = B(WW)(B(BWB)B)
Sentential calculus
To close this section on open questions answered by relying on a program based on the clause language paradigm, we turn to a question implicit in our correspon dence with D. Scott (1990).In that correspondence, the topic of sentential cal culus became prominent. A complete axiomatization (provided by Lukasiewicz) for this area of logic is given by the following three formulas expressed in clause notation. (LD (L2) (L3)
P(i(i(x,y),i(i(y,z),i(x,z)))). P(i(i(n(x),x),x)). P(i(x,i(n(x),y))).
The first of the three can be thought of as transitivity, (x —» y) —> ((y — ► z) —* (x -+ z)). The second can be read as (a;' —> x) —» x, with ' denoting negation (complement), and the third as x —* (x' —* y). For sentential calculus, the rule of inference is condensed detachment (see Section 4.1).An axiom set is complete for sentential calculus if it is strong enough to permit the deduction of any formula that is true under all assignments of true and false, with the usual notion of implication and negation. The theorem in question asserts that the Lukasiewicz system (consisting of the clauses LI, L2, and L3) is complete for sentential calculus.The strategy for proving completeness is to deduce another system, such as FL, that is known to be complete. (FL1) (FL2) (FL3)
P(i(x,i(y,x))). P(i(i(x,i(y.z)),i(i(x,y),i(x,z)))). P(i(i(n(x),n(y)),i(y,x))).
Scott has indicated that the Lukasiewicz proof deducing the three axioms of FL is 46 steps in length; using OTTER on the Macintosh, Scott obtained es-
Collected Works of Larry Wos
1044
sentially the same proof.In our correspondence, Scott expressed interest in a shorter proof; we answered this open question by producing a 29-step proof; the proof was obtained in slightly less than 2 CPU hours on a Solbourne (with 256 megabytes of memory) after retaining approximately 103,000 clauses. Before turning to the relation of the clause language paradigm to logic pro gramming and to person-oriented reasoning, we note that the rate of success in answering open questions appears to be increasing sharply. We conjecture that three forces have produced this change: Far more researchers in automated reasoning are actively experimenting; substantial advances have occurred in both theory and implementation; and the clause language paradigm has evolved markedly.
5
Relation t o logic programming and t o person-oriented reasoning
Because logic programming (Prolog in particular) has attracted the attention of various researchers as a possible basis for automated reasoning programs, notably (Stickel 1988), we present in this section a summary of various sim ilarities and differences between the logic programming and clause language paradigms. In addition, because the manner in which individuals reason— mathematicians and logicians in particular—also is of interest, we include a brief discussion of person-oriented reasoning. Our primary motivation is to clarify some common misconceptions and to permit a better under standing and appreciation of the power of the clause language paradigm.
5.1
Logic programming
It may seem odd to compare logic programming and the clause language paradigm, since in some sense they address fundamentally different issues—namely, pro gramming versus general-purpose deduction. In the strictest sense—with various exceptions for applications to deductive databases, expert systems, and limited aspects of theorem proving—logic programming is concerned with programming, designed to easily implement specific algorithms, especially those in which logi cal reasoning plays an important role. In contrast, the clause language paradigm consists of a collection of procedures that, taken together, form a reasoning sys tem designed to attack problems for which one does not know of an effective algorithm to apply. Nevertheless, we find such a comparison of interest and of value, especially for those who are not very familiar with logic programming or with the clause language paradigm discussed in this chapter. The comparison may remove certain points of confusion regarding the possible advantages and disadvantages of each. The most obvious similarity between logic programming and the clause lan guage paradigm is that both rely on the use of clauses to present an assignment
Logical Basis for the Automation of Reasoning
1045
to be completed. The second important similarity rests with the fact that the type of reasoning employed in logic programming is one of the types of reason ing that can be employed by an automated reasoning program relying on the clause language paradigm. At the most general level, that reasoning corresponds to ordered input resolution, in which inference rules are restricted to apply to sets of clauses containing at least one input clause, and in which the search is ordered in such a way that one proof is constructed at a time. We note that the reasoning also can be viewed as an application of linked hyperresolution (Veroff and Wos 1990). At a lower level, every reasoning step of each path that solves a subgoal is a successful application of binary resolution. In addition to sharing certain aspects of representation and inference rule, logic programming and the clause language paradigm share certain aspects of the use of strategy. Specifically, both rely heavily on the use of the set of sup port strategy, although logic programming uses a very restricted version of this strategy. Finally, both paradigms rely on proof by contradiction, and both can use proof by contradiction to construct or discover an object satisfying certain stated properties. While the clause language paradigm can be used to construct or design an object through the explicit use of ANSWER literals, such construc tions are implicit in the nature of the logic programming paradigm. At least four crucial differences between logic programming and the clause language paradigm immediately come to mind, and a number of lesser ones can be given. First, although both paradigms rely on the clause language, classical logic programming languages are restricted to the use of Horn clauses, clauses containing at most one positive literal. (In fact, program clauses are required to be definite, containing exactly one positive literal; only the goal clause is permit ted to be all negative.)In the clause language paradigm, however, no restriction is placed on the clauses to be used in presenting a question or a problem. A no table consequence of the restriction to definite Horn clauses is that relationships such as exclusive or cannot be expressed naturally in a logic programming lan guage. Some logic programming languages mitigate this restriction, in part, by including a negation operator and interpreting negation as negation as failure— an appropriate interpretation for several important applications. Second, in logic programming—and in theorem-proving programs based on a similar paradigm, for example (Stickel 1988)—no new clauses are retained during an attack on a question or problem.This lack of retention clearly is one important source of the impressive speed offered by the logic programming paradigm. The clause language paradigm, on the other hand, relies heavily on the retention of new information. Although such retention (when all other con siderations are ignored) can be expensive, both in execution time and memory usage, we conjecture that—especially for deep questions and hard problems— it is absolutely necessary for effectiveness. For one who doubts this necessity, we recommend an attempt to duplicate, by means of logic programming, the successes discussed in Section 4. In addition, further insight and appreciation for the clause language paradigm can be gained by accepting the challenges we
1046
Collected Works of Larry Wos
present in Section 6. The third important difference focuses on the use of strategy.Although logic programming (as we have observed) does use strategy, its use is extremely limited when compared to the richer use of strategy in the clause language paradigm. Though the limitation of logic programming to a single search strat egy contributes to performance, confining the use of strategy to a depth-first and left-to-right search and to a very limited form of the set of support strategy severely limits the effectiveness of the paradigm for solving difficult problems (and can prove disastrous when unbounded searches are permitted). Indeed, for logic programming to provide the needed power for proving a wide class of theorems from mathematics, we conjecture that a far more sophisticated use of strategy is required—for example, using a broader form of the set of support strategy or using the weighting strategy to permit a user to give hints. The fourth significant difference between logic programming and the clause language paradigm is their respective treatment of equality in its fullest meaning.FYom what we know, no satisfactory and fully general treatment currently exists in logic programming. Although we are obviously partial to the treatment given to equality by the use of the inference rule paramodulation, we openly recognize that this inference rule does not—by itself—solve all of the problems that accompany a natural treatment of equality.As a result, we are still ac tively searching for ever more powerful strategies to control the application of paramodulation. In contrast to using paramodulation, some researchers in logic program ming have considered building equality into the unification algorithm (DeGroot and Lindstrom 1986), more or less in the style of E-resolution (Morris 1969). Such an approach, which goes even further than using associative-commutative unification (Stickel 1981)—a procedure that has, in certain cases, yielded im pressive results, for example, (Kapur and Zhang 1989)—has actually been tried in automated theorem proving, and the early practical results have been disappointing.A number of researchers in logic programming would in fact have predicted such an outcome, believing that building equality into unification has little practical value. Among the other noteworthy differences is the absence of the 'occurs check' for unification in most logic programming languages, in contrast to its required presence in the clause language paradigm.Clearly, the absence of the occurs check contributes in an important way to the excellent speed that is offered, but offering the option of using the occurs check—for example, in applications for which soundness is a concern—seems to merit serious consideration. Other differences worth mentioning focus on the use, in the clause language paradigm, of demodulation to produce canonical forms for information and the use of subsumption to remove information captured by more powerful statements.Of course, neither of these procedures is relevant when no new information is re tained. In summary, we conjecture that it will take more than minor extensions to
Logical Basis for the Automation of Reasoning
1047
the logic programming paradigm to produce the power needed for effective au tomated reasoning. After all, if one considers how impressively mathematicians and logicians apply logical reasoning to questions and problems, one should ex pect that no shortcut exists to producing a computer program that can prove even moderately interesting theorems. From the evidence cited earlier, however, such programs do exist—programs relying on the clause language paradigm.
5.2
Person-oriented reasoning
The clause language paradigm—used successfully in reasoning programs to prove interesting theorems—was not formulated to imitate a mathematician or logician; indeed, the paradigm exhibits rather significant differences from the type of reasoning applied by people. For example, the conclusions drawn by a person are often far less general than those drawn by a program based on the clause language paradigm. An excellent example of this contrast in general ity is provided by a person's use of instantiation (the uniform substitution of terms for variables) and the computer's use of paramodulation (an inference rule that generalizes the usual notion of equality-oriented reasoning).Clearly, instantiation is used in mathematics and logic, and used wisely. For example, a mathematician might use instantiation to deduce that (yz){yz) = e (the identity in a group) from the hypothesis that (xx) = e, and then use the new conclusion as a key step in proving that the type of group under study is commutative. A typical automated reasoning program would not draw such a conclusion, since instantiation is ordinarily not an inference rule offered by such a program. No known strategy exists for wisely choosing appropriate instances, even though mathematicians and logicians do have that ability. On the other hand, a person finds the use of paramodulation—certainly, by hand—rather difficult. Perhaps the explanation rests in part with the fact that this inference rule combines the selecting of instances of the appropriate type—those found by unification of an argument and a term—with the use of the usual notion of equality substitution. With regard to the use of strategy, the analysis is rather more compli cated.Indeed, although a person's reasoning is seldom restricted or directed by the explicit use of strategy, one can find (in such reasoning) examples analo gous to the use of strategy by a computer program. For example, the practice in mathematics of restricting the reasoning by keying on the assumed falseness of a theorem when seeking a proof by contradiction is clearly reminiscent of the use of the set of support strategy. As a different example, the preference by mathematicians of one class of expression over another class reminds one of assigning weights (priorities) when using the weighting strategy in the clause language paradigm; assigning weights is rather like giving hints to a challenging exercise. Person-oriented reasoning also differs from computer-oriented reasoning (of the type discussed in this chapter) with regard to the use of subsumption and the use of demodulation. With regard to subsumption, person-oriented reasoning
1048
Collected Works of Larry Wos
often exhibits the use of a pair of statements, one of which is a proper instance of the other; in contrast, the clause language paradigm virtually requires the use of subsumption to purge proper instances of clauses, especially when the assignment is anything but the most trivial. The use of instantiation, so com mon in person-oriented reasoning, would obviously necessitate an appropriate restriction of subsumption to protect the conclusions obtained with that type of reasoning. As for demodulation, far more freedom can be and is exercised in person-oriented reasoning—in mathematics and in logic, for example—than in automated reasoning. In the former, one uses canonicalization when it seems convenient and appropriate.In the latter, one cannot in most cases exercise such freedom: Canonicalization is virtually required for effective automated reason ing, but the canonicalization strategy cannot be applied selectively. Even notationally, person-oriented reasoning differs sharply from the ap proach taken in the clause language paradigm.In the former, one has virtually no restrictions; in the latter, one is restricted by the rigidity of the clause lan guage. However, rather than being a disadvantage, this rigidity appears to us to contribute to the possibility of formulating effective inference rules and power ful strategies to control their actions. From our experimentation, we conjecture that the use of natural deduction as the basis for automated reasoning offers less potential for answering questions and solving problems. Indeed, consistent with our observations concerning the differences between the clause language paradigm and logic programming or person-oriented reasoning—observations based on more than twenty-five years of experimentation with various auto mated reasoning programs—we find that programs relying on the clause lan guage paradigm nicely complement a person's approach to answering questions and solving problems.
6
Challenge problems for testing, comparing, and evaluating
We present in this chapter various challenge problems, including questions that are still open but that are amenable to attack with an automated reasoning program.Five factors motivate our including these problems. First, no more profitable path than experimentation exists for causing advances in automated reasoning to occur .Second, to accurately measure the value of programs, pro cedures, techniques, inference rules, strategies, and the like, the nature of the field requires testing and comparing on real questions and problems; indeed, no substitute for experimentation exists. Third, for a claim of progress to be valid, it must be substantiated with evidence focusing on reducing the CPU time required to complete an assignment or focusing on expanding the number of successes. Fourth, new ideas in theory, implementation, and application often spring from the intrigue of accepting and meeting a challenge; among the more
Logical Basis for the Automation
of Reasoning
1049
exhilarating experiences is that of answering an open question. Fifth, researchers are vastly more interested in experimentation now, in 1991, than they were but one decade ago. To stimulate research, we offer—in addition to the theorems discussed earlier in this chapter—the following open questions and challenge problems. Robbins Algebra The following question has been open for decades, receiving attention even from Tarski and his students (Henkin et ol. 1971; Tarski 1980). 'Is every Robbins algebra a Boolean algebra?' A Robbins algebra is a nonempty set satisfying the following three axioms, expressed in clause notation, in which the function o can be interpreted as sum and the function n as negation. (Rl) (R2) (R3)
EQUAL(o(x,y),o(y,x)). EQUAL(o(o(x,y),z),o(x,o(y,z))). EqUAL(n(o(n(o(x,y)),n(o(x,n(y))))),x).
A Boolean algebra is a nonempty set 5 with two binary operations, sum and product; a unary operation, negation (or complement); and two distinguished members represented with 0 and 1, respectively. In the following clauses, the function prod is used to represent the product operation. */, c o m m u t a t i v i t y (BAD EQUAL(sum(x,y),sum(y,x)). (BA2) E Q U A L ( p r o d ( x , y ) , p r o d ( y , x ) ) . 7, d i s t r i b u t i v i t y (BA3) EQUAL(prod(x,sum(y,z)),sum(prod(x,y),prod(x,z))). (BA4) EQUAL(prod(sum(x,y),sum(x,z)),sum(x,prod(y,z))). '/, i d e n t i t y (BA5) EQUAL(sum(x,0),x). (BA6) E q U A L ( p r o d ( x , l ) , x ) . '/, complement (BA7) E q U A L ( s u m ( x , n e g a t i o n ( x ) ) , 1 ) . (BA8) E Q U A L ( p r o d ( x , n e g a t i o n ( x ) ) , 0 ) . To show that a Robbins algebra is a Boolean algebra, one need only show that the axioms for Robbins algebra imply the axioms for Boolean algebra. If one relies on an automated reasoning program with the objective of proving that Robbins does imply Boolean, then an added challenge focuses on coping with the extremely large number of clauses that will ordinarily be encountered. It is interesting to note that the axioms for Robbins algebra together with any one
1050
Collected Works of Larry Wos
of several simple axioms is sufficient to imply the axioms for Boolean algebra (Winker 1990)—in some sense Robbins algebra is at least 'near-Boolean'. To show that a Robbins algebra is not a Boolean algebra, one need only find a model that satisfies the three axioms for a Robbins algebra but violates a property for a Boolean algebra.(In terms of the given representations, o and n from Robbins algebra correspond, respectively, to sum and negation from Boolean algebra.) Since it is known that every finite Robbins algebra is Boolean, such a model will necessarily be infinite. Therefore, if one relies on the assistance of an automated reasoning program, an added challenge is presented by the need to cope with infinite sets. We note that an alternative axiomatization of Boolean algebra consists of (Rl), (R2), and Huntington's (1933) axiom (H3) (H3)
EQUAL(o(n(o(n(x),y)),n(o(n(x),n(y)))),x).
Attempts to show that a Robbins algebra is or is not a Boolean algebra could key on this alternative axiomatization. Open Questions in Combinatory Logic Combinatory logic presents a number of open questions of which the follow ing offer intrigue. Does the fragment with a basis consisting of the combinators B and S alone satisfy the strong fixed point property?The following clauses suffice. The first two of the following three clauses specify the actions of B and S, respectively; the third clause corresponds to the denial of the strong fixed point property. '/, basis of interest EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). EqUAL(a(a(a(S,x),y),z),a(a(x,z),a(y,z))). '/, denial of the theorem that there exists a combinator '/■ satisfying the strong fixed point property -EQUAL(a(y,f(y)),a(f(y),a(y,f(y)))).
If paramodulation is the inference rule, then these clauses, together with reflexivity of equality, suffice. If the inference rule of choice is one of the resolution-based rules, hyperresolution for example, then one must include, in addition, clauses for symmetry and transitivity of equality and for substitutivity into each of the arguments of the function a. For a similar question, does the fragment with a basis consisting of the combinators B and N\ satisfy the strong fixed point property? The behavior of the combinator TVi is given by the following clause. EQUAL(a(a(a(Nl,x),y),z),a(a(a(x,y),y),z)).
Logical Basis for the Automation of Reasoning
1051
To further encourage research focusing on the automation of model gener ation, we present here two additional open questions.Does there exist a finite model satisfying the eombinators B and L in which the strong fixed point prop erty fails to hold? Does there exist a finite model satisfying the eombinators Q and L in which the strong fixed point property fails to hold? That some (pos sibly infinite) model of the type under discussion in each of the two questions exists follows from results found in (McCune and Wos 1989). Because the designation open question can be misleading, we point out that the preceding questions from combinatory logic are our questions. We do not mean to imply that we know the answers, for we do not; nor, as far as we can ascertain, does anyone else. Challenge Problem from Many-Valued Sentential Calculus Although not an open question, the following theorem from many-valued sentential calculus provides an excellent challenge for an automated reasoning program.The theorem, sometimes known as the fifth conjecture of Lukasiewicz (1970), asserts that, from the first four of the following five clauses, the fifth can be deduced by using condensed detachment. (LI) (L2) (L3) (L4) (L5)
P(i(x,i(y,x))). P(i(i(x,y),i(i(y.2).i(x,z)))). P(i(i(i(x,y),y),i(i(y,x),x))). P(i(i(n(x),n(y)),i(y,x))). P(i(i(i(x,y),i(y,x)),i(y,x))).
The problem asks for an approach that enables an automated reasoning program to prove the Lukasiewicz conjecture using condensed detachment. Two points to keep in mind are (1) a proof of the conjecture has been obtained where the problem was rephrased as one for equality, and (2) a 63-step proof has been obtained using condensed detachment, a proof obtained by using OTTER in a mode that is in part proof checking and in part proof finding.The challenge is to find a proof using condensed detachment, but without using the outline of a known proof for guidance. Since the fifth conjecture is indeed challenging to the point that it may be beyond the limits of the current programs—we once generated 983,000,000 clauses with OTTER in an attempt to obtain a proof—we offer four problems that are in range and yet merit study. Again, condensed detachment is present as well as the four axioms (LI through L4) for many-valued sentential calculus. The four problems focus, respectively, on proving each of the following theorems expressed in clause notation; the comments are names that refer to specific steps in the known 63-step proof. P(i(n(n(x)),x)). P(i(i(x,y),i(i(z,x),i(z,y)))).
7. Step 24 '/. Step 25
Collected Works of Larry Wos
1052 P(i(x,n(n(x)))). P(i(i(x,y),i(n(y),n(x)))).
7. Step 29 % Step 36
With the approach on which we settled, the first and third (steps 24 and 29) are easier to prove with OTTER than are the second and fourth. If one prefers to study the fifth conjecture of Lukasiewicz in an equality form (Font et al. 1984), the following clauses are appropriate, where T can be thought of as t r u e . (ELI) (EL2) (EL3) (EL4)
EQUAL(i(T,x),x). EQUAL(i(i(x,y),i(i(y,z),i(x,z))),T). EQUAL(i(i(x,y),y),i(i(y,x)lx)). EQUAL(i(i(n(x),n(y)),i(y,x)),T).
The theorem to prove asserts that the following clause is deducible from ELI through EL4. (EL5)
7
EQUAL(i(i(i(x,y),i(y,x)),i(y,x)),T).
Current state of the art: Basic research problems to solve
In this section, we present some general and some specific problems to solve, leaving a far more extensive and thorough treatment to the book Automated Reasoning: S3 Basic Research Problems (Wos 1987). That book also offers prob lems for testing possible solutions to the 33 research problems discussed there, and axiom systems—with the corresponding clauses—for diverse areas of math ematics and logic. Each problem addresses an obstacle to the further advance ment of automated reasoning. As each of these general and specific problems is solved, the field of automated reasoning will advance sharply. Among the more significant problems to solve is that concerning a builtin treatment of set theory. Next to reasoning focusing on equality, perhaps the most common and important—at least in the context of mathematics— is that focusing on set theory.The problem to solve concerns some means—for example, through the use of inference rules or strategy—to permit an automated reasoning program to treat set theory as if it is 'understood' in the sense that paramodulation permits a program to treat equality as 'understood'.Too often, the set-theoretic aspects of a question present a serious obstacle with regard to efficient reasoning by a program. Strikingly different from the preceding problem is that concerning the auto mated generation of models and counterexamples.The field has made impressive progress in the past decade in the area of proving theorems, but, for the op posite side of the question, far too little progress has occurred. Indeed, when a researcher suspects or conjectures that a purported theorem is in fact not
Logical Basis for the Automation of Reasoning
1053
provable, and wishes an automated reasoning program to assist in proving the conjecture by finding an appropriate counterexample, too little assistance in that regard is available. In the area of implementation, two problems, if solved, would add, respec tively, to the desire to use reasoning programs and to the efficiency with which they complete assignments. The first problem focuses on designing and im plementing a sophisticated user interface to permit those unfamiliar with the intricacies of automated reasoning to use reasoning programs.Such an interface would encourage numerous mathematicians and logicians to seek the assistance of a program to answer a wide spectrum of open questions. If such an interface were to provide substantial assistance in making wise choices for representation, inference rules, and strategies, then a marked advance would have occurred, for there currently exist few rules of this type. The second problem for implementation concerns the discovery of an effi cient means to test nonunit clauses (those containing more than one literal) for forward subsumption.Specifically, given a nonunit clause, the problem is to efficiently retrieve from the database of retained clauses a clause that subsumes the given clause, if such a clause exists. The corresponding problem for unit clauses has been solved with McCune's (1990a) adaptation of discrimination trees. Such trees, however, have not yet been adapted to the application of forward subsumption of nonunit clauses; this problem is particularly difficult because it requires finding a clause that subsumes any subset of the literals of the nonunit clause. With various experiments in which nonunit clauses are generated in abundance, one can quickly see the importance of this problem. If one chooses to use subsumption, there is a risk that an increasing fraction of the CPU time will be spent in testing for the subsumption of nonunit clauses. Alternatively, if one chooses to suppress the use of subsumption, there is a risk of a sharp degradation in performance because of the presence of clauses that could be subsumed, sometimes including numerous copies of a single clause. Either choice can be disappointing. We conjecture that the most significant contributions to automated rea soning will be in the area of strategy—specifically, strategy for restricting the actions of a program.For example, the set of support strategy restricts the appli cation of an inference rule by preventing it from being applied to various subsets of clauses.That strategy, still considered one of the most powerful strategies yet formulated, has the added advantage of requiring no CPU time to exercise. Nevertheless, the effect of the set of support strategy is limited. For a specific research problem to solve, one might study the possibility of extending or gen eralizing the set of support strategy. For a second specific research problem to solve, one might study possible strategies to control the actions of paramodulation; uncontrolled, the inference rule produces far too many conclusions. The field would benefit from an analysis of existing features, for the dis parate performance of various approaches is not well understood. For example, the field would benefit from a full understanding of why an approach using
1054
Collected Works of Larry Wos
paramodulation often is dramatically more effective than an approach using hyperresolution.For a second example, one might try to provide guidelines for deciding in what order to apply procedures such as subsumption, demodulation, weighting, and unit conflict. Regardless of the choice of problem, aspect, or area—almost without exception— what is required is experimentation.A sharp increase in experimentation was in fact one of the major forces for the rapid advance of automated reasoning in the past decade. As evident from the material in the next section, the conditions for easy and substantial experimentation are far better than at any other time in the brief (if compared to other sciences) history of the field.
8
Programs, books, and a problem database
At this point in the chapter, we focus on various programs, five books, and a problem database, some combination of which may provide what is needed for one who wishes to conduct research in automated reasoning, to pursue an application of automated reasoning, or simply to explore what is possible. For example, one can pursue the application of proving properties of computer pro grams and of algorithms by obtaining a copy of the Boyer-Moore (1979, 1988) Theorem Prover, or one can instead pursue the study of various logical calculi by obtaining a copy of McCune's program OTTER (McCune 1990b). The Boyer-Moore Theorem Prover, written in LISP, can be obtained elec tronically; the details can be obtained by contacting Dr. Robert Boyer in the Computer Science Department of the University of Texas or by electronic mail ([email protected]) .This remarkable program demonstrates how automated reasoning has been used successfully to solve real problems in a variety of fields. Among the theorems proved by the Boyer-Moore Theorem Prover are various theorems in metamathematics (Shankar 1985), the invertibility of the Rivest, Shamir, and Adleman public key encryption algorithm (Boyer and Moore 1984), the soundness and completeness of a propositional calculus decision procedure, the soundness of an arithmetic simplifier (actually used in their program), the termination of Takeuchi's function, and the correctness of many elementary list and tree processing functions. The Boyer-Moore theorem-proving program has also been used successfully to prove properties of many recursive functions and to prove the correctness (more precisely, the verification conditions) of various Fortran programs, including a fast string-searching algorithm, an integer square root algorithm using Newton's method, and a linear-time majority vote algo rithm. These programs are each relatively small, requiring no more than a page of code. Nevertheless, the correctness arguments are fairly deep. If one is seriously interested in using the Boyer-Moore program, or if one wishes to gain a full appreciation of their impressive achievement, two books are recommended. The earlier book, A Computational Logic (Boyer and Moore 1979), shows rather well how the prover works. The later book, A Computational
Logical Basis for the Automation of Reasoning
1055
Logic Handbook (Boycr and Moore 1988), can be viewed as a users manual to the program. The book describes the logic of the prover (both formally and informally), describes the commands for using it (both abstractly and with examples), and includes an installation guide. The book gives a cursory overview of the structure of the prover but does not attempt a complete description. In contrast to the Boyer-Moore program, designed for the application of automated reasoning to proving properties of programs and of algorithms, the McCune program OTTER is designed both for research in automated reason ing and for a wide spectrum of applications. OTTER, which also is available electronically, is written in C and is portable; it runs with impressive speed on various workstations (Suns, for example), personal computers (that are IBM compatible), and the Macintosh. For details for obtaining a copy of this power ful program, designed by Dr. William McCune, one can send electronic mail to [email protected]. OTTER offers a number of inference rules, various strate gies, demodulation, subsumption, the ANSWER literal, and a host of options and special procedures.To present a problem to OTTER, one can rely on the clause language or on first-order predicate calculus with quantifiers. The use of OTTER has played a key role in answering open questions from various fields, including combinatory logic, finite semigroups, and a number of logical calculi.Not only does this program perform at impressive speed—drawing more than 2,000 conclusions and applying more than 4,000 demodulators per CPU second on a SPARCstation l-\—its performance barely changes with time or the size of the database of retained information. Indeed, after 19 CPU hours, or the retention of 30,000 clauses, or with the use of 2,000 demodulators (rewrite rules), OTTER's performance is not substantially less than with far smaller numbers. Unlike the Boyer-Moore program, OTTER does not offer induction or an interactive facility. Where the Boyer-Moore program sets the standard for applications focusing on proving properties of programs and algorithms, OTTER sets the standard for the application of proving theorems from various fields of mathematics and logic. Several other automated reasoning programs are worthy of mention.Of a strikingly different nature than either the Boyer-Moore program or OTTER are those programs based on Prolog technology.Among such programs, those designed and implemented by Stickel (1988) have proved most useful. For ex ample, Marien (1989) has used one of Stickel's programs to obtain a significant new result in equivalential calculus (see Section 4).Of yet a different nature are those programs based heavily on the use of rewrite rules, often including the use of associative-commutative unification (Stickel 1981). The program RRL (Kapur and Zhang 1989) has performed strongly on problems from ring the ory, producing various proofs in impressively little CPU time. The program SbReve2 (Anantharaman et al. 1989) also exhibits substantial reasoning power, as evidenced by its success with Moufang identities. For a final example, Chou's (1988) program has had remarkable success proving theorems in geometry. If one wishes to experiment with OTTER, then one can access by anony-
Collected Works of Larry Wos
1056
mous FTP a problem database that resides at Argonne.To access the problem database, one should connect to info.mcs.anl.gov by anonymous FTP, go to the directory pub/ATP_problems, then see the file README; note that ATP and README must be upper case. Among the areas covered by the database are group theory, ring theory, Tarskian geometry, elementary set theory, topology, various calculi, and puzzles. The notation is consistent with OTTER input. Proofs and commentary are included. If one wishes to conduct research in automated reasoning, the book Auto mated Reasoning: 33 Research Problems (Wos 1987) provides ample material. The book includes problems for testing and evaluating proposed solutions to the research problems it presents, axioms and clauses for studying various areas of mathematics and logic, the axioms and clauses for studying all of set theory within first-order logic by using the Godel approach, and an in-depth discussion of the obstacles to the effective automation of reasoning. With two additional books, one is well prepared for gaining a full under standing of the basics of automated reasoning, its possible applications, and its successes. The first of these two books is Symbolic Logic and Mechanical Theorem Proving by Chang and Lee (1973). Of the few books that provide a thorough treatment of the formalism on which the clause language paradigm is based, their book is generally the preferred. The book includes proofs of the theorems that establish the needed logical properties of various inference rules and strategies. The second of the two books is Automated Reasoning: Introduction and Ap plications (Wos et al. 1991a), revised edition. Although this book contains a chapter devoted to the underlying formalism, its main thrust is to focus on suc cessful applications of the field and to introduce the field to those who have no knowledge of automated reasoning and little or no knowledge of logic. Indeed, various chapters are devoted to specific successful applications of automated rea soning, including circuit design, circuit validation, and answering open questions from mathematics and logic.The book is self-contained, requiring no prerequi sites. It serves well as a college or university text, presenting numerous exercises with their answers. The book also contains a chapter on open questions and on challenge problems, a chapter that presents a tutorial for the use of OT TER, and a diskette with OTTER's source and a load module for use on an IBM-compatible personal computer.
9
Summary and the future
In this chapter, we show how automated reasoning—the field whose objective is to design and implement computer programs that address the reasoning aspects of problem solving—is effectively based on logic. Indeed, the field often relies on a subset of first-order predicate calculus for the representation of information and on the use of formal inference rules. Unlike mathematics and logic, however,
Logical Basis for the Automation of Reasoning
1057
to complete assignments of even moderate difficulty, the field depends on the explicit use of strategy, one type to restrict the actions of the inference rules, and one type to direct their action.In addition to the use of strategy, also virtually required is the use of subsumption to avoid the retention of a class of information that is logically weaker than existing information and, when equality is present, the use of demodulation to canonicalize and simplify information. The material we present in this chapter provides evidence for the long standing debate between Minsky and McCarthy, the former asserting that a general emphasis on logic and a specific emphasis on resolution are essentially a waste of time, and the latter endorsing the role of logic and the attempt to axiomatize various areas.McCarthy is winning, as the evidence shows, and win ning decisively—at least for the application of automated reasoning. Indeed, in every regard—in number of successes, variety of successes, and significance of successes—automated reasoning programs with logic as the basis have achieved dramatically more than any program based on an approach taken by people. Of such logic-based programs, those based on what has come to be known as the clause language paradigm have received the most recognition.In this chapter, we focus on that paradigm and on various successes with its use, including the answering of open questions, in finite semigroups (Winker et al. 1981), in equivalential calculus (Peterson 1977; Kalman 1978; Wos et al. 1984), in combinatory logic (Smullyan 1985, 1987; Wos and McCune 1988), and in sentential calculus (Scott 1990). Although we were unaware of the Minsky/McCarthy debate when we entered the field in 1963, we chose to approach the automation of reasoning with logic as its basis, and have never thought any other approach offered as much. Because two other approaches to the automation of reasoning—that based on logic programming and that based on person-oriented reasoning—have re ceived and continue to receive substantial attention, we include in this chapter a discussion of each in relation to the clause language paradigm.We focus on the differences and similarities, concluding that the marked complexity found in the clause language paradigm is inescapable, if one intends to use a pro gram to attack interesting questions and problems. (To be more precise, other equally complex paradigms have proved extremely powerful; for example, the Boyer-Moore (1979, 1988) program offers impressive power. To see intuitively why there exists a need for various inference rules, di verse strategies, numerous procedures, and the correspondingly large number of lines of computer code, one simply reviews mathematics and logic. Such a review quickly reveals that deep reasoning is required to answer questions from the various areas, and also reveals that an expert in one area often finds dif ficulty with problems from another area. Therefore, it seems at least odd that researchers continually search for a simple solution for the automation of rea soning, for example, a solution based on one inference rule or on one strategy. Clearly, a paradigm at least as complex as the clause language paradigm is re quired. Although simpler approaches are doomed—at least, if the application is
1058
Collected Works of Larry Wos
mathematics or logic or the proving of properties of programs and algorithms— they nevertheless merit investigation. Logic programming, which grew out of the study of automated theorem proving, has—through its use as the basis of a theorem-proving program (Stickel 1988)—in fact contributed to the advance of automated reasoning. As for the future, the picture is more promising now than at any other time in the history of the field, which some mark as beginning in approximately 1960. Although the progress was far slower in the first two decades than it might have been—too little experimentation in that period accounts for this fact—the last decade has seen impressive advances, in theory, in implementation, and in ap plication. These advances can be traced mainly to the eagerness of researchers to experiment, and experiment heavily. Included among the significant advances are the research and implementation of associative-commutative unification al gorithms (Stickel 1981; Biirckert et ol. 1988; Siekmann 1989), the formulation of the kernel strategy (Wos and McCune 1988), the formulation of linked inference rules (Veroff and Wos 1990), the use of sophisticated indexing mechanisms for the efficient implementation of automated reasoning programs (McCune 1990a), and the design and implementation of two powerful programs, the Boyer-Moore (1979, 1988) Theorem Prover, and McCune's (1990b) OTTER. In this chapter, we give the details for obtaining each of these programs. We also mention several books relevant to the field, and give the details for accessing a growing problem database that can be used for experimentation and for research. The better automated reasoning programs now available offer substantial assistance for answering questions from mathematics and logic. Clearly, far more power is needed and—we predict—forthcoming. To gain an appreciation of the progress that has occurred in this young field in but three decades, one need only realize that the more effective programs used now are more capable of solving problems that require reasoning than are the vast majority of people, even if restricted to university students. Perhaps the error that underlies the position taken by those who assert that automated reasoning programs offer little and that the field has made essentially no progress rests with comparing these programs to the better mathematicians and logicians. As counterevidence to such a position, we simply refer to the various open questions that have been answered with the assistance of an automated reasoning program; the variety of such questions and the depth speaks well of substantial progress. For progress to accelerate, even more experimentation is required, which is one reason we have discussed in this chapter the obstacles to an effective au tomation of reasoning and suggested specific research problems to solve.lt would be even better if new areas of mathematics and logic were attacked with the assistance of an automated reasoning program and if many mathematicians and logicians began using a reasoning program. The use of reasoning programs, espe cially by masters of mathematics and logic, would benefit automated reasoning by more accurately identifying which aspects merit immediate attention and would benefit mathematics and logic by leading to answers to open questions.
Logical Basis for the Automation of Reasoning
1059
If we can overcome the significant obstacle of the dissemination of information— so that many mathematicians and logicians, for example, will be encouraged to use an automated reasoning program—then the future will be even more promising. Even should this obstacle remain as is, the field can look forward to ever-widening horizons and to the increasing use of automated reasoning programs as automated reasoning assistants.
References [Anantharaman et al., 1989] S. Anantharaman, J. Hsiang, and .1. Mzali. SbReve2: A term rewriting laboratory with (AC-)unfailing completion. In N. Dershowitz, editor, Proc. Third International Conference on Rewriting Techniques and Applications, pages 533-37. Lecture Notes in Computer Science, Vol. 355, Springer-Verlag, Berlin, 1989. [Barendregt, 1981] H. P. Barendregt. The lambda calculus: Its syntax and se mantics. North-Holland, Amsterdam, 1981. [Boyer and Moore, 1979] R. Boyer and J Moore. A computational logic. Aca demic Press, New York, 1979. [Boyer and Moore, 1984] R. Boyer and J Moore. Proof checking the RSA pub lic key encryption algorithm. American Mathematical Monthly, 91:181-9, 1984. [Boyer and Moore, 1988] R. Boyer and J Moore. A computational logic hand book. Academic Press, San Diego, 1988. [Burckert et al., 1988] H. Biirckert, A. Herold, D. Kapur, J. Siekmann, M. Stickel, M. Tepp, and H. Zhang. Opening the AC-unification race;. J. Au tomated Reasoning, 4(4):465-74, 1988. [Change and Lee, 1979] C. Chang and R. Lee, R. Symbolic logic and mechanical theorem proving. Academic Press, New York, 1979. [Chou, 1988] S. C. Chou. Mechanical geometry theorem proving. D. Reidel, Dor drecht, 1988. [Davis and Putnam, 1960] M. Davis and H. Putnam. A computing procedure for quantification theory. J. of the ACM, 7:201-15, 1960. [DeGroot and Lindstrom, 1986] D. DeGroot and G. Lindstrom, editors. Logic programming: Functions, relations, and equations. Prentice-Hall, Englewood Cliffs, N.J., 1986. [Font et al., 1984] J. M. Font, A. J. Rodriguez, and A. Torrens. Wajsberg alge bras. Stochastica, 8(1):5-31, 1984. [Green, 1969] C. Green. Theorem-proving by resolution as a basis for questionanswering systems. In B. Meltzer and D. Michie, editors, Machine Intelli gence 4, pages 183-205. Edinburgh University Press, Edinburgh, 1969.
1060
Collected Works of Larry Wos
[Henkin et al., 1971] L. Henkin, J. Monk, and A. Tarski. Cylindric algebras, Part I. North-Holland, Amsterdam, 1971. [Huntington, 1933] E. Huntington. New sets of independent postulates for the algebra of logic, with special reference to Whitehead and Russell's Principia Mathematica. Trans, of AMS, 35:274-304, 1933. [Kalman, 1978] J. Kalman. A shortest single axiom for the classical equivalential calculus. Notre Dame J. Formal Logic, 19(l):141-4, 1978. [Kapur and Zhang, 1989] D. Kapur and H. Zhang. An overview of RRL (Rewrite Rule Laboratory). In N. Dershowitz, editor, Proceedings Third International Conference of Rewriting Techniques and Applications, pages 559-63, Lecture Notes in Computer Science, Vol. 335, Springer-Verlag, Berlin, 1989. [Lukasiewicz, 1970] J. Lukasiewicz. The equivalential calculus, In L. Borkowski, editor, pages 250-77, Jan Lukasiewicz: Selected works, North-Holland, Am sterdam, 1970. [Lusk and McFadden, 1987] E. Lusk and R. McFadden. Using automated rea soning tools: A study of the semigroup F2B2. Semigroup Forum, 36(1):7588, 1987. [Marien, 1989] A. Marien. Private communication, 1989. [McCharen et al., 1976] J. McCharen, R. Overbeek, and L. Wos. Complexity and related enhancements for automated theorem-proving programs. Com puters and Mathematics with Applications, 2:1-16, 1976. [McCune and Wos, 1987] W. McCune and L. Wos. A case study in automated theorem proving: Finding sages in combinatory logic. J. Automated Rea soning, 3(1):91-108, 1987. [McCune and Wos, 1989] W. McCune and L. Wos. The absence and the pres ence of fixed point combinators. Theoretical Computer science, 87:221-228, 1991. [McCune, 1990] W. McCune. OTTER 2.0 users guide. Technical Report ANL90/9. Argonne National Laboratory, Argonne, 111., 1990. [McCune, 1992] W. McCune. Experiments with discrimination tree indexing and path indexing for term retrieval, J. Automated Reasoning, 9(2): 147167, 1992. [Morris, 1969] E. Morris. E-resolution: An extension of resolution to include the equality relation. In Proceedings of the International Joint Conference on Artificial Intelligence, Washington, D.C., pages 287-94, 1969. [Peterson, 1977] J. Peterson. The possible shortest single axioms for ECtautologies. Technical Report Department of Mathematics Report Series No. 105, Auckland University, Auckland, New Zealand, 1977.
Logical Basis for the Automation
of Reasoning
1061
[Robinson and Wos, 1969] G. Robinson and L. Wos. Paramodulation and theorem-proving in first-order theories with equality. In B. Meltzer and D. Michie, editors, Machine Intelligence 4, pages 135-50, Edinburgh Uni versity Press, Edinburgh, 1969. [Robinson, 1965a] J. Robinson. Automatic deduction with hyper-resolution. In ternational J. Computer Mathematics, 1:227-34,1965. [Robinson, 1965b] J. Robinson. A machine-oriented logic based on the resolu tion principle. J. of the ACM, 12:23-41, 1965. [Scott, 1990] D. Scott. Private communication, 1990. [Shankar, 1985] N. Shankar. Towards mechanical metamathematics. J. mated Reasoning, l(4):407-34, 1985.
Auto
[Siekmann, 1989] J. Siekmann. Unification theory. Journal of Symbolic Compu tation, 7:207-74, 1989. em Special issue on unification, ed. C. Kirchner. [Smith, 1988] B. Smith. Reference manual for the environmental theorem prover, an incarnation of AURA. Technical Report ANL-88-2. Argonne National Laboratory, Argonne, 111., 1988. [Smullyan, 1985] R. Smullyan. To mock a mockingbird. Alfred A. Knopf, New York, 1985. [Smullyan, 1987] R. Smullyan. Private correspondence, 1987. [Statman, 1986] R. Statman. Private correspondence with Raymond Smullyan, 1986. [Stickel, 1981] M. Stickel. A unification algorithm for associative-commutative functions. J. of the ACM, 28:423-34, 1981. [Stickel, 1988] M. Stickel. A Prolog technology theorem prover. J. Reasoning, 4(4):353-80, 1988.
Automated
[Tarski, 1980] A. Tarski. Private communication, 1980. [Veroff and Wos, 1990] R. Veroff and L. Wos. The linked inference principle, I: The formal treatment. J. Automated Reasoning, 10(3):287-343, 1990. [Winker et al., 1981] S. Winker, L. Wos, and E. Lusk. Semigroups, antiautomorphisms, and involutions: A computer solution to an open problem, I. Mathematics of Computation, 37:533-45, 1981. [Winker, 1980] S. Winker. Private communication, 1980. [Winker, 1982] S. Winker. Generation and verification of finite models and counterexamples using an automated theorem prover answering two open questions. J. of the ACM, 29:273-84, 1982. [Winker, 1990] S. Winker. Robbins algebra: Conditions that make a nearBoolean algebra Boolean. J. Automated Reasoning, 6(4):465-89, 1990.
1062
Collected Works of Larry Wos
[Wos and McCune, 1988] L. Wos and W. McCune. Searching for fixed point combinators by using automated theorem proving: A preliminary report. Technical Report ANL-88-10. Argonne National Laboratory, Argonne, 111., 1988. [Wos and McCune, 1990] L. Wos and W. McCune. The application of auto mated reasoning to questions in mathematics and logic. Mathematics and Computer Science Division Preprint MCS-P199-1290, Argonne National Laboratory, Argonne, 111., 1990. [Wos and Robinson, 1973] L. Wos and G. Robinson. Maximal models and refu tation completeness: Semidecision procedures in automatic theorem prov ing. In W. Boone, F. Cannonito, and R. Lyndon, editors, Word Problems: Decision Problems and the Burnside Problem in Group Theory, pages 60939, North-Holland, New York, 1963. [Wos et al., 1964] L. Wos, G. Robinson, and D. Carson. The unit preference strategy in theorem proving. In AFIPS Proceedings of the Fall Joint Com puter Conference, Vol. 26, pages 615-21, Washington, D.C., 1964. Spartan Books. [Wos et al., 1965] L. Wos, G. Robinson, and D. Carson. Efficiency and com pleteness of the set of support strategy in theorem proving. J. of the ACM, 12:536-41, 1965. [Wos et al., 1967] L. Wos, G. Robinson, D. Carson, and L. Shalla. The concept of demodulation in theorem proving. J. of the ACM, 14:698-709, 1967. [Wos et al., 1984] L. Wos, S. Winker, R. Veroff, B. Smith, and L. Henschen. A new use of an automated reasoning assistant: Open questions in equivalential calculus and the study of infinite domains. Artificial Intelligence, 22:303-56, 1984. [Wos et al., 1991] L. Wos, S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, and R. Butler. OTTER experiments pertinent to CADE-10.
T h e Linked Inference Principle, I: T h e Formal Treatment* ROBERT VEROFF Department of Computer Science, University of New Mexico, Albuquerque, NM 87131, U.S.A. and LARRY WOS Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL 60439-4801, U.S.A. (Received: 11 July 1990; accepted: 7 January 1991) Abstract. In this article, we present a detailed, formal treatment of the linked inference principle, and we apply this principle to obtain the abstract formula tions of various linked inference rules. Included among such rules are linked UR-resolution, linked hyperresolution, and linked binary resolution, each of which generalizes the corresponding standard and well-known inference rule. In addition to the formalism, we discuss the motivation and objectives for the formulation of linked inference rules. We also include experimental results and numerous examples. In particular, we show how and why the effectiveness of an automated reasoning program can be, and often is, markedly increased by relying on the linked version rather than the more familiar standard version of an inference rule. Key words. Linked inference rules, inference rules, partitioning strategy, target strategy, depth-size strategy.
1
Motivation, Objectives, and an Intuitive In troduction to Linked Inference Rules
At the most general level, the motivation for formulating linked inference rules (which are introduced by example in this section and in Section 2, and for mally defined in Section 3) is the familiar and widely shared desire to markedly increase the effectiveness of automated reasoning programs. Such a marked in*This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted from the Journal of Automated Reasoning, Vol. 8, no. 2, pp. 213-274, with kind permission from Kluwer Academic Publishers.
Collected Works of Larry Wos
1064
crease might occur if a means could be found to avoid, or at least curtail, a reasoning program's tendency to deduce and then retain a vast amount of unneeded information. Since this unneeded information frequently results (directly and indirectly) from the program's simultaneous consideration of conclusions whose main value is to permit connection of one significant fact with another, relegating such intermediate information to being present implicitly only might cause a sharp increase in program effectiveness. The study of linked inference rules differs from the studies of matings [2, 8], refutation graphs [24], and the connection method [4], where the emphasis is on the characterization of and search for an entire proof, usually as a single step. It also differs from the study of connection graphs [11], where the essence is to accrue all possible unifiers before the search for conclusions is begun. (We also use the term links, but in a totally different manner.) In contrast to seeking proofs as a single step - as well as having the objective of introducing new infer ence rules - our emphasis is on extending and generalizing various well-known rules, providing a means for drawing conclusions that have a high probability of being significant, and (so to speak) seeking proofs in small pieces. In addition, an integral part of linked inference is the study and use of various types of strat egy. Indeed, the motivation for linked inference includes the capturing of certain strategic aspects of the reasoning found in mathematics. For an example, one frequently finds in a mathematics proof a conclusion that is reached in effect by combining, in a single step, reasoning in the spirit of resolution with that in the spirit of equality substitution. The appropriate linked inference rule captures such reasoning and clearly requires more than the pairing (or the mating) of literals. One goal of linking is to more efficiently access information that is deemed significant, for example, by reaching ahead in the search space. Other stud ies can be viewed as sharing this goal, studies including applications of model elimination [14], building equational theories into the unification algorithm [10, 25], theory resolution [27], the termination procedure described in ref. [3], and procedures described in refs. [9, 28, and 29]. Example EX1, Motivating an Interest in Linked UR-Resolution Let us consider the following three clauses based on the well-known 'jobs puzzle' [33]. (By convention, we use the symbol '|' to mean or and the symbol '-' to mean not. Also, the scope of a variable is assumed to be the clause in which it appears. Specifically, variables appearing in different clause occurrences are assumed to be distinct.) (Gail is female.) (EX1-1) FEMALE(Gail) (Nobody is both female and male.) (EX1-2) -FEMALE(x) I -MALE(x)
The Linked Inference Principle, I
1065
(The job of nurse i s held by a male.) (EXl-3) -HASAJOB(x,nurse) | MALE(x) Given these three clauses, an automated reasoning program quickly concludes that Gail is not a nurse. By applying standard UR-resolution [16] to the first two clauses, with clause (EX1-2) as the nucleus, the program obtains (EX1-4)
-MALE(Gail)
as the rather insignificant conclusion. The program can then use this new clause, with clause (EXl-3) as the nucleus, to deduce (EX1-5)
-HASAJOB(Gail,nurse)
as a significant conclusion. In this example, the intermediate result -MALE(Gail) serves only to permit clause (EXl-1) to connect to clause (EXl-3). When clauses such as (EX1-4) are retained and then considered with information that turns out to be unneeded, frequently a torrent of useless information results - the immediate descendants, their descendants, and the like. Indeed, the reasoning program often can be sent astray, wandering from a study of the property of being not male to a study of other distantly related properties. On the other hand, if such intermediate information were relegated to being present implicitly only, then much of the useless information (and its consequences) could be avoided, with a corresponding reduction in the size of the search space. One sees how such pruning of the search space can occur (with the use of standard inference rules) by viewing UR-resolvents or hyperresolvents as con sisting of the appropriate set of binary resolvents, and then considering the implementation of UR-resolution or hyperresolution [20, 26] that does not gen erate those intermediate binary resolvents. The absence of such binary resolvents prevents their consideration, their interaction, and their spawning of many gen erations of additional unneeded clauses. Were such binary resolvents generated, they would correspond to rather insignificant conclusions and mainly serve the purpose of providing a path from the appropriate hypotheses to the conclusion. In other words, just as clause (EX1-4) is an intermediate result that leads to clause (EX1-5), the appropriate intermediate binary resolvents (of an applica tion of UR-resolution or hyperresolution) lead to the final resolvent. By generalizing Example EXl, we thus see that there may exist conclusions, obtained with the standard version of well-known inference rules, whose only use is to connect more interesting and significant bits of information. One of the points we make in this article is that such intermediate information need not be generated and retained. Instead, such information can be relegated to being present implicitly only. A means for doing so is provided by the use of linked inference rules. We can glimpse how linked inference rules work by considering the original clauses of Example EXl. As we shall further illustrate and define formally later
Collected Works of Larry Wos
1066
in this article, one can use linked UR-resolution and designate clause (EX 1-2) to be a linking clause only and designate clause (EX 1-3) as the nucleus. Then clause (EX1-2) links clause (EX1-3) to the satellite clause (EX1-1) to deduce the desired conclusion -HASAJOB(Gail,nurse) in a single linked inference step. The intermediate fact -MALE(Gail) is not generated and is present implicitly only. The logic programming paradigm [12] can be viewed as taking the notion of implicit information to its logical extreme in which a complete proof can be considered as a single deductive step - in particular, without retention of any additional or intermediate information. The most serious drawback to this approach is the loss of effectiveness resulting from the inability to save and take advantage of any intermediate information [37]. Linking can be viewed as an attempt to capture the best of both worlds: the power to save intermediate information that is useful, and the ability to skip over, in a controlled fashion, information that is less useful. Example EX2, Motivating an Interest in Linked Hyperresolution For a second example, consider the following four clauses taken from the end of a proof by contradiction of the verification of a certain property of a computer program. (The integer a i s g r e a t e r than 0.) (EX2-1) GT(a,0) (Integers g r e a t e r than 0 are p o s i t i v e . ) (EX2-2) -GT(x,0) I POSITIVE(x) (Integers cannot be both p o s i t i v e and negative.) (EX2-3) -POSITIVE(x) I -NEGATIVE(x) (The i n t e g e r a i s negative.) (EX2-4) NEGATIVE(a) Standard hyperresolution, if applied to the first two clauses, will yield the fol lowing clause. (EX2-5)
POSITIVE(a)
A second application of hyperresolution, if applied to clauses (EX2-3), (EX24), and (EX2-5), will result in the deduction of the empty clause, establishing that a proof has been found. If the program selects clause (EX2-5) as the focus of attention and considers it with other rather insignificant information (which would typically be present when many clauses are retained), the program can stray far from the problem under investigation before the empty clause is fi nally deduced and recognized. Indeed, as J Moore pointed out [19], one finds
The Linked Inference Principle, I
1067
that use of the Boyer-Moore program [6] frequently results in that program's consideration of one predicate after another, eventually focusing on concepts t h a t have no relevance to the problem at hand. We frequently witness the same phenomenon with our programs; we expect to encounter it far less often with the use of linked inference rules. Similar to Example EX1, to avoid deducing the unwanted clause POSI T I V E ^ ) , one could employ a linked inference rule - in this case, linked hyperresolution. To glimpse how linked hyperresolution works, we again consider the four original clauses of Example EX2. A one-step proof by contradiction is ob tained with linked hyperresolution, using (EX2-3) as the nucleus, (EX2-1) and (EX2-4) as satellites, and (EX2-2) as a link. This example hints at how the type of reasoning found in many dialects of logic programming is captured by linked hyperresolution [37]. We note that the preceding use of linked inference also is an example of linked binary resolution, discussed by example in Section 2 and defined formally in Section 3.2. From the viewpoint of linked binary resolution, clauses (EX2-1) and (EX2-4) are the parents, and clauses (EX2-2) and (EX2-3) are the links. Linked resolution steps can be far more complex than those illustrated so far. For example, linking clauses can contain more than two literals. When such 'nonbinary' links participate in a linked inference step, they may contribute literals to the result of the inference (see Example BR1 in Section 2.3), or they may connect a literal in the nucleus to more than one satellite (see Example UR5 in Section 2.1), or both. Linked inference rules provide a potentially powerful means for preventing or sharply curtailing an automated reasoning program from directly considering information such as conclusion (EX1-4) and conclusion (EX2-5). As we shall show, the appropriate use of such rules causes a reasoning program to treat information such as conclusions (EX1-4) and (EX2-5) as being present implicitly only. Such information, if appropriate designations are given, is never considered for retention and, therefore, cannot be used to lead the program astray. Recognizing that our primary motivation of sharply increasing program effec tiveness provides little concrete direction, other than that just discussed, we next consider our specific objectives. (For historical and bibliographical purposes, we note that our earlier work on linked inference [34], which was designated as the second paper on the subject, promised a paper giving the full formal treatment of the linked inference principle. The present article fulfills much of that promise - omitting only the details for equality-oriented reasoning, to be presented in a later article - and corrects and extends information given in the earlier paper. We also note that this paper, which had been cited in the bibliography of the earlier paper as expected to appear under four authors, is in fact written by only two of those authors.)
Collected Works of Larry Wos
1068
1.1
SPECIFIC OBJECTIVES
Our research was prompted by the pursuit of a number of specific objectives, including the following: 1. to replace (at least in part) the syntactic conditions that constrain various well-known inference rules by conditions that come closer to being seman tic - for example, by emphasizing the significance of a predicate rather than its sign; 2. to make it easier to use a natural representation when presenting a problem to an automated reasoning program - for example, by reducing the need to artificially encode information as unit clauses rather than as nonunit clauses; 3. to provide a means for such a program to take much larger deduction steps, if that is the user's preference; and 4. finally and most important, to provide a means for the user to set condi tions - by setting the appropriate parameters for the reasoning program that, if satisfied, will sharply increase the likelihood that a high percentage of the information retained by an automated reasoning program will be significant. The means we have chosen to attempt to reach (at least to an important extent) the given four objectives is to apply the linked inference principle (pre sented in Section 3) to the formulation of a number of distinct linked inference rules. Since the degree to which we are successful will be determined solely by substantial experimental results with applications to real problems, we recognize that the ultimate verdict is years away. For our formulation of linked inference rules, we were guided by properties of existing rules, rules such as the standard versions of UR-resolution [16], hyperresolution [23], binary resolution [22], and paramodulation [21]. However, the standard version of each of these inference rules presents certain obstacles (to be discussed in detail), obstacles that become much less severe when one uses the corresponding linked inference rule. For example, when one uses the standard version of any of the cited inference rules, one often encounters the obstacle of being forced to include in the set of support [31] clauses that correspond to general information and that should, therefore, play an auxiliary role rather than a key role in a program's attempt to complete the given assignment. As we shall see, the linked version of an inference rule often is more compatible with the set of support strategy than is the corresponding standard version of the inference rule. Even further, we shall see that one can actually choose a smaller set of support than one would if following the usual recommendation. In addition, we shall find that a smaller maximum weight limit (upper bound on the complexity) [16] for retained information can be used, smaller than that
The Linked Inference Principle, I
1069
of certain intermediate steps in the sought-after proof when that proof relies on the use of standard inference rules. Rather than immediately presenting the formal definitions of the various linked inference rules and the formal discussion of the linked inference principle used to formulate them, let us instead set the stage by first approaching our subject intuitively. 1.2
INTUITIVE INTRODUCTION TO LINKED INFERENCE RULES
The following questions and answers will serve us well. Question: What should one have in mind when hearing the term linked inference rule? Answer-. The term linked inference rule is derived from the use of various clauses to link one clause (the nucleus) to other clauses (the satellites) thought to be most pertinent to the problem under study. For example, in contrast to standard UR-resolution where the satellites act directly upon literals in the nucleus, in linked UR-resolution, additional clauses can be used to link literals in the nucleus to the satellites. Question: From an intuitive viewpoint, what are linked inference rules? Answer. At the most general level, a linked inference rule is a type of rea soning (obtained by applying the linked inference principle) that combines a number of smaller steps into a single larger step - just as UR-resolution and hyperresolution combine in a single step a number of binary resolution steps. For example, linked UR-resolution, which combines one or more standard URresolution steps into a single step, requires that exactly one of the clauses that participates be a nucleus, all of whose literals but one are removed by unifica tion with a literal (of opposite sign) from another clause. The resulting clause is an instance of the remaining literal. While standard UR-resolution requires that literals of the nucleus be removed directly with unit satellites, linked URresolution permits literals in the nucleus to be removed either with unit satellites or with nonunit links. In the latter case, all of the remaining literals of the links must be removed in a similar fashion. In particular, links are permitted to re solve with links, creating 'chains' of clauses linking the nucleus to some set of satellites. The following three inference trees illustrate, respectively, standard URresolution, linked UR-resolution in which no link resolves with another link, and linked UR-resolution in which links resolve with links. Example EX3, Tree Representation of Standard and Linked UR-Resolution In the following trees, the literals of a clause are enclosed in brackets [ ], and '|' is used to identify the appropriate literal clashes (binary resolutions); the symbol | for or is omitted from the nonunit clauses to avoid confusion.
Collected Works of Larry Wos
1070
The first tree represents a standard UR-resolution deduction of clause S. The nucleus is -P | -Q | R | S. The satellites are P, Q, and -R.
[-P I [P]
-Q I [Q]
R I [-R]
S]
The second tree represents a linked UR-resolution deduction of clause S. The nucleus is -PI | -Ql | R | S, and the satellites are -P2, Q2, and -R. The remaining clauses, PI | P2 and Q l | -Q2, are the links. In this case, linking clauses connect a literal in the nucleus directly to a satellite.
[-P1 I [PI
P2] I [P2]
-Ql I [Ql -Q2] I [Q2]
R I [-R]
S]
The third tree also represents a linked UR-resolution deduction of clause S. The nucleus is -PI | -Ql | R | S, and the satellites are -P2, -Q3, Q5, and -R. The remaining clauses, PI | P2, Q l | -Q2, Q2 | Q3 | -Q4|, and Q4 | -Q5, are the links. In this case, literals in linking clauses resolve with literals in linking clauses, creating chains of links from the nucleus to satellites.
[-P1 I [PI
P2] I [-P2
-Ql I [Ql ]
-Q2] I [Q2 I [-Q3]
R I [-R] Q3
S]
-Q4] I [Q4 -q5] I CQ5]
We note that in the third tree the single literal -Ql in the nucleus is connected to more than one satellite. This is due to branching caused by the linking clauses. Question: What are the advantages of using linked inference rules? Answer. A linked inference rule is a way of reasoning that gives the user control over various parameters, such as the size of the reasoning step, the
The Linked Inference Principle, I
1071
breadth of the search that the program is allowed to make, and the semantic nature of the conclusion. (Actually, to properly and fully control the semantic nature of conclusions, one combines the use of a linked inference rule with the use of a strategy, the target strategy, which is presented in Section 4.2). The advantages are that the reasoning program can avoid certain obstacles presented by the standard inference rules and, ideally, can more quickly get to significant information. A secondary advantage is that the use of linked inference rules permits more natural representations for problems. Question: W h a t kinds of obstacle are presented by the standard versions of some inference rules? Answer. For example, UR-resolution requires that, of the set of clauses under simultaneous consideration, all but one must be a unit clause. Sometimes, there are not enough unit clauses available to permit one to solve a given problem with the choice of UR-resolution as the inference rule and with the set of support that one wishes to use, even though the preference for that inference rule and set of support seems to be a good choice. To see what we mean by not enough unit clauses, let us consider the following syntactic example. Example EX4, Lack of Unit Clauses We use the following clauses. (EX4-1) (EX4-2) (EX4-3) (EX4-4) (EX4-5)
P -P I R Q -Q I S -R I -S
If clause (EX4-5) corresponds to the denial of the conclusion to be proved, and if clauses (EX4-1) through (EX4-4) correspond to the general axioms, then clause (EX4-5) would be the preferred set of support. With that choice of set of support and with UR-resolution as the chosen inference rule, no proof can be found. The use of linked inference rules alleviates the severity of, but does not eliminate, such obstacles. Question: Would standard hyperresolution suffice for the given example, and would linked UR-resolution suffice? Answer. T h e use of hyperresolution, as one can immediately verify, if coupled with clause (EX4-5) as the set of support yields no conclusions and, hence, no proof. On the other hand, as expected, the use of linked UR-resolution would work well, for its use would allow clause (EX4-2) to link clause (EX4-5) as a nucleus to clause (EX4-1) as a satellite to yield the unit clause (EX4-6)
-S
Collected Worlcs of Larry Wos
1072
as a linked UR-resolvent. Then, by applying linked UR-resolution again - or by applying standard UR-resolution, which is a special case of linked UR-resolution - the program could deduce (EX4-7)
-Q
from clauses (EX4-6) and (EX4-4), which would conflict with clause (EX4-3), completing a proof by contradiction. Question: Would linked hyperresolution, as yet undefined, also suffice? Answer. The use of linked hyperresolution also would suffice, for clause (EX45) would serve well as a nucleus, using clauses (EX4-2) and (EX4-4) as links to link, respectively, to clauses (EX4-1) and (EX4-3) as satellites. The result would be a one-step proof, and a proof, in fact, in the spirit of the programming language Prolog [Clocksin84] - taking clause (EX4-5) to be the goal clause. Further study of the given example reveals how linked UR-resolution can combine a number of standard UR-resolution steps into a single step, and how linked hyperresolution can act similarly for standard hyperresolution. Just as one can program standard hyperresolution to combine a number of binary res olution steps into a single step without generating, for possible retention, the intermediate binary resolvents, one can (and, for efficiency, should) program the various linked inference rules in such a manner that intermediate clauses are never generated for consideration for retention. Question: Since hyperresolution is refutation complete, in contrast to UR-resolution which requires other conditions to be satisfied if such completeness is to be guar anteed, why not simply use hyperresolution when the set of clauses to be studied suffers from an inadequate supply of unit clauses? Answer. A thorough discussion and satisfying analysis of the interplay of inference rule and strategy cannot as yet be given by us, for too much remains to be learned. However - especially in view of our intention in this section to supply an intuitive perspective - the following observations may help clarify the issue. 1. Without the use of the set of support strategy (or some as-yet-unknown equivalent) to restrict the application of the inference rules, a reasoning program typically requires an inordinate amount of CPU time to complete even simple assignments. 2. If a set of clauses is unsatisfiable, that unsatisfiability frequently is intro duced with the addition of negative unit clauses arising from assuming that the theorem under study is false. 3. If one considers such a set of clauses and studies it with hyperresolution, the negative unit clauses frequently come into play only to signal that the
The Linked Inference Principle, I
1073
proof by contradiction has been completed. Put another way, rather than keying on the assumed falseness of the theorem under study, a program using hyperresolution can easily spend a great deal of CPU time exploring the underlying theory, finding the desired proof more or less by accident. 4. In addition, reliance on unit clauses to drive a proof search is, in most cases, far more effective than reliance on nonunit clauses. Keying on unit clauses can cause an automated reasoning program to (in effect) treat a search as one of case analysis, one case at a time, where keying on nonunit clauses can cause the program to simultaneously consider all of the cases with the side effect of mixing the cases. Question: Does the actual difficulty rest with the use of the set of support strategy? Answer. The following example illustrates that, in an important sense, the problem does not rest solely with the desire to use the set of support strategy. Example EX5, Unit Clauses and the Set of Support Strategy Let us assume that all of the following clauses are in the set of support. (EX5-1) (EX5-2) (EX5-3) (EX5-4) (EX5-5)
-P P P P P
With UR-resolution, no clauses are deduced. With a linked inference rule closely related to linked UR-resolution - one that permits a type of literal merging a proof is found (for example, by deducing in two linked inference steps the conflicting units R and -R). Question: To what areas of application and to which aspects of reasoning might linked inference rules be of especial value? Answer. Set theory and program verification appear to be areas whose study might especially benefit from the use of linked inference rules. Another potential area of application is taxonomic reasoning, as discussed in [27] as an application of theory resolution. More generally, reasoning about inequalities, as described in ref. [5], appears to be an aspect of reasoning that is captured, at least in part, by linking. Also, of particular interest, the aspect of reasoning concerned with definition expansion might be most amenable to a treatment with linked inference, specifically when one wishes to open a definition for a short time only, without permitting the information at the lower level to be free to spawn many descendants. (A similar observation holds for definition contraction, in which the program could temporarily recognize and reason about defined concepts.)
Collected Works of Larry Wos
1074 Example EX6, Definition Expansion
To illustrate the use of linking for definition expansion, we consider two theorems from set theory. We begin with the following axioms that define the subset relation in terms of the element relation. Vx, y{SUBSET(x, y) <- Vz{EL{z, x - E)L(z, y)))) (EX6-1) (EX6-2) (EX6-3)
-SUBSET(x.y) I -EL(z.x) I EL(z,y) SUBSET(x.y) I EL(f(x,y),x) SUBSET(x.y) I -EL(f(x,y),y)
The first theorem states that every set is a subset of itself. To prove this theorem, we adjoin the following clause as the denial and as the only element in the set of support. (EX6-4)
-SUBSET(a,a)
A proof can be found by temporarily expanding the definition of SUBSET in terms of EL. In particular, the simultaneous consideration of clauses (EX6-2), (EX6-3), and (EX6-4) yields (EX6-5)
SUBSET(a.a)
in a single linked UR-resolution step, which conflicts with (EX6-4). With linking, no explicit conclusions in terms of EL are needed. The following inference tree corresponds to the deduction of clause (EX6-5). [SUBSET(x.y) [SUBSET(x,y) I [-SUBSET(a.a)]
EL(f(x,y),x)] I -EL(f(x,y),y)]
We note that the clauses in the inference tree are the original (uninstantiated) clauses that participate in the corresponding deduction. For a more interesting example, we consider the following additional axioms for the definition of power set. (Vz, x(EL(z,powerset(x)) +-> SUBSET{z,x))) (EX6-6) (EX6-7)
-EL(z,powerset(x)) I SUBSET(z.x) EL(z.powerset(x)) I -SUBSET(z.x)
The theorem states that for all sets x and y, if x is a subset of y, then the power set of x is a subset of the power set of y. To prove this theorem, we adjoin the following clauses as the denial.
The Linked Inference Principle, I (EX6-8) (EX6-9)
1075
SUBSET(a.b) -SUBSET(powerset(a).powerset(b))
A proof can be found by temporarily expanding the definitions of SUBSET and powerset in terms of EL. In particular, the following sequence of linked URresolution steps produces a proof entirely in terms of SUBSET and powerset, without explicitly considering conclusions in terms of EL. (From EX6-9, EX6-3, and EX6-7.) (EX6-10) -SUBSET(f(powerset(a).powerset(b)),b) (From EX6-9, EX6-2, and EX6-6.) (EX6-11) SUBSET(f(powerset(a),powerset(b)),a) (From EX6-11, EX6-1, EX6-2, EX6-1, EX6-8, EX6-3, and EX6-10.) (EX6-12) SUBSET(f(powerset(a),powerset(b)),b) Clause (EX6-12) conflicts with clause (EX6-10), completing the proof. The fol lowing inference trees correspond, respectively, to the deductions of (EX6-10), (EX6-11), and (EX6-12). We note that the literals of some of the clauses are reordered for presentation. Inference tree for clause (EX6-10): [EL(z,powerset(x)) I -EL(f(x,y),y)]
-SUBSET(z,x)]
[SUBSET(x,y) I [-SUBSET(powerset(a),powerset(b)) ] Inference tree for clause (EX6-11):
[-EL(z,powerset(x)) I EL(f(x,y),x)]
[SUBSET(x.y) I [-SUBSET(powerset(a),powerset(b))]
SUBSET(z,x)]
1076
Collected Works of Larry Wos
Inference tree for clause (EX6-12):
[SUBSET(x,y) [SUBSET(f(powerset(a).powerset(b)),a)] I [-SUBSET(x.y) EL(z.y) I [-SUBSET(x.y) -EL(z,x) I [SUBSET(a.b)] [SUBSET(x.y)
EL(f(x,y),x>] I I I -EL(z,x)] EL(z.y)] I -EL(f(x,y),y)]
I [-SUBSET(f(powerset(a),powerset(b)),b)]
1.3
AGENDA
To make completely clear the subtleties and nuances of linked inference, we present (in Section 2) a graduated set of examples of linked UR-resolution, linked hyperresolution, and linked binary resolution. The commentary accompanying these examples will set the stage for the formal definitions (given in Section 3) of these inference rules and will also explain why certain conditions are included as requirements for the various rules. In Section 3 we present the linked inference principle. The more general formalism will treat various inference rules as special cases, more or less in the spirit of setting parameters to obtain the desired linked inference rule. Since inference rules, regardless of their nature, require the use of one or more strategies to control them if the effectiveness of their use is to be maximized, we turn to the subject of strategy in Section 4. In addition to discussing how the use of the set of support strategy [31] and the weighting strategy [16] meshes with linked inference, we also introduce various new strategies particularly tailored to the new inference rules. Although an abstract formalism can often produce a deep appreciation for a subject, in the field of automated reasoning - consistent with our never-changing viewpoint - the true test of the value of an inference rule, strategy, or some other mechanism is its effect on program performance. Therefore, we briefly describe (in Section 5) an extension to the automated reasoning program OTTER [17] that includes an implementation of linked UR-resolution, and give (in Section 6) some highlights of various experiments. We include there unfavorable as well as favorable comparisons to enable researchers to begin to decide in which areas and under which circumstances the use of linked inference is profitable.
The Linked Inference Principle, I
2
1077
G r a d u a t e d Examples to Illustrate Properties of Linked Inference Rules
Let us consider the literal-oriented inference rules UR-resolution, hyperresolution, and binary resolution, discussing both the standard version and the linked version of each. UR-resolution is perhaps the best rule to study first, for one can most easily use it to illustrate a number of the subtleties of the topic of linked inference. We then turn to hyperresolution, building on the knowledge gained from the preceding discussion of UR-resolution. Finally, we focus briefly on binary resolution. 2.1
LINKED UR-RESOLUTION
When presented with a set of clauses in which the equality relation is not promi nent, when the task is to find a proof by contradiction, and when no linked inference rule is accessible, our choice of inference rule - if no additional infor mation is available - is UR-resolution. That inference rule is oriented toward the deduction of unit clauses, which meshes well with our notion that unit clauses play a powerful role for many studies. To succeed in drawing a conclusion, the standard version of UR-resolution requires the simultaneous consideration of a set S of clauses such that exactly one clause in 5 be a nonunit clause, the re maining clauses in S be unit clauses, and an appropriate unifier be applied to (so to speak) cancel all but one literal of the nonunit clause with the unit clauses. The nonunit clause is called the nucleus, and the unit clauses (not necessar ily distinct) are called satellites. As we shall see, linked UR-resolution captures (standard) UR-resolution as a special case, and also uses the concepts of nucleus and satellite. The following examples illustrate standard and linked UR-resolution and introduce some terminology pertinent to linked inference. Each example consists of a set of clauses and one resolvent of that set. We note that the specified resolvent is chosen for illustration and is not necessarily the only resolvent of the given set of clauses. Example UR1, Standard UR-Resolution Clauses: (UR1-1) (UR1-2) (UR1-3)
P(a,x) -Q(x,d) -P(x,b) I -P(x,c) | q(x,y) I R(y,x)
Collected Works of Larry Wos
1078
Inference TYee:
[-P(x.b) I [P(a,x)]
-P(x,c) I CP(a.x)]
Q(x,y) I C-Q(x.d)]
R(y.x)]
Standard UR-Resolvent: R(d,a) Clause (UR1-3) is the nucleus. Clause (URl-2) and two distinct occurrences of clause (UR1-1) are the satellites. As we shall see later, R(d,a) also is a linked UR-resolvent, for linked URresolution captures standard UR-resolution. Using the terminology of linked in ference, we say that this application of linked inference has link depth 0 (because no linking clauses participate) and has deduction size 3 (because the deduction represents the application of 3 binary resolution steps). Before continuing with more interesting examples, we note that a single global unifier exists that applies to the distinct clause occurrences participating in the deduction. Although several of the remaining examples will be propositional, it is understood that, in general, a global unifier is required to complete an application of a linked inference rule. Example UR2, Linked UR-Resolution with 1 Linking Clause Clauses: (UR2-1) (UR2-2) (UR2-3) (UR2-4)
P -Q2 -Ql I Q2 -P I Ql I R
Inference TVee: [-P I [P]
Ql I [-Q1
R] Q2] I [-Q2]
Linked UR-Resolvent: R In this case, clause (UR2-4) is the nucleus, and clauses (UR2-1) and (UR2-2) are satellites. Clause (UR2-3) is a linking clause, linking literal Ql of the nucleus (UR2-4) to satellite (UR2-2). One might think of the linking clause (UR2-3) as
The Linked Inference Principle, I
1079
transforming literal Q l of the nucleus into the literal Q2 so that it can resolve with the satellite (UR2-2). T h e link depth of this application of linked inference is 1 because the single linking clause, (UR2-3), links a literal of the nucleus directly to a satellite. The deduction size is 3 because 3 applications of binary resolution are represented. We note that the clause -Ql is also a linked UR-resolvent of this set of clauses, specifically of clauses (UR2-2) and (UR2-3). To filter the set of conclusions that can be drawn with linked UR-resolution, with the goal of avoiding the deduction of-Ql for example, a strategy tailored to the use of linked inference can be used. In Section 4.2, we discuss such a strategy, the target strategy, for controlling the application of linked inference rules to increase the likelihood that only 'interesting' information is generated and retained. Example UR3, Linked UR-Resolution
with More Than 1 Linking
Clause
Clauses: (UR3-1) (UR3-2) (UR3-3) (UR3-4) (UR3-5)
P2 PI I -P2 -Q2 -Ql I Q2 - P I I Ql I R
Inference Tree: [-P1
Ql
I [PI
R]
I -P2]
[-Q1
Q2]
I
I
[P2]
[-Q2]
Linked UR-Resolvent: R Clause (UR3-5) is the nucleus, clauses (UR3-1) and (UR3-3) are satellites, and clauses (UR3-2) and (UR3-4) are links. The deduction size is 4. We note that both linking clauses are used to link a literal in the nucleus directly to a satellite. For this reason, the link depth is 1. In general, the link depth is the length of the longest 'chain' of linking clauses, and not the total number of linking clauses. In the next example, we consider a deduction with link depth greater than 1. Example UR4, Linked UR-Resolution Clauses: (UR4-1)
P2
with Link Depth Greater Than 1
Collected Works of Larry Wos
1080 (UR4-2) (UR4-3) (UR4-4) (UR4-5) (UR4-6) (UR4-7)
PI 1 -Q4 -Q3 -Q2 -Ql -PI
-P2 1 1 1 1
Q4 Q3 Q2 Ql
Inference Tree: [-P1 I [PI
-P2] I [P2]
Ql I [-Q1
R] Q2] I [-Q2
Q3] I [-Q3
Q4] I [-Q4]
Linked UR-Resolvent: R Clause (UR4-7) is the nucleus, clauses (UR4-1) and (UR4-3) are satellites, and the remaining clauses are links. In this case, literals in the linking clauses (UR44), (UR4-5), and (UR4-6) resolve to create a chain from the literal Ql in the nucleus to the satellite (UR4-3). This deduction has link depth 3 because 3 is the length of the longest chain of links. Another chain, of length 1, exists connecting literal -PI in the nucleus to satellite (UR4-1). The deduction size is 6. In the next example we see that in a single linked UR-resolution step, one occurrence of a clause can be a nucleus, while another occurrence of the same clause is a link. Example UR5, Linked UR-Resolution with Clauses Playing Dual Roles Clauses: (UR5-1) (UR5-2) (UR5-3) (UR5-4)
LT(a.b) LT(b,c) LT(c,d) -LT(x.y) I -LT(y,z) I LT(x.z)
The Linked Inference Principle, I
1081
Inference Tree (renaming variables for clarity):
[-LT(u.v) I [LT(a,b)]
-LT(v,w) I [LT(b.c)]
[-LT(x.y) I LT(u,w)]
-LT(y.z) I [LT(c,d)]
LT(x.z)]
Linked UR-Resolvent: LT(a, d) The clause (UR5-4) participates twice in this application of the inference rule, once as the nucleus and once as a linking clause. The link depth is 1 because the link (UR5-4) connects the literal -LT(i, y) of the nucleus (UR5-4) to the satellites (UR5-1) and (UR5-2). The deduction size is 4. Example UR6, Literal Merging Until this example, we have avoided the discussion of literal merging. Let us consider the following clauses. (UR6-1) (UR6-2)
P IQ -P I Q
No conclusion is drawn when standard UR-resolution is applied to these two clauses, despite the fact that resolution yields two literals that merge, resulting in a unit clause. With the usual definition of UR-resolution, the program is not allowed to test for literal merges (not even for merges within the nucleus itself), for to do so could degrade program performance markedly. For the same reason, the definition of linked UR-resolution does not permit literal merges, including literals introduced by linking clauses. In Section 3.3, however, we shall focus on how the linked inference principle, in its full gen erality, does capture literal merging. Also, in contrast to linked UR-resolution, we shall see (in Section 2.2) that linked hyperresolution naturally permits some amount of literal merging. Properties of Linked UR-Resolution Standard UR-resolution, which is simply linked UR-resolution with link depth 0, requires that the nucleus be a nonunit clause, that the satellites be unit clauses - and, therefore, not contribute literals to the result - and that ex actly one literal of the nucleus be unpaired. The UR-resolvent is an instance of the single unpaired literal in the nucleus. To maintain the spirit of this inference rule, linked UR-resolution is subject to the same requirements.
Collected Works of Larry Wos
1082
As with standard UR-resolution, a successful application of linked UR-resolution implies the existence of a type of pairing set that pairs literals in a rather con strained manner; the properties of such a pairing set are given in Section 3. Also in Section 3, we discuss the similarities and differences between the concept of pairing set and that of matings [2, 4, 8]. The property that distinguishes linked UR-resolution from standard UR-resolution is the permission to pair a literal in the nucleus with a literal in another nonunit clause, a link. The clauses (clause occurrences) that are the hypotheses of a successful application of linked UR-resolution can be partitioned into disjoint sets, the nucleus, the satellites, and the (possibly empty set of) links. The nucleus is that unique clause (occurrence) that contains the unpaired literal whose instance (descendant) is the single literal of the linked UR-resolvent. Since literal merging is not permitted in linked UR-resolution, the satellites are precisely the unit clauses that participate in the deduction. The remaining clauses are the links. Linking clauses share properties with both the nucleus and the satellites. Each link shares the property with the nucleus of requiring that it be a nonunit clause. Each link shares the property with the satellites of requiring that each of its literals be paired with a literal in some other clause. In other words, links do not contribute literals to the result. 2.2
LINKED HYPERRESOLUTION
The inference rule hyperresolution is restricted to the deduction of positive clauses, clauses free of the symbol'-' (not). To succeed in drawing a conclusion, the standard version of hyperresolution requires the simultaneous considera tion of a set S of clauses such that exactly one clause (the nucleus) in S be a clause containing one or more negative literals, the remaining clauses (the satellites) in 5 be positive clauses, and an appropriate unifier be applied to (so to speak) cancel all of the negative literals of the nucleus by unifying each with a positive literal from one of the satellites. In addition, each satellite must have the property that exactly one of its literals is paired in the simultaneous unification. Finally, the hyperresolvent produced by a successful application of standard hyperresolution must consist of positive literals only; the empty clause is admissible. Example HY1, Standard Hyperresolution with a Nonunit Satellite Clauses: (HY1-1) (HY1-2) (HY1-3)
-P(a.b) | -Q(x) I R(x) P(x,y) I S(y,x) Q(c)
The Linked Inference Principle, I
1083
Inference Tree: [-P(a.b) I [P(x.y)
S(y,x)]
-Q(x) I [Q(c>]
R(x)]
Standard Hyperresolvent: S(b,a) | R(c) The clause (HY1-1) is the nucleus, and the clauses (HY1-2) and (HY1-3) are the satellites. Just as linked UR-resolution captures standard UR-resolution as a special case in which the link depth is 0, linked hyperresolution similarly captures standard hyperresolution. Example HY2, Linked Hyperresolution
with Link Depth Greater Than 0
Clauses: (HY2-1) (HY2-2) (HY2-3) (HY2-4)
- P ( a , x ) I -Q(x) I R(x) P(x,b) - S ( x , y ) I Q(y) - P ( x , y ) I S ( y , x ) I R(c)
Inference Tree: R(x)]
[ - P ( a . x ) -Q(x)
I
I
[PCx.b)]
[Q(y)
[-P(x.y)
-S(x,y)] I S(y,x)
R(c)]
I [P(x,b)] Linked Hyperresolvent: R(b) | R(c) The clause (HY2-1) is the nucleus for this application of the inference rule, and two distinct occurrences of clause (HY2-2) are the satellites. The clauses (HY23) and (HY2-4) are the linking clauses, creating a chain of length 2 from the literal -Q(x) in the nucleus to one occurrence of the satellite (HY2-2). For this reason, the link depth of this application of linked inference is 2. The deduction size is 4. We note that one of the linking clauses, (HY2-4), contributes a literal to the result. Example HY3, Literal Merging Both standard and linked hyperresolution are more tolerant of literal merging than is UR-resolution (standard or linked). The reason rests with the termi nation condition that permits any number of positive literals in the resolvent.
1084
Collected Works of Larry Wos
Testing for literal merges can occur after the unifier has been applied and the deduction is otherwise complete. This is in marked contrast to UR-resolution in which the test for merges - if merging were allowed - might be necessary several times during the search for appropriate clauses and unifiers needed to complete the application of the inference rule. We can illustrate merging with a small modification to Example HY2. Changing the third literal of clause (HY24) from R(c) to R(x), we see that a single literal merge will occur, resulting in the linked hyperresolvent R(b). Properties of Linked Hyperresoltttion Standard hyperresolution, which is simply linked hyperresolution with link depth 0, requires that the nucleus contain at least one negative literal, that all of the negative literals and none of the positive literals of the nucleus be paired, and that the satellites all be positive clauses each of which has exactly one of its literals paired. The literals of the hyperresolvent are the appropriate (merged) instances of the positive literals of the nucleus and of the unpaired literals of the satellites. Linked hyperresolution is subject to the same requirements for nuclei and satellites. As with standard hyperresolution, a successful application of linked hyper resolution implies the existence of a type of pairing set (discussed in detail in Section 3). The property that distinguishes linked hyperresolution from standard hyperresolution is the permission to pair a negative literal in the nucleus with a literal in another nonunit clause, a link, that contains negative literals. The definition requires that all of the negative literals of a link be paired and that exactly one of the positive literals be paired. The clauses (clause occurrences) that are the hypotheses of a successful application of linked hyperresolution can be partitioned into disjoint sets, the nucleus, the satellites, and the (possibly empty set of) links. The nucleus is that unique clause (occurrence) that contains no paired pos itive literals. The satellites are precisely the positive clauses. The remaining clauses are the links. Links contain exactly one paired positive literal and at least one negative literal. Linking clauses share properties with both the nucleus and the satellites. Each link shares the properties with the nucleus of requiring that it contain at least one negative literal and that all of its negative literals be paired. Each link shares the properties with satellites of requiring that it contain at least one positive literal and that exactly one of its positive literals be paired. Each literal in a linked hyperresolvent is an instance either of a positive lit eral in the nucleus or of an unpaired positive literal in a satellite or link. Since the nucleus might contain no positive literals at all, and the links and satellites might contain no unpaired positive literals, linked hyperresolution may succeed in deducing the empty clause. In contrast to linked UR-resolution, linked hyper resolution permits literal merging after the unifier is applied to the appropriate
The Linked Inference Principle, I
1085
literal pairs. A merge may involve literals that were originally from different clauses or from the same clause. 2.3
LINKED BINARY RESOLUTION
To complete the picture, we illustrate linked binary resolution with the following example. Example BR1, Linked Binary Resolution Clauses: (BR1-1) (BR1-2) (BR1-3) (BR1-4) (BR1-5)
-Q4 1 R4 -Q3 1 Q4 1 R3 -Q2 1 Q3 -Ql 1 Q2 Ql 1 Rl 1 R2
Inference Tree:
[-Q4 I
R4]
i
[-Q3 I
Q4
R3]
I
[-Q2
Q3]
l I
[-Q1 1
CQl
Q2] Rl
R2]
Linked Binary Resolvent: Rl | R2 | R3 | R4 Clauses (BR1-1) and (BR1-5) are the parents of the deduced clause. The remaining clauses are the links, which form a single chain between the parents. We note that both parents and one link contribute to the deduced clause. The link depth of this application of linked inference is 3. The deduction size is 4. Properties of Linked Binary Resolution Standard binary resolution, which is linked binary resolution with link depth 0, pairs exactly one literal from each of two parent clauses. The literals of the binary resolvent are the appropriate instances of the unpaired literals. As with standard binary resolution, a successful application of linked binary resolution implies the existence of a type of pairing set (discussed in detail in Section 3). The property that distinguishes linked binary resolution from
1086
Collected Works ofL&rry Wos
standard binary resolution is the permission to pair the single paired literal of a parent with a literal in a link, forming a single chain of links between the parent clauses. The literals of the linked binary resolvent are the appropriate instances of the unpaired literals in the parents and links. The clauses (clause occurrences) that are the hypotheses of a successful ap plication of linked binary resolution can be partitioned into a set of exactly two parents and a (possibly empty) set of links. The parents are those unique clauses (clause occurrences) that contain exactly one paired literal. The remain ing clauses are the links, each containing exactly two paired literals. Since the parents may be unit clauses, and since the links may contain exactly two literals each or the set of links may be empty, linked binary resolution may succeed in deducing the empty clause. Also, as with linked hyperresolution, linked binary resolution permits literal merging after the unifier is applied to the appropriate literal pairs.
3
The Linked Inference Principle
The linked inference principle, formulated mainly to provide a theoretical basis and uniform framework for deriving both linked and standard inference rules, is a principle of reasoning that can be applied to a set of hypotheses in the form of clauses to yield a sound conclusion in the form of a clause. As we shall see, each application of the principle can be identified with a corresponding pairing set. To guarantee the soundness of the conclusions yielded by applying the principle, various conditions (to be discussed in this section) must be met by the pairing set that captures the actions of the particular application of the linked inference principle. The interest in this principle rests with its use to capture pedagogically un der a single concept many of the (ordinarily) disparate aspects of automated reasoning. Indeed, the principle provides sufficient properties to capture, under appropriate constraints, both standard and linked inference rules, proof by con tradiction as a single step of reasoning, the type of reasoning found in Prolog, and the type of reasoning that combines in a single step literal-oriented reason ing with term-oriented reasoning that emphasizes equality. Such constraints can be viewed as setting various parameters governing the application of a single principle of reasoning. We introduce the principle in stages. The first stage accounts for resolution alone, ignoring issues of literal merging and factoring. The first stage is suf ficient to capture formally the linked versions, presented informally earlier, of three standard inference rules of interest: UR-resolution, hyperresolution, and binary resolution. Although now defined formally as instances of the linked in ference principle, each rule is viewed in the context of its corresponding standard version. The second stage extends the linked inference principle to account for literal merging and factoring. The third stage extends the principle to account
The Linked Inference Principle, I
1087
for term-oriented reasoning that emphasizes equality. This last stage is briefly introduced here, with the detailed treatment presented in a future paper. In keeping with mathematics and logic, we provide the appropriate abstrac tion here, drawing no conclusions concerning the practical value or the feasibility of implementing the principle. In Section 5 we give some details concerning our current implementation and give in Section 6 some highlights of our experimen tation. We note that we have not yet addressed the problem of implementing the principle in its full generality. A direct implementation of the linked inference principle would require the program, given a set of clause occurrences and the choice of inference rule or rules, to directly seek appropriate pairing sets and unifiers. In contrast, our current approach to applying linked inference rules is driven by the selection of a single clause followed by the search for appropriate clauses dictated by the choice of inference rule. Therefore, our use of linked in ference rules does not mirror the direct use of the linked inference principle; the corresponding pairing set is present implicitly only. Several of the properties and conditions that guarantee the integrity of the linked inference principle are either identical to or quite similar to those pre sented in ref. [2]. (There also are similarities to results in refs. [4] and [13].) In fact, the soundness results for the first two stages of the principle are conse quences of the key theorem presented in ref. [2]. We note, however, that where Andrews uses his theorem as the basis for a refutation procedure relying on a search for matings, our interest here is the development, implementation, and testing of a new class of inference rules. To avoid any confusion, we note that the focus of linked inference differs from that of matings, for the former empha sizes the generalization of various types of reasoning and the role of individual deduction steps, where the latter emphasizes the role of proof as a whole. In addition, an integral part of linked inference is the study and use of various types of strategy. Indeed, our interest in and study of linked inference rest in part with the objective of capturing certain strategic and reasoning aspects of mathematical research. In a mathematics proof, for example, one frequently finds in a single step of reasoning an instance of combining resolution-oriented with equalityoriented reasoning. Such reasoning steps, which can be captured by an applica tion of the appropriate linked inference rule, clearly requires far more than the pairing (or the mating) of literals. Since, as is the case for various well-known inference rules, more than one copy of a given clause may participate in a single deduction, we focus on a set S of clause occurrences rather than clauses. Similarly, to cope with the possible presence of a literal or term in more than one clause or clause occurrence, we are concerned with literal and term occurrences.
Collected Works of Larry Wos
1088
3.1
STAGE 1
As shown by example in the preceding sections, the object of those linked in ference rules that are literal oriented is to select a set S of clause occurrences and find (if possible) and apply a unifier in such a way that literals are paired, unified, and canceled. If such a unifier is found and applied, a linked resolvent is obtained by taking the union of the corresponding instances of the unpaired literals. The differences among the various linked inference rules are reflected in the number and type of clause occurrences in S, the number of unpaired literals, and the properties of the paired and unpaired literals. From a more abstract viewpoint, the differences among the various linked inference rules are captured by the properties (defined in this section) shared by the members of the corresponding class of pairing sets. Indeed, specific linked inference rules can be defined in terms of such properties. Even further, a given pairing set, if certain conditions are satisfied, represents (corresponds to) a sound application of a linked inference rule. DEFINITION. Let S be a nonempty set of clause occurrences. The unordered pair (Li, L2) is a clash element of type 1 for 5 if and only if L\ and L2 are literal occurrences appearing in distinct clause occurrences of S, are of opposite sign, and (ignoring sign) are unifiable. The literal occurrences Lj and L2 are said to be paired. Pairing sets are fundamental to the definition of the linked inference princi ple. We present here a definition that includes clash elements of type 1 only but that is sufficient for stage 1 of our development of the linked inference princi ple. The more general definition presented later includes clash elements, factor elements, and equality elements; it also captures literal merging, factoring, and term-oriented reasoning that emphasizes equality. DEFINITION. Let S be a nonempty set of clause occurrences. A pairing set, Ps> of type 1 is a finite set of clash elements of type 1 for S. When the underlying set 5 is understood, we simply refer to P. By definition, the literals of each clash element in a pairing set are unifiable (ignoring sign). In order for a pairing set to represent a single deduction, the clash elements must, in addition, be simultaneously unifiable under a single substitution. DEFINITION. A pairing set P of type 1 is clashable if and only if there exists a unifier a such that each pair of literals in P unifies (ignoring sign) under a. A clashable pairing set corresponds to a (possibly large) step of reasoning formally, an application of a linked inference rule - in the sense that each clash element of a pairing set indicates a single binary resolution step.
The Linked Inference Principle, I
1089
Example EX7, Clashable Pairing Sets The set of clauses (EX7-1) (EX7-2) (EX7-3)
-P(x.y) I -Q(x,y) I R(x,y) P(a,w) Q(z,b)
together with the pairing set {(P(a,w),-P(x,y)), (Q(z,b),-Q(x,y)) } corresponds to the deduction by standard UR-resolution of the clause R(a, b). The global unifier is a = {b/w,a/x,b/y,a/z}. The corresponding inference tree follows. [-P(x.y) I [P(a,w)]
-Q(x.y) I [Q(z,b)]
R(x,y)]
For a second example, if we ignore the third clause and the second clash element in the given pairing set, we have the correspondent of an application of binary resolution. As we provide the needed formalism, we answer two questions concerning pairing sets of type 1. 1. Given a pairing set P, what is the result (deduced conclusion) of the corresponding reasoning step? 2. Under what conditions does a given pairing set P represent a sound rea soning step - a sound deduction of the corresponding result? At least for those discussed in the article, each application of a resolutionoriented linked inference rule can be interpreted as a sequence of binary resolu tion and factoring [30] steps. Therefore, informally, the result (deduced conclu sion) of the reasoning step that corresponds to a given pairing set can be ob tained by using such a procedural interpretation - for example, by programming the corresponding sequence of binary resolution and factoring steps. Although we occasionally give such procedural interpretations for pedagogical purposes, we stress that a procedural interpretation is nothing more than a possible im plementation of an application of a linked inference rule. Formally, the result that corresponds to a pairing set is defined by the following. D E F I N I T I O N . Let Ps be a clashable pairing set of type 1 with a most general unifier a. The linked resolvent corresponding to P is the union (after cr is applied) of the unpaired literal occurrences of S\ the unpaired literals are those literal occurrences not appearing in a clash element of type 1 of P. Let us determine under what conditions a given pairing set P of type 1 is sound - represents a sound deduction of its corresponding linked resolvent. From an intuitive viewpoint, we note that it suffices that P have a sound procedural
Collected Works of Larry Wos
1090
interpretation that results in the linked resolvent. Formally, it suffices that P satisfy certain properties, which we present in this section. (We also present additional properties that capture the intended spirit of linked inference.) Several properties of interest can be presented in terms of deductive chains. DEFINITION. A deductive chain in the pairing set Ps is a sequence [Li, L2,..., £* with k even and k > 0, consisting of literal occurrences from P such that (1) for each odd i from 1 to k — 1, literals L< and Li+i are paired in P; (2) for each odd i and j from 1 to k — 1, with i ^ j , the unordered pairs (Li, Li+\) and (Lj, Lj+i) are not equal; and (3) for each even i from 2 to k — 2, L< and Li+i are distinct literal occurrences appearing in the same clause occurrence in S. The first and second conditions together ensure that, in addition to being a sequence of literal occurrences, the sequence also is a sequence of distinct literal pairs from P. These pairs represent the literal clashes appearing on the chain. When considered with the first two conditions, the third condition ensures that adjacent literal pairs - a four-literal subsequence beginning with an odd i- in the sequence represent two binary resolutions involving a common clause occurrence. We note that a deductive chain may contain subchains that themselves are deductive chains. For those familiar with graph theory, we note that a deductive chain is simply a path in the appropriate 'clause graph'. The vertices in such a graph correspond to literal occurrences. There exist two types of edge in such a graph, those that connect literals in the same clause occurrence and those that connect paired literals. We often refer to the clause occurrences that appear on a deductive chain. When we do so, we simply mean the clause occurrences that have literals on the chain. We also refer to the literals at the ends of a deductive chain to designate literals L\ and L* in the definition. In general, the deductive chains of interest are those that begin with a literal in the nucleus of some specific linked inference step and end with a literal in a satellite of that step. Example EX8, Deductive Chains Clauses: (EX8-1) (EX8-2) (EX8-3) (EX8-4)
P -P I Q I R -Q I S -S
The Linked Inference Principle, I
1091
Inference Tree: [-P
Q
I
I
[P]
[-Q
RJ S]
I [-S] Linked UR-Resolvent: R Clause (EX8-2) is the nucleus, clause (EX8-3) is a link, and the remaining clauses are satellites. The pairing set for this deduction is P = {(P,-P), (Q,-Q), (S,-S)}. The deductive chains in P are the following. [P, -P] [-P, P] [Q, -Q] C-Q, Q] [S, -S] [-S, S] [P, - P , [-Q, Q, [Q, - 0 , [-S, S,
Q, -Q] - P , P] S, -S] -Q, Q]
[p, - p , q, -q. s , -S]
[-s, s, -q, q, - P , P] The deductive chains of particular interest - namely, those beginning with a literal of the nucleus and ending with a satellite - are the following. [-P, P] [Q, - Q , S, -S] In order to guarantee that a pairing set of type 1 is sound - corresponds to a sound deduction - the indicated resolution steps must be 'compatible'. Specifically, the pairing set must satisfy the property that no subset of clash elements precludes the membership of any other clash element. Example EX9, Compatibility of Resolution
Steps
Let us consider the pairing set { (P,-P), (Q,-Q) } and the following clauses. (EX9-1) (EX9-2)
P I q I R -P I - q
This pairing set clearly does not correspond to a sound deduction of the linked resolvent R - the indicated resolution steps are not compatible, for the subset consisting of (P,-P) precludes the membership of the clash element (Q,-Q).
Collected Works of Larry Wos
1092
Example EX10, Compatibility of Resolution Steps, Another Example For a slightly more complex example, the resolution steps indicated in the pair ing set { (P,-P), (S,-S), (Q,-Q) } are not compatible for the following clauses. (EX10-1) (EX10-2) (EX10-3)
P I Q IR -P I S -S I -Q
Such incompatibilities can be characterized in terms of the existence of cycles in the pairing set. DEFINITION. The deductive chain [Li,Z^, ...,Lfc] in the pairing set Ps is a cycle if and only if literal occurrences L\ and L* appear in the same clause occurrence in S. The pairing set Ps is cyclic if and only if it contains at least one cycle. The pairing set P is acyclic if and only if it is not cyclic. For example, the pairing sets given in Examples EX9 and EX10 are cyclic, which can be seen by considering the respective deductive chains [P, -P, -Q, Q] and [P, -P, S, -S, -Q, Q]. To be of interest, a pairing set must be acyclic. We give three additional properties which - although not technically required for soundness - we require to preserve the intended spirit of stage 1 of the linked inference principle. Informally, a pairing set Ps of type 1 must satisfy the following properties. 1. The pairing set corresponds to at most one deduction. 2. Every clause occurrence in 5 participates in the application of the inference rule. 3. A literal occurrence appears in at most one clash element of P. PROPERTIES 1 and 2: The pairing set corresponds to at most one deduc tion, and every clause occurrence in S participates in the application of the inference rule. Example EX11, Motivation for Properties 1 and 2 Let us consider the following set S. (EX11-1) (EX11-2) (EX11-3) (EX11-4)
P -P I -Q R -R | Q
Although soundness is not the problem, we disallow the pairing set { (-P,P), (R,R) }. From a procedural view, one can see that the given pairing set represents
The Linked Inference Principle, I
1093
more than one deduction, namely, the deduction of -Q and that of Q. Formally, allowing consideration of the given pairing set would admit the clause -Q I q as the corresponding linked resolvent, the union of the unpaired literals. The pairing set { (-P,P), (-QiQ). (-R>R) }, however, is allowed; it corresponds to the deduction (by an application of linked hyperresolution) of the empty clause. The case for property 2 is similar - the literals of clauses that do not participate in the application of the linked inference rule will appear in the linked resolvent. The appropriate formal concept for distinguishing between the desirable and undesirable pairing sets in this context, and hence capturing properties 1 and 2, is the following. DEFINITION. A pairing set Ps is connected if and only if, for any distinct clause occurrences C and D in S, there exists a deductive chain [Li, L^,..., L>k] in 5 such that literal occurrences L\ and Lfc appear, respectively, in clause occurrences C and D. To be of interest, a pairing set must be connected. We note that the property of being connected is not actually required for soundness. The only consequence of dropping the requirement is that a linked resolvent may consist of the union of literals corresponding to separate con clusions. Although adding arbitrary literals to a clause is sound, we require the property of being connected in order to preserve the spirit of the linked inference principle. One may recognize in the preceding definitions a direct analogy to concepts in graph theory. Indeed, it is possible to give formal graph-theoretic definitions for the desired properties in terms of appropriate 'resolution graphs'. PROPERTY 3: A literal occurrence appears in at most one clash element of P. Example EX12, Motivation for Property 3 Let us consider the following set S. (EX12-1) (EX12-2) (EX12-3)
P(x,y) I Q(x.y) -P(a,w) I R(w) -P(z,b) I S(z)
We disallow the pairing set P= { (P(x,y),-P(a,w)), (P(x,y),-P(z,b)) } because the literal occurrence P(x,y) appears in more than one clash element. We note that no procedural interpretation exists that permits the literal occur rence P(x, y) to resolve with the -P literals of both clause (EX12-2) and clause (EX 12-3). The following formal property is precisely what is needed to capture property 3.
Collected Works of Larry Wos
1094
DEFINITION. The pairing set Ps is locally disjoint if and only if no literal occurrence of S appears in more than one clash element in P. To be of interest, a pairing set must be locally disjoint. We note that, for acyclic pairing sets of type 1, the property of being lo cally disjoint is not required for soundness. For example, the pairing set P in the preceding example is acyclic, and the deduction of its corresponding linked resolvent (EX12-4)
Q(a,b) I R(b) | S(a)
is sound. To see that the deduction is sound, consider the clause that results from applying binary resolution to clauses (EX12-1) and (EX12-2). Clause (EX12-4) follows from the resulting clause by applying a substitution - specifically the substitution required for the original pairing set P - and by adding the literal S(b) (which is a sound operation). The soundness of the general case follows similarly - the linked resolvent corresponding to a pairing set that is not locally disjoint always can be deduced from the linked resolvent corresponding to a pairing set that is locally disjoint by applying a substitution and adding literals. Nevertheless, we require the property of being locally disjoint to preserve the spirit of the linked inference principle. The property of being locally disjoint hints at a related property, that of a literal occurrence being paired with at most one other literal occurrence. Indeed, for pairing sets of type 1 - where clash elements are pairs of single literal occurrences - these two properties are equivalent. A distinction between these two properties is made, however, in stage 2 of the linked inference principle (presented in Section 3.3), which extends stage 1 to account for literal merging [1] and factoring [30]. In this case, clash elements are defined to be pairs of sets of literal occurrences (indicating literal merges), and literal occurrences are therefore permitted to be paired with several other literal occurrences. With the property of being clashable, the simultaneous presence of the given formal properties is sufficient to ensure the soundness of pairing sets of type 1 and also sufficient to capture the spirit of stage 1 of the linked inference principle. DEFINITION. The pairing set Ps of type 1 is an admissible pairing set of type 1 if and only if P is nonempty, clashable, acyclic, connected, and locally disjoint. THEOREM. Let S be a set of clause occurrences, Ps be an admissible pairing set of type 1, and a be a most general unifier for the pairs in P. The linked resolvent corresponding to P, the single clause consisting of the union of the unpaired literals of S after sigma is applied, is a logical consequence of S. The proof of this theorem follows as a trivial consequence of the corresponding theorem for stage 2; see Section 3.3.
The Linked Inference Principle, I
3.2
1095
DEFINITIONS OF SPECIFIC LINKED INFERENCE RULES
In this section, we define linked versions of UR-resolution, hyperresolution, and binary resolution, each as an application of the linked inference principle (stage 1). For each linked inference rule, taking into account the possible presence of linking clauses, we adopt terminology that naturally extends the terminology used for the corresponding standard version of the rule. We also discuss various properties that follow from the definitions. DEFINITION. The pairing set Ps of type 1 is an application of linked URresolution if and only if P is admissible and exactly one literal occurrence ap pearing in the members of S is unpaired. We adopt the following terminology for linked UR-resolution. By definition, the clause occurrence containing the single unpaired literal is the nucleus, the unit clauses are the satellites, and the remaining clauses are the links. We note that the partition of S into nucleus, satellites, and links is uniquely determined by the pairing set P. Linked UR-resolution satisfies the following properties. 1. The nucleus is a nonunit clause having the unpaired literal and at least one paired literal. The latter property follows from the properties that P is nonempty and connected. 2. There exists at least one unit clause occurrence (satellite) in S. Otherwise, an application of the linked inference rule cannot possibly result in a unit clause. (We note that literal merging and factoring are not permitted.) 3. The conclusion is a unit clause, an instance of the single unpaired literal. 4. Linked UR-resolution captures standard UR-resolution precisely when the set of linking clauses is empty. 5. All literals in links are paired, since the nucleus contains the only unpaired literal. Therefore, links do not contribute literals to the deduced clause. 6. Linked UR-resolution has the following recursive property, applying any indicated binary resolution step to the pairing set P either results in an empty pairing set, corresponding to the final linked UR-resolvent, or re sults in a pairing set that is itself an application of linked UR-resolution. (Applying an indicated binary resolution step to the pairing set Ps pro duces a new pairing set Ps by the following procedure. Choose a clash element (Li,I>2) from Ps, and let a be a most general unifier for L\ and Z,2- Say L\ and L2 appear in clause occurrences C\ and C2, respectively. Let Cz be the union of C\ and Ci minus the literal occurrences Li and L-iLet SfS' be constructed from 5by deleting clause occurrences C\ and C2, adjoining the single clause occurrence C3, and applying a. We note that
Collected Works of Larry Wos
1096
this last step is identical to performing the indicated binary resolution step on clause occurrences C\. and Ci- Finally, let P' be constructed from P by deleting the chosen clash element and by applying
LT(v,l) | LT(N,v) I IB(A,w) -LT(ul.vl) | -LT(vl.ul) -LT(u2,v2) I -LT(v2,u2) LT(1,J) -LT(x.y) I -LT(y,z) I LT(x,z) LT(J,K) LT(K,N)
Inference Tree: [LT(v,D I [-LT(ul.vl)
-LT(vl.ul)] I [LT(l.J)]
LT(N.w) I [-LT(x.y)
IB(A,w)]
-LT(y,z) LT(x,z)] I I [LT(J,K)] [-LT(u2,v2) -LT(v2,u2)] I [LT(K.N)]
Linked UR-Resolvent: IB(A,J) The pairing set for this example is {(LT(w,l),-LT(ul,vl)), (LT(1,J), -LT(vl,ul)), (LT(N,w),-LT(x,y)), (LT(J,K),-LT(y,z)), (LT(x,z),-LT(u2,v2)), (LT(K,N),-LT(v2,u2))}. The global unifier is a = {J/ul, N/u2, 1/vl, K/v2, J/w, N/x, J/y, K/z). Clause (UR7-1) is the nucleus, clauses (UR7-4), (UR7-6), and (UR7-7) are satellites, and the remaining clauses are links. The link depth is 2, and the deduction size is 6. DEFINITION. The pairing set Ps of type 1 is an application of linked hyperresolution if and only if P is admissible and the following properties hold: (1) there exists exactly one clause occurrence in S, having at least one negative literal, such that all of its negative literals and none of its positive literals are paired; (2) there exists a nonempty subset of clause occurrences in S such that each member of the subset consists of positive literals only and such that each
The Linked Inference Principle, I
1097
member has exactly one of its literals paired; and (3) the remaining clause oc currences in S are mixed (have both positive and negative literals), and each has exactly one positive literal paired and all of its negative literals paired. By definition, the three categories of clause just given correspond, respec tively, to the nucleus, satellites, and links of an application of linked hyperresolution. We note that the partition of S into nucleus, satellites, and links is uniquely determined by the pairing set P. Linked hyperresolution satisfies the following properties. 1. The nucleus contains at least one negative literal, since P is connected. The nucleus might, however, have no positive literals. 2. The deduced clause (possibly the empty clause) consists of positive literals only, since all negative literals are paired. 3. A link contributes literals to the deduced clause precisely when the link contains more than one positive literal; such literals may be merged with other literals in the linked hyperresolvent. 4. Linked hyperresolution captures standard hyperresolution precisely when the set of linking clauses is empty. 5. Linked hyperresolution has a recursive property analogous to that of linked UR-resolution, namely, applying any indicated binary resolution step to the pairing set P either results in an empty pairing set, corresponding to the final linked hyperresolvent, or results in a pairing set that is itself an application of linked hyperresolution. Example HY4, Linked Hyperresolution We revisit here the inference presented in Example HY2. This time we explicitly list the two occurrences of clause (HY2-2) that participate in the deduction, and we rename the variables in the clauses so that different clause occurrences have distinct variable names. Clauses: (HY4-1) (HY4-2) (HY4-3) (HY4-4) (HY4-5)
-P(a,x) I -Q(x) I R(x) P(y,b) P(z,b) -S(u,v) I Q(v) -P(wl,w2) | S(w2,wl) I R(c)
Collected WorJcs of Larry Wos
1098 Inference Tree: [-P(a.x) I [P(y,b)]
-Q(x) I [Q(v) [-P(wl,w2) I [P(z,b)]
R(x)] -S(u,v)] I S(w2,wl)
R(c)]
Linked Hyperresolvent: R(b) — R(c) The pairing set is {(-P(a,x),P(y,b)), (-Q(x),Q(v)), (-S(u,v),S(w2,wl)), (P(wl,w2), P(z,b))}. The global unifier is a = {b/u, b/v, b/wl,b/w2, b/x, a/y, b/z). Clause (HY4-1) is the nucleus for this application of the inference rule, and the two distinct clause occurrences (HY4-2) and (HY4-3) are the satellites. The clauses (HY4-4) and (HY4-5) are the linking clauses. The link depth is 2, and the deduction size is 4. We note that one of the linking clauses (HY4-5) con tributes a literal to the result. DEFINITION. The pairing set Ps of type 1 is an application of linked binary resolution if and only if P is admissible and the following properties hold: (1) exactly two clause occurrences in 5 contain a single paired literal, and (2) each of the remaining clause occurrences in S contains exactly two paired literals. By definition, the two clause occurrences that contain a single paired literal are the parents, and the remaining clauses are the links. Occasionally it will be convenient to use terminology for linked binary resolution that is consistent with the terminology used for the other linked inference rules. For this reason, we shall arbitrarily refer to one of the parents of the deduced clause as the nucleus and the other parent as the satellite. Linked binary resolution satisfies the following properties. 1. The deductive chain in P from the paired literal in one parent to the paired literal in the other parent consists of all the literal pairs in P. In other words, a linked binary resolution step consists of a single deductive chain between the parents. 2. Linked binary resolution captures standard binary resolution precisely when the set of linking clauses is empty. 3. A link contributes literals to the deduced clause precisely when the link contains more than two literals; such literals may be merged with other literals in the linked binary resolvent. 4. A parent contributes literals to the deduced clause if and only if the parent
The Linked Inference Principle, I
1099
contains more than one literal; such literals may be merged with other literals in the linked binary resolvent. 5. The conclusion may be the empty clause. 6. Linked binary resolution has a recursive property analogous to that of linked UR-resolution, namely, applying any indicated binary resolution step to the pairing set P either results in an empty pairing set, corre sponding to the final linked binary resolvent, or results in a pairing set that is itself an application of linked binary resolution. Example BR2, Linked Binary Resolution Clauses: (BR2-1) (BR2-2) (BR2-3) (BR2-4)
LT(w.l) I LT(N,w) I IB(A,w) -LT(x,y) I -LT(y,z) I LT(x,z) -LT(u.v) | -LT(v,u) LT(J,N)
Inference Tree: [LT(w,D
LT(N.w)
IB(A,w)]
I I
[-LT(x.y)
-LT(y,z)
LT(x,z)]
1 [-LT(u.v)
-LT(v,u)]
1 [LT(J.N)]
Linked Binary Resolvent: LT(w,l)
LT(w,J) — IB(A,w)
The pairing set for this example is {(LT(N,w), -LT(x,y)), (LT(x,z),-LT(u,v)), (LT(J,N),-LT(v,u))}. The global unifier is a = {N/u, J/v, N/x, w/y, J/z). Clauses (BR2-1) and (BR2-4) are the parents. The remaining clauses are the links. The link depth is 2, and the deduction size is 3. We note that one parent and one link contribute to the deduced clause. For convenience and for purposes of strategy, implementation, and experi mentation that will bo described in Sections 4, 5, and 6 respectively, we define the following two measures for pairing sets. DEFINITION. Let the pairing set Ps be admissible, and let the clause occur rences in S be partitioned into a single nucleus, a nonempty set of satellites, and a (possibly empty) set of links. The link depth of P with respect to the partition is the largest number of linking clauses that appear on a single deductive chain starting from a literal in the nucleus.
Collected Works of Larry Wos
1100
We note that the link depth is 0 precisely when there exist no links. We also note that link depth is uniquely determined by the pairing set in linked URresolution, linked hyperresolution, and linked binary resolution - the partition is implied in each of these cases. DEFINITION. The deduction size of the pairing set P is the number of pairs in P. Informally, the deduction size can be considered as the number of binary resolution steps that would be needed to complete the corresponding deduction. Example EX13, Link Depth and Deduction Size Here, we focus on earlier examples, UR4, HY4, and BR1. In Example UR4, the deduction size is 6, and the link depth is 3, which follows from considering the deductive chain [Ql, -Ql, Q2, -Q2, Q3, -Q3, Q4, -Q4]. In Example HY4, the deduction size is 4, and the link depth is 2, which follows from considering the deductive chain [-Q(x), Q(v), -S(u,v), S(wl,w2), -P(w2,wl), P(z,b)]. In Exam ple BR1, the deduction size is 4, and the link depth is 3, which follows from considering the deductive chain [Ql, -Ql, Q2, -Q2, Q3, -Q3, Q4, -Q4]. 3.3
STAGE 2, LITERAL MERGING AND FACTORING
In this section, we discuss the extension of the linked inference principle to include literal merging [1] and factoring [30]. The distinction between literal merging and factoring varies somewhat in the literature. We take literal merging to be no more than the collapsing of two or more identical literals in a clause, a direct consequence of the definition of a clause as a set of literals. Factoring is an inference rule that applies a most general unifier for two or more literals in a clause. Factoring, then, reduces to literal merging once a unifier applies. Example EX14, Literal Merging Clauses: (EX14-1) (EX14-2)
-P(x) I Q(x) P(a) I Q(a)
I Q(a)
Resolvent: Q(a) Two merges occur in this example. One merge takes place because identical literal occurrences are 'brought into' the same clause as a result of the resolution step. The other merge takes place solely as a consequence of the substitution made for the resolution step. Example EX15, Factoring
The Linked Inference Principle, I
1101
Clauses: (EX15-1) (EX15-2)
-P(x) I -P(y) P ( u ) I P(v)
These two clauses have factors -P(x) and P(u), respectively, which conflict as units. To account for literal merging and factoring, for stage 2, we add two defi nitions to extend the preceding theory. The first extension is to the definition of clash element. The second permits factor elements to be included in pairing sets. DEFINITION. Let She a nonempty set of clause occurrences. The set {Li, Li, ■■■, £*} is a merge set of type 2 for S if and only if the Li are literal occurrences appearing in S, all are of the same sign, and all are simultaneously unifiable. D E F I N I T I O N . Let S be a nonempty set of clause occurrences. The unordered pair (L,M) is a clash element of type 2 for S if and only if L and M are merge sets of type 2 for 5, the literals in L are opposite in sign from the literals in M, and all the literals (ignoring sign) are simultaneously unifiable. Each ij € L is said to be paired with eachTO,-€ M . Merge sets play two roles in stage 2 of the linked inference principle, first, as part of clash elements as just defined, and second, as members of pairing sets defined for stage 2 shortly. For clarity, we give a second definition to distinguish these contexts. D E F I N I T I O N . Let 5 be a nonempty set of clause occurrences. A factor ele ment of type 2 for S is a merge set of type 2 for 5. The procedural interpretation of a clash element (L,M) of type 2 is the following: the literal occurrences {li} € L merge, the literals {mi} € M merge, and then the resolution of L and M takes place. The procedural interpretation of a factor element L of type 2 is the following: the literal occurrences l, € L merge, and the resulting literal appears in the final linked resolvent corresponding to the pairing set. We note that factor elements capture a natural generalization of factoring, which is defined formally as the unification of exactly two literal occurrences. D E F I N I T I O N . Let 5 be a nonempty set of clause occurrences. A pairing set Ps of type 2 is a finite set of clash elements of type 2 and factor elements of type 2 for S. We note that every pairing set of type 1 corresponds directly to a pairing set of type 2 in the following way: each clash element (L, M) of type 1, which is a pair of literal occurrences, corresponds to the clash element ({L}, {M}), which
Collected Works of Larry Wos
1102 is a pair of singleton sets of literal occurrences.
DEFINITION. A pairing set P of type 2 is clashable if and only if there exists a unifier sigma such that (1) for each clash element (L, M) in P, all of the li 6 L and nij € M unify (ignoring sign) under a, and (2) for each factor element L in P, all of the li € L unify under a. The definition of linked resolvent remains the same as in stage 1, namely, the union of the unpaired literals with the most general unifier for the pairing set applied. However, for the extension to pairing sets of type 2, we must revise our definition of admissible pairing set. The desired soundness result then follows from Theorem 2 in ref. [2]. DEFINITION. The pairing set Ps of type 2 is an admissible pairing set of type 2 if and only if P is nonempty, clashable, locally disjoint, and connected, and every cycle in P contains a merge (a literal occurrence that is paired with at least two distinct literal occurrences in the cycle). Example EX16, Merges and Cycles To illustrate the relationship of merges and cycles, we consider three pairing sets for the clauses given in Example EX15. Pairing Set 1: {({-P(x)},{P(u)})} Pairing Set 2: {({-P(z)},{P(u)}),({-P(y)},{P(v)})} Pairing Set 3: {({-P(z), -P(y)}, {P(u), P(«)})} The first pairing set corresponds to the following deduction. (EX16-1)
-P(y) I P(v)
The pairing set contains no merges or cycles, and the deduction is sound. The second pairing set contains two clash elements, and its corresponding linked resolvent is the empty clause. The pairing set is not sound, however, for it contains a cycle that contains no merges. The third pairing set corresponds to a sound deduction of the empty clause. Although this pairing set contains cycles, all is acceptable, for each cycle contains a merge. For example, at least one literal in the cycle [-P(x), P(u), P(v), -P(y)] - in fact every literal - is paired with more than one other literal in the cycle. THEOREM. Let S be a set of clause occurrences, Ps be an admissible pairing set of type 2, and sigma be a most general unifier for the pairs in P. The linked resolvent corresponding to P, the single clause consisting of the union of the unpaired literals ofS after sigma is applied, is a logical consequence ofS. The proof of this theorem is a simple consequence of Theorem 2 in ref. [2], which states that if there exists an acceptable mating, then 5 is unsatisfiable. In the special case where every literal occurrence in S is paired in P, admissibility
The Linked Inference Principle, I
1103
trivially implies that there exists an acceptable mating, and our theorem fol lows. For the general case, it suffices to show for soundness that there exists a resolution deduction of a clause that logically implies the linnked resolvent. The proof of the general case rests with the special case and with a simple property of resolution refutations. We begin by considering any resolution refutation. We then adjoin literals arbitrarily to the distinct clause occurrences that participate in the refutation and repeat the corresponding resolution steps that appeared in the original refutation. If no literal merges occur in intermediate results, then the refutation clearly becomes a deduction of the clause consisting of the ad joined literals with the appropriate unifier applied. If literal merges do occur, then the resulting clause logically implies the clause just described. This theorem captures the result for stage 1 trivially, for, by definition, admissible pairing sets of type 1 have no cycles. Although admissibility is sufficient to formally capture the soundness of pair ing sets, soundness is better understood in terms of dependencies between clash and factor elements of pairing sets. If one considers an application of a linked in ference rule implemented as a sequence of binary resolution and factoring steps, dependencies are constraints on that implementation. For example, a merge de pends on a clash if, procedurally, the clash is required to bring two literals into the same clause so that they can merge. Similarly, a clash depends on a merge if a literal is paired with more than one literal in a clash element. Soundness re quires that no conflicts exist among the dependencies. Specifically, a procedural interpretation exists such that all of the indicated merges and clashes can take place. Dependencies can be easily described in terms of pairing sets. A merge of literal occurrences L\ and L2 depends on every clash on a deductive chain between a literal in the clause occurrence containing L\ and a literal in the clause occurrence containing L 2 - A clash element depends on each of the literal merges specified in the merge sets of the clash element. Dependencies between specific merges and clashes can be interpreted as de pendencies between clash and factor elements of pairing sets. In particular, a factor or clash element E\ depends on a clash element Ei if and only if some merge specified in E\ depends on the clash specified by £'2. (Clash and factor elements cannot depend on factor elements, since the property of being locally disjoint ensures that a literal occurrence appearing in a factor element appears in no other clash or factor element.) In addition, dependencies between clash and factor elements are transitive. It follows that a pairing set is sound if and only if no cycles exist among the dependencies - no element depends on itself. The following examples illustrate the various types of dependencies that can occur. In these examples and for the remainder of this paper, when we need to distinguish between occurrences of otherwise identical literals, we subscript the literal with the number of the clause occurrence in which it appears. Also, we often itemize the distinct elements of a pairing set for easy reference.
Collected Works of Larry Wos
1104 Example EX17, No Dependencies Clauses: (EX17-1) (EX17-2) (EX17-3)
-P I q -Q I R -R I S
Pairing Set Elements: (EX17-A) (EX17-B)
( {Q}, -C-Q> ) ( )
We note that (EX17-A) and (EX17-B) are the elements of the pairing set {({Q}.{-Q». «R}.{-R})}Linked Resolvent: -P | S No dependencies exist in the pairing set for example EX17. Procedurally, as it turns out for this example, the two indicated resolution steps (EX17-A) and (EX17-B) can occur in either order with the same linked resolvent as the result. To illustrate certain subtleties, we consider another example in which no dependencies are present and yet, to obtain the given conclusion, the order in which the steps are applied is forced. Example EX18, No Dependencies, but Order Relevant Clauses: (EX18-1) (EX18-2) (EX18-3)
-P I Q I R P IQ -Q I R
Pairing Set Elements: (EX18-A) ( - P , P ) (EX18-B)
( -Q, Q 2 ) (-Q paired with Q from clause EX18-2 only)
Linked Resolvent: R | Q i By the definition of linked resolvent, literal Qi from clause (EX18-1) appears in the result because it is not paired. That only one occurrence of literal R appears in the result is a consequence of a clause (by definition) being a set of literals. Attempting to describe a procedural interpretation of this reasoning step as a sequence of binary resolution steps suggests the following. On the one hand, no dependencies exist; therefore, our intuition suggests that the binary resolution steps can occur in any order. On the other hand, the resolution step indicated
The Linked Inference Principle, I
1105
in the clash element (EX18-B) must occur first, for, otherwise, there would be an 'accidental', and incorrect, merge. Although a procedural interpretation of a pairing set must reflect any dependencies that exist, a lack of dependencies does not imply total flexibility in the choice of a procedural interpretation. (We note, however, that such 'accidental' merges result in clauses that subsume the defined linked resolvent [38].) Example EX19, Direct
Dependencies
Clearly, a clash element depends on the merges specified in that clash element. Let us consider the same clauses as in Example EX18, but with a different pairing set. Clauses: (EX19-1) (EX19-2) (EX19-3)
-P I Q I R P I Q -Q I R
Pairing Set Elements: (EX19-A) ( -P, P ) (EX19-B) ( -Q, Q j.Qa ) Linked Resolvent: R In this case, two dependencies exist. The clash indicated by element (EX19B) depends on the merge of Qi and Q2 specified in (EX19-B), and the merge in (EX19-B) depends on the clash indicated in (EX19-A). Interpreted as de pendencies between clash and factor elements, clash element (EX19-B) depends on clash element (EX19-A). No conflict (cycle) exists among the dependencies, and the application of linked inference could be implemented by executing the binary resolution step indicated by (EX19-A), followed by the binary resolution step indicated by (EX19-B). Example EX20, Direct Dependencies, Clauses: (EX20-1) (EX20-2) (EX20-3) (EX20-4)
P I Q -P I Q P I -Q -P I -Q
Pairing Set Elements: (EX20-A) ( P 1, -P 2 ) (EX20-B) ( P3, -P 4 ) (EX20-C) ( Qi.Qa. -Q3.Q4 )
Another
Example
Collected Works of Larry Wos
1106 Linked Resolvent: [ ], the empty clause
The clash in (EX20-C) depends on the merges in (EX20-C), and the merges in (EX20-C) depend on the clashes in both (EX20-A) and (EX20-B). Inter preted as dependencies between clash and factor elements, (EX20-C) depends on both (EX20-A) and (EX20-B). No conflict exists, and an implementation as the 'execution' of (EX20-A), followed by (EX20-B), followed by (EX20-C) yields the correct result. We stress here that the issue of dependencies is relevant to soundness only. Once the pairing set is determined to be sound, the result of the application of the corresponding inference rule follows directly from the definition of linked resolvent. The following example illustrates conflicts in dependencies. Example EX21, Dependencies That Conflict Clauses: (EX21-1) (EX21-2) (EX21-3)
P IQ -P I Q P ! -Q
Pairing Set Elements: (EX21-A) ( - P 2 , Pi,P 3 ) (EX21-B) ( -Q 3 , Qi,Q2 ) Linked Resolvent: [ ], the empty clause The merge in (EX21-A) depends on the clash (EX21-B), and the merge in (EX21-B) depends on the clash (EX21-A). These dependencies conflict, and the pairing set does not represent a sound deduction. (Formally, there exists a cycle that does not contain a merge. Consider, for example, the cycle [P3, -P2, Q2, -Q3].) Another potential problem exists concerning dependencies, but, as it turns out, other required properties solve it. Example EX22, Necessary Clash Does Not Appear Clauses: (EX22-1) (EX22-2) (EX22-3)
P IQ -P I Q -Q
Pairing Set Element: (EX22-A) ( -Q, q lt Qa )
The Linked Inference Principle, I
1107
The merge of Qi and Q2 depends on a clash that does not appear in the pairing set. We note, however, that the given pairing set is not connected, for no deductive chain in P exists connecting literal occurrences P and -P; indeed, [Qi. -Q> Q2] and [Qi, -Q, -Q, Q2] are not deductive chains. The pairing set P, therefore, is not admissible. It is fairly easy to see that admissible pairing sets cannot have such missing elements. 3.4
STAGE 3, EXTENDING THE PRINCIPLE TO INCLUDE EQUALITY
Stage 3 of the linked inference principle extends stage 2 to include both stan dard and linked versions of inference rules for equality-oriented reasoning - rules such as paramodulation [21], hyperparamodulation [32], and negative paramodulation [35]. By extending stage 2, the program has access to rules that permit chains of equality substitutions into a term and its descendants to be performed as a single reasoning step. In addition, stage 3 captures the type of reason ing that combines that found in resolution-oriented rules with that found in equality-oriented rules - the type of reasoning often found in mathematics. Be cause of space considerations, the lack of the corresponding implementation, and the current lack of experimental results, we briefly introduce the subject here and leave the detailed treatment for a later paper. Stage 3 includes extensions to the notion of a pairing set and related con cepts. For example, in addition to permitting clash and factor elements as de fined for stage 2, pairing sets of type 3 include equality elements, which represent standard binary paramodulation steps. To account for literal merges - of both into literals and from literals - equality elements indicate (binary) paramodula tion steps from sets of literal occurrences into sets of term occurrences. The extensions to the formalism required to capture equality-oriented rea soning add substantial complexity to the theory of linking. In particular, the issues of soundness and implementation are far more complicated for pairing sets of type 3 than for pairing sets of type 1 or type 2. For example, the issues concerning dependencies between pairing set elements and procedural interpre tations of pairing sets are far more subtle. Nevertheless, since equality-oriented inference rules offer far more deductive power for attacking problems in which equality plays a dominant or natural role, the added complexity needed to cap ture them is merited.
4
Strategy
To offer the needed reasoning power for even moderately interesting assignments, the chosen inference rule or rules must be controlled by the use of strategy. Linked inference rules are no exception. One might wonder why strategy is needed, since (as discussed in Section 1) our primary objective in formulating
1108
Collected Works of Larry Wos
linked inference rules is to increase the likelihood that the information retained by an automated reasoning program will be significant. Indeed, that likelihood is somewhat increased, for the use of linked inference rules, by permitting the program to take larger deductive steps, bypasses the need to explicitly consider so-called intermediate and less significant information. However, unless some constraint is placed on the actions of linked inference rules, their application will yield many of the smaller steps that one might wish to skip. (For example, every ordinary UR-resolvent also is a linked UR-resolvent.) In other words, merely having permission to take larger reasoning steps in no way guarantees that a program will deduce information that is sufficiently significant, nor does that permission guarantee that a program will perform with the desired effectiveness. Therefore, one must use strategy, both strategy to restrict and strategy to direct the application of linked inference rules. Although we shall discuss the value of and added latitude in the use of ex isting well-known strategies, we begin by presenting three new strategies each tailored to linked inference rules. The first strategy, the partitioning strategy, focuses on the clause occurrences that participate in applications of linked in ference rules. The second, the target strategy, is concerned with properties of the conclusions obtained with applications of linked inference rules. The third strategy, the depth-size strategy, is concerned with the size of reasoning steps that are permitted in applications of linked inference rules. Of these three new strategies, the target strategy is of particular interest, for it provides a means for using semantic criteria to filter the set of possible conclusions that might be drawn. In addition, the appeal of this strategy - as well as the partitioning strategy - rests with its indirect effect of reducing the likelihood of taking de duction steps that are too small. Although the definition of the target strategy does not necessitate the use of linked inference rules - in contrast to the other two new strategies which do - its use is far more effective with the choice of such inference rules. Because of the increased potential for redundancy - repeatedly deducing the same clauses - when linked inference rules are used, additional strategy to address this potential is of interest. In this context, we present two strategies for pruning the search space, respectively applications of subsumption and unit deletion. To complete our treatment of strategy, we turn to the use of the set of support strategy [31] and the use of weighting [16]. The added latitude one has in using either strategy contributes to the attractiveness of using linked inference rules. Although we present each of the various strategies as separate topics, we note that the choices of representation, inference rule, and strategy are strongly interrelated and best not, therefore, be made independently. In Section 6, we discuss some of these interrelations in the context of several experiments using our current implementation of linked UR-resolution.
The Linked Inference Principle, I
4.1
1109
T H E PARTITIONING STRATEGY
The clause occurrences that participate in any linked inference step can be partitioned into a nucleus, one or more satellites, and zero or more links. In the standard versions of UR-resolution and hyperresolution, the potential use of a clause as a nucleus or satellite is determined strictly by syntactic crite ria. Although similar syntactic restrictions apply to linked inference rules, such restrictions do not completely determine the designation for each clause. For ex ample, for applications of linked UR-resolution, there may exist nonunit clauses that can be used either as a link or as a nucleus. One way to restrict the application of linked inference rules is to restrict the use of specific clauses by choosing the appropriate designation. For an illustra tion, let us return to the first example presented in this paper. (EX1-1) (EX1-2) (EX1-3)
FEMALE(Gail) -FEMALE(x) | -MALE(x) -HASAJOBCx,nurse) I MALE(x)
If the application of the inference rule is not constrained by the use of some strategy, the conclusion (EX1-4)
-MALE(Gail)
and the conclusion (EX1-5) -HASAJOB(Gail,nurse)
would both be deduced as linked UR-resolvents. If, however, conclusions about gender are considered to be rather insignificant, the user may designate clause (EX1-2) to be a link only, thus preventing its use as a nucleus. Since a linked UR-resolvent is by definition a descendant of a literal in the nucleus, restricting clause (EX1-2) to be a link prevents the explicit deduction of the intermediate and rather insignificant result (EX 1-4) but still permits its implicit use. The partitioning strategy rests on partitioning (by means of the appropriate designations) the input clauses into nuclei, satellites, and links. (To be precise, so that an input clause can be given more than one designation and thus play more than one role, multiple copies are allowed; after all, linking is concerned with clause occurrences.) Use of the partitioning strategy clearly restricts the application of linked inference rules, since the use of a clause is constrained by its designation. As with other strategies, such as the set of support strategy, the effective ness of the partitioning strategy depends on its use - assigning the appropriate designations to the clauses. As yet, we have little information regarding the rel ative effectiveness of, for example, preferring many links and few nuclei or the converse. Therefore, we simply rely on our inclination to designate as links those clauses whose literals correspond to what we conjecture to be rather insignifi cant aspects of the problem under study. Nevertheless, our experiments do show
Collected Works of Larry Wos
1110
that the use of the partitioning strategy can materially add to the program's effectiveness. 4.2
T H E TARGET STRATEGY
Ideally, the intention of using linked inference rules is to retain significant con clusions only, skipping over intermediate and rather insignificant conclusions. Although the use of linked inference rules, by permitting the program to take larger deductive steps, does increase the likelihood of reaching significant results, their application must be restricted to further reduce the set of possible conclu sions that might be drawn. The strategy presented in the preceding subsection provides some limited control by restricting the use of certain clauses in applica tions of linked inference rules. The target strategy, presented in this subsection, provides a means for using semantic criteria for characterizing significant results to supplement the syntactic termination criteria of the chosen linked inference rule(s). To use the target strategy, the user flags those literal occurrences that are considered to be significant. Then, for a clause to be considered for retention, it must consist only of literals descended from flagged literals. To illustrate the use of the target strategy, we consider a fragment of a theorem from Tarskian geometry. Tarski's axiomatization of plane geometry rests heavily on the notion of a point being (not necessarily strictly) between two points. The theorem under discussion asserts that, for all points x and y, x is between x and y. One proof of this theorem relies on first proving a lemma asserting that, for all points x and y, y is between x and y. (That y is between x and z can be proved when y is known to be between z and x, but proved with far more difficulty than one might expect.) From among the clauses that can be used to study Tarskian geometry, the following four clauses suffice to prove this lemma. In these clauses, L(u,v,x,y) means that the distance between points u and v is the same as the distance between points x and y, and B(x,y,z) means that point y lies between points x and 2. The function ext(x,y,u,v) designates a point that extends the line segment between x and y by a distance equal to that of the line segment between u and v. The clause numbers given after each clause are taken from the corresponding experiment discussed in ref. [36]. (Identity axiom for equidistance.) (EX23-1) -L(x,y,z,z) I EQUAL(x.y)
(5)
(Axiom of segment construction.) (EX23-2) B(x.y,ext(x,y,u,v)) (13) (EX23-3) L(y,ext(x,y,u,v),u,v) (14) (Equality substitution axiom for B.) (EX23-4) -EQUAL(u.v) I -B(x,y,u) | B(x,y,v)
(26)
The Linked Inference Principle, I
1111
To set the stage for the use of linked hyperresolution coupled with the target strategy, let us first give a proof using standard hyperresolution. From clause (EX23-3) as satellite and clause (EX23-1) as nucleus, the clause (EX23-5)
EQUAL(ext(x,y,z,z),y)
(32)
is deduced. Then, from clauses (EX23-5) and (EX23-2) as satellites and clause (EX23-4) as nucleus, the desired clause (EX23-6)
B(x.y,y)
(33)
is deduced. Since both the lemma and the theorem under discussion are concerned with betweenness and, consequently, with literals in the corresponding predicate B, the deduction of clause (EX23-5) is in an obvious sense an unfortunate necessity, necessitated by the use of standard hyperresolution. The clause (EX23-5) is needed as an intermediate clause to play the role of satellite. One might instead simply prefer to simultaneously consider clauses (EX23-1), (EX23-2), (EX23-3), and (EX23-4) and deduce in one step clause (EX23-6). Such a deduction can be made if one uses linked hyperresolution with clause (EX23-4) as the nucleus, clause (EX23-1) as a link, and the other two clauses as satellites. The nature of the lemma and the theorem, in addition to suggesting that betweenness and hence the predicate B be emphasized, also suggests that no other predicate be considered significant. To achieve this end, one can use the target strategy to cause the program to select for possible retention only those linked hyperresolvents that are concerned with betweenness, thus avoiding the deduction of those in the other predicates that are present. To take such action seems warranted in view of the fact that betweenness is the focus of attention. Such a use of the target strategy places an added restriction on the clauses designated as nuclei and, therefore, meshes nicely with the partitioning strategy to further filter the set of possible conclusions that might be drawn. The means for restricting the set of conclusions to those focusing on betweenness is to flag only those literals that are appropriate. In the case under discussion, one simply flags the positive B literal in (the nucleus) clause (EX23-4) as a target literal and flags no others. With the target strategy, only clauses consisting of descendants of the flagged literals will be considered for retention. More formally, the target strategy asks the user to choose one or more clauses - not necessarily nuclei - among the input clauses and then, from among their literals, designate which are to be the target literals. When a literal is flagged as a target literal, any of its descendant literals is admissible in a conclusion and no other literals are admissible. We note, however, that targeting a literal does not imply that its descendant must be present in the conclusion. We also note that an unflagged literal in one clause does not inherit the property of admissibility simply because a copy of that literal is flagged in another clause. Indeed, for admissibility, each literal occurrence that is to have that property
Collected Works of Larry Wos
1112
must be flagged. This requirement gives the user the flexibility to make choices of target based on context. One must be careful when using the target strategy to avoid incompatibility with the chosen inference rule. For example, if the choice of rule is linked hyperresolution, and if a mixed clause contains a positive literal that has not been flagged as a possible target, then that clause cannot play the role of nucleus, although it can play the role of link. Indeed, if one wishes a clause to play the role of nucleus for linked hyperresolution, then the use of the target strategy requires that all of its positive literals be flagged as targets. On the other hand, flagging all of the positive literals in a clause as targets does not prevent that clause from playing the role of link for linked hyperresolution. Although not by definition, the use of the target strategy and linked inference rules naturally mesh well. On the one hand, a review of the nature of linked inference suggests that, without the use of the target strategy, far too many conclusions may be drawn. On the other hand, by taking larger deductive steps, linking permits the reasoning program to move directly from one significant fact (target) to another. Without linking, reasoning steps may be too small to ensure that significant conclusions will be drawn. When linked inference rules are the choice, special care must be taken when using the target strategy in conjunction with link depth and deduction size limits (discussed in the next subsection), for one can easily block all paths to a proof. In Section 6, we shall discuss the wise and unwise use of the target strategy and its value when compared to using standard inference rules uncontrolled by such a strategy. 4.3
T H E DEPTH-SIZE STRATEGY
Unless appropriate constraints are placed on linked inference rules, their use has the potential of taking arbitrarily large reasoning steps. In fact, in the lim iting case, the lack of constraints in the form of strategy can in effect give the program permission to seek a proof as a single application of a linked infer ence rule. Although such permission may be of theoretical interest, it has little general value for effective automated reasoning. Retaining some intermediate in formation is clearly our preference. Our experience strongly suggests that only in a very limited way is it useful to take the extremely large reasoning steps that are possible with the use of linked inference rules; ideally, reasoning steps should be just large enough to move from one significant fact to another. To exercise the needed control of the size of reasoning steps taken with the application of linked inference rules, one can use the depth-size strategy. We recall that, for a given linked inference - formally, for its pairing set Ps - its link depth equals the maximum number of linking clauses on a deductive chain from its nucleus to a satellite, and its deduction size equals the number of binary resolution steps represented. The object of the depth-size strategy is to limit, by the choice of a maximum link depth and a maximum deduction size, the size of
The Linked Inference Principle, I
1113
reasoning steps that are possible with an application of a linked inference rule. Immediately, various refinements come to mind and various questions for research can be posed, questions whose answers have important practical impli cations. Although we cannot as yet experiment with the following refinement, intuition suggests that restricting the number of literals in a nucleus that are attackable with a chain of links would prove to be a valuable strategy. A second refinement focuses on the 'branching' that might be caused by links containing more than two literals. For example, if all links are required to consist of two literals each, then no branching can occur. We thus have a case in which one can use the partition strategy to refine the use of the depth-size strategy. A deep understanding of how, when, and in what combinations to use the various strategies will clearly require substantial experimentation. In Section 6, we describe experiments concerning the use of the depth-size strategy in conjunction with the use of other strategies. 4.4
PRUNING STRATEGIES
The three strategies just presented key directly on properties of an application of a linked inference rule or, equivalently, on properties of the corresponding pairing set. The primary objective is to restrict the set of possible new conclu sions that might be drawn. In this section, rather than being concerned with new conclusions, we present strategies that prune the search space to be explored. Indeed, the emphasis in this section is on sharply reducing the likelihood of deducing conclusions already present; in other words, here we address the prob lem of redundancy. This problem is of particular concern, for, if no strategy is employed, the potential of deducing conclusions that are already known is far greater with the use of a linked inference rule than with the use of its standard counterpart. We note that, in contrast to the preceding strategies, the strategies we next present are more directly dependent on our implementation of linked inference rules. For the discussion of those strategies to be easily followed, we first briefly summarize the global search algorithm employed by OTTER [17]. The algorithm relies on the use of three lists of clause occurrences: (1) clauses in the set of support that have not yet been chosen as the focus of attention; (2) clauses that either were input but not in the set of support, or are in the set of support but have already been chosen as the focus of attention; and (3) positive equality units that are designated as demodulators. Initially, the first list contains just those input clauses chosen to be in the set of support. The main loop for deducing clauses consists of choosing as the focus of attention a clause from the first list, moving the chosen clause to the second list, and then applying the chosen inference rule(s) to each subset of clauses such that one element of the subset is the chosen clause and the remaining elements are on the second list. When a clause is generated, it is processed - for example, with the list of demodulators and, if all constraints are satisfied, then placed on the first list for future possible
ColJected Works of Larry Wos
1114
consideration. To see why redundancy is a more serious problem with the use of a linked inference rule than with the rule that it generalizes and, therefore, see why some type of pruning strategy is called for, let us consider the following example in which clauses (EX24-3) and (EX24-4) are among the axioms - never being the focus of attention - and clauses (EX24-1) and (EX24-2) have not yet been the focus of attention. (EX24-1) POSITIVE(a) (EX24-2) GT(a,0) (EX24-3) -GT(x,0) I POSITIVE(x) (EX24-4) -POSITIVE(x) I EQUAL(abs(x),x) (abs for absolute value) Let us assume that the inference rule in use is linked hyperresolution and that the equality literal in clause (EX24-4) is the only target literal. Let us also assume that clause (EX24-1) is considered (as the focus of attention) before clause (EX24-2) is. When clause (EX24-1) gets chosen as the focus of attention, the clause (EX24-5)
EQUAL(abs(a),a)
is deduced (at link depth 0). Then, when clause (EX24-2) is chosen as the focus of attention, it resolves with (EX24-3) as a linking clause to yield POSITIVE(a) as an intermediate result, which in turn resolves "with (EX24-4) to yield EQUAL(abs(a),a) at link depth 1, which is subsumed as a second copy of (EX24-5). Redundancy occurs - in both the search and the conclusion - for the intermediate clause EQUAL(abs(a),a) is a copy of a clause that already ex ists. Redundancy is a real problem, and, clearly, a reduction in the number of redundant deductions is important. The importance of such a reduction was amply demonstrated with an anal ysis of our experiments with a problem from Lukasiewicz [15] (see Section 6). In response, we formulated the intermediate subsumption strategy. The object of the strategy is to identify intermediate unit clauses that are already present in the database of information and avoid their use for continuing along a path designed to complete the application of a linked inference rule. (Our emphasis on unit clauses is in part motivated by the efficiency of OTTER's use of dis crimination trees [18] for comparing one unit clause with another.) In particular, with the new pruning strategy, each intermediate unit clause generated before the nucleus is present - before the nucleus has been added to the developing pairing set - is examined for possible subsumption. The set of clauses to be used as possible subsumers is chosen by the user. The user can choose to use none, either, or both of the following options. Under the first option, a candidate unit clause will be discarded if it is subsumable either by (1) a clause that was input and not in the set of support or (2) a clause that has already been considered as the focus of attention during the
The Linked Inference Principle, I
1115
run. Under the second option, such an intermediate unit clause will be discarded if it is subsumable by a clause in the set of support that has not yet been the focus of attention. The subsumption of an intermediate unit clause during the application of a linked inference rule truncates potentially many paths that would otherwise be traversed. An examination of the results of our various experiments shows that a po tential conflict exists between the choices one might wish to make regarding the use of strategy. In particular, the choice to subsume intermediate unit clauses, even if restricted to subsumption of the type permitted under the first option just given, can cause problems with the use of a minimal set of support - even to the point of total ineffectiveness. In the next subsection, we shall discuss how this potential interference can occur. In addition to the preceding pruning strategy, we are also experimenting with the following strategy. Ordinarily, unit deletion is that procedure that automatically removes a literal from a nonunit clause - after the completion of an application of the inference rule in use - when that literal is opposite in sign but otherwise is subsumable by a unit clause already present, regardless of the location of the subsumer. The invocation of unit deletion is sound and can add materially to program effectiveness. The new strategy invokes unit deletion during the application of a linked inference rule, applying it to intermediate results with the intention of sharply curtailing the number of paths that would otherwise be explored. Finally, we also intend to explore a strategy for dynamically reordering lit erals. Experiments with standard inference rules have shown that the order of the literals in a nonunit clause, usually the nucleus, can affect in an important way the CPU time required to process such nonunit clauses. A potential gain in efficiency comes from identifying sooner rather than later those paths that will meet with unification failure, excluding those focusing on an occurs-check failure. As it turns out, a fair amount of CPU time is consumed by continually backtracking through the literals of a nucleus to find those paths that complete, for example, in standard UR-resolution or standard hyperresolution. This new strategy would use various metrics to reorder, at different points, the literals of the links and the nucleus in use for the application of a linked inference rule. The gain in efficiency, if such occurs, would come from identifying large sets of paths that cannot complete, and making such an identification sooner rather than after exploring useless partial paths that terminate in unification failure. 4.5
LINKING AND THE SET OF SUPPORT STRATEGY
To provide a perspective for our next topic on strategy, let us first review certain aspects regarding the use of the set of support strategy. To sharply restrict the application of the chosen inference rule(s), the use of this strategy is a virtual constant in our research and experimentation. Despite its value, two obvious cases exist in which one encounters difficulty with its use. If one places very
Collected Works of Larry Wos
1116
many clauses in the set of support, then the program is permitted to explore far too many paths, which is contrary to the objective of the strategy. On the other hand, if one places too few clauses in the set of support - especially with the use of rules such as hyperresolution - then no paths can be explored and no conclusions can be drawn. Ideally, the object is to split the difference, placing so few clauses in the set of support that most paths of reasoning are blocked, with a sharp increase in efficiency, and yet placing enough clauses in the set to permit a solution to the problem under attack to be found. At the same time, one would prefer to place just those clauses in the set of support that the semantics of the prob lem naturally suggests belong there, and thus capture more closely the type of reasoning found in mathematics. Unfortunately, in too many cases, one simply lacks sufficient latitude in choosing the set of support. However, when linked inference rules are the choice, the situation changes dramatically. We can illustrate how things change with a small modification to the example from Tarskian geometry. We begin with clauses (EX23-1), (EX232), (EX23-3), and (EX23-4) and adjoin the clause (EX25-7)
-B(c,d,d)
(neg33)
with the intention of proving that, for all points x and y, y is between x and y. Both from the viewpoint of typical practice in mathematics and as suggested by the spirit of the set of support strategy, the natural choice for the set of support is clause (EX25-7) only. With this choice of set of support and with the choice of standard hyperresolution - equivalently, linked hyperresolution with maximum link depth equal to 0 and with no use of the target strategy - no proof can be found. Indeed, although clause (EX25-7) can be used as a nucleus, no clauses will be generated. Were we to insist on using standard hyperresolution, we would be forced to place at least one additional clause in the set of support - clause (EX23-1) would suffice to obtain a proof - violating the spirit of the strategy and potentially, at least in more complex examples, sharply decreasing the program's effectiveness. If we replace standard hyperresolution with linked hyperresolution, we still must add to clause (EX25-7) as the set of support if we set the maximum link depth to 1. In contrast, if we change the maximum link depth to 2, the use of linking enables the program to obtain a proof by contradiction in a single linked hyperresolution step, a step, in fact, in the spirit of logic programming. The explanation for the success obtained with a set of support consisting of clause (EX25-7) alone - when using linked hyperresolution coupled with a maximum link depth of 2 - rests with the ability to access simultaneously input clauses not included in the set of support. In contrast - with standard hyperresolution as the choice of inference rule - to make possible the needed simultaneous access would require modifying the set of support. We thus see how the use of linked inference rules gives more latitude in choosing the set of support. We also see how one can combine the use of two strategies, in this case, the
The Linked Inference Principle, I
1117
set of support strategy with the depth-size strategy. In the section on experi mentation, we describe experiments designed to compare the results of diverse choices for the set of support coupled with different choices for the link depth and deduction size limits. In general, an increase in the maximum link depth, in the maximum deduction size, or in both gives one increased license in the choice of the set of support; the corresponding strategies mesh well. We also give in Section 6 evidence of the potential conflict that can occur with the use of the set of support strategy and the use of the first option of the intermediate subsumption strategy. Placing clauses outside rather than in the set of support - which, if all other factors are ignored, is an excellent move because of the corresponding sharp reduction in the number of possible paths to traverse - obviously increases the number of possible subsumers of intermediate unit clauses (for the first option of the intermediate subsumption strategy). The greater the number of possible subsumers, the greater the likelihood that an intermediate unit clause generated during the application of a linked inference rule will be subsumed. Since one path for a linked inference rule to access an input clause that is placed outside of the set of support is through the generation of that clause - or through the generation of an appropriate instance of that clause - as an intermediate result, the placement of few input clauses in the set of support interferes or even conflicts with the use of a strategy that truncates paths that pass through an intermediate unit clause that is subsumable. In other words, choosing the most attractive set of support does not mesh so well with the desire to prune the search space to be explored, when the pruning is via the intermediate subsumption strategy. 4.6
LINKING AND THE WEIGHTING STRATEGY
The main object of the weighting strategy is to direct the reasoning of the program by choosing the 'next' clause on which to focus attention, where the choice is based on priorities assigned (usually) by the user. With this strategy, the program chooses the lowest-weight clause. The priorities, called weights, are intended to reflect the user's knowledge and intuition about how to attack the problem under consideration. If the user does not or cannot provide hints about how to attack the problem, then the weight of a clause can simply be its symbol count. In addition to ordering the various clauses based on priority, weighting is also used to purge information considered too complex to be relevant. The user assigns a maximum weight for retained conclusions. The use of the weighting strategy presents two obvious obstacles. First, if the maximum weight chosen is too small, then the key conclusion may be purged because of being more complex than permitted by the maximum. Second, and far more serious, the program may get trapped among so-called lower-weight clauses, needing perhaps one high-weight clause to complete its given assign ment. Even if the program eventually escapes such a trap - before the useful higher-weight clause is chosen as the focus of attention - a huge amount of mem-
1118
Collected Works of Larry Wos
ory and CPU time may be consumed, sometimes exceeding what is available. Regardless of the way weights are assigned, even for problems of intermediate difficulty, either obstacle can prove formidable. Although the choice of inference rule does not enable one to circumvent either obstacle, with the use of linked inference rules both are often far less severe. Indeed, with linking, the burden on the user of cleverly determining an excellent set of weights and of choosing wisely the maximum allowed is sharply reduced. With linked inference rules as the choice, two factors account for the added latitude in the use of the weighting strategy. The first factor focuses on the value of the maximum weight (complexity) allowed for retained conclusions. Indeed, precisely because linked inference rules can be used to force various bits of information to be present implicitly only - a property that some standard rules also possess, but to a far smaller degree - the use of linked inference rules gives the program access to intermediate clauses that may have extremely high weight while avoiding their consideration for retention and, therefore, avoiding the comparison of their complexity to the maximum allowed. As a result, when using the linked version of an inference rule rather than the standard version, one often can set a smaller maximum on the complexity of retained information with less likelihood of blocking all paths to a solution to the problem at hand. A reduction in the amount of retained information can materially increase the effectiveness of an automated reasoning program. The second factor, also resulting from the relegation of certain information to being present implicitly, concerns the ability to 'reach ahead' and in effect consider a clause that already resides in the database of information and that has weight (sometimes substantially) higher than the clause in focus. For example, before the completion of an application of the chosen linked inference rule, a unit clause may be generated as an intermediate result that is also a copy of an existing clause that has not yet been the focus of attention. (Again, a similar property is possessed by certain standard inference rules if compared to binary resolution, but to a far smaller degree than is the case for linked inference rules.) Without being able to reach ahead, the program might not consider the higher weight clause for a substantial amount of CPU time, for it ordinarily would be forced to wait until all clauses of lesser weight have been considered as the focus of attention. In view of the preceding observation, one can quickly see that a potential conflict exists between the added latitude when using the weighting strategy and when using the intermediate subsumption strategy. Specifically, if one chooses the second option - the use of subsumers that have not yet been the focus of attention - then access to certain retained clauses of weight higher than those nearby can be blocked. In Section 6, we describe experiments designed to illustrate the various points made in this subsection. For now, we note that if one reviews the material of this subsection, one can see how the use of linked inference rules permits a program to 'tunnel' under one or more heavy (high-weight) facts to move more readily
The Linked Inference Principle, I
1119
from one significant fact to another. Tunneling from one fact to another, as frequently occurs with the use of linked inference rules, can be dramatically less expensive (measured in CPU time) than traversing the direct path that passes through points of high weight, which is often a necessity with the use of the standard version of various inference rules. 4.7
SUMMARY OF STRATEGY
Various combinations of strategies are subject to conflicts, and one certainly encounters difficulties in choosing which combination to employ. Far more re search is required to understand the hidden interrelationships; such understand ing might lead to the formulation of metarules for making wise choices for the various options. Despite these obstacles, our experiments strongly suggest that the addition of linked inference rules together with the strategies we have pre sented gives an automated reasoning program far more power than would oth erwise be available. The use of the target strategy to restrict the set of acceptable conclusions nicely complements the use of the set of support strategy, which restricts the sets of clauses to which a linked inference rule can be applied. Both strategies emphasize the role of semantics, and their use permits a program to capture some of the type of reasoning found in mathematics. By choosing to use linked inference rules in preference to standard rules, one has far more latitude in the choice of which clauses to place in the set of support. One also has more latitude in the choice of weights - to direct the program's reasoning - and in the assignment of the maximum weight allowed for a retained clause, thus reducing (in many cases) the need to rely upon elaborate or unnatural weighting schemes. The target strategy can also be thought of as a termination strategy, giv ing conditions for acceptable termination of a linked inference rule or, for that matter, of a standard inference rule. One cannot, however, cavalierly use the target strategy and choose the linked inference rule without exercising some care that sufficient literals have been targeted. For example, since the choice of linked hyperresolution requires for its application that one clause be a nucleus, which implies that the descendants of all of the positive literals of that clause be present in any resolvent, those positive literals must all be targeted. Similarly, with linked hyperresolution, since exactly one positive literal of each link must be unified with some negative literal, at most one literal in each link can be omitted from those literals that are targeted. Of course, whether the target strategy is in use or not, with rules such as linked UR-resolution and linked hyperresolution, no choice exists regarding the designation of satellite. However, with the partition strategy, the choice of which clauses to designate as nuclei, which as links, and which as both can dramatically affect the likelihood of completing the assigned task. The choice of maximum link depth and maximum deduction size also can have striking effects. The greater each is, the more likely that the important side effect of tunneling will
1120
Collected Works of Larry Wos
occur, the moving from one low-weight clause to another with the implicit use of a clause of (sometimes much) higher weight. Our experiments suggest that tunneling proves to be quite significant for reducing the CPU time required to prove theorems of even moderate difficulty. Although increasing the link depth and deduction size limits gives the pro gram more deductive power, it also sharply increases the potential for redun dancy, for traversing as a subpath some previously traversed path in the search space. Preliminary evidence indicates that, if the intermediate subsumption strategy is used, much of this redundancy can be avoided, with a corresponding improvement in effectiveness. Recognizing that far more control is needed be cause linked inference rules can be so prolific, we conclude from our experiments that the value of using linked inference rules - when constrained with the use of various strategies - far outweighs the value of relying solely on their standard counterparts.
5
An Implementation of Linked UR-Resolution
An experimental version of linked UR-resolution has been implemented in OT TER [17]. As one might expect, rather than searching directly for pairing sets and appropriate unifiers, the current implementation searches for linked URresolvents by applying sequences of binary resolution steps (of course, discard ing the intermediate results). The algorithm for efficiently guiding the search for determining which binary resolution steps to apply - turned out to be more complex and more interesting than we at first expected. The basic algorithm, however, is fairly straightforward - a simple depth-first search with backtrack ing, using the partitioning strategy to determine how to use the various clauses, using the deduction size limit to determine when to backtrack, and using the target strategy to determine when a linked UR-resolvent has been found. Of course, to avoid generating a myriad of clauses that are discarded because their link depth exceeds the assigned maximum, we need far more than the basic algorithm. Indeed, most of the complexity of the implementation of linking is designed to address this concern. Rather than repeatedly traversing the developing inference tree to establish link depth, the current implementation uses a bookkeeping strategy that up dates link depth in constant time after each binary resolution and backtracking step. In addition to monitoring actual link depth, the algorithm monitors po tential link depth - before a nucleus has even been brought into the developing inference tree. The object is to prevent the generation of any partial inference tree that cannot be successfully completed within the assigned maximum link depth. Maintaining the bookkeeping, particularly under backtracking, is the heart of the implementation algorithm, which we shall discuss in a forthcoming paper. The current OTTER implementation of linked UR-resolution supports the
The Linked Inference Principle, I
1121
following user options. 1. The inference rule, controlled by the linkedjwrjres flag. 2. The partitioning strategy, controlled by explicit labeling of clauses. 3. The target strategy, controlled by lists of (references by number to) chosen literals. 4. Maximum depth size, controlled by the max.ur-depth flag. 5. Maximum deduction size, controlled by the max.ur.deductionsize flag. 6. The first intermediate subsumption option - subsumers are limited to axioms and clauses previously chosen as the focus of attention - controlled by the linkedsub-unit-axioms flag. 7. The second intermediate subsumption option - subsumers are limited to clauses in the set of support that have not yet been chosen as the focus of attention - controlled by the linkedsub.uniLsos flag. 8. The intermediate unit deletion strategy, controlled by the linkedjunit.del flag.
6
Experimentation
We have been experimenting extensively with our implementation of linked URresolution, controlled by various combinations of strategy. The problems studied are taken from areas including formal logic, Tarskian geometry, set theory, pro gram verification, topology, and puzzles. In this section, we present highlights of some of our experiments, including results that are favorable and those that are not so favorable to the use of linked inference rules and various strategies. The highlights presented are chosen to illustrate claims and observations made earlier in this article - for example, those concerning wise and unwise choices regarding the various strategies. We do not present any results in which equal ity plays an important role, for the corresponding formalism is not included in this article, nor do we yet have available the required implementation; those experiments will be covered in a later article. We in no way imply that we have as yet obtained conclusive evidence; far more data is clearly required. Nevertheless, the data gathered so far suggests that research emphasizing the role of linked inference rules is clearly merited. Because of an apparently unavoidable problem in automated reasoning, the inability of decoupling the various aspects to be studied, we obviously cannot conduct our experiments under the most preferred conditions. For example, the effectiveness of the target strategy is tightly coupled to the choices made for
Collected Works of Larry Wos
1122
maximum link depth and maximum deduction size. Acknowledging this prob lem, our experiments - most of which are not presented here - are designed to study and evaluate at least the following. 1. A comparison of the use of linked inference rules to the use of the corre sponding standard rules they generalize. 2. The effective use of the partitioning strategy. 3. The effective use of the target strategy. 4. The appropriate choices for maximum link depth and maximum deduction size. 5. The impact of linking on the effective use of the set of support strategy. 6. The impact of linking on the effective use of the weighting strategy. 7. The processing of intermediate results with pruning strategies, namely, intermediate subsumption and unit deletion. 8. The preprocessing of nuclei - generating an expanded set - as an alterna tive to using linked inference rules. 6.1
PROBLEMS FROM FORMAL LOGIC
Most of the experiments highlighted in Section 6 focus on an area of logic closely related to implicational calculus. This area was chosen for study because the axiom set is small and because the area offers for study problems whose difficulty varies widely. The following clauses correspond to the axioms for this area of logic. (LUKA-1) (LUKA-2) (LUKA-3) (LUKA-4)
P(i(x,i(y,x))) P(i(i(x,y),i(i(y,z),i(x,z)))) P(i(i(i(x,y),y),i(i(y.x),x))) P(i(i(n(x),n(y)),i(y,x)))
The inference rule for this logic is condensed detachment, which can be captured by using standard hyperresolution and the following nucleus as an input clause. (LUKA-5)
- P ( i ( x , y ) ) I -P(x) I P(y)
For this area of study, our experiments are designed to compare the effectiveness of standard and linked hyperresolution. Fortunately, our implementation of linked UR-resolution suffices. Since the single nucleus contains exactly one positive literal, and since the theorems of the logic are represented as positive unit clauses, using linked UR-resolution with
The Linked Inference Principle, I
1123
the positive literal of the nucleus as the only target literal behaves precisely as linked hyperresolution would. The specific problems chosen for study are four key steps in a known proof of a problem from Lukasiewicz [15]. (Step 24) P(i(n(n(x)),x)) (Step 25) P(i(i(x,y),i(i(z,x),i(z,y)))) (Step 29) P(i(x,n(n(x)))) (Step 36) P(i(i(x,y),i(n(y),n(x)))) Each of the four steps follows from the axioms and applications of condensed detachment; there is no special hypothesis. 6.2
COMPARING LINKED AND STANDARD HYPERRESOLUTION
We have run hundreds of experiments with the four Lukasiewicz problems just described, using both standard and (simulated) linked hyperresolution, and us ing various strategies. The experiments with linked hyperresolution include var ious choices for 1. the clauses to be placed in the set of support, 2. the maximum weight allowed for retained clauses, 3. the maximum link depth, 4. the maximum deduction size, 5. the pruning of intermediate results, and 6. the strategy for choosing the 'next' clause as the focus of attention, in cluding experiments with level saturation. We present here a few highlights of the results of our experiments with the Lukasiewicz problems. 1. Linked hyperresolution offered impressively more power than did standard hyperresolution. For one of the more persuasive examples, step 36 required 75 times as much CPU time to prove with standard hyperresolution as was required with linked hyperresolution; on a Sun 4 workstation, the use of
1124
Collected Works of Larry Wos
linked hyperresolution yielded a proof in approximately 511 CPU seconds, where the use of standard hyperresolution required approximately 38 600 CPU seconds. On the other hand, we do have examples in which standard hyperresolution performs slightly better than linked hyperresolution does, but each of these focuses on a far simpler problem than step 36. 2. With linking, one can use a minimal set of support, consisting of (LUK A-4) alone, and still obtain proofs of steps 24, 25, 29, and 36. In contrast, with standard hyperresolution, using the same minimal set of support failed to prove any of these theorems. The improved performance with linking appears to result from the fact that its wise use permits the program to block early in the search many paths that would otherwise be explored. 3. The use of linked hyperresolution with maximum link depth 1 and max imum deduction size 5 permits the maximum weight to be set at 14 and still prove steps 24, 25, 29, and 36. In contrast, with standard hyperres olution, steps 25 and 36 require the maximum weight to be set to 16. If instead the maximum is set to 14, the list of clauses that have not yet been the focus of attention becomes empty, implying that no proof within those constraints exists. Further analysis of the proofs obtained with link ing shows that (in effect) some formulas of length 16 are being used, but used implicitly as intermediate results. One discovers that the use of link ing permits use of formulas that would otherwise be purged because of the maximum weight limit. The use of linking also permits early use of formulas that are retained in the set of support but ordinarily delayed for consideration as the focus of attention. 4. Choosing a minimal set of support, say (LUKA-4) alone, and also choosing the option that purges intermediate clauses if they are subsumed by an axiom or a clause already chosen as the focus of attention, can cause a degradation of effectiveness. For example, step 25 was far more difficult to prove using the intermediate subsumption option, requiring up to 10 times as much CPU time to complete the task. Further, if one chooses to use both options for subsuming intermediate clauses, then the program may require even more time to obtain a proof. In other words, the various choices for using strategy do indeed conflict. 6.3
EXPERIMENTS WITH THE TARGET STRATEGY
To test various choices for which literals to target, we have run numerous exper iments in set theory, Tarskian geometry, and program verification. As expected, linked inference rules are far more effective with the use of the target strategy than without its use. Also as expected, the appropriate choice of targets depends heavily on the choices made for maximum link depth and maximum deduction
The Linked Inference Principle, I
1125
size. Clearly, having smaller link depth and deduction size limits requires, in gen eral, the use of more targets, for, otherwise, significant results (targets) cannot be reached. On the other hand, experiments with our current implementation suggest that, when few targets are nagged and at the same time the link depth and deduction size limits are set correspondingly high, far more CPU time is con sumed than desirable. The explanation appears to rest with the vastly larger search space that is being explored. In order to establish guidelines for an ap propriate balance between a natural choice for targets - stressing significant information only - and reasonably wise choices for maximum link depth and maximum deduction size, far more experimentation is needed. 6.4
EXPERIMENTS WITH THE PARTITIONING STRATEGY
To test various choices for the designation of links and nuclei, we have run numerous experiments. Program verification is particularly well suited for these experiments because of the richness of the axiom set - for example, axioms for properties of integers and arrays. As expected, effective designations depend heavily on the choices made for targets, maximum link depth, and maximum deduction size. We make two specific observations. 1. Designating as linking clauses clauses such as those representing transi tivity of a relation can be computationally prohibitive for all but very small link depths. The potential for extremely high computational cost rests with the large number of ways that such clauses can link together. Nevertheless, the nature and significance of such clauses suggest that, in most cases, they be designated as linking clauses. We have begun the development of a theory for restricting their application. 2. In several experiments, increasing the number of linking clauses markedly decreased the sensitivity to the choice of weights and reduced the need for using special demodulators. Clearly, far more experimentation is needed.
7
Summary and Conclusions
In this article, we have focused on linked inference rules, presenting (1) a dis cussion of the motivation for their formulation, (2) a number of detailed exam ples, (3) the complete formalism (for those rules not emphasizing the role of equality), (4) various strategies (including some tailored to linked inference) for enhancing their effectiveness, and (5) experimental evidence supporting their value. The inference rules presented here include linked UR-resolution, linked hyperresolution, and linked binary resolution, each of which generalizes its stan dard counterpart. For example, where standard UR-resolution requires that each
1126
Collected Works of Larry Wos
(unit) satellite directly unify with a corresponding literal in the nucleus, linked UR-resolution permits a (unit) satellite to, in effect, unify with a literal in the nucleus by relying on a (possibly empty) chain of nonunit linking clauses. One objective of using linked inference rules is to permit an automated reasoning pro gram to take larger-than-usual deductive steps, relegating a substantial amount of information to being present implicitly only. In addition to presenting each of the various linked inference rules separately, we also present the rules as applications of a single principle of reasoning, the linked inference principle. This principle provides a uniform theoretical frame work, capturing under one umbrella both standard and linked inference rules, proof by contradiction as a single step of reasoning, the reasoning found in logic programming, and the type of reasoning that combines in a single step literal-oriented reasoning with term-oriented reasoning that emphasizes equal ity. In this article we merely touch on equality-oriented reasoning and the type of reasoning that combines such with resolution-oriented reasoning, with the full treatment presented in a later article. Although doing so is of some theoretical interest, we do not advocate in structing a reasoning program to seek a proof by contradiction as a single rea soning step. Indeed, for questions and problems of even moderate difficulty, our experience strongly suggests that the retention of some information is required. The idea behind using linked inference rules is to retain information that is significant for the given assignment, relegating that which is rather insignificant to being present implicitly only. The use of linked inference rules promotes the use of strategy, strategy to restrict and strategy to direct the application of inference rules. For example, the target strategy, which focuses on the semantics of the current assignment, is particularly effective when used in conjunction with linked inference rules. The use of linked inference rules also affords one a sharp increase in latitude in the choice of which clauses to place in the set of support and which weight templates (complexity measures) to assign to clauses. To attack a difficult problem, a reasoning program - at least with the paradigm we prefer - is often forced to delay for a substantial time its fo cusing on a key but complex fact, a fact that is already deduced but that has high weight. For example, a program using a standard inference rule typically must consider in turn all formulas of length 10, then 11, then 12, and the like, delaying for a great deal of CPU time before considering the key formula of length 16. In contrast, with the use of linked inference rules, such a delay is often avoided. This positive effect of linking on the use of weighting is due to the increased capacity to 'tunnel' - to reach ahead in the search space and use, as intermediate clauses, those of high weight (complexity), and thus move more readily from one significant fact to another. The use of linked inference rules offers related benefits for assigning the maximum weight for retained clauses. Although rules such as UR-resolution and hyperresolution offer to a limited extent the capacity to tunnel, linked inference rules offer this capacity far more
The Linked Inference Principle, I
1127
- actually, to the extent that the user chooses. Of course, if one does choose to increase the capacity to tunnel, a price must be paid, for the program will then have permission to explore - with each clause on which it focuses - far more of the possible search space. The set of support strategy, by blocking the consideration of sets of axioms, was designed to curtail (early in the search) the paths to be explored. Unfor tunately, depending on the choice of (standard) inference rule, one might be forced - in order to avoid blocking all paths to a solution - to place in the set of support clauses that naturally belong outside the set. This forced action can cause the program to explore aspects of the underlying theory that are irrele vant, resulting in the deduction of a large number of unneeded clauses, with a corresponding sharp degradation of effectiveness. With the use of linked infer ence rules, on the other hand, one has far greater latitude in the use of the set of support strategy. In particular, although the use of linking does not completely eliminate the problem, it often permits the use of a smaller and more natural set of support Most important, the use of linked inference rules can have a dramatically positive effect on program performance, occasionally reducing the CPU time required to complete a proof by a factor of 75. Such a reduction can transform the search for a proof from unacceptable to acceptable. For example, we used (simulated) linked hyperresolution to obtain a proof in less than 9 CPU minutes (on a Sun 4 workstation) in contrast to requiring, with standard hyperresolu tion, more than 10.7 CPU hours. Of course, linked inference rules are not the complete answer to program effectiveness. Their use causes the program to en counter far more redundancy than does the use of standard inference rules or so it appears. We introduce in this article various strategies to address that problem. The use of linked inference rules also has the potential of yielding too many conclusions from a single focal clause, for, depending on the parameter settings, many axioms and clauses that earlier were the focus of attention can be simultaneously brought into play. Finally, because of the latitude one has in the use of linked inference rules and the strategies that control them, it becomes increasingly important to develop metarules for making wise choices. Weighing the disadvantages against the advantages of using one or more linked inference rules, we conclude that further research and experimentation are clearly merited. Nevertheless, the results of our early experiments - some of which we include here with a corresponding brief analysis - strongly suggest that the incorporation of linked inference rules sharply increases the value, usefulness, and power of an automated reasoning program.
References 1. Andrews, P. (1968), 'Resolution with merging', Journal of the ACM 15, 367-381.
1128
Collected Works of Larry Wos
2. Andrews, P. (1976), 'Refutations by matings', IEEE Transactions on Com puters C-25, 801^807. 3. Antoniou, G., and Ohlbach, H. (1983), 'Terminator', in Proceedings of the Eighth International Joint Conference on Artificial Intelligence, Karl sruhe, West Germany, pp. 916-919. 4. Bibel, W. (1987), Automated Theorem Proving, 2nd edn., Vieweg Verlag, Braunschweig, West Germany. 5. Bledsoe, W., and Hines, L. (1980), 'Variable elimination and chaining in a resolution-based prover for inequalities', in Proceedings of the Fifth In ternational Conference on Automated Deduction, Springer-Verlag Lecture Notes in Computer Science, Vol. 87, W. Bibel and R. Kowalski (Eds.), Springer-Verlag, New York, pp. 70-87. 6. Boyer, R., and Moore, J (1988), A Computational Logic Handbook, Aca demic Press, San Diego. 7. Clocksin, W., and Mellish, C. (1984), Programming in Prolog, 2nd edn., Springer-Verlag, New York. 8. Davis, M. (1963), 'Eliminating the irrelevant from mechanical proofs', Ex perimental Arithmetic, High Speed Computing and Mathematics, Proceed ings of Symposia in Applied Mathematics, Vol. 15, American Mathemat ical Society, Providence, R.I., pp. 15-30. 9. Dixon, J. (1973), 'Z-resolution: Theorem proving with compiled axioms', Journal of the A CM 20, 127-147. 10. Kirchner, C. (ed.) (1989), Special Issue on Unification, Journal of Symbolic Computation 7. 11. Kowalski, R. (1975), 'A proof procedure based on connection graphs', Journal of the ACM 22, 572-595. 12. Kowalski, R. (1979), Logic for Problem Solving, Elsevier North-Holland, New York. 13. Loveland, D. (1969), 'A simplified format for the model elimination pro cedure', Journal of the ACM 16, 349-363. 14. Loveland, D. (1969), 'Theorem-provers combining model elimination and resolution', in Machine Intelligence 4, B. Meltzer and D. Michie (Eds.), Edinburgh University Press, Edinburgh, pp. 73-82. 15. Lukasiewicz, J. (1970), 'The equivalential calculus', Jan Lukasiewicz: Se lected Works, L. Borkowski (Ed.), North-Holland, Amsterdam, pp. 250277.
The Linked Inference Principle, I
1129
16. McCharen, J., Overbeek, R., and Wos, L. (1976), 'Complexity and related enhancements for automated theorem-proving programs', Computers and Mathematics with Applications 2, 1-16. 17. McCune, W. (1990a), OTTER 2.0 Users Guide, Technical Report ANL90/9, Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, 111. 18. McCune, W. (1990b), 'Experiments with discrimination tree indexing and path indexing for term retrieval', Journal of Automated Reasoning (to appear). 19. Moore, J (1984), personal communication. 20. Overbeek, R. (1975), 'An implementation of hyper-resolution', Computa tional Mathematics with Applications 1, 201-214. 21. Robinson, G., and Wos, L. (1969), 'Paramodulation and theorem-proving in first-order theories with equality', Machine Intelligence 4, B. Meltzer and D. Michie (Eds.), Edinburgh University Press, Edinburgh, pp. 135150, 22. Robinson, J. (1965) 'A machine-oriented logic based on the resolution principle', Journal of the ACM 12, 23-41. 23. Robinson, J. (1965), 'Automatic deduction with hyper-resolution', Inter national Journal of Computer Mathematics 1, 227-234. 24. Shostak, R. E. (1976), 'Refutation graphs', Artificial Intelligence 7, 51-64. 25. Siekmann, J. (1989), 'Unification theory', p. 207 in [10]. 26. Smith, B. (1988), Reference Manual for the Environmental Theorem Prover, An Incarnation of AURA, Technical Report ANL-88-2, Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, 111. 27. Stickel, M. (1985), 'Automated deduction by theory resolution', Journal of Automated Reasoning 1, 333-355. 28. Stickel, M. (1988), 'A Prolog technology theorem prover: Implementation by an extended Prolog compiler', Journal of Automated Reasoning 4, 353380. 29. Veroff, R., and Henschen, L. (1981), 'Application of automatic transfor mations to program verification,', Proceedings of the Seventh International Joint Conference on Artificial Intelligence, Vol. 1, A. Drinan (Ed.), Van couver, British Columbia, pp. 472-479.
1130
Collected Works of Larry Wos
30. Wos, L., Carson, D., and Robinson, G. (1964), 'The unit preference strat egy in theorem proving', Proceedings of the AFIPS Conference 26, Spartan Books, Washington, D.C., pp. 615-621. 31. Wos, L., Robinson, G., and Carson, D. (1965), 'Efficiency and complete ness of the set of support strategy in theorem proving', Journal of the ACM12, 536-541. 32. Wos, L., Overbeek, R., and Henschen, L. (1980), 'Hyperparamodulation: A refinement of paramodulation', Proceedings of the Fifth International Conference on Automated Deduction, Springer-Verlag Lecture Notes in Computer Science, Vol. 87, W. Bibel and R. Kowalski (Eds.), SpringerVerlag, New York, pp. 208-219. 33. Wos, L., Overbeek, R., Lusk, E., and Boyle, J. (1984), Automated Reason ing: Introduction and Applications, Prentice-Hall, Englewood Cliffs, N.J.; 2nd edn., McGraw-Hill, 1992. 34. Wos, L., Veroff, R., Smith, B., and McCune, W. (1984), 'The linked in ference principle, II: The user's viewpoint', Proceedings of the Seventh In ternational Conference on Automated Deduction, Springer-Verlag Lecture Notes in Computer Science, Vol. 170, R. Shostak (Ed.), Springer-Verlag, New York, pp. 316-332. 35. Wos, L., and McCune, W. (1986), 'Negative paramodulation', Proceedings of the Eighth International Conference on Automated Deduction, SpringerVerlag Lecture Notes in Computer Science, Vol. 230, J. Siekmann, (Ed.) Springer-Verlag, New York, pp. 229-239. 36. Wos, L. (1987), Automated Reasoning: S3 Basic Research Problems, PrenticeHall, Englewood Cliffs, N.J. 37. Wos, L., and McCune, W. (1990), 'Automated theorem proving and logic programming: A natural symbiosis', Journal of Logic Programming (to appear). 38. Yates, R., Raphael, B., and Hart, T. (1970), 'Resolution graphs', AHificial Intelligence 1, 257-289.
The application of automated reasoning to questions from mathematics and logic1 Larry Wos and William McCune Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, Illinois 60439, U.S.A.
Abstract Sharply different from the well-known use of various computer pro grams for the numerical aspects of mathematics and logic is the newer and less familiar use of a program to address the logical reasoning as pects. In this article, we focus on such a program—the automated rea soning program OTTER—which is portable, available electronically by anonymous FTP, and usable on a wide variety of computers, even on per sonal computers. We discuss the types of assistance provided by OTTER, including proof finding, conjecture formulation, and object construction. With OTTER's assistance, we have answered a number of open questions taken from a variety of fields. We focus on such questions from combinatory logic, equivalential calculus, Robbins algebra, and finite semigroup theory. For those who enjoy a challenge, we also offer ten questions, in cluding some that are still open, and an open question that eluded even Tarski.
1
A u t o m a t e d reasoning and research in mathe matics and logic
More than thirty years of evidence exists of the value of using a computer program to address the numerical aspects of a problem taken from some area of mathematics or logic. In this article, we shall present evidence of the value of using a totally different type of computer program, one that addresses the reasoning aspects. We shall emphasize (in sections 4, 5, and 6) new results obtained with our newest and most powerful automated reasoning program O T T E R (Organized Techniques for Theorem-proving and Effective Research) 1 This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted with permission from the Annals of Mathematics and AI, Vol. 5, pp. 321-370 (1992).
1132
Collected Works of Larry Wos
[20] and give (in section 3) the details for obtaining a copy of the program. The uses for OTTER include proof finding, conjecture formulation, and object construction. With OTTER's assistance, we have answered a number of open questions taken from a variety of fields. We shall focus on such questions from combinatory logic, equivalential calculus, Robbins algebra, and finite semigroup theory. For those who enjoy a challenge, we shall also offer (in section 6.1) ten questions, including some that are still open, and (in section 6.3) an open question that eluded even Tarski [9]. To provide an understanding of the mechanisms from which OTTER and many other reasoning programs derive their power, we shall review (in section 2) the five basic elements of automated reasoning: language for presenting the question or problem, inference rules for reasoning logically, strategy for controlling the reasoning, a procedure for canonicalization, and a procedure for purging logically weaker consequences. Of the five, strategy is the most intriguing. Indeed, the explicit use of strategy is one of the significant aspects of at tacking a question or problem with the assistance of an automated reasoning program, an aspect that contrasts with and nicely complements the approach typically taken by a person unaided. One type of strategy (the set of support strategy [37], see section 2.3) that OTTER employs restricts the program's rea soning with the object of increasing the likelihood that the deductions it makes are relevant to the problem under study. A strikingly different type of strat egy (weighting [17], see section 2.3) used by OTTER permits the researcher to play an active role in directing the program's reasoning with advice based on knowledge and intuition, rather like giving a hint for a starred exercise. In addition to the explicit use of strategy, a reasoning program such as OTTER also differs from a person in that it explicitly presents (on demand) each deduction it makes and the specific hypotheses from which the deduction was made. By exercising one of the available options, the researcher can have the program present only those deductions that are retained, or have the program present all deductions, including those that are discarded. An examination of the deductions and of the history of each—especially when the specific objective of the research has not yet been obtained—can lead to the formulation of an important conjecture or can lead to the discovery of an unexpected and key lemma, which can then be used to complete the research. On the other hand, when the program does succeed in completing its assigned task, one occasionally finds additional and unexpected information of value—for example, a far shorter or a far less complex proof than was previously known. Moreover, since no implicit assumptions are made and since all deductions with the corresponding history can be included in the presentation, the proofs found by an automated reasoning program can be checked algorithmically—which ob viously makes the refereeing process sharply different from what it usually is. Especially because of the use of strategy, but also because of the use of a mechanism (demodulation [38], see section 2.4) for canonicalizing deductions
Application of AR to Questions from Mathematics and Logic
1133
and a mechanism (subaumption [24], see section 2.5) for purging logically weaker results, an automated reasoning program proves to be most useful for research. Of course, far more is needed. In particular, the task of presenting a problem to such a program is at best tedious. More serious is the lack of metarules for making wise choices for which rule(s) of inference to use, which notation, and which types of strategy. Nevertheless, the programs available now offer impressive deductive power, to the point that, with their assistance, various open questions have been answered. We shall show from where this power is derived, featuring (in section 3) our newest program OTTER and how it has been used to answer various open questions. With regard to the degree of assistance OTTER offers for research, what makes this program unique among automated reasoning programs is its ability— even when presented with a deep question or a difficult problem—to continue to make deductions at a constantly high rate, rather than having its performance degrade with computer time or with the number of deductions retained. Indeed, in a recent study of a problem from Lukasiewicz (see section 5 for the details), during the first hour, OTTER deduced facts at the rate of 711 per CPU second (second of computer time) and, during the 440th hour, it deduced facts at the rate of 597 per CPU second, deducing more than 983,000,000 in its attack. OTTER's almost linear performance (with respect to CPU time) is one of the factors that makes this program far superior to its predecessors. OTTER also functions impressively even when the set of retained facts be comes quite large. As an example, in a study of equivalential calculus (see section 5 for the details), a proof that the formula YRM implies the formula XGF was completed upon retention of a fact numbered 62,364. One thus sees why we find the use of this program so attractive. Its appeal also rests with its built-in treatment of equality. The program can apply, based on the researcher's dictates, a given set of rules {demodulators [38], see section 2.4) for canonicalization, or it can instead find such rules on its own. OTTER also offers a powerful inference rule (paramodulation [23,39], see section 2.2) that generalizes equality substitution, permitting it to reason directly deep within expressions. Because of its effective treatment of equality, we have successfully used the program to prove deep theorems in Robbins algebra [34,44] (see section 6.3) and in combinatory logic [43] (see section 6.1). Rather different from proving a theorem is the activity of finding a shorter proof than any known proof of the theorem under consideration. Shorter proofs are appealing, for they are often more elegant. In addition, as E. W. Dijkstra has observed [6], such proofs play a vital role in program verification. In this article, we shall present (in section 5) some techniques that OTTER can apply to obtain shorter proofs, and we shall include examples that are markedly shorter than any previously known proofs. In addition to OTTER, a number of other automated reasoning programs merit citation. Unfortunately, because of space limitations, we cannot touch on very many programs; no meaning should be drawn from an omission in this
1134
Collected Works of Larry Wos
regard. Some reasoning programs are general purpose, where others are intended for use in one specific area. For example, the Boyer-Moore Theorem Prover [3,5] was designed for the study and application of program verification. The Boyer-Moore Theorem Prover, written in LISP, can be obtained elec tronically; the details can be obtained by contacting Dr. Robert Boyer in the Computer Science Department of the University of Texas or by electronic mail (boyerCcs.utexas.edu). This remarkable program demonstrates how auto mated reasoning has been used successfully to solve real problems in a variety of fields. Among the theorems proved by the Boyer-Moore Theorem Prover, we cite those focusing on the invertibility of the Rivest, Shamir, and Adleman public key encryption algorithm [4], the soundness and completeness of a propositional calculus decision procedure, the soundness of an arithmetic simplifier (actually used in their program), the termination of Takeuchi's function, and the correct ness of many elementary list and tree processing functions. This program has also been used successfully to prove properties of many recursive functions and to prove the correctness (more precisely, the verification conditions) of various Fortran programs, including a fast string-searching algorithm, an integer square root algorithm using Newton's method, and a linear-time majority vote algo rithm. These programs are each relatively small, requiring no more than a page of code. Nevertheless, the correctness arguments are fairly deep. Of a strikingly different nature are those programs based on Prolog technol ogy. Ammong such programs, those designed and implemented by Mark Stickel [31] have proved most useful. For evidence of their usefulness, we note that A. Marien in Belgium used one of Stickel's programs to obtain a proof of a deep the orem in equivalential calculus. Even further, an analysis of that proof revealed that a new and shorter proof of the theorem in question had been found—the shortest known proof before Marien's success consists of 23 steps, and the one obtained with the Stickel program consists (in effect) of 10 steps. Of yet a different nature are those programs based heavily on the use of on rewrite rules, often including the use of ac-unification. The program RRL [12] has performed strongly on problems from ring theory, producing in impressively little CPU time various proofs. The program SbReve [1] also exhibits substantial reasoning power, as evidenced by its success with Moufang identities. What is clear from these terse observations is that the field is now intent upon experimentation, which offers much promise for the future. Before we turn to the evidence supporting the value of using an automated reasoning program as a research assistant—to show from where such programs derive their power—let us review the basic elements.
2
The five elements of automated reasoning
Noting that the more intriguing topic, that of answering open questions, is left for section 6, let us begin with a brief treatment of the five basic elements of
Application ofAR to Questions from Mathematics and Logic
1135
automated reasoning: language for presenting the question or problem, inference rules for reasoning logically, strategy for controlling the reasoning, a procedure for canonicalization, and a procedure for purging logically weaker consequences. (A detailed treatment of the five elements can be found in [40,42].) Although only the first two are obviously required, as it turns out, all five are vital for most studies—if an automated reasoning program is to offer enough deductive power to prove even moderately interesting theorems. Indeed, without the use of strategy to restrict the application of the inference rules, far too many conclusions will be drawn, of which the vast majority will be irrelevant to the task at hand. Equally vital is the use of a procedure for canonicalization, to avoid retaining the possibly numerous ways of expressing in effect the same conclusion. Also a virtual requirement is the use of a procedure to purge the conclusion B when the conclusion A has already been retained, where A is more general than B. As we visit the five elements of automated reasoning, we note that, with the type of program under discussion, both the type of assignment and the degree of sophistication vary widely. If used in the most general and unsophis ticated manner, when given a question to answer or a problem to solve, an automated reasoning program accepts the question or problem and naively ac crues information until a termination condition is reached. When the program is unsuccessful, the termination conditions include exceeding the available or allotted memory, exceeding the allotted computer time, and deducing all possi ble conclusions within the given constraints. When successful in completing the given assignment—which often does not require a sophisticated use, at least for simple assignments—the program returns its results and, if desired, a detailed account of how they were obtained. The most frequent assignment asks the program to find a proof—almost always, a proof by contradiction. Such an approach might be viewed as historical accident. Such is not the case in the sense that seeking a proof by contradiction afords a reasoning progam access to a natural stop condition, that of easily testing for unit conflict or testing for the deduction of the empty clause. In contrast, an approach based on what might be termed a "positive approach", perhaps in the spirit of theorem finding, appears not to offer a cmparable stop condition. In addition, one might ask the program to construct some object, if such exists; for that task, OTTER offers the option of using the ANSWER literal (discussed in section 3) to "catch" and display the constructed object. Instead, the assignment can be simply one of information gathering, where the researcher intends to examine the conclusions to see whether any are especially interesting or, for that matter, to see whether the hypotheses or axioms are consistent. At the opposite end of the spectrum, a program such as OTTER can be used with a high degree of sophistication. Of course, a familiarity with the diffi culties presented by research would correctly lead one to predict that the unso phisticated use of an automated reasoning program will usually be insufficient
Collected Works of Larry Wos
1136
for attacking even moderately interesting questions or problems. The degree of sophistication is a function of the researcher's knowledge and intuition, of ex perience with the program in use, and certainly of the options and capabilities the program offers. As in mathematics, the approach one takes is crucial. With the use of a reasoning program such as OTTER, one has a choice of inference rules, of strategy, of notation, and of canonicalization rules. To make these choices independently of each other will almost certainly reduce the program's effectiveness—sometimes to the point of futility—because the side effects of using the various inference rules, strategies, notation, and the like are complex and strongly coupled and, as yet, not well understood. The incentive to master the intricacies of using a program such as OTTER rests with the possibility of having it assist in answering open questions and in solving deep problems. In sections 6.1 through 6.4, we shall show that this possibility is in fact a reality. To learn from where OTTER and other programs derive their power, let us now turn to the five basic elements.
2.1
Language
Let us quickly present the relevant concepts and notation and touch on the conventions we observe. For our various examples, we shall employ the notation appropriate for the use of OTTER. Although some variation in the syntax occurs, the most common language used to present a question or a problem to an automated reasoning program is the clause language [40,42], whose use can in many cases map one first-order formula into many clauses. By definition, a clause is a set of distinct literals, where a literal is an n-ary predicate symbol, where n is > 0, followed by its n arguments and possibly preceded by logical not. Therefore, a clause cannot contain two identical copies of a literal. Within a clause, only two logical con nectives are allowed, or and not, denoted, respectively, by | and -. Between each pair of clauses, logical and occurs implicitly. No other logical connectives are permitted within the language. (OTTER also permits use of the first-order predicate calculus, which it then translates into the clause language, and in addition permits use of infix notation for equality literals.) The arguments of a predicate can be variables or n-ary functions, with n > 0, followed by their n arguments. A function can have as its arguments variables or functions. A variable is always and only interpreted as meaning "for all", and its scope is precisely the clause in which it occurs. Existence is captured by the use of appropriate functions, as the following examples illustrate. Let us consider expressing the fact that the sum in either order of 0 and x is x in arithmetic, or that there exists an element e in a group that is a two-sided identity, or that the union in either order of the null set with any set x is that same set. If phrased in first-order predicate calculus, all three statements can be expressed with a single first-order sentence by using an appropriate predicate P:
Application
of AR to Questions from Mathematics
and Logic
1137
there exists a y such that for all x P(y, x, x) and P{x, y, x). If expressed in the clause language, the following two clauses suffice, where o is simply a constant (function of zero arguments) that expresses the existence of the corresponding object.
P(a,x,x). P(x,a,x).
The fact t h a t as is a constant asserts that the existential variable it replaces depends on no other variables. The occurrence of the same variable x in both clauses implies nothing, for the scope of a variable is no more than the clause in which it occurs. As will be clear, when we discuss the built-in treatment of equality offered by programs such as O T T E R , a more effective notational alternative exists than the given two clauses. Obviously, if one is presented either the first-order statements or the corre sponding two clauses out of context—barring the presence of some mnemonic such as 0 rather than a—no way exists to know how to attach meaning. Con versely, to obtain a characterization of the concepts under study, one needs additional clauses, which brings us to a second example of replacing an existentially quantified variable. We continue to focus simultaneously on arithmetic, group theory, and set theory, but now on the respective facts that (1) the sum in either order of x and -x is 0, (2) the product in either order of x and the inverse of x is the identity e, and (3) the intersection in either order of x and the complement of x is the null set. As in the preceding example, a single first-order sentence, with an appropriate predicate P, suffices to capture all three facts: there exists a z such that for all x there exists a y such that P{x, y, z) and P{y, x, z). Consistent with the first example, we translate the sentence into two clauses.
P(g(x),x,b). P(x,g(x),b).
The explanation for the soundness of using the (Skolem) function g whose argu ment is x rests with the fact that the existentially quantified variable y is solely a function of the universally quantified variable x. Again, without a mnemonic or additional clauses, encountering the given two clauses gives no clue concerning their mathematical correspondents. If, on the other hand, the context is group theory, then one might have found—as mnemonics—the predicate P replaced by PROD, the constant 6 replaced by e (for the group identity), and the function g replaced by the function inv (for inverse). Similarly, if the context is set theory—to further characterize the
Collected Works of Larry Wos
1138
concept of complement—one might have encountered the following two clauses concerning complement in its relation to union. UN(comp(x),x,l). UN(x,comp(x),l). For programs (such as OTTER) that offer a built-in treatment of equality, a far preferable alternative exists for expressing the concepts and relations oc curring in the two preceding examples. The following clauses provide a sample. EQUAL(sum(0,x),x). EQUAL(prod(e,x),x). EQUAL(un(comp(x),x),l). The use of the predicate EQUAL in a clause enables such a program to treat equality as "understood", giving the program access to the inference rule paramodulation which can be applied directly at the term level (see section 2.2), typically resulting in a dramatic increase in efficiency. Compared to programs that do not reason within the extended first-order predicate calculus—by automatically treating equality as understood—OTTER offers marked advantages, especially with regard to performance. Indeed, any program or any paradigm that lacks a built-in treatment of equality suffers markedly, for the type of reasoning so valuable to mathematics cannot be efficiently captured or even approximated. To experience the appeal of an equality-oriented notation, let us consider, for example, the familiar laws of commutativity and associativity of product. With the equality-oriented notation, a single clause for each suffices. EQUAL(prod(x,y),prod(y,x)). EQUAL(prod(prod(x,y),z),prod(x,prod(y,z))). On the other hand, if the program in use does not offer a built-in treatment of equality, then—although not nearly as satisfying or effective—the following clauses suffice. -PROD(x.y.z) -PROD(x,y,u) -PROD(x.y.u)
I I I
PROD(y.x.z). -PR0D(y,z,v) -PR0D(y,z,v)
| |
-PR0D(u,z,w) -PROD(x.v.w)
I I
PR0D(x,v,w). PROD(u.z.w).
Application of AR to Questions from Mathematics and Logic
1139
When we introduce various inference rules (in section 2.2), we shall revisit the given alternative representations for commutativity and associativity. Of course, between the two given notational extremes, many choices exist. For example, even without access to a built-in treatment of equality, one can use an equality predicate with appropriate functions and equality axioms. One could express associativity again with two clauses each containing four literals, but with the use of an equality predicate. As commented earlier, to make this choice independent of the choice of the inference rule can reduce the program's effectiveness. Indeed, each of the first three inference rules we introduce in the next section in general meshes best with a notation that deemphasizes the use of function symbols, and the fourth inference rule is best used with their emphasis and with a notation that implicitly assumes a built-in treatment of equality.
2.2
Inference rules
Common to all of the inference rules used by a program such as OTTER is the concern for generality. For example, if OTTER is given clauses that assert the existence of an element a and that note that product is commutative, its consideration of a left identity c with ex = x will not—without additional information—result in the deduction that ae = a. Of course, such a conclusion is sound, but not as general as that which OTTER would draw, namely, xe = x (in clause form). In contrast, a person might indeed conclude that oe = a, which is obtainable by applying the inference rule instantiation to the more general conclusion. Instantiation is not a rule that a program such as OTTER offers; we shall explain why shortly. The generality (of the conclusions drawn by an automated reasoning pro gram) results from the use of the procedure unification, on which the various inference rules rest. (Unification in a slightly less general form was used by logi cians in the context of the inference rule condensed detachment before any effort directly relevant to atomated reasoning.) Intuitively, unification is a procedure that takes two statements and looks for the largest common domain to which the two apply, and then substitutes into the variables of each statement (as little as needed) accordingly. In the example under discussion—returning to a notation that does not emphasize the role of equality—OTTER would take the first two of the following three clauses and deduce the third. PR0D(e,x,x). -PR0D(x,y,z) PR0D(x,e,x).
|
PR0D(y,x,z).
To verify the soundness of the deduction, one must keep in mind that the presence of the same variable in two different clauses is to be ignored, for the scope of a variable is simply the clause in which it occurs. If the variable x in
Collected Works of Larry Wos
1140
the first clause is renamed to w, then the third clause (ignoring variable names) is obtained by substituting e for x and w for both y and z and cancelling two literals that are identical except for sign. To anticipate a natural question, unification may require that a nontrivial substitution be made into both clauses, which we shall witness when we examine the inference rule paramodulation. The type of reasoning we have just reviewed is simultaneously an example of the application of the inference rules binary resolution [24], hyperresolution [25], and UR-resolution [17] and other inference rules. Binary resolution is required to consider two clauses at a time; hyperresolution can consider two or more clauses at a time, but is required to produce clauses that are positive (free of the not symbol -; UR-resolution (unit resulting) can consider clauses two or more at a time, but is required to produce (single literal) unit clauses (free of the or symbol |). For a more representative example of the use of hyperresolution, we focus on a fragment of reasoning taken from a proof of a classroom exercise: in a group, if the square of every element x is the identity e, then the group is commutative. Of the numerous proofs of this exercise, one can begin by assuming that the group is not commutative and that, therefore, there exist elements a and b such that ab = c but ba^ c. The first step of the proof under discussion asserts that cb = a, which follows from the simultaneous consideration of the assumption that ab = c, the hypothesis that the square of every x is e, the axiom of right identity, and the axiom of associativity. The same conclusion in clause form— the fifth of the following five clauses—is obtained by applying hyperresolution to the simultaneous consideration of the first four of the five. PR0D(a,b,c). PROD(x.x.e). PR0D(x,e,x). -PROD(x.y.u) PROD(c.b.a).
|
-PROD(y.z.v)
I
-PROD(x.v.w)
I
PROD(u.z.w).
The use of hyperresolution can produce nonunit clauses also. For a comparably representative use of UR-resolution, we consider the following five clauses, the fifth of which is obtained with this inference rule. -PROD(b.a.c). PROD(x.x.e). PROD(x.e.x). -PROD(x.y.u) | -PROD(c.a.b).
-PROD(y.z.v)
I
-PROD(x.v.w)
I
PR0D(u,z,w).
The use of UR-resolution can also produce positive clauses, clauses free of the
Application of AR to Questions from Mathematics and Logic
1141
not symbol. Especially if one has given a little thought to the classroom exercise, one might wonder about the more straightforward proof that begins by concluding that, since xx = e, (yz)(yz) = e, and finishes by deducing that zy = yz, which is obtained by multiplying on the left (of both sides of the first step) by y and on the right by z. For a program to find this particular proof would require the use of instantiation—in this case, the uniform replacement of x by yz in the equation xx = e. Although such steps are typical of the reasoning of a person—who can wisely choose which instance is promising—they never occur in the reasoning of a program of the type under discussion. Because no strategy has yet been formulated to decide which instances merit attention, and because the random application of instantiation can produce a myriad of useless conclusions, this type of reasoning is avoided. In sharp contrast to the possible use of instantiation (as we shall see in section 2.3 on strategy), the type of inference rule used by an automated reasoning program admits substantial and effective control—indeed, as we show in section 6, enough to permit a number of open questions to be answered. At the opposite end of the spectrum from instantiation—and rather different from the preceding three inference rules we have discussed—is the inference rule paramodvlation, a rule that generalizes equality substitution. For studies of group theory and the like, this inference rule offers more potential power than any other rule currently in use. In addition, with its use, one can employ—with only beneficial effects on program performance—the notation that emphasizes the use of predicates such as EQUAL, which is clearly more appealing because of its vague resemblance to mathematical notation. For example, if we return to the discussion of commutativity and the existence of a left identity to deduce the existence of a right identity—as the following clauses illustrate—we have a simple use of paramodulation. EQUAL(prod(e,x),x). EQUAL(prod(x,y).prod(y.x)). EQUAL(prod(x,e),x). For a rather more complex illustration—fulfilling our earlier promise con cerning the need to make a nontrivial substitution into both hypotheses—we turn to ordinary arithmetic in which the third clause is obtained by paramodulating from the first clause into the second. EQUAL(sum(x,minus(x)),0) . EQUAL(sum(y,sum(minus(y),z)),z). EQUAL(sum(y,0),minus(minus(y))).
Collected Works of Larry Wos
1142
To see that this last clause is in fact a logical consequence of its two parents, one unifies the argument sum(x,minus(x)) with the term sum(minus(y),z), applies the corresponding substitution to both the from and the into clauses, and then makes the appropriate term replacement justified by the typical use of equality. The substitution found by the attempt to unify the given argument and given term requires substituting minus(y) for x and minus(minus(y)) for z. To prepare for the (standard) use of equality in this example—and here we encounter a key feature of paramodulation—a nontrivial substitution for variables in both the from and the into clauses is required, which illustrates how paramodulation generalizes the usual notion of equality substitution. In contrast, in the standard use of equality substitution, one does not apply a nontrivial replacement for variables in both the from and the into statements. Summarizing, a successful use of paramodulation combines in a single step the process of finding the (in an obvious sense) most general common domain for which both the from and into clauses are relevant and applying standard equality substitution within that common domain. A single application of paramodulation can lead to the deduction of an in teresting conclusion that the usual mathematical reasoning requires more than one step to yield. In contrast to paramodulation, the mathematician or logician picks the instances—the substitutions of terms for variables—that might be of interest, and then applies (the usual notion of) equality substitution. Paramod ulation, on the other hand, picks the (maximal) instances of the from and into clauses automatically and—rather than deducing intermediate conclusions by applying the corresponding replacement of terms for variables—combines the instance picking with a standard application of equality substitution. The proofs obtained with paramodulation often have a more mathematical flavor than do those obtained with other inference rules. Nevertheless, each of the rules offers certain advantages. Indeed, although the majority of our successes with answering open questions have occurred by relying on paramodulation, the inference rules covered earlier also played an important part (see section 6.2).
2.3
Strategy
Despite the generality and power offered by the various inference rules, their application must be restricted by the use of one type of strategy and directed by the use of another type; otherwise the program can deduce far too many conclusions and can too easily proceed in an unprofitable direction. The most powerful strategy for restricting the application of an inference rule is the set of support strategy [37]; the most effective strategy for directing their application is the weighting strategy [17]. Both strategies are global in that each can be used with any of the inference rules offered by OTTER and also used with many other inference rules. The two strategies work well together. The set of support strategy restricts the program's reasoning with the in tention of sharply retarding the generation of irrelevant conclusions. To use the
Application of AR to Questions from Mathematics and Logic
1143
set of support strategy, one is required to choose a subset T of the set S of input clauses given to the program to describe the problem to be studied. The program then draws a conclusion only if it is recursively traceable to T. There fore, at the beginning of the program's attack on a problem—from a procedural viewpoint—an inference rule is applied to a subset of clauses from S only if at least one of its members is in T. Any clause that is retained is automatically given the power of the clauses that are members of T. Thus, after additional clauses have been retained, an inference rule can be applied to a subset of clauses if one of them is a clause not in S—a clause that is not an input clause. Stated another way, with the set of support strategy, the program is not allowed to apply an inference rule to a subset of clauses all of which are in S - T. In contrast to restricting the reasoning, the weighting strategy can be used to direct it in its choice of the next clause on which to focus. To use this strat egy, one assigns priorities, called weights, to the various concepts, relations, and terms. The weights can be based simply on symbol count, or they can be based on a set of elaborate templates. The intention is to give the researcher the op portunity of guiding the program's attack by giving it hints based on knowledge and intuition. By setting a maximum on the weight of a retained clause, the strategy also permits one to impose a cutoff point on complexity; any generated clause whose weight exceeds the maximum will immediately be purged. Recalling that the typical assignment asks the program to seek a proof by contradiction, our experience strongly suggests that, for the set of support strat egy to be most effective, the best choice for the subset T of the input set S of clauses is the union of those clauses that correspond to the special hypothesis (as the term is technically used in automated reasoning) and those clauses that correspond to assuming that the theorem under attack is false. The special hy pothesis consists of those assumptions (of the statement of a theorem) that are outside of the general axioms from which the theorem is taken. For an illustration of how one might use the set of support strategy, let us consider the "commutator theorem" of group theory. The theorem to prove asserts that if the cube of every element x in the group is the identity e, then [[x, y],y] = e for all x and y, where the commutator [x,y] of any two elements x and y of a group is the product of x, y, the inverse of x, and the inverse of y. The special hypothesis consists of the assumption that the cube of x is e, which can be represented with the following clause. EQUAL(prod(x.prod(x,x)),e) .
The following two clauses represent, respectively, the definition of commutator and the assumption that the theorem is false. EQUAL(com(x,y),prod(x,prod(y,prod(inv(x),inv(y))))).
Collected Works of Larry Wos
1144 -EQUAL(com(com(a,b),b),e) .
The recommended set of support consists of the three given clauses. In sec tion 4, we give a proof of this theorem relying on the use of paramodulation and including the axioms for group theory expressed in the equality-oriented notation. To illustrate the use of the weighting strategy, we again use the commuta tor theorem. If one has no intuition about how the program should attack the theorem, one can simply have the weight (priority) be strictly a function of the symbol count, which will cause the program to select as the focus of attention shorter expressions in preference to longer. Alternatively, because the commu tator involves inverse, one might give a low weight (high priority) to any term in which inverse (inv) occurs and give higher weight to any expression in which inverse does not occur. Of course, if one wishes the program to prefer a spe cific expression that is quite complex, then that expression can be assigned an extremely low weight—for example, a negative weight. In contrast to the set of support strategy, which is a global strategy designed to restrict the application of any inference rule, an automated reasoning pro gram can also use a number of other strategies that are specific in that they are designed to restrict the application of some particular inference rule, such as paramodulation. First, the program can be restricted from paramodulating from or into a variable. This restriction prevents a myriad of conclusions from being drawn. Such a restriction strategy is, in most cases, mandatory. After all, paramodulating from or into a variable will always yield a conclusion since the corresponding unification can never fail. Second, the program can be required to paramodulate only from a specified side of each equality. In some cases, all applications of paramodulation are required to be from the left side only; in others, all are required to be from the right only.
2.4
A canonicalization procedure
In many areas of mathematics and logic, one often rewrites each new deduction into a canonical form. In automated reasoning, a similar action can be taken. The procedure used by OTTER for this purpose is called demodulation, and the rules of canonicalization are called demodulators [38]. The demodulators can be included among the input clauses, or OTTER can be instructed to find its own, those that satisfy some given set of criteria. A sharp difference, however, exists between mathematics and automated reasoning. In the former, one uses canonicalization when it seems convenient and appropriate. In the latter, one cannot in most cases exercise such freedom, for— without automatically requiring each conclusion to be rewritten into a canonical form—the program will drown in information. Of course, some conclusions will be unaffected by the particular choice of demodulators in a given problem.
Application of AR to Questions from Mathematics and Logic
1145
One other difference exists between the use of canonicalization by a math ematician or logician and its use by a reasoning program. When a person uses various equalities for canonicalization, the equalities are applied only to the expressions chosen by the person; when a program applies such equalities, all expressions to which the equalities are applicable are in fact rewritten into a canonical form. Let us consider two typical examples of the use of demodulation. One might, for example, prefer to uniformly replace -(-t) by t for any term t and prefer to uniformly replace r(s + t) by rs + rt for terms r, s, and t. The following two clauses, if designated as demodulators, will achieve one's preference. EQUAL(minus(minus(x)),x). EQUAL(prod(x,sum(y,z)),sum(prod(x,y),prod(x,z))).
As one might predict, care must be taken in the choice of which equality clauses to attempt to use as demodulators. In particular, an unwise choice can cause the program to loop. Barendregt [2] defines combinatory logic as an equational system satisfying the combinators S and K (whose equations are given in section 6.1); as a corollary, one notes that S and K provide a basis for the entire logic. For example, when the following clause equivalent of the equation for the combinator W is used as a demodulator and when the program encounters the term (WW)IV, this term will be transformed to itself repeatedly without ever terminating. (W)
EQUAL(a(a(V,x),y),a(a(x,y),y)).
For a more interesting example, let us consider the expression T = a(a(W, a(B, x)),a(W, a{B, x))) and what occurs when the two demodulators (for the combinators W and B) are applied to T with the object of producing a canonical form. (W) (B)
EQUAL(a(a(W,x),y),a(a(x,y),y)). EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))).
Demodulation begins by successfully applying W, then B, to obtain a(x, D which leads to another successful application of W followed by one with B to obtain
Collected Works of Larry Wos
1146 a(x, a(x, T))
which of course leads to yet another success and, in fact, to a nonterminating sequence of successful applications of W and B. (For those who are curious, the expression T is a member of an interesting set of kernels discovered during our study of combinatory logic [19,43]; see section 6.1.) Nevertheless, as long as one is careful about the choice of demodulators, the use of demodulation almost always sharply increases the effectiveness of a reasoning program in its search for assignment completion. Even further, for many studies, without the use of demodulation the program will simply require an inordinate amount of computer time to complete rather simple assignments.
2.5
A procedure for purging trivial conclusions
Although the use of various types of strategy and of demodulation does indeed contribute markedly to the efficiency of an automated reasoning program, such a program continues to deduce conclusions that are trivial and unneeded corol laries of existing clauses. For example, if the program paramodulatea from the second argument of the clause equivalent of (Wx)y = (xy)y into the first subargument of the second argument of the clause equivalent of (W(Wx))y
= ((xy)y)y,
the program deduces the clause equivalent of {W{Wx))y = {{Wx)y)y, which is a trivial corollary, in fact an instance, of {Wx)y = (xy)y and—if the appropriate option is set—is, therefore, immediately discarded. The procedure for discarding such deductions is subsumption [24]. The clause A subsumes the clause B if there exists a uniform replacement of terms for variables in A that produces a clause that is a subclause of B. For a second example of subsumption, an example that might not be ex pected, let us consider the following two clauses and recall that a variable is relevant only to the clause in which it occurs. P(x) I P(x).
P(y).
That the second clause subsumes the first follows trivially from the definition of subsumption. However, as it turns out, the first also subsumes the second, as can be seen by replacing y by x in the first to produce the following clause.
Application of AR to Questions from Mathematics and Logic
1147
P(x). As commented earlier, a clause, by definition, does not allow duplicate literals; technically, a clause is defined as a set of distinct literals. Of particular importance is the role of subsumption for removing clauses that assert the equality of a term with itself; such an assertion is, needless to say, usually of little interest, seldom useful, but a potential source of program degradation. To remove such trivial clauses, we use the following clause for reflexivity of equality to subsume many clauses that would otherwise be kept. EqUAL(x.x). This clause, which must be included in the input if paramodulation is the chosen rule of inference, is also important in that—as we shall see in section 4 when we give a proof of the commutator theorem—a proof often terminates with the deduction of a clause asserting that some term t is not equal to itself.
3
T h e program O T T E R
The automated reasoning program OTTER (Organized Techniques for Theoremproving and Effective Research) [20] is portable, available electronically by anonymous FTP, and usable on a wide variety of computers, even on per sonal computers. OTTER, written in approximately 24,000 lines of C, accepts questions or problems expressed in the clause language or first-order predicate calculus. The inference rules offered by this program include binary resolution [24], hyperresolution [25], UR-resolution [17], paramodulation [23,39], and linked UR-resolution [33]. Its strategies include the set of support, weighting, and var ious options for controlling paramodulation. OTTER also offers the use of de modulation, subsumption, various built-in functions, the ANSWER literal, and numerous other features. Of the features not touched on in section 2, the ANSWER literal [8] is per haps of greatest interest for research. Its purpose is to "catch" as its argument the object that may be implicitly found when the program succeeds in complet ing a proof. For example, when we studied fixed point problems with the object of answering various open questions (see section 6.1), we instructed OTTER to seek appropriate proofs by contradiction. We assumed, with the intention of reaching a contradiction, that no fixed point combinator existed within the given constraints. In those cases in which OTTER found a proof that in fact such a combinator does exist, the desired combinator was displayed as an argu ment of the ANSWER literal. We shall illustrate OTTER's use of the ANSWER
1148
Collected Works of Larry Wos
literal when we focus on answers to open questions in section 6.1 (also see the Sample Input File given shortly). When no proof was found—for example, when the fixed point property under study fails to hold—then an examination of the argument of the ANSWER literal revealed that fact. One other feature of OTTER merits particular attention. If the appropriate option is set (see Sample Input File given shortly), OTTER will compare dif ferent proofs of the same conclusion to determine which proof is shorter. When a shorter proof is found, the earlier copy of the conclusion is purged, and the second copy is placed in the set of support. Although not a guarantee, the use of this option aids one in finding shorter proofs of the result under consideration. The obstacle to total success rests with the fact that the longer path to a given (intermediate) conclusion might contain steps that can be used repeatedly in the deduction of the (final) desired result, where the shorter path may lack such steps. A copy of OTTER can be obtained electronically. For details, one can write to William McCune Mathematics and Computer Science Division Argonne National Laboratory Argonne, IL 60439-4844 mccunefimcs.anl.gov Among the advantages OTTER has over its predecessors is its use of discrim ination trees for applying (forward) subsumption and for applying (forward) de modulation [21]. Because of their use, runs that formerly required 4 CPU hours to complete on a Sun 3 workstation now complete in 10 CPU minutes. OT TER typically takes each generated clause and—for maximum effectiveness— demodulates it, weighs it, tests it with subsumption to see if it merits retention and then, if all is in agreement, integrates it into the database of retained in formation; nevertheless, the program steadily deduces conclusions at the rate of 300 per CPU second on a Sun 3 workstation. What is equally—or perhaps more—impressive is OTTER's lack of degradation regardless of length of run or number of retained clauses. OTTER continues to be enhanced. A parallel-processing version (ROO) has been implemented, and experiments with it are indeed promising. We expect that a version of OTTER will continue to play a vital role in our research for many years to come. Before turning to various results, including new ones, let us briefly focus on a typical input file for OTTER. The sample file corresponds to asking OT TER to investigate the possibility that the strong fixed point property holds for a fragment of combinatory logic. Typically, for such a question, one sets various options (such as the choice of inference rule) and assigns various limits (for example, maximum allowable memory). One also includes various lists of clauses. For example, one uses the set of support strategy by placing the clauses
Application of AR to Questions from Mathematics and Logic
1149
considered to be the keys in the corresponding list. If one wishes OTTER to seek as many proofs as it can find within the allotted constraints, then one as signs 0 to the maximum number of proofs; this feature gives the researcher the opportunity of instructing OTTER to attempt to prove a number of theorems in a single run. To permit one to include comments, OTTER accepts, without echoing them, lines in the input file with the comment preceded by Sample Input File for OTTER
'/, Combinatory Logic. 7, Prove the strong fixed point property for {B, M, L>. '/. '/, Paramodulate from left sides of axioms into given clauses. set(para_into). clear(para_from_right). set(ancestor_subsume). assign(max_seconds, 600). assign(max.mem, 8000). assign(max.veight, 55). assign(max.proofs, 0). list(axioms). 7, reflexivity: EQUAL(x,x). V, the equation for the combinator {\em B}: EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). 7, the equation for the combinator {\em M}: EQUAL(a(M,x),a(x,x)). 7. the equation for the combinator <\em L}: EQUAL(a(a(L,x),y),a(x,a(y,y))). end_of_list. '/, If a refutation is found, $ANSWER contains a % fixed point combinator. list(sos). '/, denial that the strong fixed point property holds: -EQUAL(a(y,f(y)),a(f(y),a(y,f(y)))) I $ANSWER(y). endof list. list(demodulators).
1150
Collected Works of Larry Wos
V, the equation for the combinator {\em B}: EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). end_of_list.
4
Proofs of two contrasting theorems
Before turning (in section 5) to techniques for finding shorter proofs and to some successes obtained by applying them, and then (in section 6) to various open questions answered by using an automated reasoning program, let us focus here on the proofs of two contrasting theorems. The two proofs, taken from actual runs with OTTER, provide a fuller illustration of the use of the elements of automated reasoning and, more important, of the effectiveness of OTTER. We shall begin with the familiar commutator theorem from group theory to illus trate the value of using paramodulation and demodulation. Then, to illustrate the use of hyperresolution and weighting, we turn to a theorem from the area of logic known as equivalential calculus [41]. Noting that OTTER offers numerous approaches for attacking a question or problem, we shall briefly give the basis for our choice of how to attack each of the two theorems. The commutator theorem asserts that groups with exponent 3—those such that the cube of every element x is the identity e—satisfy [[x, y),y] = e for all x and y, where the commutator [x, y] of any two elements x and y of a group is the product of x, y, the inverse of x, and the inverse of y. For the attack on this theorem, we chose paramodulation as the inference rule, for we have found that problems of this type are more amenable to the use of an equality-oriented notation coupled with this inference rule. Indeed, as is typical of algebra, many of the steps that are profitable rest on an action (substitution) deep within some subterm. For our strategy, we chose the set of support strategy, placing all of the ax ioms for a group outside that set to avoid exploring group theory in general. We also used the weighting strategy, basing the priorities merely on symbol count, for we had no strong intuition about how to attack the theorem. Our use of demodulation consisted of supplying among the input clauses certain famil iar equalities to be used as demodulators and also instructing OTTER to add to the set of demodulators various equalities deduced during the run. When a demodulator was adjoined during the run, it was also used for back demodula tion, a procedure that demodulates clauses that are already present. We used subsumption to purge newly generated clauses when a more general clause was already present, and also to purge clauses already retained in preference to the generation of a more general clause. In the following proof, which was obtained in less than 1 CPU second on a Sun 4 workstation, the first number reflects the position in the sequence of kept clauses; the next set of numbers gives the history of the deduced clause. We use the functions / for product, g for inverse, and h for commutator. In the following
Application of AR to Questions from Mathematics and Logic
1151
proof, the clauses are numbered according to their place in the database of retained conclusions with the numbers taken from the corresponding computer run. The expression para-into,8,6 means that paramodulation was applied into a term in clause (8) and from an argument of clause (6). When paraJrom,8,6 occurs, the roles are reversed. The expression demod,6 means that clause (6) is used as a demodulator. Proof of the Commutator Theorem '/, reflexivity: 1 EqUAL(x.x). '/, left identity: 2 EQUAL(f(e,x),x). '/, right identity: 3 EqUAL(f(x,e),x). 7. left inverse: 4 EqUAL(f(g(x),x),e). 7, right inverse: 5 EQUAL(f(x,g(x)),e). V, associativity: 6 EQUAL(f(f(x,y),z),f(x,f(y,z))). 7. definition of commutator: 7 EQUAL(h(x,y),f(x,f(y,f(g(x),g(y))))). 7. the cube of x is the identity e:
8 EQUAL(f(x,f(x,x)),e). 7. denial of [[x,y],y}] - e: 9 -EQUAL(h(h(a,b),b),e). 17 [para_into,8,6,demod,6] EQUAL(f(x,f(y, f(x,f(y,f(x,y))))),e). 19 [para_from,8,6,demod,2,6] EQUAL(f(y,f(y,f(y,x))),x). 23 [para_into,19,5,demod,3] EQUAL(g(x),f(x,x)). 25 [back.demod,7,demod,23,23,6] EQUAL(h(x,y), f(x,f(y,f(x,f(x,f(y,y)))))). 27 [back_demod,9,demod,25,25,6,6,6,6,6,8,3,6,6,6,6,6,6, 6,6,6,6,19,19]
-EQUAL(f(a,f(b,f(b,f(a,f(a,f(b,f(b,f(a,f(b, f(a,f(a,b))))))))))),e). 30 [para_from,17,19,demod,3] EQUAL(f(y,f(x,f(y,f(x,y)))),f(x,x)). 34 [para_from,30,19] EQUAL(f(x,f(x,f(y.y))), f(y,f(x,f(y,x)))). 36 [para_from,30,6,demod,6,6,6,6] EQUAL(f(z,f(x,f(z,f(x,f(z,y))))),f(x,f(x,y))).
Collected Works of Larry Wos
1152 42
[para_from,34,6,demod,6,6,6,6,6] EQUAL(f(x,f(y,f(x,f(y,z)))),f(y,f(y,f(x,f(x,z))))). 46 [back.demod,27,demod,42] -EQUAL(f(a,i(b,f(b,i(a,f(a,f(b,f(a,f(a,f(b, f(b,f(a,b))))))))))),e). 57 [para_into,36,6,demod,6,6,6] EQUAL(f(x,f(y,f(z,i(x,i(y,f(z,f(x,u))))))), f(y,f(z,f(y,f(z,u))))). 59 [back.demod,46,demod,57,19,42,8,3,8] -EQUAL(e.e). Clause (59) c o n t r a d i c t s clause ( 1 ) , and the proof i s complete. The second theorem is taken from equivalential calculus, a field of logic whose objects are formulas in the two-place function e (for equivalent) and variables a;, y, and the like. In contrast to group theory, this field admits a standard axiomatization consisting of a single formula. Thirteen such formulas of length 11 exist, and no shorter formula is that strong; the length of a formula is its symbol count, excluding commas and grouping symbols and, if present, the predicate symbol. Of those thirteen, the last two, XHK and XHN, were shown to be single axioms by S. Winker [34] in the early 1980s. His outstanding success was obtained after many runs with AURA [26], one of our automated reasoning programs, directed by his excellent insight. Winker's approach to proving that a given formula provides a complete axiomatization for equivalential calculus was the typical taken—derive a known single axiom. For our example, we shall take the same approach. We shall focus on the formula YRM with the objective of proving that it alone axiomatizes the cal culus. (This formula was mentioned in the introduction as an example in which an automated reasoning program could obtain a proof after the retention of a clause numbered 62,364.) When we first studied this problem, the corresponding proof was obtained by choosing as the next clause on which to focus attention that with the fewest symbols. To derive formulas in this calculus, one can use the inference rule condensed detachment. This rule considers two formulas e(A, B) and C and, if A and C unify, yields the formula D where D is obtained from B by applying the unifier of A and C. To apply condensed detachment, an automated reasoning program can use hyperresolution with the following clause. -P(e(x,y))
I
-P(x)
I
P(y).
When condensed detachment is applied to a pair of formulas, that which plays the role of e(A, B)—equivalently, that which is unified with the first literal of the preceding clause—is called the major premiss. To obtain the proof that YRM is a single axiom, we used the inference rule hyperresolution to (in effect) capture condensed detachment. For the weighting
Application ofAR to Questions from Mathematics and Logic
1153
scheme, rather than making (as we did in the first study) the weight of each formula of the form e(A, B) be its length (symbol count), here we assigned the weight to be the length of A plus twice the length of B plus 2. We chose to use weighting in the given manner for the following reasons. As observed earlier, whenever condensed detachment is successfully applied to the formulas e(A, B) and C, the result D is an instance of B, and its length, therefore, is at least that of B. However, depending on the nature of the substi tution that is applied to unify A and C, the length of D can well exceed that of B. One can find, for example, two formulas such that their successful condensed detachment has a length slightly less than the sum of their lengths. Next, we recall that OTTER delays focusing on formulas with higher weight when ones of lower weight are available, and the program purges formulas whose weight exceeds the assigned maximum. Progress toward completion of a proof would, therefore, seem to be increased with the deduction of formulas of lighter weight rather than heavier weight. Given these observations—and the fact that we had never succeeded, during a period of eight years of occasional experimentation, in obtaining a proof for XHK in a single computer run—we decided to penalize formulas e(A, B) whose "tail" (B) is long. However, we decided to give slight preference to formulas whose first symbol is a single variable. The following two weight templates achieved our objectives. weight(P(e(x,2)), 1). weight(P(e(1,2)). 1).
We note that the order of the two templates is important; if the order is reversed, then the desired preferential treatment would not be given. As evidence of the effectiveness of the given weighting scheme, we also note that the following proof, although completing with the derivation of XGF as does the proof whose last step is clause (62364), completes with an earlier clause. Proof for YRM 7, condensed detachment: 1 [] -P(e(x,y)) I -P(x) I P(y). 7. denial of {\em XGF}: 6 [] -P(e(a,e(e(b,e(a,c)),e(c,b)))) I $ANSWER(P5_XGF). 7, the formula {\em YRM}: 26 [] P(e(e(x,y).e(z,e(e(y,z),x)))).
27 [hyper,26,1,26] P ( e ( x , e ( e ( e ( y , e ( e ( z , y ) , u ) ) , x ) , e ( u , z ) ) ) ) . 28 [hyper,27,1,27] P ( e ( e ( e ( x , e ( e ( y , x ) , z ) ) , e(u,e(e(e(v,e(e(w,v),v6)),u),e(v6,w)))),e(z,y))). 30 [hyper,27,1,26] P ( e ( e ( e ( x , e ( e ( y , x ) , z ) ) , e ( e ( u , v ) ,
1154
Collected Works of Larry Wos
e(w,e(e(v,w),u)))),e(z,y))). 31 [hyper,30,1,30] P ( e ( e ( x , e ( e ( e ( y , e ( e ( e ( z , e ( e ( u , z ) , v)),y),e(v,u))),x),w)),w)). 34 [hyper,31,1,26] P ( e ( e ( x , e ( e ( y , e ( e ( e ( z , e ( e ( u , z ) , v ) ) , y),e(v,u))),e(w,x))),w)). 42 [hyper,28,1,26] P ( e ( e ( e ( x , e ( y , e ( z , x ) ) ) , z ) , y ) ) . 43 [hyper,42,1,27] P ( e ( e ( e ( x , e ( e ( y , x ) , z ) ) , e ( e ( e ( u , e(v,e(w,u))),w),v)),e(z,y))). 44 [hyper,42,1,26] P ( e ( x , e ( e ( y , x ) , e ( e ( z , e ( y , e ( u , z ) ) ) , u ) ) ) ) . 55 [hyper,43,1,34] P ( e ( e ( e ( e ( e ( x , e ( y , e ( z , x ) ) ) , z ) , y ) , e(e(e(u,e(e(v,u),w)),v6),e(w,v))),v6)). 56 [hyper,43,1,30] P ( e ( e ( x , e ( e ( e ( y , e ( e ( z , y ) , e ( e ( u , e(z,e(v,u))),v))),x),w)),w)). 96 [hyper,55,1,42] P ( e ( e ( x , e ( e ( e ( e ( e ( y , e ( z , e ( u , y ) ) ) , u ) , z),x),v)),v)). 100 [hyper,96,1,44] P ( e ( e ( x , e ( e ( e ( e ( y , e ( z , e ( u , y ) ) ) , u ) z),e(v,x))),v)). 106 [hyper,100,1,44] P ( e ( x , e ( e ( e ( y , e ( z , e ( u , y ) ) ) , u ) , e ( z , x ) ) ) ) . 107 [hyper,106,1,56] P ( e ( e ( x , y ) , e ( z , e ( x , e ( y , z ) ) ) ) ) . 110 [hyper,106,1,31] P ( e ( e ( e ( x , e ( e ( y , x ) , z ) ) , y ) , z ) ) . 111 [hyper,106,1,30] P ( e ( e ( x , e ( y , e ( z , e ( y , x ) ) ) ) , z ) ) . 120 [hyper,111,1,110] P ( e ( x , e ( e ( x , y ) , y ) ) ) . 134 [hyper,120,1,43] P ( e ( e ( e ( x , y ) , y ) , x ) ) . 166 [hyper,134,1,134] P ( e ( x , x ) ) . 174 [hyper,134,1,110] P ( e ( x , e ( e ( y , x ) , y ) ) ) . 177 [hyper,166,1,120] P ( e ( e ( e ( x , x ) , y ) , y ) ) . 191 [hyper,174,1,177] P ( e ( e ( x , e ( y , y ) ) , x ) ) . 200 [hyper,174.1,134] P ( e ( e ( x , e ( e ( e ( y , z ) , z ) , y ) ) , x ) ) . 449 [hyper,200,1,27] P ( e ( e ( x , e ( y , x ) ) , y ) ) . 461 [hyper,449,1,28] P ( e ( e ( e ( e ( x , e ( e ( y , x ) , z ) ) , u ) , e(z,y)),u)). 6004 [hyper,107,1,174] P ( e ( e ( x , e ( e ( y , z ) , e ( u , e ( y , e(z,u))))),x)). 6327 [hyper.6004,1,106] P ( e ( e ( x , e ( y , e ( z , x ) ) ) , e ( z , y ) ) ) . 6369 [hyper,6327,1,174] P ( e ( e ( x , e ( e ( y , e ( z , e ( u , y ) ) ) , e(u,2))),x)). 6375 [hyper,6327,1,30] P ( e ( e ( e ( x , y ) , e ( e ( y , z ) , x ) ) , z ) ) . 6379 [hyper.6327,1,44] P ( e ( e ( x , e ( y , e ( z , x ) ) ) , e ( y , z ) ) ) . 6416 [hyper,6375,1,461] P ( e ( e ( e ( e ( x , y ) , z ) , e ( z , x ) ) , y ) ) . 6508 [hyper,6416,1,191] P ( e ( e ( e ( x , e ( y , y ) ) , z ) , e ( z , x ) ) ) . 6521 [hyper,6379,1,174] P ( e ( e ( x , e ( e ( y , e ( z , e ( u , y ) ) ) , e(z,u))),x)). 6587 [hyper,6508,1,6327] P ( e ( e ( x , e ( x , y ) ) , y ) ) . 6607 [hyper,6587,1,174] P ( e ( e ( x , e ( e ( y , e ( y , z ) ) , z ) ) , x ) ) .
Application of AR to Questions from Mathematics and Logic
1155
7917 [hyper,6369,1,30] P ( e ( e ( x , e ( y , z ) ) , e ( e ( z , x ) , y ) ) ) . 8508 [hyper,6521,1,30] P ( e ( e ( e ( x , y ) , z ) , e ( e ( y , z ) , x ) ) ) . 13522 [hyper,7917,1,7917] P ( e ( e ( x , e ( y , e ( x , z ) ) ) , e ( z , y ) ) ) . 13541 [hyper,7917,1,6607] P ( e ( e ( x , y ) , e ( y , x ) ) ) . 16960 [hyper,8508,1.13522] P ( e ( e ( e ( x , e ( y , z ) ) , e ( z , x ) ) , y ) ) . 18590 [hyper,16960.1,13541] P ( e ( x , e ( e ( y , e ( x , z ) ) , e ( z , y ) ) ) ) . Clause (18590), XGF, contradicts clause (6), the denial of XGF, and the proof i s complete. From the statistics, we conjecture that—without the use of discrimination trees to sharply decrease the CPU time required to apply subsumption—the preced ing proof would have required 1 CPU hour on a Sun 4 workstation rather than the 2.5 CPU minutes that were required. Indeed, to obtain that proof, OTTER generated more than 72,000 clauses, more than 45,000 of which were subsumed. When we omitted the first of the two weight templates, OTTER completed a proof with clause (34692). Finally, the omission of both templates, as experi ments show, causes OTTER to find far fewer proofs—derive far fewer known single axioms. Noting that we are building a case for the use of an automated reasoning program for research and, equally, for the usefulness of OTTER, let us now turn to some new results concerning shorter proofs and the techniques for obtaining them.
5
Searching for shorter proofs
One of the frequently posed questions—especially when, during a lecture, we have presented proofs obtained with an automated reasoning program—concerns the possibility of using such a program to find shorter proofs. Until recently, we have had little to offer in this regard. However, the past two years of research and experimentation have led to the discovery of various techniques and pro cedures that have proved quite profitable to use. In this section, we present some of those techniques and some of the successes obtained with their use. The program OTTER again played a key role. Probably from the beginning of mathematics and logic, the pursuit of shorter proofs has been a concern of mathematicians and logicians. In fact, our entrance into the study of equivalential calculus was prompted by Kalman's suggestion that we seek, with the assistance of one of our reasoning programs, a shorter proof establishing that the formula XGK is a single axiom for that calculus, which we succeeding in doing [41]. The interest in shorter proofs rests in part with their possible elegance and in part with the desire to know. Shorter proofs are also of interest for various applications in areas including combinatory logic, circuit design, and program
Collected Works of Larry Wos
1156
synthesis, especially when the proved theorem concerns existence. For example, if OTTER proves that, for some given fragment of combinatory logic, the strong fixed point property holds, then appropriate use of the ANSWER literal con veniently provides the corresponding fixed point combinator as its argument. Since the length of the proof is directly related to the length of the fixed point combinator, the shorter the proof, (more likely) the smaller the combinator. Similarly, if the problem that is solved by OTTER focuses on the design of a circuit, then finding a shorter proof may well mean that a far more efficient circuit has been constructed. Essentially the same remark holds for program synthesis. Before presenting some general techniques that OTTER can apply to assist the researcher in seeking shorter proofs, let us first focus on a specific example. Again, we turn to equivalential calculus but, this time, to the theorem estab lishing that the following formula (XGK) is a single axiom. (XGK)
e{x,e(e(y,e(z,x)),e{z,y)))
This formula was proved by Kalman [11] to be a single axiom for the calculus— the eleventh discovered out of the thirteen that exist. Kalman's proof proceeds by deriving (with 43 applications of condensed detachment) the formula PYO, (PYO) e(e(e(x, e(y, z)), z), e{y, x)) which was already known to be a single axiom for the calculus. The proof we found in response to Kalman's suggestion consists of 23 derived steps, also cul minating in the deduction of the formula PYO [41]. Because we found the study of XGK so stimulating, and because we found the theorem in question to be potentially difficult for automated reasoning pro grams, we included it as a challenge problem in a recent publication [46]. Ac cepting our challenge, A. Marien [16] made a remarkable discovery, a 10-step derivation of PYO from XGK; we strongly conjecture that no shorter derivation is possible. We thank Marien, for his achievement led directly to our successful use of OTTER to find a proof similar in structure and, more important, to its use to find new and far shorter proofs establishing that each of the formulas XHK and XHN is a single axiom for equivalential calculus. In section 6.2, we give some of the pertinent details concerning the new shorter proofs; it is im portant to note that we would never have attempted to prove either theorem, much less to search for shorter proofs, had it not been for Winker's success, for which we are indeed indebted. To introduce by example the first general technique for (possibly) finding shorter proofs, we give two proofs of the theorem that asserts that, from the formula XGK, one can derive the formula PYO. The technique relies on using one of OTTER's option—that of level saturation—to choose the clauses on which to focus in the order they are retained, coupled with the use of weighting to block the retention of an unwanted clause. To instruct OTTER to use level saturation, one uses the following instruction.
Application of AR to Questions from Mathematics and Logic
1157
set(sos_queue) We were led to use level saturation because of Marien's success. We were led to use weighting to block the retention of unwanted clauses because of the following observation. Whenever the formula e(x, x) is used as the major premiss, condensed de tachment always succeeds, but merely returns a second copy of the minor pre miss. Then, from an intuitive viewpoint—although the use of the formula e(x, x) as a minor premiss can yield new deductions—this formula is rather like reflexivity of equality, which we seldom use for making deductions. We therefore decided to see what improvement (if any) in CPU time would result if OTTER was prevented from ever using e(x,x). The first proof we give relies on level saturation, but does not block the use of any specified clause. The second, also relying on a level saturation approach, blocks the use of e(x, x) and, as we unexpectedly found, is shorter than the first and in fact is similar in structure to that found by Marien. To obtain the second proof, we added the following statement to the input. weight(P(e(x,x)),80). To have OTTER assign a weight of 80 to the clause correspondent of e(x,x), one must place this weight template before any other that might apply. We then set the maximum weight for retained clauses to 52 so that, if e(x, x) was ever derived, it would immediately be purged because of having too high a weight. As one can see by examining the first of the two proofs we give shortly, the corresponding clause was derived, and it was used in the proof. In answer to a natural question, had we omitted the predicate P from the given weight template, then far more than the unwanted clause would have been immediately purged upon generation. Indeed, this omission would have caused OTTER to assign a weight of 80 or greater to any clause containing a subterm of the form e(u, v) for any (not necessarily distinct) variables u and v. Let us now give the two proofs. The first proof, which relies on hyperresolution as the inference rule, uses weighting only to purge clauses deemed too complex, where complexity (weight) is measured simply in terms of symbol count. The second and more satisfying proof, which is similar in structure to Marien's, also relies on hyperresolution but, more important, uses weighting to block certain paths of exploration by immediately purging (if generated) the clause equivalent of the formula e(x, x). The first proof requires approximately 600 CPU seconds to obtain and is thirteen steps in length, and the second proof requires approximately 120 CPU seconds to obtain and is ten steps in length.
Collected Works of Larry Wos
1158 Proof 1, XGK Implies PYO % condensed detachment: 1 G - P ( e ( x , y ) ) I -P(x) I P(y). 7, 35 '/. 36
denial of {\em PYO}: [] -P(e(e(e(a,e(b,c)),c),e(b,a))) I $ANSWER(PYO). the formula {\em XGK}: [] P(e(x,e(e(y,e(z,x)),e(z,y)))).
37 [hyper,36,1,36] P ( e ( e ( x , e ( y , e ( z , e ( e ( u , e ( v , z ) ) , e(v,u))))),e(y,x))). 41 [hyper,37,1,36] P ( e ( e ( x , e ( y , e ( e ( z , e ( u , e ( v , e(e(w,e(v6,v)),e(v6,w))))),e(u,z)))),e(y,x))). 42 [hyper,37,1,36] P ( e ( e ( e ( e ( x , e ( y , z ) ) , e ( y , x ) ) , e ( z , u ) ) , u ) ) . 44 [hyper,41,1,36] P ( e ( e ( e ( x , y ) , e ( e ( y , e ( x , e ( z , e(e(u,e(v,z)),e(v,u))))),w)),w)). 46 [hyper,42,1,42] P ( e ( x , x ) ) . 50 [hyper,42,1,36] P ( e ( e ( x , e ( y , e ( e ( e ( e ( z , e ( u , v ) ) , e(u,z)),e(v,w)),w))),e(y,x))). 59 [hyper,46,1,36] P ( e ( e ( x , e ( y , e ( z , z ) ) ) , e ( y , x ) ) ) , e(u,v)),v)))). 88 [hyper,59,1,44] P ( e ( x , e ( e ( y , z ) , e ( e ( z , e ( y , e ( u , e(e(v,e(w,u)),e(w,v))))),e(x,e(v6,v6)))))). 103 [hyper,65,1,36] P ( e ( e ( x , e ( y , e ( z , e ( z , e ( e ( e ( e ( u , e(v,w)),e(v,u)),e(w,v6)),v6))))),e(y,x))). 222 [hyper,88,1,37] P ( e ( e ( x , y ) , e ( z , e ( z , e ( y , e ( x , e ( u , e (e(v,e(w,u)),e(w,v))))))))). 917 [hyper,222,1,42] P ( e ( x , e ( e ( y , z ) , e ( e ( z , e ( y , x ) ) , e(u,e(e(v,e(w,u)),e(w,v))))))). 8792 [hyper,917,1,103] P ( e ( e ( e ( x , e ( y , z ) ) , z ) , e ( y , x ) ) ) . Clause (8792), PYO, contradicts clause (35), the denial of PYO, and the proof is complete.
Proof 2, XGK Implies PYO V, condensed detachment: 1 [] -P(e(x.y)) I -P(x) I P(y). 7. 35 7. 36
denial of {\em PYO}: [] -P(e(e(e(a,e(b,c)),c),e(b,a))) I $ANSWER(PY0). the formula {\em XGK}: [] P(e(x,e(e(y,e(z,x)),e(z,y)))).
Application
of AR to Questions from Mathematics
and Logic
1159
37 [ h y p e r , 3 6 , 1 , 3 6 ] P ( e ( e ( x , e ( y , o ( z , e ( e ( u , e ( v , z ) ) , e(v,u))))),e(y,x))). 42 [ h y p e r , 3 7 , 1 , 3 6 ] P ( e ( e ( e ( e ( x , e ( y , z ) ) , e ( y , x ) ) , e ( z , u ) ) , u ) ) . 46 [ h y p e r , 4 2 , 1 . 3 7 ] P ( e ( x , e ( e ( e ( y , e ( z , u ) ) , e ( z , y ) ) , e(u,e(x,e(v,e(e(w,e(v6,v)),e(v6,w)))))))). 50 [ h y p e r , 4 2 , 1 , 3 7 ] P ( e ( e ( x , e ( e ( y , e ( z , x ) ) , e ( z , y ) ) ) , e ( u , u ) ) ) . 54 [ h y p e r , 4 6 , 1 , 3 7 ] P ( e ( e ( e ( x , e ( y , z ) ) , e ( y , x ) ) , e ( e ( e (u,e(v,w)),e(v,u)),e(w,z)))). 61 [ h y p e r , 5 0 , 1 , 3 6 ] P ( e ( e ( x , e ( y , e ( e ( z , e ( e ( u , e ( v , z ) ) , e(v,u))),e(w,v)))),e(y,x))). 78 [ h y p e r , 6 1 , 1 , 3 6 ] P ( e ( e ( e ( x , x ) , e ( e ( y , e ( e ( z , e ( u , y ) ) , e(u,z))),v)),v)). I l l [hyper,78,1,36] P ( e ( e ( x , e ( y , e ( e ( e ( z , z ) , e ( e ( u , e(e(v,e(w,u)),e(w,v))),v6)),v6))),e(y,x))). 350 [ h y p e r , 1 1 1 , 1 , 3 6 ] P ( e ( e ( x , e ( e ( e ( y , y ) , e ( e ( z , e(e(u,e(v,z)),e(v,u))),x)),w)),w)). 2578 [ h y p e r , 3 5 0 , 1 , 5 4 ] P ( e ( e ( e ( x , e ( y , z ) ) , z ) , e ( y , x ) ) ) . C l a u s e ( 2 5 7 8 ) , PYO, c o n t r a d i c t s c l a u s e ( 3 5 ) , t h e d e n i a l of PYO, and t h e proof i s c o m p l e t e . Although both proofs were obtained with level saturation—choosing (for the focus of attention) the clauses precisely in the order they are retained—such an approach typically requires entirely too much CPU time to complete assign ments. Usually, far more effective is a search based on selecting, as the "next" clause on which to focus, the clause with the lowest weight, where the weight of a clause is dictated by the various weight templates. However, such an attack on the formula XGK, with symbol count as the basis for weight assignment, produced a far longer proof, 51 steps, than either of the two cited proofs and required approximately 30 times as long to complete. In contrast to the preceding example in which a single run suffices to obtain a shorter proof, let us now consider an example in which iteration is the key, an example t h a t combines theorem proving with proofchecking and even with a small taste of referecing. A study of the example will show one how to have O T T E R assist in the translation of a proof from one axiom system to another and also how O T T E R can be used to supply missing steps of a proof. More important, its study will illustrate how the use of O T T E R can result in a far more satisfying proof than was anticipated. The theorem to prove is taken from an area of logic closely related to implicational calculus. Again the inference rule is condensed detachment. In the following four axioms, which characterize the field of study, one can think of the function t as "implies" and the function n as "negation". i(x, i(y, x)
Collected Works of Larry Wos
1160 i(i(x,y),i(i(y,z),i(x,z))) i(i(i(x,y),y),i(i(y,x),x)) i{i{n(x),n(y)),i(y,x))
The theorem to prove, which was called the fifth conjecture of Lukasiewicz [14], asserts that the four axioms together imply i(i(i(x,y),i{y,x)),i{y,x)). As we did in our first attempt with OTTER, one can recast the problem as Wajsberg successfully did [7] by introducing the constant T (true) and relying on the following axioms. i(T,x) = x i(i{x, y), i(i(y, z), i(x, z))) = T i(i(x,y),x) = i(i(y,x),x) i(i(n(x),n(Y))Ay,*))=T The theorem to prove asserts that i(i(i(x,y),i{y,x)),i(y,x))
=T.
Because of the emphasis on equality, we chose paramodulation and demodula tion as the basis of our attack, using a feature in OTTER that is a variation of the Knuth-Bendix approach to a complete set of reductions [13]. OTTER found a 50-step proof. This success immediately led to the following question. Could OTTER use condensed detachment to prove the theorem as it was originally stated, without the use of equality and the constant T (true)? Our first attempt, predictably, was to use hyperresolution. Without finding a proof, OTTER generated clauses at such a high rate and retained so many that we decided to examine the equality-oriented proof and see how many of its steps had a correspondent in OTTER's use of condensed detachment. Few were found. For example, the clause equivalent of the apparently key step i(i(x,y),t(n(j/),n(z)))=T was absent. Subsequent experimentation revealed that the proof of this lemma could in fact be obtained with the use of condensed detachment implemented by means of hyperresolution, but more than 38,000 CPU seconds would be required on a Sun 4 workstation, and the proof would complete upon retention of clause (21542). Because a number of steps in the equality-oriented proof occur after this lemma, we conjectured that to have OTTER find, without substantial intervention by us, a condensed detachment proof in a single run would require many CPU weeks—or more. Indeed, even with the use of the potentially far more powerful inference rule (linked hyperresolution [33]), a recent attempt with OTTER failed after the generation of more than 983,000,000 clauses and the use of more than 440 CPU hours. The challenge remains open.
Application of AR to Questions from Mathematics and Logic
1161
In the interval, we did formulate an approach for OTTER to assist us in producing a condensed detachment proof of the desired result, an approach that enabled OTTER to supply the needed missing steps by combining theorem proving, proofchecking, and refereeing. The approach consisted of first producing an outline of a condensed detachment proof whose steps are the correspondents of those occurring in the equality-oriented proof. We then discovered how one could use certain lemmas (if available) to yield the missing steps to complete a proof from the outline. With a series of runs designed to find the desired lemmas and possibly some of the missing steps, we iterated, using the discoveries from one run as part of the input for the next run. We used weighting to cause OTTER to prefer, in the run that followed, the discoveries from the preceding run. We expected that the completed proof would require at least 150 applications of condensed detachment. The iterative approach succeeded. However, instead of finding the expected proof, OTTER produced a 63-step proof, which we now give. Proof of Lukasiewicz's Fifth Conjecture
V, condensed detachment: 1 [] - P ( i ( x , y ) ) I -P(x) I P(y). '/. denial of fifth conjecture of Lukasiewicz: 45 [] -P(i(i(i(a,b),i(b,a)),i(b,a))) I $ANS(Luka_5). '/, four axioms for the logic:
48 49 50 51 52 54 55 56 58 59 61 62 63 64
[] [] [] []
P(i(x,i(y,x))). P(i(i(x,y),i(i(y,z),i(x,z)))). P(i(i(i(x,y),y),i(i(y,x),x))). P(i(i(n(x),n(y)),i(y,x))).
[hyper,48,1,48] P ( i ( x , i ( y , i ( z , y ) ) ) ) . [hyper,49,1,49] P ( i ( i ( i ( i ( x , y ) , i ( z , y ) ) , u ) , i ( i ( z , x ) , u ) ) ) . [hyper,49,1,48] P ( i ( x , i ( i ( y , z ) , i ( i ( z , u ) , i ( y , u ) ) ) ) ) . [hyper,49,1,48] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . [hyper,50,1,49] P ( i ( i ( i ( i ( x , y ) , y ) , z ) , i ( i ( i ( y , x ) , x ) , z ) ) ) . [hyper.51,1,49] P ( i ( i ( i ( x , y ) , z ) , i ( i ( n ( y ) , n ( x ) ) , z ) ) ) . [hyper,52,1,50] P ( i ( i ( i ( x , i ( y , x ) ) , z ) , z ) ) . [hyper,54,1,54] P ( i ( i ( x , i ( y , z ) ) , i ( i ( u , y ) , i ( x , i ( u , z ) ) ) ) ) . [hyper,54,1,49] P ( i ( i ( x , y ) , i ( i ( i ( x , z ) , u ) , i ( i ( y , z ) , u ) ) ) ) . [hyper,55,1,50] P ( i ( i ( i ( i ( x , y ) , i ( i ( y , z ) , i ( x , z ) ) ) , u ) , u». 66 [hyper,56,1,51] P ( i ( n ( x ) , i ( x , y ) ) ) . 68 [hyper,56,1,50] P ( i ( x , i ( i ( x , y ) , y ) ) ) . 71 [hyper,58,1,58] P ( i ( i ( i ( x , i ( y , x ) ) , i ( y , x ) ) , i(i(i(x,y),y),x))).
1162
Collected Works of Larry Wos
74 [hyper,61,1,59] P ( i ( i ( n ( x ) , n ( i ( y , i ( z , y ) ) ) ) , x ) ) . 75 [hyper,64,1,59] P ( i ( i ( n ( x ) , n ( i ( i ( y , z ) , i ( i ( z , u ) , i(y,u))))),x)). 76 [hyper,64.1,54] P ( i ( i ( x , i ( y , z ) ) , i ( x , i ( i ( z , u ) , i(y,u))))). 78 [hyper,66,1.62] P ( i ( i ( x , y ) , i ( n ( y ) , i ( x , z ) ) ) ) . 79 [hyper,66,1,49] P ( i ( i ( i ( x , y ) , z ) , i ( n ( x ) , z ) ) ) . 81 [hyper,68,1,62] P ( i ( i ( x , i ( y , z ) ) , i ( y . i ( x , z ) ) ) ) . 82 [hyper,71,1,56] P ( i ( i ( x , y ) , i ( i ( i ( y , x ) , x ) , y ) ) ) . 84 [hyper,74,1,68] P ( i ( i ( i ( i ( n ( x ) , n ( i ( y , i ( z , y ) ) ) ) , x ) . u),u)). 85 [hyper,76,1,68] P ( i ( x , i ( i ( y , z ) , i ( i ( x , y ) , z ) ) ) ) . 87 [hyper,78,1,49] P ( i ( i ( i ( n ( x ) , i ( y , z ) ) , u ) , i ( i ( y , x ) , u ) ) ) . 89 [hyper,79,1,75] P ( i ( n ( n ( x ) ) , x ) ) . 91 [hyper,81,1,64] P ( i ( i ( x , y ) , i ( i ( z , x ) , i ( z , y ) ) ) ) . 94 [hyper,84,1,54] P ( i ( i ( x , i ( n ( y ) , n ( i ( z , i ( u , z ) ) ) ) ) , i(x,y))). 96 [hyper,85,1,49] P ( i ( i ( i ( i ( x , y ) , i ( i ( z , x ) , y ) ) , u ) , i ( z , u ) ) ) . 98 [hyper,89,1,63] P ( i ( i ( i ( n ( n ( x ) ) , y ) , z ) , i ( i ( x , y ) , z ) ) ) . 99 [hyper,89,1,51] P ( i ( x , n ( n ( x ) ) ) ) . 108 [hyper,91,1,89] P ( i ( i ( x , n ( n ( y ) ) ) , i ( x , y ) ) ) . 110 [hyper,91,1,56] P ( i ( i ( x , i ( i ( y , z ) , u ) ) , i ( x , i ( z , u ) ) ) ) . 111 [hyper,91,1,51] P ( i ( i ( x , i ( n ( y ) , n ( z ) ) ) , i ( x , i ( z , y ) ) ) ) . 112 [hyper,94,1,87] P ( i ( i ( n ( x ) , y ) , i ( n ( y ) , x ) ) ) . 116 [hyper,99,1,49] P ( i ( i ( n ( n ( x ) ) , y ) , i ( x , y ) ) ) . 122 [hyper,111,1,79] P ( i ( i ( i ( x , y ) , n ( z ) ) , i ( z , x ) ) ) . 125 [hyper,112,1,98] P ( i ( i ( x , y ) , i ( n ( y ) , n ( x ) ) ) ) . 130 [hyper,116,1,91] P ( i ( i ( x , i ( n ( n ( y ) ) , z ) ) , i ( x , i ( y , z ) ) ) ) . 135 [hyper,125,1,91] P ( i ( i ( x , i ( y , z ) ) , i ( x , i ( n ( z ) , n ( y ) ) ) ) ) . 136 [hyper,125,1,61] P ( i ( n ( i ( x , y ) ) , n ( y ) ) ) . 138 [hyper,125,1,49] P ( i ( i ( i ( n ( x ) , n ( y ) ) , z ) , i ( i ( y , x ) , z ) ) ) . 139 [hyper,125,1,122] P ( i ( n ( i ( x , y ) ) , n ( i ( i ( y , z ) , n ( x ) ) ) ) ) . 142 [hyper,135,1,110] P ( i ( i ( i ( x , y ) , i ( z , u ) ) , i ( y , i ( n ( u ) , n(z))))). 144 [hyper,136,1,82] P ( i ( i ( i ( n ( x ) , n ( i ( y , x ) ) ) , n(i(y,x))),n(x))). 146 [hyper,138,1,91] P ( i ( i ( x , i ( i ( n ( y ) , n ( z ) ) , u ) ) , i(x,i(i(z.y),u)))). 147 [hyper,138,1,58] P ( i ( i ( i ( n ( x ) , n ( y ) ) , n ( y ) ) , i(i(x.y).n(x)))). 148 [hyper,139,1,91] P ( i ( i ( x , n ( i ( y , z ) ) ) , i(x.n(i(i(z,u),n(y)))))). 151 [hyper,144,1,91] P ( i ( i ( x , i ( i ( n ( y ) , n ( i ( z , y ) ) ) , n(i(z,y)))),i(x,n(y)))).
Application of AR to Questions from Mathematics and Logic 152 154 156 160 163 165 168 169 173 175 178 179 182 183 184 187
1163
[hyper,147,1,142] P ( i ( n ( x ) , i ( n < n ( y ) ) , n ( i ( y , x ) ) ) ) ) . [hyper,151,1,59] P ( i ( i ( i ( i ( x , y ) , y ) , n ( i ( x , y ) ) ) , n ( y ) ) ) . [hyper,152,1,130] P { i ( n ( x ) , i ( y , n ( i ( y , x ) ) ) ) ) . [hyper,154,1,91] P ( i ( i ( x , i ( i ( i ( y , z ) , z ) , n(i(y,z)))),i(x,n(z)))). [hyper,156,1,68] P ( i ( i ( i ( n ( x ) , i ( y , n ( i ( y , x ) ) ) ) , z ) , z ) ) . [hyper,160.1,58] P ( i ( i ( i ( i ( x , y ) , y ) , n ( i ( y , x ) ) ) , n ( x ) ) ) . [hyper,165,1,91] P ( i ( i ( x , i ( i ( i ( y , z ) , z ) , n(i(z,y)))),i(x,n(y)))). [hyper,168,1,96] P ( i ( i ( x , y ) , i ( i ( y , n ( i ( y , x ) ) ) , n ( x ) ) ) ) . [hyper,169,1,163] P ( i ( i ( i ( x , n ( i ( x , y ) ) ) , n(i(i(x,n(i(x,y))),n(y)))),n(n(y)))). [hyper,173,1,108] P ( i ( i ( i ( x , n ( i ( x , y ) ) ) , n(i(i(x,n(i(x,y))),n(y)))),y)). [hyper,175,1,91] P ( i ( i ( x , i ( i ( y , n ( i ( y , z ) ) ) , n(i(i(y,n(i(y,z))),n(z))))),i(x,z))). [hyper,178,1,148] P ( i ( i ( i ( x , n ( i ( x , y ) ) ) , n ( i ( y , x ) ) ) , y ) ) . [hyper,179.1,91] P ( i ( i ( x , i ( i ( y , n ( i ( y , z ) ) ) , n(i(z,y)))),i(x,z))). [hyper,182,1,96] P ( i ( x , i ( i ( n ( i ( x , y ) ) , n ( i ( y , x ) ) ) , y ) ) ) . [hyper,183,1.146] P ( i ( x , i ( i ( i ( y , x ) , i ( x , y ) ) , y ) ) ) . [hyper,184.1,81] P ( i ( i ( i ( x , y ) , i ( y , x ) ) , i ( y , x ) ) ) .
Clause (187) contradicts clause (45), and the proof i s complete.
To find this proof with an automated reasoning program, in contrast to checking it, offers a substantial challenge. We have made numerous unsuccessful attempts, including one—as commented earlier—that generated more than 983,000,000 clauses. Nevertheless, the study of this Lukasiewicz conjecture did lead to the proofchecking/refereeing mode we have discussed. The success with finding a shorter proof establishing XGK to be a single axiom and the success with obtaining—in contrast to finding—a condensed de tachment proof of the fifth conjecture of Lukasiewicz together hint at the variety of assistance OTTER offers and suggest that the likelihood of reaching one's re search goal can be sharply influenced by the choices made by the researcher—the choices of representation, inference rule, and strategy, for example. That the dif ferent choices offered by a program such as OTTER produce a wide spectrum of behavior merely reflects the complexity of mathematics and logic. In the approach we prefer, the researcher plays the role of expert to give advice, the program functions as a tireless assistant to execute complex instructions, and together they form an extremely effective team—sometimes. With regard to some of the general techniques for finding shorter proofs with OTTER's assistance—rather than the single weight template that was
Collected Works of Larry Wos
1164
used in the first example—one can include many weight templates, some to block the use of expressions deemed undesirable, and some to encourage the use of others. Alternatively, since weighting is more costly (measured in CPU time) than demodulation is, one can achieve the same objective with demodulators in place of weight templates. Demodulation has the additional advantage of blocking the use of instances of expressions designated as undesirable; however, more care must be exercised with the use of demodulation than with the use of weighting. For example, one can use the following demodulator to cause OTTER to discard any clause containing a subterm that is an instance of e(x, x). EQUAL(e(x,x).discard). If this is the choice, then one includes a weight template assigning to the term discard a weight higher than the chosen maximum weight. A second technique for finding shorter proofs is based on the choice of input clauses included in the set of support. Indeed, the inclusion of a clause permits its interaction with those input clauses outside of the set of support, where its exclusion blocks such interactions and truncates numerous paths that might otherwise be explored. Although preventing the interaction of various clauses does not guarantee that no path to some chosen clause exists, such an action in general reorders the search space dramatically, which in turn might lead to finding a totally different proof—sometimes a shorter proof. A third technique concerns the global approach to selecting the next clause to be the focus of attention. Ordinarily, our approach is to instruct OTTER to base its selection on the weights of the clauses in the set of support that have not yet been the focus of attention, selecting that with the lowest weight. However, as illustrated earlier, if one replaces this approach with that of level saturation, which instructs the program to choose clauses in the order they are retained, then the weights of the retained clauses are ignored and the search space is again dramatically reordered. With level saturation, one can still block the use of various expressions and subexpressions with weighting and with demodulation. With weighting, one uses the purge-gen list on which one places weight templates to be used for deciding that a generated clause is to be discarded because its weight is too high. Each of the three given techniques is designed to perturb the search space. In contrast to these techniques, each of which is indirect in that actual comparisons of proof lengths are not made, one can use a direct technique for searching for shorter proofs. In particular, with the following instruction, one can cause OTTER to use the direct approach to finding shorter proofs, that of comparing the derivation lengths of paths that lead to the same conclusion. setfancestorsubsume). With this option, the generation of a second copy of an existing clause results in a comparison of the derivation path lengths to each copy. If the path to the
Application of AR to Questions from Mathematics and Logic
1165
second copy is longer, the new clause is simply subsumed. If the path to the first copy is longer, then the second copy is retained and placed in the set of support, and the first copy is purged. Although use of this option tends to find shorter proofs, it does not guarantee success. After all, a longer path to a given (intermediate) conclusion may contain steps that, if used repeatedly, produce a shorter proof.
6
Answering open questions
We now turn to a survey of various open questions—including some posed by Kaplansky, Smullyan, Kalman, McFadden, and Grau—that have been answered with OTHER'S assistance and with the assistance of some of its predecessors. As one can see from the following list, both the nature of those questions and the field from which they are taken vary widely. We shall discuss in detail only results obtained with OTTER but also touch on the work of some of our colleagues. 1. With the program AURA [26], Kaplansky's question was answered by finding a semigroup of order 83 admitting a nontrivial antiautomorphism, but admitting no nontrivial involutions [35]. 2. To answer Smullyan's questions concerning various aspects of combinatory logic, we used OTTER; we devote section 6.1 to those questions and their answers. 3. The Kalman questions concerning the possible existence of additional shortest single axioms for equivalential calculus were answered with AURA's assistance by showing that each of the four formulas XJL, XKE, XAK, and BXO is too weak [41] and that the formula XCB is also too weak (un published), but the formulas XHK and XHN are strong enough to each serve as a complete axiomatization [34,44]. Kalman's question concerning a shorter proof for the formula XGK was answered with AURA by finding a 23-step proof [41]; Marien's more recent discovery of a 10-step proof is, of course, a more satisfying answer to the question (see section 5). In section 6.2, we briefly touch on similar questions, and we issue a challenge for research assisted by an automated reasoning program. 4. The McFadden questions, the focus of section 6.4, concern the sizes of various finite semigroups; they were answered with the use of OTTER [15]. 5. Grau's question concerning the possible independence of the first three of the five axioms for a ternary Boolean algebra was answered with AURA's assistance by finding appropriate models [36]. 6. As for the promised questions focusing on Robbins algebra, they are cov ered in section 6.3.
Collected Works of Larry Wos
1166
Let us now turn to some of the highlights of our recent attempts to answer open questions.
6.1
Combinatory logic
The area in which we have had the most uniform success is combinatory logic. Barendregt [2] in effect defines combinatory logic as an equational system sat isfying the combinators S and K (defined shortly) with S and K as constants. Noting that expressions are assumed to be left associated unless otherwise in dicated, the actions of S and K are given by the following two equations. Sxyz = xz(yz) Kxy = x If one uses paramodulation as the inference rule, problems from combinatory logic in its entirety can be submitted to the program OTTER with the following clauses. EQUAL(x.x). EQUAL(a(a(a<S,x),y),z),a(a(x,z),a(y,z))). EQUAL(a(a(K,x),y),x). Rather than focusing on combinatory logic as a whole, here we study var ious fragments, subsets of the logic in which S and K are replaced by other combinators of which the basis of the fragment under consideration consists. In this article, we confine the discussion to questions focusing on combinations and questions focusing on fixed point properties. By definition, when given a specific combinator P, a combination from the basis B of the fragment is an expression (purely in terms of the elements of B) that satisfies the equation for P. Next, by definition, the length of a combination is the number of occurrences of the basis elements. Two fixed point properties are of interest, the weak and the strong. The weak fixed point property holds for the fragment with basis B if and only if, for all combinators x, there exists a y expressed purely in terms of the elements of B such that y = xy. The strong fixed point property holds for the fragment with basis B if and only if there exists a 0 such that for all combinators x the equation ©x = x(&x) holds, where 0 is expressed purely in terms of the elements of B. We focus first on open questions concerning (1) the possible existence of various combinations, (2) the shortest (if any) that exist, and (3) the number of the minimal length. For a simple example of the questions to be discussed, but ones whose answers were already known, let us focus on the combinator L with Lxy = x(yy)
Application of AR to Questions from Mathematics and Logic
1167
and the fragment whose basis B consists of the combinators B and W with Bxyz = x(yz) Wxy = xyy. Given this basis B, a search for a combination satisfying the equation for L easily succeeds, finding the combination W B . For a proof of success—keeping in mind that combinators are assumed to be left associated unless otherwise indicated—one simply notes that BWBxy = W(Bx)y = Bxyy = x(yy). That same search shows that the smallest combination of B and W that satisfies the equation for L has length 3, and there exists exactly one combination of that length. Motivated by correspondence with R. Smullyan [28], we considered certain questions that were open concerning the existence, minimal length, and number (of that length) of various combinations. The following theorems, which answer those questions, are taken from our study. Rather than a complete proof, for each theorem we simply give one or more of the corresponding combinations and certain additional information, reserving the details (including the precise clauses and parameter settings) for far more comprehensive Argonne report [44]. We also include some of the pertinent statistics (to permit one to judge the difficulty of the theorem), sample OTTER input, and a summary of the approach we used. The following theorems, if viewed as challenge problems for testing programs, approaches, or paradigms, do not ask one to verify that the combination that we give fulfills its requirements. Instead, the more interesting challenge is to begin with an appropriate set of axioms—which, if no mechanism exists for equality-oriented reasoning, should include those for equality—and the denial that a combination of the desired type exists. Using as an example the B, W, and L problem discussed earlier—purely for illustration and for a template of how to attack the various theorems presented shortly—with one of the notations acceptable to OTTER, one could have the input consist of the following. EQUAL(x,x). EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). EQUAL(a(a(W,x),y),a(a(x,y),y)). -EqUAL(a(a(x.f(x)),g(x)),a(f(x),a(g(x),g(x))))
I $ANSVER(x).
Upon completion of a proof, OTTER would have as the argument of the AN SWER literal in the final step a(a(B, W), B). In contrast, were one simply attempting to have OTTER prove that BWB is a combination that behaves as L does, one would replace the given inequality by the following. -EQUAL(a(a(a(a(B,W),B),f),g),a(f,a(g,g))).
Collected Works of Larry Wos
1168
The presence of Skolem constants in place of Skolem functions makes the cor responding problem, in general, far easier to solve. Here is a list of the combinators relevant to this section. (B) Bxyz = x(yz) (Q) Qxyz - y(xz) (C) Cxyz = xzy (Qi) Q\xyz = x(zy) (F) Fxyz = zyx (T) Txy = yx (G) Gxyzw = xw(yz) (V) Vxyz = zxy (L) Lxy = x(yy) (W) = xyy (P) Pxyyz - xy(xyz) (Ni) Nixyz = xyyz (N) Nxyz = xzyz Theorem CL-1. From the basis consisting of B and T, a combination can be found that satisfies the equation for Q. A proof of the theorem rests with an examination of either of the following two combinators, both found in less than 6 CPU seconds. B(TB)(BBT) B(B(TB)B)T In addition, no shorter combination exists with the desired properties, nor does any other exist of length 6. Theorem CL-2. From the basis consisting of B and T, a combination can be found that satisfies the equation for Q\. A proof of the theorem rests with an examination of either of the following two combinators, both found in less than 14 CPU seconds. B(TT)(BBB) B(B(TT)B)B In addition, no shorter combination exists with the desired properties, nor does any other exist of length 6. Theorem CL-3. From the basis consisting of B and T, a combination can be found that satisfies the equation for C. A proof of the theorem rests with an examination of either of the following two combinations, both found in less than 19 CPU seconds. B(T(BBT))(BBT) B(B(T{BBT))B)T In addition, no shorter combination exists with the desired properties, nor does any other exist of length 8. Theorem CL-4. From the basis consisting of B and T, a combination can be found that satisfies the equation for F. A proof of the theorem rests with an examination of any of the following five combinations, all found in less than 50 CPU seconds. B(TT)(BB(BBT)) B(B(TT)(BBB))T B(B(TT)B)(BBT)
B(B(B(TT)B)B)T
B{TT)(B(BBB)T) In addition, no shorter combination exists with the desired properties, nor does any other exist of length 8. Theorem CL-5. From the basis consisting of B and T, a combination can be found that satisfies the equation for V.
Application of AR to Questions from Mathematics and Logic
1169
A proof of the theorem rests with an examination of any of the following ten combinations, all found in less than 248 CPU seconds. B{T{BBT)){BB(BBT)) B(T(BBT)){BB{BTT)) B(B(T(BBT))B){BBT) B(B{T(BBT))B)(BTT) B(T{BBT)){B(BBB)T) B(T(BBT))(B(BBT)T) B(B{T(BBT))(BBB))T B(B(T{BBT))(BBT))T B(B{B(T(BBT))B)B)T B{B(B{T(BBT))B)T)T In addition, no shorter combination exists with the desired properties, nor does any other exist of length 10. Theorem CL-6. From the basis consisting of B and T, a combination can be found that satisfies the equation for G. Rather than giving a combination of the desired type, we instead observe that five of length 10 do exist, and no smaller ones suffice. Theorem CL-7. From the basis consisting of B, Q, and W, a combination can be found that satisfies the equation for P with Pxyyz = xy(xyz). A proof of the theorem rests with an examination of either of the following two combinations, both found in less than 11 CPU seconds. QQ(W)(Q(QQ))) B(W(Q(QQ)))Q In contrast to our approach to proving the preceding six theorems, for this last theorem, we replaced the strategical restriction of paramodulating from the left sides of equalities into the left sides of inequalities with the strategi cal restriction of paramodulating from the right sides into the right sides. The shortest such combination that we have found in which all three combinators occur, measured in occurrences of B, Q, and W, has length 6. Our approach to finding appropriate combinations relies heavily on paramodulation and the set of support strategy. In addition, for this type of problem, we frequently restrict paramodulation to be from the left side of positive equalities only and into the left side of the inequalities. We use the ANSWER literal to extract (from each proof) the desired combination. Let us now turn to open questions focusing on the two given fixed point properties. For these questions, in contrast to a constant concern with the basis consisting of the combinators B and T, here we study various fragments. The typical question asks about the presence or absence, for a given basis B, of either the weak or the strong fixed point property. Let us consider, for an example focusing on the strong fixed point property, the easily answered question for the fragment with basis B consisting of S and L. That this fragment satisfies the strong fixed point property can be seen by considering the combinator SLL and noting that SLLx = Lx(Lx) = x(Lx(Lx)) = x(SLLx). Since a combinator © that establishes the presence of the strong fixed point property for any fragment is called a fixed point combinator, we have also proved that SLL is a fixed point combinator. When the strong fixed point property holds for a fragment, the weak fixed point property must also hold, for the 0 that must exist for the former is such that Qx is the needed y for the latter—to satisfy y = xy. We thus see that the weak fixed point property holds for the fragment with basis S
Collected Works of Larry Wos
1170
and L. To see, by example, that the weak fixed point property does not imply the strong, we consider the fragment whose basis is L alone. By noting that Lx(Lx) = x(Lx(Lx)), we see that the weak holds. Since one cannot construct, from a single regular combinator, a fixed point combinator [19,29]—a result that answered an open question posed by Smullyan [27]—and since L is a regu lar combinator, the fragment under consideration cannot satisfy the strong fixed point property. For a fragment that fails to satisfy even the weak fixed point property, we offer—although not obvious—the fragment whose basis is S alone (see Theorem 1 of [19]). A far richer and more interesting fragment than that with a basis consisting of S and L is that with a basis consists of B and W. In particular, rather than the single fixed point combinator SLL constructible in the former fragment— which we believe is the case—in the latter, by having OTTER apply the kernel strategy, one can construct an infinite number of fixed point combinators (see [43] for a full account and see [19] for some of the details). The first fixed point combinator constructible from B and W alone B(WW){BW{BBB)) was found by Statman [29] in response to a question posed by Smullyan [27]. When this question was attacked with the assistance of an automated reasoning program—rather than merely duplicating Statman's success—four additional combinators of the desired type were found [18]. This result, obtained a few months before the formulation of the kernel strategy, illustrates the usefulness of automated reasoning programs for research. For a glimpse of the power offered by a program such as OTTER, es pecially when applying the kernel strategy, we note that—in contrast to the 20 CPU hours required for the original success in finding the five fixed point combinators—all five are obtained with the new approach in less than 3 CPU seconds. Of the infinite number of such combinators constructible from B and W, the smallest has length 8, and the number of that length is five. 9i e2 e3 e4 e5
= = = = =
B(B(B(WW)W)B)B B{B\WW)W){BBB) B\B\WW){BWB)B B\WW){BW{BBB)) B(WW)(B(BWB)B)
For those who enjoy a challenge, for those who wish to gain a fuller appre ciation of the comparative strengths of the different approaches, and for those who might wish to assess the power of another program, we offer the following questions—some of which are still open. 1. OpenQuestion: Does the fragment with basis B consisting of B and S alone satisfy the weak fixed point property?
Application of AR to Questions from Mathematics and Logic
1171
2. Open Question: Does the fragment with basis B consisting of B and 5 alone satisfy the strong fixed point property? 3. Open Question: Does the fragment with basis B consisting of the combi nators B and Ni satisfy the weak fixed point property? 4. Easy Question: Does the fragment with basis B consisting of B and M alone satisfy the weak fixed point property? 5. Difficult Question: Does the fragment with basis B consisting of B and M alone satisfy the strong fixed point property? Statman has apparently answered this question [30]. 6. Difficult Question: Does the fragment with basis B consisting of B and N alone satisfy the strong fixed point property? 7. Open Question: Does there exist a finite model satisfying B and L in which the strong fixed point property fails to hold? 8. Open Question: Does there exist a finite model satisfying Q and L in which the strong fixed point property fails to hold? 9. Open Question: What interesting conditions are sufficient to guarantee that a fragment of combinators satisfies the weak fixed point property? 10. Open Question: What interesting conditions are sufficient to guarantee that a fragment of combinators satisfies the strong fixed point property? For additional open questions, see [43]. By returning to our successes with OTTER, we can supply certain perti nent information. In our further study of the Smullyan question [27] concerning the possible existence of a regular combinator to be considered with B to con struct fixed point combinators—Smullyan's question was the impetus for the already-cited Statman contribution—we considered 5 as a candidate. When the corresponding study failed to yield either positive or negative results, we intro duced the combinator TV which, various inquiries suggest, has not been studied before. OTTER's application of the kernel strategy yielded precisely what we needed to complete our study of the fragment with basis B and N [43]. We found that, similar to the fragment with basis B and W, the fragment with ba sis B and JV is indeed rich; one can construct an infinite class of infinite families of fixed point combinators with interesting interrelations. One might consider the challenge of finding the smallest fixed point combinator in the B and N fragment. Let us now turn to the next question, one that might provide a clue for an swering one of the questions still open. At a workshop held at Argonne National Laboratory in the summer of 1989—before Statman had answered Question 5— the openness of questions 1, 2, and 5 naturally led to the following question.
Collected Works of Larry Wos
1172
Does the fragment with basis B, M, and 5 satisfy the strong fixed point prop erty? The weak fixed point property for this fragment was not in doubt (see [27] for an answer to Question 4). As one would obviously predict, we again used OTTER to apply the kernel strategy. If the strategy yielded an appropriate fixed point combinator, then we would have our answer; if it did not, then an examination of OTTER's output, as discussed in section 1, might reveal what was needed. In several CPU minutes on a Sun 3 workstation, we obtained the following result. S(M(B(SB)M))y In other words, we have a family of fixed point combinators, any one of which (by replacing y by any combinator) suffices to establish that the fixed point property holds for the given fragment. With regard to the fragment with basis B and L and to the fragment with basis Q and L—each the object of the corresponding open question posed to us by Smullyan—we again found OTTER useful, for an examination of its output pointed us in the right direction. Indeed, as a corollary of Theorem 2 in [19], we proved that each of the fragments is too weak to satisfy the strong fixed point property. Because of the presence of the combinator L, that each satisfies the weak fixed point property was proved earlier in this section.
6.2
Equivalential calculus
A survey of our attempts to answer open questions with the assistance of one of our automated reasoning programs would be indeed lacking without reference to Winker's proof that each of the formulas XHK and XHN is a single axiom for equivalential calculus [34]. The two theorems are of especial appeal in that each refuted the conjecture that, other than the eleven shortest single axioms that had been discovered before 1980 [11,22,45], no other formula of length 11 would serve. Winker's use of the program exemplifies the iterative approach to which we alluded in section 1: make a run; if the goal is not reached, examine the run to extract possibly key information, occasionally making a conjecture; use the extracted information in the next run, after making whatever changes to the parameters deemed wise; and continue. As an indication of the difficulty offered by the two important theorems, Winker's 83-step proof for XHK relies on the use of a formula of length 71, and his 159-step proof for XHN relies on the use of a formula of length 103 [34,44]. For a simple example of how an unsuccessful run might lead to the informa tion needed to answer an open question, let us consider the following formula XBB and ignore the fact that this formula is known to be inadequate for serving by itself as a single axiom for equivalential calculus. (XBB)e(x, e(e(e(x, e(y,z)), y), z)). Let us treat this formula as if it were a candidate for being a shortest single axiom for the calculus and see what might happen if we use OTTER to investi gate this possibility. As in section 5, we would use hyperresolution and include
Application
of AR to Questions from Mathematics
and Logic
1173
in the input a clause to capture condensed detachment and clauses that play the role of negations of the thirteen shortest single axioms. The only clause we would place in the set of support is the clause equivalent of the formula XBB, the last of the following fifteen clauses. We would use the following input file. list(axioms). 7, condensed detachment: - P ( e ( x , y ) ) I -P(x) | P(y). 7, n e g a t i o n s of the t h i r t e e n s h o r t e s t s i n g l e axioms: $ANSWER(P1_YQL). -PCeCeCa.tO.eCeCc.bheCa.c)))) $ANSWER(P2_YQF). -P(e(e(a,b),e(e(a,c),e(c,b)))) $ANSWER(P3_YQJ). -P(e(e(a,b),e(e(c,a),e(b,c)))) $ANSVER(P4_UM). -P(e(e(e(alb),c),e(b,e(c,a)))) $ANSWER(P5_XGF). -P(e(a,e(e(b,e(a,c)).e(c,b)))) $ANSWER(P7_WN). -P(e(e(a,e(b,c)),e(c,e(a.b)))) $ANSWER(P8_YRM). -P(e(e(a,b),e(c,e(e(b,c),a)))) $ANSWER(P9_YR0). -P(e(e(a,b),e(c,e(e(c,b),a)))) $ANSWER(PYO). -P(e(e(e(a,e(b,c)),c),e(b,a))) $ANSWER(PYM). -P(e(e(e(a,e(b,c)),b)1e(c,a))) $ANSWER(XGK). -P(e(a,e(e(b,e(c,a)),e(c,b)))) $ANSWER(XHK). -P(e(a,e(e(b,c).e(e(a,c),b)))) $ANSWER(XHN). -P(e(a,e(e(b,c),e(e(c,a),b)))) end_of_list. list(sos). % t h e formula XBB: P(e(x,e(e(e(x,e(y,z)),y),z))). end_of_list. Rather than using the ANSWER literal to capture an object under construc tion, in this example the ANSWER literal is used to quickly identify, should a contradiction be obtained, the formula that is derived. If we set the maximum weight limit to 200, to place relatively little constraint on OTTER's retention of clauses, a cursory examination of the retained clauses reveals that each is longer than its predecessor. A closer examination shows that each retained clause contains as a subformula an alphabetic variant of the formula XBB. These two observations might lead one to the conjecture that, if one begins with XBB alone, then all derived formulas will contain a copy of that formula. If such is the case, then XBB cannot serve as a complete axiomatization for equivalential calculus, for none of the thirteen single axioms will be derivable. The conjecture is, of course, correct, which can be proved by analyzing the unifications that are required for a successful application of condensed detachment [41]. We thus see how an unsuccessful run can indeed lead to what is needed to reach a given objective. Winker's successes with XHK and XHN must have required excellent insight at many points. In contrast to Winker, when we attempted to use one of our
Collected Works of Larry Wos
1174
programs to obtain a proof for each of XHK and XHN—in place of insight—we had the well-recognized advantage of knowing that the corresponding theorems are true. Also in contrast to Winker, we repeatedly failed to reach our objective. Rather than proofchecking Winker's proof—as we exemplified in section 5 with our discussion of obtaining a condensed detachment proof for the fifth conjecture of Lukasiewicz—our objective was to find a means for one of our programs to find, in a single run, a proof for XHK and then do the same for XHN. Eight years and many failures after Winker found his two proofs, we found the soughtafter general approach. Similar to our use in section 5, we used weighting to prefer formulas with shorter tails. Our shortest proof for XHK consists of 35 applications of condensed detachment, and the longest formula in the proof has length 47. Our shortest proof for XHN—obtained with level saturation— consists of 23 steps, and the longest formula has length 39. OTTER's use of discrimination trees for the application of subsumption sharply reduced the CPU time to obtain the two shorter proofs; the strategy appears to be essential. One might enjoy the challenge of attempting to find proofs establishing that each of the given thirteen formulas, if unnegated, provides a complete axiomatization for equivalential calculus.
6.3
Robbins algebra
The following question has been open for decades, receiving attention even from Tarski and his students [9,32]. Is every Robbins algebra a Boolean algebra? A Robbins algebra is a nonempty set satisfying the following three axioms in which the function o can be interpreted as plus and the function n as negation. (Rl) o(x, y) = o{y, x) (R2) o(o(x, y),z) = o(x, o(y, z)) (R3) n(o(n(o(x,y)),n(o(x,n(y)))))
=x
A Boolean algebra is a nonempty set 5 with two operations, plus and times, and a 0 and a 1. Each operation is commutative, and each distributes over the other. The 1 is a multiplicative identity, and the 0 is an additive identity. In addition, for every x, the negation of x exists with x plus its negation equal to 1 and x times its negation equal to 0. An alternative axiomatization of Boolean algebra consists of Rl, R2, and Huntington's axiom [10]. (H3) o(n(o(n(x),y)),n(o(n(x),n(y)))) =x Therefore, one way to prove that a Robbins algebra is a Boolean algebra is to derive H3 from R1-R3. It has been proved that every finite Robbins algebra is a Boolean algebra. Our contributions focus on the addition of one or more properties to see whether the resulting system can be shown to be Boolean. For example, Winker proved [34] that the addition of the single equality o(x,x) = x to the Robbins axioms yields a Boolean algebra. He also proved that the addition of a 0 such that o(x, 0) = x, or a 1 such that o(x, 1) = 1, suffices. But weaker axioms can be
Application of AR to Questions from Mathematics and Logic
1175
added and still yield a Boolean algebra. For example, the addition of the equality 0(0, o) = a for some constant a suffices. Even weaker, the addition of o(a, b) = a for some o and 6 suffices. We call these properties sufficiency properties (see [44] for additional details including proofs of the earlier-mentioned results). For this last result, in contrast to the preceding results, the proof required substan tial intervention, direction, and a number of runs by Winker using one of our programs. Here we select from Winker's recent research two new results concerning the addition of a single equality that guarantees, when considered with the axioms of a Robbins algebra, the properties of a Boolean algebra. Theorem RA-1, near miss equality. If there exist elements o and b in a Robbins algebra that satisfy n(o(n(o(a,o(a,b))),n(o(a,n(b))))) = a (which is syntactically similar to R3), the resulting algebra is Boolean. Theorem RA-2. If the equality n(o(x, y)) = i(n(x),n(y)) is adjoined to R1-R3, the resulting algebra is Boolean. (Although intersection has not been defined, the given equality is reminiscent of De Morgan's law.) To attempt to prove that a Robbins algebra is not Boolean, one can either (1) find an infinite model of R1-R3 that fails to satisfy one of the known sufficiency properties, or (2) prove that, from R1-R3, one cannot derive one of the known sufficiency properties.
6.4
Finite semigroups
We close this section with yet another use of a program such as OTTER. For the problems discussed here, OTTER is used more in a computational manner than in a reasoning manner. We merely present some of the highlights, with the fuller account to be found in [15,44,47]. With the appropriate clauses, OTTER can be used to apply a variety of algebraic operations. For example, OTTER can be given a set of generators and relations to compute the closure of that set, if indeed the closure is finite. One can use clauses like the following to list the elements and cause OTTER to attempt to find the corresponding closed set. P(a). P(b). -P(x) I -P(y) I P ( f ( x , y ) ) . One can add appropriate demodulators to produce the desired canonical form. For example, if the cube of 0 is e and the product function / is associative, one might include the following clauses in the demodulator list.
Collected Works of Larry Wos
1176 EqUAL(f(a,f(a,a),e)). EQUAL(f(f(x,y),z),f(x,f(y,z))).
The questions to be answered focus on determining the size of various semi groups whose size was previously unknown. A semigroup is a nonempty set with an associative binary operation. We begin by defining the 5-element Brandt semigroup Bl by the following multiplication table. 0 e f a b 0 0 0 0 0 0 e 0 e 0 a 0 / 0 0 / 0 b a 0 0 a 0 ea 6 0 6 0 / 0 An interesting semigroup, because it plays a key role in classifying other semigroups with certain properties (see [15]), is F2B2, which can be described in the following way: Consider all 25-tuples of the form xl ... x25, where xi is in B2. Let g\ = (0,0,0,0,0, e, e, e, e, e, /, / , /, /, / , o, a, a, a, a, 6,6, b, 6,6) p2 = (0, e, / , a, 6,0, e, /, a, 6,0, e, /, a, 6,0, e, /, a, 6,0, e, /, a, 6) (We find it useful to denote the preceding by 0 5 e 5 / 5 o 5 6 5 and (0e/o6) 5 , respec tively.) We define F2B2 to be the semigroup generated by gl and g2 under componentwise multiplication in B2 and the "inverse" operation in B2. (The elements 0, e, and / are their own inverses, and a and 6 are mutual inverses.) Although F2B2 is clearly finite, its order (number of elements) is perhaps as large as 525 = 298,023,223,876,953,125. In [15], an automated theorem prover similar to OTTER was used to prove that its order is actually 71 and to reveal additional information concerning the internal structure of the semigroup. A natural question focuses on computing the size of F3B2, where B2 is the semigroup described earlier and where F3B2 is the corresponding set of 125-tuples generated by 0 2 5e 2 5/ 2 5a 2 56 2 5 05e5/5a5o565)5 (0e/a6) 2 5 and their inverses. The potential order of the semigroup under study is 5X25. Its order, computed by OTTER, is actually 1435. A semigroup closely related to B2 is the semigroup B21 obtained by adjoin ing an identity element 1 to B2. The question to answer concerns the order of F2B21. Its order was quickly computed to be 223.
Application of AR to Questions from Mathematics and Logic
7
1177
Summary and conclusions
In this article, we have shown in some detail how an automated reasoning pro gram can be used as an aid for research and have given some of the results of our research with such programs, heavily emphasizing open questions we have an swered. To provide a complete treatment—especially for those unfamiliar with the field—we have included a detailed discussion of the elements of automated reasoning. We have focused mainly on the program OTTER, which is portable, available electronically by anonymous FTP, and usable on a variety of machines including personal computers. We have included a sample input file to show how one can use OTTER, and we have given the needed axioms and related information should one decide to continue an attack on one of the topics covered here. As illustrated in this article, OTTER can be used to answer open questions from a variety of fields of mathematics and logic including combinatory logic, equivalential calculus, Robbins algebra, and finite semigroup theory. We wel come additional open questions of the type discussed in this article. OTTER can be used to find proofs, check proofs, referee, and construct various objects. We have given examples of each of these uses and have provided a detailed account of how some of the open questions were answered with the assistance of OTTER. We have also presented various techniques for systematically seek ing shorter proofs. The successes we have discussed include those of colleagues. Finally, we have included a number of challenges—some focusing on questions that remain open—for research and for automated reasoning programs. To put into perspective the successes we have had with our programs, we point out that the various researchers—although extremely experienced in auto mated reasoning—had little expertise in the fields from which the open questions were taken. We conjecture, therefore, that the use of a program such as OT TER by a mathematician or logician with substantial knowledge in a particular area might lead to significant advances. What is clear to us is that, after one gains some familiarity with OTTER—which will require at least a moderate effort—the use of this program markedly adds to one's research capability.
References [1] S. Anantharaman, J. Hsian and J. Mzali, SbReve2: A term rewriting labora tory with (AC)-unfailing completino, in: Prov. 3rd Int. Con}, on Rewriting Tech niques and Applications, Lecture Notes in Comptuer Science, vol. 335 (Springer, Berlin, 1989) pp. 533-537. [2] H.P. Barendregt, The Lambda Calculus: Its Syntax and Semantics (NorthHolland, Amsterdam, (981).
1178
Collected Works of Larry Wos
[3] R. Boyer and J Moore, A Computational Logic (Academic Press, New York, 1979). [4] R. Boyer and J Moore, Proof checking the RSA public key encryption algo rithm, Amer. Math. Monthly 91 (1984) 181-189. [5] R. Boyer and J Moore, A Computational Logic Handbook (Academic Press, San Diego, 1988). [6] E. Dijkstra, Dijkstra's reply to comments, in: A debate on teaching comput ing science, CACM 32 (December 1989) 1397-1414. [7] J.M. Font, A.J. Rodriguez, and A. Torrens, Wajsberg algebras, Stochastica 8(1984) 5-31. [8] C. Green, Theorem-proving by resolution as a basis for question-answering systems, in: Machine Intelligence 4, eds. B. Meltzer and D. Michie (Edinburgh University Press, Edinburgh, 1969) pp. 183-205. [9] L. Henkin, J. Monk, and A. Tarski, Cylindric Algebras, Part I (NorthHolland, Amsterdam, 1971). [10] Huntington, E., New sets of independent postulates for the algebra of logic, with special reference to Whitehead and Russell's Principia Mathematica, Trans. AMS 35 (1933) 274-304. [11] J. Kalman, A shortest single axiom for the classical equivalential calculus, Notre Dame J. Formal Logic 19, (1978) 141-144. [12] D. Kapur and H. Zhang, An overview of RRL (Rewrite Rule Laboratory), in: Proc. 3rd Int. Conf. of Rewriting Techniques and Applications, Lecture Notes in Computer Science, vol. 335 (Springer, Berlin, 1989) pp. 559-563. [13] D. Knuth and P. Bendix, Simple word problems in universal algebras, in: Computational Problems in Abstract Algebra, ed. J. Leech (Pergamon Press, New York, 1970) pp. 250-277. [14] J. Lukasiewicz, The equivalential calculus, in: Jan Lukasiewicz: Selected Works, ed. L. Borkowski (North-Holland, Amsterdam, 1970) pp. 250-277. [15] E. Lusk and R. McFadden, Using automated reasoning tools: A study of the semigroup F2B2, Semigroup Forum 36 (1987) 75-88. [16] A. Marien, private communication (1989).
Application of AR to Questions from Mathematics and Logic
1179
[17] J. McCharen, R. Overbeek, and L. Wos, Complexity and related enhance ments for automated theorem-proving programs, Computers and Mathematics with Applications 2 (1976) 1-16. [18] W. McCune and L. Wos, A case study in automated theorem proving: Finding sages in combinatory logic, J. Auto. Reasoning 3 (1987) 91-108. [19] W. McCune and L. Wos, The absence and the presence of fixed point combinators, Mathematics and Computer Science Division Preprint MCS-P870689, Argonne National Laboratory, Argonne, 111. (1989). [20] W. McCune, OTTER 2.0 Users Guide, Technical Report ANL-90/9, Ar gonne National Laboratory, Argonne, IL (1990). [21] W. McCune, Experiments with discrimination tree indexing and path in dexing for term retrieval, J. Auto. Reasoning, to appear. [22] J. Peterson, The Possible Shortest Single Axioms for EC-Tautologies, De partment of Mathematics Report Series No. 105, Auckland University, Auck land, New Zealand (1977). [23] G. Robinson and L. Wos, Paramodulation and theorem-proving in firstorder theories with equality, in: Machine Intelligence 4, eds. B. Meltzer and D. Michie (Edinburgh University Press, Edinburgh, 1969) pp. 135-150. [24] J. Robinson, A machine-oriented logic based on the resolution principle, J. ACM 12 (1965)23-41. [25] J. Robinson, Automatic deduction with hyper-resolution, Int. J. Comput. Math. 1 (1965) 227-234. [26] B. Smith, Reference Manual for the Environmental Theorem Prover, An In carnation of AURA, Technical Report ANL-88-2, Argonne National Laboratory, Argonne, IL (1988). [27] R. Smullyan, To Mock a Mockingbird (Alfred A. Knopf, New York, 1985). [28] R. Smullyan, private correspondence (1987). [29] R. Statman, private correspondence with Raymond Smullyan (1986). [30] R. Statman, private correspondence (1990). [31] M. Stickel, A Prolog technology theorem prover, J. Auto. Reasoning 4 (1988) 353-380.
1180
Collected Works of Larry Wos
[32] A. Tarski, private communication (1980). [33] R. Veroff and L. Wos, The linked inference principle, I: The formal treat ment, Mathematics and Computer Science Preprint MCS-P160-0690, Argonne National Laboratory, Argonne, IL (1990). [34] S. Winker, private communication (1980). [35] S. Winker, L. Wos, and E. Lusk, Semigroups, antiautomorphisms, and invo lutions: A computer solution to an open problem, I, Math. Comput., 37 (1981) 533-545. [36] S. Winker, Generation and verification of finite models and counterexamples using an automated theorem prover answering two open questions, J. ACM, 29 (1982) 273-284. [37] L. Wos, G. Robinson, and D. Carson, Efficiency and completeness of the set of support strategy in theorem proving, J. ACM 12 (1965) 536-541. [38] L. Wos, G. Robinson, D. Carson, and L. Shalla, The concept of demodula tion in theorem proving, J. ACM 14 (1967) 698-709. [39] L. Wos and G. Robinson, Maximal models and refutation completeness: Semidecision procedures in automatic theorem proving, in: Word Problems: De cision Problems and the Burnside Problem in Group Theory, eds. W. Boone, F. Cannonito, and R. Lyndon (North-Holland, New York, 1973) pp. 609-639. [40] L. Wos, R. Overbeek, E. Lusk, and J. Boyle, Automated Reasoning: Intro duction and Applications (Prentice-Hall, Englewood Cliffs, NJ, 1984). [41] L. Wos, S. Winker, R. Veroff, B. Smith, and L. Henschen, A new use of an automated reasoning assistant: Open questions in equivalential calculus and the study of infinite domains, Art. Int. 22 (1984) 303-356. [42] L. Wos, Automated Reasoning: S3 Basic Research Problems (Prentice-Hall, Englewood Cliffs, NJ, 1987). [43] L. Wos and W. McCune, Searching for fixed point combinators by using automated theorem proving: a preliminary report, Technical Report ANL-88-10, Argonne National Laboratory, Argonne, IL (1988). [44] L. Wos, S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, and R. Butler, OTTER Experiments Pertinent to CADE-10, Technical Report ANL89/39, Argonne National Laboratory, Argonne, IL (1989).
Application of AR to Questions from Mathematics and Logic
1181
[45] L. Wos, Meeting the challenge of fifty years of logic, J. Auto. Reasoning 6 (1990) 213-232. [46] L. Wos, R. Overbeek, and E. Lusk, Subsumption, a sometimes undervalued procedure, Festschrift for J.A. Robinson, ed. J.-L. Lassez, to appear. [47] L. Wos, S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, and R. Butler, Automated reasoning contributes to mathematics and logic, in: Proc. 10th Int. Conf. Automated Deduction, Lecture Notes in Artificial Intelligence, vol. 449, Springer-Verlag, New York, 1990) pp. 485-499.
Automated Reasoning and Enumerative Search, with Applications to Mathematics Jian Zhang and Larry Wosf* fMathematics and Computer Science Division Argonne National Laboratory Argonne, Illinois 60439-4801
Abstract More and more mathematical problems are being solved with the aid of computers. In this paper, we examine the applications of reasoning and search programs to mathematics. It is also shown that the combination of these two techniques can solve mathematical problems more effectively.
1
Introduction
Reasoning and search are two of the most important activities involved in prob lem solving. In this paper, we first focus on the value of using an automated reasoning program as a research assistant in attacking questions from mathe matics. Indeed, a number of open questions have been answered with the use of such a program, including questions from finite semigroups posed by Kaplansky, from equivalential calculus posed by Kalman, from combinatory logic posed by Smullyan, and from sentential calculus posed by Scott. In answering the various questions, a automated reasoning program was asked to find alge braic constructs, to consider mappings in combination, to provide a complete characterization of an infinite set of deducible theorems, to refute conjectures, to construct needed objects, to find shorter proofs, and to discover a new axiom system. Also central to this paper is the case we make (in Section 4) for the symbiotic relation that can exist between enumerative search (ES) and automated reason ing (AR). Indeed, an enumerative search can profitably be used as a search •This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38 Reprinted from the Proceedings of the International Conference for Young Computer Scientists, ed. Yongchun Liu and Xiaoming Li, International Academic Publishers, 1991, 543545.
Automated Reasoning and Enumerative Search
1183
strategy by an automated reasoning program, and conversely an automated reasoning program can be used to sharply reduce the size of an enumerative search.
2
A u t o m a t e d Reasoning
From a 1955 perspective, the attempt to use a single computer program to answer questions from various areas of mathematics and logic by applying rea soning would be viewed, at best, as audacious and, at worse, as absurd. After all, how could one program cope with concepts that include group, ring, topological space, homomorphism, and combinator? Further, how could this mythical pro gram be instructed to apply the logical reasoning required to prove theorems from essentially unrelated fields? Perhaps most challenging, what means could be found to adequately direct the program's search for the needed steps of a proof and to effectively restrict its search to the consideration of a reasonable subset of the usually vast number of possible conclusions? As it turns out, the 1955 evaluation of audacious or even absurd—although understandable—was incorrect. Instead, from the early programs that offered essentially no promise of proving interesting theorems, there evolved various general-purpose, automated reasoning programs whose use resulted in answering open questions from a wide variety of essentially unrelated fields. For example, Kaplansky's question concerning the possible existence of a finite semigroup in which one type of mapping is present and another type is absent was answered when an automated reasoning program found such a semigroup of order 83 (consisting of 83 elements). That same program then proved that the smallest such semigroup has order 7 and that, of the more than 800,000 semigroups of that order, only four possess the desired properties. Kalman's questions concerning the possibility of using any of six formulas by itself as a complete axiom system for equivalential calculus were answered when an reasoning program helped obtain a total characterization of the infinite set of deducible theorems for four of the formulas and a lengthy proof for each of the other two. The characterization showed that each of the four formulas is too weak to provide a complete axiomatization, and the two proofs established that the remaining two formulas are each strong enough. The proofs, respectively of length 84 and 159 steps and of complexity 71 and 103 if measured in terms of the longest included formula, refuted the conjecture that each was too weak. Smullyan's questions focusing on the presence or absence of the strong fixed point property for various subsets (called fragments) of combinatory logic were answered by constructing (where appropriate) a fixed point combinator and, elsewhere, providing the key information to show that the property could not hold. Scott's question regarding the existence of a sharply different proof for the completeness of the Lukasiewicz axiom system for sentential calculus was an-
Collected Works of Larry Wos
1184
swered in the affirmative when an automated reasoning program found a 30-step proof of the completeness, contrasting nicely with the original 46-step proof. In addition, the study led to the discovery of a new complete axiom system for sentential calculus. Single programs now exist that offer sufficient power to answer each of the cited questions—and far more! The most powerful general-purpose reasoning program currently available is called OTTER, designed and implemented by Dr. William McCune of the Mathematics and Computer Science Division at Argonne National Laboratory. The program consists of approximately 20,000 lines of C code. It is portable, running well on workstations, personal computers, and the Macintosh. On a Sparcstation, per CPU second, OTTER continually deduces approximately 500 conclusions, and can easily apply more than 4,000 rewrite rules for canonicalization and simplification. This program derives its power in part from the use of the clause language paradigm [Wos84,Wos87] and the use of diverse inference rules and strategies.
3
Enumerative Search
The method of enumerative search can be summarized in the following way. Given an abstract space (or a set) which consists of a number of "objects", we wish to find an object "x" that has a specific property "P". Let us call "x" the "target". To achieve our intention, we simply examine the objects in some order and check each object to see whether it satisfies "P". In practice, we often need not check all the objects. Instead, some heuristics may be employed to reduce the search space. If we know in advance that none of the objects in a subspace satisfies the property "P", then this subspace may be skipped. Usually such a subspace is characterized by a certain condition, which will represent all the objects in it. For example, if we are seeking a prime, or a prime having some additional properties, and we know that all primes (except 2) are odd numbers, then the numbers in the set n l 2 and n is even may be skipped without missing the target. Such heuristics are essential for improving the efficiency of the search, and make the ES method more practical. For a problem to be solved completely by a program applying ES, the search space must be finite. With such a goal, we must work in discrete (not continuous) domains. Appropriately constrained to guarantee finiteness, the search space may be a set of natural numbers, a set of 0-1 matrices, or a set of finite groups. For example, we may search for a prime number in some finite set N of natural numbers, or search for a pair of primes p and q in some finite set N * N such that m-n = 2 (such numbers are called twin primes). Normally, the search space should admit some ordering so that we can proceed systematically, moving from "smaller" objects to "larger" objects. For example, we might move from 1 to 2, to 3, ... or move from (0, 0, 0) to (0, 0, 1), to (0, 1, 0) to (0, 1, 1). In this way, we can visit all the objects and see whether a target has been found. Also
Automated Reasoning and Enumerative Search
1185
important to ES is that the property "P" be readily verifiable. Moreover, the property should belong to a single object only, not to a set of objects. Appropriate candidates for a program applying ES include problems from number theory, combinatorics, algebra, logic, and other similar branches of mathematics. Among the successes obtained with ES are the classification of all graphs with 10 vertices and the proof that no projective plane exists of order 10.
4
A R and ES Combined
That AR and ES complement each other in many respects can be seen by focusing on ternary Boolean algebra. A ternary Boolean algebra [Grau47] (TBA) is a set "S" with one ternary function "f' from S * S to S and one unary function "g" from S to S, where the following five axioms hold (for any v, w, x, y, z in S): 1. f(f(v,w,x),y,f(v,w,z)) = f(v,w,f(x,y,z)) 2. f(y,x,x) = x 3- f(x,y,g(y)) = x 4. f(x,x,y) = x 5- f(g(y),y,x) = x A ternary Boolean algebra can be transformed into a Boolean algebra, and conversely. Now suppose we wish to find a TBA that has 4 elements. Without loss of generality, the elements may be denoted as 0, 1, 2, 3. The task is to determine the values g(0), g(l), g(2), g(3) and f(ij,k) for each 3-tuple (ij,k), where 0 j= i, j , k j= 3. The total number of these unknowns is 4 + 4 3 = 68, and each unknown may take the value 0, 1,2, or 3. With ES, we have a maximum of 468 different choices. However, axioms (2) and (4) can be used to "calculate" some values directly, f(0,0,l) = 0, f(0,1,1) = 1, ..., reducing the number of unknowns to 40, still too large a number. We can next use an AR program to derive additional equations to further reduce the number of unknowns, obtaining the following [Winker78]: 6. f(x,y,x) = x 7- g(g(x)) = x 8. f(g(y),x,y) = x 9. f(x,y,z) = f(y,x,z) 10. f(x,y,z) = f(x,z,y) We know from (7) that the elements are divided into pairs: (al, bl) and (a2, b2), with g(al) = bl, g(bl) = al, g(a2) = b2, g(b2) = a2. Without loss of generality, we may choose 0 = al, 1 = bl, 2 = a2, and 3 = b2, and the function
Collected Works of Larry Wos
1186
"g" is completely determined. Then, the equations (2), (4), (6), (3), (5), and (8) can be used to calculate some values of the function "f". At this point, there exist 24 unknowns, some equivalent to others in the sense of equations (9) and (10). The elimination of redundant unknowns reduces their number to 4, and we see how AR can benefit ES. Conversely, AR can benefit from ES by, for example, using an exhaustive search to find key lemmas. For a second example, ES may play a key role in finding a shorter proof. We thus see how AR and ES can sometimes complement each other.
5
Conclusions
The use of automated reasoning and of enumerative search can play a key role in answering some question or solving some problem that has remained open. The combination of the two sometimes offers even greater power. Indeed, the application of an enumerative search by an automated reasoning program led to finding far shorter proofs of two important theorems in equivalential calculus and to finding an unexpectedly elegant proof establishing the completeness of a new axiom system for sentential calculus.
References [Grau47] Grau, A. 'Ternary Boolean algebra," Bulletin of the Amer. Math. Soc. 53 (1947) pp. 567-572. [Winker78] Winker, S., and Wos, L., "Automated generation of models and counterexamples and its application to open questions in ternary Boolean alge bra," in Proc. 8th Inter. Symp. on Multiple Valued Logic, IEEE & ACM (1978) pp. 251-256. [Wos84] Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: Introduction and Applications, Prentice-Hall, Englewood Cliffs, N.J. (1984). [Wos87] Wos, L., Automated Reasoning: 33 Basic Research Problems, PrenticeHall, Englewood Cliffs, N.J. (1988).
Benchmark Problems in Which1 Equality Plays t h e Major Role E. Lusk and L. Wos Mathematics and Computer Science Division Argonne National Laboratory Argonne, Illinois 60439-4801 Abstract. We have recently heard rumors that researchers are again studying paramodulation [7] in the context of strategy for its control. In part to facilitate such research, and in part to provide test problems for evaluating other approaches to equality-oriented reasoning, we offer in this article a set of benchmark problems in which equality plays the dominant role. The test problems are taken from group theory, ring theory, Robbins algebra, combinatory logic, and other areas. For each problem, we include appropriate clauses and comment as to its status with regard to provability by an unaided automated reasoning program. To complement the test problems, we offer various open questions.
1. Group Theory A group is a nonempty set G in which multiplication is associative such that a two-sided identity e exists whose product with x is i and for which the two-sided inverse of x exists. To study group theory, one can use the following clauses; throughout the remainder of this paper, we use the notation of William McCune's program O T T E R [3,4], where " | " means or and " - " means n o t . EQ(prod(e,x),x). EQ(prod(x,e),x). EQ(prod(inv(x),x),e).
EQ(prod(x,inv(x)),e). EQ(prod(prod(x,y),z),prod(x,prod(y,z))). EQ(x,x).
The last clause (for reflexivity) is included, for its presence is required when paramodulation is used. When attempting to prove that some set of equalities is an axiom system for group theory, one proves each of these axioms, except for the clause for reflexivity, one at a time. P r o b l e m G T 1 , simple. If the square of every x is the identity, the group is commutative. EQ(prod(x,x),e). 'This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted with permission from the Proceedings of the Eleventh International Conference on Automated Deduction (CADE-11), Lecture Notes in Artificial Intelligence, Vol. 607, ed. D. Kapur, Springer-Verlag, New York, 1992, 781-785.
Collected Works of Larry Wos
1188
Problem GT2, moderate. Prove that the following equality (taken from Mered ith [6] is a single axiom for groups in which the square of every x is the identity. In particular, using the single axiom, derive the axioms for groups (given ear lier) and the axiom that asserts that the square of every element is the identity. In this problem e is represented by the term prod(x,x), once one proves that prod(x, x) = prod(y, y). EQ(prod(prod(prod(x,y),z),prod(x,z)),y). Problem GT3, moderate. Prove that [[x, y], y] = e when the cube of every x is e, where [x,y] is the product of x, y, the inverse of x, and the inverse of y. EQ(prod(x,prod(x,x)),e).
EQ(com(x,y),prod(x,prod(y,prod(inv(x),inv(y))))).
Problem GT4, moderate. Prove that the following equality axiomatizes group theory; the corresponding theorem, proved by McCune using OTTER [5], is a new contribution to the literature. In this problem and the next two, e is prepresented by the term prod(x,inv(x)), once one has proved that prod(x,inv(x)) = prod(y, inv(y)). EQ(prod(x,inv(prod(y,prod(prod(prod(z,inv(z)),inv(prod(u,y))),x)))),u). Problem GT5, moderate. Prove that the following euality axiomatizes commu tative group theory; this new single axiom was found by William McCune using OTTER [5].q EQ(prod(prod(prod(x,y),z),inv(prod(x,z))),y). Problem GT6, never proved in single runs for each axiom. Prove that the following equality axiomatizes commutative group theory; the result was verified by Ken Kunen [private correspondence] using OTTER as an assistant. EQ(prod(inv(prod(inv(prod(inv(prod(xl,x2)),prod(x2,xl))),prod(inv(prod(z,y)), prod(z,inv(prod(prod(v,inv(x)),inv(y))))))),x),v).
2. Robbins Algebra A Robbins algebra is a nonempty set A satisfying the following four axioms, expressed in clause notation, in which the function o can be interpreted as plus and the function n as negation. (Rl) EQ(o(x,y),o(y,x)). (R2) EQ(o(o(x,y),z),o(x,o(y,z))).
(R3) EQ(n(o(n(o(x,y)),n(o(x,n(y))))),x). (R4) EQ(x,x).
Benchmark Problems in Which Equality Plays the Major Role
1189
A Boolean algebra is a nonempty set S with two operations, plus and times, and a 1 and a 0. Each operation is commutative, and each distributes over the other. The 1 is a multiplicative identity, and the 0 is an additive iden tity. In addition, for every x, the negation of x exists with x plus its negation equal to 1 and x times its negation equal to 0. An alternative axiomatization of Boolean algebra consists of (Rl), (R2), and Huntington's axiom (H3) [2]: EQ(o(n(o(n(x),y)),n(o(n(x),n(y)))),x). Whether Robbins implies Boolean is still an open question. What is known is that the addition to the three Robbins axioms of any one of a number of properties of a Boolean algebra suffices to yield Boolean. Problem RAl, simple. Prove that, if the axiom EQ(o(x,0),x). is adjoined to the axioms for a Robbins algebra, the resulting algebra is Boolean. We recommend trying to prove Huntington's axiom (H3). Problem RA2, moderate. Prove that the addition of the equality EQ(o(x,x),x). to Robbins yields Boolean. Problem RA3, hard. Prove that, where c is a constant, the addition of the equality EQ(o(c,c),c). to Robbins yields Boolean. Problem RA4, never proved in a single run unaided. Prove that, where c and d are constants, the addition of the equality EQ(o(c,d),d). to Robbins yields Boolean. Problem RA5, never proved in a single run unaided. Prove that, where c and d are constants, the addition of the equality EQ(n(o(c,d)),n(d)). to Robbins yields Boolean.
3. Combinatory Logic Barendregt [1] defines combinatory logic as an equational system satisfying the combinators S and K with ((Sx)y)z = (xz)(yz) and (Kx)y = x. Rather than studying this logic in its entirety, one finds challenging test problems by replacing one or both of S and K by one or more combinators and focusing on questions concerning the possible presence of the strong fixed point property. The set consisting of the combinators under study is called a basis, and the set of combinators generated by a basis is called a fragment. Where A is a given fragment with basis B, the strong fixed point property holds for A if and only if there exists a combinator y such that, for all combinators x, yx = x(yx), where y is expressed purely in terms of elements of B. The problems we offer focus on various subsets of the following combinators. We use a(S, x) to represent Sx.
Collected Works of Larry Wos
1190 EQ(a(a(a(B,x),y),z),a(x,a(y,z))). EQ(a(a(a(C,x)1y))z)Ia(a(x,Z),y)). EQ(a(a(a(H1x)1y),z),a(a(a(x,y),z)>y)). EQ(a(I,x),x).
EQ(a(M,x),a(x,x)). EQ(a(a(a(N,x),y),z),a(a(a(x,z),y),z)). EQ(a(a(a(SIx))y))z))a(a(x>z),a(y)Z))). EQ(a(a(W,x)(y),a(a(x,y),y)).
For each of the following problems, the object is to use the combinators specified in the problem and no others and prove that the strong fixed point property holds by finding an appropriate object. Problem CL1, simple. The set consists of B, M, and W. Problem CL2, hard. The set consists of B and W. Problem CL3, hard. The set consists of B and N. Problem CL4, hard. The set consists of B and H. Problem CL5, hard. The set consists of B, C, I, and S. To complement the preceding test problems, we offer two open questions. Does the set consisting of B and M alone permit the construction of an object that proves that the strong fixed point property holds? Does the set consisting of B and S alone permit the construction of an object that proves that the strong fixed point property holds?
4. Many-Valued Sentential Calculus The axioms are the following, where the constant T can be interpreted as "true" and the functions i and n as implication and negation, respectively. EQ(i(T,x),x). EQ(i(i(x,y),i(i(y,z),i(x,z))),T).
EQ(i(i(x,y),y),i(i(y,x),x)). EQ(i(i(n(x),n(y)),i(y,x)),T).
Problem MV1, simple. Prove that each of the two equalities EQ(i(n(n(x)),x),T). and EQ(i(x,n(n(x))),T). holds in many-valued sentential calculus. Problem MV2, moderate. Prove that EQ(i(i(x,y),i(i(z,x),i(z,y))),T). holds in the calculus. Problem MV3, moderate. Prove that EQ(i(i(x,y),i(n(y),n(x))),T). holds in the calculus. Problem MV4, hard. Prove that EQ(i(i(i(x,y),i(y,x)),i(y,x)),T). holds in the calculus.
Benchmark Problems in Which Equality Plays the Major Role
1191
5. Nonunit Problems With the intention of spurring research focusing on paramodulation in which nonunit clauses occur, we offer the following problems. Problem NU1, moderate. The problem asks one to prove the following identity in modular lattices in which a 0 and 1 exist, where A is meet, V is join, and ' is complement. This is the equational form of Sam's Lemma. ((A V B)' V ((A A B)' A B)) A {{A V B)' V ((A A S)' A A)) = {A V B)' The following clauses can be used, the first 18 of which capture the properties of a modular lattice. EQ(meet(0,x),0). EQ(meet(x,0),0). EQ(join(0,x),x). EQ(join(x,0),x). EQ(meet(l,x),x). EQ(meet(x,l),x). EQ(join(l,x),l). EQ(join(x,l),l). EQ(meet(x,x),x). EQ(join(x,x)x). EQ(meet(x,y),meet(y,x)). EQ(join(x,y),join(y,x)).
EQ(meet(meet(x,y),z),meet(x,meet(y,z))). EQ(join(join(x,y),z),join(x,join(y,z))). EQ(meet(x,join(x,y)),x). EQ(join(x,meet(x,y)),x). -EQ(meet(x,z),x) | EQ(meet(z,join(x,y)),join(x,meet(y,z))). EQ(x,x). EQ(join(r2,meet(a,b)),l). EQ(meet(r2,meet(a,b)),0). EQ(join(rl,join(a,b)),l). EQ(meet(rl,join(a,b)),0). EQ(join(rl,meet(a,r2)),b2). EQ(join(rl,meet(b,r2)),a2). -EQ(meet(a2,b2),rl).
Problem NU2, moderate. Prove that subgroups of index 2 are normal, using the clauses given earlier to study group theory. O(x) means that x is in the subgroup, j(x,y) is an element of the subgroup that exists if x and y are not in the subgroup (for giving the definition of index 2). 0(e). -O(x) | 0(inv(x)). -O(x) | -0(y) | 0(prod(x,y)). 0(x) | 0(y) | 0(i(x,y)).
0(x) | 0(y) | EQ(prod(x,j(x,y)),y). 0(b). -0(prod(a,prod(b,g(a)))).
Problem NU3, hard. In set theory, prove that if two ordered pairs are equal, then they are equal componentwise. In the following clauses, op(x,y) means the ordered pair, up(x,y) means the unordered pair, IN is set membership, and sing is the singleton set consisting of a;.
Collected Works of Larry Wos
1192 EQ(x,x). IN(x,sing(x)). -IN(x,sing(y)) | EQ(x,y). IN(x,up(x,y)). IN(y,up(x,y)).
-IN(x,up(y,z)) | EQ(x,y) | EQ(x,z). EQ(op(x,y),up(sing(x),up(x,y))). EQ(op(ml,rl),op(m2,r2)). -EQ(ml,m2) | -EQ(rl,r2). EQ(op(x,y),up(sing(x),up(x,y))).
References 1. Barendregt, H. P. The Lambda Calculus: Its Syntax and Semantics, NorthHolland, Amsterdam (1981). 2. Huntington, E., "New sets of independent postulates for the algebra of logic, with special reference to Whitehead and Russell's Principia Mathematica", Trans, of AMS, 35, pp. 274-304 (1933). 3. McCune, W., OTTER 2.0 Users Guide, Technical Report ANL-90/9, Argonne National Laboratory, Argonne, Illinois, 1990. 4. McCune, W., What's New in OTTER 2.2, Mathematics and Computer Sci ence Division Technical Report ANL/MCS-TM-153, Argonne National Labora tory, 1991. 5. McCune, W., Single Axioms for Groups and Abelian Groups with Various Operations, Mathematics and Computer Science Division Preprint MCS-P2701091, Argonne National Laboratory, Argonne, Illinois, 1991. 6. Meredith, C. A., and Prior, A. N., "Equational logic", Notre Dame J. Formal Logic, 9, pp. 212-226 (1968). 7. Wos, L., Automated Reasoning: S3 Basic Research Problems, Prentice-Hall, Englewood Cliffs, N.J., 1987.
Experiments in Automated Deduction with Condensed Detachment* William McCune and Larry Wos Mathematics and Computer Science Division Argonne National Laboratory Argonne, Illinois 60439-4801 U.S.A.
Abstract This paper contains the results of experiments with several search strategies on 112 problems involving condensed detachment. The problems are taken from nine different logic calculi: three versions of the two-valued sentential calculus, the many-valued sentential calculus, the implicational calculus, the equivalential calculus, the R calculus, the left group calcu lus, and the right group calculus. Each problem was given to the theorem prover OTTER and was run with at least three strategies: (1) a basic strategy, (2) a strategy with a more refined method for selecting clauses on which to focus, and (3) a strategy that uses the refined selection mech anism and deletes deduced formulas according to some simple rules. Two new features of OTTER are also presented: the refined method for selecting the next formula on which to focus, and a method for controlling memory usage.
1
Introduction
The aim of this paper is to examine the role of strategy in the study of logic calculi with condensed detachment. We present results of experiments with the theorem-proving program OTTER on 112 problems, all of which contain the axiom (or, from another point of view, inference rule) condensed detachment. All of the problems concern axiomatizations of various logic calculi, includ ing the two-valued sentential calculus and two of its variations, the many-valued "This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted with permission from the Proceedings of the Eleventh International Conference on Automated Deduction (CADE-11), Lecture Notes in Artificial Intelligence, Vol. 607, ed. D. Kapur, Springer-Verlag, New York, 1992, 209-223.
Collected Works of Larry Wos
1194
sentential calculus, the implicational fragment of sentential calculus, equivalential calculus, and three subsystems of the equivalential calculus: the R calculus, the left group calculus, and the right group calculus. The problems should also serve well as test problems for evaluating other search strategies and other theorem-proving programs. We have experimented extensively with most of the problems, and we have developed specialized strategies for particular logic calculi. For the experiments presented in this paper, however, we sought strategies that perform well on all of the problems. Aside from a default basic strategy, we experimented with a guidance strategy and a deletion strategy. The guidance strategy, which we call the ratio strategy (Section 1.2.1), combines best-first search with breadth-first search when selecting the next formula on which to focus. The deletion strategy (Section 1.2.2) causes derived formulas that are instances of simple patterns to be deleted.
1.1
Condensed Detachment
All of the problems use C. A. Meredith's condensed detachment [6, 14], a rule of inference that combines detachment (modus ponens) and instantiation. Let C be the binary operation of concern. If C(a, 0) and 7 are both theorems (renamed so that they have no variables in common), and if a and 7 unify with most general unifier a, then Per is deduced by condensed detachment. The formula C(a, P) is the major premise, and 7 is the minor premise. The binary operation is usually interpreted as "implies", "equivalent", or some variation of the group operation, depending on the calculus. The logic calculi can be studied as first-order theories by a trivial trans formation [5]. First, a unary predicate P, interpreted as "is a theorem" or "is the group identity", is introduced. Then, each axiom of the calculus is preceded by P, with its variables universally quantified. Finally, condensed detachment becomes an axiom of the theory. VsVy(P(C(x,y))&P(x)
-
P(y)).
An application of hyperresolution with the axiom condensed detachment corre sponds directly to an application of the inference rule condensed detachment. Although we used hyperresolution exclusively for the experiments presented in this paper, any inference rule for first-order logic is applicable. The AN calculus, which is a variation of the two-valued sentential calculus, has a binary operation 0, which can be interpreted as disjunction, and a unary operation n, which can be interpreted as negation. For the AN calculus, the following variation of condensed detachment is used: V*Vy(P(o(n(z),y))&P(s)
-
P(y)).
The study of logic calculi with condensed detachment has been one of the first and most successful applications of automated theorem proving. Original
Experiments in Automated Deduction with Condensed Detachment
1195
research has been conducted and open questions have been answered by relying heavily on automated theorem proving programs [3,16,15, 4, 22, 18, 21, 11, 10].
1.2
OTTER
and Simple Strategies
OTTER [9] is a resolution/paramodulation theorem-proving program for firstorder logic with equality. Its basic algorithm, restricted to hyperresolution with condensed detachment, is shown in Figure 1.
Start with sos list containing all axioms and with usable list containing the axiom for condensed detachment. Loop: 1. G = select-given-clause(sos); 2. move G from sos to usable; 3. apply condensed detachment as much as possible, with G as one premise, taking the other premise from usable; append to sos the results that are not subsumed by anything in sos or usable; end loop. Figure 1 OTTER'S Basic Algorithm with Condensed Detachment
1.2.1
Selecting the Given Clause
Our default strategy for selecting the given clause in Step 1 of the basic algorithm has traditionally been to select a clause with the fewest symbols; if there is more than one clause of minimum length, the first of those is selected. We call the default strategy "selecting the smallest clause as given". However, some problems in the logic calculi yield quickly to a breadth-first search, which is accomplished by selecting the first clause in the sos list as the given clause. The method we use for most of the experiments presented in this paper combines those two methods. In every fourth iteration of the loop, the first clause is selected, and in the remaining iterations, the first clause of minimum length is selected. We call this refined method "selecting the given clause with ratio 3". The refinement allows large clauses to enter the search while the focus remains mainly on small clauses. It is similar to a selection strategy used by J. Kalman in one of his early programs [3]. 1.2.2
Deleting Derived Formulas
In the equivalential calculus, the R calculus, and the left and right group calculi (all of which have binary operator e), we found that formulas containing subfor-
Collected Works of Larry Wos
1196
mulas that are instances of e(x, x) are generally not as useful or as powerful as formulas without such instances. Searches in which those formulas are deleted are generally more effective, although they can result in longer proofs. The strat egy also applies to the implicational calculi by deleting deduced formulas with instances of i(x,x), although it appears to be less effective there. The strategy applies to the AN calculus, in which the binary operation is disjunction, by deleting formulas with instances of o(n(x), x). In the calculi with unary operation n, meaning negation, we found that deduced formulas containing instances of n(n(x)) caused redundancy in the search spaces and that deleting those formulas generally improved the searches. We also ran experiments deleting formulas with instances of n(n(n(x))). We used demodulation of derived formulas to implement the deletion strat egy. When the strategy was in use, demodulation usually accounted for between one third and one half of the CPU time. 1.2.3
Controlling Memory Usage
We limited the OTTER jobs to 12 Mbytes of memory, in which OTTER can store roughly 20,000 formulas. Even with the deletion strategy of the preceding subsection, O T T E R quickly fills 12 Mbytes. The list sos typically grows much faster than does the number of given clauses that are removed from it. Thus, most formulas in sos never enter the search, and memory is wasted. Our current solution to that problem is the following. When one third of available memory has been filled, we impose a limit on the number of symbols in deduced clauses. The limit, say n, is such that 5% of all formulas in sos have < n symbols. Every tenth iteration of the main loop after the initial limit has been set, calculate a prospective new lim't n' in the same way. If n' < n, then the limit is reset to n'. We arrived at the values 1/3 and 5% by trial and error. Although this method is incomplete, its use with condensed detachment problems typically does not have a great effect on the sequence of given clauses, or therefore, on the search. We have not experimented heavily with this method on other problems.
1.3
The Experiments
We ran all of the experiments on SPARCstation 1+ computers with 16 megabytes of main memory. In that environment, O T T E R can infer several thousand formu las per second, most of which are deleted because they are subsumed by existing formulas or by the deletion strategy. (Back subsumption, in which newly kept formulas cause the deletion of weaker existing formulas, was not used.) Here is an example of the way in which problems are presented. Given the equivalential calculus formulas (EC-1) (EC-4)
e(e(e{x,y),e(z,x)),e(y,z)) e(e(x,y),e(y,x))
Experiments in Automated Deduction with Condensed Detachment (EC-5)
1197
e(e(e(x, y), z), e(x, e(y, z)))
the problem (EC-4.EC-5 => EC-1) is to find a refutation of the following set of clauses. Symbols x, y, and z are variables, and a, 6, and c are Skolem constants. -iP{e{x, y)) | ^P{x) | P{y). P(e(e{x,y),e(y,x))). P(e(e(e(z, y), z), e(x, e(y,*)))). ->P(e(e(e(a, 6), e(c, a)), e(6, c))).
% Condensed Detachment % EC-4 % EC-5 % Denial of EC-1
Each problem was run with several strategies with a time limit of four hours each. In the tables that follow, "Fail" indicates that no proof was found within four hours, and "*" indicates that no proof is possible, because the goal would be deleted by the deletion strategy. All of the times are given in seconds. The strategies are the following. Basic. The smallest formula is selected as given. Ratio. Given clauses are selected with ratio 3. R-e. Given clauses are selected with ratio 3, and deduced clauses containing an instance of e(x, x) as a subformula are deleted. R-i. Given clauses are selected with ratio 3, and deduced clauses containing an instance of i(x, x) as a subformula are deleted. R-nn. Given clauses are selected with ratio 3, and deduced clauses containing an instance of n(n(x)) are deleted. R-nnn. Given clauses are selected with ratio 3, and deduced clauses containing an instance of n(n(n(x))) are deleted. R-i-nn. Given clauses are selected with ratio 3, and deduced clauses containing an instance of i(x, x) as a subformula or an instance of n(n(x)) are deleted. R-i-nnn. Given clauses are selected with ratio 3, and deduced clauses contain ing an instance of i(x, x) as a subformula or an instance of n(n(n(x))) are deleted. R-o-nn. Given clauses are selected with ratio 3, and deduced clauses containing an instance of o(n(x), x) as a subformula or an instance of n(n(x)) are deleted. R-o-nnn. Given clauses are selected with ratio 3, and deduced clauses contain ing an instance of o(n(x), x) as a subformula or an instance of n(n(n(x))) are deleted. We present here a sequence of problems that reflects a wide range of difficulty and that roughly follows the historical development of the individual calculi.
Collected Works of Larry Wos
1198
2
Two-Valued Sentential Calculi
We experimented with three versions of two-valued sentential calculus: (1) the CN calculus, with operators intended to mean implication and negation, (2) the CO calculus, with implication and falsehood, and (3) the AN calculus, with disjunction and negation. If appropriate definitions are added for the missing operators, each version is equivalent to the classical prepositional calculus.
2.1
The Implication/Negation Two-Valued Sentential Calculus (CN)
Each of the following formulas holds in the two-valued sentential calculus (CN). The numbering of the formulas is from [7, p. 42-51]. (CN-1) (CN-2) (CN-3) (CN-16) (CN-18) (CN-19) (CN-20) (CN-21) (CN-22) (CN-24) (CN-30) (CN-35) (CN-37) (CN-39) (CN-40) (CN-46) (CN-49) (CN-54) (CN-59) (CN-60) (CN-CAM)
i(i{x,y),i(i(y,z),i(x,z))) i(i(n(x),x),x) i(x,i(n(x),y)) i(x,x) i(x,i(y,x)) i(i(i(x, y), z), i{y, z)) i(x,i(i{x,y),y)) i(i(x,i{y,z)),i(y,i(x,z))) i(i(x,y),i{i(z,x),i(z,y))) i(i(i(x,y),x),x) i(i(x,i{x,y)),i(x,y)) i(i(x, i(y, z)), i(i(x, y), i(x, z))) i(i(i(x,y),z),i(n(x),z)) i(n(n(x)),x) i(x, n(n(x))) i(i(x,y),i(n(y),n(x))) i(i(n(x),n(y)),i(y,x)) i(i(x,y),i(i(n{x),y),y)) i(i(n{x), z),i(i(y, z), i(i(x, y), z))) i(i(x, i(n(y), z)), i(x, i(i(u, z), t(t(y, u), z)))) i(i(i(i(i(x, y), i(n(z), n(u))), z),v), i(i(v, x), i(u, x)))
According to Lukasiewicz [8, p. 136], the first axiom system for the twovalued sentential calculus was {CN-18,CN-21,CN-35,CN-39,CN-40,CN-46} and was due to Frege. We use that as our starting point. Lukasiewicz showed that CN-21 depends on the remaining axioms of FVege's system (Problem 1, Table 1). Another early axiomatization of CN was'due to Hilbert [8, p. 136]: {CN3,CN-18,CN-21,CN-22,CN-30,CN-54}. Lukasiewicz showed that CN-30 is not necessary (Problem 2, Table 1). Problems 3-6, Table 1, are to derive Frege's simplified system from Hilbert's simplified system.
Experiments in Automated Deduction with Condensed Detachment
1199
Table 1 CN Calculus, Frege and Hilbert Systems Theorem Basic Ratio R-i-nn R-i-nnn R-nn R-nnn 1 CN-18,CN-35,CN-39,CN-40,CN-46 =* CN-21 Fail 246 16 176 26 254 2 CN-3,CN-18,CN-21,CN-22,CN-54 =»■ CN-30 3 5 2 2 6 6 3 CN-3.CN-18,CN-21,CN-22,CN-54 =*■ CN-35 Fail Fail 8005 6371 3657 3864 4 CN-3,CN-18,CN-21,CN-22,CN-54 =*• CN-39 9 11 8 <1 * » 5 CN-3,CN-18,CN-21,CN-22,CN-54 =»■ CN-40 14 10 34 13 * * 6 CN-3,CN-18,CN-21,CN-22,CN-54 =>■ CN-46 7366 1534 1467 1509 2857 2401
#
Lukasiewicz axiomatized CN with {CN-l,CN-2,CN-3} [7]. Other axiom sys tems for CN are {CN-18,CN-35,CN-49} (Church [1]), {CN-19,CN-37,CN-59} (Lukasiewicz [7]), {CN-19,CN-37,CN-60} (Wos [?]), and {CN-CAM} (C. A. Mered ith [12]). Problems 7-24, Table 2, are to start with {CN-l,CN-2,CN-3} and derive formulas in the other axiomatizations. Problems 25-36, Table 3, are to derive Lukasiewicz's system {CN-l,CN-2,CN-3} from the other systems. Table 2 CN Calculus, Starting with {CN-l,CN-2,CN-3} Theorem Basic 7 CN-l,CN-2,CN-3 => CN-16 <1 8 CN-l,CN-2,CN-3 => CN-18 60 9 CN-l,CN-2,CN-3 => CN-19 60 10 CN-l,CN-2,CN-3 => CN-20 89 11 CN-l,CN-2,CN-3 => CN-21 104 12 CN-l,CN-2,CN-3 =► CN-22 105 13 CN-l,CN-2,CN-3 => CN-24 105 14 CN-l,CN-2,CN-3 =► CN-30 109 15 CN-l,CN-2,CN-3 => CN-35 Fail 16 CN-l,CN-2,CN-3 => CN-37 105 17 CN-l,CN-2,CN-3 => CN-39 104 18 CN-l,CN-2,CN-3 => CN-40 106 19 CN-l,CN-2,CN-3 =*• CN-46 1021 20 CN-l,CN-2,CN-3 =► CN-49 260 1195 21 CN-l,CN-2,CN-3 =*■ CN-54 22 CN-l,CN-2,CN-3 =*• CN-59 Fail Fail 23 CN-l,CN-2,CN-3 => CN-60 24 CN-l,CN-2,CN-3 =*• CN-CAM Pail
#
2.2
Ratio <1 7 7 147 148 589 71 71 Fail 33 31 32 1262 73 1608 Fail Fail Fail
R-i-nn <1 5 5 23 23 74 31 32 Fail 31
* • 423 31 447 Fail Fail Fail
R-i-nnn <1 5 5 28 28 184 40 45 Fail 40 37 38 1434 36 1552 Fail Fail Fail
R-nn <1 10 10 65 66 177 40 40 Fail 34
* * 470 45 509 Fail Fail Pail
The Implication/Falsehood Two-Valued Sentential Calculus (CO)
Each of the following formulas holds in the CO calculus: (C0-1)
i(i(x,y),i(i(y,z),i(x,z)))
R-nnn <1 9 9 157 158 595 86 86 Fail 40 41 42 1378 88 1763 Fail Fail Fail
Collected Works of Larry Wos
1200
Table 3 CN Calculus, Deriving {CN-l,CN-2,CN-3} # 25 26 27 28 29 30 31 32 33 34 35 36
Theorem Basic CN-18,CN-35,CN-49 => CN-1 Fail CN-18,CN-35,CN-49 =>• CN-2 4 CN-18,CN-35,CN-49 => CN-3 3 CN-19,CN-37,CN-59 =J- CN-1 6038 CN-19,CN-37,CN-59 =» CN-2 622 CN-19,CN-37,CN-59 => CN-3 161 CN-19,CN-37,CN-60 =* CN-1 5611 CN-19,CN-37,CN-60 => CN-2 753 CN-19,CN-37,CN-60 => CN-3 239 CN-CAM =* CN-1 Fail CN-CAM => CN-2 Fail CN-CAM =* CN-3 6
(CO-2) (CO-3) (CO-4) (C0-5) (CO-6) (CO-CAM)
Ratio 1083 3 1 303 359 12 515 546 224 Fail Fail 10
R-i-nn 89 8 3 89 3107 5 493 Fail 345 Fail Fail Fail
R-i-nnn 531 11 3 245 6800 12 682 Fail 337 Fail Fail Fail
R-nn 91 1 12 99 257 6 480 511 329 Fail Fail 14
R-nnn 1137 4 2 286 592 15 702 755 332 Fail Fail 14
i(x,i(y,x)) i(i(i(x,y),x),x) i(F,x) i(i(i(x,F),F),x) i(i(x, i(y, z)), i{i(x, y), z(x, z))) i(i(t(i(i(x, y), i{z, F)), u), v), i(i{v, x), i(z, x)))
Each of the sets {C0-l,C0-2,C0-3,C0-4} (Tarski-Bernays, according to [12]), {C0-2,C0-5,C0-6} (Church [1]), and {CO-CAM} (C. A. Meredith [12]) axiomatizes the CO calculus. Problems 37-49, Table 4, involve deriving each axiom system from the others.
2.3
The Disjunction/Negation Two-Valued Sentential Calculus (AN)
Each of the following formulas holds in the AN calculus: (AN-1) o(n(o(n{y), z)), o(n(o(x, y)), o(x, z))) (AN-2) o(n(o(x,2/)),o(j/,x)) (AN-3) o(n(x),o(y,x)) (AN-4) o(n(o(x,x)),x) (AN-CAM) o{n(o(n(o(n(x), y)), o(z, o(u, t>)))), o(n{o(n(u), x)), o{z, o{v, x)))) Each of the sets {AN-l,AN-2,AN-3,AN-4} (Whitehead-Russell, according to [12]) and {AN-CAM} (C. A. Meredith [12]) axiomatizes the AN calculus. Prob lems 50-54, Table 5, are to derive each system from the other. Recall that the clause form of condensed detachment for the AN calculus is ->P(o(r»(x),y)) | ^P{x) \ P{y).
Experiments in Automated Deduction with Condensed Detachment
1201
Table 4 The CO Calculus # 37 38 39 40 41 42 43 44 45 46 47 48 49
Theorem C0-2,C0-5,C0-6 => CO-1 C0-2,C0-5,C0-6 => CO-3 C0-2,C0-5,C0-6 => CO-4 CO-2,CO-5,CO-6 =S> CO-CAM C0-l,C0-2,C0-3,C0-4 => CO-5 C0-l,C0-2,C0-3,C0-4 => C0-6 C0-l,CO-2,CO-3,CO-4 => CO-CAM CO-CAM =► CO-1 CO-CAM => CO-2 CO-CAM => CO-3 CO-CAM => CO-4 CO-CAM => CO-5 CO-CAM => CO-6
Basic 419 337 <1 Fail 38 1251 Pail Fail <1 13 <1 5 Fail
Ratio 72 103 <1 Fail 7 953 Fail Fail <1 24 <1 9 Fail
R-i 54 98 <1 Fail 7 1010 Fail Fail <1 30 <1 12 Fail
R-o-nnn Fail Fail Fail 78 Fail
R-nn Fail 516 449 137 2657
Table 5 The AN Calculus Theorem Basic # 50 AN-l,AN-2,AN-3,AN-4 => AN-CAM Fail 51 AN-CAM =»■ AN-1 Fail 52 AN-CAM =» AN-2 3472 53 AN-CAM =* AN-3 34 54 AN-CAM =* AN-4 11447
Ratio Fail Fail Fail 58 Fail
R-o-nn Fail Fail Fail 133 Fail
R-nnn Fail Fail 5365 78 Fail
Collected Works of Larry Wos
1202
3
T h e Many-Valued Sentential Calculus (MV)
Each of the following formulas holds in the many-valued sentential calculus: (MV-1) (MV-2) (MV-3) (MV-4) (MV-5) (MV-24) (MV-25) (MV-29) (MV-33) (MV-36) (MV-39) (MV-50)
i{x,i{y,x)) i{i(x,y),i(i{y,z),i(x,z))) i(i(i(x, y),»), i(i(y, x), x)) i(i(i(x,y),i(y,x)),i(y,x)) i(i(n(x),n(y)),i(y,x)) i(n{n(x)),x) t(t(x, y), i(i(z, x), i(z, y))) i(x,n(n(a:))) i(i(n(x),y),i(n(y),x)) i(i(x,y),i(n(y),n(x))) i(n(t(x,y)),n(y)) «(n(*),t(y,n(«(y,*))))
Lukasiewicz denned the many-valued sentential calculus Ln0 and conjectured that it is axiomatized by {MV-l,MV-2,MV-3,MV-4)MV-5} [8]. Wajsberg proved the conjecture, and C. A. Meredith later proved MV-4 dependent on the remain ing axioms [8, p. 144]. Problems 55-62, Table 6, are to prove MV-4 and several other formulas from {MV-l,MV-2,MV-3,MV-5}. (Problem 55 has been called "Luka5" by members of the Argonne group.) Table 6 The MV Calculus #
55 56 57 58 59 60 61 62
4
Theorem MV-l,MV-2,MV-3,MV-5 MV-l,MV-2,MV-3,MV-5 MV-l,MV-2,MV-3,MV-5 MV-l,MV-2,MV-3,MV-5 MV-l,MV-2,MV-3,MV-5 MV-l,MV-2,MV-3,MV-5 MV-l,MV-2,MV-3,MV-5 MV-l,MV-2,MV-3,MV-5
=* MV-4 => MV-24 => MV-25 => MV-29 => MV-33 => MV-36 => MV-39 => MV-50
Basic Fail 3 4475 3 Fail Fail 7 Fail
Ratio Fail 2 8 2 2036 2035 17 2041
R-i-nn Fail
• 5
*
1468 3138 675 3151
R-i-nnn Fail 8 5 8 2665 2664 25 2674
R-nn Fail
* 9
*
1827 3812 628 3825
R-nnn Fail 2 9 2 3955 3955 16 3964
T h e Implicational Propositional Calculus (IC)
The implicational propositional calculus (IC) is the part of the sentential cal culus in which the negation operation does not occur. Each of the following formulas holds in IC: (IC-1) (IC-2)
i(x,x) i(x,i(y,x))
Experiments in Automated Deduction with Condensed Detachment (IC-3) (IC-4) (IC-5) (IC-JL)
1203
i(i(i(x,y),x),x) i(i(x, y), i(i(yt z), i(x, z))) i(x,i{i(x,y),y)) i{i(i(x, y), z), i(i(z, x), i(u, x)))
Each of the sets {IC-2,IC-3,IC-4} (Tarski-Bernays, according to [8, p. 296]) and {IC-JL} (Lukasiewicz [8, p. 295]) axiomatizes IC. Problems 63-68, Table 7, are to derive each system from the other. Table 7 The Implicational Prepositional Calculus # 63 64 65 66 67 68
5
Theorem Basic IC-2,IC-3,IC-4 =► IC-JL 50 IC-JL =*• IC-1 8 IC-JL =► IC-2 8 IC-JL => IC-3 32 IC-JL =*• IC-4 7933 IC-JL => IC-5 2172
Ratio 101 <1 <1 47 13985 3753
R-e 100 27 <1 26 12224 2715
Equivalential and Group Calculi
The equivalential and group calculi have one binary operator, e. In the equiv alential calculus (EC) [8], e(a, 0) is normally interpreted as equivalence of a and 0; however, it can also be interpreted as the group operation ct0 in Boolean groups (groups in which the square of every element is the identity). Under the group interpretation, the theorems of EC are exactly the formulas that are equal to the group identity in Boolean groups. The theorems of the R calculus [13] are exactly the formulas equal to the identity in Abelian groups when e(a, 0) is interpreted as a/3 - 1 . There is also an L calculus, whose theorems are equal to the identity when e(a, 0) is interpreted as ct~l0. We have not experimented with the L calculus, but for completeness, we list here YOL, the shortest single axiom for the L calculus [16]. No other of length 11 exists. (YOL)
e(e(x,y),e(e(e(z,y),x),z))
The theorems of the left group (LG) calculus [2] are exactly the formulas equal to the identity in (general) groups when e(ct,f3) is interpreted as or 1 /?. Similarly, the theorems of the right group (RG) calculus [2] are exactly the formulas equal to the identity in (general) groups when e(a, 0) is interpreted as a/T1. The following relationships exist between the equivalential and group calculi: LG theorems C L theorems C EC theorems. RG theorems C R theorems C EC theorems.
Collected Works of Larry Wos
1204
5.1
The Equivalential Calculus (EC)
The following formulas hold in the equivalential calculus: (EC-1) (EC-2) (EC-4) (EC-5)
e{e(e{x,y),e(z,x)),e(y,z)) e(e{x,e(y,z)),e(e(x,y),z)) e(e(x,y),e(y,x)) e{e(e{x,y),z),e(x,e(y,z)))
According to Lukasiewicz [8, p. 252], the first axiomatization of EC was {ECl.EC-2}, due to Les"niewski. Soon after, Wajsberg produced others, including {EC-4.EC-5}. Problems 69 and 70, Table 8, are to derive the Lesniewski system from the Wajsberg system. Each of the following formulas is a single axiom for EC, in roughly the order in which they were discovered. None shorter exists, nor does there exist any other of length 11. (YQL) (YQF) (YQJ) (UM) (XGF) (WN) (YRM) (YRO) (PYO) (PYM) (XGK) (XHK) (XHN)
e(e(x,y),e(e(z,y),e(x, z))) e(e(x,y),e(e(x,z),e(z,y))) e(e(x,y),e(e(z,x),e(y,z))) e(e(e(x, y),z),e(y, e(z, x))) e{x,e(e(y,e{x,z)),e(z,y))) e(e(x,e(y, z)),e(z, e(x, y))) e(e(x,y),e(z,e(e(y,z),x))) e(e(x,y),e(z,e(e(z,y),x))) e(e{e(x,e{y,z)),z),e(y,x)) e(e(e(x, e(y, z)),y),e(z,x)) e(x,e(e(y,e(z,x)),e(z,y))) e(x,e(e(y,z),e(e(x,z),y))) e(x,e(e(y, z),e(e(z, x),y)))
Lukasiewicz Lukasiewicz Lukasiewicz Meredith Meredith Meredith Meredith Meredith Meredith Meredith Kalman Winker Winker
Problems 71-84, Table 8, are to start with each single axiom and derive the system that precedes it.
5.2
The R Calculus (R)
Each of the following formulas is a single axiom for the Ft calculus: (QYF) (YQM) (WO) (XGJ)
e(e(e(x, y),e(x,z)),e(z,y)) e(e(x,y),e{e(z,y),e{z,x))) e(e(x, e(y, z)),e(z, e(y, x))) e(x,e(e(y, e(z, x)),e(y, z)))
Meredith Meredith Meredith Winker
Problems 85-88, Table 9, are to show the four formulas equivalent in a circular manner.
Experiments in Automated Deduction with Condensed Detachment
Table 8 EC Theorem EC-4,EC-5 => EC-1 EC-4.EC-5 =» EC-2 YQL =S> EC-4 YQL => EC-5 YQF =*• YQL YQJ => YQF UM =*• YQJ XGF => UM WN => XGF YRM => WN YRO => YRM PYO => YRO PYM => PYO XGK =► PYM XHK => XGK XHN => XHK
# 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84
Basic 244 <1 <1 23 2 34 558 <1 98 326 188 281 245 Fail Fail 750
Ratio 366 <1 <1 2 5 54 1074 <1 164 474 250 592 449 Fail Fail 1690
R-e 279 <1 <1 2 2 33 159 <1 85 425 151 516 352 499 886 484
Table 9 R Calculus # 85 86 87 88
Theorem Basic YQM => QYF <1 WO => YQM 21 XGJ =*• WO Fail QYF => XGJ 41
Ratio <1 11 Fail 42
R-e <1 5 362 21
1205
Collected Works of Larry Wos
1206
5.3
The Left Group Calculus (LG)
Kalman's axiomatization of the LG calculus is {LG-l,LG-2,LG-3,LG-4,LG-5} [2](LG-1) (LG-2) (LG-3) (LG-4) (LG-5)
e(e(e(x, e(e(y, y), x)), z), z) e(e(e(e(e(x, y), e(x, z)), e(y, z)), u), u) e(e(e(e(e(e(x, y), e(x, z)), u), e(e(y,z), u)), v), v) e(e(e(e(x, y), z), u), e(e(e(x, v), z), e(e(y, v), u))) e(e(e(x, e(e(y, x), z)), e(e(u, x), v)), e(e(e(e(x, y), u), z), v))
(P-l) (P-4) (Q-1) (Q-2) (Q-3) (Q-4) (LG-27-1690)
e(e(e(x, y), z), e(e(u, y), e(e(x, u), z))) e(x, e(e(e(e(y, z), e(y, u)), e(z, u)), x)) e(x,e(e(y,z),e(e(z,y),x))) e(e(x,y),e(e(z,x),e(z,y))) e(e(e(x,y),e(e(y,x),z)),z) e(e(e(x,y),e(x,z)),e(y,z)) e(e(e(e(x, y), z), e(e(u, v), e(e(e{w, v), e(w, u)), s))), e(z, e(e(y, x), 5)))
With great assistance from OTTER, McCune later showed that each of the sets {LG-2.LG-3}, {LG-2.P-1}, {LG-2.P-4}, {LG-2,Q-l,Q-2}, {P-l.Q-3}, {P4.Q-3}, {Q-l,Q-2,Q-3}, {Q-l,Q-3,Q-4}, and {LG-27-1690} also axiomatizes the LG calculus [11, 10]. Problems 89-101, Table 10, roughly parallel the discovery of the new axiom systems for the LG calculus.
Table 10 LG Calculus # 89 90 91 92 93 94 95 96 97 98 99 100 101
Theorem LG-2,LG-3,LG-4 =* LG-1 LG-2.LG-3 =* LG-4 LG-3 =* LG-4 LG-2.LG-3 => LG-5 LG-2.P-1 => LG-3 LG-2.P-4 =*> P-l LG-2.Q-1.Q-2 => P-l P-l.Q-3 =► LG-2 P-4.Q-3 => P-l Q-l,Q-2,Q-3 =!> LG-2 Q-l.Q-4 =► Q-2 LG-27-1690 => P-l LG-27-1690 => Q-3
Basic 115 222 109 Fail Fail <1 16 211 <1 10905 <1 <1 <1
Ratio 115 6 8 Fail Fail <1 30 295 <1 Fail <1 <1 2
R-e * 2 9 845 536 <1 5 15 1 7617 <1 <1 3
Experiments in Automated Deduction with Condensed Detachment
5.4
1207
The RG Calculus (RG)
Kalman's axiomatization of the RG calculus is {LG-1',LG-2',LG-3',LG-4',LG5'} [2]. (LG-1') (LG-2') (LG-3') (LG-4') (LG-5')
e(x,e(x,e(e(y,e{z,z)),y))) e(x, e(x, e(e(y, z), e(e(y, u), e(z, u))))) e(x, e(x, e(e(y, e(z, u)), e(y, e(e(z, v), e(u, v)))))) e(e(e(z, e(y, z)), e(u, e(y, v))), e(x, e{u, e(z, v)))) e(e(x, e(y, e(z, e(u, v)))), e(c(x, e(v, z)), e(e(y, e{v, u)), v)))
(Q-2') (Q-3') (Q-4')
e{e(e(x, y), e(z, y)), e(x, z)) e(x,e(e{x,e(y,z)),e(z,y))) e(e(x,y),e(e(x,z),e(y,z)))
With great assistance from OTTER, McCune later showed that each of the pairs {Q-2',Q-3'} and {Q-3',Q-4'} axiomatizes the RG calculus and that each of the following formulas is a single axiom for the RG calculus [11, 10]: (LG-2'} (S-2') (S-3') (S-4') (P-4') (S-6')
e(x, e(x, e(e(y, z), e(e(y, u), e{z, u))))) e{e{x, e(y, z)), e(x, e(e(y, u), e(z, u)))) e[x, e(x, e(e(e(y, z), e(u, z)), e(y, u)))) e(e{x, e(y, z)), e(e(x, e(u, z)), e(y, u))) e(e{x, e(e(y, z), e(e(y,«), e(z, u)))), x) e(e(x, e(e(e(y, z), e(«, z)), e(y, u))), x)
Problems 102-112, Table 11, roughly parallel the discovery of the new axiom systems for the RG calculus.
6
Summary
We have presented 112 condensed detachment problems that offer a large range of difficulty to automated theorem-proving programs, and we have shown how OTTER, using several simple strategies (see Section 1.3), performs on those problems. For the equivalential, R, RG, and LG calculi (the problems with functor e), strategy R-e wins on nearly all problems. We note that the deletion in strategy R-e prevents proofs in problems 89 and 102. For the CN, CO, and MV calculi, no clear overall winner was found. For the AN calculus problems, strategy Rnn performed best. For the IC problems, the basic strategy performed best. Although we did not run experiments using deletion while selecting the smallest clause as given, we can compare the performance of basic and ratio strategies (both without deletion). No clear winner was found, but the ratio strategy
Collected Works of Larry Wos
1208
Table 11 RG Calculus # 102 103 104 105 106 107 108 109 110 111 112
Theorem Basic LG-2' =► LG-1' 130 LG-2' =*• LG-3' Fail LG-2' => LG-4' Fail LG-2' =*■ LG-5' Fail Q-2',Q-3' =► LG-2' 9609 Q-3',Q-4' =► Q-2' <1 S-27 =► LG-2' 757 S-3' =*• LG-2' 91 S-4' =*• LG-2' 5837 P-4' =► LG-2' <1 S-6' => LG-2' 120
Ratio 133 Fail 889 Fail Fail <1 1495 142 Fail <1 143
R-e
* 104 62 809 5634 <1 136 40 Fail" <1 19
"The deletion strategy eliminates all interesting paths.
performed slightly better than the basic strategy overall. The results of the experiments reinforce our long-held position that a single strategy cannot be effective on a wide range of problems. Several of the problems have been particularly challenging for us. Problem 67, posed as a challenge problem in [17] and called "imp4" by members of the Argonne group, was the first truly difficult condensed detachment theorem proved by OTTER. It has been used extensively as a benchmark for parallel deduction programs. Problem 34, to derive CN-1 from CN-CAM, has resisted all of our attempts at automated proofs. (One attempt generated 1.4 billion formulas and consumed 17 CPU days on a Solbourne 5e/900 computer.) Problem 55, to show the dependence of MV-4 in Lukasiewicz's system for L^0, has also resisted all of our attempts. (One attempt generated 983 million formulas.) We have, however, found many proofs for Problem 55 using OTTER in various proofchecking modes [20]. OTTER'S search for a proof for Problem 44, to derive C01 from CO-CAM, is impeded by the memory control feature. The weight limit is lowered, either too much or too soon, which causes key formulas to be discarded. OTTER has found a proof in about seven hours with a strategy similar to the basic strategy but with a constant weight limit of 18 instead of the memory control feature. We have not obtained proofs for problems 24, 40, 43, and 50, which are to derive complicated single axioms, because our strategies are biased towards finding simple formulas. The remaining problems for which the tables list complete failure have yielded to specialized strategies.
References 1. A. Church. Introduction to Mathematical Logic, volume I. Princeton Uni versity Press, 1956.
Experiments in Automated Deduction with Condensed Detachment
1209
2. J. A. Kalman. Axiomatizations of logics with values in groups. Journal of the London Math. Society, 2(14):193-199, 1975. 3. J. A. Kalman. Computer studies of T—» - W - 1 . Relevance Logic Newslet ter, 1:181-188, 1976. 4. J. A. Kalman. A shortest single axiom for the classical equivalential cal culus. Notre Dame Journal of Formal Logic, 19:141-144, 1978. 5. J. A. Kalman. Condensed detachment as a rule of inference. Studia Logica, LXII(4):443-451, 1983. 6. E. J. Lemmon, C. A. Meredith, D. Meredith, A. N. Prior, and I. Thomas. Calculi of pure strict implication. Technical report, Canterbury Univer sity College, Christchurch, 1957. Reprinted in Philosophical Logic, Reidel, 1970. 7. J. Lukasiewicz. Elements of Mathematical Logic. Pergamon Press, 1963. English translation of the second edition (1958) of Elementy logiki matematycznej, PWN, Warsaw. 8. J. Lukasiewicz. Selected Works. North-Holland, 1970. Edited by L. Borkowski. 9. W. McCune. OTTER 2.0 users guide. Tech. Report ANL-90/9, Argonne National Laboratory, Argonne, IL, March 1990. 10. W. McCune. Automated discovery of new axiomatizations of the left group and right group calculi. Preprint MCS-P220-0391, Argonne National Lab oratory, Argonne, IL, 1991. 11. W. McCune. Single axioms for the left group and right group calculi. Preprint MCS-P219-0391, Argonne National Laboratory, Argonne, IL, 1991. 12. C. A. Meredith. Single axioms for the systems (C,N), (C,0), and (A,N) of the two-valued propositional calculus. Journal of Computing Systems, 1:155-164, 1953. 13. C. A. Meredith and A. N. Prior. Equational logic. Notre Dame Journal of Formal Logic, 9:212-226, 1968. 14. D. Meredith. In memoriam Carew Arthur Meredith (1904-1976). Notre Dame Journal of Formal Logic, 18:513-516, 1977. 15. J. G. Peterson. Shortest single axioms for the classical equivalential cal culus. Notre Dame Journal of Formed Logic, 17(2):267-271, 1976. 16. J. G. Peterson. The possible shortest single axioms for EC-tautologies. Report 105, Dept. of Mathematics, University of Auckland, 1977.
1210
Collected Works of Larry Wos
17. F. Pfenning. Single axioms in the implicational propositional calculus. In E. Lusk and R. Overbeek, editors, Proceedings of the 9th International Conference on Automated Deduction, Lecture Notes in Computer Science, Vol. 310, pages 710-713, New York, 1988. Springer-Verlag. 18. L. Wos. Meeting the challenge of fifty years of logic. Journal of Automated Reasoning, 6(2):213-232,1990. 19. L. Wos. Automated reasoning and Bledsoe's dream for the field. In R. S. Boyer, e ditor, Automated Reasoning: Essays in Honor of Woody Bledsoe, chapter 15, pages 297-342. Kluwer Academic Publishers, 1991. 20. L. Wos and W. McCune. The application of automated reasoning to proof translation and to finding proofs with specified properties: A case study in many-valued sentential calculus. Tech. Report ANL-91/19, Argonne National Laboratory, Argonne, IL, 1991. In preparation. 21. L. Wos, S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, and R. Butler. Automated reasoning contributes to mathematics and logic. In M. Stickel, editor, Proceedings of the 10th International Conference on Automated Deduction, Lecture Notes in Artificial Intelligence, Vol. 449, pages 485-499, New York, July 1990. Springer-Verlag. 22. L. Wos, S. Winker, B. Smith, R. VerofF, and L. Henschen. A new use of an automated reasoning assistant: Open questions in equivalential calculus and the study of infinite domains. Artificial Intelligence, 22:303-356,1984.
Application of Automated Deduction to t h e Search for Single Axioms for Exponent Groups* William McCune and Larry Wos Mathematics and Computer Science Division Argonne National Laboratory Argonne, Illinois 60439-4801 U.S.A.
A b s t r a c t . We present new results in axiomatic group theory ob tained by using automated deduction programs. The results include single axioms, some with the identity and others without, for groups of exponents 3, 4, 5, and 7, and a general form for single axioms for groups of odd exponent. The results were obtained by using the pro grams in three separate ways: as a symbolic calculator, to search for proofs, and to search for counterexamples. We also touch on relations between logic programming and automated reasoning.
1
Introduction
A group of exponent n is a group in which for all elements x, xn is the identity e. Groups of exponent 2, xx = e, are also called Boolean groups. A single axiom for an equational theory is an equality from which the entire theory can be derived by equational reasoning. We are concerned with single axioms for groups of exponent n, n > 2. B. H. Neumann [6, p.83] gives a general form for single axioms for certain subvarieties of groups, including exponent groups. The axioms it produces are very long, they contain inverse, and they do not contain the identity. We sought shorter axioms without inverse, some without and others with identity. When we started the study, we knew of simple single axioms 'This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted with permission from Logic Programming and Automated Reasoning, Lecture Notes in Artificial Intelligence, Vol. 624, ed. A. Voronkov, Springer-Verlag, New York, 1992, 131-136.
Collected Works of Larry Wos
1212
for Boolean groups [3]. Since then, we have found many single axioms, not containing the identity, for exponents 3, 5, and 7, and a general form for groups of odd exponent. We have also found single axioms, containing the identity, for exponents 2 and 4 and for odd n, 3 < n < 17. We made extensive use of three types of symbolic computation in discovering the axioms. First, the automated deduction program OTTER [1, 4] was used as a symbolic calculator, performing strictly algorithmic deductions, to generate sets of candidate single axioms. We consider such use to be a type of logic program ming. Second, O T T E R also played its traditional role as a theorem prover, to attempt to show that candidates are in fact single axioms. Third, the program FINDER [7] was used to search for counterexamples, to show that candidates are not single axioms. The first two types of computation listed above illustrate our view on the re lationships between logic programming and automated reasoning [8]. Although the theoretical foundations of the two areas are closely related and the imple mentation methods can be similar, practical applications are usually far apart, with logic programming relying on algorithmic deduction, and automated rea soning on less-focused search. Several of the methods we used are based on recent work in which single axioms were discovered for the left group and right group calculi [2] and for several axiomatizations of ordinary groups and Abelian groups [3].
2
Axiomatizations of Exponent Groups
Throughout the paper, e is the group identity, (x ■ y) is product, z _ 1 is inverse, and x n is right-associated. The variety of groups of exponent n, n > 1, can be axiomatized with the following set of three equalities. ( i • y) -z = x ■ (y • z) ex = x xn = e
associativity left identity exponent property
(2.1) (2.2) (2.3)
(Inverse is not required, because x _ 1 = i n _ 1 . Also, left identity can be replaced with right identity x • e = x.) However, the identity e need not be mentioned, for the following set axiomatizes the same structures. {x • y) ■ z = x ■ (y ■ z) yn ■ x = x xn = yn
associativity left identity without e (2.4) exponent property without e (2.5)
(Again, left identity can be replaced with right identity x • yn = x.) An equality a = /? is a single axiom for groups of exponent n if and only if it holds in groups of exponent n and one of the above sets can be derived from it. (It is known that either a or 0 must be a variable.) Note that the mirror image
Search for Single Axioms for Exponent Groups
1213
of a single axiom, obtained by flipping arguments of all occurrences of product, is also a single axiom.
3
P r o g r a m s Used
OTTER is a resolution/paramodulation automated deduction system for firstorder logic with equality. As well as its normal role of searching for proofs, O T T E R can be "programmed" to perform symbolic computation tasks. We list here examples of tasks that arose during our study of exponent groups and that can be addressed by "programming" OTTER. • Given a string of terms, construct the set of products of the terms with all possible associations. For example, a string of length 5 produces a set of 14 associations. • Given term t, construct {t'\t' can be obtained from t by inserting one occurrence of e}. • Given a set of equalities, rewrite each with x~l = x • x ■ x\ then paramodulate one level from the left argument of x • x ■ x ■ x = e. • Given a set of equalities, generate 10,000 consequences of the set; then extract equalities with three distinct variables and one occurrence of e. The preceding methods and others were used to generate sets of candidate single axioms for exponent groups. We used OTTER as a theorem prover to attempt to show that candidates are single axioms. The search strategy was based on Knuth-Bendix completion, and it included the following enhancements. • Equalities that could not be oriented into rewrite rules were allowed to participate in the search. • We placed a limit on the length of equalities. The limit for each case was typically determined by experimentation. • We used the ratio strategy [5], which combines best-first search and breadthfirst search, for selecting the next equality for application of paramodulation. • Denials of the associativity, identity, and exponent properties were input, but they did not participate in the searches. They were used only to detect proofs. • We occasionally pruned the search based on our intuition.
Collected Works of Larry Wos
1214
When working on a particular type of candidate, we ran individual O T T E R jobs, carefully tuning the strategy. In contrast, with a set of, say, 1000 candidates we would fix the strategy and automatically run a sequence of 1000 OTTER searches, each with a small time limit. FINDER [7] is a program that searches for models of sets of first-order clauses. Given a candidate, if FINDER produces a model violating a group property or the exponent property, the candidate is not a single axiom. Most of our useful assistance from FINDER was with jobs of less than one minute, finding models of less than five elements.
4 4.1
Results Single Axioms without the Identity
For groups with exponent 2, we already knew short single axioms [3], for exam ple, ((x • y) ■ z) ■ (x -z) = y.
(4.1)
In contrast to (4.1), the axiom produced by B. H. Neumann's general form contains 14 occurrences of product and 9 occurrences of inverse, and we have not been able to verify it with OTTER. For exponent 3, we quickly found the following, each of which is a single axiom, by considering all associations of xxxyzzz = y. x • ((x • (x • (y • (z • z)))) -z)=y x-((x-((x-y)-z))-(z-z)) =y x-((((x-x)-(yz))-z)-z) =y
(4.2) (4.3) (4.4)
For exponent 4, we considered all associations of several strings, but we failed to find short single axioms (without the identity e). For exponent 5, we found 14 single axioms (excluding mirror images), in cluding the following, by considering associations of xxxxxyzzzzz = y. x ■ (x ■ ((x ■ (x ■ (x ■ (y • (z ■ (z ■ (x ■ z))))))) • *)) = y x • (x • ((x • (x ■ ((x • y) ■ z))) -{z-{z-{z- z))))) = y
(4. (4.6)
Odd Exponent Without Identity. We noticed a similarity between (4.2) and (4.5) and conjectured that the following equalities (written without the operator and assuming right association where parentheses are omitted) are single axioms for exponents 7 and 9, respectively. xxx(xxxxyzzzzzz)z = y xxxx{xxxxxyzzzzzzzz)z = y
exponent 7 exponent 9
(4.7) (4.8)
Search for Single Axioms for Exponent Groups
1215
OTTER quickly proved the conjectures. We also verified the obvious general form for odd exponents through 21. We noticed similarities in the O T T E R proofs that (4.2), (4.5), (4.7), and (4.8) are single axioms for exponents 3, 5, 7, and 9, respectively, and proved (by hand) that the general form holds for all odd exponents. We believe that there exists another general form for groups of odd exponent that can be obtained by generalizing (4.3) and (4.6), but we have not yet worked out all the details. Even Exponent Without Identity. We failed to find any new single axioms for groups of exponent 6 or exponent 8, and we have little intuition about general forms for single axioms for even exponents.
4.2
Single Axioms with Identity
Our main reason for seeking single axioms urith the identity for exponent groups is that in the case of ordinary groups, single axioms exist in terms of product and inverse, but no single axioms exist in terms of product, inverse, and identity [6]. We believe also that axioms with identity are more natural and appealing. For exponent 2, we easily found many single axioms with one occurrence of the identity e by considering simple transformations of known single axioms without e. An example is * • ((V • (e • *)) • {x ■ z)) = y,
(4.9)
which is also a single axiom for exponent 2 if (e • z) is replaced with z. We conjectured that an equality without e is a single axiom if and only if the result of inserting one occurrence of e in any position is also a single axiom. However, with the assistance of FINDER, we found counterexamples to both directions of the equivalence. Results for exponent 3 were similar to those for exponent 2. A sample single axiom for exponent 3 is x ■ ((x • ((* • y) • z)) .(e-(z-
z))) = y.
(4.10)
For exponent 4, we had no single axioms without e to use as a starting point, so we turned to brute force. We considered the 1429 associations of xxxxyzzzz = y, and for each of those, the 17 subterms at which an occur rence of e can be inserted. By symmetry we inserted e only to the left of the subterms and had 1429 * 17 = 24293 candidates, each with one occurrence of e. With each candidate, we ran an O T T E R search with a time limit of 30 seconds. (Most searches were terminated in less than 30 seconds by the restrictive search strategy.) One single axiom emerged: x • (Or • ((* • ((e • ((* • y) ■ z)) ■ z)) ■ z)) ■ z) = ». Several of the other candidates derived sufficient properties except for associa tivity, and when we reran those candidates with a greater time limit, nine more
(4.11)
Collected Works of Larry Wos
1216
single axioms emerged. Note that in (4.11), none of the products is applied to two products. All single axioms known to us for exponent 4 have that property. For exponent 6, we considered the set analogous to the exponent 4 candidates and ran O T T E R searches with a subset of those, but we failed to find single axioms. Odd Exponent with Identity. We observed the following relationships be tween (4.3), (4.6), and (4.10). Equalities (4.3) and (4.10) (both exponent 3) are similar except for e, and (4.6) (exponent 5) has a form similar to (4.3) (exponent 3). By analogy, we conjectured that (written without the operator and assuming right association where parentheses are omitted) xx(xx(xy)z)ezzzz = y xxx(xxx(xy)z)ezzzzzz = y
(4.12) (4.13)
are single axioms for exponents 5 and 7, respectively. OTTER proved the required theorems. We then conjectured that the obvious general form holds for all odd exponents. O T T E R has checked the general form for cases through exponent 17 (the first proof for exponent 17 required 23 hours on a SPARCstation 2 and had 181 steps), but we have not yet worked out the details for the general proof. As in the general forms without e, we are attempting to generalize the OTTER proofs for cases 3,5,7, •••,17 with e, but the O T T E R proofs with e are much more complex.
Appendix We present here an O T T E R proof (found in less than 1 second on a SPARCsta tion 2) that (4.3) is strong enough to be a single axiom for groups of exponent 3. Equalities 88, 99, and 104 below are sufficient properties. The justification m — n indicates paramodulation from m into n, and : m,n,- ■■ indicates sim plification with m,n,- •. 6 8 10 13 15 19 23 27 29 31 33 40
z.((x-((*•»)•*))•(*■*)) = » x • (y ■ ((z • z) ■ (z ■ z))) = (x • y) • z
(y • (y • ((v • x) ■ (z ■ z)))) -z = x (x ■ ((x ■ (x •!/)) • z)) -{zz) = y ((x • x) • x) • x = x (x • x) ■ (((x • x) • x) • (x • x)) = x (((x • x) • x) • (x • y)) • (y ■ y)1 = x (x • (z ■ ((z • (z • y)) • (u • u)))) - u =•yx (x • x) • (x • ((x • x) • (x • x))) = x (x ■ y) • (((y • y) ■ (y ■ y)) ■ ({y y){y = x y))) {x ■ (((v • y) • y) • (y • («•«)))) • z =y x (x • (y • z)) • (z • z) = x • y
[(4.3)] [6-6] [6-8] [8-10] [8-10] [15-6] [15—13:15] [13-8] [19-6] [8—23:15] [23—8] [8—33:15]
Search for Single Axioms for Exponent Groups 47 49 61 64 76 80 88 99 104
x • (x ■ (x • y)) = y (x • y) • z = x ■ (y ■ ((z • z) ■ (z • z))) (x • (y • z)) ■ ((«• u) • (u • u)) = x • (y • (z • «)) * • ((i/ • *) • (y • *)) = ! / • y (x ■ y) ■ ((y ■ y) ■ (y • (i/ • y))) = *
(x • x) • (x • x) = x (x-y)z = x-(yz) x-{y-(y-y))=x x ■ (x • x) = y ■ (y • y)
1217 [13:40] [33->27:15,15] [40->40j [47—40] [31:61] [29:64] [49:80] [76:88,47,88] [99-»47]
References 1. W. McCune. Otter 2.0 Users Guide. Tech. Report ANL-90/9, Argonne National Laboratory, Argonne, 111., March 1990. 2. W. McCune. Automated discovery of new axiomatizations of the left group and right group calculi. Preprint MCS-P220-0391, Mathematics and Com puter Science Division, Argonne National Laboratory, Argonne, 111., 1991. 3. W. McCune. Single axioms for groups and Abelian groups with various operations. Preprint MCS-P270-1091, Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, 111., 1991. 4. W. McCune. What's New in Otter 2.2. Tech. Memo ANL/MCS-TM-153, Mathematics and Computer Science Division, Argonne National Labora tory, Argonne, 111., July 1991. 5. W. McCune and L. Wos. Experiments in automated deduction with con densed detachment. Preprint MCS-P237-0491, Mathematics and Com puter Science Division, Argonne National Laboratory, Argonne, 111., 1991. 6. B. H. Neumann. Another single law for groups. Bull. Australian Math. Soc, 23:81-102, 1981. 7. J. Slaney. Finder, finite domain enumerator: Version 1.0 notes and guide. Tech. Report TR-ARP-10/91, Automated Reasoning Project, Australian National University, Canberra, Australia, 1991. 8. L. Wos and W. McCune. Automated theorem proving and logic program ming: A natural symbiosis. Journal of Logic Programming, 11(1): 1-53, July 1991.
T h e Impossibility of t h e Automation of Logical Reasoning 1 Larry
Wos
Mathematics and Computer Science Division Argonne National Laboratory Argonne, Illinois 60439-4801 [email protected] (708) 252-7224
Abstract
Mathematicians and logicians are justly revered for the power of their minds and the depth of their reasoning. Their success in applying logical reasoning to the proof of one significant theorem after another is awe inspiring. And yet, who among these scientists can say precisely how such proofs are found? Therefore, how could anyone have had the audacity to even consider the possibility of automating logical reasoning with the goal of assigning to a computer program the task of proving theorems? Indeed, in 1948 the eminent logician Lukasiewicz asserted that a formalized proof cannot be "discovered mechanically", but can only be "checked mechanically". Given the importance of his research, it would be erroneous to interpret the Lukasiewicz assertion as evidence of naivete or a lack of foresight. Clearly, therefore, the successful automation of proof finding is out of the question—or so it was thought—especially if the theorem under consideration is interesting and deep. Nevertheless, colleagues, we have beaten the odds, done the impossible, automated reasoning so effectively that our programs have even answered open questions. Yet skeptics still exist, funding is not abundant, and recognition of our achievements is inappropriately small and not sufficiently widespread. How might we remedy this situation, and how might we prevent people from taking seriously articles entitled "Computers Still Can't Do Beautiful Mathematics" (New York Times, July 14, 1991, Week in Review)? Perhaps the following sug gestions will provide ammunition for waging the war in which we are obviously engaged, and perhaps my colleagues can use that ammunition to win the war. 'This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted, with permission, from the Proceedings of the Eleventh International Confer ence on Automated Deduction (CADE-11), Lecture Notes in Artificial Intelligence, Vol. 607, ed. D. Kapur, Springer-Verlag, New York, 1992, pp. 1-3.
Impossibility of the Automation of Logical Reasoning
1219
Let me warn you first, however, that these suggestions come from one who lacks a talent for reticence and the avoidance of superlatives. To me, less than the following understates the case: The degree to which we have automated logical reasoning in less than thirty years is marvelous, stunning, and simply beautiful. For example, Boyer and Moore have produced a splendid program that has verified algorithms in use and all of the details for a new hardware/software system. Chou's program is impressive in its ability to prove one geometry theorem after another. McRobbie and Meyer have a program that has answered open questions in nonstandard logics. Bledsoe's programs have obtained marked success in analysis and proved most useful in Gypsy in the context of correctness proofs for software. McCune and I have answered open questions with his powerful program OTTER, deep questions from a variety of fields of mathematics and logic. Of course, given a randomly selected theorem from some mathematics book, the probability is small that an existing automated reasoning program can prove it. However, finally, we can cite numerous examples of being presented with interesting theorems, taken from an unfamiliar area, that were proved on the first try by a program. The point is to think of the glass as one fourth full, not three fourths empty. Given the cited successes and realizing that many others exist, one might wonder why we are insufficiently recognized. The fault, dear Brutus, rests in part with inadequate dissemination of our achievements and in part with too few examples of successes with problems designated by others as "real prob lems" or Grand Challenges. Of course, some of our work is familiar to other computer scientists, but far wider exposure and recognition is needed, requiring a nontrivial expenditure of time and energy. Precisely how might we proceed? Campaign 1, graduate departments in universities: We contact such departments—mathematics and logic are particularly amenable—to dissemi nate our achievements and to accrue appropriate open questions to attack. An obvious mechanism is that of sending letters, papers, and even books. Campaign 2, the Journal of Automated Reasoning: We seek to expand its subscriber list to exceed 1200. Perhaps a chain letter: You subscribe to the Journal and add four names under yours on a circulating list, each of whom must subscribe and supply four additional names. Campaign 3, what are called real applications: We attempt to axiomatize aspects of physics, chemistry, biology, and other sciences and—of greater importance—then demonstrate the ability to solve hard problems in the cor responding fields. Of course, I am not referring to test problems or prototype problems, but, instead, to problems that the world loves to discuss. I recognize that my poor scholarship may have overlooked examples that already exist; if so, please educate me. Do I think that such campaigns will be fun? On the contrary, my estimate of the appeal of these campaigns approximates zero. Nevertheless, by winning these campaigns, we win the war.
1220
Collected Works of Larry Wos
As we fight this latest war, let us keep in mind the many battles we have won, victories over various aspects of the automation of logical reasoning, symbolized by answers to open questions and the verification of complicated algorithms. Of course, more powerful strategies and more effective inference rules are needed, breakthroughs in implementation are crucial, and—to select one major area not attacked often—the capacity to generate large models and counterexamples efficiently is vital. In addition, perhaps powerful metrics can be discovered, met rics for accurately measuring progress and making sharp comparisons between programs, between inference rules, between strategies, and between paradigms. Despite the given needs and many not cited, we have accomplished much. In deed, to us as researchers goes the credit for producing this beautiful edifice, this marvel of computer science, this program that functions as an automated reasoning assistant. We must win the current war and continue to make advances at the current rate, for the importance of automated reasoning to science and to society as a whole cannot be overvalued. In addition, since mathematicians and logicians throughout the world applaud the magic of sitting alone in a room and reading, line by line, a detailed proof of a deep theorem, the field of automated reasoning clearly merits substantial praise, for some of our programs contribute to magic by producing just such an intriguing proof that can be read and fully understood and appreciated. As we did with the goal of the automation of logical reasoning, we can again do the impossible: Through research and effective campaigning, we can correctly gain for our field wide recognition as one of the most significant and astounding advances of civilization. That we have barely begun is clear; that challenges will always exist is preferred; that automated reasoning offers intrigue, excitement, and beauty will continually be true.
The Kernel Strategy and Its Use for the Study of Combinatory Logic* LARRY WOS Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, Illinois 60439, U.S.A., (e-mail [email protected]) (Received: 29 October 1991) Abstract. Barendregt defines combinatory logic as an equational system satis fying the combinators S and K with ((Sx)y)z = (xz)(yz) and (Kx)y = T, the set consisting of S and K provides a basis for all of combinatory logic. Rather than studying all of the logic, logicians often focus on fragments of the logic, sub sets whose basis is obtained by replacing S or A" or both by other combinators. In this article, we present a powerful new strategy, called the kernel strategy, for studying fragments in the context of questions concerned with fixed point properties. Interest in such properties rests in part with their relation to normal forms and paradoxes. We show how the kernel strategy was used to answer a number of open questions, offering abundant evidence that the availability of the kernel strategy marks a singular advance for automated reasoning. In all of our experiments with this strategy applied by an automated reasoning program, the rate of success has been impressively high and the CPU time to obtain the desired information startlingly small. For each fragment we study, we use the kernel strategy to attempt to determine whether the strong or the weak fixed point property holds. Where A is a given fragment with basis B, the strong fixed point property holds for A if and only if there exists a combinator y such that, for all combinators i, yx = x(j/x), where y is expressed purely in terms of elements of B. The weak fixed point property holds for A if and only if for all combinators x there exists a combinator y such that y = xy, where y is ex pressed purely in terms of the elements of B and the combinator x. Because the use of the kernel strategy is so effective in addressing questions focusing on either fixed point property, its formulation marks an important advance for combinatory logic. Perhaps of especial interest to logicians is an infinite class of infinite sets of tightly coupled fixed point combinators (presented here), whose unexpected discovery resulted directly from the application of the strategy by an automated reasoning program. We also offer various open questions for pos sible research and focus on an automated reasoning program and input files that may prove useful for such research.
'This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted from Journal of Automated Reasoning 10 287-343, 1993, with kind permission from Kluwer Academic Publishers.
1222
Collected Works of Larry Wos
Key words. Kernel strategy, combinatory logic.
1
Introduction, Background, and the Type of Question under Consideration
In this article, we show how research that began by focusing on a single question (Question 5 in Section 1.3) from combinatory logic [1, 6] culminated in the formulation of a powerful strategy, the kernel strategy. (We note that much of the material presented here resulted directly from close collaboration with W. McCune and that certain terminology and proofs are his.) Barendregt defines combinatory logic as an equational system satisfying the combinators S and K with ((Sx)y)z = (xz)(yz) and (Kx)y = ar, the set consisting of S and # provides a basis for all of combinatory logic. Rather than studying all of the logic, logicians often focus on fragments of the logic, subsets whose basis is obtained by replacing 5 or K or both by other combinators. When the kernel strategy is applied by an automated reasoning program to the study of various fragments, the results are impressive, including answers to open questions [11, 19] (see the theorems in Section 3). For a measure of the power of the kernel strategy, we note that its use in answering a question in combinatory logic (Question 5, which initiated our study) reduced the CPU time (on a Sun 3 workstation) from 20 CPU-hours to less than 10 CPU-seconds. For evidence of the value of this new strategy to combinatory logic, we note that its use led to the unexpected discovery of an infinite class of infinite sets of tightly coupled fixed point combinators. One naturally wonders whether the type of question we consider is intrinsi cally difficult to answer or, instead, is merely difficult for a reasoning program. The former is the case. Indeed, logicians consider questions focusing on the pos sible construction of fixed point combinators to be deep. Further, from what we know, other than the use of the kernel strategy, no systematic approach exists for attacking such questions. Thus, the strategy marks a satisfying advance for combinatory logic. The formulation of the kernel strategy equally marks a significant advance for automated reasoning. Indeed, from the first intense effort to automate log ical reasoning in the early 1960s, researchers have sought an important field of mathematics or logic or an important class of problem for which an automated reasoning program is useful more than occasionally. Before the formulation and application of the kernel strategy, we were unable to cite such a field or class of problem. Because access to this new strategy corrects this deficiency, the kernel strategy is particularly appealing for automated reasoning. When a question of the type discussed here is submitted to an automated reasoning program ap plying the kernel strategy, the likelihood of success is impressively high and the CPU time required to obtain the desired information startlingly small. Indeed, in the majority of cases we studied, the application of the kernel strategy by the
Kernel Strategy and Combinatory Logic
1223
automated reasoning program OTTER [9] either constructs the desired object in less than 5 CPU-seconds on a SPARCstation 1+ or supplies sufficient data to enable one to prove that the sought-after construction cannot be completed. (In Appendix B, we focus on OTTER in some detail, give the means for obtaining this program, and include appropriate input files for using the program to apply the kernel strategy.) When the problem to be solved is only moderately difficult, the kernel strat egy can even be applied by hand with relative ease. For more complex problems, however, applying the strategy by hand is difficult, in part because of its reliance on unification in the fullest sense (see the first example in Section 2); specifically, a nontrivial substitution of terms for variables often occurs in the two equations under consideration. This reliance on full unification, evidenced in the strategy's use of the inference rule paramodulation [14, 22, 18, 21], may explain why the kernel strategy was formulated by researchers in automated reasoning rather than by researchers in combinatory logic. (The full import of these observations will become clear later in this section and in Section 2; near the end of Sec tion 1.2, we give an example of the use of paramodulation that shows that this inference rule generalizes the usual notion of equality substitution.) So that one can gain insight regarding the power of the kernel strategy, and so that one can experience the nature of the type of question central to this article and of concern to logicians, we give in the next section four sample ques tions for one to attempt to answer unaided. The first question is considered to be easy to answer, the second is somewhat challenging, the third is indeed difficult - it is the question that prompted us to begin our research - and the fourth question is still open. To complement the examples we use to illustrate the various concepts, we include (in Section 3) various theorems that answered diverse open questions, theorems concerning deep aspects of combinatory logic. The results obtained by an automated reasoning program applying the kernel strategy played a vital role in our success in proving these theorems. Included among the combinators we study in this article are those presented in the fol lowing alphabetically organized table (in which Bl and Q are different names for the same combinator), where, consistent with a convention observed in com binatory logic, expressions are assumed to be left associated unless otherwise indicated. Bxyz = x(yz) Bfxyz = y(xz) Cxyz = xzy Hxyz = xyzy Ix = x Kxy = x Lxy = x(yy) Mx = xx M\xy = xxyy
Nxyz = xzyz Ri xyz = y(zx) N\xyz = xyyz Sxyz = xz(yz) Oxy = y(xy) Txy = yx Oixy = y(xy(xy)) Uxy = y{xxy) Qxyz = y{xz) U\xyzv, = u(xx(yz)zu) Qixyz = x(zy) foxyz = z(xx(yx)z) Qixyz = y(xz)(xyxz) Wxy = xyy Rxyz = yzx Wlxy = yxx
Collected Works of Larry Wos
1224
1.1
T H E T Y P E OF QUESTION UNDER CONSIDERATION
Let us begin with the following seven equations, the last two of which focus on properties rather than on specific combinators. We note that the variable y in equation (7) is existentially quantified, while all other occurrences of the variables z, y, and z in the seven equations are universally quantified. (1) (2) (3) (4) (5) (6) (7)
Uxy = y(xxy) Bxyz = x(yz) Wxy = xyy Mx = xx Sxyz = xz{yz) Fx = x(Fx) for all x, exists y such that y = xy
We use lower-case x, y, z, and the like for variables that (usually) implicitly range over the space of combinators, and upper-case italicized letters for the various specific combinators we study. We use bold upper-case letters for various generic constructs; for example, we denote a fragment of combinatory logic by A, the basis for a fragment by B, and a fixed point combinator by F. The first five equations each state how a particular combinator acts on all combinators. The sixth equation defines the strong fixed point property, and the seventh equation the weak fixed point property; we use the kernel strategy to study the possible presence of both the strong and the weak fixed point property for fragments of combinatory logic, subsets in which S or K or both are replaced by other combinators of which the basis of the fragment under consideration consists. We also use the strategy to study the possible presence of the reducible weak fixed point property (introduced in this article in Section 2.1 and introduced earlier in [11] as the kernel property) and note that, in contrast to the fact that the strong implies the weak, the strong does not necessarily imply the reducible weak (see the example given near the end of Section 2.1). In contrast to equation (6) in which the existentially quantified variable F occurs and does not depend on the variable x, the existentially quantified variable y in equation (7) does depend on x. Using all but equation (7), we now pose the promised four questions to permit one to experience the type of question that often concerns logicians and that is central to this article. Later in the article we include the answers to the first three questions; the fourth remains an open and challenging research question. For each question, one can seek an answer by using the type of reasoning found in mathematics or logic, by using paramodulation, or by using instantiation. Regardless of the type of reasoning that is used, one can seek a direct proof or a proof by contradiction. Question 1. Can one use equation (1) and find an expression purely in terms of the combinator [/such that, when F is set equal to the expression, equation (6) holds? Equivalently, can one find a fixed point combinator in which only U
Kernel Strategy and Combinatory Logic
1225
occurs? Question 2. Can one use equations (2), (3), and (4) and find an expression consisting only of occurrences of B, W, and M such that, when F is set equal to the expression, equation (6) holds? In other words, can one find a fixed point combinator using the combinators B, W, and M and no others? Question 3. Can one use equations (2) and (3) and find a fixed point combinator using only B and W such that, when F is set equal to the expression, equation (6) holds? Question 4- Can one use equations (2) and (5) and find a fixed point combinator using only B and S such that, when F is set equal to the expression, equation (6) holds? Of the four given questions, the first two pose no challenge for an automated reasoning program. It suffices to use paramodulation and clauses for the combi nators under consideration and a clause that denies that the strong fixed point property holds. On the other hand, the third question does present a real chal lenge. If the question is attacked with the standard approach, and if success is ever attained, an automated reasoning program can labor for many CPU-hours, even on a SPARCstation 2. We can view the four sample questions as offering an intriguing research topic for automated reasoning: Find, if possible, an approach that enables a reasoning program to answer such questions in acceptable CPU time. That was our objective shortly after we entered the field of combinatory logic. Whether the key would be one of representation, of inference rule, or of strategy was totally unknown to us in the beginning. We did know that, when presented with some chosen fragment, researchers in combinatory logic consider the determination of whether the strong or the weak fixed point property is present to be, in general, a deep and difficult question. We did know that after many CPU-hours, using one of our automated reasoning programs to apply the standard approach (of keying on the denial of the desired conclusion), we had failed to obtain an answer to the third question (of the four given earlier). We also knew that, in the equivalent of 20 CPU-hours on a Sun 3 workstation, we had used an automated reasoning program to answer that question [12], but we were required to make two runs and then compare the results of each to obtain the desired proof by contradiction. For the CPU time to be acceptable, we chose as a target the goal of answering the difficult third question in less than 1 CPU-hour. Thus we began our search for a general approach, the search that culminated in the formulation of the kernel strategy. Before presenting a detailed treatment of the strategy, a discussion • of the source of its power, and some results obtained with its application by an auto mated reasoning program, we turn to some needed background.
1226
1.2
Collected Works of Larry Wos
A BRIEF INTRODUCTION TO COMBINATORY LOGIC
More than sixty years ago, the study of combinatory logic commenced. This logic is concerned with the abstract notion of applying one function to another. Combinatory logic can be viewed as an alternative foundation for mathematics - which was Curry's proposal [4, 5] - or viewed as a programming language. On the one hand, although Curry's original plan of producing a self-contained foundation for all of mathematics and logic was doomed to fail, nevertheless the logic offers the same generality and power as set theory in the sense that essentially all of mathematics can be embedded in it. On the other hand, any computable function can be expressed in combinatory logic, and the logic can be used as an alternative to the Turing machine. In fact, combinators have been used as the basis for the design of computers. Of course, for serious or efficient programming by a person or by a computer, neither combinatory logic nor a Turing machine is a particularly good choice; indeed, were one to program in either language, the experience would at best be tedious and painful. Never theless, some researchers are definitely interested in combinatory logic in the context of programming at a high level of abstraction. Of a sharply different nature is the interest in combinatory logic for its capacity to express paradoxes. Of such paradoxes, perhaps the best known is the Russell Paradox, which asks one to consider the set S whose members are all sets that are not members of themselves. A paradox exists, for if S is a member of itself, then S is not a member of itself, and if S is not a member of itself, then 5 is a member of itself. The Russell Paradox and other paradoxes can be formulated in terms of what are called fixed point combinators (to be defined); indeed, such combinators were known as paradoxical combinators in the early days of combinatory logic. To set the stage for our intense focus on fixed point combinators, let us now turn to some formalism. Barendregt [1] defines combinatory logic as an equational system satisfying the combinators S and A" with ((Sx)y)z = (xz)(yz) and (Kx)y = x for all combi nators x, y, and z. The elements of combinatory logic are combinators. Perhaps unfortunately, as with the concepts of set and number, combinators are not de fined in the manner expected in mathematics; in particular, we cannot supply a statement of the form 'C is a combinator if and only if...'. Instead, as Hindley and Seldin point out [6], one might take the view of a computer scientist and be satisfied with knowing how each combinator acts on other combinators; such actions are given by appropriate equations. The only combinators we study here are called proper. DEFINITION 1 (proper). A combinator is called proper if and only if (1) the left side of its equation is left associated and consists of the combinator followed by some nonempty list of distinct variables and (2) the right side consists of some or all of the variables that occur on the left side. As examples of proper combinators, we have those that are the focus of the
Kernel Strategy and Combinatory Logic
1227
four questions given in Section 1.1, namely, U, B, W, M, and 5. The combinator K, which with 5 plays the key role for combinatory logic, is also proper. An examination of the differences found in the equations of the six proper com binators just mentioned correctly suggests the presence of interesting subsets of combinators, distinguishable by the properties of their corresponding equa tions. For example, one can focus on combinators that are regular (Definition 2, given immediately), that are isolating, and that are replicating (respectively, Definitions 13 and 14 in Section 3.2). DEFINITION 2 (regular). A combinator is called regular if and only if (1) the combinator is proper and (2) the first variable on the right side of its equation appears precisely once and is identical to the first variable occurring on the left side of its equation. Among regular combinators, we have B, W, S, and K. On the other hand, the combinators U and M are not regular. However, as the following remark shows, one can find combinations of regular combinators that act as combinators that are not regular act. Remark 1. As observed, a combinator generally is presented by means of an equation that specifies its actions on other combinators, expressions being left associated unless otherwise indicated. Any given combinator that is proper can be expressed in terms of S and K alone. In other words, the expression in which only S and K occur acts on other combinators in the same way as the given combinator does. Equivalently, for the set of all proper combinators, the set consisting of S and K alone forms a basis. For example, Turing's combinator U as well as the combinators B and W that played such an important role in motivating us to study combinatory logic can be expressed, respectively, as S{K(S{SKK))){S{SKK){SKK)), S{KS)K, and SS(SK). An algorithm exists for using S, K, and / (with Ix = x and acting like SKK) to find expressions of the type just given [16], and indeed to express any proper combinator; however, its use does not produce the particular expression for Wjust cited. Rather than focusing on S and K and on combinations of them that act as some given combinator acts, we focus mainly on proper subsets of combinatory logic called fragments. Indeed, with the objective of determining whether either of two fixed point properties holds, our research concentrates on some subset in which 5 or A" or both are replaced with one or more combinators. We therefore need the following definitions. DEFINITION 3 (strong fixed point property, fixed point combinator). Where B is the basis for some given fragment A, the strong fixed point property holds for A if and only if there exists a combinator y such that, for all combinators x, yx = x(yx), where y is expressed purely in terms of combinators in B. Any y with this property is called a fixed point combinator.
1228
Collected Works of Larry Wos
D E F I N I T I O N 4 (weak fixed point property). Where B is the basis for some given fragment A, the weak fixed point property holds for A if and only if for all combinators x there exists a combinator y such that y = xy, where y is expressed purely in terms of the combinators in B and the combinator x. Perhaps the most striking difference between the two given properties con cerns the nature of the quantification. The expression y, which must exist if one is to show that the weak fixed point property holds, depends on x, therefore, as x varies, y varies. The object that must exist if one is to show that the strong fixed point property holds must not depend on x. As an example of a fragment in which the strong fixed point property holds, let us consider the fragment with basis consisting of the combinator U alone, with Uxy = y(xxy), and the combinator UU; U is Turing's combinator. Using the equation for U, but with x replaced by U and y replaced by x, we have UUx = x(UUx), which is clearly an instance of the equation that occurs in the definition of the strong fixed point property. The combinator UU, which does not depend on the value x as x ranges over various combinators, is thus proved to be a fixed point combinator, and we have answered in the affirmative the first of the four questions posed in Section 1.1. For a second example, we consider the fragment with basis consisting of S and L alone, with Lxy = x(yy), and the combinator SLL. Since SLLx = Lx(Lx) = x(Lx(Lx)) = x(SLLx), we have a proof that SLL is a fixed point combinator and that the fragment under discussion satisfies the strong fixed point property. Of course, the fact that SLL is a fixed point combinator sheds no light on whether the smaller fragment with basis consisting of L alone satisfies the strong fixed point property, for S is not a member of the basis of this smaller fragment, and therefore its use is not permitted. As it turns out, and certainly not obvious, there cannot exist a fragment that satisfies the strong fixed point property but that has a basis consisting of a single regular combinator. That fact was first proved by R. Statman [17] in response to the corresponding question (Question 5 in Section 1.3) posed by R. Smullyan; we include two different proofs in this article, the first ppoof relying on techniques found in automated reasoning (see Theorem 4 in Section 3.2) and that which we found first, and the second relying on the use of Theorems 3 and 5 in Section 3.2. The interest in the strong fixed point property and in fixed point combi nators is not restricted to the formulation of paradoxes. The interest in such combinators also rests in part with the fact that Godel's self-referential sen tence and Kleene's recursion theorem can be interpreted as applications of fixed point combinators [1]. As we have verified, the question of determining whether a given fragment satisfies the strong fixed point property is often extremely difficult to answer. Therefore, because the application of the kernel strategy by a reasoning program often constructs fixed point combinators with ease when the fragment under study offers sufficient power for such a construction - the formulation of this strategy marks an important advance for automated
Kernel Strategy and Combinatory Logic
1229
reasoning. We note that the presence of the strong fixed point property implies the presence of the weak, because if the fixed point combinator F establishes for a fragment A the presence of the former, then Fa: = x(Fx), and we can use Fx as the needed y in the definition of the latter. For an example of a fragment satisfying the weak fixed point property but not the strong, we consider the fragment with basis consisting of L alone and note that, for all x, Lx(Lx) = x(Lx(Lx)), which is of the form y = xy. For an example of a fragment in which even the weak fixed point property fails to hold, we offer the fragment with basis consisting of the combinator S alone. This observation follows as a corollary to Theorem 5 (see Section 3.2), which gives necessary conditions for a fragment to satisfy the strong fixed point property. We thus have mounting evidence for the intricacy and challenge offered by combinatory logic. From the viewpoint of the kernel strategy and for a preview of what is to come, we note that expressions such as Lx(Lx) are of great interest. Indeed, when one or more such expressions, called kernels (Definition 8 in Section 2), are proved to exist, then the fragment satisfies the reducible weak fixed point property. To complete our brief introduction to combinatory logic, we need three ad ditional concepts: reduction, expansion, and extensionality. The first two focus on the type of reasoning often applied in the field, and the third concerns a property that is sometimes assumed to hold. D E F I N I T I O N 5 (reduction). The sequence C0, Cu ■ ■ ■ , Ck is a reduction (relative to the proper combinators Ai, A%, ... , A^) of the expression Cto the expression D if and only if (1) C= Co, (2) C{ is obtained from Ci-\ by applying (in the spirit of equality substitution) the left side of Ai, (3) Ck = D, and (4) the terms that are replaced are each free of variables. We say that Ai reduces Ci-\ to Cj. For an example of a reduction relative to the basis consisting of the combi nators B and W, we have B{WB)BB, WB(BB), B(BB(BB)). One obtains the definition of expansion by merely focusing on the right sides of equations for combinators, rather than on their left sides. Equivalently, a sequence is an expansion if and only if its reverse is a reduction. We note that the application of reduction or expansion is more restrictive than that of demodulation [24], for in demodulation the terms being rewritten can contain variables. The comparison with paramodulation is far more striking, for (in terms of unification) reduction and expansion permit a one-way unifica tion only; indeed, permission to replace variables by terms is given only to the equations from which a substitution is made. In contrast, with paramodulation, one is permitted to make nontrivial replacement of terms for variables in both the from statement and the into statement. For an example of the latitude per mitted in the use of paramodulation - an example showing how this inference rule generalizes the usual notion of equality substitution - we consider the fol-
CoJJected Works of Larry Wos
1230
lowing three clauses and apply paramodulation from the first into the second to yield the third; from the viewpoint of mathematics, paramodulation applied to both the equation x + (-x) = 0 and the equation y + (-y + z) = z yields in a single step the conclusion y + 0 = -(-y). EQUAL(sum(x,minus(x)),0). EQUAL(sum(y,sum(minus(y),z)),z). EQUAL(sum(y,0).minus(minus(y))).
Thus we see more fully why researchers in automated reasoning were the ones who formulated the kernel strategy, for (as will be seen) the strategy relies on the use of paramodulation. Sometimes, in the study of combinatory logic, one wishes to add the following law and then ask whether two objects of interest are unequal even in its presence. DEFINITION 6 (extensionality).FoT all y and for all z, if for all x, yx = zx, then y = z. 1.3
A SUCCESS STORY
The following question was posed by R. Smullyan in the mid-1980s. Question 5. Does there exist a single regular combinator (Definition 2 in Section 1.2) such that the fragment with basis consisting of that combinator and B alone satisfies the strong fixed point property (see Definition 3 in Section 1.2), where Bxyz = x(yz)7 In the preceding section, we cited as examples of regular combinators S, K, L, and B; W is also regular. In contrast, we cited the combinator U as an example of one that is not regular. We immediately see how nicely things are coming together: No single regular combinator is sufficient for constructing a fixed point combinator (Theorem 4 in Section 3.2), U\s not regular, and U is sufficient for constructing a fixed point combinator, namely, UU. In February 1986, Statman [17] answered Smullyan's question by showing that the fragment with basis consisting of B and W alone satisfies the strong fixed point property (see Section 2.3), where Wxy = xyy, thus the third of the four questions posed in Section 1.1 is answered in the affirmative. Learning of Statman's success, and prior to the formulation of the kernel strategy, we used an automated reasoning program to study Smullyan's question. In the equivalent of 20 CPU-hours on a Sun 3 workstation, we found Statman's combinator. However, unexpectedly, we also found four additional fixed point combinators constructible from B and W alone [12]. As we learned by corresponding with Smullyan [15], we had made an interesting contribution to combinatory logic. To have used an automated reasoning program to make a contribution to such a deep field was clearly most satisfying. On the other hand, we were not
Kernel Strategy and Combinatory Logic
1231
so pleased with the fact that more than 20 CPU-hours was required. Further, we were somewhat disappointed that we were forced to make two runs and compare their results in search of a proof by contradiction. Therefore, spurred by the desire to find a general approach to sharply reduce the required CPU time and prompted by our discovery of four unexpected combinators, each of which answers Smullyan's original question (Question 5), we embarked on the research that culminated in the formulation and application of the kernel strategy. With the use of this strategy, we revisited the fragment with basis consist ing of B and W alone. In contrast to the 20 CPU-hours required in our first successful attack on the question, one of our automated reasoning programs ap plying the kernel strategy found the already-cited five fixed point combinators (constructible from B and W alone) in less than 10 CPU-seconds. Far more im pressive, the continued use of the strategy next resulted in the discovery of an infinite set of such combinators, no two of which are equal even if one assumes the presence of extensionality (Definition 6 in Section 1.2), which asserts that two combinators are equal if they act the same on all combinators. Still later, the use of the kernel strategy led to the discovery of an infinite class of infinite sets of fixed point combinators constructible from B and W alone. In Section 2.3, we shall present the five fixed point combinators we first found without the use of the kernel strategy, and then present the infinite class of infinite sets of such combinators in Section 3. In addition to serving well for the study of questions concerned with the possible presence of the strong fixed point property for a given fragment, the kernel strategy is also effective for the study of questions concerned with the possible presence of the weak fixed point property (Definition 4 in Section 1.2) and of the reducible weak fixed point property (Definition 7 in Section 2.1).
2
The Kernel Strategy
The kernel strategy is a two-stage strategy that, when presented with any cho sen fragment A with basis B, seeks to establish the presence of either of two fixed point properties for A. In its first stage, the strategy seeks to establish the presence of the reducible weak fixed point property, a property that implies the weak fixed point property. Noting that we shortly give the formal and compli cated definition of this property (Definition 7), we are content here with viewing the property as requiring that, for all x, there exist a y that reduces to xy (see Definition 5 in Section 1.2). If the first stage succeeds, the second stage of the kernel strategy seeks to extend the results of the first stage to establish the presence of the strong fixed point property. In each stage, with the objective of completing a proof by contradiction, the strategy keys on the elements of the basis B of the chosen fragment. The kernel strategy is sound in the sense that, if the first stage succeeds, then the fragment A is guaranteed to satisfy the reducible weak fixed point property
1232
Collected Works of Larry Wos
and, if the second stage succeeds, A is guaranteed to satisfy the strong fixed point property. Regarding its fixed point completeness - the guarantee of always constructing at least one fixed point combinator when given a fragment that satisfies the strong fixed point property - in Section 4, we discuss fragments that satisfy the strong fixed point property but for which the strategy is of no use. As part of that discussion, we offer as a research topic a conjecture concerning conditions under which the kernel strategy is fixed point complete and suggest, as a second topic, the possibility of extending the strategy to cope with the given exceptions. Even when the strategy fails to yield the desired expression or object, an analysis of what has been obtained with it often contains the key to proving (if it is the case) that the fragment fails to satisfy one or both of the fixed point properties. In each stage of the kernel strategy, paramodulation is the inference rule, with the substitution always occurring from the right side of an equation for an element of the basis B of the fragment under study. In other words, all from clauses for paramodulation correspond to elements of B. In the first stage, the substitution is always into the right side of a negative equality that is itself the denial that the weak fixed point property holds or is a descendant of that neg ative equality. (We are forced to focus on the weak fixed point property, rather than its stronger version that requires reducibility, for that added property does not naturally map into a first-order representation.) If the first stage succeeds, then one can conclude from an examination of the run that the reducible weak fixed point property holds. In the second stage, contrary to expectation, the focus is not on the denial that the strong fixed point property holds nor on descendants of the correspond ing negative equality. Instead, all substitutions are either into the first argument of a positive unit clause of the form FIXED(s,t) for terms s and t, or the sub stitutions are into descendants of such a clause; the clause FlXED(s,t), which can be read as 's is a fixed point of V, is in effect obtained from a successful use of stage 1. As we illustrate shortly, we do include a negative unit clause of the appropriate form to enable the program to 'know' when and if success has been obtained in the second stage. Strictly speaking, the use of the kernel strategy does not require the use of the clause language nor the use of paramodulation; however, as we immediately illustrate, each contributes importantly to the ease and effectiveness of using the strategy. Nor is the use of an automated reasoning program a requirement; how ever, certain programs, including OTTER, offer features that mesh well with the elements of the kernel strategy (see Appendix B for appropriate input files and a discussion of OTTER). Indeed, the strategy can be applied by hand, especially when the question under consideration can be answered in the affirmative by finding an appropriate expression containing six or fewer symbols. To prepare the way for the formal basis and a fuller understanding of the kernel strategy, we focus on the fragment with basis consisting of L and S alone. The questions to answer concern the possible presence, for the given fragment,
Kernel Strategy and Combinatory Logic
1233
of the reducible weak fixed point property and the strong fixed point property. The stages are applied separately. For the first stage, we use the following four clauses to capture, respectively, that x = x, Lxy = x(yy), Sxyz = xz(yz), and the assumption that the weak fixed point property fails to hold. (For those unfamiliar with the use of the clause language, we note that the fourth of the following clauses is obtained by taking the statement 'there exists an isuch that for all y y j= xy\ which comes from the cited assumption, and introducing a Skolem constant / i n place of the existentially quantified variable.) The clauses rely on the use of '-' for logical not, ' | ' for logical or, the function a that is implicitly present in combinatory logic to mean that one combinator is 'applied' to another, and the ANSWER literal to present the results of any successes. EQUAL(x,x). EQUAL(a(a(L,x),y),a(x,a(y,y))). EqUAL(a(a(a(S,x),y),z),a(a(x,z),a(y,z))). -EQUAL(y,a(f,y)) I $ANSWER(y). Consistent with the property that a variable is relevant only to the clause in which it occurs, the use of paramodulation from the right side of the second clause into the right side of the equality literal of the fourth yields the following clause. -EQUAL(a(y,y),a(a(L,f).y))
I
$ANSWER(a(y,y)).
We temporarily ignore the argument of the ANSWER literal, being concerned only when and if a proof by contradiction has been completed. Therefore, if viewed from the perspective of combinatory logic, the preceding clause says 'yy / Lfy\ where / i s a constant introduced by assuming that the weak fixed point property does not hold. Consideration of the preceding clause and the first clause (reflexivity) immediately completes a proof by contradiction, instantiating y to a(L,f). We thus have proved that the weak fixed point property holds for the fragment A. As for the reducible weak fixed point property, which is the object of stage 1 of the kernel strategy, now the ANSWER literal $ANSWER(a(L,f),a(L,f)) comes into play. Noting that its argument can be read as Lf(Lf) and that /was introduced (when we assumed that the weak fixed point property fails to hold) in place of the variable x, we see that setting y equal to Lx{Lx) completes a proof that the weak fixed point property holds for A. That the reducible weak fixed point property holds can be seen by noting precisely how L can be used and by noting that we permit the use of a generalization of reduction (as defined with Definition 5 in Section 2.1). Indeed, if we call Lx{Lx) K, we see that K is expressible solely in terms of the variable x and elements of the basis B of the fragment under study and that K reduces to xK with a single use of the equation for L, if we permit reductions to replace terms in which variables occur. As the notation correctly suggests, K is a kernel of the fragment A (see Definition 8 in Section 2.1).
Collected Works of Larry Wos
1234
With regard to illustrating the use of the second stage of the kernel strategy, we use the following clauses, the fourth of which can be read as 'for all x, Lx(Lx) is a fixed point of X*, and the fifth can be read as denying that 'there exists y such that for all x, yx is a fixed point of x'. EQUAL(x,x). EQUAL(a(a(L,x),y),a(x,a(y,y))). EQUAL(a(a(a(S,x),y),z),a(a(x,z),a(y,z))). FIXED(a(a(L,x),a(L,x)),x). -FIXED(a(y,g(y)),g(y)) I $ANSWER(y). The use of paramodulation from the right side of the third clause into the first argument of the fourth clause yields a sixth clause. FIXED(a(a(a(S,L),L),x),x). Consideration of the fifth and sixth clauses completes a proof by contradiction, instantiating the argument of the ANSWER literal to a term corresponding to SLL. If we denote SLL by F, an analysis of the proof just completed shows that Fx = K and that x(Fx) = xK. But the proof obtained by applying the first stage of the kernel strategy establishes that K = xK. Therefore, Fx = x(Fx), and we have proved that A satisfies the strong fixed point property and that SLL is a fixed point combinator. Before we turn to the formal basis for the kernel strategy, we amplify certain comments made earlier concerning the differences in reasoning found in combinatory logic and found in automated reasoning. We also provide a glimpse of a possible explanation for the formulation of this strategy by researchers in automated reasoning. The key is found by closely observing what occurs in the preceding illustration of applying the first stage of the kernel strategy. In partic ular, when paramodulation is used, unification in its fullest is required; indeed, a nontrivial replacement of terms for variables occurs in both the from positive equality and the into negative equality. For the unification, the term / replaces the variable x in the equation for L, and the term O(J/,J/) replaces the variable y in the denial that the weak fixed point property holds. In contrast, the use of both reduction and expansion in combinatory logic is each more restrictive than demodulation, not even allowing the into term to contain variables. As seen ear lier in this section, we employ a generalization of reduction, one that does allow the into term to contain variables, but still prohibits those variables from being replaced; in other words, the generalization mirrors the spirit of demodulation. Keeping in mind the given illustration of applying the first and the second stage of the kernel strategy, we can now turn to its formal basis, following that section with additional and more complex illustrations.
Kernel Strategy and Combinatory Logic
2.1
1235
T H E F O R M A L BASIS O F T H E K E R N E L S T R A T E G Y
To see in greater detail how our research resulted in the adaptation of various elements of automated reasoning to the study of fixed point properties in combi natory logic, we now present the formal basis of the kernel strategy. As already seen in the preceding section, for example when we used generalized reduction, we extended a basic concept of combinatory logic in a manner reminiscent of de modulation. In particular, where reduction as used in combinatory logic requires that the terms being rewritten be free of variables, both generalized reduction and demodulation relax the requirement to permit such terms to contain vari ables as long as no instantiation takes place in the terms. (Throughout this section and the remainder of this article, we make no distinction between re duction and generalized reduction.) As we shall soon see, a far more interesting example of adapting automated reasoning for the study of combinatory logic is provided by the concept of kernel. We begin our presentation of the formal basis of the kernel strategy with a closer scrutiny of the weak fixed point prop erty, which will lead us to the first new concept, the reducible weak fixed point property. When the weak fixed point property holds for the fragment A with basis B, for each x there must exist a y such that y = xy, where y is expressed solely in terms of the elements of B and the variable x. The presence of the weak fixed point property implies the existence of a set of ordered pairs Bi,Ai such that Bi = A{Bi and such that each Bi is expressible solely in terms of elements of B and the corresponding Ai. No restriction exists regarding a tight coupling of all of the corresponding Bi, nor is any restriction placed on the type of step that can be used in a proof that Bi = A^Bi or, more generally, that y = xy. In contrast, to satisfy the reducible weak fixed point property, two additional requirements must be met: one regarding a tight coupling, and one regarding the type of step to be used in the desired proof. To set the stage for the appropriate formal definition and to clarify the distinction between these two weak fixed point properties, let us consider the fragment with basis consisting of L and M alone, where Lxy = x(yy) and Mx = xx. Assume that, as x ranges over the terms expressible with combinators, we have an ordering Asubl, Asubl, ... and that for odd i, Bsubi has the form LAsubi(LAsubi) and for even t, Bsubi has the form M(LAsubi). To see that the weak fixed point property holds for the fragment under discussion - that, for all x, there exists a y such that y = xy - we consider two cases, i odd and i even. For odd i, we note that Bi reduces to AiB, with a single application of the equation for L (in the spirit of demodulation), giving LAi(LAi) = Ai{LAi(LAi)). For even i, an application to Bi of the left side of the equation for M followed by an application of the left side of the equation for L followed by an application of the right side of the equation for M yields Bt = M(LAi) = LAi{LAi) = Ai(LMLAi)) = Ai(M(LAi)) = AfBt. As for the reducible weak fixed point property (Definition 7, given almost
1236
Collected Works of Larry Was
immediately), in contrast to the weak fixed point property, the given Bsubi lack two key properties, one regarding their coupling, and one regarding reducibility. First, for j different from i, one cannot obtain B3 from Bi by merely replacing the appropriate occurrences of Ai by those of A;. We can remedy this flaw by forcing B3 for even j to follow the pattern of B; for odd i. In other words, we can have all Bi tightly coupled (in the manner consistent with the definition we give of the reducible weak fixed point property) by requiring them all to be the appropriate instances of Lx(Lx). Second, by imposing this condition, we correct the lack of reducibility for B5, with j even, and also satisfy the final condition of the definition we now give; indeed, Lx(Lx) reduces to x(Lx(Lx)). DEFINITION 7 (reducible weak fixed point property). The fragment A with basis B satisfies the reducible weak fixed point property if and only if (1) for all x there exists y with y xy, (2) as x ranges over all terms A1,A2,... expressible with combinators, all corresponding Bi with Bi = AiB2 are identical except for the appropriate replacement of Ai by A3, and (3) there must exist a proof showing that y reduces to xy in which each deduced step can be obtained from the preceding step by applying a reduction corresponding to an element of B. Remark 2. We note that the property of reducibility is outside first-order predicate calculus, at least if treated in a straightforward manner. Hence, even though the first stage of the kernel strategy aims at finding kernels, we do not focus on a clause that denies that the reducible weak fixed point property holds, but instead must be content to focus on denying that the weak fixed point property holds; however, if we are successful, we prove the stronger property because of the restriction on paramodulation. In particular , as noted , in the first stage of the kernel strategy, paramodulation is restricted to be from the right sides of combinators and into terms in the right side of some negative equality. Adherence to the first of the two restrictions guarantees that any expression found in the ANSWER literal at the completion of a proof satisfies the reducibility requirement of the definition of the reducible weak fixed point property, and, more important, so does the expression obtained by replacing the Soklem constant f by the variable x. Indeed, although the use of paramodulation may require a nontrivial substitution for variables in both the from and into expressions, the desired expression (a kernel) extracted from the completed proof can be appropriately reduced (in the spirit of demodulation) by applying in reverse order the steps used to construct it. We also note that, in the context of the preceding definition, we do not consider, for example, MB and BB to be the same term (for they are not identical) despite the fact that they are obviously equal. Clearly, for any given fragment, the presence of the reducible weak fixed point property implies the presence of the weak fixed point property. On the other hand, the following example strongly suggests that the former is a strictly stronger property than the latter; we say `suggests' because we have not yet completed (in full detail) the required proof. (The example we now give was found
Kernel Strategy and Combinatory Logic
1237
directly because of a contribution by A. Piperno [13]; we discuss his contribution more fully in Section 4.) Let U2 be the combinator with U2xyz = z(xx(yx)z) and M1 be the combinator with Mlxy = xxyy. Then let F = U2U2(M1M1). From the following, we see that F is a fixed point combinator. By reducing with U2, Fx = x(U2U2(M1M1U2)x). Then, x(Fx) = x(x(U2U2(M1M1U2)x)) = x(x(U2U2(M1M1U2U2)x)), by reducing with M1, = x(U2U2(M1M1U2)x) by ap-
plying the right side of U2. Therefore, the fragment A with basis consisting of U2 and Ml alone satisfies the strong fixed point property, and hence satisfies the weak fixed point property. However, it appears (almost certain) that A does not satisfy the reducible weak fixed point property. Equivalently, it appears that no kernels (Definition 8, given shortly) of A exist. By focusing on the fragment with basis B consisting of the combinators B and W alone and on their respective equations (2 and 3 in Section 1.1), we can easily show the significance of the second and third conditions of the preceding definition and, hence, the fact that satisfying the reducible weak fixed point property is (apparently) stronger than satisfying the weak fixed point property. Merely for illustration, let us choose from among the values that x ranges over in the equation y = xy the combinators L, M, S, and U. Consider the following four candidate values for y that might be used in y = xy. (A) W(BL)(W(BL)), (B) BWBM(W(BM)), (C) W(BS)(BWBS), and (D) BWBU(BWBU). With the exception of the expression given in (B), one can use the other three with the equations for B and W in the spirit of reduction (or demodulation) to obtain an instance of the equation y = xy. As for (B), one can use it also to obtain an instance of the weak fixed point equation, but one must add a step that corresponds to applying the right side of the equation for B, a step that is not a reduction. In other words, judging by the use of (A) through (D), the fragment with basis B consisting of B and W alone is on its way to satisfying the weak fixed point property. On the other hand, in the context of the stronger reducible weak fixed point property, (A) through (D) give us problems, for (B) violates the third requirement of the definition and no two of (A) through (D) satisfy the second requirement. Nevertheless, in regard to the first stage of the kernel strategy, the first and fourth expressions are far from useless . Indeed, either (A) or (D), if generalized, serves us well. (We shall see in the next section that, from the perspective of the kernel strategy, (C) is of less interest , for the generalization of (C) will not be obtained with the first stage of the strategy as we typically apply it.) In particular, if we use the equations for B and W as reduction rules (equally, as demodulators) and consider the set of instances either of W(Bx)(W(Bx)) or of BWBx(BWBx) as x ranges over all combinators, we have a proof that the fragment A under discussion satisfies the reducible weak fixed point property. From a syntactic perspective, the following discussion and definitions show that the generalization of (A), (C), and (D) each produces a kernel, where the kernel is obtained by replacing L, S, and U, respectively, by x. From a semantic perspective (see Definition 9 given shortly), the three kernels obtained from
1238
Collected Works of Larry Wos
the respective generalizations of (A), (C), and (D) are the respective sets of instances as x ranges over all terms expressible with combinators. When kernels are viewed from the semantic perspective, we shall see that condition (2) of the definition of the reducible weak fixed point property comes into play heavily. As for condition (3), with, for example, regard to the generalization of (D), we say that the kernel K reduces to aK, where K = BWBx(BWBx,). In particular, we relax the requirement that the terms being reduced or demodulated (with the use of the equations for B and W) be free of variables. D E F I N I T I O N 8 (kernel, syntactic,). / / the expression K consisting of occur rences of a set B of combinators and occurrences of the variable x is such that K reduces to xK (with the elements of B), then K is a kernel and, more precisely, a kernel of the fragment A whose basis is B. The existence of a kernel K for the fragment A establishes the presence of the reducible weak fixed point property for A. Alternatively, when the reducible weak fixed point property is satisfied by the fragment A with basis B, there must exist (because of the second and third requirements taken together) at least one equation of the form K = xK such that K reduces to xK (with the elements of B) and such that K is expressed solely in terms of elements from B and the variable x. We call K a kernel of the fragment A, or simply a kernel. For the following semantic definition of kernel, one might think of the Kx as the Bt of the reducible weak fixed point property. D E F I N I T I O N 9 (kernel, semantic). A kernel is the full set K of combinators Kx such that (1) all Ki share in location and occurrence a finite set B of com binators, (2) in all other locations in Ki one particular identifying combinator Ai occurs, (3) for j different from i, the identifying Aj is different from the cor responding Ai, and (4) for each t, Ki reduces to AiKi by using the equations for the elements of B. When the four conditions are satisfied, we say that K is a kernel of the fragment A whose basis is B. The existence of a kernel K for the fragment A establishes the presence of the reducible fixed point property for A. Alternatively, when the reducible weak fixed point property holds for the fragment A with basis B and when E of the form y = xy is an equation that establishes the property to be satisfied by A, then a kernel K of A consists of the set of combinators that is obtained from E by taking all instances of the left side of E as the variable x ranges over all terms expressible with combinators. D E F I N I T I O N 10 (superkernel). Syntactically, the expression S is a superkernel of A with basis B if and only if (1) S is a kernel of A and (2) the only reduction with an element of B that applies to S involves the first symbol in S. Semantically, the set S is a superkernel of A if and only if (1) S is a kernel of A and (2) exactly one reduction applies to each of the elements of S and that reduction involves the first symbol. For example, the kernel W(Bx)(W(Bx)) is a superkernel; but the kernel
Kernel Strategy and Combinatory Logic
1239
BWBx(BWBx) is not a superkernel, for it admits a reduction with B that does not involve its first symbol. As we have seen, certain fragments have more than one kernel. For example, the fragment with basis consisting of B and W alone offers great richness, for (as we show in Section 3.1) one can find an infinite number of kernels for it. (As expected, noting that any kernel K reduces to xK reduces to x(xK) ad infinitum, we count only the earliest element K in such a sequence, ignoring the other elements.) In contrast, it seems almost certain that the fragment with basis consisting of L alone has only one kernel, namely, Lx(Lx). Noting that the search for kernels is precisely the objective of stage 1 of the two-stage kernel strategy, we now turn to some additional examples to illustrate its use. 2.2
ADDITIONAL EXAMPLES OF APPLYING STAGE 1 OF THE KERNEL STRATEGY
For our first example in this section, we focus on the fragment with basis L alone and revisit and amplify some of our earlier discussion. Our goal is to find at least one kernel and thus prove that the fragment satisfies the reducible weak fixed point property. However, as observed, reducibility cannot be studied directly in first-order predicate calculus; hence, without recourse to, say, Godel's finite axiomatization of set theory [2, 18], we cannot directly address our objective with the use of clauses. Instead, therefore, we assign to the automated reasoning program the specific task of proving that the weak fixed point property holds, using constraints on the program's attack so that, if it succeeds, we establish the presence of the reducible weak fixed point property. As is our usual practice, we assume that the weak fixed point property fails to hold, and we use as the only clause in the set of support [23, 18, 21] the following. -EQUAL(y,a(f,y))
I $ANSWER(y).
As already observed, or is denoted by ' | ', not by '-', and the function a, which is present implicitly in combinatory logic to indicate that one combinator is 'applied' to another, is used. The constant / is chosen for mnemonic reasons, because our larger goal is to use the results of stage 1 (if any) to then study in stage 2 the possible presence of the strong fixed point property by seeking an appropriate combinator F. We include as part of the denial clause a literal whose predicate is SANSWER, for we intend to capture and present any kernels that are constructed in stage 1 to then be used in stage 2. For the remaining clauses, none of which are placed in the set of support, we use one for reflexivity of equality (because we are using paramodulation as the inference rule) and add clauses for the elements of the basis of the fragment under study. In the example under discussion, we have the following two clauses. EQUAL(x,x). EQUAL(a(a(L,x),y),a(x,a(y,y))).
Collected Works of Larry Wos
1240
To prevent their interaction, we place none of the equations for basis elements in the set of support, for stage 1 of the kernel strategy is concerned exclusively with applying the right side of a basis equation to a negative equality. This concern is reflected in one of our actions regarding the use of strategy, namely, that of blocking paramodulation from the left side of any equation; for some insight into the reasons for applying this restriction, see Remark 2 in Section 2.1. We further restrict paramodulation by requiring that all into terms be in the right side (second argument) of some negative equality. These two restrictions are motivated by the objective of finding a kernel K that reduces to xK. Finally, as part of our strategy, we typically prevent paramodulation from focusing on an into term that is a variable. This restriction, coupled with our usual avoidance of the clause that corresponds to the functional reflexive axiom a(x,y) = a(x,y), accounts for stage 1 missing certain kernels, such as the generalization of (C) (see Section 2.1), namely, W{Bx){BWBx). In general, missing such kernels ordinarily does not prevent one from proving that the reducible weak fixed point property holds, when such is the case, and seldom causes one to overlook any fixed point combinators constructible from the basis in use. We say 'seldom' because even this kernel can be put to use in the context of the strong fixed point property by first letting Q2 be the combinator such that Qzxyz = y(xz)(xyxz), second considering the combinator Q%BW, and third noting that Q2BW is &fixedpoint combinator. Given the preceding description regarding the first stage of the kernel strat egy, we can quickly apply it to the fragment whose basis consists of L alone. A single paramodulation step from the right side of the equation for L into the right side of the negative clause that denies the presence of the weak fixed point property yields the following clause. -EQUAL(a(x,x),a(a(L,f),x))
I
$ANSWER(a(x,x)).
When this clause is considered with that for reflexivity, a proof by contradiction is completed, and the argument of the ANSWER literal of the resulting clause is the expression a(a(L,f),a{L,f)). The constant /, in the clause that asserts that the weak fixed point property fails to hold, corresponds to the (universally quantified) variable x. We thus have a proof that a kernel has been found, namely, Lx{Lx). Hence, we have succeeded in showing that the reducible weak fixed point property holds for the fragment whose basis is L alone, and also holds for any fragment whose basis contains L, because one is not required for any of the fixed point properties to use all of the elements of the basis of the fragment under study. In this simple example, an analysis of the single paramodulation step shows that a nontrivial substitution for variables occurs in both the from argument and the into term. In other words, from the viewpoint of automated reasoning, demodulation from the right side of the equation for L would not have sufficed, and, from the viewpoint of combinatory logic, the use of expansion would not have sufficed even if generalized. We recall that expansion is the reverse of
Kernel Strategy and Combinatory Logic
1241
reduction, requiring the reasoning to be from the right sides of equations for combinators such that the terms being replaced are free of variables. As with generalizing reduction, we generalize expansion by removing the requirement that the terms being replaced be free of variables, but adding the requirement that they remain unchanged. Let us now turn to a slightly more complex example of applying stage 1 of the kernel strategy. We consider the fragment with basis consisting of B and W alone. The study of this fragment, prompted (as we observed) by the knowledge that Statman had used it to answer a question (Question 5 in Section 1.3) posed by Smullyan, actually led to our formulation of the kernel strategy. By replacing the clause in which L occurs in the preceding example by the following two clauses, the program OTTER finds more than twenty-five kernels in less than 2 CPU-seconds on a SPARCstation 1+. EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). EQUAL(a(a(W,x),y),a(a(x,y),y)). (Throughout this article, expressions of the form G G G are often referred to as the cube of G.) Of the kernels found by OTTER applying the first stage of the kernel strategy, the following turn out to be especially interesting: W{Bx)(W(Bx)), BWBx(BWBx), the cube of W{B{Bx)), the cube of W(BBBx), the cube of BWB{Bx), the cube of BW(BBB)x, and the cube of B(BWB)Bx. Let us call the last five kernels, respectively, Ki(B, W) through Ks(B, W). (Actually, rather than the last five kernels just given, the program instead finds five kernel schemata, defined near the end of Section 2.3, each of the form GGj/ rather than of the form GGG.) In the next section, we make use of all seven kernels, showing that the last five are connected in a beautiful way, the beauty resting in part with their relation to each other, in part with their relation to five fixed point combinators, and in part with the structure they correctly suggest exists for the fragment whose basis consists of B and W alone. Finding any one of these kernels is sufficient to prove that the fragment under discussion satisfies the reducible weak fixed point property. We also see how much richer this fragment is than that with basis consisting of L alone. Moreover, in contrast to the fact that the latter fragment fails to satisfy the strong fixed point property, we show in the next section that the former fragment satisfies it abundantly. In particular, from B and W alone, one can construct an infinite class of infinite sets of fixed point combinators, each set exhibiting an unexpected recursive property. Further, even if one assumes extensionality to be present, the fragment offers enough power to permit construction of an infinite set such that no two of its members are equal. With two final observations concerning the cited kernels, we are ready to ap ply the second stage of the kernel strategy. First, the kernel BWBx{BWBx) was guaranteed to exist once the kernel Lx(Lx) was found. The proof follows from the fact that the combinator BWB acts on other combinators precisely as the combinator L does, namely, BWBxy = x(yy). In other words, when extension-
Collected Works of Larry Wos
1242
ality is assumed, L — BWB. Second, had one found the kernel BWBx(BWBx) directly because of finding the kernel Lx(Lx), one might, as a consequence, have been quickly led to the discovery of the kernel W(Bx)( W{Bx)) merely by apply ing two reductions with the combinator B or by applying one global reduction with B (in the spirit of hyperparamodulation [20, 18]). 2.3
ADDITIONAL EXAMPLES OF APPLYING STAGE 2 OF THE KERNEL STRATEGY
Stage 2 of the kernel strategy attempts to use the kernels found in stage 1 to establish that the strong fixed point property holds for the fragment under study. As in stage 1, paramodulation is used, reasoning from the right sides of the various equations corresponding to the basis elements of the fragment. However, rather than paramodulating into the right side of negative equalities (as in stage 1), in stage 2 the into terms are contained in the left side of positive clauses, clauses whose first argument is a kernel found in stage 1. Kernels are considered one at a time. Our focus on a clause whose first argument is a kernel provides an unexpected move; in the typical approach taken in automated reasoning, the focus would be on the denial that the strong fixed point property holds. Of course, we could instead choose a variant of the typical approach by relying on the fact that K = xK for the kernel K in use, but such a choice is far less effective than applying the second stage of the kernel strategy. The second stage dictates the use of a clause of the following type. FIXED(a(a(W,a(B,x)),a(W,a(B,x))),x). The first argument of FIXED in the preceding clause is obtained by choosing the first of the seven kernels (found in the preceding section) in our study of B and W. The clause can be read as saying, ' W(Bx)( W(Bx)) is a fixed point of x\ To enable the program to detect the completion of a proof by contradiction, we then include the following clause. -FIXED(a(z,g(z)),g(z)) I $AMSWER(z). The clause can be obtained by denying that 'there exists a combinator F such that, for all x, Fx is a fixed point of x'. The form of the clause relies on the occurs check to block the completion of proofs that do not correspond to constructing a fixed point combinator - in particular, to avoid the following. If one applies stage 2 to the consideration of the kernel schema GGy (which stage 1 can find) with G = W(B(Bx)), one would use the following clause. FIXED(a(a(a(W,a(B,a(B,x))),a(V,a(B,a(B,x)))),y),x). When this clause is considered with the negative clause just given (in the context of completing a proof), the presence of the second occurrence of the term g(z)
Kernel Strategy
and Combin&tory
Logic
1243
leads to the discovery of an occurs check, which in turn prevents the program from mistakenly concluding that GGy is a fixed point combinator. (We note that, in the original formulation of the kernel strategy [19], we were forced to discard by hand such unwanted proofs; we thank A. Bundy for his comments [3] that eventually led to the improved approach given in this article.) When and if a proof by contradiction is completed, stage 2 has constructed a fixed point combinator, which is found as the argument of the ANSWER literal. By setting the appropriate parameter to instruct O T T E R to continue finding proofs as long as CPU and memory remain, stage 2 can, at least in principle, construct more than one fixed point combinator from a single kernel. Often, however, the structure of the fragment under study does not admit such to occur when we add the restriction that reducible combinators are to be discarded. In other words, in almost all cases we are interested in a fixed point combinator if and only if the combinator is irreducible modulo the set of basis elements, meaning that (in the spirit of reduction or, equivalently, demodulation) none of the basis elements can be applied. For example, if one studies the fragment with basis consisting of M and U alone, one finds the fixed point combinator UU and also finds MU. But the latter reduces to UU (since Mx = xx) and is, therefore, uninteresting regardless of whether extensionality is present. On the other hand, occasionally we are forced to accept reducible fixed point combinators because no irreducible fixed point combinators exist for the fragment under study; for example, the consideration of 0(LO{LO)) with Oxy = y[xy) establishes that the fragment with basis consisting of L and O alone satisfies the strong fixed point property, but this combinator (as well as others one might suggest for this fragment) is reducible. For our first example of applying stage 2, let us consider the fragment A with basis consisting of B, W, and M. If we let K be the kernel W(Bx)( W(Bx)) and apply the second stage of the kernel strategy to K, with three paramodulation steps from the right sides of the equations for M, B, and B, respectively, we obtain B(BMW)Bx, which we write as Fx. Thus, F x = K and x(Fx) = xK. But, since K is a kernel, K reduces to xK, and therefore K = xK. Therefore, F x = x(Fx), proving that F is a fixed point combinator. Since F is expressed purely in terms of B, W, and M, the fragment A under study must satisfy the strong fixed point property, which answers in the affirmative the second of the four questions posed in Section 1.1. If we now switch our attention to the kernel K / = BWBx(BWBx) and apply stage 2 of the kernel strategy by using the equation for M followed by the use of that for B, we obtain BM(BWB)x, which we write as F/x. By an argument similar to the preceding, we see that F / is a fixed point combinator, and we have a second proof that the fragment A satisfies the strong fixed point property. Since K/ reduces to K, we also have a proof that, for all x, F/x = Fx. Therefore, in the presence of extensionality, the two fixed point combinators F / and F (found with the kernel strategy) are equal. On the other hand, if extensionality is absent, then the two fixed point combinators are not equal, which adds to the
1244
Collected Works of Larry Wos
growing intrigue of using the kernel strategy, for the kernels K and K/ are equal regardless of extensionality. In addition, since BWB acts on other combinators as L does, we have a proof that the fragment with basis consisting of B, M, and L satisfies the strong fixed point property, for the existence of the fixed point combinator BM(BWB) proves that BML is also a fixed point combinator. From the perspective of the kernel strategy, one can use stage 2 to move quickly from the kernel Lx{Lx) to the fixed point combinator BML. For our next example of the use of stage 2 of the kernel strategy, we turn to the fragment A whose study culminated in our formulation of the kernel strategy, namely, that with basis consisting of B and W alone. Here we make good use of the five kernels, Kj(B, W), briefly discussed earlier; for this example, we simply call these respective kernels Ki through K5 and note that they can be expressed, respectively, as the (left-associated) cube of a generator Gi, where, for example, Gi = W{B(Bx)). We select one of five subsets of the following nine clauses, each subset focus ing exclusively on one of the five kernels under discussion. EqUAL(x.x). EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))) . EQUAL(a(a(W,x),y).a(a(x,y),y)). -FIXED(a(y,g(y)),g(y)) I $ANSWER(y). FIXED(a(a(a(W,a(B,a(B,x))),a(W,a(B,a(B,x)))), a(W,a(B,a(B,x)))),x). FIXED(a(a(a(W,a(a(a(B,B),B),x)),a(W,a(a(a(B,B),B),x))), a(W,a(a(a(B,B),B),x))),x). FIXED(a(a(a(a(a(B,W),B),a(B,x)),a(a(a(B,W),B),a(B,x))), a(a(a(B,W),B),a(B,x))),x). FIXED(a(a(a(a(a(B,W),a(a(B,B),B)),x),a(a(a(B,W), a(a(B,B),B)).x)),a(a(a(B,W),a(a(B,B),B)),x)),x). FIXED(a(a(a(a(a(B,a(a(B,W),B)),B),x),a(a(a(B, a(a(B,W),B)),B),x)),a(a(a(B,a(a(B,W),B)),B),x)),x). Of the nine clauses, the first four are, respectively, reflexivity, the equation for B, the equation for W, and the negative clause used to determine that a fixed point combinator has been found. As noted in Section 2, the negative clause is obtained by denying that 'there exists y such that for all x, yx is a fixed point of a?. The last five, chosen in order and one at a time, are used to determine whether stage 2 can extend, respectively, Ki through K5 to one or more fixed point combinators. Each of the five attempts succeeds in less than 1 CPU-second on a SPARCstation 1+ and, after discarding those that are reducible with B and W, con structs the following five fixed point combinators. B{B{B{WW)W)B)B B\B{WV/)W){BBB)
Kernel Strategy and Combinatory Logic
1245
B{B{WW){BWB))B B{WW){BW{BBB)) (Statman's fixed point combinator) B{WW){B{BWB)B) If we call the preceding five fixed point combinators Fi through F5, respec tively, we find a one-to-one correspondence between the Fi and the Ki. Some of the beauty of the fragment A under study is exhibited by the correspon dence as manifested in the Fi: One takes the tail of each F{ (defined as the part of the combinator obtained by ignoring the first set of symbols through the occurrence of WW), recalls that each of the kernels Ki can be expressed as the (left-associated) cube of a generator Gi, and notes that the respective tails match the corresponding Gi in symbol occurrence and pattern if one ignores the occurrence of the variable x. Further, although the set of five kernels exhibits a transparent structure - one can obtain from Gi the other Gi by expanding with B - the corresponding five fixed point combinators are not nearly so easily obtained one from the other. Put another way, given K i , one might quickly conjecture the nature of the remaining Ki (by simultaneously applying to all occurrences of the appropriate generator an expansion with B), but, in contrast, one might not easily discover the remaining Fj if simply given Fi with no hints. We note that we are interested in such simultaneous (or global) expansions if and only if they are applied to a term containing the variable x. The significance of the role played by Ki becomes clearer when we discuss this kernel as the superkernel (Definition 10 in Section 2.1) Ssu&l. In particular, in contrast to K2 through K5, the only reduction with a basis element of A that applies to Ki is that involving its first symbol. Remark 3. Before we turn in Section 3 to contributions to combinatory logic resulting directly from the research reported here, we address two aspects as yet not adequately covered. By doing so, we add to the mounting evidence of the beauty possessed by the fragment A whose basis consists only of B and W. The first aspect concerns the apparent irrelevance of the superkernel W(Bx){ W(Bx)), which we shall call So, to the construction of fixed point combinators for A and the relation of this superkernel to Ki = Si and, as it turns out, to an infinite sequence of kernels of A. Rather than being irrelevant, the structure of So in its relation to the structure of Si correctly suggests that a generalization can profitably be made. Indeed, if we let the generator W(Bx) of So be Go and the generator W(B(Bx)) of Si be G i , we can generalize, for i = 0, 1, . . . , by letting the generator Gi be the right-associated expression whose first symbol is W followed by t+1 occur rences of B followed by x. Then, for j = 0 , 1 , . . . , we let Sj be the left-associated expression consisting of j+2 occurrences of Gj. Clearly, So and Si satisfy the preceding definition. One can then prove that (1) for all j = 0,1,..., Sj are superkernels; (2) from each Sj, one obtains, with zero or more simultaneous expansions with the combinator B to the generators, m kernels, where m is the
1246
Collected Works of Larry Wos
number of ways to associate p letters with p equal to the number of symbols in the generator of SJ; and (3) except for So, to each kernel obtained from some Sj there corresponds a unique fixed point combinator. The second aspect we address here concerns our earlier observation (in Sec tion 2.2) regarding kernel schemata. Recalling that a kernel K of a fragment A requires by definition that it be expressed solely in terms of the elements of the basis of the fragment and the variable x, we define a kernel schema to be an expression that contains at least one variable y different from x such that at least one instance of the schema is a kernel. We noted that, rather than finding the five kernels Ki through K5, stage 1 finds five schemata, in each of which the third occurrence of the corresponding generator is replaced by the variable y. Had we given to stage 2 one of the five schemata, say the one with an instance equal to K i , the kernel strategy would have constructed far more than a single irreducible fixed point combinator. For example, in addition to the useful kernel Ki obtained by instantiating y to Gi, one obtains useful kernels by instantiat ing y to the square of Gi, to its cube, and so on. The use of these additional instantiations leads to a many-to-one correspondence of fixed point combinators to kernels. As with the preceding example focusing on B, W, and M, we again encounter the intrigue of combinatory logic. Specifically, in the absence of extensionality, the five kernels Ki through K5 are, nevertheless, equal, but the corresponding five fixed point combinators Fi through F5 are distinct. 2.4
T H E SOURCE OF THE P O W E R OF THE KERNEL STRATEGY
If, in general, the question of determining whether the strong fixed point prop erty holds for a given fragment is considered by researchers in combinatory logic to be deep and difficult to answer, and if quite often the use of the kernel strat egy answers the question for a chosen fragment in just a few CPU-seconds, one might naturally wonder from where the strategy derives its power. Two aspects account for its power: one essentially concerning combinatorics, and one con cerning the various restrictions placed on the type of reasoning on which the strategy relies. First, the strategy derives its power in part from attacking the question in two stages, thus dramatically reducing the size of the space of possible paths to explore. In particular, by first focusing in stage 1 on the possible presence of the weak fixed point property, the kernel strategy attacks a question that, at least in principle, should be easier to answer. After all, the weak fixed point property permits the use of expressions that, in addition to relying on the use of elements of the basis of the fragment under study, also rely on the use of the variable x. For example, if one were asked whether the weak fixed point property holds for the fragment A with basis consisting of B and W alone and had never given the question prior thought, one might quickly answer the question in the affirmative with the following observations. The combinator BWB acts on other
Kernel Strategy and Combinatory Logic
1247
combinators as the combinator L does. That the fragment with basis consist ing solely of L satisfies the weak fixed point property can be quickly proved by considering Lx(Lx). Therefore, consideration of BWBx(BWBx) immediately completes a proof that A satisfies the weak fixed point property. Even if one failed to explore the use of L and, instead, chose a more direct path, one might quickly find the expression So = W{Bx){W{Bx)). With regard to the strong fixed point property, on the other hand, the con sideration of L is of little use; indeed, the fragment whose basis consists solely of L fails to satisfy the property (see Theorem 4 in Section 3.2). As for the relative difficulty of finding So compared with finding, say, F i , finding the former is far more likely than finding the latter, even though the difference in length between the two objects is just 2. To experience firsthand the relative difficulty, one can submit each of the two questions to an automated reasoning program, choosing the standard approach by including as the target the denial that the respective properties hold. The kernel strategy directly addresses the combinatorics of the question by discarding all results produced in the first stage that do not (in effect) prove that the weak fixed point property holds. For an analogy, one might think of the first stage as seeking (in a single run) a key lemma to be used in the second stage and, further, of knowing in advance the precise characteristics of the lemma. Although less directly, the combinatorics are further addressed by focusing in the second stage only on the possible extension of the successes obtained in the first stage. In addition, when compared with the typical approach of focusing on the denial of the strong fixed point property, the use of stage 2 of the kernel strategy often offers a significant reduction in path length, as the following shows. Let g denote the path length from an expression (a kernel) that proves that the weak fixed point property is present to a combinator that proves that the strong is present. Let h denote the path length of a proof of the strong fixed point property, when starting with the basis elements of the fragment under study. One frequently finds that g is enough smaller than h to cause a sharp reduction in the number of paths to explore. For example, in the case of Ki and Fi, g= 5 and /i = 8. As for the second aspect accounting for the power of the kernel strategy, we first note that, at least when applied by an automated reasoning program, the inference rule paramodulation is used in both stages. Although this inference rule, which generalizes equality substitution, is in many cases rather difficult to apply by hand, it offers far more reasoning power than does either reduction or expansion, even if generalized. By relying on unification in its fullest sense (see the example near the end of Section 1.2), the use of paramodulation permits the deduction of conclusions that are much more general than those yielded by reduction and expansion. When one then takes into account the restrictions each stage of the kernel strategy places on the application of paramodulation (see Section 2), one finds the other main source for the power of this strategy. Although not part of the definition of the kernel strategy, one additional
1248
Collected Works of Larry Wos
powerful restriction can be placed on its use of paramodulation. The restriction, called the l's role or l's rule strategy, requires that the into term include the first symbol of the argument containing it. To see precisely what is meant, let us consider the following, expressed in the notation of combinatory logic. Bxy(uv) = x(tAuv)) The given equality is obtained from the equation for the combinator B by merely replacing zby uv. When restricted by the l's rule, paramodulation into the given equality can use as into terms any term in its left side provided the term contains B and any term in its right side provided the term contains i. Therefore, the terms uv and y{uv) are inadmissible as into terms. We often use the l's rule strategy, even more in stage 2 than in stage 1. The l's rule and the pseudo l's rule (defined shortly) prove useful for the following classification of kernels. For the classification, we recall that every kernel K has the property that K reduces to xK reduces to x(xK) ad infinitum. Therefore, some step of the corresponding reduction isolates an occurrence of x. By definition, we say a reduction step satisfies the pseudo l's rule if and only if the step does not satisfy the l's rule, but, when the leftmost leading isolated occurrence of x is ignored, it satisfies the l's rule. DEFINITION 11 (simple kernel). A kernel K of a fragment with basis B is simple if and only if there exists a reduction of K to xK (with elements of B) such that all steps satisfy the 1 's rule. DEFINITION 12 (semisimple kernel). A kernel K of a fragment with basis B is semisimple if and only if there exists a reduction with elements of B of K to xK such that, before x is isolated, all steps satisfy the l's rule and, after x is isolated, all steps satisfy the pseudo l's rule. Every simple kernel is a semisimple kernel, for the set of steps in the re duction of K to xK after x isolates is empty. On the other hand, the kernel W(Bx)(BWBx) is semisimple but not simple. For a second example of a semisim ple kernel that is not simple, we turn to the fragment with basis consisting of B, N (with Nxyz = xzyz), and Wand the kernel Bx{ W(Bx))( W(Bx)). If the second stage of the kernel strategy is applied to this kernel, it constructs the fixed point combinator B(N(BB(NBWj) W)B, thus proving that the fragment satisfies the strong fixed point property. For a kernel that is not even semisimple, we consider the fragment with basis consisting of B, C, I, and S (with Ix = x and Cxyz = xzy) and the kernel CSI(Bx)(CSI(BX)). If we call this kernel K and reduce it with the intention of obtaining xK, we find that, after i isolates, a reduction with I is needed. We also find that that reduction fails to satisfy the pseudo l's rule. (Applying stage 1 of the kernel strategy, OTTER found K in approximately 57 CPU-seconds on a SPARCstation 1+, retaining 8,711 clauses; we were forced to avoid the use of the l's rule and to permit paramodulation from and into variables.) The
Kernel Strategy and Combinatory Logic
1249
fact that the given kernel is not even semisimple does not prevent its use from leading to a fixed point combinator for the fragment, namely, B(S(CSI)(CSF))B, constructed in less than 1 CPU-second by OTTER applying stage 2 of the kernel strategy. This basis consisting of B, C, S, and / is of particular interest, for it provides a basis for all of noneliminating combinatory logic [16]. A combinator is called an eliminator if and only if (1) the combinator is proper and (2) there exists at least one variable appearing on the left side of its equation that does not appear on the right side. This last example shows how complicated combinatory logic can be. Indeed, to find the kernel that naturally corresponds to the given fixed point combinator, one cannot simply apply reductions that satisfy the l's rule and then that satisfy the pseudo l's rule. Were one to do so, one would miss finding the given kernel and, in fact, would never find a kernel even if one extended the pseudo l's rule to permit ignoring all leading isolated occurrences of x. Further, to find the given kernel with stage 1 of the kernel strategy requires relaxing two of the constraints ordinarily placed on paramodulation: In particular, one must permit paramodulation from and also into variables. However, once the given kernel is found, stage 2 (as it is usually applied with its restriction on the role of variables) quickly constructs the given fixed point combinator.
3
Contributions to Combinatory Logic
The contributions to combinatory logic reported here focus on a number of open questions that were first offered in the mid-1980s, some asked explicitly by Smullyan, and some posed implicitly as a result of our study of the Smullyan questions. Included among the questions on which we focus are the following, the first of which was cited earlier in Section 1.3. Question 5. Does there exist a single regular combinator (Definition 2 in Section 1.2) such that the fragment with basis consisting of that combinator and B alone satisfies the strong fixed point property (see Definition 3 in Section 1.2), where Bxyz = x{y£)l As observed, this question, first answered by Statman [17], prompted our entrance into the field of combinatory logic and its study with the assistance of an automated reasoning program. Question 6. Does the fragment with basis consisting of B and L alone satisfy the strong fixed point property? Question 7. Does the fragment with basis consisting of L and Q (often called Bl) alone satisfy the strong fixed point property? Question 8. Can a fragment whose basis consists of a single regular combinator satisfy the strong fixed point property?
1250
Collected Works of Larry Wos
Question 9. What conditions are necessary for a fragment to satisfy the strong fixed point property? Here we answer these questions, noting that the kernel strategy played the key role. We begin with a detailed answer to Question 5. We first show how one can construct an infinite number of fixed point combinators from B and W alone such that no two are equal even if extensionality is assumed. Then we show how one can construct an infinite class of such infinite sets. Perhaps even more satisfying, we next turn to other answers to Question 5, answers in which W plays no role. 3.1
ANSWERING QUESTION 5 IN DETAIL
In the mid-1980s, Smullyan asked about the possible existence of a fragment that satisfies the strong fixed point property and that has as its basis B and one other regular combinator. By finding the fixed point combinator B( WW)(BW(BBB)), Statman answered the question in the affirmative, showing that the fragment A with basis B consisting of B and W alone is such a fragment. As noted, before we formulated the kernel strategy, we used an automated reasoning program to find Statman's combinator and four others somewhat like it, where our approach was rather traditional in its focus on denying that the strong fixed point property fails to hold (see [12] and Section 1.3). We call these fixed point combinators Fi(B, WO through F 5 (B, HO or simply F i through F 5 ; Statman's is the fourth. For all five F<, F<x reduces to the superkernel Si equal to the (left-associated) cube of Gj with G\ = W(B(Bx)). One can prove that Si is a member of an infinite set of superkernels Sj for t = 1, 2 where Si is obtained in the following manner. Let the generator Gi of Sj be the right-associated expression of length t+3 whose first symbol is W, whose last symbol is x, and whose re maining symbols are B. Let Sj be the left-associated expression consisting of t+2 copies of Gj. One can prove that, for all i = 1, 2, . . . , Si is a superkernel. The superkernel Si is the kernel Ki(B, W) we studied in Section 2.2. From each Si, one can construct with stage 2 of the kernel strategy a unique fixed point combinator. The fixed point combinator corresponding to Si is ob tained in the following way. First, express Sj solely in terms of its generator Gi. Second, repeatedly expand with W {by paramodulating from the right side of its equation) until a single occurrence of Gi remains, always choosing as the into term the smallest term available. Third, replace the single occurrence of Gi by its definition in terms of B, W, and x, and expand with B. The given three-step procedure yields an infinite set of fixed point combinators, no two of which are equal even in the presence of extensionality. Further, for each i, the combinator corresponding to Sj has length 3(i + 2) - 1 and contains exactly i + 2 occurrences of W. As we obtained from Ki (B, W) the finite family of kernels Ki through K 5
Kernel Strategy and Combinatory Logic
1251
by applying zero or more expansions with B to the generator Gi, we can obtain a finite family of kernels from each Sj. Indeed, for a given Si, one treats all copies of the generator Gj simultaneously and alike (by using global expansion), considering all sequences of expansion with B such that the term being expanded (the into term) contains the variable x. From Si, one obtains 5 kernels (including Si itself), from S2 14, from S3 42, and, in general, from Sj m kernels, where m is the number of ways to associate t+3 letters (which is the number of letters in the corresponding generator). For all i, by applying the three-step procedure given earlier to the family of kernels obtained from Sj, one can construct a unique fixed point combinator. By marking the symbols in the superkernels and tracking their movement as the kernels are obtained by global expansion, one obtains a natural mapping from their corresponding fixed point combinators to the integers. For example, one sees how the mapping is obtained by noting that the symbols in the generator of Si =Ki have the pattern (1,1,2) and that the patterns for the respective generators of K2 through K5 follow in order the patterns for the association of four letters. We can quickly obtain a second infinite set of fixed point combinators to serve as companions to those of length 8, 11, 14, and the like. Again, an infinite set of superkernels provides the key. For each i, we simply take Si and replace all occurrences of W by BW. In this way, we obtain a second infinite set of superkernels, each of which can be used to construct a fixed point combinator. Rather than having respective lengths of 8, 11, 14, and the like, the fixed point combinators for this set have respective lengths of 9, 12, 15, and the like. In all other respects, except for containing an additional occurrence of B, this second infinite set has the same properties as the preceding infinite set does, which is why we used the term companion set. Now let us turn to the promised infinite class of such infinite sets. To produce the infinite class, we revisit the kernel schema G1G13/. As we observed earlier, by instantiating y to Gi, we obtain the superkernel Si. The instantiation of y to the square of Gi also yields a useful kernel, although not a superkernel. To easily see why this kernel, which we call Sj, is not a superkernel, we simply note that a reduction applies to it such that the first symbol is not involved. Nevertheless, an application of a small modification of the three-step procedure (used earlier in this section) leads to the construction of a fixed point combinator of length 11. The modification permits use of B in addition to Won the path whose objective is to produce an expression in which Gi occurs once. Let us call Sf a pseudo-superkernel, for, with regard to both B and W, its generator Gi is irreducible. We can use this pseudo-superkernel in a manner similar to our use of the superkernel Si, namely, to produce an infinite set of pseudo-superkernels. Indeed, we again use repeated insertion of an occur rence of B, the insertion that produces G2 from Gi, G3 from G2, and the like. Equivalently, we let S^ be the expressions of the form GjGi(GjGj), where G< is the generator of Si. The infinite set of pseudo-superkernels S? behaves in most respects as the infinite set of superkernels Sj does. Most important, each
1252
Collected Works of Larry Wos
pseudo-superkernel can be used to construct a fixed point combinator. We thus have a third infinite set of fixed point combinators constructible from B and W alone such that no two are equal even in the presence of extensionality. To complete the presentation of the promised infinite class, we instantiate y in the given kernel schema to the cube of the appropriate generators, then to the fourth power, and the like. As to the association of the generators within the instantiation of y, let us choose that which is fully left associated. We note that one can prove that all other associations produce pseudo-superkernels, each leading to the presentation of an infinite set of pseudo-superkernels that in turn leads to the construction of an infinite set of fixed point combinators. We complete our discussion of the fragment A with basis consisting of B and W by first noting that no fixed point combinator of length less than 8 can be constructed for this fragment. We also note that, except for length 10, one can construct a fixed point combinator of length i for i > 8. The proof that none exists of length less than 8 and none of length 10 was obtained with a generateand-test approach applied by a Prolog program written for that purpose. In contrast to the use of the combinator W to be considered with B to con struct fixed point combinators, reliance on the kernel strategy led directly to the discovery that other combinators could be used in place of W. Specifically, prompted by our incomplete study of the fragment with basis B and 5, we in troduced and then studied the combinator N with Nxyz = xzyz. When the first stage of the kernel strategy was applied to the study of the fragment A with basis consisting of B and N, the program OTTER found a kernel schema one of whose instances is the superkernel Ki(B,N) equal to the cube of N(B(Bx)) and no smaller superkernel. In contrast to the inadequacy of the smallest su perkernel W(Bx)(W(Bx)) (of the fragment with basis consisting of B and W) for constructing fixed point combinators, the smallest superkernel of A is more than adequate. Indeed, when Ki(B,N) is studied with the second stage of the kernel strategy, in sharp contrast to the single combinator obtained from Ki(B, W), the following four fixed point combinators are constructed, each of which is irreducible. B(B(N(BB(N(BBN)N))N)B)B BIB(N(BB(N(N(BB))N))N)B)B
BlB(N{N(B{BB)(N(BBN))))N)B)B BIB(N{N(B(BB)(NIN(BB)))))N)B)B In addition to leading to the construction of four combinators (rather than a single combinator), we note one more oddity: Two of them have length 13, and two have length 14. By expanding with B, the superkernel K\(B,N) can be used to produce kernels in a manner identical to the use of K\(B, W). The expansion pro duces K2(#,7V) through K5(B,N), four kernels that are identical, respectively, to K 2 (B, HO through K 5 (fl, W) except for the replacement of Wby N. The use of any of these four kernels by the second stage of the kernel strategy provides additional evidence of some of the significant differences between the properties
KerneJ Strategy and Combinatory Logic
1253
of the fragment A with basis B and N and the fragment with basis B and W. For example, the mapping from fixed point combinators to their corresponding natural kernel is many-to-one and not one-to-one. Nevertheless, the fragment A shares with the fragment with basis B and W the important property of admit ting the construction of an infinite set of fixed point combinators such that no two are equal even in the presence of extensionality. One other property of interest concerns the usefulness of the kernel schema found in stage 1, namely, N(B(Bx))y(N(B(Bx))). From that schema, one can construct not just one fixed point combinator, but a fixed point combinator schema, the following. B(B(B(N(BNB)y)N)B)B Since one obtains a fixed point combinator from the preceding schema regardless of the instantiation of y to an expression solely in terms of B and N, the schema generates an infinite number of such combinators for the fragment A. Among those, we see that we have fixed point combinators of smaller length than those previously discussed, namely, two of length 11. Also, curiously, if we reverse the process of constructing the given combinator from the given kernel schema by now reducing it with B and N, rather than the given kernel schema of the form Gj/G, we instead obtain a schema of the form G(Gy)G, where G = N(B(Bx)). (To apply the kernel strategy with OTTER to find the first cited kernel schema for B and N and then use it to construct the cited fixed point combinator schema required less than 2 CPU-seconds on a SPARCstation 1+.) Thus we see that the fragment A with basis consisting of B and N alone answers Smullyan's original question, Question 5, but without reliance on the combinator W. Before turning to yet one more answer to Question 5, we pause here to note that, for combinatory logic as a whole, the combinator N may merit additional study. In particular, since BN(BB)xyz = xz(yz), BN(BB) acts on all other com binators as S does. Therefore, noting that S and K provide a basis for all of combinatory logic, one might find it interesting to study the logic instead with B, N, and K. We also note that, where Cxyz = xzy, N acts on other combina tors as does B(BW)C and S as B(BW)(BBC), which may add to the appeal of using N. Finally, N appears to offer more power than does S in the context of fixed point combinators, for one can construct such combinators from B and N and, apparently, not from B and S; we return to this topic in Section 4. With regard to a comparison of N and W, one property possessed by the former and not the latter is that the former is a permuter (see Definition 17 in Section 4): The order of some subsequence of variables on the right side of the equation for the combinator is a nontrivial permutation of the sequence of the corresponding variables on the left side. A third answer to Question 5 focuses on the replacement of W by H with Hxyz = xyzy. Our proof that the fragment with basis consisting of B and H alone satisfies the strong fixed point property rests on the following combinator. B{B{H{B{BH){BB)){H{BH){BB))H)B)B Again, our success resulted directly from the use of the kernel strategy. An
1254
Collected Works of Larry Wos
interesting superkernel (found in stage 1 in less than 1 CPU-second by OTTER on a SPARCstation 1+) is the (left-associated) cube of H(B(Bx)). Use of it in a manner similar to the use of the superkernel Ki (B, W) proves most profitable. 3.2
ANSWERING QUESTIONS 6 THROUGH 9 IN DETAIL
In this section, we focus mainly on results that complement those presented ear lier in this article. In that context, we are concerned with fragments that do not satisfy the strong fixed point property and, in that regard, answer Questions 6, 7, and 8 posed at the beginning of Section 3. Close scrutiny shows that obtaining the needed proofs was aided by applying an understanding of some of the basic elements of automated reasoning. We note that, although the kernel strategy is oriented to construct appropriate objects and expressions and, therefore, to address the affirmative side of questions concerning fixed point properties, an analysis of the results obtained with its use nevertheless more than suggested the direction in which to move when we were addressing the negative side. We close this section with an answer to Question 9 by giving necessary conditions that a fragment must satisfy if it is to offer sufficient power for constructing fixed point combinators. To answer Question 6, which asks whether the fragment A with basis con sisting of B and L alone satisfies the strong fixed point property, we were led to introduce the following concept. DEFINITION 13 (isolator). A combinator is called an isolator if and only if (1) it is proper and (2) the right side of its equation consists of a single variable or is of the form vt for some variable v and some term t. Such combinators are termed isolating. Examples of isolators include B, L, U, and M. On the other hand, combi nators that fail to isolate include S, N, and W. As we see when we present the theorem (Theorem 5 in Section 3.2) that answers the ninth question, isolators play a vital role in the construction of fixed point combinators. To answer Questions 8 and 9, we introduced the following additional defini tion. DEFINITION 14 (replicator). A combinator is called a replicator if and only if (1) the combinator is proper and (2) a variable appears more than once on the right side of its equation. Such combinators are termed replicating. The combinators S, N, L, and W are replicators, but the combinators B and K are not. LEMMA 1. // the regular combinator C is an isolator such that the left side of its equation contains more than one variable, then reducing the expression ab with C when a is free of occurrences of some symbol, say s, produces an expression cd with c not empty and free of occurrences of s.
Kernei Strategy and Combinatory Logic
1255
The proof of this lemma is contained essentially in the proof we give later in this section for Theorem 4. By using the preceding lemma and by relying on the following key theorem of Church-Rosser, we can prove the theorem (Theorem 2) that answers Question 6 in the negative. THEOREM 1 (Church-Rosser theorem of combinatory logic). If the expression c equals the expression d, then there exists an expression e such that c and d ore each reducible to e. Because the Church-Rosser theorem holds for combinatory logic, the field offers a type of power sometimes lacking in other areas of mathematics and logic. In particular, knowing that two expressions are equal, one cannot ordinarily guarantee that a third exists such that the two reduce to it. Equivalently, from the viewpoint of automated reasoning, the equality of two expressions does not imply that a third exists such that the two demodulate to it. But, in combinatory logic, such a guarantee or implication does hold. For example, if we consider the combinator M with Mx = xx, we see that MB(MW) = BB(MW) and also that MB(MW) = MB(WW). Therefore, BB(MW) = MB(WW). By the Church-Rosser theorem, there must exist a third term to which the last two cited terms each reduce. The term BB( WW) is such a term. Of far greater interest is the example that focuses on some fixed point com binator F. Since F is a fixed point combinator, Fx = x(Fx) for all combinators x. Therefore, if we select any arbitrary combinator C, we can apply the ChurchRosser theorem to the two expressions FC and C(FC) to conclude that some third expression must exist to which the given two each reduce. Now if we choose for our combinator C some combinator that does not occur in F and such that the equation for C involves at least two variables, the common expression guar anteed by Church-Rosser to which F C and C(FC) each reduce must have the form Cd for some d. THEOREM 2. The fragment A with basis consisting of B and L alone does not satisfy the strong fixed point property. Proof. The combinators B and L are both isolators. By Lemma 1, if either is applied to an expression of the form ab with a free of occurrences of x with both a and b nonempty, then an expression of the form cd will be obtained with both c and d nonempty and with c still free of occurrences of x. For any fixed point combinator F, since Fx = x(Fx), by Church-Rosser there must exist a reduction of Fa; to x(d) for some d. But, if we assume the existence of a fixed point combinator F expressed solely in terms of B and L and then apply repeated reduction with B and L to Fx, we see by our earlier observation concerning ab that Fx can never reduce to xd for some d. Therefore, our assumption about the existence of such a fixed point combinator F leads to a contradiction, and the proof is complete. □
1256
Collected Works of Larry Wos
After we succeeded in answering Smullyan's question, Question 6, concerning B and L, he asked about the possible construction of a fixed point combinator from L and Q alone (see Question 7); the combinator Q is often called Bi. Theorem 3 shows that such a construction is not possible and, of added inter est, provides an alternative proof for Theorem 2. We need the following two definitions. DEFINITION 15 (left component, right component). For any expression of the form cd, the left component is c and the right component is d. In particular, the left component of cde is cd and the right component is e. DEFINITION 16 (left restricted). A proper combinator is called left restricted if and only if the last variable on the left side of its reduction rule does not occur in the left component of the right side of its reduction rule. For example, the combinators B, L, and Q are left restricted, where Qxyz = y(xz). On the other hand, the combinators W, S, and TV are not. LEMMA 2. If F is a fixed point combinator, then there exists a sequence of terms to, h, t?,, . . . such that Fx reduces to to reduces to xti reduces to xfx^j ad infinitum. The proof of this lemma relies on applying Theorem 1, Church-Rosser. THEOREM 3. If A is a fragment such that all the members of its basis B are left restricted, then A fails to satisfy the strong fixed point property. Proof. Assume, by way of contradiction, that A satisfies the strong fixed point property. Then there exists a fixed point combinator F constructed from the members of B alone. By Lemma 2, there exists a term t such that Fx reduces to xt. Next, Fx is of the form ab, where a is free of x. We show that if a onestep reduction with a left-restricted combinator is applied to a combination ab, where a is free of x, then the result is a combination a/b/, where a/ is free of x. Case 1. The reduction involves a only or b only. Obvious. Case 2. The reduction involves both a and b. The reduction rule for a leftrestricted combinator has the form Cxi ... xn = lr, where 1 is free of xn. Since 1 is constructed from nothing more than xi , ... , x n _i, the term c/ is constructed from nothing more than the subterms of a. In particular, x does not occur in a/. Since F is free of x, we can conclude that, regardless of the number of reduc tion steps, Fx cannot reduce to xt. A contradiction has been established, and the proof is complete. D By applying the preceding theorem, we see that the seventh question is answered in the negative, for both L and Q are left restricted. We also see that this theorem has as a corollary Theorem 2, for both B and L are left restricted. We nevertheless include the given proof of Theorem 2 because of historical reasons (it was found first, by the author of this article) and because of its
Kernel Strategy and Combinatory Logic
1257
nature. With regard to the eighth question, which asks whether a fragment whose basis consists of a single regular combinator can satisfy the strong fixed point property, we again note that Statman was the first to answer this question. Nevertheless, we include our answer here for two reasons. First, from what we understand, our proof is simpler than Statman's. Second, since we studied and answered the question before we knew that he had answered it, we include our attack as a further indication of the value of relying on techniques borrowed from automated reasoning. Although the proof of the following theorem depends on a theorem presented later in this section, we nevertheless include it now, for it addresses yet another aspect addressed by two of its predecessors. We also note that we close this subsection with a shorter and simpler proof, including the following in part for historical reasons. T H E O R E M 4. If A is a fragment whose basis consists of a single regular combinator, then A fails to satisfy the strong fixed point property. Proof. Let C be the only element in the basis of A, and let C be a regular combinator. Assume by way of contradiction that A in fact satisfies the strong fixed point property. Then, by Theorem 5, C must be a replicator. Since C is regular, the first variable on its right side must occur exactly once. Therefore, since C replicates some term, C must contain more than one variable. In addi tion, the replicating variable must not be the first variable on the right side of its equation, which is also the first variable on the left side of that equation. Now if C is applied as a reduction to an expression of the form ab with a free of any occurrences of some constant / and a and b are not empty, then - with the following detailed argument - we can prove that the expression cd that is obtained is such that c is not empty, d may be empty, and c is free of any occurrences of /. To see that this conclusion is valid, first note that B must unify with the last variable on the left side of the equation for C. Next, since the equation for C must contain more than one variable on its left - a replicating variable must exist on the left that is different from the first variable that occurs there - and since all of the variables on its left are distinct because C is regular and therefore proper, d must not unify with the first variable on the left side of the equation for C. Then we note that, since by Theorem 5 C must isolate / i n some application, the first variable on its right must be isolated from the rest of the expression on its right. In particular, the right side must be of the form as for some nonempty expression s of variables, where s contains no occurrences of x. Next note that, since the variable x occurs on both sides of C, c must not be empty. Even further, c is the expression substituted for x in the reduction with C. Finally and most important, c must be free of occurrences of/, because x is isolated from s. To complete the proof, we now apply C as a reduction to F/, where F is an assumed fixed point combinator constructible from C alone. By earlier observations, repeated application must eventually reduce F / to ./e for some
1258
Collected Works of Larry Wos
expression e. But F is free of any occurrences of /. Therefore, each reduction with C produces some cd with c not empty and free of/. We can then conclude that, regardless of the number of applications of C, at no point will an expression of the form fe for some e be produced, a conclusion that contradicts the original assumption that A satisfies the strong fixed point property, and the proof is complete. D We now come to a theorem that answers Question 9, a theorem that gives necessary conditions that a fragment must satisfy if it is to offer sufficient power for constructing fixed point combinators. THEOREM 5. If the fragment A with basis B satisfies the strong fixed point property, then B must contain a combinator that is a replicator and a (not necessarily distinct) combinator that is an isolator. Also, if F is a fixed point combinator expressed solely in terms of elements of B, then F must contain a replicator and also contain a (not necessarily distinct) isolator. Proof. Let A be a fragment with basis B such that A and B satisfy the hypothesis of the theorem. Our proof makes use of the Church-Rosser property of combinatory logic: If two given expressions are equal, then a third expression (not necessarily distinct from the others) exists such that the two given expres sions reduce to the third. From the viewpoint of automated reasoning, given two equal expressions, a third must exist such that the two demodulate to the third. Let F be a fixed point combinator of A. Therefore, F is expressed solely in terms of elements of B, and Fx = x(Fx) for all x. To simplify the argument, let C be a combinator that is not a member of B. Since F is a fixed point combinator, F C = C(FC). By Church-Rosser, there must exist an expression d such that both F C and C(FC) reduce to d. Because F is expressed solely in terms of elements of B and because C is not an element of B, d must have the form Ce for some expression e. Therefore, the reduction that is applied to F C to yield Ce must include a step that isolates C, and that step must use an equation for an element of B. Further, that isolating step must focus directly on a combinator present in F . Thus, part of the conclusion of the theorem has been proved. With regard to the presence of a replicator, we can apply Lemma 2 to establish that F C reduces to Cti reduces to C(C<2) ad infinitum for terms ti, t%, ... . Since a reduction step with a combinator that is not a replicator always reduces the number of symbols, the absence in B of replicators would preclude the existence of the given infinite sequence, and the proof is complete. D That there is no need for distinct combinators, one to replicate and one to isolate, in the basis of a fragment that satisfies the strong fixed point property can be seen by considering the fragment with basis consisting solely of U and the fixed point combinator UU. If we replace the strong fixed point property in Theorem 5 by the weak fixed point property, then the corresponding theorem is also true, which gives us nec essary conditions for a fragment A to satisfy the weak fixed point property.
Kernel Strategy and Combinatory Logic
1259
Therefore, the fragment (cited near the end of Section 1.2) whose basis consists only of the combinator 5 cannot even satisfy the weak fixed point property, for 5 is not an isolator. By taking this result and those preceding it into consideration, a detailed picture begins to emerge, providing the basis for future research that we discuss in part in the next section. For example, the fragment with basis con sisting of L alone satisfies the weak fixed point property and the reducible weak fixed point property, as seen by considering the kernel Lx(Lx). As required by the observation following the proof of Theorem 5, its basis contains a replicator and an isolator, the same combinator L. However, the fact that the basis of some fragment contains a replicator and an isolator does not suffice to guarantee that the fragment satisfy the strong fixed point property. The fault does not rest with the basis consisting of a single combinator, for the fragment with basis consisting of B and L (by Theorem 2) does not satisfy the strong fixed point property. But the fragment with ba sis consisting of B and W does satisfy the property, a fact that is particularly interesting since the equation for W is similar to that for L except for the asso ciation of the variables on their respective right sides. Given these observations, one might naturally ask for topics for research, which is the focus of Section 4. We close this subsection with an outline of a second and simpler proof of Theorem 4, a proof in which Theorems 3 and 5 play a key role. By hypothesis, the basis B under discussion contains a single regular combinator C. Therefore, the right side of the equation for C begins with x, the first variable appearing on the left side, and x occurs only once on the right side. By Theorem 5, C must be a replicator, which implies that more than one variable occurs on the left side of the equation for C. Also by Theorem 5, C is an isolator. The last two observations show that the right side of C has the form xt for some nonempty term t, and we then see that C is left restricted. By Theorem 3, the fragment with basis B cannot satisfy the strong fixed point property. 3.3
T H E STUDY OF OTHER FRAGMENTS
At this point, we quickly present additional results of our research, obtained (directly and indirectly) from applying the kernel strategy to the study of various fragments. We begin by giving pairs consisting of a fixed point combinator F and a kernel K that corresponds to it; using the classification of kernels given at the end of Section 2.4, we classify the kernels we give here. For each pair, one thus knows that the fragment whose basis consists of the combinators mentioned in the first of its elements satisfies the strong fixed point property. Since, with examples such as that given near the end of Section 2.1, we now know (almost with certainty) that the strong fixed point property does not necessarily imply the reducible weak fixed point property (a fact that contrasts with the relation of the strong to the weak fixed point property), each of the given pairs serves a second purpose, for each also establishes the presence (for the appropriate fragment) of the reducible weak fixed point property.
1260
Collected Works of Larry Wos
We obtain the kernel K for a fixed point combinator F by reducing Fx with the elements that occur in F, focusing where possible on the leftmost reducible term. As we see when we present a kernel that is not even semisimple, namely, the square of CSI(Bx), one cannot always choose the leftmost term that is reducible to show that K reduces to xK. Thus, to each F, we find a unique K, where the converse is not true (as seen in our discussion of B and N). To complement this data, we also list various fragments (by their respective bases) that do not satisfy the strong fixed point property. Although only infrequently do we encounter a fixed point combinator F such that Fx is a kernel, as is the case with UU, our first pair F,K does have that property. Let F = 0(LO{LO)) with Oxy = y(xy) and K = Fx; K is a semisimple kernel. Such pairs are interesting to us, for they focus on a stronger property than Fx = x(Fx), namely, the property that Fx reduces to x(Fx). For F = S(QM)(QM), its K = QMx(QMx), which is semisimple. If F = B{RiMM)B with R\xyz = y(zx), its K = BxM(BxM), which is semisimple. If F = S(B(SSS))Qi)(BSQi) with Q^xyz = x(zy), its K = 5(Qix)(5(Q 1 x)(B5Q 1 x), which is not even semisimple. If F = BM{B{TM)B) with Try = yx, its K = M{B(TM)Bx), which is simple. If F = B(TM)(B(BM)B), its K = M(BxM), which is simple (and revisited later in this section). Sharing the preceding K is F = B{B(TM)(BM))B. Also sharing that kernel are F = B{BBTM(BM))B and F = B(RM{BM))B, where Rxyz = yzx (which is not surprising if one notes that R acts on other combinators as BBTdoes). If F = B(B(S(SSS)S)C)B, its K is equal to the (left-associated) cube of S(C(Bx)), which is simple. If F = B(S(SSS)S)(BCB), its K is equal to the cube of S(BCBx), which is simple. A glance at the two kernels correctly suggests that the first is a superkernel and the second is obtained from it by global expansion, by simultaneously expanding with B the three occurrences of the generator. Immediately, one sees a possible parallel to the study of the fragment with basis B and Wand the focus on the superkernel the cube of W{B{Bx)). Indeed, five kernels can be obtained with zero or more global expansions with B applied to the superkernel the cube of S(C(Bx)). Additional kernels can be obtained from some of the five kernels by applying global expansion with C, twice each time. For a small taste of a study that might prove stimulating, we note that one can begin with the kernel the cube of S(BCBx), whose corresponding fixed point combinator has length 9, globally expand twice with C to produce a kernel that leads to the construction of a fixed point combinator of length 11, and continue in this manner to construct fixed point combinators of length 13, 15, and the like. If F = S{SB{KM))(SB(KM)), itsK = SB(KM)x(SB{KM))x, which is semisim ple. Motivated by the fact that SH acts on other combinators as M does, in the preceding we can uniformly replace M by SH and find yet another interesting pair; however, the kernel for this pair is not even semisimple. For an example of an F whose K begins with an isolated occurrence of x, we consider F = 0\L
Kernel Strategy and Combinatory Logic
1261
with 0\xy = y{xy{xy)) and K = x{Lx{Lx))\ the kernel is semisimple, for the set of reductions that are applied before x isolates is empty and those applied after x isolates satisfy the pseudo l's rule. For our final fragment satisfying the strong fixed point property, we turn to that with basis consisting of B and W1, where W1xy = yxx. If F = B{B{B(Wl W1) {BWl))B)B, its K = W\B{Bx)W1){B{Bx)Wl). Further, this F is a member of a set of five fixed point combinators that bears a marked similarity to the following five constructible from B and W. B{B{B{WW)(BW)B)B B{B\WW){BW)){BBB)
B{B{WW){B{BW)B))B B{WW){B{BW){BBB)) B{WW){B{B{BW)B)B) The preceding five are those of length 9. These five serve as companions to those of length 8 (given in Section 2.3). The length 9 combinators are obtained from their length 8 correspondents by replacing the last occurrence of W by B W. To obtain the five fixed point combinators in terms of B and Wl, one merely replaces all occurrences of W (in the five we just listed in terms of B and W) by W1. In contrast to the possession of the strong fixed point property by the frag ments just discussed, we now give fragments (by listing their respective bases) that fail to satisfy the property. If B consists of H, L, M, N, W, and W1, then the fragment A with basis B fails to satisfy the strong fixed point property. If B consists of C, H, A/, N, S, and W 1 , then failure. If B consists of B, L, Q, and Qi, then failure. If B consists of H, L, M, N, W, and W1, then failure.
4
Research Topics and Questions Still Open
For the first topic for possible research, one might return to Theorem 5 in the preceding section with the intention of seeking sufficient conditions that guarantee the presence of the strong fixed point property or, instead, focus on the weak fixed point property or, further, on the reducible weak fixed point property. Of course, the conditions must be interesting, rather than, say, focusing on the presence of B and W, whose presence of course guarantees that the strong fixed point property is satisfied. One might begin by noting that the presence of a replicator and an isolator in the basis of a fragment and the existence of a kernel of the fragment together are not sufficient. Indeed, one need simply review what we know about the fragment with basis consisting of B and L alone. Two somewhat related research topics focus, respectively, on (1) finding conditions under which the kernel strategy is fixed point complete and (2) ex tending the strategy to be fixed point complete for all fragments, and thus cope with the counterexamples given almost immediately. Fixed point completeness is concerned with a guarantee that, when presented with a fragment that satis-
1262
Collected Works of Larry Wos
fies the strong fixed point property, use of the kernel strategy will always result in the construction of at least one fixed point combinator for that fragment. For many months after we formulated the kernel strategy, we thought it was fixed point complete for all fragments. However, as one can see from the following counterexamples, some conditions are required. For the first counterexample, we consider the fragment with basis B consist ing of L, W, and U\ and the combinator schema F = U\U\(LW(LW)v)v, where U\xyzu = u(xx(yz)zu). By instantiating the variable v to any combination of elements from B, one obtains a fixed point combinator for the fragment. This example is essentially that of G. Jacopini [7]. The proof that fixed point combinators are obtained proceeds by affixing the variable x to F, reducing once with U\, and then expanding once with the combination LW after noting that LW is, in the presence of extensionality, the earlier-mentioned Mi. Unfortunately, there does not exist a kernel K such that F/ reduces to K, where F/ is any fixed point combinator obtained by instantiating the variable v in the schema F with elements of B. For a second counterexample, we offer Piperno's modification [13] of Jacopini's counterexample, namely, U2U2(LW(LW)U2), which is a fixed point com binator for the fragment with basis consisting of L, W, and Hi with Uixyz = z(xx(yx)z). As a third counterexample (obtained from the second), we have the fragment with basis consisting of U2 and Mi with M\xy = xxyy and the fixed point combinator U i f ^ M i M i ) cited in Section 2.1. In that section, we gave the proof for the third example; the proof for the second is similar. Noting that the first counterexample to the unconditional fixed point com pleteness of the kernel strategy focuses in part on a combinator with four vari ables and the second and third counterexamples each on a combinator with three variables, we pose the following question. Question 10. Does there exist a counterexample in which none of the combinators is concerned with more than two variables? All three counterexamples share a common property: The basis of each con tains a combinator called a permuter. DEFINITION 17 (permuter). A combinator is called a permuter if and only if (1) the combinator is proper and (2) the order of some subsequence of variables on the right side of the equation for the combinator is a nontrivial permutation of the sequence of the corresponding variables on the left side. Such combinators are termed permuting. For example, the combinators N and S are permuting, but the combinators B and W are not. C O N J E C T U R E . The kernel strategy is fixed point complete for fragments whose bases are free of permuting combinators. A study of this conjecture might prove to be an intriguing research topic. In
Kernel Strategy and Combinatory Logic
1263
that regard, the classification of kernels given at the end of Section 2.4 might be of use. As we discussed, we frequently restrict the use of paramodulation in one or both stages of the kernel strategy by employing the 1 's rule. Where combina tory logic frequently employs head reduction to terms, requiring that the first symbol be involved at each stage of the reduction, the l's rule can focus on any term within any argument of any predicate with the requirement that the into term involve the first symbol of the argument. In other words, the l's rule strategy generalizes the concept of a head reduction. For a possible research topic, we suggest the study of uses for this strategy other than in the context of combinatory logic. Of a rather different flavor from the preceding research topics is the open question that we posed as Question 4 in Section 1.1. Question 4- Does the fragment with basis consisting of B and S alone satisfy the strong fixed point property? In addition, we have the closely related and still open questions focusing on the reducible weak fixed point property and on the weak fixed point property. Question 11. Does the fragment with basis consisting of B and S alone satisfy the weak or the reducible weak fixed point property? Question 12. Does the fragment with basis consisting of B and N\ alone satisfy the weak fixed point property, where N\xyz = xyyz? The corresponding question (for this fragment) concerning the possible presence of the strong fixed point property is answered in the negative as a corollary to Theorem 3 in Section 3.2. For the final open question focusing on one of the fixed point properties, we turn to the fragment A with basis consisting of B and M alone. Question 13. Does the fragment with basis consisting of B and M alone satisfy the strong fixed point property? Smullyan posed this question in the middle 1980s, and it has received sub stantial attention from us and from Statman. Logicians consider this question to be both deep and significant. (Before the introduction of the concept of kernel, this expression was cited by Smullyan, in [16, p. 135], as proof that the fragment satisfies the weak fixed point property. For those who enjoy history, we note that Smullyan commented in conversation that he had no idea that an approach such as the kernel strategy could be found.) We next note the connection between the conjectured fixed point completeness of the kernel strategy for fragments whose basis is free of permuters and a proof that A fails to satisfy the strong fixed point property. Specifically, if we assume such completeness, then we can
1264
Collected Works of Larry Wos
give the following theorem, reserving its proof for Appendix A. (The proof was provided by W. McCune [10] and is an improvement of a proof first provided by the author of this article.) THEOREM 6. / / the kernel strategy is fixed point complete for fragments whose basis is free of permuters, then the fragment A with basis B consisting of B and M alone fails to satisfy the strong fixed point property. Because of the interest shown in the fragment A by Smullyan and Statman and its importance to combinatory logic, Theorem 6 adds to the impetus for studying the possible fixed point completeness of the kernel strategy for fragments sharing one or more common properties. In that regard, we give the following definition and an additional open question for possible research. DEFINITION 18 (right terminating). A proper combinator is called right terminating if and only if the last variable on the left side of its reduction rule is the only variable that occurs in the right component of the right side of its reduction rule. For example, the combinators L, W, M, and N are right terminating, but Q and S are not. Question 14- Does the fragment with basis consisting of N and Q alone satisfy the strong fixed point property? This fragment does satisfy the reducible weak fixed point property, which is immediately clear from considering the kernel NQx(NQx). Let us call this fragment A2 and the fragment with basis consisting of B and M, Ai. The fragments Aj and A2 share interesting properties. The basis of each consists of an isolator that is also left restricted and a replicator that is right terminating. Both fragments satisfy the reducible weak fixed point property. Regarding the strong fixed point property, currently the status is unknown for both fragments. Of course, the analogue to Theorem 6 is of no use, for N is a permuter. Further, we have the fragment with basis consisting of B and W sharing most of the key properties but known to satisfy the strong fixed point property, and in abundance. Might some needed insight be gained from studying expressions such as C = B(BM(BM))B, which comes close to being a fixed point combinator for Ai? Indeed, if we let G = BM(Bx), we find that C reduces to G G reduces to x(G(BxG)) reduces to x(x(BxG(Bx(BxG)))) and the like. Finally, we note that we have proved that fragments whose basis consists solely of right-terminating combinators fail to satisfy the strong fixed point property [11,19]. Of a strikingly different nature from the preceding questions are the following four questions focusing on the existence of appropriate finite models; the first and third are included to provide one with test problems, and the second and fourth are still open.
Kernel Strategy and Combinatory
Logic
1265
By a finite model, we have in mind a finite set of letters, a table for 'applying' one letter to another, and, to each combinator under study, a (not necessarily unique) assignment of one of the letters. Currently, too little progress has oc curred regarding the generation of models and counterexamples with the use of an automated reasoning program, which is one motive for our inclusion of such questions. Question 15. Does there exist a finite model satisfying S and W in which the weak fixed point property fails to hold? There does exist a three-element model of the desired type. Question 16. Does there exist a finite model satisfying B and L in which the strong fixed point property fails to hold? Question 17. Does there exist a finite model satisfying L and Q in which the strong fixed point property fails to hold? (We note that, just before publication of this paper, J. Zhang found a four-element model answering this question, a question that had been open [25].) Question 18. Does there exist a finite model satisfying B and N\ in which the strong fixed point property fails to hold? We close this section by selecting from various other questions still open the following, most of which focus on the existence of a particular type of kernel. Question 19. What conditions are necessary, and what are sufficient, for a frag ment A to guarantee that there exists a simple (alternatively, semisimple) kernel of the fragment? Question 20. Does there exist a kernel K in which at least two distinct replicators occur such that the two replicators each participate in the reduction that proves that K is a kernel? Question 21. What properties of a fixed point combinator are necessary, and what are sufficient, for its natural kernel to be simple (alternatively, semisimple)? Question 22. Under what conditions does the existence of a kernel (alterna tively, simple kernel, semisimple kernel) guarantee that its use will lead to the construction of a fixed point combinator? Question 23. If F is a fixed point combinator whose natural kernel is K , and if all combinators in F are regular, noneliminating, and nonpermuting, must K be a simple kernel? Question 24- How large is the largest set of combinators that satisfies the strong
Collected Works of Larry Wos
1266
(alternatively, weak, reducible weak) fixed point property such that no proper subset does?
5
Summary
In this article, we feature the kernel strategy, which offers (from what we know) the only systematic attack on the construction of expressions or objects that, respectively, establish the presence of the weak and the strong fixed point prop erty. The strategy is also used to construct expressions, called kernels, that establish the presence of the reducible weak fixed point property, a property in troduced in this article (and termed the kernel property earlier in [11]). To use the strategy, one selects a fragment of combinatory logic, a subset whose frosts is obtained by replacing one or both of the combinators 5 and K by some set of combinators. If the first stage of the two-stage kernel strategy succeeds, then the fragment under study is proved to satisfy the weak fixed point property and, further, to satisfy the reducible weak fixed point property. The second stage of the strategy focuses on any successes of the first stage, each of which is called a kernel, and attempts to use the kernel to construct a fixed point combinator. If the second stage succeeds, then the fragment is proved to satisfy the strong fixed point property. Logicians consider that many of the questions focusing on fixed point prop erties often present a substantial challenge and are deep in nature. Therefore, since the kernel strategy often succeeds in less than 5 CPU-seconds on a SPARCstation 1+ when applied by the program OTTER, its formulation marks an important advance for both combinatory logic and for automated reasoning; see Appendix B for a discussion of OTTER that includes appropriate input files. When the focus is on the possible presence of the strong fixed point property, the power of the strategy rests in part on dividing the problem into two subproblems, each of which is substantially more tractable. Its power is also derived from the use of paramodulation (a generalization of equality substitution) and various strategies used to control the application of this inference rule. As evidence of the value of the kernel strategy, we present answers to various open questions (see also [11,19]), each answer obtained (directly and indirectly) by heavy reliance on the strategy. (We note that much of the research reported here was in collaboration with W. McCune, relying heavily on the use of his automated reasoning program OTTER.) Among the highlights, we offer two infinite classes of infinite sets of fixed point combinators for the fragments with respective bases consisting of B and W and of B and N. To complement the results of our research, we pose (in Section 4) various open questions and suggest research topics, some of which focus on the concepts of kernel and reducible weak fixed point property. From the perspective of automated reasoning, a kernel of a fragment A with basis B is an expression K such that K can be demodulated to xK by using some or all of the elements of B as demodulators.
Kernel Strategy and Combin&tory Logic
1267
One feature that makes this study of fixed point properties especially ap pealing from the viewpoint of automated reasoning is its uniformity of success, at least when compared with other studies. In particular, the likelihood of ob taining an answer to some given question is rather high and, in a large fraction of the cases, the CPU time to obtain the answer impressively low. In addition to establishing the value of the kernel strategy, we have demonstrated the value of automated reasoning for an attack on deep questions, especially when the attack relies heavily on the inference rule paramodulation and on strategy to control its application.
Appendix A We devote Appendix A to a proof of the following theorem. T H E O R E M 6. // the kernel strategy is fixed point complete for fragments whose basis is free of permuters, then the fragment A with basis B consisting of B and M alone fails to satisfy the strong fixed point property. Proof. Assume by way of contradiction that A satisfies the strong fixed point property. There must exist, therefore, at least one fixed point combinator F expressed purely in terms of B and M. First, we show that, if F/ is such a combinator, then there exists a fixed point combinator F of A such that F ' reduces to F and F is irreducible with respect to B and M. Let C be a combinator not appearing in F. As a consequence of Lemma 2, there must exist a term t such that F/ reduces to Ct for some term t. Since neither B nor M is an eliminator or a permuter, there must exist a reduction R of F/ to Ct such that the steps focus in order on each of the symbols in F/. If we now consider the possibility of reducing F/ by applying B or M in the order in which they occur in F/ and always focus on a term containing the first symbol of the entire expression, we must succeed in a finite number of steps in producing an irreducible F; otherwise, R could not exist. Since F/ is a fixed point combinator, F must also be, and we have succeeded in our first objective. Second, we show that, if F is an irreducible fixed point combinator of A, if C is a combinator not occurring in F, and if FC reduces to t for any term t, then every term in t that contains an occurrence of C ends with an occurrence of C. If t = FC, then the number of reduction steps that is applied is zero, and the conclusion clearly holds. Let us assume by way of contradiction that there exists a term t violating the conclusion, that the number of reduction steps to obtain t from F C is n > 0, and that all terms tl obtained with fewer than n reduction steps applied to FC satisfy the conclusion. On the reduction path from F C to tthere must exist a term r such that t is obtained from r by reducing with B or with M. By assumption, r must satisfy the conclusion. Also by assumption, t must contain a term s that contains an occurrence of C but that does not end with an occurrence of C. Obviously, * cannot be contained in r. Were s produced
1268
Collected Works of Larry Wos
by applying M to Ms/ to get s/ containing s, one could then conclude the existence of a (not necessarily proper) subterm of st that violates the conclusion, which cannot be since r does not violate the conclusion. Were s produced by applying B to Bdef to obtain d{ef) containing s, then Bdef must contain an occurrence of C, which implies that Bdef must end with an occurrence of C. By combining this observation with the fact that we can rule out the possibility of s being contained in d or e or / because of the assumptions concerning r, we see that again s cannot exist. Since all cases have been considered, the assumption of the existence of a term t violating the conclusion leads to a contradiction, and our second objective is reached. Third, we show that, if F is an irreducible fixed point combinator of A and C is a combinator not occurring in F, then the reduction of F C to t for any term tis such that every step involves an occurrence of C. Since F is irreducible, the only one-step reduction to some term t must involve an occurrence of C. By way of contradiction, let t be a term obtained by reducing FC with a reduction R of length n with n > 1 such that t violates the conclusion and such that all terms obtainable by reductions of F C with fewer steps satisfy the conclusion. Therefore, there exists a term s that is the focus of a reduction step on the path from F C to t such that s does not involve an occurrence of C. Two cases exist for the form of s, Mg and Bdef for appropriate terms. By assumption, s does not occur in the expression r that is reduced to yield the expression containing s, for r can be reached by fewer reduction steps starting with FC. In the first case, the term in r that is reduced to yield Mg has one of three forms: MM, Bmij, or BiMj. The first two forms can be quickly dismissed, for the presence of either leads directly to a term in r violating the assumptions. As for the third form, g = j , which is free of occurrences of C. Then, since the third form reduces to i(Mj), by using the result proved to reach our second objective, BiMj is free of occurrences of C, which contradicts the properties of r. Regarding the second case, seven possibilities exist for the form of the term that yields Bdef. MBij, M(Bi)j, M(Bij), BBijkh, B(Bi)jkh, B(Bij)kh, and Bi(Bjk)h. The first six forms can be dismissed by an argument similar to that used to dismiss the first two of the three forms focusing on Mg. The seventh form can be dismissed by arguing as we did for the third form focusing on Mg. In both cases and for all possibilities, we arrive at a contradiction regarding the properties of r, and the third objective is reached. To complete the proof of the theorem, we note that the existence of some fixed point combinator for A implies the existence of one, call it F, that is irreducible such that Fx reduces to a kernel K that in turn reduces to xK. And it is here that the hypothesis concerning the fixed point completeness of the kernel strategy comes into play. Let us simply focus on some combinator C not present in F and the corresponding instances of K and xK, which we shall rename to K and CK. In the reduction of K to CK, M is used at least once, for CK contains more symbols than does K and B is not a replicator. On the other hand, M is used at most once, for every reduction step involves an occurrence of
Kerne/ Strategy and Combinatory Logic
1269
C (already proved), no step with B or M deletes an occurrence of C, and CK contains exactly one more occurrence of C than does K. Therefore, M is used exactly once, that use replicates exactly one occurrence of C, and the replicated C occurs at the end of the replicated term. The number of occurrences of M in K is equal to the number in CK; the use of B does not have any effect on the number of occurrences of M\ and the one use of M decreases the number of occurrences of M, at least temporarily. Therefore, the one use of M replicates exactly one occurrence of M Let us consider the single use of Mthat reduces Ms to ss for some term s, and let us focus on sequences of symbols in the order in which they occur, sequences involving occurrences of M and C only (ignoring all other symbols). By the preceding observations, the symbol sequence of interest in s is AfC. Therefore, the use of M reduces a sequence of the form MMC to MCMC Since the use of B simply deletes an occurrence of B and rearranges parentheses, the use of B cannot affect a sequence of interest. Thus, the only change in a sequence in the reduction of K to CK results from the use of M. On the one hand, the sequence in K is Si MMCS2 for some (possibly empty) s\ and S2, and the sequence in CK is s\MCMCs2- On the other hand, since the occurrence of K in CK must match K, the sequence in CK is Cs\ MMCs2- We have a contradiction, for no Si and S2 exist to accommodate the two versions of the sequence in CK, and the proof is complete. D
Appendix B To encourage further research in combinatory logic and other areas of mathe matics and logic, here we introduce researchers to a few of the powerful features offered by McCune's automated reasoning program OTTER. With the objec tive of sharply increasing one's understanding of the material presented in this article, we focus heavily on two input files that can be used by this program to apply the kernel strategy. We also include two output files for illustration. OTTER, which has for years played a key role in our research, proved to be invaluable in our study of combinatory logic; it is clearly our favorite program. This general-purpose reasoning program offers its users a wide variety of inference rules, various strategies to restrict and direct their application, and many other effective features. In particular, as illustrated in the input files we give here, the strategies that are offered include one for blocking numerous paths of reasoning, one for imposing the researcher's knowledge and intuition to direct the program's search for significant information, and one for making a breadthfirst search. In addition, OTTER offers a procedure for purging less general information in the presence of more general, and a procedure for canonicalizing and simplifying the form in which information is retained. This program, written in C, runs effectively on workstations, personal com puters, and Macintoshes. Among the languages it accepts are fully quantified
Collected Works of Larry Wos
1270
first-order predicate calculus and the clause language [18, 21]. For information for obtaining a copy of OTTER, one can write by e-mail to otterfimcs. a n l . gov. To obtain input files or additional information, one can e-mail to wosfimcs. a n l . gov. An alternative to e-mail is a newly published book [21], which contains many problems in OTTER notation, open questions for research, various input files, a copy of the program (on diskette), and a tutorial for using the program. Regarding the two input files we give shortly, the first can be used by OTTER to apply stage 1 of the kernel strategy, and the second can be used to apply stage 2. Experimentation with these two files will aid one in understanding this article more fully. For the researcher's convenience, we include in the first input file the clause equivalent (in OTTER notation) of each of the combinators given just before Section 1.1 begins. In the second input file, we include various kernels for possible experimentation. Each file consists of a sequence of instructions to OTTER, a list of weight templates that affect both the program's search for information and the nature of the conclusions that are retained, and two lists of clauses called, respectively, 'usable' and 'sos' (set of support). The object of partitioning the input clauses into the two cited lists is that of using the set of support strategy [23, 28, 21] to restrict the application of the chosen inference rule or rules, in the case of the two files, paramodulation. In particular, when OTTER applies an inference rule to some set of clauses chosen from the database it maintains, one member (the focal clause) of the set must have at one time been a member of list(sos); when a clause is retained, it is adjoined to list(sos). Keeping in mind that the presence of'%' causes OTTER to treat the corre sponding material from that symbol to the end of the line as a comment, let us begin with the input file for applying stage 1 of the kernel strategy, and then discuss the file in some detail. The clauses rely on the use of'-' for logical not, 'I' for logical or, the function a that is implicitly present in combinatory logic to mean that one combinator is 'applied' to another, and the ANSWER literal to present the results of any successes. Input File for Stage 1 set(para_into). set(para_from_right). clear(para_from_left). set(para_into_right). clear(para_into_left). clear(back.sub). clear(print_kept). V, set(para_ones_rule). 7. set(para_into_vars) . % set(para_from_vars). set(bird_print).
Kernel Strategy and Combinatory Logic
'/, set(very_verbose) . '/, set(sos_queue) . '/, set(input_sos_first). assign(max_proofs,0). assign(max.seconds,5). assign(max_mem,2000). assign(max.weight,1). weight_list(purge_gen). weight(x,-1000). end_of_list. list(usable). EQUAL(x,x). '/, The combinators Ml and U2 were suggested by Piperno. V, regular isolators (including replicators) EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). '/. EQUAL(a(I,x),x). 7. EQUAL(a(a(K,x),y),x). 7. EQUAL(a(a(L.x).y),a(x,a(y,y))). 7. EQUAL(a(a(a(Ql,x) ,y) ,z) ,a(x,a(z,y))) . 7. irregular isolators (including replicators) 7. 7. 7. 7. 7. 7. 7. 7. 7. 7.
EQUAL(a(M,x),a(x,x)). EQUAL(a(a(0,x),y),a(y,a(x,y))). EQUAL(a(a(01,x),y),a(y,a(a(x,y),a(x,y)))). EQUAL(a(a(a(Q,x) ,y) ,z) ,a(y ,a(x,z))). EqUAL(a(a(a(Rl,x),y),z),a(y,a(z,x))). EQUAL(a(a(T,x),y),a(y,x)). EQUAL(a(a(U,x) ,y) ,a(y,a(a(x,x) ,y))). EQUAL(a(a(a(a(Ul,x),y),z),u),a(u,a(a(a(a(x,x), a(y,z)),z),u))). EQUAL(a(a(a(U2,x),y),z),a(z,a(a(a(x,x),a(y,x)),z))).
7. regular replicators (non-isolating) 7. EQUAL(a(a(a(H,x) ,y) ,z) ,a(a(a(x,y) ,z) ,y)). 7. EQUAL(a(a(a(N,x) ,y) ,z) ,a(a(a(x,z) ,y) ,z)). 7. EQUAL(a(a(a(Nl ,x) ,y) ,z) ,a(a(a(x,y) ,y) ,z)) . 7. EQUAL(a(a(a(S,x),y),z),a(a(x,z),a(y,z))). EqUAL(a(a(W,x),y),a(a(x,y),y)) .
1271
Collected Works of Larry Wos
1272
% i r r e g u l a r r e p l i c a t o r s (non-isolating) 7. EQUAL(a(a(Ml,x) ,y) ,a(a(a(x,x) ,y) ,y)) . 7, EQUAL(a(a(a(Q2,x),y),z),a(a(y,a(x,z)),a(a(a(x.y),x),z))). V. EQUAL(a(a(Wl,x) ,y) ,a(a(y,x) , x ) ) . '/, others, non-isolating non-replicating 7. EQUAL(a(a(a(C,x) ,y) ,z) ,a(a(x,z) ,y)) . '/. EQUAL(a(a(a(R,x) ,y) ,z) ,a(a(y ,z) ,x)). end_of_list. list(sos). -EQUAL(y,a(f,y)) I $ANSWER(y). end_of_list.
The first five lines of the preceding input file instruct OTTER to use as inference rule paramodulation, restricting its application by (1) requiring that the equality substitution always be into a term in the focal clause chosen from list(sos), (2) requiring that the from argument be the right-hand argument of an equality and the into term be in the right-hand argument of a literal, and (3) blocking both the use of the left-hand argument of an equality as a from argument and any terms in the left-hand argument as into terms. The next two lines of the file respectively instruct the program to suppress the use of back subsumption (a procedure for discarding an existing clause when a newly retained clause is more general than it) and to avoid printing (in the output file) newly retained clauses. OTTER treats the eighth line of the file as a comment and ignores it; if the '%' were removed, then paramodulation would be further restricted by use of the l's rule strategy (see Section 2.4). Were they not considered as comments, lines nine and ten would, respectively, give permission to the program to paramodulate from and into variables; because paramodulation from or into a variable always succeeds, it is generally best to block such paths of reasoning, for the corresponding conclusions are usually of little or no value. Obviously, cases exist in which one must allow such paths to be explored, for example, in the case of the combinators / and K. Of the commented and uncommented instructions to OTTER found in the preceding input file, only the tenth, set(bird_print), is tailored to combinatory logic. Use of this command causes OTTER to print information by observing the conventions of combinatory logic, assuming expressions are left associated unless otherwise indicated and omitting all occurrences of the function a for 'applies'. As for the next three commands, set(very.verbose) is used when one wishes to
Kernel Strategy and Combinatory Logic
1273
investigate OTTER's work more fully - for example, when one is puzzled by an apparent failure to deduce an expected conclusion - set(sos.queue) is used to instruct OTTER to make a breadth-first search, and set(input-sos.first) is used to instruct the program to focus on all input clauses in list(sos) before focusing on any deduced clause. Of the four 'assign' commands, the first (because of the value 0) instructs the program to place no limit on the number of proofs it can find within the CPU time and memory allotted, the second places a limit on the CPU time to be used, and the third places a limit on the memory usage (in kilobytes). Especially valuable in research in general is the feature relying on the parameter governing the number of proofs to be sought, enabling OTTER to continue its attack on a question even though one answer has been found - thus perhaps leading to a multitude of answers. Providing one with an understanding of the final command, set(max.weight,l), in the given input file, as well as an appreciation of the list that follows it, re quires a fair amount of detail. The inclusion of this command causes OTTER to retain a conclusion only if its weight [8, 18, 21] (complexity) is less than or equal to 1, where the weight is determined by symbol count or by recourse to templates included in the input file (see, for example, the list that follows the command). If, instead, one wishes the program to retain conclusions of greater complexity, one merely replaces the value 1 by the preferred limit or, by remov ing this command, places no limit on complexity of retained information. The list that follows the max.weight command contains a single weight template, weight(x,-1000), whose presence has OTTER assign to each variable in a con clusion the value -1000. The objective of the combination of setting max.weight to 1 and including the given list with its single template is to discard any con clusion that is free of variables. In contrast to using weighting solely to discard conclusions, we see in the second input file how it can be used also to direct a program's search. Of the clauses found in the preceding input file, exactly four are not com mented out and hence are accessible to OTTER for consideration: that for reflexivity of equality, that for the combinator B, that for the combinator W, and that for the assumption that the weak fixed point property fails to hold. Therefore, use of this input file will cause OTTER to focus on the fragment of combinatory logic whose basis consists of B and W alone. To experiment with stage 1 of the kernel strategy in the context of some other fragment - whether discussed in this article or not - one makes the appropriate choice of basis ele ments, which may require one to include clauses not present in the given input file. As for stage 2, one can take the successes (if any) obtained from stage 1 experiments and use them with the appropriate variant of the following input file to seek fixed point combinators. To see how one might proceed, let us assume that we have obtained from a successful use of the preceding file five kernels, Ki through K5 (see Sections 2.2 and 2.3), and let us focus on the following file
Collected Works of L&rry Wos
1274
and the discussion that follows it. (Further illustration is provided by the two output files we include later in this appendix.) Input File for Stage 2 set(para_into). set(para_from_right). clear(para_from_left). '/, set(para_into_right). '/. clear(para_into_left). clear(back.sub). clear(print_kept). set(para_ones_rule). V, set(para_from_vars). V, set(para_into_vars). set(bird_print). % set(very.verbose). % set(sos.queue). V, set(input_sos_first). assign(max_proofs,0). assign(max_seconds,5). assign(max_mem,2000). % assign(max_weight,l). V. weight_list(purge_gen). '/. weight(x,-1000). '/. end_of_list. '/, The following weight list permits finding five length 8 fixed V, point combinators (for the fragment with basis consisting '/, of B and W in one run by preferring a kernel generator. weight_list(pick_and_purge). weight(a(W,a(B,a(B,x))),1). weight(a(W,a(a(a(B,B),B),x)),l). weight(a(a(a(B,W),B),a(B,x)),1). weight(a(a(a(B,W),a(a(B,B),B)),x),1)• weight(a(a(a(B,a(a(B,W),B)),B),x),1)• end_of_list. list(usable). EQUAL(x.x). EqUAL(a(a(a(B,x),y),z),a(x,a(y,z))). EQUAL(a(a(W,x),y),a(a(x,y),y)). -FIXED(a(y,g(y)),g(y)) | $ANSWER(y).
Kernel Strategy and Combinatory Logic
1275
end_of_list. list(sos). 7, The following comments and clauses focus on B and W. 7, fixed point combinators of length 8. FIXED(a(a(a(W,a(B,a(B,x))),a(W,a(B,a(B,x)))),a(W, a(B,a(B,x)))),x). FIXED(a(a(a(W,a(a(a(B,B),B),x)),a(W,a(a(a(B,B),B),x))), a(W,a(a(a(B,B),B),x))),x). FIXED(a(a(a(a(a(B,W),B),a(B,x)),a(a(a(B,W),B),a(B,x))), a(a(a(B,W),B),a(B,x))),x). FIXED(a(a(a(a(a(B,W),a(a(B,B),B)),x),a(a(a(B,W),a(a(B,B), B)),x)), a(a(a(B,W),a(a(B,B),B)),x)),x). FIXED(a(a(a(a(a(B,a(a(B,W),B)),B),x),a(a(a(B,a(a(B,W),B)), B),x)),a(a(a(B,a(a(B,W),B)),B),x)),x). 7. The following five kernels are corresponding companions '/, leading to the five length 9 fixed point combinators. 7. FIXED(a(a(a(a(B,W),a(B,a(B,x))),a(a(B,W),a(B,a(B,x)))), 7. a(a(B,W),a(B.a(B.x)))),x). 7. FIXED(a(a(a(a(B,W),a(a(a(B,B),B),x)),a(a(B,W), 7. a(a(a(B,B),B),x)))a(a(B,W),a(a(a(B,B),B),x))),x). 7. FIXED(a(a(a(a(a(B,a(B,W)),B),a(B,x)),a(a(a(B,a(B,W)),B), 7. a(B,x))),a(a(a(B,a(B,W)),B),a(B,x))),x). 7. FIXED(a(a(a(a(a(B,a(BlW)),a(a(B,B),B)),x),a(a(a(B,a(B,W)), 7. a(a(B,B),B)),x)),a(a(a(B,a(B,W)),a(a(B,B),B)),x)),x). 7. FIXED(a(a(a(a(a(B,a(a(B,a(B,W)),B)),B),x),a(a(a(B, 7. a(a(B,a(B,W)),B)),B),x)),a(a(a(B,a(a(B,a(B,W)),B)),B), 7. x)),x). 7. The following are the five kernel schemata that can be 7. used to obtain the five length 8 fixed point combinators. 7. FIXED(a(a(a(W,a(B,a(B,x))),a(W,a(B,a(B,x)))),z),x). 7. FIXED(a(a(a(W,a(a(a(B,B).B),x)),a(W,a(a(a(B,B),B>,*)))> 7. z),x). 7. FIXED(a(a(a(a(a(B,W),B),a(B,x)),a(a(a(B,W),B),a(B.x))), 7. z),x). 7. FIXED(a(a(a(a(a(B,W),a(a(B,B),B)),x),a(a(a(B,W), 7. a(a(B,B),B)),x)),z),x). 7. FIXED(a(a(a(a(a(B,a(a(B,W),B)),B),x),a(a(a(B, 7. a(a(B,W),B)),B),x)),z),x).
Collected Works of Larry Wos
1276
7, The following kernel is the 0-th for B and W. 7. FIXED(a(a(W,a(B,x)),a(W,a(B,x))),x). V, The following focuses on B and N. '/, The following five kernels are the first five for B and V, N in order. '/. FIXED(a(a(a(N,a(B,a(B,x))),a(N,a(B,a(B,x)))), */. a(N,a(B,a(B,x)))),x). '/. FIXED(a(a(a(N,a(a(a(B,B) ,B) ,x)) ,a(N,a(a(a(B,B) ,B) ,x))), 7. a(N,a(a(a(B,B),B),x))),x). 7. FIXED(a(a(a(a(a(B,N),B),a(B,x)),a(a(a(B,N),B),a(B,x))), 7, a(a(a(B,N),B),a(B,x)')),x). 7. FIXED(a(a(a(a(a(B,N),a(a(B,B),B)),x),a(a(a(B,N), 7. a(a(B,B),B)),x)),a(a(a(B,N),a(a(B,B),B)),x)),x). 7. FIXED(a(a(a(a(a(B,a(a(B,N) ,B)) ,B) ,x), 7, a(a(a(B,a(a(B,N),B)),B),x)),a(a(a(B,a(a(B,N),B)), 7, B),x)),x). end_of_list.
A comparison of the commands to OTTER found in the preceding file with those found in that given for stage 1 shows that paramodulation is now restricted by the 1 's rule strategy in addition to the requirement that the from argument be the right-hand argument. The comparison also shows that no limit is placed on the weight or complexity of a retained conclusion. Next, one notes that, rather than using list(purge-gen) to discard clauses free of variables, the choice is list(pick-and.purge) to direct OTTER's search for proofs. The presence of the five templates found in list(pick_and_purge) causes the program to prefer over other clauses those containing as a term a generator of one of the kernels Ki through K5. Regarding the clauses found in the input file for stage 2, as in the file for stage 1, one again finds in list(usable) those for reflexivity and for the combinators B and W. However, one also finds in the stage 2 file a negative clause, that used to determine assignment completion. Finally, in contrast to the stage 1 file, list(sos) in the stage 2 file contains positive clauses, one for each of the five kernels under study. If the stage 2 input file is used as given, then OTTER will find in one run the five fixed point combinators of length 8, those discussed and presented in Section 3.2. In contrast to the preceding input file, it is important to note that the standard use of stage 2 would focus on one kernel at a time and would also not rely on weight templates. For a glimpse of how we typically use OTTER to apply the kernel strategy, let us focus on two output files produced by one of the experiments that proved most rewarding. The study concerns the fragment with basis consisting of B and N alone. In the first file, one sees that OTTER finds a kernel for the fragment,
KerneJ Strategy and Combinatory Logic
1277
namely, the argument of the ANSWER literal in the last clause of the proof, with the constant / replaced by the variable x. In the following proof, para.into,4,2 means that the paramodulation is from clause 2 into clause 4. A Sample O u t p u t File for Stage 1 OTTER 2 . 2 , July 1991 The job began on lutra.mcs.anl.gov, Mon Mar 16 17:12:39 1992 The command was "otter4+". set(para_into). WARNING: set(para_from_right) flag already set. set(para_from_right). clear(para_from_left). WARNING: set(para_into_right) flag already set. set(para_into_right). clear(para_into_left). clear(back_sub). clear(print_kept). WARNING: assign(max_proofs,l) already has that value. assign(max_proofs,1). assign(max.seconds,5). assign(max.mem,2000). assign(max.weight,1). weight_list(purge_gen). weight(x,-1000). end_of_list.
list(usable). 1 [] EqUAL(x.x). 2 [] EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). 3 [] EQUAL(a(a(a(N,x),y),z),a(a(a(x,z),y),z)). end_of_list. list(sos). 4 [] -EqUAL(y,a(f,y)) I $ANSWER(y). end_of_list. given clause #1: (wt-5) 4 [] -EQUAL(y,a(f,y)) I $ANSWER(y). given clause #2: (wt»ll) 5 [para_into,4,2] -EQUAL(a(x,y),a(a(a(B,f),x),y)) I $ANSWER(a(x,y)). > UNIT CONFLICT at 0.07 sec > 7 [binary,6,3] $ANSWER(a(a(a(N,a(B,a(B,f))),v65),a(N,a(B,a(B,f))))).
Collected Works of Larry Wos
1278
Length of proof is 2. __
__
__
__
pR00F
__
__
__
__
2 3 4 5
[] EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). [] EQUAL(a(a(a(N,x),y),z),a(a(a(x,z),y),z)). [] -EQUAL(y,a(f,y)) I $ANSWER(y). [para_into,4,2] -EQUAL(a(x,y),a(a(a(B,f),x),y)) I $ANSWER(a(x,y)). 6 [para_into,5,2] -EQUAL(a(a(x,y),z),a(a(a(a(B,a(B,f)),x), y).z)) I $ANSVER(a(a(x,y),z)). 7 [binary,6,3] $ANSVER(a(a(a(N,a(B,a(B,f))),v65), a(N,a(B,a(B,f))))). —
—
—
—
end of proof
—
—
—
—
-
— — — — — statistics clauses input 4 clauses given 2 clauses generated 2 demod ft eval rewrites 0 clauses wt.lit.sk delete 0 tautologies deleted 0 clauses forward subsumed 0 (subsumed by sos) 0 clauses kept 2 empty clauses 1 clauses back subsumed 0 sos size 1 Kbytes malloced 31
—
—
—
—
-
— — — — times (seconds) — — — — run time 0.06 (run time 0 hr, 0 min, 0 sec) system time 0.14 input time 0.02 clausify time 0.00 para_into time 0.00 pre.process time 0.02 demod time 0.00 weigh cl time 0.00 for_- time 0.00 renumber time 0.00
Kernel Strategy and Combinatory Logic
1279
keep c l time 0.00 p r i n t _ c l time 0.00 c o n f l i c t time 0.01 post.process time 0.00 back.- time 0.00 lex.rpo time 0.00 The job finished Mon Mar 16 17:12:39 1992 For the second file, we extract the kernel from the first file by making the appropriate notational changes. In particular, we take the argument of the AN SWER literal in the final line (the empty clause) of the proof, replace the con stant / by the variable x, and use the result as the first argument of a unit clause whose 2-place predicate is FIXED. A Sample O u t p u t File for Stage 2 OTTER 2 . 2 , July 1991 The job began on lutra.mcs.anl.gov, Mon Mar 16 17:16:55 1992 The command was "otter4+". set(para.into). WARNING: set(para.from.right) flag already set. set(para_from_right). clear(para.from.left). clear(back.sub). clear(print.kept). set(para.ones.rule). WARNING: assign(max_proofs, 1) already has that value. assign(max.proofs.l). assign(max.seconds,5). assign(max.mem,2000). list(usable). 1 [] EqUAL(x.x). 2 [] EqUAL(a(a(a(B,x),y),z),a(x,a(y,z))). 3 [] EQUAL(a(a(a(N,x),y),z),a(a(a(x,z),y),z)). 4 [] -FIXED(a(y,g(y)),g(y)) I $ANSWER(y). end.of.list. list(sos). 5 [] FIXED(a(a(a(N,a(B,a(B,x))),z),a(N,a(B,a(B,x)))).x). end.of.list. given clause #1: (wt-19) 5 [] FIXED(a(a(a(N,a(B,a(B,x))),z),a(N,a(B,a(B,x)))),x).
1280
Collected Works of Larry Wos
given clause #2: (wt=21) 6 [para_into,5,2] FIXED(a(a(a(a(a(B,N),B),a(B,x)),y),a(N,a(B,a(B,x)))),x). given clause #3: (wt=21) 8 [para_into,5,2] FIXED(a(a(a(B,a(a(N,a(B,a(B,x))),y)),N),a(B,a(B,x))),x). given clause #4: (wt-21) 10 [para_into,6,3] FIXED(a(a(a(a(N,a(B,N)),a(B,x)),B),a(N,a(B,a(B,x)))),x). given clause #5: (wt-23) 7 [para_into,5,2] FIXED(a(a(a(a(B,a(N,a(B,a(B,x)))),y),z), a(N,a(B,a(B,x)))),x). given clause #6: (wt-23) 9 [para_into,6,2] FIXED(a(a(a(a(a(B,a(a(B,N),B)),B),x),y),a(N, a(B,a(B,x)))),x). given clause #7: (wt-23) 12 [para_into,6,2] FIXED(a(a(a(B,a(a(a(a(B,N),B),a(B,x)),y)),N), a(B,a(B,x))),x). given clause #8: (wt-23) 13 [para_into,8,2]
FIXED(a(a(a(a(a(B,B),a(N,a(B,a(B,x)))),y),N), a(B,a(B,x))),x). given clause #9: (wt-23) 14 [para_into,8,2] FIXED(a(a(a(B,a(a(B,a(a(N,a(B,a(B,x))),y)),N)),B), a(B,x)).x). given clause #10: (wt=23) 15 [para_into,10,2] FIXED(a(a(a(a(a(a(B,N),B),N),a(B,x)),B),a(N,a(B, a(B.x)))),x). given clause #11: (wt-23) 16 [para_into,10,2] FIXED(a(a(a(a(a(B,a(N,a(B,N))),B),x),B),a(N. a(B.a(B,x)))),x). given clause #12: (wt-23) 17 [para_into,10,2] FIXED(a(a(a(B,a(a(a(N,a(B,N)),a(B,x)),B)),K), a(B,a(B,x))),x). given clause #13: (wt-23) 20 [para_into,7,3] FIXED(a(a(a(a(N,B),x),a(N,a(B,a(B,y)))),a(N, a(B,a(B,y)))),y). given clause #14: (wt-23) 22 [para_into,7,3] FIXED(a(a(a(N,a(B,a(N,a(B,a(B,x))))),y), a(N,a(B,a(B,x)))),x). given clause #15: (wt-23) 27 [para_into,9,3] FIXED(a(a(a(a(N,a(B,a(a(B,N),B))),x),B), a(N,a(B,a(B.x)))),x). given clause #16: (wt-23) 33 [para_into,13,3] FIXED(a(a(a(a(a(N,B),a(N,a(B,a(B,x)))),B),N), a(B,a(B,x))),x). given clause #17: (wt-23) 35 [para_into,13,3] FIXED(a(a(a(N,a(a(B,B),a(N,a(B,a(B,x))))),N),
Kernel Strategy and Combinatory
Logic
a(B,a(B,x))),x). g i v e n c l a u s e #18: (wt-23) 39 [ p a r a _ i n t o , 1 5 , 3 ] FIXED(a(a(a(a(a(a(N,B),B),N),a(B,x)),B), a(N,a(B,a(B,x)))),x). g i v e n c l a u s e #19: (wt»23) 45 [ p a r a _ i n t o , 1 6 , 3 ] FIXED(a(a(a(a(N,a(B,a(N,a(B,N)))),x),B),a(N, a(B,a(B,x)))),x). g i v e n c l a u s e #20: (wt-23) 51 [ p a r a _ i n t o , 2 0 , 3 ] FIXED(a(a(a(N,a(N,B)),a(N,a(B,a(B,x)))), a(N,a(B,a(B,x)))),x). g i v e n c l a u s e #21: (wt-23) 60 [ p a r a _ i n t o , 3 3 , 3 ] FIXED(a(a(a(a(a(N,N),a(N,a(B,a(B,x)))),B),N), a(B,a(B,x))),x). g i v e n c l a u s e #22: (wt-25) 11 [ p a r a _ i n t o , 6 , 2 ] FIXED(a(a(a(a(B,a(a(a(B,N),B),a(B,x))),y),z), a(N,a(B,a(B,x)))),x). g i v e n c l a u s e #23: (wt-25) 18 [ p a r a _ i n t o , 7 , 2 ] FIXED(a(a(a(a(a(a(B,B),N),a(B,a(B,x))),y),z), a(N,a(B,a(B,x)))),x). g i v e n c l a u s e #24: (wt-25) 23 [ p a r a _ i n t o , 7 , 2 ] FIXED(a(a(a(B.a(a(a(B,a(N,a(B,a(B,x))))>y),z)),N), a(B.a(B,x))),x). g i v e n c l a u s e #25: (wt-25) 24 [ p a r a _ i n t o , 9 , 2 ] FIXED(a(a(a(a(a(a(a(B,B),a(B,N)),B),B),x),y), a(N,a(B,a(B,x)))),x). g i v e n c l a u s e #26: (wt-25) 29 [ p a r a _ i n t o , 9 , 2 ] FIXED(a(a(a(B,a(a(a(a(B,a(a(B,N),B)),B),x),y)),N), a(B,a(B,x))).x). g i v e n c l a u s e #27: (wt-25) 30 [ p a r a _ i n t o , 1 2 , 2 ] FIXED(a(a(a(a(a(B,B),a(a(a(B,N),B),a(B,x))),y),N), a(B,a(B,x))),x). g i v e n c l a u s e #28: (wt-25) 31 [ p a r a _ i n t o , 1 2 , 2 ] FIXED(a(a(a(B,a(a(B,a(a(a(a(B,N),B),a(B,x)),y)),N)),B), a(B,x)),x). g i v e n c l a u s e #29: (wt-25) 32 [ p a r a _ i n t o , 1 3 , 2 ] FIXED(a(a(a(a(a(a(B,a(B,B)),N),a(B,a(B,x))),y),N), a(B,a(B,x))),x). g i v e n c l a u s e #30: (wt-25) 36 [ p a r a _ i n t o , 1 3 , 2 ] FIXED(a(a(a(B,a(a(a(a(B,B),a(N,a(B,a(B,x)))),y),N)),B). a(B,x)),x). g i v e n c l a u s e #31: (wt-25) 37 [ p a r a _ i n t o , 1 4 , 2 ] FIXED(a(a(a(a(a(B,B),a(B,a(a(N,a(B,a(B,x))),y))),N),B), a(B,x)).x). g i v e n c l a u s e #32: (wt-25) 38 [ p a r a _ i n t o , 1 4 , 2 ]
1281
1282
Collected Works of Larry Wos FIXED(a(a(a(B,a(a(B,a(a(B,a(a(N,a(B,a(B,x))),y)),N)), B)),B),x),x). given clause #33: (wt-25) 40 [para_into,15,2] FIXED(a(a(a(a(a(B,a(a(a(B,N),B),N)),B),x),B), a(N,a(B,a(B,x)))),x). given clause #34: (wt»25) 41 [para_into,15,2] FIXED(a(a(a(B,a(a(a(a(a(B,N),B),N),a(B,x)),B)),N), a(B,a(B,x))),x). given clause #35: (wt-25) 42 [para_into,16,2] FIXED(a(a(a(a(a(a(a(B,B),N),a(B,N)),B),x),B), a(N,a(B,a(B,x)))),x). given clause #36: (wt«25) 46 [para_into,16,2] FIXED(a(a(a(B,a(a(a(a(B,a(N,a(B,N))),B),x),B)),N), a(B,a(B,x))),x). given clause #37: (wt-25) 47 [para_into,17,2] FIXED(a(a(a(a(a(B,B),a(a(N,a(B,N)),a(B,x))),B),N), a(B,a(B,x))),x). given clause #38: (wt-25) 48 [para_into,17,2] FIXED(a(a(a(B,a(a(B,a(a(a(N,a(B,N)),a(B,x)),B)),N)),B), a(B,x)),x). given clause #39: (wt-25) 50 [para_into,20,2] FIXED(a(a(a(a(B,a(a(N,B),x)),N),a(B,a(B,y))),a(N, a(B,a(B,y)))),y). given clause #40: (wt-25) 52 [para_into,20,2] FIXED(a(a(a(B,a(a(a(N,B),x),a(N,a(B,a(B,y))))),N), a(B,a(B,y))),y). given clause #41: (wt-25) 53 [para_into,22,2] FIXED(a(a(a(a(a(B,N),B),a(N,a(B.a(B,x)))),y), a(N,a(B,a(B,x)))),x). given clause #42: (wt-19) 144 [para_into,53,3] FIXED(a(a(a(N,a(a(B,N),B)),x),a(N,a(B,a(B,y)))),y). given clause #43: (wt-21) 146 [para_into,144,2] FIXED(a(a(a(a(a(B,N),a(B,N)),B),x),a(N,a(B,a(B,y)))),y). given clause"#44: (wt-21) 148 [para_into,144,2] FIXED(a(a(a(B,a(a(N,a(a(B,N),B)),x)),N),a(B,a(B,y))),y). given clause #45: (wt-21) 150 [para_into,146,3] FIXED(a(a(a(a(N,a(B,N)),B),a(B,N)),a(N,a(B,a(B,x)))),x). given clause #46: (wt-19) 156 [para_into,150,3] FIXED(a(a(a(a(N,N),B),a(B,N)),a(N,a(B,a(B,x)))),x). given clause #47: (wt-21) 159 [para.into,156,2] FIXED(a(a(a(a(B,a(a(N,N),B)),B),N),a(N,a(B,a(B,x)))),x). given clause #48: (wt-21) 160 [para_into,156,2] FIXED(a(a(a(B,a(a(a(N,N),B),a(B,N))),N),a(B,a(B,x))),x). given clause #49: (wt-23) 147 [para_into,144,2]
Kernel Strategy and Combinatory Logic
1283
FIXED(a(a(a(a(B,a(N,a(a(B,N),B))),x),y),a(N, a(B,a(B,z)))),z). given clause #50: (wt=23) 149 [para_into,146,2] FIXED(a(a(a(a(a(a(B.a(B,N)),B),N),B),x),a(N,a(B, a(B,y)))),y). given clause #51: (wt»23) 152 [para_into,146,2] FIXED(a(a(a(B,a(a(a(a(B,N),a(B,N)),B),x)),N), a(B,a(B,y))),y). given clause #52: (wt-23) 153 [para.into,148,2] FIXED(a(a(a(a(a(B,B),a(N,a(a(B,N),B))),x),N), a(B,a(B,y))),y). given clause #53: (wt=23) 154 [para_into,148,2] FIXED(a(a(a(B,a(a(B,a(a(N,a(a(B,N),B)),x)),N)),B), a(B,y)),y). > UNIT CONFLICT at 0.93 sec > 185 [binary,184,4] $ANSWER(a(a(B,a(a(B,a(a(B,a(a(N,a(a(B,N),B)),x)), N)),B)),B)). Length of proof is 7.
__ 2 3 4 5 7
__
_. —
PROOF
—
—
—
—
[] EQUAL(a(a(a(B,x),y),z),a(x,a(y,z))). [] EQUAL(a(a(a(N,x),y),z),a(a(a(x,z),y),z)). [] -FIXED(a(y,g(y)),g(y)) I $ANSWER(y). [] FIXED(a(a(a(N,a(B,a(B,x))),z),a(N,a(B,a(B,x)))),x). [para_into,5,2] FIXED(a(a(a(a(B,a(N,a(B,a(B,x)))),y),z), a(N,a(B,a(B,x)))),x). 22 [para_into,7,3] FIXED(a(a(a(N,a(B,a(N,a(B,a(B,x))))),y), a(N,a(B,a(B,x)))),x). 53 [para_into,22,2] FIXED(a(a(a(a(a(B,N),B),a(N, a(B,a(B,x)))),y),a(N,a(B,a(B,x)))),x). 144 [para_into,53,3] FIXED(a(a(a(N,a(a(B,N),B)),x), a(N,a(B,a(B,y)))),y). 148 [para.into,144,2] FIXED(a(a(a(B,a(a(N, a(a(B,N),B)),x)),N),a(B,a(B,y))),y). 154 [para.into,148,2] FIXED(a(a(a(B,a(a(B,a(a(N, a(a(B.N),B)),x)),N)),B),a(B,y)),y). 184 [para.into,154,2] FIXED(a(a(a(B, a(a(B,a(a(B,a(a(N,a(a(B,N),B)),x)),N)),B)),B),y),y). 185 [binary,184,4]$ANSWER(a(a(B,a(a(B,a(a(B, a(a(N,a(a(B,N),B)),x)),N)),B)),B)).
CoJJected Worics of Larry Wos
1284 proof
clauses input clauses given clauses generated demod & aval rewrites tautologies deleted clauses forward subsumed (subsumed by sos ) clauses kept empty clauses clauses back subsumed sos size Kbytes malloced
—
—
—
—
-
5 53 179 0 0 0 0 179 1 0 127 191
— — — — times (seconds) — — — — 0.88 (run time 0 hr, 0 m: run time 0.35 system time 0.02 input time 0.00 clausify time para.into time 0.15 pre_process time 0.50 0.00 demod time weigh cl time 0.00 0.02 for_- time renumber time 0.03 keep cl time 0.35 print_cl time 0.00 conflict time 0.05 post.process time 0.00 back_- time 0.00 lex_rpo time 0.00 The job finished Mon Mar 16 17:16:56 1992
0 sec)
We thus have an excellent example of how valuable the kernel strategy is - for the cited experiment provides an unexpected alternative answer to Smullyan's question, Question 5 - and how effective this strategy is when applied by OT TER. Indeed, in negligible CPU time on a SPARCstation 1+, OTTER estab lishes that the fragment under study satisfies the strong fixed point property, presenting (as the argument of the ANSWER literal in the final line) a set of appropriate combinators, each obtainable by setting the variable x to an ex pression purely in terms of B and N. In contrast, to experience firsthand how
Kernei Strategy and Combinatory Logic
1285
unsatisfying is the approach one might ordinarily take when seeking to establish the presence of the strong fixed point property, and thus experience in compari son the power of the kernel strategy, one begins with the second of the two given input files. One then removes the negative clause from list(usable) and replaces all clauses in list(sos) by the following. -EqUAL(a(y,f(y)),a(f(y).a(y,f(y)))). At that point, one is prepared for appropriate experimentation, requiring among other actions replacement of the templates in list(pick-and.purge) and modifi cation of the restrictions on' paramodulation. Of course, a fuller experience is gained by next studying other fragments, for example, the fragment with ba sis consisting of B and N alone. Since the use of the standard approach to the study of B and W or the study of B and N is likely to produce disappointing results, one might next study more cooperative fragments, such as that with basis consisting of S and L alone. If one performs the suggested experiments, one will see that the formulation of the kernel strategy does indeed mark a significant advance for automated reasoning and for combinatory logic.
References 1. Barendregt, H. P., The Lambda Calculus: Its Syntax and Semantics, NorthHolland, Amsterdam (1981). 2. Boyer, R., Lusk, E., McCune, W., Overbeek, R., Stickel, M., and Wos, L., 'Set theory in first-order logic: clauses for Godel's axioms', J. Automated Reasoning 2, 287-327 (1986). 3. Bundy, A., Personal correspondence (1988). 4. Curry, H. B., and Feys, R., Combinatory Logic I, North-Holland, Amster dam (1958). 5. Curry, H. B., Hindley, J. R., and Seldin, J. P., Combinatory Logic II, North-Holland, Amsterdam (1972). 6. Hindley, J. R., and Seldin, J. P., Introduction to Combinators and Lambda Calculus, Cambridge University Press, Cambridge (1986). 7. Jacopini, G., Personal correspondence (1989). 8. McCharen, J., Overbeek, R., and Wos, L., 'Complexity and related en hancements for automated theorem-proving programs', Computers and Mathematics with Applications 2, 1-16 (1976).
1286
Collected Works of Larry Wos
9. McCune, W., OTTER 2.0 Users Guide, Technical Report ANL-90/9, Argonne National Laboratory, Argonne, Illinois (1990). 10. McCune, W., Personal correspondence (1988). 11. McCune, W., and Wos, L., 'The absence and the presence of fixed point combinators', Theoretical Computer Science, 87, pp. 221-228 (1991). 12. McCune, W., and Wos, L., 'A case study in automated theorem proving: Finding sages in combinatory logic', J. Automated Reasoning 3, no. 1, 91-108 (February 1987). 13. Piperno, A., Personal correspondence (1989). 14. Robinson, G., and Wos, L., 'Paramodulation and theorem-proving in firstorder theories with equality', in Machine Intelligence 4 (eds. B. Meltzer and D. Michie), Edinburgh University Press, Edinburgh, pp. 135-150 (1969) 15. Smullyan, R., Personal correspondence (1987). 16. Smullyan, R., To Mock a Mockingbird, Alfred A. Knopf, New York (1985). 17. Statman, R., Personal correspondence with Raymond Smullyan (1986). 18. Wos, L., Automated Reasoning: S3 Basic Research Problems, PrenticeHall, Englewood Cliffs, N.J. (1987). 19. Wos, L., and McCune, W. W., Searching for Fixed Point Combinators by Using Automated Theorem Proving: A Preliminary Report, Technical Re port ANL-88-10, Argonne National Laboratory, Argonne, Illinois (1988). 20. Wos, L., Overbeek, R., and Henschen, L., 'Hyperparamodulation: a re finement of paramodulation', in Proceedings of the Fifth Conference on Automated Deduction, Lecture Notes in Computer Science, Vol. 87 (ed. R. Kowalski and W. Bibel), Springer-Verlag, New York, pp. 208-219 (July 1980). 21. Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: Introduction and Applications, 2nd ed., McGraw-Hill, New York (1992). 22. Wos, L., and Robinson, G., 'Maximal models and refutation complete ness: Semidecision procedures in automatic theorem proving', in Word Problems: Decision Problems and the Burnside Problem in Group The ory (eds. W. Boone, F. Cannonito, and R. Lyndon), North-Holland, New York, pp. 609-639 (1973). 23. Wos, L., Robinson, G., and Carson, D., 'Efficiency and completeness of the set of support strategy in theorem proving', J. ACM, 12, 536-541 (1965).
Kernel Strategy and Combinatory Logic
1287
24. Wos, L., Robinson, G., Carson, D., and Shalla, L., 'The concept of de modulation in theorem proving', J. ACM, 14, 698-709 (1967). 25. Zhang, J., Personal correspondence, Institute of Software, Academia Sinica (1992).
Automated Reasoning Answers Open Questions Larry Wos*
An A u t o m a t e d Research Assistant When a computer program applies logical reasoning so effectively that the pro gram yields proofs that are published in mathematics and in logic journals, an important landmark has been reached. That landmark has been reached by various automated reasoning programs. Their use has led to answers to open questions from fields that include group theory, combinatory logic, finite semi group theory, Robbins algebra, propositional calculus, and equivalential calcu lus. Among the successes, automated reasoning programs have answered ques tions posed by Irving Kaplansky, Dana Scott, Raymond Smullyan, and John Kalman. In addition to proving significant theorems, a single automated rea soning program is used to construct a needed specific object or structure, to find an appropriate model or counterexample, to supply a new axiom system, to check a given proof, to discover a more elegant proof, and to settle conjectures— positively or negatively. Noting that such powerful and versatile automated reasoning programs ex ist, one naturally wonders about the ease of using such a program and which program is recommended. The program I recommend is the one that continues to play a vital role in my research: Its name is OTTER [3]. OTTER is rather easy to use, requiring one to prepare an input file that contains no more than a statement of the problem under attack and an instruction concerning the type of reasoning to employ—when the choice is simply to rely on the program's defaults. (Because the presentation of a question or problem is ordinarily the most burdensome aspect of using a program that reasons logically, I postpone its discussion until after introducing the five elements of automated reasoning.) Of course—as one expects with an increase in the challenge of research, games, or puzzles—to complete assignments of increased complexity demands an increase "Larry Wos is a research scientist in the Mathematics and Computer Science Divison at the Argonne National Laboratory. He can be reached by email at: [email protected]. Reprinted with permission from Notices of the AMS, Vol. 5, no. 1, pp. 15-26 (January 1993), American Mathematical Society, 1993.
Automated Reasoning Answers Open Questions
1289
in the sophistication of program use. Fortunately, however, increased complex ity and required sophistication are not commensurate: An increase of a factor of 1000 in complexity is frequently reflected in an increase in sophistication of only a factor of 10. For overcoming the obstacle of ever-growing complexity, the program OTTER offers the use of strategy of various types. Researchers, poker players, chess players, each can attest to the appeal and intrigue of us ing strategy. To further aid the user of OTTER, the program offers (through use of the chosen output file) some assistance in verifying that all is in order regarding one's attempt to solve a problem or answer a question. In addition to echoing in the output the various options from which one can choose, for each deduced conclusion the program presents the precise history of its origin. An examination of such histories enables one to determine the accuracy of the cho sen representation and to evaluate the wisdom of the choices regarding strategy, type of reasoning, and parameter settings. To facilitate and encourage both the use of the recommended program and the reliance on automated reasoning to assist in research, written material is available: a taste offered by this article, a meal offered by a problem database accessible electronically, and a veritable banquet offered by the new McGrawHill book Automated Reasoning: Introduction and Applications, by Wos and coauthors [13]. With the tutorial given in Chapter 16 and with the program OTTER provided on diskette in that book, one can soon experience the use of an automated reasoning program as a valuable research assistant. Ol'TER runs well on workstations, (IBM-compatible) personal computers, and Macintoshes. One might now wish some insight into the difficulty of the questions answer able with the assistance of OTTER. To fulfill such a wish, I prefer and enjoy offering conjectures that were settled by using the program, and, for added in terest, I suggest (as a possibly intriguing contest) that the researcher attempt to settle the conjectures unaided. I have selected three conjectures for consider ation: one conjecture from group theory, one from combinatory logic, and one from two-valued sentential calculus (also known as prepositional calculus). In the following, lower-case u through z are variables.
Conjectures to Settle, a Friendly Contest between Researcher and O T T E R Conjecture 1. The following equation fails to provide a complete axiomatization for the variety of groups of exponent 5, all of those groups in which, for all x, the fifth power of x is the identity e. {x(x((x(x((xy)z)))(e{z(z(zz)))))))
= y
(1)
The preceding conjecture can be viewed as asserting that equation (1) fails to imply at least one of the following: product is associative, ex = x = xe, the fifth power of x (for all x) is the identity. One need not be concerned with inverse,
Collected Works of Larry Wos
1290
for the inverse of x is simply equal to the fourth power of x for groups of the type under consideration. Conjecture 2. Using the following two equations for the combinators B and N, one can show that there exists a fixed point combinator F expressed solely in terms of B and N, where a fixed point combinator F is a combinator such that Fa; = x(Fx). {{Bx)y)z = x{yz)
(2)
{{Nx)y)z = {{xz)y)z
(3)
Conjecture 3. Where "—>" can be interpreted as implication a nd "->" as negation in the following six formulas, one can show that there exists a model that satisfies condensed detachment (to be defined almost immediately) and formulas (4), (5), and (6) and that fails to satisfy at least o ne of (7), (8), and (9). (((X ^y)^Z)-*(y^ z)) (4) (((x - j/) - z) - H z ) - z)) ((« -
H x
) _
Z))
_ » ( t t _» ( ( y _ z) -
((*• _
(5) y)
_♦ Z))))
(6)
((*-»)-»((v-*)-(*-*)))
(7)
((-(*)-*)-*)
(8)
( S _ (^( X ) ^
(9)
y))
For this area of logic, condensed detachment considers two formulas, (A —> B) and C, and, if C unifies with A, yields the formula D, where D is obtained by applying to B the most general unifier of C and A. Unification is a procedure that considers two expressions and seeks to find the most general substitution that makes the two identical; unification will be discussed further in the section on the elements of automated reasoning. Coming Attractions For the curious and for those who have been tempted to consider the three given conjectures, in this article I settle each, touching briefly on the role the program OTTER played and drawing on earlier research. Because the brevity of that discussion may leave various questions unanswered, I focus in greater detail later in this article on the basic elements of automated reasoning, enabling the researcher to gain a fuller appreciation for how OTTER attacks a question or problem; the use of strategy may be of particular interest. One learns that, in contrast to the programs that are symbolic calculators for integration and the like, the type of program in focus in this article applies logical reasoning, rather reminiscent of that found in mathematics—and sometimes with totally unexpected and intriguing results that are publishable.
Automated Reasoning Answers Open Questions
1291
To complete the picture, I discuss the general type of problem for which OT TER provides valuable assistance and feature specific open questions that were answered. The focus is mainly on the research at Argonne National Laboratory, for, more than any other effort concerned with the automation of reasoning, my colleagues and I at Argonne have emphasized the study of open questions. As one learns in this article, our approach to the automation of reasoning differs sharply from approaches one often finds in artificial intelligence; indeed, our paradigm relies on types of reasoning and other procedures that are not easily or naturally applied by a person. To complement the successes reported here, I pose additional open questions and offer challenges, each focusing on some area of mathematics or logic. As may already be obvious, I conjecture that the use of the program OTTER provides substantial potential for an attack on the posed questions and the offered chal lenges, as well as an attack on other questions of which I have no knowledge. If one is interested in research and challenges concerned directly with automated reasoning, the cited program will also serve well in that regard; a good source for appropriate research problems is the book Automated Reasoning: S3 Basic Research Problems [11]. Therefore, for those who may be interested in using this new research assistant, this article provides the details for obtaining a copy of the program. Should researchers use OTTER profitably, I would enjoy hearing of the results; the appropriate electronic mail address is [email protected]. I also encourage researchers to send additional open questions to consider. Open Questions Answered and Challenges Offered To add to the temptation of using an automated reasoning program and of sug gesting other areas to explore, I now turn to various open questions that were answered with heavy assistance from OTTER and its predecessors. As for areas of mathematics and logic totally unrelated to those of concern in this article, they are also amenable to study with an automated reasoning program—for ex ample, set theory [6,11], number theory [8], and Tarskian geometry [7]. Although this article focuses mainly on recent studies of group theory, combinatory logic, and various logic calculi, it also touches on questions answered little more than a decade ago, for they serve nicely to illustrate types of problem that can be attacked with a reasoning program. At least from the historical perspective, the successful use of an automated reasoning program to answer open questions is simply astounding. Indeed, to see how pessimistic was the view concerning the possibility of automating logical reasoning so successfully as to permit proving interesting theorems—or, for that matter, proving even simple theorems—one need only glance at the following quote taken from a 1948 paper by the eminent logi cian J. Lukasiewicz [2]: "A formalized proof can be checked mechanically but cannot be mechanically discovered." Obviously—and most fortunately—as as this article repeatedly demonstrates, Lukasiewicz was mistaken. That such a famous logician held this position is completely understandable; indeed, to have
1292
Collected Works of Larry Wos
believed otherwise in 1948 might have required clairvoyance. Even further, but four decades ago, how could any mathematician or logician have conjectured with conviction that the late 1980s and early 1990s would find that computer programs not only "discover" significant proofs, but often discover such proofs in astonishingly little computer time? I begin with questions taken from pre-OTTER history, questions answered with a predecessor of this newest automated reasoning program. Ternary Boolean Algebra The first example focuses on the esoteric field of ternary Boolean algebra and the question that marked Argonne's entrance into the use of an automated reasoning program to attempt to answer open questions. The question asks which, if any, of the first three of the following five axioms is independent of the remaining four. (TBAl) (TBA2) (TBA3) (TBA4) {TBA5)
/ ( / ( « , w, x), y, /(«, w, z)) = f{v, w, / ( i , y, z)) f{y,x,x) = x f(x,y,g(y))=x f{x,x,y) = x f{g(y),y,x)=x
A nonempty set satisfying these five axioms is a ternary Boolean algebra. It was known that the fourth and fifth are dependent on the first three axioms. My colleagues and I were faced with two possible uses of an automated rea soning program, that of proving theorems and that of finding models. Although not in the context of attacking open questions, we had had many successes in the former; in the latter, we had had none. When we attempted to have our program prove that each of the first three axioms is dependent on the remaining four, no proofs were obtained. Fortunately, Steve Winker (a member of the Argonne group) then devised a method enabling one of our reasoning programs to gener ate models [9]. By using a program (whose design preceded that of OTTER) to apply Winker's method, we quickly established the independence of each of the first three axioms. Although the models that suffice are disappointingly small— each consisting of four or fewer elements—we had, nevertheless, succeeded for the first time in our research in using an automated reasoning program to an swer an open question. (For those interested in history, I note that, prior to our attempt at Argonne National Laboratory to answer open questions, the only successful use of a reasoning program in that context is that concerning SAM's lemma in the theory of modular lattices [1]. I also note that our programs are still not very effective for model generation.) Finite Semigroups To obtain a question from a field of far greater interest than offered by ternary Boolean algebra, we turned for an appropriate challenge to Irving Kaplansky. He suggested seeking an answer to the following.
Automated Reasoning Answers Open Questions
1293
Does there exist a finite semigroup that admits a nontrivial antiautomorphism but that does not admit any nontrivial involutions? A nontrivial antiautomorphism is a one-to-one onto mapping h such that h(xy) = h(y)h(x) and such that h is not the identity mapping. A nontrivial involution is a nontrivial antiautomorphism j such that j(j{x)) = x. The nature of the Kaplansky question suggested the avoidance of an exhaus tive search. After all, there exist more than 800,000 semigroups of order 7 alone, no two of which are isomorphic. Recognizing the difficulty of telling a reasoning program that the sought-after structure must be finite, we chose to have the program explore candidate semigroups, keying on various sets of generators and relations. The study succeeded: An appropriate semigroup was found, one of order 83 [10]. To attempt to find a smaller semigroup of the desired type, we had the program proceed more or less as one would in the study of quotient groups. Again success: One of order 7 was found, and, later, it was proved that there exist four nonisomorphic semigroups of that order, and none of smaller order. Equivalential Calculus The third success focuses on a field of logic known as equivalential calculus and on questions that proved to be far more difficult to answer. The formulas of equivalential calculus are the set of expressions in the two-place function e (for equivalent) and the variables x, y, z, and so on. Fortuitously from the viewpoint of automated reasoning, the unification procedure can be relied upon, that procedure (as defined earlier) that considers two expressions and seeks to find the most general substitution that makes the two identical; unification is illustrated later, in the discussion of the elements of automated reasoning. The inference rule that is often employed to prove theorems is condensed detachment. For this area of logic—similarly to the use in two-valued sentential calculus— condensed detachment considers two formulas, e(A, B) and C, and, if C unifies with A, yields the formula D, where D is obtained by applying to B the most general unifier of C and A. Encouraged by John Kalman (the University of Auckland), who had heard of our prowess in proving theorems, we began the study of seven open questions: Which, if any, of the following seven formulas provides a complete axiomatization of equivalential calculus? (A formula is a single axiom if and only if one can use it with condensed detachment to deduce all formulas in which variables occur twice.) (XJL) {XKE) (XAK) (BXO) {XCB) {XHK)
e{x,e{y,e{e{e(z,y),x),z))) e(x,e{y,e(e(x,e(z,y)),z))) e(x,e{e{e{e(y,z),x),z),y)) e(e(e(e(x,e(y,z)),z),y),x) e(x,e(e(e(x,y),e(z,y)),2)) e(x,e(e{y,z),e(e(x,z),y)))
Collected Works of Larry Wos
1294 (XHN)
e(x,e(e(y,z),e(e(z,x),y)))
To attack each of the seven questions, as is obvious, one could seek an appro priate proof, or one could seek an appropriate model. Since the conjecture was that none of the seven was strong enough to be a single axiom for the calculus, the path that appeared best to pursue was to seek appropriate models. Unfor tunately, from what we were told, to seek a model might entail the examination of too many candidates. Since our programs have never demonstrated marked power for model generation, the path concerned with establishing a formula too weak to be a single axiom would almost certainly require the formulation of a new approach. Our discovery of the needed approach nicely illustrates the sym biosis that sometimes exists between a researcher and an automated reasoning program, and it also illustrates that luck often plays a key role in science. Our foray into equivalential calculus began with the study of the formula XBB: (XBB)
e(x, e(e{e(x, e(y,
z)),y),z))
We chose that formula more or less arbitrarily, motivated by the belief that it corresponded to an open question. Using condensed detachment as inference rule, and using various known single axioms as targets to establish assignment completion, we instructed OTTER to study the formula XBB. If the program were to succeed in deducing any of the target formulas, then we would have a proof that XBB is a single axiom—but such did not occur. Instead, an examina tion of the program's output revealed that the deduced formulas steadily grew in symbol count. Closer inspection showed that the handful of deduced formulas could be described with a single iterative pattern, which led us to conjecture that all theorems deducible from XBB would satisfy the pattern. On the one hand, we quickly proved our conjecture; on the other hand, we shortly learned that this formula held no interest for logicians, for it was already known to be too weak to be a single axiom. But luck was with us: we had already answered some of the seven open questions of concern before we learned of the lack of interest in XBB. Even better, the approach gleaned from our use of our program proved to play the key role in completing the study, the approach of identifying some number of patterns to describe all deducible formulas from a given formula [15,14]. Each of the first five of the seven formulas is too weak to serve as a single axiom; but, contrary to conjecture, the last two—XHK and XHN—each were proved strong enough. Group Theory and the Era of OTTER Having covered the pre-OTTER history of our attempts to answer open ques tions, I now turn to the era of OTTER. My colleagues and I used this automated reasoning program to settle the three conjectures posed earlier and to answer
Automated Reasoning Answers Open Questions
1295
various related open questions, some of which I discuss in this article. Although the questions taken from group theory were studied most recently, I nevertheless begin with them [5]. One often studies group theory as a whole, structures closed under an asso ciative operation in which a (two-sided) identity exists and in which, for every x, a (two-sided) inverse exists. Instead, one often studies a class or variety of groups in which an additional equation is assumed to hold. For example, when xy = yx, one has the variety of commutative groups, and when xx = e (the identity), one has Boolean groups. Here I shall confine my attention to varieties of groups of odd exponent—all groups in which the cube of a; equals the identity, the fifth power equals the identity, the seventh power equals the identity, and the like. For a given variety, I focus on the search for a single equation that axiomatizes all groups in the variety; in particular, I show how my colleagues and I settled the first conjecture. When the focus is on all of group theory, Alfred Tarski proved that, if con strained to rely explicitly on product, inverse, and identity, one cannot find a single equation to serve as a complete axiom system. If the focus is switched from all of group theory to some variety obtained by adding one equation, Ken Kunen (University of Wisconsin) has outlined a proof that again one cannot find an axiom system of the type discussed by Tarski. (Historical note: Kunen sup plied us with his proof after we had completed the research reported here and after we had answered various other related questions.) If one drops the require ment of the explicit use of the identity e, then B. H. Neumann has provided a schema for obtaining a single axiomatizing equation. However, because our interest concerns the axiomatic question when the identity is explicitly present, the Neumann schema is of no assistance. I begin with groups of exponent 3, those in which the third power of x (for all x) is the identity e, then settle the first conjecture, and close with a result that focuses on all varieties of odd exponent. William McCune (also an Argonne scientist) had used OTTER to successfully study other varieties. His research focused on single equations in which e is absent. Nevertheless, his work was clearly the impetus for asking the following question. Does there exist a single equation in which only product and the constant e occur such that it serves as a complete axiomatization for groups of exponent 3? Given a candidate equation of the desired syntactic form, one must use it to prove that product is associative, that the constant e is in fact an identity, and that the third power of x (for all x) is equal to e. By using the inference rule paramodulation and the procedure demodulation (for canonicalization), in the style of Knuth-Bendix, OTTER succeeded in finding the desired equation, the following. {x){{x{{xy)z)){e{zz))))=y (Paramodulation and demodulation are discussed in the section on the elements of automated reasoning.) When we turned our attention to groups of exponent
1296
Collected Works of Larry Wos
5—and hence to the the first conjecture—OTTER again succeeded, finding the following. (x(x((x(x((xy)z)))(e(z(z(zz))))))) =y In other words, the first conjecture was refuted. To be precise, we had actually conjectured that the preceding equation does provide an axiomatization for groups of exponent 5 and, further, that it is a member of a family of closely coupled equations for groups of odd exponent. To test our more general conjecture, we had OTTER study groups of exponent 7, 9, 11, 13, 15, and 17, each with the appropriate member of the family we had in mind. We were thus using our program as a research assistant; without such an assistant, a researcher might find this study more than cumbersome. Although we were forced to experiment to find the appropriate parameter settings for the different cases under study, OTTER succeeded eventually in all six. To provide some insight into the magnitude of OTTER's achievement, I note that the case focusing on exponent 17 required more than 23 CPU hours on a SPARCstation 2, producing a proof (for associativity alone) consisting of 181 applications of paramodulation. For those who may wish to use some other reasoning program to consider the same precise question, I note that excluded from the cited proof length count are the hundreds of canonicalization steps. I also note that, were the proof written out in its fullest, it would contain equations with more than 4,000 symbols. One of the charming properties of the family of single axioms for the various varieties of groups of odd exponent is that no need exists for recursion; instead, given an odd exponent, one can immediately provide the desired single axiom— or so it appears. Since an appropriate proof has not yet been completed, I offer for research the conjecture that, for all odd exponents, the type of equation we have exhibited for exponents 3 and 5 generalizes. In that regard, I now give the corresponding equation for exponent 17. (x(x(x(x{x(x{x(x({x(x(x{x(x(x(x(x((xy)z))))))))) (e(z(z(z(z(z(z(z(z(z(z(z(z(z(z(zz)))))))))))))))))))))))))
= y
Combinatory Logic The second conjecture focuses on the adequacy of the combinators B and N for constructing a fixed point combinator F, a combinator expressed solely in terms of B and N with Fx = x(Fx). From what we know, no systematic approach with or without the aid of a computer exists for attacking this type of question—other than that we formulated when we studied combinatory logic with OTTER. Barendregt defines combinatory logic as an equational system satisfying the combinators S and K with {{Sx)y)z = (xz)(yz) and (Kx)y = x; the set con sisting of S and K provides a basis for all of combinatory logic. Rather than studying all of the logic, logicians often focus on fragments of the logic, sub sets whose basis is obtained by replacing 5 or A" or both by other combinators.
Automated Reasoning Answers Open Questions
1297
Where A is a given fragment with basis B, the strong fixed point property holds for A if and only if there exists a combinator y such that, for all combinators x, yx = x(yx), where y is expressed purely in terms of elements of B. The weak fixed point property holds for A if and only if for all combinators x there exists a combinator y such that y = xy, where y is expressed purely in terms of the elements of B and the combinator x. Therefore, the focus of attention for the second conjecture is the possible presence of the strong fixed point property for the fragment with basis consisting of B and N alone. As for the second conjecture, use of OTTER settles it in the affirmative by constructing the following combinator.
B(B(N(BB{N(BBN)N))N)B)B Of far greater interest is the manner in which the combinator is constructed. Indeed, this combinator, as well as various others that answered open questions of the type on which the second conjecture focuses, was constructed by applying a new strategy, the kernel strategy [4,12]. This strategy is what I had in mind when I remarked about the lack, prior to our research, of a systematic approach to answering the type of question under discussion. For a given fragment, the application by OTTER of the kernel strategy often settles the question concern ing the presence of either fixed point property in less than 3 CPU seconds on a SPARCstation 2—by constructing an appropriate object—or suggests what is needed for an argument to show that the desired property is absent. Immediately, two queries demand attention: (1) from where does the kernel strategy derive its power, and (2) how might one explain its formulation by researchers in automated reasoning rather than by researchers in combinatory logic? The power of the strategy rests mainly on three aspects. First, the strat egy relies on the use of the inference rule paramodulation (to be discussed later), a rule that generalizes equality substitution and in a manner not reminiscent of some researcher's reasoning. Second, various strategies are used to control the application of paramodulation to deter the program from deducing unneeded information. Third, when the question under study concerns the strong fixed point property, the kernel strategy attacks it in two stages, in the first attacking the easier-to-answer question concerning the weak fixed point property and, if the answer is in the affirmative, in the second using only the relevant results to attack the harder question. In particular, the second stage of the strategy relies heavily and directly on the results (obtained in the first stage) that establish the presence of the weak fixed point property, gaining marked effectiveness by ignoring all other information produced by the first stage. Regarding the re searchers who formulated the kernel strategy, we had the distinct advantages of access to a powerful reasoning program and detailed knowledge concerning its elements, such as paramodulation, unification, and demodulation (a procedure for automatically canonicalizing deduced conclusions). Our entrance into combinatory logic was indirectly prompted by Raymond Smullyan, with whom we later communicated moderately often. That communi-
1298
Collected Works of Larry Wos
cation led to his posing various open questions, questions we answered before our study of B and N but during our formulation of the kernel strategy. In response to his question, we proved that the fragment with basis consisting of B and L alone does not satisfy the strong fixed point property, where (Lx)y = x(yy). Again prompted by Smullyan, we then proved that the fragment with basis con sisting of L and Q alone fails to satisfy the strong fixed point property, where ((Qx)y)z = y(xz). Each of the cited fragments does satisfy the weak fixed point property, proved by considering the expression (Lx)(Lx). (For the curious, I note that the preceding expression is a kernel.) As part of our research, we also showed that, from B and W alone, one can construct an infinite class of infinite sets of fixed point combinators. As it turns out, the same is true for B and N. The reported successes provide yet more evidence of the value of relying on an automated reasoning program as a research assistant, for the program played a key role in all of the results cited here and in many not cited. Of course, many fascinating research questions concerning the strong fixed point property remain open, providing challenges for the team of a researcher and an automated reasoning program. Of the more interesting is one posed by Smullyan: Does the fragment with basis consisting of B and M alone satisfy the strong fixed point property, where Mx — xx? By considering the expres sion M(BxM)—another kernel—one quickly sees that this fragment satisfies the weak fixed point property. Especially if one is interested in an open question focusing on the weak fixed point property, I offer the following two questions. Does the fragment with basis consisting of B and S alone satisfy the weak fixed point property? Does the fragment with basis consisting of B and N\ alone satisfy the weak fixed point property, where {{Nix)y)z = ((xy)y)z? One can immediately prove that the presence of the strong fixed point property implies the presence of the weak. For a different type of open question to consider, I suggest that one attempt to find a finite model that satisfies the equations for B and L but fails to satisfy the strong fixed point property. That some model exists follows from our earlier cited result; but it is not known whether a finite model exists. For additional open questions and for a detailed treatment of the kernel strategy and numerous results of its use, see [12]. Two-Valued Sentential Calculus Regarding the third conjecture, which focuses on two-valued sentential (or propositional) calculus, I thank Dana Scott, for it was his interest in our research and in OTTER that eventually (though indirectly) led to our study of the conjec ture. The path to that study began with a challenge from Scott: See whether OTTER can prove all of 68 theorems he selected from two-valued sentential calculus. Although our first attempt to prove all 68 yielded proofs of only 33 of the theorems—a result that many researchers might indeed consider rather impressive—the story has a beautiful ending. Indeed, prompted in part by greed—manifested in the objective of proving all 68 theorems in one run—and in part by curiosity concerning a possibly new
Automated Reasoning Answers Open Questions
1299
approach, we formulated a new strategy, called the resonance strategy, which sharply differs from any other with which we were acquainted at the time. In the context of the Scott challenge, the strategy in effect says to OTTER: if the theorem T is proved, and if T matches at the function occurrence level any of the 68 theorems to be proved, then focus heavily on T to direct the attack. When the new strategy was put to the test, OTTER proved all 68 theorems in a single run in less than 16 CPU minutes on a SPARCstation 1+. One significant criterion for measuring the power of a strategy is its effec tiveness when used to study problems other than those that prompted its for mulation. The resonance strategy meets that criterion. The new context is that of finding more elegant proofs, especially where elegance is reflected in proof length. One of our more satisfying successes focuses on two-valued sentential calculus and on the following axiomatization supplied by Lukasiewicz. (LI)
((x - y) -» ((y - * ) - ( i -
z)))
(L2) ( H x ) - s ) - x ) (L3)
(I-HI)-|/))
The three formulas are, respectively, (7), (8), and (9) of the third conjecture. The Lukasiewicz proof that (LI) through (L3) axiomatizes the calculus con sists of 33 steps, each an application of condensed detachment. With the goal of finding a shorter and more elegant proof of the Lukasiewicz result, we decided to base our attack on the use of the resonance strategy and on the use of a feature in OTTER that, for each conclusion that is reached more than once, compares the proof lengths and gives preference to the shorter. Therefore, at the beginning of the attack, we instructed OTTER to focus heavily on any formula that is sim ilar to one of the 33 steps in the Lukasiewicz proof. We interated, on the whole finding shorter and still shorter proofs. For each step of the iteration—some of which yielded nothing of added interest—we changed various parameters and, more important, keyed OTTER's attack on using the resonance strategy to fo cus heavily on any formula that is similar to one of the steps of the shortest proof available. We were rewarded: OTTER eventually found a 22-step proof establishing that (LI) through (L3) axiomatizes two-valued sentential calculus. During our study of this area of logic, we used OTTER to focus profitably on other axiom systems, including that of Frege, Hilbert, and Church. One of the benefits resulting from the corresponding research was the accrual of additional evidence (to be cited shortly) of the value of using an automated reasoning program as a research colleague. Indeed, as a result of an odd concatenation of circumstances, we were driven to seek a new axiom system—the motivating force for the third conjecture. The conjecture asserts that failure results from an attempt to use condensed detachment to show that the formulas I numbered (4), (5), and (6) provide an axiomatization for two-valued sentential calculus, where the specific objective is to deduce (7), (8), and (9), which are, respectively, (LI), (L2), and (L3). As one may have correctly surmised from the current discussion,
1300
Collected Works of Larry Wos
our goal was actually to refute the conjecture and, instead, show that we had an axiom system—a new axiom system. Rather than considering the conjecture as stated and seeking to deduce (7), (8), and (9) from (4), (5), and (6), we chose what we suspected to be an easier question to attempt to answer. In particular, we had learned (from browsing in various papers of Lukasiewicz) of yet another axiom system, one that shares (with the system under study) the formulas numbered (4) and (5). In place of (6), the system has ((~>{x) —► y) -» ((z —» y) —► ((x —» z) -» y))) as its third member; Lukasiewicz calls this formula thesis 59. In fact, our choice of (4), (5), and (6) was an intuitive one, based on knowledge of the cited closely related system. And here is the "additional evidence" alluded to earlier: From (4), (5), and (6), OTTER deduced thesis 59, and we had found a new axiom system. There fore, as a bonus, we refuted the third conjecture. Then, from curiosity, we had OTTER seek to prove (7), (8), and (9) directly. Success: The shortest proof obtained consists of 23 applications of condensed detachment. Returning to thesis 59 with the objective of adding to the intrigue of using an automated reasoning program, I now present an elegant proof found by OTTER, a proof that Scott commented is the type that a person might never have dis covered. (Since the following proof relies on unification in a nontrivial way, one might wish to delay its detailed examination until briefly studying the examples given in the review of the elements of automated reasoning.) In the following proof, the steps are numbered based on the OTTER run, where "-" means not, "|" means or, and the predicate P can be interpreted as "is deducible". Also, [hyper,l,j,A:] means that the inference rule hyperresolution (exemplified later) is used with clause (1) to capture condensed detachment, that the clause num bered j is the major premiss used with the first literal of (1), and that the clause numbered k is the minor premiss used with the second literal of (1). In the proof, a, b, and c are constants, the function i is used for —», and the function n is used for ->. An Elegant Proof 1 D -P0(x,y)) I -P(x) | P(y). 8 0 P(i(i(i(x,y),z),i(y,z))). 9 [] P(i(i(i(x,y),z),i(n(x),z))). 10 0 P(i(i(u,i(n(x),z)),i(u,i(i(y,z),i(i(x,y),z))))). 25 0 -P(i(i(n(a),b),i(i(c,b),i(i(a,c),b)))). 39 [hyper.1,10,9] P(i(i(i(x,y),z),i(i(u,z),i(i(x,u),z)))). 51 [hyper.1,39,8] P(i(i(x,i(y,z)),i(i(i(u,y),x),i(y,z)))). 212 [hyper.1,51,8] P(i(i(i(x,y),i(i(z,y),u)),i(y,u))). 8405 [hyper.l^l^lO] P(i(i(n(x),y),i(i(z,y),i(i(x,z),y)))). Clause (8405) contradicts clause (25), and the proof is complete, requiring ap-
Automated Reasoning Answers Open Questions
1301
proximately 108 CPU seconds on a SPARCstation 2. In the context of elegant proofs, one might find intriguing the challenge of seeking, if possible, proofs shorter than the three cited here of respective lengths 22, 23, and 4, where length is measured strictly in terms of the number of applications of condensed detachment. The Five Elements of Automated Reasoning, a Short Course At this point, I briefly review the five basic elements of automated reasoning: representation of information, inference rules for drawing conclusions, strategy for controlling the reasoning, a means for canonicalization, and a means for purging trivial information. I concentrate on the features found in what might be called the Argonne paradigm [11,13]. Among those features are the retention of deduced conclusions, the emphasis on strategy, the use of various inference rules, the control of redundancy, and the detection of assignment completion almost always by completing a proof by contradiction. At the most general level, since my entrance into the field in 1963, these features have played a key role in Argonne's research and in Argonne's design of reasoning programs. Compared to the paradigm now reviewed, I have never believed there existed as much potential in seeking to emulate person-oriented reasoning, a common theme found in artificial intelligence. That belief perhaps explains my introduc tion of the explicit use of strategy (in the early 1960s), my formulation of the inference rule paramodulation, and my endorsement of the use of the clause language to present questions and problems to a reasoning program. For a small taste of my position, I note that people find instantiation to be a powerful and useful inference rule; however, I recommend against its use by a computer pro gram. Indeed, where the researcher can and typically does choose well which instance of a fact to use—for example, profitably choosing the instance (yz)(yz) = e of the equation xx = e when seeking to prove commutativity for Boolean groups—I conjecture that countless years will pass before a means will exist for a program to apply instantiation wisely. Nor am I in favor of the currently popular approach (to the automation of reasoning) based on logic programming, especially when the question or problem under study is even moderately deep. Indeed, for the type of question of great est interest to me—questions from mathematics and logic are my favorites—I consider it essential to retain deduced conclusions, of course, filtered greatly to control redundancy and to emphasize significance. I maintain this view—or bias?—in part because of making various comparisons among reasoning pro grams. As those who are familiar with my research can attest, my conviction continues to grow concerning the potential of the paradigm I now discuss. Representation and Unification Regarding the clause language for communicating with OTTER, the following example serves well for introducing it and for providing a minute taste of uni fication, the procedure so crucial to so many procedures used by the program.
1302
Collected Wbrlcs of Larry Wos
Were OTTER to deduce the following two clauses, it would immediately "know" that a proof by contradiction had been completed. GT(a,x). -GT(y,b). Of course, strictly speaking, neither clause has any semantic content. But one can interpret them, respectively, in the following way. "For all x, the constant a is greater than x.n "For all y, y is not greater than the constant b." OTTER detects a contradiction by using unification, substituting b for x in the first clause and o for y in the second. Unification is that procedure that finds, if one exists, a most general substitution for two given expressions such that, when applied, the resulting expressions become identical. In the given example, the two expressions are the clauses with the not sign ignored. Inference Rules and Unification in Greater Detail In contrast to considering just two clauses at a time, OTTER also uses inference rules that consider three (or more) clauses at a time—as suggested by the 4-step proof given earlier. For an example of this type of reasoning—actually, an exam ple of hyperresolution—I select the first deduced conclusion in the 4-step proof cited earlier as evidence of elegance; let us examine how it is obtained. Of the following four clauses, OTTER attempts to find a substitution for variables to simultaneously apply to the first three clauses to yield the fourth. The variables are renamed for convenience. 1 [] -P(i(x3,y3)) | -P(x3) | P(y3). 9 0 P(i(i(i(xl,yl),zl),i(n(xl),zl))). 10 Q P(i(i(u2,i(n(x2),z2)),i(u2,i(i(y2,z2),i(i(x2,y2),Z2))))). 39 [hyper, 1,10,9] P(i(i(i(x,y),z),i(i(u,z),i(i(x,u),z)))). The desired substitution that will (ignoring sign) unify clause (10) with the first literal of clause (1) and at the same time unify clause (9) with the second literal of clause (1) is x for xl, y for yl, z for zl, i(i(x, y),z) for u2, x for x2, u for y2, z for z2, i(i(i(x, y),z),i(n(x),z)) for x3, and i(i(i(x,y),z),i(i(u, z),i(i(x,u),z))) for y3. After the substitution is applied simultaneously to clauses (1), (9), and (10), the cited literal pairs (ignoring sign) become identical and, because of being opposite in sign, are canceled to yield clause (39). Although logicians with diverse interests have for years applied condensed detachment by hand, we have a good illustration of why a program such as OT TER finds its application far less of a burden. For a more powerful illustration— showing why the cited 4-step proof might indeed not have been discovered by a person—one need only complete a detailed analysis of the last three steps of that proof with the objective of obtaining the appropriate sets of substitutions for the various variables. The fourth step is particularly interesting, for it rests on the use of nontrivial variable replacement in all three of its ancestors.
Automated Reasoning Answers Open Questions
1303
Let me now illustrate the use of paramodulation in the case where one is permitted to make nontrivial replacement of terms for variables in both the from statement and the into statement. For an example of the latitude permitted in the use of paramodulation—an example showing how this inference rule gen eralizes the usual notion of equality substitution—consider the following three clauses and apply paramodulation from the first into the second to yield the third; from the viewpoint of mathematics, paramodulation applied to both the equation x + (~x) = 0 and the equation y + (—y + z) = z yields in a single step the conclusion y + 0 = — (—y). EQUAL(sum(x,minus(x)),0). EQUAL(sum(y,sum(rninus(y),z)),z). EQUAL(sum(y,0),minus(minus(y))). To see that this last clause is in fact a logical consequence of its two parents, one unifies the argument sum(x,minus(x)) with the term sum(minus(y), z), ap plies the corresponding substitution to both the from and into clauses, and then makes the appropriate term replacement justified by the typical use of equality. The substitution found by the attempt to unify the given argument and given term requires substituting minus(y) for x and minus(mimis(y)) for z. To prepare for the (standard) use of equality in this example—and here one encounters a key feature of paramodulation—a nontrivial substitution for variables in both the from and the into clauses is required, which illustrates how paramodula tion generalizes the usual notion of equality substitution. I also note that, most likely, a researcher would not find delight in applying paramodulation by hand: This inference rule is not particularly reminiscent of person-oriented reasoning. Strategy Having touched on the language and some of the inference rules used by OT TER, I turn next to strategy. In view of some of the current efforts in automated reasoning, apparently many still feel that strategy is unneeded, or believe that the simplest of strategies suffices. Obviously, I do not share this view, at least when the domain of study concerns even moderately deep questions from math ematics or logic. Certainly, excellence in program design and implementation is required—as one finds in McCune's program OTTER—and also required is a language possessing representation adequacy, as is offered by the clause lan guage. Also, one must have access to inference rules whose use, in addition to drawing conclusions only if they follow logically, contributes significantly to program effectiveness. However, far more is required, for the heavy sword of potential combinatoric explosion always hangs over the head of the program attempting to answer a deep question. Indeed, as observed by Woody Bledsoe (University of Texas), for hard problems from mathematics, even access to 10,000 times more computing power will not suffice. One thus sees why I and others are so interested in some means to address the potential combinatoric
1304
Collected Works of Larry Wos
explosion—and strategy to control the program's reasoning seems to offer by far the best attack on this obstacle. At the most general level, strategy can be classified into two types: one type to restrict the search for information, and one type to direct the search. If history is a good teacher, powerful restriction strategies are of far greater value than are powerful direction strategies—because the former offer a greater reward by directly addressing the potential of combinatoric explosion, and the latter address this obstacle only indirectly. Especially for the following discussion, recall that, almost always, seeking a proof by contradiction is the goal when attacking a question or a problem with the assistance of an automated reasoning program. The most powerful restriction strategy of which I am aware is called set of support. Informally, the user selects a subset of the input statements, and the strategy requires that all lines of reasoning must begin with some statement in the chosen subset. Formally, to use the set of support strategy, the researcher partitions the set S of statements (or clauses) that present the question or problem under study into two sets, T and S — T. The strategy also dictates that all newly retained statements (or clauses) are adjoined to T. The set of support strategy restricts the search by prohibiting an inference rule from being applied to a set of statements all of which are members of S — T. Of immediate concern is the possibility of using the strategy and getting into serious trouble, for example, preventing the program from proving a known theorem by restricting the search too severely. I can address that justifiable concern with an informal and then a formal observation, suspecting that neither is intuitively obvious. Informally, one is safe if S — T consists of the general background information—for example, the axioms and lemmas to be used— and T consists of the assumption that the purported theorem under study is false, together with the information specific to the purported theorem. As an illustration, if the objective is to prove that groups in which the square of every x is the identity e are commutative, then T might consist of the given exponent 2 property (the special hypothesis) and the assumption that commutativity is absent. Formally and from the viewpoint of logic, one is guaranteed refutation completeness when using the set of support strategy whenever S—T is satisfiable and, therefore, has a model. Of a totally different nature is the restriction strategy known as weighting. One use of this strategy enables the researcher to assign a maximum on the complexity of information to be retained. One can, for example, instruct the program to immediately discard any conclusion if it contains a term of the form f{f(f(g,r),s),t) for terms q, r, s, and t, where, for example, the function / might be used for product. Of course, as one would suspect, weighting permits the use of far more complex templates, giving the researcher the opportunity of providing little or much advice concerning the undesirability of expressions. Undesirable expressions as defined by the researcher—those whose weight, based on the given templates, exceeds the user-assigned maximum—are immediately
Automated Reasoning Answers Open Questions
1305
purged by the program; where templates are not applicable, the program simply uses symbol count to determine the weight of a deduced conclusion. Weighting can also be used to direct a program's search. Indeed, if one wishes the program to choose (as the focus of attention) information by substituting for symbol count a different measure of complexity, one includes (in the input) templates with assigned values to enable the program to place priorities on each item of retained information. The smaller the weight of an item (a clause), the higher the priority it has. For example, for questions focusing on group theory, the researcher can cause the program to prefer statements concerned with inverse over those concerned with the identity. For questions taken from propositional calculus, a researcher can cause the program to emphasize the role of formulas containing a term of the form n(i(x, y)) while placing far less emphasis on those containing a term of the form i{n(x), y). Thus, by judicious choice of the weight templates, if desired, the researcher can have an automated reasoning program direct its search based on the researcher's intuition and expertise. Of a different flavor, one can instruct a reasoning program to make a breadthfirst search, considering each item of information in the order it is retained. I note that for many years I considered this strategy, called level saturation, to be naive and of little value for answering interesting questions. However, despite numerous experiments supporting that original position, I have recently mod ified my stand, for my colleagues and I have put this simple strategy to good use, obtaining some shockingly short proofs. Were it not for the ease of hav ing OTTER apply level saturation, I almost certainly would have missed this opportunity of revising and updating my views and, therefore, missed the corre sponding amusement—a glance in the mirror of history does sometimes produce laughter. For the curious, I note that the implied conclusion is correct: In the vast majority of cases, weighting is a far more effective direction strategy than is level saturation. But there exists a strategy, the ratio strategy, that combines some of the advantages of the two strategies just compared. Its use permits a program to occasionally use very complex formulas—however complexity is de fined by the researcher—while mainly concentrating on the less complex. The ratio strategy is of particular value when a proof requires getting over a hump whose form is a long, long clause. Redundancy Control Even though a program such as OTTER offers various other useful strategies— some of which powerfully restrict the application of paramodulation—the ob stacle of redundancy nevertheless exists. The same conclusion can be reached repeatedly, and no reason exists for retaining more than one copy. Further, a more general conclusion can be reached, either before or after instances of it are deduced. Ordinarily, no need exists for retaining the less general conclusions. A somewhat subtler form of redundancy is that found in a set of expressions all of whose members can be canonicalized to a common expression. The subtler obstacle is addressed in the Argonne paradigm by using demodulation to canon-
1306
Collected Worfcs of Larry Wos
icalize and simplify conclusions through the use of demodulators (rewrite rules). The researcher can supply the demodulators, or OTTER can find them by ap plying user chosen criteria. Regarding the more blatant form of redundancy, the program relies on subsumption to identify and purge statements (clauses) that are captured as corollaries of other statements. The Challenge of Problem Presentation At this point, I fulfill my earlier promise concerning the discussion of the some times burdensome aspect of presenting a question or a problem to an automated reasoning program and, more specifically, answer the natural question concern ing the difficulty of producing the clauses needed to convey to OTTER the nature of the intended study. When the area of interest is one that has been the subject of numerous experiments in automated reasoning, little difficulty is encountered, at least at the start. For example, if the area is group theory, ring theory, lattice theory, Tarskian geometry, or equivalential calculus, the book Automated Reasoning: SS Basic Research Problems [11] provides the researcher with a decent start. For clauses to study combinatory logic—especially in the context of the kernel strategy—I suggest [12]. As for set theory, although a nice start is provided by [6] and by [11], experimentation quickly leads to the con clusion that far more is desired—in particular, when the context is more proof finding than proof checking. Indeed, experiments with OTTER suggest that an intriguing challenge exists: Find, if possible, a small set of clauses—perhaps 14 or fewer—that the program can use to easily prove numerous simple theorems and, in the main, without guidance from the researcher. Clearly, I am implying that finding proofs rather than checking proofs is more useful, more satisfying, and more demanding. Regarding the use of OTTER for the study of areas of mathematics and logic for which no template exists, the researcher finds a substantial challenge—but a challenge that, almost certainly, can be met. Even in the context of proof checking, which is less taxing than is proof finding, one may be required (for a new area of study) to make a substantial effort to produce clauses that the program can use effectively. Although not at all obvious, regarding proof check ing, the vast majority of theorems is within range of automated reasoning, at least in principle. In particular, although exceedingly far from delectable, one can always fall back on the use of clauses for Godel's finite axiomatization of set theory [11]. Instead, for each new venture, I conjecture that—risky though it clearly is— the possible reward merits an attempt at finding suitable clauses that avoid the use of Godel's axioms, and, further, of finding clauses that OTTER can use effectively in the context of finding proofs. The important point to keep in mind is that neither the use of the clause language nor the use of OTTER limits the researcher to those areas of mathematics and logic contained within the convex hull of what has been studied (to this point in 1992) with the assistance of an automated reasoning program.
Automated Reasoning Answers Open Questions
1307
If one wishes to use OTTER as a research assistant but prefers to avoid the task of producing appropriate clauses, the program does offer an alternative— at least, for those who know first-order predicate calculus. In particular, one can present to OTTER a question or problem in the form of a fully quantified formula relying on the various connectives of the calculus, and the program will translate the formula into acceptable clauses. Regardless of how clauses are produced, an important distinction exists between an accurate representation of the question or problem under study and an effective representation. Indeed, because the representation admits various choices—as in mathematics and in logic, uniqueness of representation is absent—to be effective, one best take into account the inference rule and strategy that the program is instructed to use. For an illustration, I focus on group theory, choosing as the inference rule paramodulation, a rule that treats equality as a built-in concept. Once paramodulation is chosen from among the inference rules offered by OTTER, the rep resentational choice is virtually dictated, if effectiveness is of paramount con sideration. For the respective clauses for the existence of a two-sided identity, a two-sided inverse, and associativity—and the often overlooked reflexive property of equality—I recommend the following, given in OTTER notation. (1) (2) (3) (4) (5) (6)
EQUAL(prod(e,x),x). EQUAL(prod(x,e),x). EQUAL(prod(inv(x),x),e). EQUAL(prod(x,inv(x)),e). EQUAL(prod(prod(x,y),z),prod(x,prod(y,z))). EQUAL(x,x).
If one then assumes that the theorem to be proved asserts that Boolean groups (those in which, for all x, the square of x is the identity e) are commu tative, one would add to the input the following clauses. (7) EQUAL(prod(x,x),e). (8)-EQUAL(prod(a,b),prod(b,a)). Motivated by the intention of seeking a proof by contradiction, I include clause (8), asserting that commutativity is absent—absent for at least two el ements. As for strategy, I recommend the set of support strategy, instructing OTTER to follow only those lines of reasoning that begin with clause (7) or clause (8), using the other six clauses to complete applications of paramodu lation. To gain some familiarity with the use of the chosen inference rule and chosen strategy—or simply for entertainment—one might attempt to use the eight clauses in the prescribed fashion to find a proof by hand; in other words, the use of instantiation is not permitted.
1308
Collected Works of Larry Wos Summary and Conclusions
Rather than releasing a torrent of information and evidence, I have instead presented little more than a trickle to suggest how an automated reasoning program serves well as a research assistant. In that regard, my colleagues and I have used such a program to prove theorems, test and suggest conjectures, construct objects, produce more elegant proofs than previously known, and— clearly of greatest satisfaction—answer open questions from various unrelated fields of mathematics and logic. Through the use of automated reasoning— and mainly through the use of the automated reasoning program OTTER—we have answered questions from group theory, combinatory logic, finite semigroup theory, and various logic calculi. Some of the questions were posed by Irving Kaplansky, some by Dana Scott, some by Raymond Smullyan, and some by John Kalman. Our successes motivate my recommendation that researchers be at least skeptical when reading articles such as "Computers Still Can't Do Beautiful Mathematics" (New York Times, July 14, 1991, Week in Review). Indeed, to see that beautiful mathematics sometimes results from the use of an automated reasoning program, one need only consider the three conjectures offered at the beginning of this article, review OTTER's approach to settling each, and study the additional open questions whose answers I cite. Were one to apply a Turing like test to the results produced by OTTER—a test that asks if an observer can know whether a computer or a researcher produced them, emphasizing quality, significance, and elegance—I suspect that rather high marks would be given. Whether the turn of the century will find many open questions under attack by a team consisting of a researcher and an automated reasoning program is left to time to settle. Clearly, the preceding decade has witnessed a sharp increase in that regard, sometimes culminating in the answer to a question that had remained open for decades. Thus we have evidence that an automated reasoning program can and occasionally does contribute to mathematics and logic. The field of automated reasoning is relatively young (dated by some as begin ning in the early 1960s) and, fortunately, still most challenging. Approximately 40 years ago, one might indeed have wondered how research could possibly ad dress the three main obstacles to the automation of logical reasoning: a language to present to a computer the specific question of interest, a means for the com puter to draw sound conclusions, and a strategy for sufficiently controlling the reasoning to permit the computer to complete the underlying research. In this article, I show how these obstacles and others that were eventually identified were overcome, focusing mainly on the approach taken within the Mathemat ics and Computer Science Division of Argonne National Laboratory. Because open questions have played such a key role in the development of our approach, I eagerly seek additional open questions to attack with our newest program OTTER. Although at the simplest level an automated reasoning program (of the
Automated Reasoning Answers Open Questions
1309
type featured in this article) just accrues conclusions with no understanding of their meaning, I show in this article how the program's use of strategy can totally change the game. Indeed, strategy plays a key role in our paradigm. The paradigm also relies on the use of a number of inference rules, some of which are clearly oriented to application by a computer rather than by a person—for example, paramodulation, which effectively generalizes equality substitution. Thus a program such as OTTER is far more than a symbolic calculator offering impressive speed and accuracy: Such a program reasons logically, sometimes so effectively that the results are published in mathematics and in logic journals. Rather than ever being a replacement for the mathematician or logician, automated reasoning programs nicely complement the researcher. Indeed, their value as research assistants should continue to grow—and perhaps at an increas ing rate. Source Material More than any other reasoning program of which I have knowledge, we rec ommend McCune's program OTTER, which runs effectively on workstations, (IBM-compatible) personal computers, and Macintoshes. Among its excellent features, its use produces proofs that include all steps and the corresponding justification, permitting one to follow the typical practice in mathematics and logic of a thorough reading, occasionally gleaning from one of the proofs unex pected insight into the field under study. Consistent with my objective of encouraging researchers to use an automated reasoning program and my objective of accruing additional open questions to attack—awkward though it may be—I recommend consideration of my newest book Automated Reasoning: Introduction and Applications, second edition [13]. This McGraw-Hill volume contains a copy of OTTER on diskette, the source for workstations and load modules for personal computers. The sixteenth chapter is devoted solely to a tutorial on the use of OTTER, and useful input files are found throughout the book. Also, information for obtaining a copy of OTTER is available by sending e-mail to [email protected], and information for access ing a database of problems and proofs is available electronically, by accessing info.mcs.anl.gov via anonymous FTP. References [1]J. Guard, F. Oglesby, J. Bennett, and L. Settle, "Semi-Automated Math ematics", Journal of the A CM 16, 49-62 (1969). [2] J. Lukasiewicz, "The Shortest Axiom of the Implicational Propositional Calculus", Proc. of the Royal Irish Academy 52A, no. 3, 25-33 (1948). [3] W. McCune, OTTER 2.0 Users Guide, Technical Report ANL-909, Argonne National Laboratory, Argonne, Illinois (1990). [4] W. McCune and L. Wos, "The Absence and the Presence of Fixed Point Combinators", Theoretical Computer Science, 87, 221-228 (1991).
1310
Collected Works of Larry Wos
[5] W. McCune and L. Wos, "Application of Automated Deduction to the Search for Single Axioms for Exponent Groups", Proc. LPAR'92, SpringerVerlag Lecture Notes in Artificial Intelligence (to appear), Preprint MCS-P2910292 (1992). [6] A. Quaife, "Automated Deduction in von Neumann-Bernays-Goedel Set Theory", Journal of Automated Reasoning 8, no. 1, 91-147 (1992). [7] A. Quaife, "Automated Development of Tarski's Geometry", Journal of Automated Reasoning 5, no. 1 97-118 (1989). [8] A. Quaife, "Unsolved Problems in Elementary Number Theory", Journal of Automated Reasoning 7, no. 2, 287-300 (1991). [9] S. Winker, "Generation and Verification of Finite Models and Counterex amples Using an Automated Theorem Prover Answering Two Open Questions", Journal of the ACM 29, 273-284 (1982). [10] S. Winker, L. Wos, and E. Lusk, "Semigroups, Antiautomorphisms, and Involutions: A Computer Solution to an Open Problem, I", Mathematics of Computation 37, 533-545 (1981). [11] L. Wos, Automated Reasoning: S3 Basic Research Problems, PrenticeHall, Englewood Cliffs, N.J. (1987). [12] L. Wos, "The Kernel Strategy and Its Use for the Study of Combinatory Logic", Journal of Automated Reasoning (to appear). [13] L. Wos, R. Overbeek, E. Lusk, and J. Boyle, Automated Reasoning: Introduction and Applications, 2nd ed., McGraw-Hill, New York (1992). [14] L. Wos, S. Winker, R. Veroff, B. Smith, and L. Henschen, "A New Use of an Automated Reasoning Assistant: Open Questions in Equivalential Calculus and the Study of Infinite Domains", Artificial Intelligence 22, 303-356 (1984). [15] L. Wos, S. Winker, R. Veroff, B. Smith, and L. Henschen, "Questions Concerning Possible Shortest Single Axioms in Equivalential Calculus: An Ap plication of Automated Theorem Proving to Infinite Domains", Notre Dame Journal of Formal Logic 24, 205-223 (1983).
Preface: The Field of Automated Reasoning
Abstract—The term automated reasoning (first introduced in 1980) accurately describes the objective of the field, the automation of log ical reasoning. This article introduces scientists to the field and then briefly describes the papers found in this special issue. Keywords—Automated reasoning, Inference rules, Logical rea soning, Redundancy, Strategy.
1. INTRODUCTION AND BACKGROUND This issue is devoted entirely to the field of automated reasoning. Although the field is equally concerned with theory, implementation, and application, the papers in this issue emphasize the latter two aspects. The term automated reasoning was first coined in 1980 to reflect the broadening of its predecessor, automated theorem proving. Indeed, rather than focusing almost exclusively on proving theorems from mathematics and logic, by 1980 the applications had ex panded to include program verification, circuit design and validation, hypothesis testing, conjecture formulation, and puzzle solving. The name automated reasoning accurately suggests the main objective of the field: the design of computer programs that reason logically, drawing con clusions that follow inevitably from the hypotheses supplied by the user of such a program. In other words, if an automated reasoning program is sufficiently free of bugs, the reasoning it applies is sound. Although not the concern in any of the papers presented here, some automated reasoning programs also permit the user to ask for probabilistic reasoning, usually by a suitable modification of those statements of the input that characterize the question or problem under study. Of course, from a practical perspective, merely designing a computer pro gram that reasons logically offers little, unless the program can be used to This work was supported by the Office of Scientific Computing, U.S. Department of En ergy, under Contract W-31-109-Eng-38. Reprinted with permission from Computers and Mathematics with Applications, Vol. 29, no. 2, xi-xiv (February 1995).
1312
Collected Works of Larry Wos
answer questions and solve problems that interest people outside of automated reasoning. The papers in this issue strongly suggest that the field of automated reasoning has in fact arrived. Indeed, among other successes, reasoning programs have been used to answer open questions from mathematics and logic and to validate a chip that is now in use. The achievements are most impressive when one realizes that eminent logicians such as Lukasiewicz asserted in 1948 that a formalized proof cannot be "discovered mechanically" but can only be "checked mechanically" [1]. Clearly, one could not have expected foresight sufficient to predict what would occur beginning in the early 1960s and culminating in the early 1990s with the availability of powerful and versatile automated reasoning programs. However, and in contrast to the understandable lack of foresight exhibited in 1948, even today various researchers are more than skeptical (see, especially, [2]) regarding the use of a computer program to produce proofs in which numerical calculation is not the crux, proofs such as one finds in group theory, for ex ample. A charitable explanation for the current skepticism—and worse—might be inadequate dissemination of information. The papers of this issue provide substantial evidence refuting the naysayers regarding the possible automation of logical reasoning (see also [3]). The source of the impressive power offered by the better reasoning programs rests in part with the use of strategy [4],[5]. Some programs offer the user a choice of strategies to restrict the reasoning, preventing certain paths of inquiry from being explored. Of a quite different character, some programs offer the user a choice of strategies to direct the reasoning, providing a means for the program to decide where next to focus its attention. Evidence strongly suggests that, for a reasoning program to be of substantial use for answering diverse and deep questions, its menu must include a number of strategies from each class. For some programs, the basis of power also rests with mechanisms to control redundancy [6]. To be effective, a reasoning program must cope with two types of redundancy, especially evident when conclusions are retained, but an obsta cle even when they are not retained [7]. The more obvious type of redundancy concerns drawing the same conclusion repeatedly, from different paths of rea soning, and drawing pairs of conclusions one of which is less general than is the other. Some programs offer the procedure subsumption to cope with this type of redundancy by purging less general information when more general information is present. The less obvious form of redundancy, which might be termed seman tic redundancy, can be illustrated with two examples. For the first example, in many cases, semantic redundancy is present when a program retains both the fact that a + b = c and the fact that 0 + o + b) = c. For the second example, ordinarily, semantic redundancy is present when the program retains the two equalities (a -I- 6) + c = d and o + (b + c) = d. To cope with this type of redun dancy, some programs offer the procedure demodulation, a procedure that can be used to canonicalize and simplify expressions. For a thorough treatment of subsumption and of demodulation, see [4],[5].
The Field of Automated Reasoning
1313
As for the language for presenting questions and problems, variants of firstorder predicate calculus are frequently used. Regarding the reasoning itself— although some programs offer induction and some offer an approach based on complete sets of reductions—typically, the inference rules used to draw conclu sions are tailored to the field of automated reasoning, rather than emulating the reasoning people apply. For example, in contrast to offering instantiation as an inference rule—permitting the program to deduce that (yz){yz) = e from the hypothesis that xx = e, where e is the identity of a group—inference rules such as paramodulation [4],[5] are sometimes offered. Paramodulation generalizes the usual notion of equality substitution and is an excellent example of an infer ence rule that is both difficult for a person to apply and trivial for a computer program to apply. Indeed, one finds that, rather than emulating the mind of a researcher, many automated reasoning programs complement the researcher, often acting as an automated reasoning assistant. The effectiveness of today's automated reasoning assistants is attested to by the various papers in this issue. Let us therefore turn now to a brief review of those papers. 2. BRIEF REVIEW OF THE PAPERS The papers in this special issue on automated reasoning fall loosely into two groups. In the first group, the papers focus on the use of automated reason ing programs to answer previously open questions in mathematics or logic. In the second group, the papers discuss in depth some specific automated reason ing programs. One paper, the last in this issue, spans both groups: The paper discusses the application of a new strategy and also presents an overview of OTTER, a powerful automated reasoning program used in several of the appli cations reported in this issue. To aid the reader, we now summarize the papers, following the order in which they appear.
2.1. K. Kunen — Groups of Exponent 4 and O T T E R In his paper 'The Shortest Single Axioms for Groups of Exponent 4", K. Kunen successfully searches for single axioms for a particular variety of groups, those in which the fourth power of every element x is the identity e. Kunen uses the program OTTER to prove that three such axioms exist, eliminating the rest with the use of models. He also presents an improvement on B. H. Neumann's scheme for single axioms for varieties of groups.
2.2. R. Padmanabhan and W . McCune — Ternary Boolean Algebra and O T T E R In their paper "Single Identities for Ternary Boolean Algebras", R. Padman abhan and W. McCune offer for ternary Boolean algebra the first known single axioms. They use a method of Padmanabhan to find a single axiom, then show how the automated reasoning program OTTER was used to obtain a simpler axiom.
1314
Collected Works of Larry Wos
2.3. R. Padmanabhan and W . McCune — Algebraic Geometry and O T T E R In their paper "Automated Reasoning about Cubic Curves", R. Padmanab han and W. McCune study algebraic geometry by enhancing McCune's program OTTER with a new inference rule gL. They use the enhanced program to prove various incidence theorems on projective curves and without any reference to the geometry or the topology of the curves. Their application provides a new use for automated reasoning programs.
2.4. R. Boyer, M. Kaufmann, and J Moore — N q t h m and Verification In their paper "The Boyer-Moore Theorem Prover and Its Interactive En hancement", R. Boyer, M. Kaufmann, and J Moore describe the Boyer-Moore program Nqthm and its extension. These two programs, mainly used for verifi cation of both hardware and software, appear to be among the best currently available for these applications. The authors introduce the logic in which the orems are proved and present a detailed example of how the programs can be used. To show the breadth of the two programs, the authors also give short descriptions of numerous and diverse applications.
2.5. S. Chou and X.-S. Gao — Theorems in Pascal Conies S. Chou and X.-S. Gao, in their paper "The Computer Searches for Pascal Conies", discuss an approach to discovering new theorems in geometry, an ap proach that relies on numerical examples and that is based on Wu's method. Four theorems related to Pascal conies have been discovered, two of which may be new.
2.6. C. Brink, D. Gabbay, and H. J. Ohlbach — Automating Dualities in Mathematics and O T T E R Among the dualities that can occur between different theories that can occur in mathematics and in logic, C. Brink, D. Gabbay, and H. J. Ohlbach focus on structures and power structures in their paper "Towards Automating Duality". They show how properties of one theory can be automatically translated into corresponding properties of the other theory by using quantifier-elimination al gorithms and a theorem-proving program relying on first-order predicate logic. A particular instance of the duality between structures and power structures is the duality between an axiom of a Hilbert-style specification of a logic and the corresponding semantic property. Their approach is illustrated with examples treated with the automated reasoning program OTTER.
2.7. D. Kapur and H. Zhang — RRL and Rewrite Rules In their paper "An Overview of Rewrite Rule Laboratory RRL", D. Kapur
The Field of Automated Reasoning
1315
and H. Zhang provide a brief historical account of the development of their program RRL. Among the automated reasoning programs based on the use of rewrite rules, their program may be the most powerful, as evidenced by its successful use to solve hard mathematical problems. The authors include an overview of the capabilities of RRL and discuss various applications.
2.8. J. Slaney, M. Pujita, and M. Stickel — Quasigroups and Program Comparisons In their paper "Automated Reasoning and Exhaustive Search", J. Slaney, M. Pujita, and M. Stickel study and compare the use of three reasoning programs in the context of solving problems in the theory of quasigroups. Each of the three programs successfully answered previously open questions in this area of mathematics. The authors also include a philosophical discussion focusing on proofs that are essentially computational.
2.9. L. Wos — Resonance Strategy, Shorter Proofs, and OTTER The volume concludes with the paper "The Resonance Strategy", which defines and applies the resonance strategy discovered by L. Wos. The paper shows how the resonance strategy was used to find shorter proofs than were previously known and to prove theorems that were previously out of reach of an automated reasoning program. The successes (obtained with the aid of the automated reasoning program OTTER) are taken from group theory, Robbins algebra, and various logic calculi. Included in the paper is an introduction to the features of the program OTTER. 3. THE POWER OF AUTOMATED REASONING The nine papers in this issue give a tantalizing taste of the power of today's automated reasoning programs. Both special-purpose programs such as Nqthm and general-purpose programs such as OTTER and RRL are now successfully used to answer open questions and solve hard problems from mathematics, logic, and software and hardware verification. If these papers are indicative of the future, then the outlook is indeed bright, for access to a powerful automated reasoning assistant of the type described in this volume will play a key role in both research and applications of a wide variety. Larry Wos Guest Editor REFERENCES 1. J. Lukasiewicz, The shortest axiom of the implicational prepositional cal culus, Proc. Royal Irish Academy 52A 3,25-33 (1948).
1316
Collected Works of Larry Wos
2. G. Kolata, Computers still can't do beautiful mathematics, The New York Times, Section E, p. 4, (July 1991). 3. L. Wos, Automated reasoning answers open questions, Notices of the A MS 5 (1), 15-26 (January 1993). 4. L. Wos, Automated Reasoning: S3 Basic Research Problems, Prentice-Hall, Englewood Cliffs, NJ, (1987). 5. L. Wos, R. Overbeek, E. Lusk, and J. Boyle, Automated Reasoning: In troduction and Applications, 2nd ed., McGraw-Hill, New York, (1992). 6. L. Wos, R. Overbeek, and E. Lusk, Subsumption, a sometimes undervalued procedure. In Festschrift for J. A. Robinson, (Edited by J.-L. Lassez and Gordon Plotkin), pp. 3-140, MIT Press, Cambridge, MA, (1991). 7. L. Wos and W. McCune, Automated theorem proving and logic program ming: A natural symbiosis, Logic Programming 11 (1), 1 -53 (July 1991).
The Resonance Strategy L. Wos Mathematics and Computer Science Division Argonne National Laboratory Argonne, IL 60439-4844, U.S.A. wosQmcs.anl.gov
Abstract— Especially in mathematics and in logic, lemmas (basic truths) play a key role for proving theorems. In ring theory, for ex ample, a useful lemma asserts that, for all elements x, the product in either order of 0 and x is 0; in two-valued sentential (or propositional) calculus, a useful lemma asserts that, for all x, x implies x. Even in algorithm writing and in circuit design, lemmas play a key role: minusminus(x)) = x in the former and NOT(AND(x, y)) = OR(NOT(x),NOT(j/)) in the latter. Whether the object is to prove a theorem, write an algorithm, or design a circuit, and whether the assignment is given to a person or (preferably) to an automated reasoning program, the judicious use of lemmas often spells the dif ference between success and failure. In this article, we focus on what might be thought of as a generalization of the concept of lemma, namely, the concept of resonator, and on a strategy, the resonance strategy, that keys on resonators. For example, where in Boolean groups—those in which the square of every x is the identity element e—the lemmas yzyz = e and yyzz — e are such that neither gen eralizes the other, the resonator (formula schema) * * ** = e, by using each occurrence of "star" to assert the presence of some vari able, generalizes and captures (in a manner that is discussed in this article) both lemmas. Note that the cited resonator, if viewed as a lemma with star replaced by some chosen variable, captures neither cited lemma as an instance. Lemmas of a theory are provably "true" in the theory and, therefore, can be used to complete an assignment. This work was supported by the Office of Scientific Computing, U.S. Department of En ergy, under Contract W-31-109-Eng-38. Reprinted with permission from Computers and Mathematics with Applications, Vol. 29, no. 2, 133-178 (February 1995).
1318
Collected Works of Larry Wos In contrast, resonators, which capture collections of equations or col lections of formulas that may or may not include truths, are used by the resonance strategy to direct the search for the information needed for assignment completion. In addition to discussing how one finds useful resonators, we detail various successes, in some of which the resonance strategy played a key role in obtaining a far better proof and in some of which the resonance strategy proved indispensable. The successes are taken from group theory, Robbins algebra, and various logic calculi. Keywords—Automated reasoning, Group theory, Logic calculi, Open questions, OTTER, Resonance strategy, Robbins algebra.
1. GENESIS OF T H E RESONANCE STRATEGY We at Argonne National Laboratory constantly seek a question or a problem that is currently out of reach of the most powerful automated reasoning program we have in hand, and then commence our attack. To this date, we have always used for such experiments a program we have designed and implemented. Our goal is, on the one hand, to bring the question or problem within reach of our program and, on the other hand and more generally, to formulate a new strat egy, inference rule, or methodology that produces the success. We then test the new strategy, inference rule, or methodology on related problems and then on unrelated problems. Many of our contributions to automated reasoning can be traced directly to applying the cited approach; see [1, Chapter 2] for appropriate anecdotes, and see [2] for recent successes. Indeed, this article typifies our pre ferred approach to research in automated reasoning, research that continues to extend the Argonne paradigm for the automation of logical reasoning (presented in detail in [3]). To enable researchers to experience and test the power of the cited paradigm, we include various input files for the study of various areas of mathematics and logic. Each of the input files can be put to a broad use by appropriate modification of its elements, commenting out or commenting in various options. To comment out an element, one simply places a "%" before the element to be ignored by McCune's program OTTER [4]. To comment in an option so that it can be used, one simply removes the "%" that prevents its use. As a further aid to accessing the material in this lengthy paper, the following map is in order. Section 1.1 answers the natural question concerning the original motiva tion for the research reported here, research that culminated in Experiment 0 (presented in Section 1.2) that gave birth to the resonance strategy and to the concept of resonator (defined formally in Section 2). To provide a comparison with more familiar notions, in Section 1.3 we discuss the concept of resonator as
The Resonance Strategy
1319
a generalization of the concept of lemma (so frequently used in mathematics). In Section 1.4 we offer 68 theorems (or theses) that serve well for evaluating new ideas, new approaches, and new reasoning programs, and in Section 1.5 we offer some experimental results that preceded the formulation of the resonance strat egy. A comparison of these early results with successes obtained with the use of the resonance strategy strongly suggests the power offered by the strategy. To complete the picture, we then turn in Section 2 to the resonance principle and (as promised) the formal definition of a resonator so central to the resonance strategy. Because we continually seek to encourage the use of McCune's program OT TER, Section 3 is devoted to various features of this program. There we briefly touch on representation (in Section 3.1) and lists for presenting a question or problem, strategy (in Sections 3.2 and 3.4) for controlling reasoning, and (in Sections 3.3, 3.5, and 3.6) a means (weighting) for imposing the researcher's knowledge and intuition on a program's actions. Of the various inference rules OTTER offers for drawing conclusions, the only one that is featured is paramodulation (in Section 3.8), for the actions of this inference rule (more than those of any other rule) are far more complex. Sections 3.7 and 3.9 are devoted, respec tively, to other OTTER commands and to source material for learning more about this program. To provide hard evidence for the value of using the resonance strategy, we turn to its iterative use in Section 4 for the study of two-valued sentential (or prepositional calculus) and to its use in Sections 5 and 6, respectively, for the study of Robbins algebra and group theory. These uses of the resonance strategy might be termed static, as opposed to its dynamic use as discussed in Section 2. As further evidence of the power offered by the resonance strategy, we turn in Section 7 to its use for completing elegant proofs, especially in the context of seeking shorter proofs. There we discuss various aspects of elegance, including that of compactness, a property that may never have been the object of previous research. To stimulate research, we also offer (in Section 7.1) a question focusing on shorter proofs—a question that nicely complements that (posed in Section 5) which is still open concerning Robbins algebra—and (in Section 7.2) feature a charming proof (of a deep theorem in many-valued sentential calculus), a proof that avoids the use of terms of a certain type. We conclude the section with a brief discussion (in Section 7.3) of various practical aspects that focus on circuit design and on algorithm synthesis.
1.1. Scott's Challenge The genesis of the research reported in this article was a set of 68 theorems from two-valued sentential (or propositional) calculus [5] suggested by Dana Scott [6]; see Section 1.4 for the 68 theorems, which Lukasiewicz calls theses and which throughout this article we sometimes call theorems and sometimes call theses. An axiomatization for this area of logic consists of the following three formulas
Collected Works of Larry Wos
1320
in which the function i can be interpreted as "implication" and the function n can be interpreted as "negation". (LI) (L2) (L3)
i(i(x,y),i(i(y.z),i(x,z))) i(i(n(x),x),x) i(x,i(n(x),y))
An axiom set is complete for two-valued sentential calculus if the set of formulas that can be deduced from it with the use of condensed detachment (defined and illustrated shortly) and instantiation is precisely the set of formulas (in effect, unit clauses) that are true under all assignments of true and false, with implication and negation used as logicians use these terms. Scott (in effect) issued a challenge to our automated reasoning program OTTER [4] by asking how many of the 68 theorems (given in Section 1.4) it could prove, using as axioms LI, L2, and L3; see [7] for additional detail and related items. In contrast to that earlier paper in which we presented a 30-step proof establishing that the Lukasiewicz axiom system (consisting of theses LI, L2, and L3) implies the Church axiom system (consisting of theses 18, 35, and 49), in Section 7.1 we present shorter proofs—indeed, three different proofs, each of length 22. With my colleague William McCune (author of OTTER), the challenge was accepted. Of especial interest to us was our lack of familiarity with two-valued sentential calculus and with the Lukasiewicz axiom system. From the viewpoint of research, more important than the excitement produced by using our program in a new area was the fact that any successes would clearly be free of the justifiable concern that we might have substantially aided the program, even if unwittingly. As evidence of our lack of knowledge and bias, when we began our attack, we did not even know that the 68 theorems are tightly coupled. Indeed, only after our formulation of the resonance strategy, which is the focus of this article, did we learn of the coupling. To instruct OTTER to attempt to prove the 68 theorems, we were fortu nate in that the study of this area of logic often relies on the use of condensed detachment, an inference rule that can be applied by a reasoning program by using hyperresolution and the following clause, where " | " means logical or and "—" means logical not. Also, the predicate P can be interpreted as "provable" and the function i as "implication" (with i an encoding of —»). % The following clause is used with hyperresolution for % condensed detachment. -P(i(x,y)) I -P(x) | P(y).
For this area of logic, condensed detachment considers two formulas, (A —* B) and C—respectively called the major and the minor premiss—and, if C unifies with A, yields the formula D, where D is obtained by applying to B the most general unifier of C and A. (For the curious, and consistent with earlier publications, the word "premiss" is spelled as Church recommends.) Unification is a procedure that considers two expressions and seeks to find the most general
The Resonance Strategy
1321
substitution of terms for variables that makes the two identical. Unification is the basis of many of the procedures applied by OTTER and, more general' relied upon in automated reasoning (see [1,3]). Just for illustration, if one applies condensed detachment to i(x,i(x,i(y,y))) and i(z,z) with the second formula playing the role of C, one obtains i(i(z,z),i(y,y)). If one reverses the roles of the two formulas and applies condensed detachment, one obtains a copy of the first formula. In addition to instructing OTTER to use hyperresolution, we relied on three of the program's features to begin our attack on the 68 theorems suggested by Scott. First, the researcher can assign a maximum to the number of proofs to be sought in a single run; in our case, we assigned the maximum to be infinity, for any given theorem might be proved more than once, making the assignment of 68 unwise. Second, one can place the denials of theorems under attack in a special list, list(passive), to prevent their playing any role in the reasoning other than ascertaining the completion of a proof. When having a program attempt to prove a number of independent theorems, a wise move is to prevent their interaction. We did place the negation (or denial) of each of the 68 theorems in list (passive). Third, to ascertain which theorems had been proved while the run was in progress, we appended to each denial an ANSWER literal with the corresponding thesis number; Lukasiewicz calls the theorems under discussion theses. Consistent with our view that the use of strategy is crucial in almost all cases—both strategy to restrict a program's reasoning and strategy to direct it—we used the set of support strategy and weighting. For the set of support strategy, which restricts the reasoning by requiring that all conclusions that are drawn be recursively traceable to a designated input set (the initial set of support), we placed in list(sos) the three Lukasiewicz axioms L1,L2, and L3. Regarding weighting, which permits one to define the complexity of a conclusion to reflect one's knowledge and intuition and thus strongly influence OTTER's choice of where next to focus attention, we simply used symbol count. After all, we had no knowledge of the field and certainly no intuition; therefore, the natural move was to instruct the program to choose as the next focus of attention the simplest available conclusion, where simplicity was measured in terms of symbol count. Our initial attack was indeed encouraging: In the first run, OTTER proved 37 of the 68 theorems to be proved. However, essentially no additional progress
Collected Works of Larry Wos
1322
was made until we turned to the use of a parallel version of OTTER (ROO), whose use eventually led to proofs of 48 of the 68 theorems. We could get no further. Although proving 48 out of 68 theorems might be considered as meeting the original Scott challenge moderately well, to be completely candid, we wished to send to Scott a more impressive total success.
1.2. T h e Resonance Strategy Is Born More than thirty years of experimentation with automated reasoning programs has strongly suggested that, sometimes, intuition or a guess without evidence should be boldly followed. Such a move is especially appealing since, when com pared with research conducted by hand, one of the advantages of relying on the assistance of an automated reasoning program to investigate a wild guess is that the latter costs relatively little in time or energy. The hypothesis (or guess) that drove the next phase of the attack on the 68 theorems was to conjecture that, since they are all from the same field of logic, perhaps some (possibly strong) connection existed among them. Even if they were not connected, their shape or functional skeleton, ignoring variables, might hold an important clue for directing OTTER's search for the desired 68 proofs. For a taste of what is meant by "shape" of a formula, we offer the following two expressions which, though not identical, have the same shape. i(i(x,i(y,z)),i(i(y,x),i(y,z))) i(i(x,i(y,z)),i(i(x.y),i(x,z))) The two cited formulas are in fact identical ifone ignores the particular variables or, equivalently, considers the variables to be indistinguishable. We then placed the clause equivalent of each of the 68 theorems in a list, called weight-list (pick_and_purge), that is used by OTTER to direct its search and also to decide which information to purge upon generation; we note that a more complete treatment of the subject is given in Section 3.5. The placement of a formula in this list in no way asserts that the formula holds or is a valid lemma. The clause equivalent (for OTTER) of each of the theorems is obtained by prefixing each with some predicate, say P, postfixing each with a period, and (of course) adding an additional opening and an additional closing parenthesis. We also assigned to each of the 68 clauses under discussion a weight of 2, causing the program to prefer for the focus of attention any retained formula that matched in shape (ignoring the specific variables present) any of the 68 formulas. By setting the maximum of the weight of retained formulas equal to 20, any deduced formula that matched in shape one of the 68 formulas under discussion was retained, for it was given a weight of 2. (The max.weight was set to 20 because the longest formula in symbol count among the 68 has length 20, when the predicate is counted.) Both for being chosen as the focus of attention to direct the reasoning and for deciding whether to be retained (rather than discarded), any other formula was given a weight equal to its symbol count.
The Resonance Strategy
1323
When OTTER executed the new approach of directing its search by keying on formulas that match in shape one of the 68 theorems to be proved, in a single run, all were proved in less than 16 CPU-minutes on a SPARCstation H—and the resonance strategy was born. (We shall refer to this experiment throughout this article as Experiment 0.) We thus had the first evidence of the potential power of using the resonance strategy, a strategy that enables the researcher to designate chosen formulas or equations to be of especial interest because of their symbol pattern (or shape), with variables ignored. However, when one learns as we later did that the 68 theses are in fact tightly coupled, one might have an immediate and justifiable concern that the program is (in effect) proof checking some larger result. This concern was expressed by one of my colleagues early in the study of this new resonance strategy. In Sections 4-7, we provide ample evidence to put this concern to rest. As part of that evidence, we discuss the case in which the use of resonators— implemented with weight templates to direct the program's search—that were taken from a theorem from Robbins algebra led to the discovery of a shorter proof of that same theorem. This success motivated a number of studies (cited in Sections 6 and 7) featuring the resonance strategy to seek proofs more elegant than previously known, studies that culminated in finding far shorter proofs in other areas that include group theory and logic calculi.
1.3. Resonator as Generalization of Lemma That proof checking is not what is occurring is reinforced when one recalls that resonators are more general than are lemmas, for lemmas assert truths whereas resonators assert nothing. Resonators instead capture a set of statements, some of which may in fact be false. To produce the set of statements captured by a given resonator R, one begins by noting that a resonator is a formula schema obtained from a formula or equation by replacing each variable occurrence in the formula or equation by *; the formal definition is given in Section 2. The statements captured by R are precisely those that can be obtained by replacing each occurrence of * by a variable, with no constraint placed on whether the variables must be distinct; indeed, the various occurrences of * in R can be assigned the same or different variable names. For example, where in Boolean groups—those in which the square of every x is the identity element e—the lemmas yzyz = e and yyzz = e are such that neither generalizes the other, the resonator (formula schema) **** = e, by using each occurrence of "star" to assert the presence of some variable, generalizes and captures (in a manner that is discussed in this article) both lemmas. In contrast, among the equations captured by the resonator **** = e is the equation xxxy = e, which is clearly not true in all Boolean groups. Expressed in one of the acceptable ways to OTTER, the inclusion of the following resonator (where the function / denotes product and the occurrences of * have been replaced by arbitrarily chosen variable names) will ordinarily
ColJected Works of Larry Wos
1324
cause OTTER to prefer for the focus of attention equations such as yzyz = e and yyzz = e. weight(f(x,f(y,f(z,x))) - e,2). The point here is that OTTER treats all variables in a weight template (of the type just given) as indistinguishable or ignorable, other than recognizing them as variables. Of course, neither cited equation that might ordinarily be preferred will be retained, when deduced, if forward subsumption (denned in Section 3.7) is in use and the hypothesis xx = e that defines Boolean groups is present. For a second example, let us consider some of the consequences of including the following resonator (expressed in OTTER notation), which corresponds to thesis 35 as numbered by Lukasiewicz. (Throughout this article, when we talk about a resonator that corresponds to some thesis or the like, we mean that it has the same shape or functional skeleton as does the thesis and that the particular variables which replace the occurrences of star are irrelevant. Further, we typically talk about the variables in a resonator, recognizing that, in a strict sense, the occurrences of star designate variable presence in that position.) For clarity, although the following expression is (as a formula presented in clause form) identical to thesis 35, as a resonator (in OTTER notation), the variables are ignored. weight(P(i(i(x,i(y,z)),i(i(x,y),i(x,z)))),2). Because a weight of 2 has been assigned to the template, any formula—in par ticular, the following two—that matches it in shape will be given preferential treatment for directing the program's reasoning. i(i(x,i(y,z)),i(i(y,x),i(y,z))) i(i(x,i(y,z)),i(i(x,y),i(x,z))) To mechanically test a formula or equation for possibly "matching" a resonator expressed in the star notation, one first replaces all occurrences of star with variables such that no two variables are identical, and then one determines whether a renaming of the variables yields the formula or equation; if such a renaming exists, then the formula or equation matches a resonator. Because variables in a resonator (expressed in OTTER notation) are consid ered to be indistinguishable, both formulas are "captured" by the given res onator. In contrast, if one considers the corresponding clauses or (possible) lemmas, then the second of the two formulas, which itself is (in effect) iden tical to the given resonator, is not captured or generalized by the first, nor is the first captured by the second. We again see how the concept of resonator is (in the illustrated sense) a generalization of the concept of lemma. We also see that resonators can be used to guide a reasoning program's search, a use that contrasts nicely with the use of lemmas as truths from which to reason. If no statements that are true in the theory under study are captured by a given
The Resonance Strategy
1325
resonator, then, most likely, the inclusion of the resonator is pointless, for no deduced conclusion will match the resonator. On the other hand, if but a single deduced and retained conclusion is captured by a resonator—and hence given preference dictated by the weight assigned to the resonator—the inclusion of that resonator can dramatically improve the effectiveness of the program. As contrasted with what one might call the syntactic sense, the concept of resonator also generalizes the notion of lemma in the following semantic sense. One distinction sometimes made between the concept of lemma and that of theorem is that the former is often not of great interest in and of itself but, instead, is of interest for proving one or more theorems that are of interest in and of themselves. Resonators, by being used to increase the effectiveness of a program's search, are also primarily of interest for their value in proving one or more theorems. Since a single resonator can capture (in the sense just discussed) a large set of lemmas, the concept of resonator generalizes that of lemma. Further, all consequences of a lemma obtained by substitution are true, for a lemma (to be accepted for a theory) must be true. In contrast, and as part of the generalization, a resonator may be such that some statements captured by it are false and some are true.
1.4. The 68 Theorems for Study For those who might wish to pursue appropriate research, the 68 theses, num bered according to the way Lukasiewicz numbered them, are the following; in particular, theses 1, 2, and 3 are, respectively, LI, L2, and L3. (thesis_4) i(i(i(i(x,y),i(z,y)),u),i(i(z,x),u)) (thesis_5) i(i(x,i(y,z)),i(i(u,y),i(x,i(u,z)))) (thesis_6) i(i(x,y),i(i(i(x,z),u),i(i(y,z),u))) (thesis_7) i(i(x,i(i(y,z),u)),i(i(y,v),i(x,i(i(v,z),u)))) (thesis_8) i(i(x,y),i(i(z,x),i(i(y,u),i(z,u)))) (thesis_9) i ( i ( i ( n ( x ) , y ) , z ) , i ( x , z ) ) (thesis_10) i(x,i(i(i(n(x),x),x),i(i(y,x),x))) (thesis.ll) i(i(x,i(i(n(y),y),y)),i(i(n(y),y),y)) (thesis_12) i ( x , i ( i ( n ( y ) , y ) , y ) ) (thesis_13) i(i(n(x),y),i(z,i(i(y,x),x))) (thesis_14) i(i(i(x,i(i(y,z),z)),u),i(i(n(z),y),u)) (thesis_15) i ( i ( n ( x ) , y ) , i ( i ( y , x ) , x ) ) (thesis_16) i ( x , x ) (thesis_17) i ( x , i ( i ( y , x ) , x ) ) (thesis_18) i ( x , i ( y , x ) ) (thesis_19) i ( i ( i ( x , y ) , z ) , i ( y , z ) ) (thesis_20) i ( x , i ( i ( x , y ) , y ) ) (thesis_21) i(i(x,i(y,z)),i(y,i(x,z))) (thesis_22) i ( i ( x , y ) , i ( i ( z , x ) , i ( z , y ) ) ) (thesis_23) i(i(i(x,i(y,z)),u),i(i(y,i(x,z)),u))
Collected Works of Larry Wos
1326 (thesis_24) (t.hesis_25) (thesis_26) (thesi8_27) (thesis_28) (the8i8_29) (thesiB_30) (thesis_31) (thesis_32) (thesis_33) (thesis_34) (thesis_35) (thesis_36) (thesis_37) (thesis_38) (thesis_39) (the8is_40) (the8is_41) (thesis_42) (the8i8_43) (thesis_44) (thesis_45) (thesis_46) (thesis_47) (thesis_48) (theais_49) (thesis_50) (thesis_51) (thesis_52) (the8is_53) (thesis_54) (thesis_55) (thesi8_56) (thesis_57) (thesis_58) (thesis_59) (thesis_60) (thesis_61) (thesis_62) (thesis_63) (thesis_64) (thesis_65) (thesi8_66) (thesis_67)
i(i(i(x,y),x),x) i(i(i(x,y),z),i(i(x,u),i(i(u,y),z))) i(i(i(x,y),z),i(i(z,x),x)) i(i(i(x,y),y),i(i(y,x),x)) i(i(i(i(x,y),y),z),i(i(i(y,u),x),z)) i(i(i(x,y),z),i(i(x,z),z)) i(i(x,i(x,y)),i(x,y)) i(i(x,y),i(i(i(x,z),u),i(i(y,u),u))) i(i(i(x,y),z),i(i(x,u),i(i(u,z),z))) i ( i (x,y) , i (i (y, i (z, i (x,u))) , i (z, i (x ,u) ) )) i(i(x,i(y,i(z,u))),i(i(z,x),i(y,i(z,u)))) i(i(x,i(y,z)),i(i(x,y),i(x,z))) i(n(x),i(x,y)) i(i(i(x,y),z),i(n(x),z)) i(i(x,n(x)),n(x)) i(n(n(x)),x) i(x,n(n(x))) i(i(x,y),i(n(n(x)),y)) i(i(i(n(n(x)),y),z),i(i(x,y),z)) i(i(x,y),i(i(y,n(x)),n(x))) i(i(x,i(y,n(z))),i(i(z,y),i(x,n(z)))) i(i(x,i(y,z)),i(i(n(z),y),i(x,z))) i(i(x,y),i(n(y),n(x))) i(i(x,n(y)),i(y,n(x))) i(i(n(x),y),i(n(y),x)) i(i(n(x),n(y)),i(y,x)) i(i(i(n(x),y),z),i(i(n(y),x),z)) i(i(x,i(y,z)),i(x,i(n(z),n(y)))) i(i(x,i(y,n(z))),i(x,i(z,n(y)))) i(i(n(x),y),i(i(x,y),y)) i(i(x,y),i(i(n(x),y).y)) i(i(x,y),i(i(x,n(y)),n(x))) i(i(i(i(x,y),y),z),i(i(n(x),y),z)) i(i(n(x),y),i(i(x,z),i(i(z,y),y))) i(i(i(i(x,y),i(i(y,z),z)),u),i(i(n(x),z),u)) i(i(n(x),y),i(i(z,y),i(i(x,z),y))) i(i(x,i(n(y),z)),i(x,i(i(u,z),i(i(y,u),z)))) i(i(x,y),i(i(z,y),i(i(n(x),z),y))) i(i(n(n(x)),y),i(x,y)) i(x,i(y,y)) i(n(i(x,x)),y) i(i(n(x),n(i(y,y))),x) i(n(i(x,y)),x) i(n(i(x,y)),n(y))
The Resonance Strategy (thesia_68) (thesis_69) (thesis_70) (thesis_71)
1327
i(n(i(x,n(y))),y) i(x,i(n(y),n(i(x,y)))) i(x,i(y,n(i(x,n(y))))) n(i(i(x,x),n(i(y,y))))
1.5. Preliminary Experimental Results It seems clear that virtually any data that strongly promotes serious experimen tation in automated reasoning merits inclusion in an article of this type. In that regard, the following is a list of the 37 theses (by number) that were proved in a single OTTER run before the resonance strategy was formulated, the run cited in Section 1.1. 04 05 06 09 10 11 12 13 IS 16 17 18 19 20 21 22 23 24 30 36 37 38 39 40 41 42 48 49 SO 62 63 64 65 66 67 68 71
The cited theses were not proved in the order given. For thesis 10, the program found three proofs. When the original attack was revisited on a SPARCstation 2 (during the writing of this article), thesis 50 was the last of the 37 that was proved, requiring approximately 287 CPU-seconds and completing upon retention of a clause numbered 47404. The run was terminated when the assigned limit of 24 megabytes of memory was reached. When the resonance strategy was then used by keying on the 68 theses to be proved, and when all other parameters were kept the same, OTTER proved all 68 theses in a single run (see Experiment 0 cited in Section 1.2). When the experiment was revisited on a SPARCstation 2 (during the writing of this article), the last thesis to be proved was thesis 71 in approximately 397 CPUseconds after retention of a clause numbered 32257. Among the sharp differences with and without the resonance strategy, thesis 71 was proved without the use of the strategy in approximately 69 CPU-seconds after retention of a clause numbered 7689. The fact that the use of the resonance strategy sometimes costs CPU time is expected, for the search space is dramatically perturbed by assigning a low weight (high priority) to formulas that match an included resonator. For but one example, thesis 7 would ordinarily be assigned a weight of 20, if symbol count was the rule for priority assignment. With the resonance strategy, thesis 10 was proved six times, and thesis 17 was proved twice. To further encourage research with the program OTTER, we include the following input file for the study of two-valued sentential calculus. In Section 3, we focus on the use and meaning of the commands found in this file. For the researcher who wishes to avoid using the resonance strategy, it suffices to place a "%" before each of the 68 templates found in the weighJist(pick.and.purge). Otherwise, if the input file is used as given, the resulting experiment will du plicate our use of the resonance strategy in the cited context. (In the following file, " | " denotes logical or, " — " denotes logical not, and, with the exception of the clauses that mention Scott, the clauses that mention a person's name correspond to known axiom systems for two-valued sentential calculus; those
Collected Works of Larry Wos
1328
that mention Scott were included in order to answer questions he posed.) I n p u t File for Studying Two-Valued Sentential Calculus set(hyper_res). assign(max.weight,20). assign(max.proofs, 0). clear(print_kept). '/, clear(for.sub). clear(back_sub). '/, assign(max.seconds, 1200). assign(max.mem, 24000). assign(report, 900). '/, assign(max_distinct_vars, 4 ) . '/, assign(pick_given_ratio, 3). set(order_history). set(input_sos_first). 7, set(sos_queue) . set(print_level). weight_list(pick_and_purge). '/, Following are templates corresponding to the 68 theses '/, to be proved. weight(P(i(i(i(i(x,y),i(z,y)),u),i(i(z,x),u))),2). weight(P(i(i(x,i(y»z)),i(i(u,y),i(x,i(u,z))))),2). weight(P(i(i(x,y),i(i(i(x,z),u),i(i(y,z),u)))),2). weight(P(i(i(x,i(i(y,z),u)),i(i(y,v),i(x,i(i(v,z),u))))),2). weight(P(i(i(x,y),i(i(z,x),i(i(y,u),i(z,u))))),2). weight(P(i(i(i(n(x),y),z),i(x,z))),2). weight(P(i(x,i(i(i(n(x),x),x),i(i(y,x),x)))),2). weight(P(i(i(x,i(i(n(y),y),y)),i(i(n(y),y),y))),2). weight(P(i(x,i(i(n(y),y),y))),2). weight(P(i(i(n(x),y),i(z,i(i(y,x),x)))),2). weight(P(i(i(i(x,i(i(y,z),z)),u),i(i(n(z),y),u))),2). weight(P(i(i(n(x),y),i(i(y,x),x))),2). weight(P(i(x,x)),2). weight(P(i(x,i(i(y,x),x))),2). weight(P(i(x,i(y,x))),2). weight(P(i(i(i(x,y),z),i(y,z))),2). weight(P(i(x,i(i(x,y),y))),2). weight(P(i(i(x,i(y,z)),i(y,i(x,z)))),2). weight(P(i(i(x,y),i(i(z,x),i(z,y)))),2). weight(P(i(i(i(x,i(y,z)),u),i(i(y,i(x,z)).u))),2). weight(P(i(i(i(x,y),x),x)),2). weight(P(i(i(i(x,y),z),i(i(x.u),i(i(u,y),z)))),2).
The Resonance Strategy
weight(P(i(i(i(x,y),z),i(i(z,jO,x))),2). weight(P(i(i(i(x,y),y),i(i(y,x),x))),2). weight(P(i(i(i(i(x,y),y),z),i(i(i(y,u),x),z))),2). weight(P(i(i(i(x,y).z),i(i(x,z),z))),2). weight(P(i(i(x,i(x,y)),i(x,y))),2). weight(P(i(i(x.y),i(i(i(x,z),u),i(i(y,u),u)))),2). weight(P(i(i(i(x,y),z),i(i(x,u),i(i(u,z),z)))),2). weight(P(i(i(x,y),i(i(y,i(z,i(x>u))),i(z,i(x,u))))),2). weight(P(i(i(x,i(y,i(z,u))),i(i(z,x),i(y,i(z,u))))), 2). weight(P(i(i(x,i(y,z)),i(i(x,y),i(x,z)))),2). weight(P(i(n(x),i(x,y))),2). weight(P(i(i(i(x,y),z),i(n(x),z))),2). weight(P(i(i(x,n(x)),n(x))),2). weight(P(i(n(n(x)),x)),2). weight(P(i(x,n(n(x)))),2). weight(P(i(i(x,y),i(n(n(x)),y))),2). weight(P(i(i(i(n(n(x)),y),z),i(i(x,y),z))),2). weight(P(i(i(x,y),i(i(y,n(x)),n(x)))),2). weight(P(i(i(x,i(y,n(z))),i(i(z,y),i(x,n(z))))),2). weight(P(i(i(x1i(y,z)),i(i(n(z),y),i(x,z)))),2). weight(P(i(i(x.y),i(n(y),n(x)))),2). weight(P(i(i(x,n(y)),i(y,n(x)))),2). weight(P(i(i(n(x),y),i(n(y),x))),2). weight(P(i(i(n(x),n(y)),i(y,x))),2). weight(P(i(i(i(n(x),y),z),i(i(n(y),x),z))),2). weight(P(i(i(x,i(y,z)),i(x,i(n(z),n(y))))),2). weight(P(i(i(x,i(y,n(z))),i(x,i(z,n(y))))),2). weight(P(i(i(n(x),y),i(i(x,y),y))),2). weight(P(i(i(x,y),i(i(n(x),y),y))),2). weight(P(i(i(x,y),i(i(x,n(y)),n(x)))),2). weight(P(i(i(i(i(x,y),y),z),i(i(n(x),y),z))),2). weight(P(i(i(n(x),y),i(i(x,z),i(i(z.y),y)))).2). weight(P(i(i(i(i(x,y),i(i(y,z),z)),u),i(i(n(x),z),u))),2). weight(P(i(i(n(x),y),i(i(z,y),i(i(x,z),y)))),2). weight(P(i(i(x,i(n(y),z)),i(x,i(i(u,z),i(i(y,u),z))))),2). weight(P(i(i(x,y),i(i(z,y),i(i(n(x),z),y)))),2). weight(P(i(i(n(n(x)),y),i(x,y))),2). weight(P(i(x,i(y,y))),2). weight(P(i(n(i(x,x)),y)),2). weight(P(i(i(n(x),n(i(y,y))),x)),2). weight(P(i(n(i(x,y)),x)),2). weight(P(i(n(i(x,y)),n(y))),2). weight(P(i(n(i(x,n(y))),y)),2). weight(P(i(x,i(n(y),n(i(x.y))))),2).
1329
Collected WbrJcs of Larry Wos
1330
weight(P(i(x,i(y,n(i(x,n(y)))))),2). weight(P(n(i(i(x,x),n(i(y,y)))))I2). end_of_list. list(usable). % The following clause is used with hyperresolution for '/, condensed detachment. -P(i(x,y)) I -P(x) I P(y). V. The following disjunctions, except those mentioning Scott, % are the negation of known axiom systems. -P(i(p,i(q,p))) I -P(i(i(p,i(q,r)),i(i(p,q),i(p,r)))) I -P(i(n(n(p)),p)) I -P(i(p,n(n(p)))) I -P(i(i(p,q),i(n(q),n(p)))) I -P(i(i(p,i(q,r)),i(q,i(p,r)))) I $ANSWER(step_allFrege_18_35_39_40_46_21). '/. 21 is dependent. -P(i(p,i(q,p))) I -P(i(i(p,i(q,r)),i(q,i(p,r)))) I -P(i(i(q,r),i(i(p,q),i(p,r)))) I -P(i(p,i(n(p),q))) I -P(i(i(p,q),i(i(n(p),q),q))) | -P(i(i(p,i(p,q)),i(p,q))) I $ANSVER(step_allHilbert_18_21_22_3_54_30). '/. 30 is dependent. -P(i(p,i(q,p))) I -P(i(i(p,i(q.r)),i(i(p,q),i(p.r)))) I -P(i(i(n(p),n(q)),i(q,p))) I $ANSWER(step_allBEH_Church_FL_18_35_49). -P(i(i(i(p,q),r),i(q,r))) I -P(i(i(i(p,q)Ir),i(n(p),r))) I -P(i(i(n(p),r),i(i(q,r).i(i(p,q),r)))) | $ANSWER(step_allLuka_x_19_37_59). -P(i(i(i(p,q),r),i(q,r))) I -P(i(i(i(p,q),r),i
The Resonance Strategy
1331
-P(i(i(i(p,q),p),p)) I -P(i(i(p,i(q,r)),i(i(p,q),i(p,r)))) I -P(i(n(n(p)),p)) I -P(i(p,n(n(p)))) I -P(i(i(n(p),n(q)),i(q,p))) I $ANSWER(step_allScott_orig0_16_18_21_24_35_39_40_49). end_of_list. list(sos). '/, The following three are Luka, 1 2 3. P(i(i(x,y),i(i(y,z),i(x,z)))). P(i(i(n(x),x),x)). P(i(x,i(n(x),y))). */. The following are from Frege, 18 35 21 46 39 40, 7. with 21 dependent. 7. P(i(x,i(y,x))). 7. axiom Fl. 7. P(i(i(x,i(y,z)),i(i(x,y),i(x.z)))). 7. axiom F2. 7. P(i(i(x,i(y,z)),i(y,i(x,z)))). '/. axiom F3. 7. P(i(i(x,y),i(n(y),n(x)))). 7. axiom F4. % P(i(n(n(x)),x)). % axiom F5. 7. P(i(x.n(n(x)))). X axiom f6. end_of_list. list(passive). -P(i(i(i(i(q,r),i(p,r)),s),i(i(p,q),s))) I $ANS(neg_th_04). -P(i(i(p,i(q,r)),i(i(s,q),i(p,i(s,r))))) I $ANS(neg_th_05). -P(i(i(p,q),i(i(i(p,r),s),i(i(q,r),s)))) I $ANS(neg_th_06). -P(i(i(t,i(i(p,r),s)),i(i(p,q),i(t,i(i(q,r).s))))) I $ANS(neg_th_07). -P(i(i(q,r),i(i(p,q),i(i(r,s),i(p,s))))) I $ANS(neg_th_08). -P(i(i(i(n(p),q),r),i(p,r))) I $ANS(neg_th_09). -P(i(p,i(i(i(n(p),p),p),i(i(q,p),p)))) I $ANS(neg_th_10). -P(i(i(q,i(i(n(p),p),p)),i(i(n(p),p),p))) I $ANS(neg_th_ll). -P(i(t,i(i(n(p),p),p))) I $ANS(neg_th_12). -P(i(i(n(p),q),i(t,i(i(q,p),p)))) I $ANS(neg_th_13). -P(i(i(i(t,i(i(q,p),p)),r),i(i(n(p),q),r))).| $ANS(neg_th_14 -P(i(i(n(p),q),i(i(q,p),p))) I $ANS(neg_th_15). -P(i(p,p)) I $ANS(neg_th_16). -P(i(p,i(i(q.p).p)>> I $ANS(neg_th_17). -P(i(q,i(p,q))) I $ANS(neg_th_18). -P(i(i(i(p,q).r),i(q,r))) I $ANS(neg_th_19). -P(i(p,i(i(p,q),q))) I $ANS(neg_th_20). -P(i(i(p,i(q,r)),i(q,i(p,r)))) I $ANS(neg_th_21). -P(i(i(q,r),i(i(p,q),i(p,r)))) I $ANS(neg_th_22).
Collected Works of Larry Wos
1332
-P(i -P
i ( i ( q , i ( p , r ) ) , a ) , i ( i ( p , i ( q , r ) ) , s ) ) ) I $ANSCneg_th_23). i ( i ( P , q ) , p ) , p ) ) I $ANS(neg_th_24). i ( i ( p , r ) , s ) , i ( i ( p , q ) , i ( i ( q , r ) , s ) ) ) ) I $ANS(neg_th_25). i ( i ( p . q ) , r ) , i ( i ( r , p ) . p ) ) ) I $ANS(neg_th_26). i ( i ( p , q ) , q ) , i ( i ( q , p ) , p ) ) ) I $ANS(neg_th_27). i ( i ( i ( r , p ) , p ) , s ) , i ( i ( i ( p , q ) , r ) , s ) ) ) I $ANS(neg_th_28). i ( i ( p . q ) , r ) , i ( i ( p , r ) , r ) ) ) I $ANS(neg_th_29). i ( p . i p , q ) ) , i ( p , q ) ) ) I $ANS(neg_th_30). i ( p . s , i ( i ( i ( p , q ) , r ) , i ( i ( 8 , r ) , r ) ) ) ) I $ANS(neg_th_31). i ( i ( p q ) , r ) , i ( i ( p , s ) , i ( i ( s , r ) , r ) ) ) ) I $ANS(neg_th_32). i ( p , s , i ( i ( s , i ( q , i ( p , r ) ) ) , i ( q , i ( p , r ) ) ) ) ) I $ANS(neg_th_33). i ( s , i q , i ( p , r ) ) ) , i ( i ( p , s ) , i ( q , i ( p , r ) ) ) ) ) I $ANS(neg_th_34). i ( p » i q , r ) ) , i ( i ( p . q ) , i ( p , r ) ) ) ) | $ANS(neg_th_35). n ( p ) , ( p , q ) ) ) I $ANS(neg_th_36). i ( i ( p q ) , r ) , i ( n ( p ) , r ) ) ) I $ANS(neg_th_37). i ( p , n p ) ) , n ( p ) ) ) I $ANS(neg_th_38). n(n(p ) , p ) ) I $ANS(neg_th_39). p , n ( n p ) ) ) ) I $ANS(neg_th_40). i ( p , q , i ( n ( n ( p ) ) , q ) ) ) | $ANS(neg_th_41). i ( i ( n n ( p ) ) , q ) , r ) , i ( i ( p , q ) , r ) ) ) I $ANS(neg_th_42). i ( p , q , i ( i ( q , n ( p ) ) , n ( p ) ) ) ) I $ANS(neg_th_43). i ( s , i q , n ( p ) ) ) , i ( i ( p , q ) , i ( s , n ( p ) ) ) ) ) I $ANS(neg_th_44). i ( s , i q , p ) ) . i ( i ( n ( p ) , q ) , i ( s , p ) ) ) ) I $ANS(neg_th_45). i ( p , q , i ( n ( q ) , n ( p ) ) ) ) | $ANS(neg_th_46). i ( p , n q ) ) , i ( q , n ( p ) ) ) ) I $ANS(neg_th_47). i ( n ( p , q ) , i ( n ( q ) , p ) ) ) I $ANS(neg_th_48). i ( n ( p , n ( q ) ) , i ( q , p ) ) ) | $ANS(neg_th_49). i ( i ( n q ) . p ) , r ) , i ( i ( n ( p ) , q ) , r ) ) ) I $ANS(neg_th_50). i ( p , i q , r ) ) , i ( p , i ( n ( r ) , n ( q ) ) ) ) ) | $ANS(neg_th_51). i ( p . i q , n ( r ) ) ) , i ( p , i ( r , n ( q ) ) ) ) ) I $ANS(neg_th_52). i ( n ( p , q ) , i ( i ( p , q ) , q ) ) ) I $ANS(neg_th_53). i ( p , q , i ( i ( n ( p ) . q ) , q ) ) ) | $ANS(neg_th_54). i ( p , q , i ( i ( p , n ( q ) ) , n ( p ) ) ) ) | $ANS(neg_th_55). i ( i ( i p , q ) , q ) , r ) , i ( i ( n ( p ) , q ) , r ) ) ) I $ANS(neg_th_56). i ( n ( p , r ) , i ( i ( p , q ) , i ( i ( q , r ) , r ) ) ) ) I $ANS(neg_th_57). i ( i ( i p , q ) , i ( i ( q , r ) , r ) ) , s ) , i ( i ( n ( p ) , r ) , s ) ) ) I $ANS(neg_th_58) i ( n ( p , r ) , i ( i ( q , r ) , i ( i ( p , q ) , r ) ) ) ) I $ANS(neg_th_59). i(s,i n(p).r».i(B,i(i(q,r).i(i(p,q),r)»» I neg_th_60). i ( p , r ) , i ( i ( q , r ) , i ( i ( n ( p ) , q ) , r ) ) ) ) | $ANS(neg_th_61), i ( n ( n ( p ) ) , q ) , i ( p , q ) ) ) | $ANS(neg_th_62). q , i ( p , p ) ) ) I $ANS(neg_th_63). n ( i ( p , p ) ) , q ) ) I $ANS(neg_th_64). i ( n ( q ) , n ( i ( p , p ) ) ) , q ) ) | $ANS(neg_th_65).
The Resonance Strategy
1333
-P(i(n(i(p,q)),p)) I $ANS(neg_th_66). -P(i(n(i(p,q)),n(q))) | $ANS(neg_th_67). -P(i(n(i(p,n(q))),q)) I $ANS(neg_th_68). -P(i(p,i(n(q),n(i(p,q))))) | $ANS(neg_th_69). -P(i(p,i(q,n(i(p.n(q)))))) I $ANS(neg_th_70). -P(n(i(i(p,p),n(i(q,q))))) | $ANS(neg_th_71). end_of_list. '/. list (demodulators). '/. (n(n(x)) = junk). '/. (n(n(n(x))) = junk). '/, (i(i(x,x),y) " junk). V. (i(y,i(x,x)) - junk). '/, (i(junk.x) = junk). '/. (i(x,junk) = junk). 7, (n(junk) = junk). 7. (P(junk) = $T). 7. end_of_list.
2. THE RESONANCE PRINCIPLE As with many principles, the resonance principle is more a strong sugges tion than a hard-and-fast rule. The principle asserts that formulas or equations found in proofs of theorems of a field provide useful resonators (formally defined shortly) for attempting to prove theorems from the same field. Captured as a special case is that of using as resonators steps of a proof of theorem T to prove T. Perhaps unexpected—it was for us when first tried—the special case of using the resonance strategy (defined in this section) does not necessarily simply re produce the known proof but, instead, often produces a far more elegant proof (see Sections 4, 5, 6, and 7 for some marked successes in that regard). A resonator R is a formula schema obtained from a formula or equation by replacing each variable occurrence in the formula or equation by *. The resonator R implicitly represents the set of formulas or equations obtained by assigning a variable name to each occurrence of * in R; the represented set may include formulas or equations that are false in the theory under study. The various occurrences of * in R can be assigned the same or different variable names; no restriction on the assignment exists. To each resonator R is attached an integer w, called its value or weight, that reflects the conjectured importance of R. The smaller the value or weight of a resonator, the higher is its conjectured importance. Implicit in the definition of resonator is the role the researcher plays, for, typically, it is the researcher who chooses the resonators and who assigns the value or weight to each resonator. DEFINITION.
1334
Collected Works of Larry Wos
Because, when expressed in OTTER notation (with * replaced by a variable), variables in a resonator are treated as indistinguishable and ignorable, a single resonator can capture a large set of statements, possibly including items that are false in the theory of mathematics or logic under study. (When we talk about the variables in a resonator, we recognize that, in a strict sense, the occurrences of star designate variable presence in that position.) For example, in Boolean groups, the resonator (expressed in OTTER notation) xyzx = e (the identity element) captures the equations yzyz = e and yyzz = e, both of which are (true) lemmas such that neither generalizes the other. The given resonator also captures the equation xxxy = e, which is false in most Boolean groups. A Boolean group is a group in which the square of every element x is the identity e. Because variables are ignored (when OTTER examines them or examines any weight template), nothing different occurs if the given resonator is replaced by the resonator xxxx = e or by the resonator xyzu = e. As discussed in some detail in Section 1.3, the concept of resonator is more general than is the concept of lemma in the sense that one resonator can capture many lemmas. Where a lemma in a theory is "true" in the theory, a resonator for a theory is not intended to take on the value true or false. DEFINITION. The static resonance strategy, often referred to simply as the reso nance strategy, is a direction strategy that relies on the use of resonators supplied by the researcher. Indeed, rather than being a restriction strategy for constraining a program's reasoning, the resonance strategy is a direction strategy for steering a program's reasoning by influencing it in its choice of where next to focus its attention. In this article, we present the results of OTTER's use of the resonance strategy in studies focusing on areas of mathematics and logic including group theory, Robbins algebra, and various logic calculi. We have also formulated and exper imented briefly with a companion to the resonance strategy. The companion strategy, called the resonance-restriction strategy, restricts a program's reason ing with resonators rather than directing its reasoning with resonators. The strategy rests on using the steps of a known proof to filter the set of deduced conclusions, retaining only those that (with variables ignored) match in shape one of the steps, but directing the search by symbol-count preference rather than by resonance. (A mechanical test for matching is given in Section 1.3.) In the future, in contrast to the static resonance strategy, we plan to inves tigate the case in which resonators are adjoined during a run, believing that the resulting dynamic resonance strategy might prove to be an extremely pow erful strategy. One incarnation of the dynamic resonance strategy would add as resonators the proof steps of so-called lesser theorems of interest proved during the attack on a so-called greater theorem of interest, where the lesser theorems were included to enable the program to find possibly useful resonators. Even without access to an implementation of the dynamic resonance strategy, one
The Resonance Strategy
1335
can (as we have in many experiments) simulate its Section 4. One be gins with simple theorems and has OTTER obtain proofs of as many of them as the allotted CPU time and memory permit. From each completed proof, one then takes the proof steps, excluding those found in the input as axioms and the like, and uses them as resonators in the attempt to prove harder theorems. Further, as we show in Section 4, one can profitably iterate in the cited man ner. The two-step and the iterated approach can each produce a valuable set of resonators for studying various aspects of the theory from which the selected theorems are taken, and it can at the same time produce valuable resonators for applying the resonance strategy in the pursuit of the proof of a very deep, purported theorem. Although in the context of the dynamic resonance strategy we have at this time little experimental evidence concerning the effectiveness of the cited twostep approach for accruing powerful resonators, in the context of the static resonance strategy we have much. In particular, we have used with great success a closely related variant of the approach for accruing resonators where the goal was that of seeking more elegant proofs. In one study, we applied an iterative approach that began with a 33-step proof [5] of the completeness (for two-valued sentential calculus) of the axiom system consisting of LI, L2, and L3 (given in Section 1.1). (For computing the length of a proof, we ignore the axioms and count just the deduced steps; condensed detachment, defined and illustrated in Section 1.1, is the inference rule that is used in this area of logic.) The Lukasiewicz proof completes by deriving Church's axiom system consisting of theses 18, 35, and 49 (given in Section 1.4). With heavy use of the resonance strategy, we eventually found various 22-step proofs of the Church axiom system using condensed detachment; see Section 7.1. Whether a shorter proof exists is at this time unknown and is an interesting and challenging research question. 3. A BRIEF INTRODUCTION TO THE PROGRAM OTTER To aid the researcher in understanding more fully the successes obtained with McCune's program OTTER and to provide a small beginning for one who wishes to use this program, we now give a brief introduction to some of its features. A thorough treatment is provided in manual form in [4] and in book form in [3], the latter offering in Chapter 16 a tutorial for the use of OTTER. The following discussion will also add to one's understanding of the items found in the input file given in Section 1.5 and the input files given later in Sections 5, 6, and 7.2.
3.1. Problem Representation and Clause Lists Although OTTER accepts a number of notations, including first-order pred icate calculus, we generally submit a question or problem to the program in the clause language. Examples of clauses are given in the input file of Section 1.5;
Collected Works ofL&rry Wos
1336
recall that " | " denotes logical or, that " — " denotes logical and, and that all variables (such as x, y, 2, and u) are implicitly universally quantified (meaning, for example, for all x). The clauses used to convey facts, relationships, equations, the assumed false ness of the conclusion of a theorem to be proved, and such can be placed on any of four lists. We place in list(sos) the clauses that the program (initially) selects from to drive its reasoning, and place in list (usable) clauses that can never be used in this manner. Clauses in list(usable) are used only to complete the ap plication of an inference rule. For example, the following clause (for condensed detachment) is placed in list (usable), for the intention is that it never drive the reasoning. - P ( i ( x , y ) ) 1 -P(x) I P(y). If one wishes OTTER to make a bidirectional search, reasoning forward from some information and backward from the assumed falseness of the theorem under study, then one places in list(sos) some or all of the clauses that convey the nature of the theory under study and the hypothesis of the theorem and some or all of the clauses that correspond to assuming the theorem false. However, as evidenced in the input file of Section 1.5, if one intends that the clauses that correspond to assuming the theorem false play no active role in drawing conclusions, then they are placed in list(passive). As one sees, in our initial study of two-valued sentential calculus prompted by Scott's e-mail, we placed the negated (or denial) form of theses 4 through 71 in list (passive). The last of the four lists, list (demodulators), for receiving input clauses is typically used for rules (equations) for rewriting information into some desired canonical form.
3.2. Restriction Strategy and Direction Strategy As the presence of the four lists suggests, especially list(sos) to the researcher familiar with automated reasoning, OTTER offers the use of strategy. We have always maintained that, without the use of strategy, deep questions and difficult problems are in almost all cases out of reach of a reasoning program. Crucial is the use of two types of strategy, strategy that restricts the program's rea soning and strategy that directs it. Further, we maintain that, within these two categories of strategy, tough assignments require for their completion a vari ety of each type. These views, supported by thirty years of experimentation, in part explain our lack of enthusiasm for studying mathematics and logic with a paradigm offering little or no strategy, for example, a paradigm such as that based on logic programming. Regarding strategy that restricts reasoning, as suggested by the name list(sos), we strongly prefer the use of the set of support strategy [1,3,8]. Intuitively, the set of support strategy requires one to choose a nonempty subset of the input clauses and restrict the reasoning to lines of inquiry that begin with a clause in the chosen subset. To use the set of support strategy, one partitions the set
The Resonance Strategy
1337
S of input clauses into two subsets, a nonempty subset T (called the initial set of support) and S — T\ the latter may be empty. The set of support strategy restricts the application of an inference rule by disallowing application of the rule to sets of clauses consisting solely of clauses from the set S—T. Put another way, all newly retained clauses are added to T (the set of support), and each set of clauses to which an inference rule is applied must contain at least one clause in T. When the axioms of a theory are placed in list(usable) and not in list(sos), the program is prevented from exploring the theory as a whole and, instead, is more or less confined to focusing on the specific theorem under study. To answer an immediate and natural question arising from a glance at the input file in Section 1.5, we sometimes place axioms in list(sos), especially when we have little else to reason from.
3.3. Weighting Even with an effective restriction strategy in use, a study benefits markedly from the use of one or more direction strategies. To direct a program's reason ing, at one end of the spectrum, one can use weighting [1,3,9], and at the other end of the spectrum, one can use level saturation (equivalently, breadth first). Weighting can be used to convey the researcher's notion regarding complexity preference. Where my colleague R. Overbeek, who formulated weighting, con siders one of its uses to be that of circumscribing the terms that the researcher conjectures to play the important role in an assignment, we consider that func tion of weighting to be one of advice giving; weighting can also be used to discard deduced conclusions that are thought to be of no use. Indeed, we have always thought the object of including templates expressing preference of one function over another or of one combination of functions over another was to reflect in tuition or knowledge. Regardless of the view, one's choice of weight templates (if any) plays an important strategic role in directing the program's reasoning, in contrast to the use of the set of support strategy for restricting reasoning. By assigning low weights (high priorities) to various functions and combi nations of functions, the researcher causes an automated reasoning program to prefer for the focus of attention conclusions containing corresponding subterms. At the other end of the spectrum, the assignment of high weights (low priorities) causes the program to delay focusing on conclusions containing corresponding subterms. If one has no intuition or knowledge to be reflected with included weight templates, then the choice (for the program) of where next to focus at tention can be based on symbol count. In that case, the program directs its search by selecting for the focus of attention the shortest clause that has not yet been used. If the computed weight of a deduced conclusion exceeds the assigned max.weight (limit on complexity of retained information), then the conclusion is immediately discarded.
1338
Collected Works of Larry Wos
3.4. Level Saturation and the Ratio Strategy In contrast to the use of weighting is the use of level saturation. For this choice of directing the reasoning, one uses the command "set(sos-queue)", which causes the order of the selection (for the focus of attention) of retained conclu sions to be based strictly on the order in which they are retained, first come first serve. In the vast majority of cases, we prefer the use of weighting (complexity preference) over that of level saturation. However, because experimentation has showed the need for using clauses with heavy weight that are found rather early in OTTER's attack—clauses whose weight delays for a long time or forever their being chosen as the focus of attention—we frequently prefer the program's reasoning be directed by a combination of weighting and of level saturation. For that preference, we use the ratio strategy formulated by McCune. When one uses the ratio strategy, one assigns a value to its parameter (pick_given_ratio) for determining how much the program is to be directed by weighting and how much by level saturation. For example, by assigning pick_given_ratio to 3, OTTER is instructed to focus on three conclusions (from among those retained) based on their weight or complexity, one by first come first serve, then three, then one, and the like. Though not basing our action on a thorough analysis of which value is most effective for assigning to pick-given .ratio parameter, we note that we frequently use the value 3. If an examination of an output file suggests that too much of the program's attention is focused on first come first serve clauses, then one increases pick-given .ratio, perhaps to 6. If too little time is spent on such clauses, then one decreases pick-given-ratio to 2 or even to 1.
3.5. Weight Lists To complete our introduction to the features of OTTER in the context of weighting, we mention three lists of interest: weight Jist (pick.ancLpurge), weight-list (pick_given), and weight Jist(purge-gen). Any weight templates included in the first list are used by the program both to direct its reasoning regarding where next to focus its attention and to af fect its retention of drawn conclusions by measuring their respective desirability against the maximum (max.weight) allowed complexity. When a drawn con clusion fails to contain any subterms that match any of the included weight templates, its complexity is measured strictly in terms of symbol count. When the complexity of a drawn conclusion strictly exceeds the chosen max.weight, the conclusion is immediately purged. Weight templates included in the second list, weight-list(pick-given), are used only to direct the program's reasoning and have no effect on conclusion purging. Weight templates included in the third list, weightJist(purge-gen), are used only for conclusion purging and have no
The Resonance Strategy
1339
effect on directing the reasoning. A quick review of the preceding observations correctly suggests that the first list combines the functions of the second and third. The choice of which of the three lists to use depends on whether the researcher has advice to give regarding which terms merit the assignment of high priority (small weight) for influencing OTTER on where next to focus its attention, advice to give regarding which terms merit the assignment of such low priority that their presence strongly suggests purging the corresponding drawn conclusions, and advice to give regarding the separation of included hints.
3.6. Examples of the Use of Weighting In view of the fact that our use of the resonance strategy with OTTER is via weighting, a few remarks and a few examples of the typical use of weighting are in order. First, we note that one could add the resonance strategy to a program that does not offer weighting (in its fullest). Indeed, this strategy is based on a program's ability to treat the researcher's chosen formulas and equations to be used as resonators (see the beginning of Section 2 for the definition) to direct the program's reasoning. What is required is the ability to compare the shape of each retained conclusion with all resonators (ignoring the variables of the conclusion and of the resonator being compared) and, if any match is found, assign to the conclusion the corresponding priority given by the researcher. We were fortunate in that McCune's implementation of Overbeek's weighting strategy is such that variables in a template are treated as indistinguishable. He could, instead, have chosen (as was the case in a prior reasoning program we used) to have distinct variables treated as distinct variables, for example, requiring that the variable x be treated only as x. For a first example of the typical use of weighting, let the function inv denote inverse (as in a group). If the researcher conjectures that any term in inv merits strong consideration, the following template can be used. weight(inv(*0),l). In the presence of this template, OTTER will compute the weight of any term in inv by multiplying the weight of its argument by 0 and adding 1. If the weight of the constant o is 1, then the assigned weight of inv(inv(a)) will be 1. If the researcher wishes terms in inv to be penalized, then two choices exist: the additive value can be changed from 1 to, say, 5, or the multiplier can be changed from 0 to, say, 2, or both. For a second example, let us assume that the researcher conjectures that terms free of variables are to be preferred and, as a consequence, wishes to penalize terms containing variables. The following template (or one like it) serves nicely. weight(x,3).
Collected Works of Larry Wos
1340
Unless some interference occurs, OTTER will add 3 to the weight of a term for each variable present in the term. For a third example, let us assume that the researcher wishes the program to prefer for the focus of attention formulas whose "tail" is short, where the tail of a formula (for this discussion) is the second argument of the leftmost function i for implication. The following weight template is the one we use. weight(P(i(*l,*2)),l). In the presence of this template, OTTER assigns a weight to each new conclusion by multiplying the weight of its first argument by 1, multiplying the weight of its second argument by 2, and adding 1 to the sum of the resulting products. McCune used this template in his application of his tail strategy to problems in equivalential calculus, where the function i is replaced by the function e for equivalence. When we used the recursive tail strategy [10] in our study of two-valued sentential (or propositional) calculus, we used the following closely related template. weight(i(*l,*2),l). In the presence of this last template, the program gives (recursive) preference to formulas that have a short tail regardless of how deep in the formula the short tail is.
3.7. Additional Commands and Options To extend our brief treatment of some of the OTTER options, we focus on the following commands found in the input file given in Section 1.5. assign(max_proofs, 0). V, assign(max_distinct_vars, 4 ) . V. clear (f or_sub). clear(back.sub).
The first of the given four commands assigns to the program the maximum number of proofs to be sought. When its value is set to 0, then no limit is placed on the number of proofs. Were it instead set, say, to 3, then the completion by OTTER of a third proof would terminate the run. Of course, before the desired number of completed proofs has been reached, a run may be terminated by a maximum placed on CPU time to be used or a maximum placed on memory to be used. No test is made to see whether more than one proof proves the same theorem. Of the four commands under discussion, the second (commented out) is pertinent to a sometimes used but unnamed restriction strategy. If one removes the comment (%) and uses the command as given, OTTER is restricted in its retention of deduced conclusions by requiring that each contain no more than four distinct variables. This restriction strategy is of particular use when
The Resonance Strategy
1341
experiments suggest that the space of conclusions that can be drawn is large, for example, when one conjectures that long formulas must be used in turn requiring the assignment of a high max.weight. To understand the use of the final two (of the four given) commands, we need a definition. The clause A subsumes the clause B if and only if a uni form replacement of terms for variables in A yields a (not necessarily proper) subclause of B. Forward subsumption, which is abbreviated forjsub, is the proce dure OTTER employs to purge a newly generated conclusion when a subsuming clause already exists in the database of retained information. Without the use of forward subsumption, the researcher or program will almost always drown in redundant conclusions. Back subsumption is the procedure used to purge an existing conclusion when a newly deduced conclusion captures it as a corollary. When seeking proofs shorter than one has in hand, OTTER offers the use of ancestor subsumption. By definition, the clause A ancestor-subsumes the clause B if and only if (1) A properly subsumes B or (2) A and B are alphabetic variants and the derivation length of A is less than or equal to that of B. The question of whether the conclusion A subsumes, properly subsumes, or ancestor subsumes the conclusion B focuses on a relation that may or may not hold; in contrast, forward and back subsumption are procedures used to possibly purge conclusions.
3.8. Paramodulation, Equality, and Inference Rules As for inference rules for drawing conclusions, OTTER offers quite a num ber, including binary resolution, hyperresolution, UR-resolution, and paramod ulation [1,3], the latter generalizing the usual notion of equality substitution. By using paramodulation coupled with demodulation, OTTER offers the researcher the use of a Knuth-Bendix approach to proving theorems; see Sections 6 and 7. For a complex example of paramodulation—one that shows why a person might not enjoy applying this rule by hand—we consider the inference rule applied to both the equation x + (—x) = 0 and the equation y + (—y + z) = z; the application yields, in a single step, the conclusion y + 0 — — (—y). In clause form, from EQUAL(sum(x,minus(x)),0) into EQUAL(sum(y,sum(minus(y),z)),z) the clause EQUAL(sum(y,0),mimis(minus(y)))
is obtained by paramodulation. To see that this last clause is in fact a logical consequence of its two parents, one unifies the argument sum(x,minus(x)) with the term sum(minus(y),z), ap plies the corresponding substitution to both the from and into clauses, and then
1342
Collected Works of Larry Wos
makes the appropriate term replacement justified by the typical use of equality. The substitution found by the attempt to unify the given argument and given term requires substituting minus{y) for x and minus{minus(y)) for z. To prepare for the (standard) use of equality in this third example—and here we encounter a key feature of paramodulation—a nontrivial substitution for variables in both the from and the into clauses is required, which illustrates how paramodulation generalizes the usual notion of equality substitution. In contrast, in the stan dard use of equality substitution, one does not apply a nontrivial replacement for variables in both the from and the into statements. In addition to using the set of support strategy, which is a general strategy designed to restrict the application of any inference rule, an automated reason ing program (such as OTTER) can also use a number of other strategies that are specific in that they are designed to restrict the application of paramodulation. First, the program can be restricted from paramodulating from or into a vari able. This restriction prevents a myriad of conclusions from being drawn. Such a restriction strategy is, in most cases, mandatory. After all, paramodulating from or into a variable will always yield a conclusion since the corresponding unification can never fail. Second, the program can be required to paramodulate only from a specified side of each equality. In some cases, all applications of paramodulation are required to be from the left side only; in others, all are required to be from the right only.
3.9. Sources for Additional Information The preceding material provides the merest hint of the versatility, usefulness, and power offered by McCune's program OTTER. In the book [3], one gains a far greater appreciation for this program. The book also includes a tutorial (in Chapter 16) for using OTTER, as well as a diskette containing the appropriate manuals, test problems, source code, and load modules (for personal comput ers). We have found OTTER to be an excellent assistant for research. For but one example, as may be clear at this point, OTTER's treatment of variables in weight templates made it trivial to experiment with the resonance strategy to determine its potential. Let us now turn to some of those experiments, specifi cally, to those experiments motivated by the writing of this article. 4. A N ITERATIVE USE OF THE RESONANCE STRATEGY In Sections 1.1 and 1.2, we discussed Scott's challenge and our response cul minating in the formulation of the resonance strategy. In particular, we noted that, without the resonance strategy, 37 of 68 target theorems were proved in a single run with OTTER and, with the use of the strategy, all 68 were proved in a single run on the first attempt. In that success, which we called Experiment 0 in Section 1.2, all 68 theorems were used as resonators in the weight Jist(pick^and_purge), each assigned a weight of 2. In Section 1.5, we sup-
The Resonance Strategy
1343
plied an appropriate input file for the researcher who wishes to duplicate our experiments both before and after the formulation of the resonance strategy. Viewing the cited use of the resonance strategy as a limiting case, we were (during the writing of this article) curious about the results of so-called inter mediate points. Specifically, we decided to experiment with an iterative use of the strategy. The plan was to start (with Experiment 1) by repeating the exper iment that produced the 37 proofs, use as resonators in Experiment 2 the union of the proof steps of the proofs obtained in Experiment 1, use as resonators in Experiment 3 the union of the proof steps of the proofs obtained in Experiment 2, and continue in this manner. In the attempt to somewhat isolate the effects of using the strategy, the plan also called for no other changes to be made in the parameters. We thought it highly likely that a comparison of two proofs of the same theorem obtained in succeeding runs would show that OTTER was not proof checking: Two different proofs would be obtained, in many cases. By executing the cited plan, we were in part gathering evidence of the value of using as resonators the steps of the proof of one theorem in the attempt to prove a related theorem. We were also simulating (in a not totally satisfactory manner) the use of the dynamic resonance strategy, see Section 2. In Experiment 1, the following 37 theses were proved. 04 05 06 09 10 11 12 13 15 IS 17 IS 19 20 21 22 23 24 30 36 37 38 39 40 41 42 48 49 SO 62 63 64 65 66 67 68 71
When we took the union of the steps from the 37 proofs, ignoring the input (hypotheses), we obtained 83 resonators for Experiment 2. Experiment 2 yielded proofs of the following 52 theses. 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 30 36 37 38 39 40 41 42 43 45 46 47 48 49 50 61 52 53 54 56 62 63 64 66 66 67 68 69 70 71
Also proved in the experiment was the axiom system of Hilbert, which consists of six theses, 3, 18, 21, 22, 30, and 54 (of which 30 is dependent on the other five members). (For computing the length of a proof, we ignore the axioms and count just the deduced steps; condensed detachment is the inference rule that is used in this area of logic.) As evidence that OTTER is not simply reproducing the proofs found in Experiment 1 (as in proof checking), note that, of the 37 theses proved in common, in Experiment 2 the proof length did not change in eleven of them, the proof length increased in four of them, and the proof length decreased in twenty-two of them. (Where a thesis was proved more than once, for comparison we took the shortest proof in each case.) The theses in which the proof length increased in Experiment 2 when compared with Experiment 1 are 11, 12, 13, and 63; in each case, the proof length increased by 1. Those in which the proof length decreased are theses 10, 15, 17 through 24, 30, 36 through 42, 48 through 50, and 62. Among the highlights, the length of the proof of thesis 10 was decreased from 13 to 4, of thesis 15 from 30 to 17, and of thesis 50 from 41 to 31. For Experiment 3, we took the union of the (deduced) proof steps of the 52 proofs obtained in Experiment 2 to use as resonators. The union consists of 90
Collected Works of Larry Wos
1344
formulas, of which 14 do not match in functional shape any of the 83 resonators used in Experiment 2. Of the remaining 76 formulas, 68 are identical (at the entire formula level) to one of the 83 resonators, and 8 match at the resonator level but not at the entire formula level. The use of the 90 resonators (from Experiment 2) in Experiment 3 yielded 58 of the sought-after 68 proofs, the following theses. 04 22 47 68
OS 23 48 69
06 24 49 70
07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 26 26 27 30 36 37 38 39 40 41 42 43 44 45 46 50 51 52 53 54 66 57 59 61 62 63 64 65 66 67 71
When the proofs that are obtained in both Experiment 2 and Experiment 3 are compared by length, one finds that Experiment 3 finds 15 of shorter length, 19 of longer length, and 18 of unchanged length. In Experiment 4, we took the union of the (deduced) proof steps of the 58 proofs completed with Experiment 3, obtaining 99 formulas to use as resonators. Of the 99, 85 are identical to one of the 90 resonators used in Experiment 3, 8 differ (at the entire formula level) but match as resonators, and 6 do not even match at the resonator (functional shape) level. Using the 99 resonators, Experiment 4 yielded proofs of all but thesis 35. We were in no way surprised, for earlier experiments had produced abundant evidence that thesis 35 resists proof and resists it well, if the resonance strategy is not used. Experiment 4 also yielded a complete proof of an alternative axiom system (of Lukasiewicz) for two-valued sentential calculus, that consisting of theses 19, 37, and 59. In Experiment 5, we took the union of the (deduced) proof steps of the 67 proofs completed with Experiment 4, obtaining 127 formulas to use as res onators. Of the 127, 97 are identical to one of the 99 resonators used in Experi ment 3, 25 differ (at the entire formula level) from each of the 99 but match as resonators, and 5 do not even match at the resonator (functional shape) level. With the 127 resonators, Experiment 5 proved thesis 35, and the iterative ap proach yielded the desired 68 proofs. Also proved with that experiment was yet another axiom system for the calculus, namely, that consisting of theses 19, 37, and 60, discovered in our earlier research [7]. Valuable information concerning the use of the resonance strategy can be extracted from a comparison of data produced by Experiment 5, in which 127 resonators are used, with Experiment 0, in which the 68 theses are used as resonators. First, one finds that the proof of thesis 35 obtained with Experiment 5 required approximately 227 CPU-seconds on a SPARCstation 2, completing with the retention of a clause numbered 18,774. In sharp contrast, the use of the 68 theses as resonators (see Section 1.2) yielded a proof of thesis 35 in approximately 36 CPU-seconds with the retention of a clause numbered 4978. Second, if one attempts to explain the marked difference in the two experiments that each prove thesis 35, one finds in their respective proofs a most interesting property. In particular, one finds that the last two steps of the proof completed in 36 CPU-seconds have the same shape—both matching at the resonator level thesis 35—but such is not the case for the proof completed in 227 CPU-seconds.
The Resonance Strategy
1345
The two steps under discussion are the following (including the corresponding history for deducing each). When OTTER is instructed to use order_history, [hyper,l,j,k] means that the inference rule hyperresolution is used with clause (1) to capture condensed detachment, that the clause numbered j is the major premiss unified with the first literal of (1), and that the clause numbered k is the minor premiss unified with the second literal of (1). 2595 [hyper,1,1471,1092] P ( i ( i ( x , i ( y , z ) ) , i ( i ( y , x ) , i ( y . z ) ) ) ) . 4978 [hyper,1,1192,2595] P ( i ( i ( x , i ( y , z ) ) , i ( i ( x , y ) , i ( x . z ) ) ) ) . As the following observations show, this second discovery (of the two cited proof steps) contains the needed clue for explaining why the experiment in which the 68 theses are used as resonators is far more successful at proving thesis 35. Since thesis 35 is among the 68 theses used as resonators, any formula that matches it in shape (ignoring variables) is given preferential treatment for being chosen as the focus of attention to drive the program's reasoning. Each of the resonators was assigned a weight of 2, and thesis 35 and formulas that match it in shape have a weight of 14 if the weight is computed based on symbol count (including the predicate symbol). Therefore, the first of the cited formulas, clause (2595), is quickly chosen as the focus of attention because of being given a weight of 2. This situation contrasts sharply with Experiment 5 where, as the evidence strongly suggests, the weight of 14 delays the choice of clause (2595) as the focus of attention. By quickly choosing clause (2595) to drive OTTER's reasoning, as the ancestor history shows, clause (4978) is deduced, and that clause is in fact thesis 35. As a side effect of the delay in choosing clause (2595) to drive the reasoning, Experiment 5 completes a 56-step proof, where the more successful experiment (Experiment 0) completes a 42-step proof. Showing how complicated is both the activity of proving deep theorems and the analysis of which parameters tell the relevant story, we note that the level of the 56-step proof is 18, and the level of the 42-step proof is 20. The level of an input statement (hypothesis) is defined to be 0, and the level of a deduced conclusion is one greater than the maximum of the levels of its immediate par ents or ancestors. For example, let A0, BO, and CO be (input) axioms and hence of level 0; of level 1, let A\ be deduced from A0 and B0, and let 5 1 be deduced from B0 and CO; and of level 2, let A2 be deduced from A\ and 5 1 . Where A2 is a theorem of interest, by definition, its proof level is 2, and its proof length is 3; length in this report does not include (input) hypotheses. Summarizing, one sees that the inclusion of thesis 35 as a resonator did cause OTTER to focus on a formula similar in shape, using that formula to markedly aid its attempt to complete a proof of thesis 35. When thesis 35 is not included as a resonator (as is the case in Experiment 5), the program follows a sharply different path to completing the desired proof. Indeed, a glance at the following two clauses, which are the last two steps of the proof produced by Experiment 5, shows how different the path is. 15795 [hyper,1,10712,7025] P ( i ( i ( x , i ( y , i ( z , u ) ) ) , i ( i ( z , x ) ,
1346
Collected Works of Larry Wos
i(y,i(z,u))))). 18774 [hyper,1.15795,1912] P ( i ( i ( x , i ( y , z ) ) , i ( i ( x , y ) , i ( x , z ) ) ) ) . Obviously, clause 15795, which is used to deduce thesis 35, does not match in shape thesis 35 even at the resonator level. We thus have an illustration of a strategy for increasing the effec tiveness of the resonance strategy: Include among the resonators the correspondent(s) of the theorem(s) that are to be proved. In addition, effectiveness sometimes is increased by also including as resonators the hypotheses of the study. We conducted one final experiment, Experiment 6. For resonators, we took the 125 distinct proof steps from the 68 proofs produced by Experiment 5. Since Experiment 5 used 127 resonators taken from the union of the proof steps from Experiment 4, and since Experiment 4 did not yield a proof of thesis 35 but Experiment 5 did, Experiment 5 clearly found some shorter proofs. Of the 125, 120 match identically one of the 127 resonators used in Experiment 5, 4 match at the resonator level but not at the entire formula level, and 1 matches at neither the entire formula level nor the resonator level. We were certain that Experiment 6 would yield complete proofs of various axiom systems for twovalued sentential calculus, those given in the input file of Section 1.5. The key is the presence among the resonators of that which captures at the functional or skeletal shape thesis 35. Indeed, when OTTER deduces thesis 35, its presence as a resonator (with low weight) predictably causes the program to quickly choose thesis 35 as the focus of attention, which in turn quickly leads to completing proofs for axiom systems in which thesis 35 is a member. If one takes the union of the proof steps of the proofs produced with Experiment 6, one obtains 126 distinct steps, of which 2 fail to be identical to any of the 125 resonators that are used; however, each of the two steps in question does match in shape a resonator. There remained the question of how different would the proofs be produced by Experiment 6 when compared with the proofs produced by Experiment 0 in which the resonators are just those corresponding (in shape) to the 68 theses under study. Table 1 compares the results of the two experiments. 5. ROBBINS ALGEBRA In this section, we briefly illustrate the value of using the resonance strategy for seeking shorter proofs where the focus is on Robbins algebra. This particu lar study broadens the scope of using the resonance strategy, for the treatment of Robbins algebra is purely in terms of equality—condensed detachment and hyperresolution play no role and are replaced by the inference rule paramodu lation; see the example of paramodulation in action given shortly, the example
The Resonance Strategy
1347
discussed in more detail in Section 3.8. Part of the interest in Robbins algebra rests with the following question, still open: Is every Robbins algebra a Boolean algebra? This question was studied in some depth by Alfred Tarski and by his students, as we learned in a phone conversation with him. It is known that every finite Robbins algebra is Boolean. Table 1: Comparison of Proofs Ex. 6 Ex. 0 Thesis 35 Proof length0 Level
45 15
42 20
Hilbert system Time Length Level
64 CPU-sec 47 14
27 CPU-sec 45 19
Alt. Lukasiewicz system Time Length Level
60 CPU-sec 41 14
35 CPU-sec 41 19
Wos system Time Length Level
105 CPU-sec 43 14
76 CPU-sec 43 20
Church system Time Length Level
109 CPU-sec 46 15
78 CPU-sec 42 20
Frege system Time Length Level
78 CPU-sec 54 15
109 CPU-sec 47 20
"Both proofs complete with the same last two steps, those matching in shape thesis 35.
Collected Works of L&rry Wos
1348
Paramodulation [1,3] is the only inference rule in use. For an example of the latitude permitted in the use of paramodulation—an example showing how this inference rule generalizes the usual notion of equality substitution—we consider the following three clauses and apply paramodulation from the first into the second to yield the third; from the viewpoint of mathematics, paramodulation applied to both the equation x + (—x) = 0 and the equation y + (—y + z) = z yields in a single step the conclusion y + 0 = — (—y). EQUAL(sum(x,minus(x)),0). EQUAL(sum(y,sum(minus(y),z)),z). EQUAL(sum(y,0),minus(minus(y))). Where "+" can be interpreted as addition (or, more familiarly in the context of Boolean algebra, as union) and the function n as negation or complement, the following three axioms (expressed in yet another form acceptable to OTTER) characterize Robbins algebra. EQO-(x,y), + (y,x)). EQ(+(+(x,y),z),+(x,+(y,z))). EQ(n(+(n(+(x,y)),n(+(x,n(y))))),x).
*/, Robbins axiom
The first two axioms respectively express the properties of commutativity and associativity of union. The third axiom expresses an identity in terms of union and complement. All three properties hold in Boolean algebra. Regarding the cited open question, no finite counterexample (or model) can be found, for there exists a rather straightforward proof asserting that finite Robbins algebras are Boolean. One therefore has two choices to settle the open question: Find an infinite model that is a Robbins algebra and that violates one of the known properties of Boolean algebra, or prove that Robbins implies Boolean. We learned of the open question in the early 1980s from a colleague, Steve Winker. He had been attempting, without gaining any valuable information, to use one of the Argonne automated reasoning programs to obtain a proof (rather than a model to serve as a counterexample). We suggested that he use what might be termed binary chop: Select some property of Boolean algebra often associated with an axiom set, adjoin the chosen property to the Robbins axioms, and then see whether the remaining properties of a Boolean algebra could be proved. When asked for a good candidate, we suggested the addition of the union of x and x = x. Winker succeeded, proving that the addition of this axiom to those of a Robbins algebra guarantees that the resulting algebra is Boolean. He continued to follow our suggestion of binary chop and obtained numerous intriguing results, some with the program by itself, some with the team of him and the program, and some with his insight alone. For example, the addition to the Robbins axioms of a 0 yields Boolean; the addition of a 1 yields Boolean; the addition of an axiom that asserts the existence of two elements c and d such that the union of c and d = d suffices; for the Winker successes, see [11,12].
The Resonance Strategy
1349
The last of the cited results is most fascinating, for it does indeed appear to be a weak assumption. Before Winker proved the corresponding theorem, he proved that the addition of an axiom asserting the existence of an element c with the union of c and c= c suffices. This theorem is the focus of this section, in the context of finding shorter proofs by relying on the resonance strategy. With the following input file, whose weight templates (which will be seen to serve nicely as resonators) could be commented out by placing % in column 1, one can have OTTER prove that the adjunction of +(c, c) = c to the Robbins axioms is sufficient to prove Huntington's axiom. Huntington's axiom together with commutativity and associativity of + suffice to characterize Boolean alge bra. Without using the resonance strategy, OTTER produces a 41-step proof (Proof 1 given shortly) from which one can extract the positive equalities, includ ing those arising from back demodulation, to use as resonators, those resonators found in the weightJist(pick-and-purge) in the input file given shortly. When these are used as resonators, OTTER then obtains a 31-step proof (Proof 2 given shortly). In other words, again one has an example of an action that, from a casual perspective, is simply in the spirit of proof checking: one expects the program to reproduce the proof just found—but it fails to do so. Instead, a sub stantially shorter proof is found, with the only change in the input being the use of the resonance strategy, keying on the steps of a known proof, Proof 1. Note that the command set(knuth.bendix) in the following input file instructs OT TER to attack the theorem under study with an approach that emphasizes the roles of paramodulation and demodulation, in a manner familiar to researchers who focus on complete sets of reductions. Input File for Studying Robbins Algebra set(knuth_bendix). set(index_for_back_demod). set(dynamic_demod_lex_dep). set(lex_rpo). set(process_input). set(display_terms). clear(print_kept). clear(print_new_demod). clear(print_back_demod). assign(report, 60). assign(max.weight, 20). assign(max_mem, 8000). lex([A, B, C, D, E. F, g(x), n(x), +(x,x)]). lrpo_lr_status( [+ (x, x) ] ) . weight_list(pick_and_purge). '/. following are steps from a proof of +(c,c)=c, '/, the union of c and c » c.
1350
Collected Works of henry Wos
weight(EQ C,+(C,x)),+(C,x)), 2). weight(EQ :c.+(z,C)),+(C,x)), 2). weight(EQ C,+(x,+(y,C))),+(C,+(x,y))), 2 ) . weight(EQ C,+(x,+(C,y))),+(C,+(x,y))), 2). weight(EQ +(n(+(C,x)),n(+(C,n(+(x,C)))))),C), 2). weight(EQ +(n(+(C,x)),n(+(C,n(+(C,x)))))),C), 2). weight(EQ +(n(C),n(+(C,n(C))))),C), 2). weight(EQ +(n(+(x,y)),n(+(y,n(x))))),y), 2). weight(EQ +(n(+(x,y)),n(+(n(y),x)))),x), 2). weight(EQ +(C,n(+(n(C),+(C,n(C)))))),n(C))) 2). weight(EQ C,+(x,y)),+(C,+(y,x))), 2). weight(EQ +(n(+(C,+(x,y))),n(+(C,n(+(y,x)))))),C); 2). weight(EQ + (n(+(C,x)) ,n(+(n(C) , + (x,C))))) ,+(x.O)2). weight(EQ >(n(+(x,+(y,z))),n(+(z,n(+(x,y)))))),z)i 2). weight(EQ +(n(+(x,y)),n(+(n(x),y)))),y), 2). weight(EQ +(n(+(x,n(y))),n(+(y,x)))),x), 2). weight(EQ +(n(+(n(x),y)),n(+(y,x)))),y), 2). weight(EQ +(n(+(x,+(y,z))),n(+(n(+(x,y)),z)))),z), 2) weight(EQ +(n(+(x,C)),n(+(C,n(+(C,x)))))),C), 2 ) . weight(EQ +(C,n(+(C,+(n(+(C,x)),n(+(x,C))))))),n(+(x,C))), 2) weight(EQ +(n(C),n(+(C,+(n(C),n(+(C,n(C)))))))),C), 2). weight(EQ +(n(+(x,+(y,z))),n(+(y,n(+(x,z)))))),y), 2). weight(EQ +(n(C),n(+(n(C),+(C,n(C)))))),C). 2). weight(EQ +(n(C),+(C,n(C)))),n(+(C,n(C)))), 2). weight(EQ +(C,n(+(C,n(C))))).n(C)), 2). weight(EQ +(n(+(x,+(y,z))),n(+(n(+(x,z)),y)))),y), 2). weight(EQ +(x,C)),n(+(C,x))), 2). weight(EQ :+(x,*(y,C))),n(+(C,+(x,y)))), 2). weight(EQ >(n(+(C,x)),n(+(C,+(n(C),x))))),+(x,C)), 2). weight(EQ +(n(+(C,x))fn(+(n(C),+(x,n(+(C,n(C)))))))),x), 2). weight(EQ :c,n(+(C,n(C)))),C), 2). weight(EQ C,+(x,n(+(C,n(C))))),+(C,x)), 2). weight(EQ x,n(+(C,n(C)))),x), 2). weight(EQ n(+(C,n(C))),x),x), 2). weight(EQ +(n(x),n(+(C,+(x,n(C)))))),x), 2). weight(EQ >(n(x),n(n(x)))),n(+(C,n(C)))), 2 ) . weight(EQ +(x,n(x))),n(+(C,n(C)))), 2). weight(EQ n(+(x,n(n(x))))),n(n(x))), 2). weight(EQ n(x)).x), 2) weight(EQ n(+(y,x)),n(+(n(y),x))),n(x)), 2). end_of_li St. list(usable). EQ(x.z).
1351
The Resonance Strategy
EQ(+(x,y),+(y,x)). EQ(+(+(x,y),z),+(x,+(y,z))). end_of_list. list(sos). EQ(n(+(n(+(x,y)),n(+(x,n(y))))),x). 7. Robbins axiom EQ(+(C,C),C). '/.hypothesis - E Q ( + ( n ( + ( A , n ( B ) ) ) , n ( + ( n ( A ) , n ( B ) ) ) ) , B ) . 7. d e n i a l '/. of Huntington axiom end_of_list. '/, l i s t (demodulators). 7. ( + ( x , y ) - + ( y , x ) ) . 7. ( + ( + ( x , y ) , z ) = + ( x , + ( y , z ) ) ) . 7. (n(+(n(+(x,y)),n(+(x,n(y))))) - x) . 7. (+(C,C) - C). 7. hypothesis '/, end_of_list.
7. Robbins axiom
P r o o f 1 in R o b b i n s A l g e b r a > UNIT CONFLICT at
63.07 s e c
> 909 [ b i n a r y , 9 0 8 , 1 ] $F.
Length of proof i s 4 1 . PROOF 1 [] EQ(x.x). 3 , 2 [] E Q ( + ( x , y ) , + ( y , x ) ) . 5 , 4 [] E Q ( + ( + ( x , y ) , z ) , + ( x , + ( y , z ) ) ) . 6 [] E Q ( n ( + ( n ( + ( x , y ) ) , n ( + ( x , n ( y ) ) ) ) ) , x ) . 9 , 8 [] EQ(+(C,C),C). 10 [] - ( E Q ( + ( n ( + ( A , n ( B ) ) ) , n ( + ( n ( A ) , n ( B ) ) ) ) , B ) ) . 12,11 [para_from,8,4] E Q ( + ( C , + ( C , x ) ) , + ( C , x ) ) . 14,13 [ p a r a _ i n t o , l l , 2 ] E Q ( + ( C , + ( x , C ) ) , + ( C , x ) ) . 15 [ p a r a _ i n t o , 1 3 , 4 ] E Q ( + ( C , + ( x , + ( y , C ) ) ) , + ( C , + ( x , y ) ) ) . 18,17 [para_from,13,4,demod,5,5] E Q ( + ( C , + ( x , + ( C , y ) ) ) , +(C,+(x,y))). 19 [ p a r a _ i n t o , 6 , 1 3 ] E Q ( n ( + ( n ( + ( C , x ) ) , n ( + ( C , n ( + ( x , C ) ) ) ) ) ) , C ) . 21 [ p a r a _ i n t o , 6 , l l ] E Q ( n ( + ( n ( + ( C , x ) ) , n ( + ( C , n ( + ( C , x ) ) ) ) ) ) , C ) . 23 [ p a r a _ i n t o , 6 , 8 ] E Q ( n ( + ( n ( C ) , n ( + ( C , n ( C ) ) ) ) ) , C ) . 27 [ p a r a _ i n t o , 6 , 2 ] E q ( n ( + ( n ( + ( x , y ) ) , n ( + ( y , n ( x ) ) ) ) ) , y ) . 31 [ p a r a _ i n t o , 6 , 2 ] E Q ( n ( + ( n ( + ( x , y ) ) , n ( + ( n ( y ) , x ) ) ) ) , x ) . 36,35 [para_from,23,6,demod,3] EQ(n(+(C,n(+(n(C),
1352
Collected Works of Larry Wos
+(C,n(C)))))),n(C)). 43 [ p a r a _ i n t o , 1 5 , 2 , d e m o d , 5 , 1 8 ] E Q ( + ( C , + ( x , y ) ) , + ( C , + ( y , x ) ) ) . 51 [para_from,43,6] E Q ( n ( + ( n ( + ( C , + ( x , y ) ) ) , n(+(C,n(+(y,x)))))),C). 61 [para_into,27,13,demod,3] E Q ( n ( + ( n ( + ( C , x ) ) , n ( + ( n ( C ) . +(x.C))))).+(x,C)). 65 [ p a r a _ i n t o , 2 7 , 4 ] E Q ( n ( + ( n ( + ( x , + ( y , z ) ) ) , n(+(z,n(+(x,y)))))),z). 73 [ p a r a _ i n t o , 2 7 , 2 ] E Q ( n ( + ( n ( + ( x , y ) ) , n ( + ( n ( x ) , y ) ) ) ) , y ) . 77 [ p a r a _ i n t o , 2 7 , 2 ] E q ( n ( + ( n ( + ( x , n ( y ) ) ) , n ( + ( y , x ) ) ) ) , x ) . 99 [ p a r a _ i n t o , 3 1 , 2 ] E Q ( n ( + ( n ( + ( n ( x ) , y ) ) , n ( + ( y , x ) ) ) ) , y ) . 107 [ p a r a _ i n t o , 7 3 , 4 ] E Q ( n ( + ( n ( + ( x , + ( y , z ) ) ) , n ( + ( n ( + ( x , y ) ) , z)))),z). 149 [ p a r a _ i n t o , 2 1 , 2 ] E Q ( n ( + ( n ( + ( x , C ) ) , n ( + ( C , n ( + ( C , x ) ) ) ) ) ) , C ) . 178,177 [para_from,149,27,demod,5,3] EQ(n(+(C,n(+(C,+(n(+(C,x)), n(+(x,C))))))),n(+(x,C))). 214,213 [ p a r a _ i n t o , 5 1 , 2 3 , d e m o d , 3 , 9 , 3 ] EQ(n(+(n(C),n(+(C,+(n(C), n(+(C,n(C)))))))),C). 219 [ p a r a _ i n t o , 6 5 , 2 ] E Q ( n ( + ( n ( + ( x , + ( y , z ) ) ) , n ( + ( y , n(+(x,z)))))),y). 233 [ p a r a _ i n t o , 6 5 , 3 5 , d e m o d , 3 , 1 2 , 3 ] EQ(n(+(n(C),n(+(n(C), +(C,n(C)))))).C). 244,243 [para.from,233,99,demod,3,36] EQ(n(+(n(C), +(C,n(C)))),n(+(C,n(C)))). 249 [back.demod,35,demod,244] E q ( n ( + ( C , n ( + ( C , n ( C ) ) ) ) ) , n ( C ) ) . 277 [ p a r a . i n t o , 1 0 7 , 2 ] E Q ( n ( + ( n ( + ( x , + ( y , z ) ) ) , n(+(n(+(x,z)),y)))),y). 315 [para_into,219,19,demod,3,178] E Q ( n ( + ( x , C ) ) , n ( + ( C , x ) ) ) . 334,333 [ p a r a _ i n t o , 3 1 5 , 4 ] E Q ( n ( + ( x , + ( y , C ) ) ) , n ( + ( C , + ( x , y ) ) ) ) . 337 [back_demod,61,demod,334] E Q ( n ( + ( n ( + ( C , x ) ) , n ( + ( C , + ( n ( C ) , x))))), + (x.O). 418,417 [para_into,277,23,demod,3] EQ(n(+(n(+(C,x)), n(+(n(C),+(x,n(-KC,n(C)))))))),x). 441 [para_into,337,249,demod,214,3] E Q ( + ( C , n ( + ( C , n ( C ) ) ) ) , C ) . 453 [para_from,441,17,demod,14] E Q ( + ( C , + ( x , n ( + ( C , n ( C ) ) ) ) ) , +(C,x)). 482,481 [para_from,453,77,demod,3,3,418] EQ(+(x, n(+(C,n(C)))),x). 496,495 [ p a r a _ i n t o , 4 8 1 , 2 ] E Q ( + ( n ( + ( C , n ( C ) ) ) , x ) , x ) . 510,509 [para_from,481,219,demod,3] E q ( n ( + ( n ( x ) , n ( + ( C , +(x,n(C)))))),x). 513 [para_from,481,99,demod,496.3] E Q ( n ( + ( n ( x ) , n ( n ( x ) ) ) ) , n(+(C,n(C)))). 765 [para.into,513,509,demod,510] E Q ( n ( + ( x , n ( x ) ) ) ,
The Resonance
Strategy
1353
n<+(C,n(C)))). 828,827 [para_from,765,99,demod,3,496] EQ(n(n(+(x,n(n(x))))),n(n(x))). 830,829 [para_from,765,99,demod,3,482,828] E Q ( n ( n ( x ) ) , x ) . 895,894 [ p a r a _ i n t o , 8 2 9 , 7 3 ] E Q ( + ( n ( + ( y , x ) ) , n ( + ( n ( y ) , x ) ) ) , n ( x ) ) . 908 [back.demod,10,demod,895,830] -(EQ(B,B)). Clause (908) contradicts clause (1), and the proof is complete. P r o o f 2 in R o b b i n s A l g e b r a > UNIT CONFLICT at
12.38 sec
> 477 [ b i n a r y , 4 7 6 , 1 ] $F.
Length of proof i s 3 1 . PROOF 1 [] EQ(x.x). 3 , 2 [] E Q ( + ( x , y ) , + ( y , x ) ) . 5 , 4 [] E q ( + ( + ( x , y ) , z ) , + ( x , + ( y , z ) ) ) . 6 [] E Q ( n ( + ( n ( + ( x , y ) ) , n ( + ( x , n ( y ) ) ) ) ) , x ) . 8 [] EQ(+(C,C).C). 10 [] - ( E Q ( + ( n ( + ( A , n ( B ) ) ) , n ( + ( n ( A ) , n ( B ) ) ) ) , B ) ) . 13 [ p a r a _ i n t o , 6 , 2 ] E Q ( n ( + ( n ( + ( x , y ) ) , n ( + ( y , n ( x ) ) ) ) ) , y ) . 17 [ p a r a _ i n t o , 6 , 2 ] E Q ( n ( + ( n ( + ( x , y ) ) , n ( + ( n ( y ) , x ) ) ) ) , x ) . 21 [ p a r a _ i n t o , 1 3 , 4 ] E Q ( n ( + ( n ( + ( x , + ( y , z ) ) ) , n(+(z,n(+(x.y)))))),z). 25 [ p a r a _ i n t o , 1 3 , 2 ] E Q ( n ( + ( n ( + ( x , y ) ) , n ( + ( n ( x ) , y ) ) ) ) , y ) . 29 [ p a r a _ i n t o , 1 3 , 2 ] E Q ( n ( + ( n ( + ( x , n ( y ) ) ) , n ( + ( y , x ) ) ) ) , x ) . 47 [ p a r a _ i n t o , 1 7 , 2 ] E Q ( n ( + ( n ( + ( n ( x ) , y ) ) , n ( + ( y , x ) ) ) ) , y ) . 55 [ p a r a _ i n t o , 2 1 , 2 ] E Q ( n ( + ( n ( + ( x , + ( y , z ) ) ) , n(+(y,nO-(x,z)))))),y). 83 [para_into,55,2,demod,5] E Q ( n ( + ( n ( + ( x , + ( y , z ) ) ) , n(+<x,n(+(z,y)))))),x). 85 [ p a r a _ i n t o , 5 5 , 2 ] E Q ( n ( + ( n ( + ( x , + ( y , z ) ) ) , n(+(n(+(x,z)),y)))),y). 115 [para_from,8,47,demod,3,3] E Q ( n ( + ( n ( C ) , n ( + ( C , n ( C ) ) ) ) ) , C ) . 122,121 [para_from,8,4] E Q ( + ( C , + ( C , x ) ) , + ( C , x ) ) . 123 [para_from,115,83,demod,3,3] EQ(n(+(C,n(+(n(C), +(C,n(C)))))).n(C)). 136,135 [para_from,115,85,demod,3] EQ(n(+(n(+(C,x)), n(+(n(C),+(x,n(+(C,n(C)))))))),x). 172,171 [ p a r a _ i n t o , 1 2 1 , 2 ] E Q ( + ( C , + ( x , C ) ) , + ( C , x ) ) . 196,195 [para_from,123,55,demod,122,3] EQ(n(+(n(C),n(+(n(C),
1354
Collected Works of Larry Wos
+(C.n(C)))))),C). 200,199 [para_from,123,29,demod,3,196] EQ(n(+(n(C), +(C,n(C)))),n(+(C,n(C)))). 215 [back_demod,123,demod,200] EQ(n(+(C,n(+(C,n(C))))),n(C)). 218,217 [para.into,135,8] EQ(n(+(n(C),n(+(n(C), +(C,n(+(C,n(C)))))))),C). 231 [para_from,171,29,demod,3,3] EQ(n(+(n(+(C,x)), n(+(n(C),+(x,C))))),+(x,C)). 237 [para_from,171,4,demod,5,5] EQ(+(C,+(x,+(C,y))), +(C,+(x,y))). 271 [para_into,231,215,demod,3,218,3] EQ(+(C,n(+(C,n(C)))),C). 293 [para_from,271,237,demod,172] Eq(+(C,+(x,n(+(C,n(C))))),+(C,x)). 328,327 [para_from,293,29,demod,3,3,136] EQ(+(x,n(+(C,n(C)))),x). 342,341 [para_into,327,2] EQ(+(n(+(C,n(C))),x),x). 354,353 [para_from,327,55,demod,3] EQ(n(+(n(x),n(+(C,+(x,n(C)))))),x). 357 [para_from,327,29,demod,342,3] EQ(n(+(n(x),n(n(x)))),n(+(C,n(C)))). 369 [para.into,357,353,demod,354] EQ(n(+(x,n(x))),n(+(C,n(C)))). 412,411 [para_from,369,47,demod,3,328]
EQ(n(n(+(x,n(n(x))))),x). 416,415 [para_from,369,47,demod,3,342,412] EQ(n(n(x)),x). 467,466 [para_into,415,25] EQ(+(n(+(y,x)),n(+(n(y),x))),n(x)). 476 [back_demod,10,demod,467,416] -(EQ(B,B)). Clause (476) contradicts clause (1), and the proof is complete. 6. G R O U P T H E O R Y In this section, the focus is on group theory, mainly studying the use of the resonance strategy for seeking shorter proofs when applied to theorems concerned with single axioms. Even though dependency exists among them, for the axioms for a group, we prefer the set consisting of left and right identity with the identity denoted by e, left and right inverse, and associativity. The axioms of right identity and right inverse, for example, can be deduced from the remaining set of axioms. We also prefer the study of group theory to be made with the use of the inference rule paramodulation [1,3], which necessitates the inclusion of a clause for reflexivity of equality. We typically use the following clauses with / denoting product and g denoting inverse.
The Resonance Strategy
1355
Left i d e n t i t y : (1) EQUAL(f(e,x),x). Right identity: (2) EQUAL(f(x,e).x). Left inverse: (3) EQUAL(f(g(x),x),e). Right inverse:
(4) EQUAL(f(x,g(x)),e). Associativity:
(5) EQUAL(f(f(x,y),z),f(x,f(y,z))). Reflexivity: (6)
EQUAL(x.x).
We were motivated to make these studies in part by our colleague McCune. He had used OTTER in an impressively successful search for single axioms for groups and for varieties of groups [13]. A variety of groups is the set of all groups that satisfy the usual axioms for a group and also satisfy one or more additional equations. For example, if one adds the equation asserting that xy = yx for all x and y, one obtains the variety of groups known as commutative, or Abelian, groups. If, instead, one adds the equation asserting that the square of every x is the identity e, one has the variety of groups known as Boolean groups, or groups of exponent 2. For an equation to be a single axiom for a given variety, one must be able to deduce from it the usual axioms for a group (or their equivalent) as well as the additional equation (s) that define the variety, and one must also be able to prove that the proposed axiom is satisfied by all members of the variety. Especially regarding the latter property, one rejects a candidate single axiom when one can prove properties that are too strong. For example, for the variety of groups in which one adds the equation asserting that the square of x commutes with the square of y, being able to prove commutativity from a proposed single axiom shows that the candidate must be rejected, for there exist groups in the variety under discussion that are not commutative, which in turn implies that the proposed axiom is not true for all members of the variety. McCune's intriguing results caused us to join him in the use of his program to extend the study to additional varieties; we succeeded. When by e-mail the preceding paragraph was sent to Ken Kunen, he replied [14] with the following important distinctions, giving the computer science per spective in comparison with the mathematical perspective. In particular, Kunen remarked that although the paragraph is logically correct, it fails to accurately capture what is done by him and by us when studying such problems. Next, Kunen noted that satisfaction by all members of the variety is equivalent to deducibility of the proposed single axiom from the usual axioms for group the ory together with the equation(s) that define the variety. In contrast to the spirit of the preceding paragraph, our approach is "generate and test", generat-
1356
Collected Works of Larry Wos
ing candidates that obviously do satisfy all of the members of the variety. (For example, McCune had OTTER take the axioms for a group and the defining equation and deduce a large set of conclusions from which he selected those he thought promising.) We accept a candidate single axiom if we can prove the needed properties from it, and we reject a candidate if we can find an appropri ate model to serve as a counterexample. Models and counterexamples are found with Slaney's program FINDER [15], with Prolog programs written for that ob jective, and with the researcher's intuition. Kunen summarized by noting that, since we consider only those candidates that are satisfied by all members of the variety under study, we never reject a candidate because of being too strong but, instead, reject it because of being too weak. In addition to the given motivation, we were quite curious about the useful ness of the resonance strategy for seeking shorter proofs for theorems in group theory. In particular—especially since the resonance strategy was developed ex clusively in the context of the study of logic calculi, where equality (in the manner discussed here) plays no role—would the methodology apply well to problems in which equality is the only relationship present? The area of study concerns the variety of groups of exponent 3, those in which the cube of every element x is the identity e. Although McCune had mainly sought single axioms in which the identity is present implicitly, in deference to our preference, he then initiated the search for single axioms in which the identity e is present explicitly. He had OTTER assist in finding good candidates and then, for each, study it to see whether the appropriate theorems could be proved. For exponent 3 groups—as the input file given shortly shows—one is asked to prove that associativity holds (for multiplication), that the element e is in fact a two-sided identity, and that the cube of every element x is e. No need exists for considering the inverse property, for the square of x is the inverse of x in the variety under discussion. Among OTTER's successes, the following equation (expressed as a clause with the function / denoting product) was proved to be a single axiom for groups of exponent 3. EQ(f(x,f(f(x,f(f(x,y),z)),f(e,f(z,z)))),y). In other words, where the function / denotes multiplication, OTTER proved (in less than 2 CPU-seconds) from the given single equation that the constant e is a two-sided identity {ex = x = xe), that multiplication is associative, and that the cube of every x is e. From the viewpoint of automated reasoning, since paramodulation is the inference rule in use, the input also contains a clause for reflexivity, x = x. For our study of the variety of groups of exponent 3 and of the value of using the resonance strategy to seek shorter proofs, we conducted two experiments. In the first, we gave no guidance (with weight templates), simply asking OTTER to (in effect) reproduce McCune's success. In the second experiment, we mod ified the first experiment by including resonators (weight templates) to direct OTTER's search. The templates correspond to the union of the proof steps of
The Resonance Strategy
1357
the four proofs produced with the first experiment. The researcher who wishes to duplicate these two experiments can use the following input file, comment ing out (with %) the 18 lines of weight templates for the first experiment, and leaving them (without comment) for the second. I n p u t File for Studying Exponent 3 Groups set(knuth_bendix). set(process_input). set(index_for_back_demod). '/, Following 8 are knuth-bendix options '/, set(dynamic_demod_all). '/. clear(para_from_right). '/, set (back_demod). 7, set (para_f rom). 7, set(para_into). 7. clear(para_into_right). 7. set (dynamic_demod). 7, set (order_eq) . set(lex_rpo) . lex([e,f(x,x),g(x)3). lrpo_lr_status([f(x,x)]). assign(pick_given_ratio, 3). assign(max_proofs, 4). as s ign(max.mem, 12000). '/. set(control_memory). set(print_level). 7. set(sos_queue) . assign(max.weight, 80). 7. assign(max.seconds, 3600). assign(report, 300). assign(demod.limit, 0).
assign(reduce_weight_limit, 1225). clear(print_kept). clear(print_new_demod). clear(print_back_demod). weight_list(pick_and_purge). '/, following i s the union of proof steps for exp3. weight(EQ(f(e,e),e), 2 ) . weight(EQ(f(e,f(x,f(x,f(x,e)))),e), 2). weight(EQ(f(f(x,e),f(f(x,e),f(x,e))),e), 2). weight(EQ(f(f(x,e),f(f(x,e),f(x,f(f(f(e,f(x,e)),y)( f(y,y))))).f(x,e)), 2). weight(EQ(f(f(x,y),e),f(x,f(y,f(z,f(z,f(z,e)))))), 2).
Collected Works of Larry Wos
1358
veight(Eq(f(f(x,y).f(e,z)),f(x,f(y,z))), 2). weight(EQ(f(f(x,y),f(f(x,y),f(x.f(y,e)))),e), 2). weight(EQ(f(x,e),x), 2 ) . weight(EQ(f(x.f(f(x,f(f(x.y),f(e,f(f(e,z),f(e,z))))),z)),y), 2). weight(EQ(f(x,f(f(x,f(f(x,y),f(e,f(z,z)))),f(f(e,f(f(e,z)lu)), f(e,f(u,u))))),y), 2). weight(EQ(f(x,f(f(x,f(f(x,y),z)),f(f(e,z),f(e,z)))).y), 2). weight(EQ(f(x,f(f(y,z),u)),f(f(x,y),f(f(e,z),u))), 2). weight(EQ(f(x,f(x,f(f(x.f(y.f(z.e))),f(f(f(e.e),u), f(u,u))))),f(y,z)), 2). weight(Eq(f(x,f(x,f(f(y,z),f(z,z)))),f(x,f(x,f(y,e)))), 2). weight(Eq(f(x,f(x,f(x,e))),e), 2). weight(Eq(f(x,f(x,f(x,f(y,e)))),y), 2). weight(Eq(f(x,f(x,f(x,f(y,f(z,e))))),f(y,z)), 2). weight<EQ(f(x,f(y,f(e,f(f(e,f(z,z)).f(e,f(zIz)))))), f(f(x,y),z)), 2). end_of_list. list(usable). EQ(x.x). end_of_list. list(sos). EQ(f(x,f(f(x,f(f(x,y),z)),f(e,f(z,z)))),y). end_of_list. list(passive). - E q ( f ( e , a ) , a ) I $ANS(lid). - E q ( f ( a , e ) , a ) I $ANS(rid). - E Q ( f ( a , f ( a , a ) ) , e ) I $ANS(exp3). - E q ( f ( f ( a , b ) , c ) , f ( a , f ( b , c ) ) ) I $ANS(assoc). end_of_list. Both experiments prove (in order) the properties of right identity, exponent 3, left identity, and associativity. In the first experiment (without the use of the resonance strategy), the four proofs (in order) have length 9 and level 10, length 12 and level 13, length 30 and level 17, and length 31 and level 19. In the second experiment, which uses the resonance strategy, the four proofs (in order) have length 8 and level 8, length 10 and level 10, length 12 and level 12, and length 17 and level 14. We freely admit that this set of experiments was indeed satisfying, for it added to the growing evidence of the power of the resonance strategy.
The Resonance Strategy
1359
7. SUCCESSFULLY SEARCHING FO ELEGANT PROOFS
Although the precise definition of elegance for a proof may never be available, three relevant properties come to mind. For each of the three, we give in this section examples of using the resonance strategy to obtain a proof more elegant than that which prompted the study. Proof length is the first of the three properties. Everything being equal, the shorter the proof, the more elegant. Of course, when specific inference rules are not in use, then the concept of the length of a proof becomes somewhat hazy; for example, symmetry of equality can be used implicitly without counting the corresponding proof step. Such potential haziness is not a problem for us in this section, for our examples each rely on the specific use of condensed detachment. More generally, with the exception of demodulation, no problem exists for OTTER, for by necessity this program uses specific inference rules. Regarding demodulation, typically its applications do not contribute to the reported length of a proof; for example, in proofs of single axioms for groups [2], some steps rely on more than 500 applications of demodulation, none of which are counted in the reported length, for the cited applications of demodulation merely produce intermediate steps not corresponding to retained clauses. The second property concerns the structure of a proof, specifically, concerns the nature of the terms present in the deduced steps. For example, one might seek a proof in which absent are terms of the form n(n(t)) for any term t, where the function n denotes negation. Intuition and experience might reasonably sug gest that such a goal may indeed be unreachable (or computationally out of reach) when axioms in which the function n is present are used in the proof. After all, one commonly sees the use of lemmas of the form not(not(x)) = x (in circuit design) and minus(minus((x)) = x (in mathematical proof). For a second example, logicians sometimes seek proofs that are organic, meaning that none of the steps of the proof contains a subformula that is true under all assignments of true and false. We think of the third property of elegance of a proof as one of compactness of the proof. Rather than a formal definition, the following illustration suffices, for one can extract from it (if desired) the appropriate formalism. Let the theorem T under consideration be of the form P implies Q and r and S. For example, let P be the Lukasiewicz axiom system consisting of LI, L2, and L3, and, respectively, let Q, R, and S be theses 18, 39, and 49 (the Church axiom system). If by hand or by program one finds a proof of T such that the proof is a proof of exactly one of Q or R or S, then one has a proof that is compact. Of course, to be a proof of, say, R requires that the last step be R and that all steps be needed in
the proof. Therefore, a compact proof of T that completes with the deduction of R must contain as subproofs proofs of each of Q and S. As further evidence of the value of the resonance strategy—although some times assisted with other procedures—we give examples of proofs in which one
Collected Works of Larry Wos
1360
or more of the three properties of elegance is present, those regarding length, structure, and compactness. The proofs are taken from two-valued sentential (or propositional) calculus and from many-valued sentential calculus, the latter being weaker than the former in the sense that the axioms of the former imply the axioms of the latter. Rather than a thorough treatment of our attack, we merely supply brief commentary to accompany the proofs.
7.1. Two-Valued Sentential Calculus The following three 22-step proofs of the Church axiom system were each obtained starting with the Lukasiewicz axiom system consisting of LI, L2, and L3. The original Lukasiewicz proof is (in effect) of length 33. The first of the three proofs is (from the viewpoint of our research) chronologically the oldest. Proof 1 in Two-Valued Sentential Calculus > EMPTY CLAUSE at 1.21 sec > 122 [hyper,4,105,119,102] $ANSVER(step_allBEH_Church_FL_18_35_49). Length of proof is 22. Level of proof is 16. PR00F
I [] -P(i(x,y))| -P(x)|P(y). 4 [] -P(i(p,i(q,p)))| -P(i(i(p,i(q,r)),i(i(p,q).i(p.r))))l -P(i(i(n(p),n(q)),i(q,p)))| $ANSWER(step_allBEH_Church_FL_18_35_49). 10 [] P(i(i(x,y).i(i(y,z).i(x,z)))). II [] P(i(i(n(x),x),x)). 12 [] P(i(x,i(n(x),y))).
81 83 85 87 88 91 92 93 94
[hyper,1,10,10] [hyper.1,10,11] [hyper,1,10,12] [hyper,1,12,11] [hyper,1,81,81] [hyper,1,81,85] [hyper.1,88,83] [hyper,1,91.87] [hyper,1,92,93]
P(i(i(i(i(x,y),i(z,y)),u),i(i(z,x),u))). P(i(i(x,y),i(i(n(x),x),y))). P(i(i(i(n(x),y),z),i(x,z))). P(i(n(i(i(n(x),x),x)),y)). P(i(i(x,i(y,z)),i(i(u,y),i(x,i(u,z))))). P(i(i(x,n(y)),i(y,i(x,z)))). P(i(i(x,i(n(y),y)),i(i(y,z),i(x,z)))). P(i(x,i(n(i(i(n(y),y),y)),z))). P(i(i(i(i(n(x),x),x),y),i(z,y))).
95 [hyper,1,81,94] P(i(i(x,i(n(y),y)),i(z,i(x,y)))). 98 [hyper,1,81,95] P(i(i(n(x),y),i(z,i(i(y,x),x))>). 101 [hyper,1,92,98] P(i(i(i(i(x,y),y),z),i(i(n(y),x),z))). 102 [hyper,1,101,85] P(i(i(n(x),n(y)),i(y,x))).
The Resonance
Strategy
1361
104 [hyper,1,101,81] P(i(i(n(i(x,y)),i(z,y)),i(i(x.z), i(x,y)))). 105 [hyper,1,85,102] P(i(x,i(y,x))). 108 [hyper,1,10,105] P(i(i(i(x,y),z),i(y,z))). 110 [hyper,1,108,102] P(i(n(x),i(x,y))). 112 [hyper,1,10,110] P(i(i(i(x,y),z),i(n(x),z))). 114 [hyper,1,112,112] P(i(n(i(x,y)),i(n(x),z))). 115 [hyper,1,92,114] P(i(i(x,y),i(n(i(x,z)),y))). 117 [hyper,1,10,115] P(i(i(i(n(i(x,y)),z),u),i(i(x,z),u))). 119 [hyper,1,117,104] P(i(i(x,i(y,z)),i(i(x,y),i(x,z)))). 122 [hyper,4,105,119,102] $ANSWER(step_allBEH_Church_FL_18_35_49). P r o o f 2 in T w o - V a l u e d S e n t e n t i a l Calculus > EMPTY CLAUSE at 2.06 sec > 139 [hyper.4,110,137,106] $ANSWER(step_allBEH_Church_FL_18_35_49). Length of proof i s 2 2 .
Level of proof i s 15.
pR00F I [] - P ( i ( x , y ) ) l - P ( x ) | P ( y ) . 4 [] - P ( i ( p , i ( q , p ) ) ) l - P ( i ( i ( p , i ( q , r ) ) , i ( i ( p , q ) , i ( p , r ) ) ) ) l -P(i(i(n(p),n(q)),i(q,p)))l $ANSVER(step_allBEH_Church_FL_18_35_49). 10 [] P ( i ( i ( x , y ) , i ( i ( y , z ) , i ( x , z ) ) ) ) . I I [] P ( i ( i ( n ( x ) , x ) , x ) ) . 12 [] P ( i ( x , i ( n ( x ) , y ) ) ) . 81 83 85 87 88 90 92 93
[hyper,1,10,10] [hyper,1,10,11] [hyper,1,10,12] [hyper,1,12,11] [hyper,1,81,81] [hyper,1,81,83] [hyper,1,10,87] [hyper,1,88,90] i(x,i(u,z))))). 94 [ h y p e r , 1 , 8 5 , 9 2 ] 95 [ h y p e r , 1 , 9 3 , 9 4 ] 96 [ h y p e r , 1 , 8 1 , 9 5 ] 100 [ h y p e r , 1 , 9 3 , 9 6 ]
P(i(i(i(i(x,y),i(z,y)),u),i(i(z,x),u))). P(i(i(x,y),i(i(n(x),x),y))). P(i(i(i(n(x),y),z),i(x,z))). P(i(n(i(i(n(x),x),x)),y)). P(i(i(x,i(y,z)),i(i(u,y),i(x,i(u,z))))). P(i(i(x,y),i(i(n(i(y,z)),i(y,z)),i(x,z)))). P(i(i(x,y),i(n(i(i(n(z),z),z)),y))). P(i(i(x,i(n(i(y,z)),i(y,z))),i(i(u,y), P(i(x,i(n(i(i(n(y),y),y)),z))). P(i(i(x,i(n(y),y)),i(z,i(x,y)))). P(i(i(n(x),y),i(z,i(i(y,x),x)))). P(i(i(x,i(y,z)),i(i(n(z),y),i(x,z)))).
Collected Works of Larry Wos
1362
105 [hyper,1,88,100] P ( i ( i ( x , i ( n ( y ) , z ) ) , i ( i ( u , i ( z , y ) ) , i(x,i(u,y))))). 106 [hyper.1.100.12] P ( i ( i ( n ( x ) , n ( y ) ) , i ( y , x ) ) ) . 110 [hyper.1,85,106] P ( i ( x , i ( y , x ) ) ) . 115 [hyper,1,10,110] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . 119 [hyper.1,115.106] P ( i ( n ( x ) , i ( x , y ) ) ) . 122 [hyper.1,100,119] P ( i ( i ( n ( x ) , y ) , i ( n ( y ) , x ) ) ) . 126 [hyper,1,122,119] P ( i ( n ( i ( x , y ) ) , x ) ) . 132 [hyper,1,10,126] P ( i ( i ( x , y ) , i ( n ( i ( x , z ) ) , y ) ) ) . 134 [hyper,1,105,132] P ( i ( i ( x , i ( y , i ( z , u ) ) ) , i ( i ( z , y ) , i(x.i(z,u))))). 137 [hyper,1,134,10] P ( i ( i ( x , i ( y , z ) ) , i ( i ( x , y ) , i ( x . z ) ) ) ) . 139 [hyper.4,110,137,106] $ANSWER(step_allBEH_Church_FL_18_35_49).
Proof 3 in Two-Valued Sentential Calculus > EMPTY CLAUSE at 1.18 sec > 125 [hyper,4,110,123,108] $ANSWER(step_allBEH_Church_FL_18_35_49). Length of proof is 22. Level of proof is 17. PROOF
I [] - P ( i ( x , y ) ) l -P(x)lP(y). 4 [] - P ( i ( p , i ( q , p ) ) ) | - P ( i ( i ( p , i ( q , r ) ) , i ( i ( p , q ) , i ( p , r ) ) ) ) | -P(i(i(n(p),n(q)),i(q,p)))| $ANSWER(step_allBEH_Church_FL_18_35_49). 10 [] P ( i ( i ( x , y ) , i ( i ( y , z ) , i ( x , z ) ) ) ) . II [] P ( i ( i ( n ( x ) , x ) , x ) ) . 12 [] P ( i ( x , i ( n ( x ) , y ) ) ) . 81 [hyper,1,10,10] P ( i ( i ( i ( i ( x , y ) , i ( z , y ) ) , u ) , i ( i ( z , x ) , u ) ) ) . 84 [hyper,1,10,12] P ( i ( i ( i ( n ( x ) , y ) , z ) , i ( x , z ) ) ) . 86 [hyper,1,12,11] P ( i ( n ( i ( i ( n ( x ) , x ) , x ) ) , y ) ) . 87 [hyper,1,81,81] P(i(i(x,i(y,z)),i(i(u,y),i(x,i(u,z))))). 89 [hyper,1,81,10] P(i(i(x,y),i(i(i(x,z),u),i(i(y.z),u)))). 91 [hyper,1,87,89] P(i(i(x,i(i(y,z),u)),i(i(y,v), i(x,i(i(v,z),u))))). 93 [hyper,1.89,86] P(i(i(i(n(i(i(n(x),x),x)),y),z), i(i(u,y).z))). 94 [hyper.1,93.11] P(i(i(x,i(i(n(y),y),y)),i(i(n(y),y),y))). 96 [hyper,1,84,94] P(i(x,i(i(n(y),y),y))).
The Resonance Strategy
1363
99 [hyper,1,91,96] P(i(i(n(x),y),i(z,i(i(y,x),x)))). 101 [hyper,1,10,99] P(i(i(i(x,i(i(y,z),z)),u), i(i(n(z).y),u))). 103 [hyper,1,101,11] P(i(i(n(x),y),i(i(y,x),x))). 105 [hyper,1,87,103] P(i(i(x,i(y,z)),i(i(n(z),y),i(x,z)))). 107 [hyper,1,91,105] P(i(i(n(x),y),i(i(z,i(u,x)),i(i(y,u). i(z,x))))). 108 [hyper,1,105,12] P(i(i(n(x),n(y)),i(y,x))). 110 [hyper,1.84,108] P(i(x,i(y,x))). 113 [hyper,1 ,10,110] P(i(i(i(x,y),z),i(y,z))). 115 [hyper,1 ,113,108] P(i(n(x),i(x,y))). 117 [hyper,1 ,105,115] P(i(i(n(x),y),i(n(y),x))). 119 [hyper,1 ,117,115] P(i(n(i(x,y)),x)). 121 [hyper,1 ,107,119] P(i(i(x,i(y,i(z,u))),i(i(z,y), i(x,i(z,u))))). 123 [hyper,1,121,10] P(i(i(x,i(y,z)),i(i(x,y),i(x,z)))). 125 [hyper,4,110,123,108] $ANSWER(step_allBEH_Church_FL_18_35_49).
An examination of the three proofs yields (to us) some surprising differences. The first proof contains eight steps not present in the second, and it contains twelve steps not present in the third. The second proof contains eight steps not present in the third. Where the first and third proofs are free of any formula in which five or more distinct variables occur, the second proof contains one step in which five distinct variables occur. As for similarities, no step in any of the three proofs contains a formula of the form n(n(t)) for any term t, nor is there present a subterm of the form i(x,x). Each proof completes with the deduction of thesis 35; therefore, each is compact. We know of no shorter proof than one of length 22, and we offer the corresponding question for research.
7.2. Many-Valued Sentential Calculus As further evidence of the value of using the resonance strategy to search for elegant proofs, we turn to many-valued sentential calculus, which can be axiomatized with the following four formulas [5,16] (written in clause notation) in which the function i can be interpreted as "implication" and the function n as "negation". P(i(x,i(y,x))). P(i(i(x,y),i(i(y,z),i(x,z)))). P(i(i(i(x,y).y).i(i(y,x),x))). P(i(i(n(x).n(y)),i(y,x))). As is typical of many logic calculi, again the inference rule that is used is con densed detachment, captured by the earlier cited clause (in Sections 1.1 and
Collected Works of Larry Wos
1364
1.5, for example) for that purpose coupled with the use of hyperresolution. Many-valued sentential calculus is weaker than two-valued sentential calculus in that the axioms of the former are deducible from the axioms of the latter. The theorem under study asserts that the following formula (in clause notation) is deducible from the given four axioms; we call the formula MV5. P(i(i(i(x,y),i(y.x)),i(y,x))). When Meredith proved that MV5 is dependent on the given four axioms for many-valued sentential calculus [16], it marked an important advance for that field. From the historical perspective, the goal of proving the given theorem in a single run without substantial guidance eluded our numerous attempts with OTTER under diverse option settings for more than two and one-half years. As reported in [17], we had with an iterated approach and with many suggestions obtained a 63-step proof. Even with that proof in hand, we could go no further from February 1990 until September 1992, unless we resorted to a proof-checking mode. (For those researchers interested in a successful attack in proving the theorem under discussion without substantial guidance, see Section 5.2 of [10].) We now give the input file that does this proof checking—in a manner that attempts to exclude from retention almost all other clauses—and follow it with the 63-step proof. We note that list (passive) is used only for unit conflict and for forward subsumption. (The input file and proof differ only slightly from that respectively used and obtained in February 1990; the main difference rests with the use of order.history, resulting in the ancestors being listed as nucleus, major premiss, and minor premiss.) Input File for Proof Checking a 63-Step Proof set(hyper_res). assign(fpa_literals,8). assign(max.weight,2). assign(max_proofs,0). clear(print_kept). '/, clear(back_sub). % assign(max.seconds,7200). assign(max_mem,24000). assign(report,300). set(order.history). set(sos_queue). weight_list(purge_gen). weight(P(i(x,i(y,i(z,y)))),2). weight(P(i(i(i(i(x,y),i(z,y)),u),i(i(z,x),u))),2). weight(P(i(x,i(i(y,z),i(i(z,u),i(y,u))))),2).
The Resonance Strategy
1365
weight(P(i(i(i(x,y),z),i(y,z))),2). weight(P(i(i(i(i(x,y),y),z),i(i(i(y,x),x),z)))>2). weight(P(i(i(i(x,y),z),i(i(n(y),n(x)),z))),2). weight(P(i(i(i(x,i(y,x)),z),z)),2). weight(P(i(i(x,i(y,z)),i(i(u,y),i(x,i(u,z))))),2). weight(P(i(i(x,y),i(i(i(x,z),u),i(i(y,z),u)))),2). weight(P(i(i(i(i(x,y),i(i(y,z),i(x,z))),u),u)),2). weight(P(i(n(x),i(x,y))),2). weight(P(i(x,i(i(x,y),y))).2). weight(P(i(i(i(x,i(y,x)),i(y,x)),i(i(i(x,y),y),x))),2). weight(P(i(i(n(x),n(i(y,i(z,y)))),x)),2). weight(P(i(i(n(x),n(i(i(y,z),i(i(z,u),i(y,u))))),x)),2). weight(P(i(i(x,i(y,z)),i(x,i(i(z,u),i(y,u))))),2). weight(P(i(i(x,y),i(n(y),i(x,z)))),2). weight(P(i(i(i(x,y),z),i(n(x),z))),2). weight(P(i(i(x,i(y,z)),i(y,i(x,z)))),2). weight(P(i(i(x,y),i(i(i(y,x),x),y))),2). weight(P(i(i(i(i(n(x),n(i(y,i(z,y)))),x),u),u)),2). weight(P(i(x,i(i(y,z),i(i(x,y),z)))),2). weight(P(i(i(i(n(x),i(y,z)),u),i(i(y.x),u))),2). weight(P(i(n(n(x)),x)),2). weight(P(i(i(x,y),i(i(z,x),i(z,y)))),2). weight(P(i(i(x,i(n(y)>n(i(z,i(u,z))))),i(x,y))),2). weight(P(i(i(i(i(x,y),i(i(z,x),y)),u),i(z,u))),2). weight(P(i(i(i(n(n(x)),y),z),i(i(x,y),z))),2). weight(P(i(x,n(n(x)))),2). weight(P(i(i(x,n(n(y))),i(x,y))),2). weight(P(i(i(x,i(i(y,z),u)),i(x,i(z,u)))),2). weight(P(i(i(x,i(n(y),n(z))),i(x,i(z,y)))),2). weight(P(i(i(n(x),y),i(n(y),x))),2). weight(P(i(i(n(n(x)),y),i(x,y))),2). weight(P(i(i(i(x,y),n(z)),i(z,x))),2). weight(P(i(i(x,y),i(n(y),n(x)))),2). weight(P(i(i(x,i(n(n(y)),z)),i(x,i(y,z))))l2). weight(P(i(i(x,i(y,z)),i(x,i(n(z),n(y))))),2). weight(P(i(n(i(x,y)),n(y))),2). weight(P(i(i(i(n(x),n(y)),z),i(i(y,x),z))),2). weight(P(i(n(i(x.y)),n(i(i(y,z),n(x))))),2). weight(P(i(i(i(x.y),i(z,u)),i(y>i(n(u),n(z))))),2). weight(P(i(i(i(n(x).n(i(y,x))),n(i(y,x))),n(x))),2). weight(P(i(i(x,i(i(n(y),n(z)),u)),i(x,i(i(z,y),u)))),2). weight(P(i(i(i(n(x),n(y)),n(y)),i(i(x,y),n(x)))),2). weight(P(i(i(x,n(i(y,z))),i(x,n(i(i(z,u),n(y)))))),2). weight(P(i(i(x,i(i(n(y),n(i(z,y))),n(i(z,y)))),i(x,n(y)))),2)
Collected Works of Larry Wos
1366
weight(P(i(n(x),i(n(n(y)),n(i(y,x))))),2). weight(P(i(i(i(i(x,y),y),n(i(x,y))),n(y))),2). weight(P(i(n(x),i(y,n(i(y,x))))),2). weight(P(i(i(x,i(i(i(y,z),z),n(i(y,z)))),i(x,n(z)))),2). weight(P(i(i(i(n(x),i(y.n(i(y,x)))),z),z)),2). weight(P(i(i(i(i(x,y),y),n(i(y,x))),n(x))),2). weight(P(i(i(x,i(i(i(y,z),z),n(i(z,y)))),i(x,n(y)))).2). weight(P(i(i(x,y),i(i(y.n(i(y,x))),n(x)))),2). weight(P(i(i(i(x,n(i(x,y))),n(i(i(x,n(i(x,y))),n(y)))), n(n(y)))),2). weight(P(i(i(i(x,n(i(x,y))),n(i(i(x,n(i(x,y))),n(y)))),y)),2). weight(P(i(i(x,i(i(y,n(i(y,z))),n(i(i(y,n(i(y,z))), n(z))))),i(x,z))),2). weight(P(i(i(i(x,n(i(x,y))),n(i(y,x))),y)),2). weight(P(i(i(x,i(i(y,n(i(y,z))),n(i(z,y)))),i(x,z))),2). weight(P(i(x,i(i(n(i(x,y)),n(i(y,x))),y))),2). weight(P(i(x,i(i(i(y,x),i(x,y)),y))),2). weight(P(i(i(i(x,y),i(y,x)),i(y,x))),2). end_of_list. list(axioms). -P(i(x,y)) I -P(x) | P(y). end_of_list. list(sos). P(i(x,i(y,x))). P(i(i(x,y),i(i(y,z),i(x,z)))). P(i(i(i(x,y),y),i(i(y,x),x))). P(i(i(n(x),n(y)),i(y,x))). end_of_list. list(passive). -P(i(a,i(b,i(c,b)))) | $ANS(step_01). -P(i(i(i(i(a,b),i(c,b)),d),i(i(c,a),d))) | $ANS(step_02). -P(i(a,i(i(b,c),i(i(c,d),i(b,d))))) | $ANS(step_03). -P(i(i(i(a,b),c),i(b,c))) I $ANS(step_04). -P(i(i(i(i(a,b),b),c),i(i(i(b,a),a),c))) I $ANS(step_05). -P(i(i(i(a,b),c),i(i(n(b),n(a)),c))) | $ANS(step_06). -P(i(i(i(a,i(b,a)),c),c)) I $ANS(step_07). -P(i(i(a,i(b,c)),i(i(d,b),i(a,i(d,c))))) | $ANS(step_08). -P(i(i(a,b),i(i(i(a,c),d),i(i(b,c),d)))) | $ANS(step_09). -P(i(i(i(i(a,b),i(i(b,c),i(a,c))),d),d)) | $ANS(step_10). -P(i(n(a),i(a,b))) | $ANS(step_ll). -P(i(a,i(i(a,b),b))) | $ANS(step_12).
The Resonance
Strategy
1367
- P ( i ( i ( i ( a , i ( b , a ) ) , i ( b , a ) ) , i ( i ( i ( a , b ) , b ) , a ) ) ) I $ANS(step_13). - P ( i ( i ( n ( a ) , n ( i ( b , i ( c , b ) ) ) ) 1 a ) ) | $ANS(step_14). - P ( i ( i ( n ( a ) , n ( i ( i ( b , c ) , i ( i ( c , d ) , i ( b , d ) ) ) ) ) , a ) ) I $ANS(step_15). - P ( i ( i ( a , i ( b . c ) ) . i ( a , i ( i ( c , d ) , i ( b , d ) ) ) ) ) I $ANS(st«p_16). - P ( i ( i ( a , b ) , i ( n ( b ) , i ( a , c ) ) ) ) I $ANS(step_17). - P ( i ( i ( i ( a , b ) , c ) , i ( n ( a ) , c ) ) ) I $ANS(step_18). - P ( i ( i ( a , i ( b , c ) ) , i ( b , i ( a , c ) ) ) ) | $ANS(step_19). - P ( i ( i ( a , b ) , i ( i ( i ( b , a ) , a ) , b ) ) ) I $ANS(step_20). - P ( i ( i ( i ( i ( n ( a ) , n ( i ( b , i ( c , b ) ) ) ) , a ) ) d ) , d ) ) I $ANS(step_21). - P ( i ( a , i ( i ( b , c ) , i ( i ( a , b ) , c ) ) ) ) I $ANS(step_22). - P U C i U O i U h K b . c ^ . d ^ i U C b . a h d ) ) ) I $ANS(step_23). - P ( i ( n ( n ( a ) ) , a ) ) I $ANS(lemma_24). - P ( i ( i ( a , b ) , i ( i ( c , a ) . i ( c , b ) ) ) ) I $ANS(lemma_25). - P ( i ( i ( a , i ( n ( b ) , n ( i ( c , i ( d , c ) ) ) ) ) , i ( a , b ) ) ) I $ANS(step_26). - P ( i ( i ( i ( i ( a , b ) , i ( i ( c , a ) , b ) ) , d ) , i ( c , d ) ) ) I $ANS(step_27). - P ( i ( i ( i ( n ( n ( a ) ) , b ) , c ) , i ( i ( a , b ) , c ) ) ) | $ANS(step_28). - P ( i ( a , n ( n ( a ) ) ) ) I $ANS(lemma_29). - P ( i ( i ( a , n ( n ( b ) ) ) , i ( a , b ) ) ) I $ANS(step_30). - P ( i ( i ( a , i ( i ( b , c ) , d ) ) , i ( a , i ( c l d ) ) ) ) | $ANS(step_31). - P ( i ( i ( a , i ( n { b ) , n ( c ) ) ) , i ( a , i ( c , b ) ) ) ) | $ANS(step_32). - P ( i ( i ( n ( a ) , b ) , i ( n ( b ) , a ) ) ) I $ANS(step_33). - P ( i ( i ( n ( n ( a ) ) , b ) , i ( a , b ) ) ) | $ANS(step_34). - P ( i ( i ( i ( a , b ) . n ( c ) ) , i ( c , a ) ) ) I $ANS(step_35). - P ( i ( i ( a , b ) , i ( n ( b ) , n ( a ) ) ) ) I $ANS(lemma_36). - P ( i ( i ( a , i ( n ( n ( b ) ) , c ) ) , i ( a , i ( b , c ) ) ) ) I $ANS(step_37). - P ( i ( i ( a , i ( b , c ) ) , i ( a . i ( n ( c ) , n ( b ) ) ) ) ) | $ANS(step_38). - P ( i ( n ( i ( a , b ) ) , n ( b ) ) ) | $ANS(step_39). - P ( i ( i ( i ( n ( a ) , n ( b ) ) , c ) , i ( i ( b , a ) , c ) ) ) I $ANS(step_40). - P ( i ( n ( i ( a , b ) ) , n ( i ( i ( b , c ) , n ( a ) ) ) ) ) | $ANS(step_41). - P ( i ( i ( i ( a , b ) , i ( c , d ) ) , i ( b , i ( n ( d ) , n ( c ) ) ) ) ) I $ANS(step_42). - P ( i ( i ( i ( n ( a ) , n ( i ( b , a ) ) ) , n ( i ( b , a ) ) ) , n ( a ) ) ) I $ANS(step_43). - P ( i ( i ( a , i ( i ( n ( b ) , n ( c ) ) , d ) ) , i ( a , i ( i ( c , b ) . d ) ) ) ) | $ANS(step_44). - P ( i ( i ( i ( n ( a ) , n ( b ) ) , n ( b ) ) , i ( i ( a , b ) , n ( a ) ) ) ) I $ANS(step_45). - P ( i ( i ( a , n ( i ( b , c ) ) ) , i ( a , n ( i ( i ( c , d ) , n ( b ) ) ) ) ) ) I $ANS(step_46). -P(i(i(a,i(i(n(b),n(i(c,b)))In(i(c,b)))),i
Collected Works of Larry Wos
1368
-P(i(i(i(a,n(i(a,b))),n(i(i(a,n(i(a,b))),n(b)))),n(n(b)))) I $ANS(step_56). -P(i(i(i(a,n(i(a,b))),n(i(i(a,n(i(a,b))),n(b)))),b)) I $ANS(Btep_57). -P(i(i(a,i(i(b,n(i(b,c))),n(i(i(b,n(i(b,c))),n(c))))), i ( a , c ) ) ) I $ANS(step_58). - P ( i ( i ( i ( a , n ( i ( a , b ) ) ) , n ( i ( b , a ) ) ) , b ) ) I $ANS(step_59). - P ( i ( i ( a , i ( i ( b , n ( i ( b , c ) ) ) , n ( i ( c , b ) ) ) ) , i ( a , c ) ) ) | $ANS(step_60). - P < i ( a , i ( i ( n ( i ( a , b ) ) , n ( i ( b , a ) ) ) , b ) ) ) I $ANS(ste P _61). - P ( i ( a , i ( i ( i ( b , a ) , i ( a , b ) ) , b ) ) ) I $ANS(step_62). - P ( i ( i ( i ( a , b ) , i ( b , a ) ) , i ( b , a ) ) ) I $ANS(step_63). end_of_list. Proof of MV5 in 63 Steps 1 [] - P ( i ( x , y ) ) I -P(x) I P(y). 2 [] P ( i ( x , i ( y , x ) ) ) . 3 [] P ( i ( i ( x , y ) , i ( i ( y , z ) , i ( x , z ) ) ) ) . 4 [] P ( i ( i ( i ( x , y ) , y ) , i ( i ( y , x ) , x ) ) ) . 5 [] P ( i ( i ( n ( x ) , n ( y ) ) , i ( y , x ) ) ) . 68 [] - P ( i ( i ( i ( a , b ) , i ( b , a ) ) , i ( b , a ) ) ) 69 71 73 75 77 79 81 83 85 87 89 91 94
I $ANS(step_63).
[hyper.1,2,2] P ( i ( x , i ( y , i ( z , y ) ) ) ) . [hyper,1.3,3] P ( i ( i ( i ( i ( x , y ) , i ( z , y ) ) , u ) , i ( i ( z , x ) , u ) ) ) . [hyper,1,2,3] P ( i ( x , i ( i ( y , z ) , i ( i ( z , u ) , i ( y , u ) ) ) ) ) . [hyper,1,3,2] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . [hyper,1,3,4] P ( i ( i ( i ( i ( x , y ) , y ) , z ) , i ( i ( i ( y , x ) , x ) , z ) ) ) . [hyper,1.3,5] P ( i ( i ( i ( x , y ) , z ) , i ( i ( n ( y ) , n ( x ) ) , z ) ) ) . [hyper.1.4,69] P ( i ( i ( i ( x , i ( y , x ) ) , z ) , z ) ) . [hyper,1,71,71] P ( i ( i ( x , i ( y , z ) ) , i ( i ( u , y ) , i ( x , i ( u , z ) ) ) ) ) . [hyper,1.71.3] P ( i ( i ( x , y ) , i ( i ( i ( x , z ) , u ) , i ( i ( y , z ) , u ) ) ) ) . [hyper.1,4,73] P ( i ( i ( i ( i ( x , y ) , i ( i ( y , z ) , i ( x , z ) ) ) , u ) , u ) ) . [hyper,1,75,5] P ( i ( n ( x ) , i ( x , y ) ) ) . [hyper,1,75,4] P ( i ( x , i ( i ( x , y ) , y ) ) ) . [hyper,1,77,77] P ( i ( i ( i ( x , i ( y , x ) ) , i ( y , x ) ) , i ( i ( i ( x , y ) , y ) , x))). 98 [hyper.1,79,81] P ( i ( i ( n ( x ) , n ( i ( y . i ( z , y ) ) ) ) , x ) ) . 100 [hyper,1,79,87] P ( i ( i ( n ( x ) , n ( i ( i ( y , z ) , i ( i ( z , u ) , i(y,u))))),x)). 102 [hyper,1,71,87] P ( i ( i ( x , i ( y , z ) ) , i ( x , i ( i ( z , u ) , i ( y , u ) ) ) ) ) . 104 [hyper.1,83,89] P ( i ( i ( x , y ) , i ( n ( y ) , i ( x , z ) ) ) ) . 106 [hyper,1,3.89] P ( i ( i ( i ( x . y ) , z ) , i ( n ( x ) , z ) ) ) . 108 [hyper,1,83,91] P ( i ( i ( x , i ( y , z ) ) , i ( y , i ( x , z ) ) ) ) . 110 [hyper,1,75,94] P ( i ( i ( x , y ) , i ( i ( i ( y , x ) , x ) , y ) ) ) .
The Resonance Strategy 112 114 116 119 121 123 125 127 129 137 140 142 144 147 154 156 161 165 167 169 171 175 177 179 181 183 186 188 191 193 195 197 200 202 204 207 210
1369
[hyper,1,91,98] P ( i ( i ( i ( i ( n ( x ) , n ( i ( y , i ( z . y ) ) ) ) , x ) , u ) , u ) ) . [hyper,1,102,91] P ( i ( x , i ( i ( y , z ) , i ( i ( x , y ) , z ) ) ) ) . [hyper,1,3,104] P ( i ( i ( i ( n ( x ) , i ( y , z ) ) , u ) , i ( i ( y , x ) , u ) ) ) . [hyper,1,106,100] P ( i ( n ( n ( x ) ) , x ) ) . [hyper,1,87,108] P ( i ( i ( x , y ) , i ( i ( z , x ) , i ( z , y ) ) ) ) . [hyper,1,71.112] P ( i ( i ( x , i ( n ( y ) , n ( i ( z , i ( u , z ) ) ) ) ) , i ( x . y ) ) ) . [hyper,1.3,114] P ( i ( i ( i ( i ( x . y ) , i ( i ( z , x ) , y ) ) , u ) , i ( z . u ) ) ) . [hyper,1,85,119] P ( i ( i ( i ( n ( n ( x ) ) , y ) , z ) , i ( i ( x , y ) , z ) ) ) . [hyper.1,5,119] P ( i ( x , n ( n ( x ) ) ) ) . [hyper,1,121,119] P ( i ( i ( x , n ( n ( y ) ) ) , i ( x , y ) ) ) . [hyper,1.121,75] P ( i ( i ( x . i ( i ( y , z ) , u ) ) , i ( x , i ( z . u ) ) ) ) . [hyper,1,121,5] P ( i ( i ( x , i ( n ( y ) , n ( z ) ) ) , i ( x , i ( z , y ) ) ) ) . [hyper,1,116,123] P ( i ( i ( n ( x ) , y ) , i ( n ( y ) , x ) ) ) . [hyper,1,3,129] P ( i ( i ( n ( n ( x ) ) , y ) , i ( x , y ) ) ) . [hyper,1,142,106] P ( i ( i ( i ( x , y ) , n ( z ) ) , i ( z , x ) ) ) . [hyper,1.127,144] P ( i ( i ( x . y ) , i ( n ( y ) , n ( x ) ) ) ) . [hyper,1,121,147] P ( i ( i ( x , i ( n ( n ( y ) ) , z ) ) , i ( x , i ( y , z ) ) ) ) . [hyper,1,121,156] P ( i ( i ( x , i ( y , z ) ) , i ( x , i ( n ( z ) , n ( y ) ) ) ) ) . [hyper,1,81,156] P ( i ( n ( i ( x , y ) ) , n ( y ) ) ) . [hyper,1,3,156] P ( i ( i ( i ( n ( x ) , n ( y ) ) , z ) , i ( i ( y , x ) , z ) ) ) . [hyper,1,156,154] P ( i ( n ( i ( x , y ) > , n ( i ( i ( y , z ) , n ( x ) ) ) ) ) . [hyper,1,140.165] P ( i ( i ( i ( x , y ) , i ( z , u ) ) , i ( y , i ( n ( u ) , n ( z ) ) ) ) ) . [hyper,1,110,167] P ( i ( i ( i ( n ( x ) , n ( i ( y , x ) ) ) , n ( i ( y , x ) ) ) , n(x))). [hyper,1,121,169] P ( i ( i ( x , i ( i ( n ( y ) , n ( z ) ) , u ) ) , i(x,i(i(z.y),u)))). [hyper.1.77.169] P ( i ( i ( i ( n ( x ) , n ( y ) ) , n ( y ) ) , i ( i ( x . y ) , n ( x ) ) ) ) . [hyper,1.121,171] P ( i ( i ( x . n ( i ( y . z ) ) ) . i(x,n(i(i(z,u),n(y)))))). [hyper,1,121,177] P ( i ( i ( x , i ( i ( n ( y ) , n ( i ( z , y ) ) ) , n(i(z,y)))),i(x,n(y)))). [hyper,1,175,181] P ( i ( n ( x ) , i ( n ( n ( y ) ) , n ( i ( y , x ) ) ) ) ) . [hyper,1,186,79] P ( i ( i ( i ( i ( x , y ) , y ) , n ( i ( x , y ) ) ) , n ( y ) ) ) . [hyper,1,161,188] P ( i ( n ( x ) , i ( y , n ( i ( y , x ) ) ) ) ) . [hyper.1.121,191] P ( i ( i ( x , i ( i ( i ( y , z ) , z ) , n ( i ( y , z ) ) ) ) , i(x.n(z)))). [hyper,1,91,193] P ( i ( i ( i ( n ( x ) , i ( y . n ( i ( y , x ) ) ) ) , z ) , z ) ) . [hyper,1,195,77] P ( i ( i ( i ( i ( x , y ) , y ) , n ( i ( y , x ) ) ) , n ( x ) ) ) . [hyper,1,121,200] P ( i ( i ( x , i ( i ( i ( y , z ) , z ) , n ( i ( z , y ) ) ) ) , i(x.n(y)))). [hyper,1,125,202] P ( i ( i ( x , y ) , i ( i ( y , n ( i ( y , x ) ) ) , n ( x ) ) ) ) . [hyper,1,197.204] P ( i ( i ( i ( x , n ( i ( x , y ) ) ) , n(i(i(x.n(i(x,y))),n(y)))),n(n(y)))). [hyper,1.137,207] P ( i ( i ( i ( x , n ( i ( x , y ) ) ) ,
1370
Collected Works of Larry Wos
n(i(i(x,n(i(x,y))).n(y)))),y)). 212 [hyper,1,121,210] P ( i ( i ( x , i ( i ( y , n ( i ( y , z ) ) ) , n(i(i(y,n(i(y,z))),n(z))))),i(x,z))). 214 [hyper,1,212,183] P ( i ( i ( i ( x , n ( i ( x , y ) ) ) , n ( i ( y , x ) ) ) , y ) ) . 216 [hyper,1,121,214] P ( i ( i ( x , i ( i ( y , n ( i ( y , z ) ) ) , n(i(z.y)))),i(x,z))). 218 [hyper,1,125,216] P ( i ( x , i ( i ( n ( i ( x , y ) ) , n ( i ( y , x ) ) ) , y ) ) ) . 220 [hyper,1,179,218] P ( i ( x , i ( i ( i ( y , x ) , i ( x , y ) ) , y ) ) ) . 222 [hyper,1,108,220] P ( i ( i ( i ( x , y ) , i ( y , x ) ) , i ( y , x ) ) ) . Clause (222) contradicts clause (68), and the proof of MV5 is complete, with length 63 and level 23. Because of our interest in using OTTER to seek elegant proofs—in this con text, focusing on proof structure—we investigated the possibility of finding a proof of the theorem under discussion in which absent are all terms of the form n(n(t)) for any term t. From a respected colleague, we received the conjecture that such a proof did not exist. After all, experiments with many-valued sen tential calculus and related calculi exhibited abundant use of the terms that we intended to avoid. At the same time, we planned to seek proofs shorter than 63 steps (of condensed detachment). After numerous experiments, we did in fact find (with OTTER) a 39-step proof free of any terms of the form n(n(t)). When we much later revisited the theorem in question, but added the use of the resonance strategy and dropped the term structure requirement, OTTER found a 35-step proof [10]. We close the history of this problem by noting that the knowledge of the 39-step proof with the term structure constraint and the 35-step proof without it caused us to study again (during the writing of this article) the theorem with the resonance strategy. Our goal was to seek a proof that the four given axioms for many-valued sentential calculus imply the formula we call MV5 such that strictly less than 35 applications of condensed detachment are required and such that no term of the form n(n(t)) is present in any of the proof steps. In our first experiment, for resonators, we used correspondents of the four axioms (each with a weight of 1) that serve as the hypotheses of the theorem to be proved, followed by correspondents (32 of them each with a weight of 2) of the proof steps of the 35-step proof with the exception of those (the three) that contain a term of the form n(n(t)), followed by correspondents (15 of them each with a weight of 4) of the proof steps of the 39-step proof that are not present in the 35-step proof. All resonators were placed in weight Jist(pick-and.purge). At the start of the run, the max.weight was set to 22; it was then reduced to 16 after 1000 clauses were chosen as the focus of attention. A limit of 4 was placed on the number of distinct variables in a retained conclusion. The ratio strategy was used with the assigned parameter of 3. Ancestor subsumption was used, and so also was back subsumption. OTTER was instructed to drive its reasoning by first focusing on each of the four axioms, placed in list(sos), before choosing
The Resonance Strategy
1371
from the pool of deduced-and-retained clauses. Finally, the input for the first experiment included the following demodulator list, whose function we explain immediately. list(demodulators). (n(n(x)) » junk). ( i ( i ( x , x ) , y ) = junk). ( i ( y , i ( x , x ) ) = junk). (i(junk,x) = junk). ( i ( x , j u n k ) = junk). (n(junk) - junk). (P(junk) - $T). end_of_list. The first demodulator is included to begin the process of purging deduced clauses containing as a subterm a term of the form n(n(t)). The second and third demodulators are included to begin the process of purging deduced clauses that contain as a proper subterm a term of the form i(t,t) for any term t. The remaining demodulators enable the program, with one exception, to complete the process of purging unwanted clauses of the types under discussion, for such clauses are eventually demodulated to $T, which the program treats as "true" and, therefore, purges. Regarding the exception, the given set of demodulators does not address the purging of a clause properly containing a term of the form n(i(t, t)) for some term t. One could certainly add two such demodulators, the following; we simply failed to do so. ( i ( n ( i ( x , x ) ) , y ) » junk). ( i ( y , n ( i ( x , x ) ) ) ■ junk). In approximately 13 CPU-seconds on a SPARCstation 2, OTTER produced a 41-step proof of level 18 upon retention of a clause numbered 1823, and in approximately 353 CPU-seconds (in the same run) produced a 38-step proof of level 15 upon retention of a clause numbered 16228. The experiment had succeeded in one of its goals, that of producing a shorter proof (than previously known) of the theorem under study such that absent are the n(n(t)) terms. This success immediately led to the second experiment, that in which the second and third demodulators were commented out (by placing % in column 1). In other words, we permitted OTTER to retain clauses whether or not they contained as a proper subterm a term of the form i(t, t). In approximately 33 CPU-seconds on a SPARCstation 2, OTTER produced a 41-step proof of level 18 upon retention of a clause numbered 3264, and in approximately 409 CPU-seconds (in the same run) produced a 34-step proof of level 17 upon retention of a clause numbered 18192. A glance at the resulting 34-step proof (which we immediately give) produces a mystery (whose possible answer we give at the end of this subsection), for none of its steps takes ad vantage of the added latitude permitted in the second experiment. In fact, the
Collected Works of Larry Wos
1372
34-step proof contains but one clause that is not present in the 38-step proof found in the cited first experiment. In particular, none of the clauses contains as a proper subterm a term of the form i(t, t). A Nice 34-Step Proof with the Structure-Avoidance Property 1 2 3 4 5 6 17 19 20 22 27 32 33 38
[] -P(i(x,y))| -P(x)|P(y). [] P(i(x,i(y,x))). [] P(i(i(x,y),i(i(y,z),i(x,z)))). [] P(i(i(i(x,y).y),i(i(y,x),x))). [] P(i(i(n(x),n(y)),i(y,x))). [] -P(i(i(i(a,b),i(b,a)),i(b,a)))|$ANS(step_MV5).
[hyper,1,3,3] P(i(i(i(i(x,y),i(z,y)),u),i(i(z,x),u))). [hyper,1,3,2] P(i(i(i(x,y),z),i(y,z))). [hyper.1,3,4] P(i(i(i(i(x,y),y),z),i(i(i(y,x),x),z))). [hyper,1,3,5] P(i(i(i(x,y),z),i(i(n(y),n(x)),z))). [hyper,1,17,17] P(i(i(x,i(y,z)),i(i(u,y),i(x,i(u,z))))). [hyper,1,19,5] P(i(n(x),i(x,y))). [hyper,1,19,4] P(i(x,i(i(x,y),y))). [hyper,1.3.20] P(i(i(i(i(i(x,y),y),z),u), i(i(i(i(y,x),x),z),u))). 51 [hyper,1,3,22] P(i(i(i(i(n(x),n(y)),z),u), i(i(i(y,x),z),u))). 56 [hyper,1,22,4] P(i(i(n(x),n(i(y,x))),i(i(x,y),y))). 71 [hyper,1,27,32] P(i(i(x,y),i(n(y),i(x,z)))). 72 [hyper,1,3,32] P(i(i(i(x,y),z),i(n(x),z))). 75 [hyper,1.27,33] P(i(i(x,i(y,z)),i(y,i(x,z)))). 83 [hyper.1.33.32] P(i(i(i(n(x),i(x.y)),z),z)). 208 [hyper,1,22,75] P(i(i(n(i(x,y)),n(z)),i(x,i(z,y)))). 220 [hyper,1,75,3] P(i(i(x,y),i(i(z,x),i(z,y)))). 227 [hyper,1,27,220] P(i(i(x,i(y,z)),i(i(z,u),i(x,i(y,u))))). 254 [hyper,1,22,83] P(i(i(n(x),n(i(n(y),i(y,z)))),x)). 358 [hyper,1,227,75] P(i(i(i(x,y),z),i(i(x,i(u,y)),i(u,z)))). 360 [hyper,1,227,71] P(i(i(i(x,y),z),i(i(x,u),i(n(u),z)))). 361 [hyper,1,227,56] P(i(i(x,y),i(i(n(z),n(i(x,z))), i(i(z,x),y)))). 495 [hyper,1,360,254] P(i(i(n(x),y),i(n(y),x))). 537 [hyper,1,220,495] P(i(i(x,i(n(y),z)),i(x,i(n(z),y)))). 636 [hyper.1.537,72] P(i(i(i(x,y),z),i(n(z),x))). 648 [hyper,1,220,636] P(i(i(x,i(i(y,z),u)),i(x,i(n(u),y)))). 687 [hyper,1,636.5] P(i(n(i(x,y)),n(y))). 713 [hyper,1,33,687] P(i(i(i(n(i(x,y)),n(y)),z),z)). 728 [hyper,1,20,713] P(i(i(i(n(x),n(i(y,x))),n(i(y,x))),n(x))) 732 [hyper,1,51,728] P(i(i(i(i(x,y),y),n(i(x,y))),n(y))).
The Resonance Strategy
1373
759 [hyper,1,38,732] P ( i ( i ( i ( i ( x , y ) , y ) , n ( i ( y , x ) ) ) , n ( x ) ) ) . 17438 [hyper,1,358,759] P ( i ( i ( i ( i ( x , y ) , y ) , i ( z , n ( i ( y , x ) ) ) ) , i(z,n(x»)). 17709 [hyper,1,648,361] P ( i ( i ( x , y ) , i ( n ( i ( i ( z , x ) , y ) ) , n ( z ) ) ) ) . 17811 [hyper,1,17438,17709] P ( i ( n ( i ( i ( i ( x , y ) , i ( y , x ) ) , x ) ) , n(y))). 18192 [hyper,1,208,17811] P ( i ( i ( i ( x , y ) , i ( y , x ) ) , i ( y , x ) ) ) . Clause (18192) contradicts clause (6), and the proof of MV5 is complete, with length 34 and level 17. The 34-step proof shares in common with the 35-step proof 29 steps. Three of the steps of the 34-step proof fail to match as a resonator any of the resonators corresponding to the steps of the 35-step proof. The 34-step proof shares in common with the 39-step proof 31 steps. Eight of the steps of the 34-step proof fail to match as a resonator any of those that correspond to the steps of the 39-step proof. Three steps of the 34-step proof are not among either the steps of the 35-step proof or the 39-step proof. Two of the steps of the 34-step proof fail to match as a resonator any resonator corresponding to a step in the 35-step proof or in the 39-step proof. Regarding a possible answer to the mystery of why OTTER produced a 34step proof in contrast to the 38-step proof it first found, we first comment on why it is in fact a mystery. First, to complete the 34-step proof, OTTER clearly does not follow the same paths it followed to produce the 38-step proof; otherwise, the program would in fact have found (in the first cited experiment) the given 34-step proof. Since only one change was made between the first and second experiments, the change accounts for following different paths. Second, because the change in the input gives OTTER more latitude, namely, the use of clauses properly containing terms of the form i(t, t), one naturally conjectures that such clauses must play a key role. Third, one might therefore easily conjecture—we certainly did—that such clauses would appear in the 34-step proof, explaining the shortening by four steps of the desired proof in terms of the added latitude. But, such clauses do not appear in the 34-step proof; indeed, the only clause in the 34-step proof that is not in the 38-step proof is the following. P(i(n(i(x,y)),n(y))). Clearly absent from the given clause are i(t, t) terms. Except for n(i(t, t)) terms, the 38-step proof must satisfy the avoidance of i(t, t) terms, for it is obtained with the first experiment, and that experiment prohibits their use. Inspection of the 38-step proof shows that such unwanted terms are absent, a fact that was also verified with an OTTER run that included two appropriately chosen demodulators. The explanation of how OTTER was able to complete a 34-step proof—four steps shorter than the 38-step proof found in the first experiment—apparently rests with the data structures and the indexing of terms. Indeed, although they
1374
Collected Works of Larry Wos
are not used in the desired proof, the retention of clauses properly containing i(t, t) terms changes the contents of the data structure and affects the indexing of terms, which in turn causes the program to traverse different paths (through the search space of conclusions) than it otherwise would.
7.3. The Relevance of Elegance to Applications Two applications are the focus of this subsection, logic circuit design and algorithm synthesis. Here we briefly discuss the relevance to these two applica tions of finding proofs with one or more of the three properties of elegance that have been under discussion. In doing so, we show how the resonance strategy is useful in solving what might be termed practical problems. We begin with proof length. When the problem is one either of circuit design or algorithm synthesis, one can profitably use the ANSWER literal offered by OTTER. In particular, depending on the nature of the proof, if one is found and the argument of the ANSWER literal is suitably prepared, the ANSWER literal will contain as its argument the corresponding circuit that is designed or algorithm that is synthesized. In 3, Chapter 7], we give various examples of using OTTER to design circuits, including the following rather well known two-inverter circuitdesign problem. Using as many AND and OR gates as you like, but using only two NOT gates, can you design a circuit according to the following spec ification? There are three inputs, il, i2, and i3, and three outputs, ol, o2, and o3. The outputs are related to the inputs in the following simple way: ol = not(il) ; o2 = not(i2) ; o3 = not(i3). Often, the shorter the proof, the fewer components in the constructed object. Everything being equal, the fewer the gates a circuit requires, the more attractive is the circuit. A similar remark holds for algorithm synthesis. We note that we have experimented very little with that application. If we now take into account the use of the resonance strategy in successfully seeking shorter proofs, we see how this strategy is relevant to the two applications under discussion. Regarding the second aspect of elegance, term structure, the cited twoinverter problem provides an excellent example. The problem requires using no more than two NOT gates. When OTTER is asked to construct the desired circuit, the corresponding proof that is sought is constrained in that no step is al lowed to contain more than two occurrences of the function not. As for algorithm synthesis, one can easily imagine the case in which one wishes to avoid nested divide instructions. As discussed earlier in this section, the resonance strategy can be put to good use in this context when coupled with demodulators of the type given in Section 7.2. As for the third aspect of elegance cited in this article, that of compactness, its presence in a proof can signal a breakthrough in efficiency either for circuit
The Resonance Strategy
1375
design or for algorithm synthesis. Indeed, imagine that the goal is the design of three circuits and that the assignment is given to OTTER by placing in list(passive) what amounts to the assumption that such is not possible for any of the three. The situation is like that in which the object is to prove each of theses 18, 35, and 49 (the Church axiom system) by using the Lukasiewicz axiom system consisting of LI, L2, and L3. In place of the Lukasiewicz axioms, let us assume that the input includes axioms that give the properties of the components to be used, for example, the properties of various gates. If OTTER is successful in finding the desired three proofs, if the use of the ANSWER literal results in the presentation of each of the sought-after circuits, and if one of the proofs is compact, then the other two proofs are subproofs of the compact proof. Should such occur, one has been presented with three circuits of interest, two of which are subcircuits of the third. One might then be able to take advantage of the given design to save on components and, with suitable actions, to add to the efficiency of the global design. Although we have had virtually no experience with algorithm synthesis, similar observations hold for algorithm synthesis in the context of finding a compact proof. Such a proof can provide one with code for one subroutine that has within it the needed appropriate code for smaller subroutines, reminiscent of what compilers attempt to produce to increase program efficiency. Because the resonance strategy can be used to squeeze steps out of a proof (by using it to seek shorter proofs), this strategy may prove useful when the goal is that of increasing efficiency either for circuit design or for algorithm synthesis.
8. SUMMARY AND CONCLUSIONS In this article, we define the resonance strategy and present evidence of its value, particularly in the context of seeking more elegant proofs. The resonance strategy asks the researcher to choose resonators, formulas and equations whose functional shape (ignoring the particular variable occurrences within them) sug gests they will be useful in directing an automating reasoning program's search for assignment completion. To each resonator, one assigns an integer, called its value or weight, that prioritizes similar expressions: the smaller the integer, the higher the priority for being chosen to direct the reasoning. An expression is similar to a given resonator if and only if the two are identical when the vari ables are ignored, in other words, the two have the same shape or functional skeleton. In one sense, resonators generalize lemmas. For example, where in Boolean groups—those in which the square of every x is the identity element e—the lemmas yzyz = e and yyzz = e are such that neither generalizes the other, the resonator xyzx = e, by treating variables as indistinguishable, generalizes and captures (in a manner that is discussed in this article) both lemmas. Where resonators (which do not take on the value true or false) are used to guide a
Collected Works of Larry Wos
1376
reasoning program's search, lemmas are basic truths from which to reason. One of the more successful uses of the resonance strategy is that of finding shorter proofs; in this article, we give examples from group theory, Robbins algebra, and various logic calculi. From the perspective of science as a whole, the successful search for shorter proofs can result in the discovery of useful lemmas that are fundamental to the field under study. The use of lemmas (or basic truths) not only often is the means for reducing the length of a proof and adding elegance but frequently leads to significant advances such as the design of a more efficient circuit or a more effective algorithm. Therefore, one benefit of using the resonance strategy often is that of finding useful and sometimes powerful lemmas. McCune's automated reasoning program OTTER offers a mechanism, weight ing, that provides the researcher a convenient way to rely on the resonance strategy. However, since the resonance strategy is used to direct a program's search by giving preference to formulas or equations that match at the skele tal level (ignoring variables) some resonator, the strategy can be implemented with a string-comparing algorithm rather than with weighting. With OTTER, one simply places the chosen resonators with the chosen value in the appro priate weightJist, usually in weightJist (pick-and.purge). A judicious choice of resonators can transform a question to be answered from the unreachable to the easy-to-answer. Intuitively, the explanation rests with the fact that the res onance strategy provides a means for escaping from cul-de-sacs, navigating po tentially wide valleys, and crossing high plateaus. By a wide valley, we refer to the case in which one needs the use of a conclusion with, say, 18 symbols in it and one is mired in a huge space of conclusions each consisting of 14 symbols. By a high plateau, we refer to the case in which the proof requires the use of three or more consecutive conclusions each of whose complexity is at least mod erately greater than the vast majority of conclusions being retained. Clearly, the resonance strategy is but one piece for solving the puzzle of proof finding, whether or not the assignment includes the search for short proofs. REFERENCES 1. L. Wos, Automated Reasoning: S3 Basic Research Problems. Prentice-Hall: Englewood Cliffs, NJ, (1987). 2. L. Wos, Automated reasoning answers open questions, Notices of the A MS 5 (1), 15-26 (January 1993). 3. L. Wos, R. Overbeek, E. Lusk, and J. Boyle, Automated Reasoning: In troduction and Applications, 2nd ed., McGraw-Hill, New York, (1992). 4. W. McCune, OTTER 2.0 users guide. Technical Report ANL-90/9, Argonne National Laboratory, Argonne, IL, (1990).
The Resonance Strategy
1377
5. J. Lukasiewicz, Elements of Mathematical Logic. Pergamon Press, Oxford, (1963). 6. D. Scott, Private communication, (1990). 7. L. Wos, Automated reasoning and Bledsoe's dream for the field, In Au tomated Reasoning: Essays in Honor of Woody Bledsoe, (Edited by R.S. Boyer), pp. 297-345, Kluwer Academic Publishers, Dordrecht, (1991). 8. L. Wos, G. Robinson, and D. Carson, Efficiency and completeness of the set of support strategy in theorem proving, J. ACM12, 536-541, (1965). 9. J. McCharen, R. Overbeek, and L. Wos, Complexity and related enhance ments for automated theorem-proving programs, Computers Math. Applic. 2, 1-16 (1976). 10. L. Wos, Unpublished information, Argonne National Laboratory, (1993). U . S . Winker, Robbins algebra: Conditions that make a near-Boolean algebra Boolean, J. Automated Reasoning 6 (4), 465-489 (December 1990). 12. S. Winker, Absorption and idempotency criteria for a problem in nearBoolean algebras, J. Algebra 153 (2), 414-423 (December 1992). 13. W. McCune, Single axioms for groups and Abelian groups with various operations, J. Automated Reasoning 10 (1), 1-13 (January 1993). 14. K. Kunen, Private communication (1993). 15. J. Slaney, J., FINDER: Finite domain enumerator, Version 2.0, Notes and guide. Technical Report, Australian National University, (1992). 16. J. Lukasiewicz, Selected Works, (Edited by L. Borkowski), North-Holland, Amsterdam, (1970). 17. L. Wos and W. McCune, The application of automated reasoning to proof translation and to finding proofs with specified properties: A case study in many-valued sentential calculus, Technical Report ANL-91/19, Argonne National Laboratory, Argonne, IL, (August 1991).
Searching for Circles of P u r e Proofs LARRY WOS* Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL 60439-4844, U.S.A. e-mail: [email protected] (Received: 10 November 1994) Abstract. When given a set of properties or conditions (say, three) that are claimed to be equivalent, the claim can be verified by supplying what we call a circle of proofs. In the case in point, one proves the second property or condition from the first, the third from the second, and the first from the third. If the proof that 1 implies 2 does not rely on 3, then we say that the proof is pure with respect to 3, or simply say the proof is pure. If one can renumber the three properties or conditions in such a way that one can find a circle of three pure proofs— technically, each proof pure with respect to the condition that is neither the hypothesis nor the conclusion—then we say that a circle of pure proofs has been found. Here we study the specific question of the existence of a circle of pure proofs for the thirteen shortest single axioms for equivalential calculus, subject to the requirement that condensed detachment be used as the rule of inference. For an indication of the difficulty of answering the question, we note that a single application of condensed detachment to the (shortest single) axiom known as PA (also known as UM) with itself yields the (shortest single) axiom P5 (also known as XGF), and two applications of condensed detachment beginning with P5 as hypothesis yields PA. Therefore, except for P5, one cannot find a pure proof of any of the twelve shortest single axioms when using PA as hypothesis or axiom, for the first application of condensed detachment must focus on two copies of PA, which results in the deduction of Pb, forcing P5 to be present in all proofs that use PA as the only axiom. Further, the close proximity in the proof sense of PA when using as the only axiom P5 threatens to make impossible the discovery of a circle of pure proofs for the entire set of thirteen shortest single axioms. Perhaps more important than our study of pure proofs, and of a more general nature, we also present the methodology used to answer the cited specific question, a methodology that relies on various strategies and features offered by W. McCune's automated reasoning program OTTERThe strategies and features of OTTER we discuss here offer researchers the needed power to answer deep questions and solve difficult problems. We close this article (in the last two sections) with some challenges and some topics for research and (in the "Author supported by the Office of Scientific Computing, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted from the Journal of Automated Reasoning, Vol. 15, no. 3, 279-315 (December 1995) with kind permission from Kluwer Academic Publishers.
Searching for Circles of Pure Proofs
1379
Appendix) with a sample input file and some proofs for study. Key words: automated reasoning, hot list, pure proofs, strategy,
1
Motivation, Background, and the Specific Problem to Solve
To set the stage for the type of problem central to this article, we note that occasionally in mathematics and in logic researchers are interested in which axioms of a given field are independent and which dependent. For example, among the usual axioms for a group, those of right identity and right inverse are each dependent on the remaining set. Somewhat related, one sometimes wonders whether a chosen lemma (such as the inverse of the inverse of x equals x) is needed for a proof, or whether one can find a proof in which no terms of a specified form occur, such as n(n(t)) for any term t where the function n denotes negation. Given a set of formulas, equations, properties, conditions, or definitions each of which implies all of the others, the general problem in focus here asks whether one can find a sequence of proofs such that the sequence forms a circle and such that each proof is pure with respect to the remaining formulas. DEFINITION 1 (Circle of proofs). For a set of k equivalent elements—formulas, equations, properties, conditions, or definitions—a circle of proofs is a sequence of proofs such that the first proof shows that the first element implies the second, the second proof shows that the second element implies the third, ..., and the A:-th proof shows that the fc-th element implies the first. DEFINITION 2 (Pure proof with respect to a set of elements) For a set of elements—formulas, equations, properties, conditions, or definitions—a proof of element j from element i is pure with respect to the set of elements if and only if it does not rely on the use of any of the elements but the j-th and the t-th. The presence of a proper instance of an element other than the j-th or t-th does not render the proof impure. If such instances are in fact absent, we say the proof is instance pure. Further, if none of the deduced steps contains as a proper subterm an instance of an unwanted element, we say the proof is subterm pure. To remove any ambiguity regarding what we mean by proof in general, we re quire that one or more specific inference rules be used and specified, for example, rules such as paramodulation [9,11] (which generalizes equality substitution) and condensed detachment [1, 2] (which we discuss with examples in Section 1.2). The particular problem of interest here asks whether one can find a circle of thirteen pure proofs, relying solely on condensed detachment, given the thirteen
Collected Works of Larry Wos
1380
(equivalent) shortest single axioms for equivalenticU calculus [1,6] (defined and briefly discussed in Section 1.2). In other words, regarding the circle property, can one order the thirteen shortest single axioms in such a way that one can find thirteen proofs, the first proof deducing (with condensed detachment) the second axiom from the first, ..., the thirteenth deducing the first axiom from the thirteenth? Regarding purity, the first proof must not rely on the use of the axioms numbered 3 through 13, ..., and the thirteenth must not rely on the use of the axioms numbered 2 through 12. Prom the viewpoint of a directed graph—where the vertices correspond, re spectively, to the thirteen axioms—one is asked to find a circuit, an arrangement of the vertices that is a cycle, visiting each of the vertices exactly once except that the cycle begins and ends at the same vertex. Regarding the graph, an edge from vertex i to vertex j exists only if there exists a pure proof of axiom j from axiom i. For a simple example that is closely related in the context of purity, imagine being asked to prove some theorem in group theory without proving and using the lemma that the inverse of the inverse of x equals x, or without using the axiom of, say, right identity. To complete the stage setting for presenting our attack on the specific prob lem and for introducing the methodology that may prove of use in totally un related areas, we provide (in Section 1.1) a bit of history and (in Section 1.2) a brief treatment of equivalential calculus. In part to complement the material of this article, we offer in Sections 5 and 6 some challenges and some topics for research, and, to stimulate such research, we provide (in the Appendix) a sample input file and some proofs for study. 1.1
GENESIS
Two factors led us to the study of the question of whether there exists a circle of pure proofs for the thirteen shortest single axioms for equivalential calculus. Perhaps most important, in the late 1970s, we were introduced to this area of logic by the logician J. Kalman, to whom we extend our thanks. That introduc tion (as various of our papers show) has led us to visit and revisit this area in various contexts, including seeking shorter proofs, testing new strategies, and developing methodology. Also playing a role in our interest in the specific problem, in the mid-1960s (if we can trust our memory), we were told a small amount about Moufang loops. We were told that any one of three equations played the key role, and were told that the three are equivalent. We were told that the proof of the equivalence of the three identities was, in the following sense, flawed. Proofs existed that 1 implies 2, that 2 implies 3 and—rather than the preferred pure proof that 3 implies 1—the existing proof was two-stage, 3 implies 2, then 2 implies 1. In other words, in the obvious sense, four proofs were required, rather than three. Finally, we were told that every ordering of the three identities and corresponding proofs suffered a similar aesthetic flaw. Regarding the concern of
Searching for Circles of Pure Proofs
1381
this article, in effect we were told of a circle of proofs for the three Moufang identities—1 implies 2, 2 implies 3, and 3 implies 1—but the proofs are not pure. The lack of purity rests with the fact that the proof of 3 implies 1 relies on the use of the second identity, 2. With the given ordering of proofs—1, 2, 3, 1— purity requires the replacement of the proof of 3 implies 1, passing through the second identity, by a proof that 3 implies 1 without use of 2. As an alternative, to produce a pure circle of proofs requires a reordering of the three identities and corresponding proofs, each of which (three) does not rely on the intermediate use of the so-called third property. 1.2
EQUIVALENTIAL CALCULUS IN BRIEF
Rather than a study of Moufang loops, the focus here, as noted, is on equivalen tial calculus. The elements to be studied are formulas that one can produce with the two-place function e (for equivalent) and the variables x, y, z, ... . Among such formulas, we have 1. e(x,x), 2. e(e(x,y),e(y,x)), 3. e(e(x,y),e(e(y,z),e(x,z))). It is no coincidence that we selected these three formulas; they were chosen because they will remind one, respectively, of reflexivity, symmetry, and tran sitivity, properties naturally associated with "equivalence". In fact, these three formulas taken together provide an axiomatization for equivalential calculus. Not so obvious, and unlike equivalence in general, the formula (1) (that we identify with reflexivity) is provable from (2) and (3) [10]. In place of (1), (2), and (3) as an axiomatization, the calculus is often studied in terms of one of thirteen formulas, each of which serves as an axiom system. Following are provably all of the shortest single axioms for equivalential cal culus. Each is expressed as a clause [9, 11] in notation acceptable to OTTER [5], where the predicate P can be interpreted as "provable" and the function e as "equivalent"; OTTER is offered on diskette in [11]. (The numbering of the following is indeed strange, but we have repeated it as we were introduced to the notation; P6, if memory serves, was once thought to be a shortest single axiom.) When a line contains a "%", the characters from the first "%" to the end of the line are treated by the program as a comment. P(e(e(x.y),e(e(z,y),e(x,z)))). P(e(a(x,y),e(e(x.z).e(z,y)»). P(e(e(x,y),e(e(z,x),e(y,z)))). P(e(e(e(x,y),z),e(y,e(z,x)))). P(e(x,e(e(y,e(x,z)),e(z,y)))). P(e(e(x,e(y,z)),e(z,e(x,y)))).
7. 7. 7. 7. 7. 7.
Pl.YQL P2_YQF P3.YQJ P4.UM P5.XGF P7_WN
Collected Works of Larry Wos
1382 P(e(e(x,y),e(z,e(e(y,z),x)))). P(e(e(x,y),e(z,e(e(z,y),x)))). P(e(e(e(x,e(y,z)>,z),e(y,x))). P(e(e(e(x,e(y,z)),y),e(z,x))). P(e(x,e(e(y,e(z,x)),e(z,y)))). P(e(x,e(e(y,z),e(e(x,z),y)))). P(e(x,e(e(y,z),e(e(z,x),y)))).
'/. */, '/. '/. '/. '/. 7.
P8.YRM P9.YR0 PYO PYM XGK XHK XHN
The inference rule that is often used is condensed detachment. For this area of logic, condensed detachment considers two formulas, e(A, B) and C— respectively called the major and the minor premiss—and, if C unifies with A, yields the formula D, where D is obtained by applying to B the most general unifier of C and A. (For the curious, and consistent with earlier publications, the word "premiss" is spelled as Church recommends.) Unification [9, 11] is a procedure that considers two expressions and seeks to find the most general substitution of terms for variables that makes the two identical. Unification is the basis of many of the procedures applied by O T T E R and, more generally, is relied upon in automated reasoning. Just for illustration, if one applies condensed detachment to e(x,e(x,e(y,y))) and e(z,z) with the second formula playing the role of (the minor premiss) C, one obtains e(e(z,z),e(y,y)). If one reverses the roles of the two formulas and applies condensed detachment, one obtains a copy of the first formula. To gain a fuller appreciation of the intricacy of using condensed detachment—ignoring the possible truth of the following expression (F)—one might by hand attempt to produce the conclusion obtainable from applying the inference rule to two copies of (F) e(e(e(e(x,e(y,z)),e(y,x)),e(z,u)),u). The conclusion one obtains with condensed detachment applied to two copies of the preceding formula is e(x, x). To capture condensed detachment, we use hyperresolution [9,11] and the following clause, where lines beginning with "%" are treated as comments, where "-" denotes logical not, and where " | " denotes logical or. V, a clause for condensed detachment -P(e(x,y)) | -P(x) I P(y).
From the fact that any of the given thirteen shortest single axioms serves as a complete axiom system by itself, one sees that any can be used to deduce each of the other twelve. For example, to prove P 5 from PA requires a single application of condensed detachment, applied to two copies of PA. Therefore, any proof of, say, XHN from PA using condensed detachment must contain as its first deduced step Ph. Regarding purity of proof, if one selects PA as
Searching for Circles of Pure Proofs
1383
the hypothesis with the goal of proving one of the other twelve shortest single axioms, only one proof is possible, that of Ph. Put another way, with PA as the axiom and condensed detachment as the inference rule, all proofs of the other shortest single axioms (except that of Ph) are not free of Ph and are, therefore, not pure. 1.3
OBJECTIVES
The following two questions are central to this article. First, from the viewpoint of mathematics and logic, does there exist an ordering of the thirteen shortest single axioms of equivalential calculus such that one can find a circle of pure proofs for that ordering? Second, from the viewpoint of automated reasoning, what strategy or strategies can be used together with other mechanisms to enable a program such as O T T E R to bear the brunt of the research? Rather than giving a terse answer to either question, we shall detail our study with the additional objective of showing those unfamiliar with O T T E R how it can be used as a research assistant. We suspect that even those with some experience with this program will find various techniques we present useful for quite unrelated research.
2
Attacking the Specific Problem
For those researchers who prefer a somewhat brisk treatment that focuses on the highlights rather than on the detailed development, we close (in Section 2.6) this section with a review. That review will also serve for those researchers who, after reading the details, wish access to a summary. 2.1
BEGINNING THE ATTACK
If the objective of the attack (namely, an appropriate ordering) does exist, from the preceding remarks, PA must immediately precede Ph. With the knowledge that at least this constraint must be observed, the first move was to determine whether other constraints of the type existed. We took each of the thirteen formulas (shortest single axioms) A (given in Section 1.2) and, with the following command, instructed OTTER to (in effect) apply condensed detachment to A with itself and immediately cease drawing conclusions. assign(max.given,1). To verify the soundness of this aspect of the methodology, we began with
PA, placing the negations (or denials) of all thirteen shortest single axioms in list(passive) [5]. The clauses in list(passive) are used only for forward subsumption and for unit conflict, the latter being the most common test for establishing that a proof by contradiction has been completed. Clauses in that list are not
1384
Collected Works of Larry Wos
subject to demodulation [9, 11], and they are not used to draw conclusions (of course, other than the empty clause). If all is in order, P5 will be deduced, and it was, as confirmed by the corresponding proof by contradiction. When the cited methodology was applied to each of the other twelve shortest single axioms, no proofs were returned. In other words, no other constraints of the type under discussion exist, at least if one restricts the search to the first level. With the knowledge that, other than the required PA-P5 immediate juxta position (in that order), any other immediate juxtaposition was not yet ruled out, we set about to find out which (shortest single) axioms could be used by O T T E R to deduce which axioms. We say "used by OTTER" because the theo retical deducibility of one axiom from another sheds no light on the practical deducibility by an automated reasoning program—or, for that matter, by a re searcher unaided. Indeed, for two examples of the depth and difficulty offered by the study of the thirteen (shortest single axiom) formulas, we note that the questions of whether XHK and XHN are each strong enough to provide a complete axiomatization were open until the early 1980s. S. Winker settled each question in the affirmative [7, 8]. Put another way, if one chooses either XHK or XHN and attempts to deduce one of the other twelve shortest single axioms—without excellent choices regarding strategy [10]—one encounters a tough problem, for a person or for a program. The formula XGK presents similar problems. (Kalman [1] proved this formula to be a single axiom.) Being aware of the toughness presented by these three (axiom) formulas and being aware that P5 leads to a deduction of PA in but two applications of condensed detachment—implying that, if an escape route to completing a circle of pure proofs happens to exist, it is indeed narrow—we expected that a variety of strategies would be needed to obtain deductions of various formulas from each of the twelve (including P5 and, of course, excluding PA). From earlier studies in the context of seeking shorter and less complex proofs [10], we had a proof that completes with the deduction of PA starting with XHN, and that study yielded the deduction of none of the other eleven shortest single axioms. Therefore, the obvious move was to place XHN immediately before PA in our search for a circle of pure proofs. (We again note that the definition of pure says nothing about proper instances of the disallowed items.) In contrast to the ease of extending the partial circle in what might be called the direction left—XHN, PA, P5—adding on the right presented a problem, for our first attempt to deduce shortest single axioms from P5 yielded PA and XHN, and no others. Further, the proof of XHN (that was obtained) is not even pure, for it relies on the deduction of PA. Obviously, the insertion to the right of Pf> of either PA or XHN was out, and, almost as obvious, purity of a proof of a fourth axiom to be placed to the right of P5 was presenting a problem. In particular, PA and XHN might be an intermediate step in all proofs starting with P 5 as the only axiom, thus preventing one from ever producing a circle of pure proofs.
Searching for Circles of Pure Proofs
1385
Closer examination of the run that deduces both PA and XHN from P5 shows how narrow is the escape route, if one plans to escape to a pure proof by avoiding the deduction of either, but especially of PA. In particular, the condensed detachment of P5 with itself yields a clause numbered (18), and the condensed detachment of (18) as major premiss (unified with the first literal of the clause for condensed detachment) with P5 as the minor premiss yields PA. Two possible escape routes are left if the corresponding application of condensed detachment succeeds rather than being blocked because of unification failure: P5 can be used as the major premiss and (18) as the minor, and (18) can be used as both the major and minor premisses. A further check of the run shows that both applications of condensed detachment succeed. Again one sees how the use of an automated reasoning program facilitates research, even at the more mundane level of ascertaining the results of specific applications of condensed detachment. We therefore made two changes in our search for shortest single axioms deducible from P5. First, to give more latitude to the program, we increased the max.weight (permissible complexity of retained formulas) from 28 to 40. Second, because of our interest in pure proofs, with the inclusion of the following weight template (whose contained formula is in fact PA) in weight Jist(purge.gen), we blocked the retention of the clause corresponding to PA. weight(P(e(e(e(x,y),z),e(y,e(z,x)))),200). (A clause technically has two weights: its pick-given weight, which is used in the context of choosing clauses as the focus of attention to drive the program's reasoning, and its purge_gen weight, which is used in the context of clause dis carding; often the two weights are the same. The weight of a clause is computed solely in terms of symbol count if no included weight template applies.) The inclusion of the cited weight template is not without risk, for other formulas that match it, ignoring variables (which is the way the weighting strategy [3, 9, 11] works), will also be purged because of our chosen max-weight, namely, 40. (In Section 2.5, we give a means that relies on demodulation for having one's cake and eating it too, for purging an unwanted formula but not purging its relatives.) Regarding the options, with the intention of decreasing the required CPU time, we used the hot list strategy [12] with the heat parameter assigned to 1 and with P5 and the clause for condensed detachment in the hot list. (Briefly, the hot list strategy enables the researcher to include in the hot list clauses that are conjectured to merit repeated and immediate visiting to complete the application of an inference rule rather than initiate it, when the program has decided to retain a new clause.) We used a level saturation approach [11], which instructs OTTER to drive its reasoning by focusing on the clauses in the order they are retained, first come first serve (breadth first). Because of the fecundity that would almost certainly occur with max.weight assigned to 40, after 50 clauses were chosen as the focus of attention to drive OTTER'S reasoning, we
Collected Works of Larry Wos
1386
reduced the max_weight to 24. The following two commands were, therefore, included. assign(change_limit_after, 50). assign(new.max.weight, 24). We included the following two commands (which instruct OTTER to search for ever shorter proofs of each deduced conclusion) with the notion (perhaps, but not for certain) that shorter proofs might be correlated to pure proofs. set(ancestor_subsume). set(back_sub). Ancestor subsumption enables a program to compare two derivation paths to the same conclusion and prefer the copy of the conclusion that is reached by the strictly shorter path. Ancestor subsumption, from a practical standpoint, requires the use of back subsumption to avoid retaining two copies of the same clause. O T T E R first deduced XHN, with a proof of length 27 and level 12 (in contrast to length 15 and level 8 when the program was allowed to retain the clause equivalent of PA) and then deduced XHN again, with a proof of length 24 and level 13. (With one exception, the length of a proof in this article, as given by OTTER, is the number of applications of condensed detachment. The exception occurs when the dynamic hot list strategy [12] is in use, for two copies of a deduced clause may appear, one from the modified hot list, and one from the usable list. In particular, when a clause is added to the hot list during the run, that clause is a copy, but with a different number, of the clause that is then added to list(sos). When duplicate steps occur in a proof, the cause rests with the use of a clause and also of its copy from the hot list. Note that the notation heat=n concerns the history of the clause, and says nothing about how the clause is used.) (The level of input clauses is 0; the level of a deduced clause is one greater than the maximum of the levels of its parents.) Then, in approximately 350 CPU-seconds (on a SPARCstation-10) with retention of clause (10266), OTTER deduced PYM. The proof has length 32 and level 14. Far more important for our purposes, the proof of PYM from P5 is pure. We were thus able to insert PYM to the right, obtaining for our partial circle (that might not be completable) the sequence XHN, P4, P5, PYM. 2.2
O U R ORIGINAL APPROACH
While we were gathering the evidence just presented, at the same time we also ran various experiments, each designed to see which axioms were deducible by O T T E R from each of the remaining axioms taken one at a time. To gather our data, we used a level saturation approach, assigned a max_weight (on the complexity of retained conclusions) of 28, reassigned it to 24 after 50 clauses had been chosen as the focus of attention (to drive or direct the program's reasoning),
Searching for Circles of Pure Proofs
1387
used ancestor subsumption [5, 11] (instructing OTTER to seek ever and ever shorter proofs of each deduced conclusion) coupled with back subsumption, and used the hot list strategy to promote ease of proof completion. (When the hot list strategy is combined with level saturation, it enables the program to, so to speak, look ahead, drawing conclusions that have a level greater than those being drawn without its use.) For the hot list strategy, we assigned the heat parameter to 1 and placed in the hot list only the clause for condensed detachment and the clause corresponding to the shortest single axiom under consideration. We shall refer to this as our original approach. Motivated by the structure of the partially completed circle of pure proofs, from the ensemble of experiments, we immediately reviewed the experiment using PYM as the only axiom. The only difference between this experiment and the experiment focusing on P5 that deduced PA and XHN and no other axioms was the axiom in use. Indeed, consistent with our approach, PYM was the only member in the initial set of support, and it and the clause for condensed detachment were the only members in the hot list. OTTER completed proofs of P5, XGK, XHK, XHK (a second time), and PA. Except for the first of the two proofs of XHK, all proofs are pure. Immediately we see the value of relying on ancestor subsumption, for its use enabled the program to find a pure proof of XHK, the second proof of that formula. At this point, one might immediately wish for some insight regarding the (possible) increase in effectiveness that results from using the hot list strategy and ancestor subsumption, when the goal is finding a pure proof. Because the hot list strategy enables a program to use a newly retained clause immediately to draw conclusions rather than waiting for it to be chosen based on its weight, the resulting perturbation of the search space can sharply promote proof completion. That such is the case can be seen by considering the situation in which the clause needed to draw a vital conclusion has a weight that prevents its choice (to drive the reasoning) for many CPU-minutes, or for forever. Therefore, at least indirectly, the use of the hot list strategy can be significant in finding pure proofs. As for ancestor subsumption, its use often leads to the completion of shorter proofs. Shorter proofs leave less room for the presence of unwanted formulas. Hence, the use of ancestor subsumption can aid a program in finding pure proofs. The inclusion of back subsumption, necessitated from a practical standpoint when ancestor subsumption is used, does not interfere with the hot list strategy, for members of the hot list are not subject to back subsumption or, for that matter, to back demodulation. The structure of the partially completed circle of pure proofs made the de duction of both F5 and PA worthless for extending it to the left or to the right. The choice between inserting (at the right) XGK and XHK was easy to make. First, the experiment with XGK as the only axiom produced one proof, that of PYO. (Because each of the thirteen single axioms has its negation in the input available to complete a proof, the first proof found in a run must be pure, for if otherwise, the unwanted formula used as a deduced clause would have had
1388
Collected Works of Larry Wos
its proof completed first.) Second, earlier studies of XHK as the only axiom in the pursuit of short proofs had produced various proofs of P I , P2, P7, P8, and P9; that of P2 is not pure—discovered only after this article was essentially complete—but the other proofs are. Clearly, the most appealing path to follow was to insert (on the right) XGK, and then immediately insert (on its right) PYO to yield the sequence XHN, P4, P5, PYM, XGK, PYO (as a longer, partially completed circle of pure proofs). Examination of other experiments immediately enabled us to find a shortest single axiom to insert on the left of our partially completed circle. Specifically, the search for a deduction of XHN revealed its proof from P8. Since, in that run, XHN was the first axiom deduced, the proof was guaranteed to be pure, for (as noted) list(passive) was provided with the negation of each of the thirteen shortest single axioms. We, therefore, inserted (on the left) P8. Next, a glance at the run using P I as an axiom showed how fecund it indeed is; its use led OTTER to completing twenty proofs (including duplicates), and all of the other twelve shortest single axioms were deduced. All twenty proofs are pure, the explanation of which we leave to future research. The sixteenth and the twentieth are of P8. We immediately inserted (on the left of P8) P I . (Actually, one might have expected us to postpone the decision of where to place P I , in view of the fact that its use leads to the deduction of each of the other twelve shortest single axioms; we simply did not make this choice, for reason or reasons we cannot give.) We then inserted P2 immediately to the left of P I , for the deduction of P I from P 2 is the first proof (of thirteen) completed when using P 2 as the only axiom. The proof is, therefore, pure. With almost the same justification, we next inserted (on the left of P2) P3. The deduction of P2 from P 3 was the fifth proof completed, and we (as so often) used some Unix commands to check that the proof is indeed pure. We were nearing success—so we thought—for we now had the sequence P3, P2, P I , P8, XHN, PA, P5, PYM, XGK, PYO (as a longer, partially completed circle of pure proofs). 2.3
MODIFYING O U R ORIGINAL APPROACH
Because none of the experiments conducted so far produced a proof that com pleted with the deduction of P3, except from formulas such as P I and P2 (which we did not wish to displace from their current position in the partial circle), we decided to modify our study of the formula PYO. Modification of the options was required, for an assignment of 28 and of 32 to max.weight resulted in O T TER'S running out of conclusions to draw (with the message sos empty) before any proofs were completed. Raising the max.weight to 36 produced a proof of XGK and none other, which, as explained in the preceding section, forces the proof to be pure; that proof was of no use given the partial circle. Raising the max.weight to 40 produced the same result. Therefore, we replaced a level saturation approach (for choosing the clauses
Searching for Circles of Pure Proofs
1389
on which to focus to drive the program's reasoning) with the ratio strategy (formulated by McCune) [11], with the pick_given_ratio assigned to 4. With this change, OTTER was instructed to choose (for the focus of attention) four clauses by weight (symbol complexity, in this case), one by first come first serve (or breadth first), then four, then one, and the like. Our motive was to sharply perturb the space of possible conclusions to be deduced. We replaced weightJist(purge-gen) by weightJist(pick_and_purge) and included as its sole member the clause equivalent of the formula XGK with an assigned weight of 200, strictly greater than the chosen max.weight of 36 to which we returned. In other words, similar to the actions discussed earlier (in Section 2.1) in the con text of the formula P5, we prevented the program from retaining (if deduced) the clause equivalent of XGK, risking the loss of like formulas that differ only in terms of which variables are present. We took this action in deference to our goal of finding a pure proof of a shortest single axiom not yet a member of our partially completed circle. To perturb the search space further, we dropped the use of ancestor subsumption and back subsumption and instructed O T T E R to change the max.weight to 24 after 70 clauses were chosen as the focus of attention, rather than after 50 were chosen. In contrast to the sparsity of completed proofs before we made the cited changes, the program completed ten proofs, in order P4, P7, F9, P8, PYM, P3, XHK, XHN, PI, and P2. Two of the proofs, that of P8 and XHN, are impure; each relies on the deduction of P4. The last of the ten proofs was completed in approximately 6700 CPU-seconds (on a SPARCstation-10), with retention of clause (111681). A glance at the partially completed circle shows that three of the eight pure proofs are of interest, those of PI, P9, and XHK. (We rejected the proof of P3 for, although a circle would indeed be completed, its acceptance would leave no room for the as-yet unused axioms.) The choice from among the three proofs of interest was easy to make. First, our experiment with P9 as the only axiom had deduced XHK and no other shortest single axiom. Second, in our earlier study of XHK, we had found a pure proof of PI, in approximately 78,273 CPU-seconds (on the equivalent of a SPARCstation-2), with retention of clause (98393); the proof has length 39 and level 25. (A SPARCstation-2 is roughly half as fast as a SPARCstation-10.) Therefore, we chose P9, inserting it on the right of our partially completed circle, which immediately allowed us to then insert to its right XHK followed by P7. We thus were near our goal of a complete circle of pure proofs, for we had the sequence P3, P2, P I , P8, XHN, P4, P5, PYM, XGK, PYO, P9, XHK, PI. Indeed, with a pure proof of P3 from P7—if one existed—we would have answered the question (central to this article) in the affirmative.
Collected Works of Larry Wos
1390
2.4
PURSUING AN ALTERNATE GOAL
But the desired proof to complete the (first) circle provided substantial resis tance, so much so that we decided to attempt to complete a second circle of pure proofs. Because we had thought we had a pure proof of P2 using XHK as the only axiom, obtained in approximately 51,359 CPU-seconds on the equivalent of a SPARCstation-2 with retention of clause (77799), perhaps we could find pure proofs to enable us to move both P 3 and P7. After this article was essentially completed, we discovered that the cited proof is not pure, for it relies on P9 as an intermediate step; on August 12, 1994, we found the needed proof, of length 76 and level 37, in approximately 767 CPU-seconds on a SPARCstation-10, with retention of clause (22558). In other words, our plan was to seek appropriate pure proofs so that P3 is not, so to speak, to the left of P2 and so that PI is not, so to speak, to the right of XHK (of course meaning before the circle is closed). By revisiting our original set of experiments designed to see which axiom could be used by O T T E R to deduce which axioms, a place for P3 was suggested by finding a pure proof (using it as the only axiom) of XHK. What was therefore needed was a pure proof of P 3 using P9 as the only axiom. A search of the early experiment with P9 as the only axiom revealed no proof, pure or impure, of P 3 . Noting that the original experiment completed three proofs of XHK and none for any other shortest single axiom, similar to what we had done earlier in our focus on P5, we blocked the program from retaining the clause equivalent of XHK—at least, that was our intention. However, closer inspection of the input file reveals that, by mistake, we included in weightJist(purge-gen) a weight template corresponding to the formula XHN. The experiment was saved by the fact that XHK and XHN have the same shape, if the variables are ignored (treated as indistinguishable), which is how weight templates work in OTTER, fortunately. We increased the max_weight to 36 (to give O T T E R more room in which to work) and made no other changes, still directing the search with level saturation. The program completed the desired pure proof of P3 in approximately 1862 CPU-seconds (on a SPARCstation-10), with retention of clause (36379). As for where to insert P7, we remarked earlier that from P I O T T E R deduces all of the other twelve shortest single axioms. The proof of P7 is pure. All that remained was to produce a pure proof from P7 of P8, and we would have the desired (second) circle of pure proofs, with the first circle still in doubt. A glance at the original experiment using P7 as the only axiom revealed that, if we were to succeed, some modification was required. For reason or reasons we cannot recall, we made but one change: We added the use of the dynamic hot list strategy, assigning 8 to the dynamicJieat.weight. With this addition, we instructed O T T E R to adjoin to the hot list during the run any clause whose weight is less than or equal to 8; in this run, weight was determined solely in terms of symbol count. (Credit for extending the hot list strategy by formulating
Searching for Circles of Pure Proofs
1391
the dynamic hot list strategy belongs to W. McCune.) This small, but obviously significant, change was just what was needed. The program produced the desired deduction of P8, and we had answered the question of interest in the affirmative. • Second Circle of P u r e Proofs: With the invaluable assistance of O T TER, we found a (second) circle of pure proofs with the following ordering of the thriteen shortest single axioms: P2, P I , PI, P8, XHN, P4, P5, PYM, XGK, PYO, P9, P3, XHK, P2. 2.5
RETURNING TO THE PURSUIT OF THE FIRST CIRCLE OF P U R E PROOFS
Inspired by the cited success, we conjectured that added effort might in fact enable us to complete the first circle, which (as noted) completes if one can find a pure proof from PI of P3. Recognizing the possible difficulty (or, perhaps, impossibility) of the task, we began two almost simultaneous attacks, the first on the equivalent of a SPARCstation-2, and the second on a SPARCstation-10. In both attacks, because we wished to avoid all shortest single axioms but one—in contrast to blocking one particular axiom—we used demodulation (rather than weighting) in a significant way that we shall discuss shortly. (We thus fulfill our earlier promise made in Section 2.1 of giving a means that relies on demodulation for having one's cake and eating it too, for purging an unwanted formula but not purging its relatives.) In the first attack, we assigned the max_weight to 48, reassigned it to 24 after 70 clauses were chosen as the focus of attention to drive the reasoning, assigned the pick.given_ratio to 4 (in place of level saturation), and dropped the use of ancestor subsumption and back subsumption. In the second and almost simultaneous attack, we assigned the max.weight to 32, reassigned it to 24 after 50 clauses were chosen as the focus of attention, used level saturation, and otherwise proceeded as in the first attempt. For a different comparison, we merely modified our original treatment of PI as the only axiom by assigning the max.weight to 32 rather than to 28, dropped the use of ancestor subsumption and back subsumption, and used demodulation. Regarding the use of demodulation, with the following technique (thanks to McCune), we instructed OTTER to block all proofs of shortest single axioms other than that of P3; of course, we did nothing to interfere with P7 itself. Put another way, of the thirteen shortest single axioms, we used demodulation to block the use of all but P7 and P3. make_evaluable(_fe_, $AND(_,_)). list(demodulators). ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( e ( x , y ) , e ( e ( z . y ) , e ( x , z ) ) ) ) - $T. ($VAR(x) ft $VAR(y) ft $VAR(z)) ->
*/. P1JTQL
Collected Works of Larry Wos
1392 P(e(e(x,y),e(e(x,z),e(z,y)))) */. ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P(e(e(x,y),e(e(z,x),e(y,z)))) ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P(e(e(e(x,y),z),e(y,e(z,x)))) ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P(e(x,e(e(y,e(x,z)),e(z,y)))) 7. ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P(e(e(x,e(y.z)),e(z,e(x,y)))) ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P(e(e(x,y),e(z,e(e(y,z),x)))) = ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P(e(e(x,y),a(z,e(e(z,y),x)))) ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P(e(e(e(x,e(y,z)),z),e(y,x))) ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P(e(e(e(x,e(y,z)),y),e(z,x))) ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P(e(x,e(e(y,e(z,x)),e(z,y)))) ($VAR<x) ft $VAR(y) ft $VAR(z)) -> P(e(x,e(e(y,z),e(e(x,z),y)))) ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P(e(x,e(e(y,z),e(e(z,x),y)))) » end_of_list.
$T.
7. P2_YqF
$T.
7. P3_YQJ
$T.
7. P4.UM
$T.
7. P5.XGF
$T.
7. P7_WN
$T.
7. P8.YRM
$T.
7. P9.YR0
$T.
7. PYO
$T.
7. PYM
$T.
7. XGK
$T.
7. XHK
$T.
7. XHN
Although the second attack began later than the first, it finished earlier, no doubt due in part to the almost double speed of a SPARCstation-10 over a SPARCstation-2. The first attack proved successful, yielding a deduction of P3 in approx imately 15,000 CPU-seconds, with retention of clause (176938); the proof is pure, which required no examination, for no other proof was completed because of our use of demodulation; it has length 28 and level 14. The second attack also proved successful, yielding a deduction of P3 in approximately 3320 CPUseconds, with retention of clause (51777); the proof is pure, which required no examination, for no other proof was completed because of our use of demodula tion; it has length 18 and level 9. In other words, the first circle does complete.
• First Circle of P u r e Proofs: With the invaluable assistance of O T T E R we found a (first) circle of pure proofs with the following ordering of the thirteen shortest single axioms: P3, P2, P I , P8, XHN, P4, P5, PYM, XGK, PYO, P9, XHK, P7, P3.
Searching for Circles of Pure Proofs
2.6
1393
REVIEW OF THE ATTACK ON THE SEARCH FOR PURE PROOFS
Here we provide a somewhat brisk review of our attack on the following question: Does there exist a circle of pure proofs for the thirteen shortest single axioms (given in Section 1.2) for equivalential calculus? For a circle of proofs to exist, one must find an ordering Al through A13 of the axioms and a set of proofs such that the first proof deduces A2 from Al, the second deduces A3 from A2, ..., and the thirteenth deduces Al from A13. For each of the thirteen proofs to be pure, each must rely on its hypothesis (shortest single) axiom and its conclusion (shortest single) axiom and on none of the other eleven (shortest single) axioms. The attack relies on a wide variety of strategies offered by McCune's auto mated reasoning program OTTER. The strategies include the hot list strategy, the dynamic hot list strategy, the ratio strategy, and level saturation. In addi tion to their role in this study, we touch on them in this section for researchers who may wish to apply them elsewhere. In the context of equivalential calculus, we require the use of the inference rule condensed detachment (of Section 1.2) for deducing the steps of each proof. To show that no circle of pure proofs exists (thus answering the question under attack in the negative), one must prove that (in effect) all possible paths to such an arrangement are blocked. For example, because a single application of condensed detachment to two copies of the formula PA yields the formula P5, PA must immediately precede P5. If a single application of condensed detachment to two copies of P5 yields PA, then no circle of pure proofs exists. On the other hand, to prove that a circle of pure proofs does exist (thus answering the question under attack in the affirmative), one must find an ordering of the thirteen shortest single axioms and a corresponding set of pure proofs. Of course, as observed, one of the proofs must deduce P5 from PA; any such proof will be pure, and all proofs of any of the other eleven shortest single axioms with PA as hypothesis will not be pure. The first phase of our attack had the objective of determining whether other PA-P5 constraints existed. For each of the thirteen shortest single axioms, we instructed OTTER to apply condensed detachment to two copies of it and cease. For this purpose, we used the following command. assign(max.given,1). For condensed detachment (in our entire study), we used hyperresolution and the following clause, where "-" denotes logical not, " | " denotes logical or, and the predicate P can be interpreted as "provable" and the function e as "equivalent". - P ( e ( x , y ) ) I -POO I P(y). We learned that no additional constraints of the type under discussion exist. In the next phase, we instructed O T T E R to take each of the thirteen axioms and deduce as many of the remaining axioms as reasonably possible with what
1394
Collected Works of Larry Wos
we call our original approach (Section 2.2). Featured in the original approach was the use of level saturation (first come first serve or breadth first) to direct the search for conclusions. To give the program enough room to operate in regard to the weight or complexity of retained conclusions (measured solely in terms of symbol count) and yet avoid drowning the program, we included the following commands. assign(max_weight,28). assign(change_limit_after, 50). assign(nev_max_veight, 24). With the perhaps naive notion that the fewer deduced steps in a proof, the greater the likelihood that the proof would be pure, we included the following two commands, the first designed specifically to cause the program to seek shorter proofs of each deduced conclusion. set(ancestor_subsume). set(back.sub). The second of the two commands just given is, from a practical standpoint, required when including the first. (The default in OTTER is "back subsumption is set".) To instruct O T T E R to seek as many proofs as the assigned CPU time and memory permit, we included the following command. assign(max.proofs, - 1 ) . Finally, because of earlier experiments in other contexts, we included one addi tional command (which will merit some explanation) to increase the reasoning power of the program, the following. assign(heat.l). (The default value for this parameter is 1; the hot list strategy is automatically invoked by including one or more members in the hot list.) The preceding command, or a similar command with a value greater than 1, is included when the researcher instructs the program to use the hot list strategy. This strategy enables one to include in a hot list clauses that are conjectured to merit repeated immediate visiting and, when the value is greater than 1, even immediate revisiting. Such clauses are used to complete the application of an inference rule, and not to initiate the application. Regarding the phrase "immediate visiting", when O T T E R decides to retain a conclusion (in the form of a clause), before another clause is chosen from list(sos) to be the focus of attention, the new clause is considered with the appropriate number of members of the hot list in the attempt to draw additional conclusions. Use of the hot list strategy almost invariably dramatically rearranges the order in which clauses are deduced. If one wishes to add to the hot list during the run, then one includes a command of the following type to instruct the program to also rely on the dynamic hot list strategy (due to McCune).
Searching for Circles of Pure Proofs
1395
assign(dynamic_heat.weight, 8 ) . With the command as given, O T T E R will adjoin to the hot list each clause it decides to retain if the clause has weight less than or equal to 8, technically its pick_given weight, which is its weight in the context of being chosen as the focus of attention; its purge_gen weight is its weight in the context of being discarded. Very often the two weights of a clause are identical. Regarding the choice of members for the (initial) hot list, typically (in this study) we included the shortest single axiom under consideration and the clause for condensed de tachment, in the following manner. list(hot). 'I, Following clause is for condensed detachment. -P(e(x,y)) | -P(x) I P(y). '/, Following is hypothesis, P5 P(e(x,e(e(y,e(x,z)),e(z,y)))). '/. P5.XGF end_of_list.
When a line contains a "%", the characters from the first "%" to the end of the line are treated by the program as a comment. The use of our original approach in the second phase of our attack yielded a substantial amount of information, not all of which was welcomed. Most welcome was the discovery that various formulas, such as P I , P2, and P3, are indeed fertile, yielding many proofs. Even better, most of the proofs obtained in the second phase are pure. Not so welcome, formulas such as PYO appear almost sterile; from PYO, the original approach yielded a deduction of XGK and no other. Also not welcome, use of the formula P5 yielded a deduction of PA in but two applications of condensed detachment, correctly implying that the escape route (with it as hypothesis) to the deduction of another element to add to a possible circle of pure proofs is narrow. Intending to use various proofs found in the second phase, supplemented by some proofs found in earlier studies in the context of seeking shorter proofs, we commenced the third phase of our attack. This phase had the objective of following the narrow (possible) escape route that would lead from P5 to another shortest single axiom as yet not used, via a pure proof. Our approach was to use the following weight template (whose contained formula is in fact PA) to prevent O T T E R from retaining PA. weight(P(e(e(e(x,y),z),e(y,e(z,x)))),200). Because of being assigned such a high weight (200), PA and clauses that are similar to it (where variables are treated as indistinguishable) will be purged for having a weight in excess of our chosen max-weight. To give the program added latitude, we increased the max_weight from 28 (which it was in our original approach) to 40. The modified approach succeeded: O T T E R found a pure proof of the formula PYM, enabling us to place PYM, so to speak, to the right of
1396
Collected Works of Larry Wos
P5. We completed this phase by relying on proofs found in phase 2, resulting in the following partially complete circle: P3, P2, P I , P8, XHN, PA, P5, PYM, XGK, PYO. The apparent lack of fecundity possessed by PYO took us to the fourth phase in which we replaced level saturation by the use of the ratio strategy (due to McCune), with the pick_given_ratio assigned to 4. The cited strategy blends (subject to the assignment) weighting and level saturation. With the as signment of 4, OTTER is instructed to choose for the focus of attention to drive its reasoning four clauses by weight, one by first come first serve (or breadth first), then four, then one, and the like. Our motive was to sharply perturb the search space. Therefore, we also dropped the use of ancestor subsumption and back subsumption. In addition, with an appropriate weight template, we prevented the program from retaining the clause equivalent of XGK. Our ac tions produced a sharp contrast to the apparent just-cited sparsity of proofs, for this phase yielded ten proofs of which eight are pure. From these proofs, we chose a pure proof of P9. Borrowing from earlier experiments, we added to our partially completed circle, obtaining P3, P2, PI, P8, XHN, PA, P5, PYM, XGK, PYO, P9, XHK, PI. With a pure proof of P3 from PI, if one existed, we would have answered the specific question of interest in this article in the affirmative, by finding a circle of pure proofs for the thirteen shortest single axioms. Because our efforts were temporarily thwarted, (as we report in Section 2.4) we applied the methodology in an attempt to complete a second circle of pure proofs. Rather than a full account, here we note that success was the result. O T T E R found the needed pure proofs for the following circle: PI, P I , PI, P8, XHN, P4, P5, PYM, XGK, PYO, P9, P3, XHK, P2. We note that we were required to correct (on August 12, 1994) one flaw, the lack of purity in the proof of P2 with XHK as the only axiom; we found the needed proof, of reported length 80 (because of using the dynamic hot list strategy) and actual length 76 and level 37, in approximately 767 CPU-seconds on a SPARCstation-10, with retention of clause (22558). Then, directly because of completing a (second) circle of pure proofs, (as reported in Section 2.5) we renewed our effort in the context of the first possible circle. With the objective of deducing precisely one shortest single axiom, P3, from P7-rather than blocking the retention of one particular shortest single axiom—we used demodulation (Section 2.5) in place of weighting. We initiated almost simultaneously two attacks (with demodulation). In the first attack, we assigned the max-weight to 48 and the pick.given_ratio to 4, and we dropped the use of both ancestor subsumption and back subsumption. In the second, we assigned the max.weight to 32 and used level saturation. Both attacks succeeded, and we had the desired circle of pure proofs, the following: P3, P2, P I , P8, XHN, PA, P5, PYM, XGK, PYO, P9, XHK, PI, P3.
Searching for Circles of Pure Proofs
3
1397
Arbitrary Circles of Pure Proofs
When we conveyed our results to our colleague McCune, he made a sugges tion that generalized one we had in mind. We had thought that, since we had developed an apparently powerful methodology (almost totally dependent on OTTER) for finding circles of pure proofs, perhaps we could produce a circle of pure proofs with the ordering of the shortest single axioms first given to us (see Section 1.2). More generally, McCune suggested that we choose an arbitrary ordering to test the methodology. Of course, he was ruling out placing P5, so to speak, to the left of PA, for (as noted) P5 must be immediately to the right of PA; P5 is yielded from PA with the first application of condensed detachment that must be made. Despite the merit of McCune's suggestion, we were content to test the methodology on the order in which we were introduced to the thir teen shortest single axioms, the following: PI, P2, P3, PA, P5, PI, P8, P9, PYM, PYO, XGK, XHK, XHN, PI. Immediately, we had a master plan: where possible, borrow from the earlier studies of the two completed circles of pure proofs, and otherwise run new ex periments utilizing the methodology that produced the two circles. We searched for the proofs in the order (just cited) dictated by the intended circle of short est single axioms. In the following, we give proof length and level and other such data to enable the researcher to extend our results in various ways and to provide information for evaluating new programs and new ideas. A glance at the original approach applied to P I yielded a pure proof of P2; the proof has length 9 and level 6 and required approximately 36 CPU-seconds to obtain, completing with the retention of clause (2987); the computer was a SPARCstation-2 (used on July 18, 1994). The original approach also yielded the desired proof of P3, using as the only axiom P2; the proof has length 10 and level 7 and required approximately 40 CPU-seconds to obtain, completing with retention of clause (3301); the computer was a SPARCstation-2 (used on July 18, 1994). To obtain a pure proof of P4 from P3, after various failures, we succeeded by changing the max_weight from 28 to 32, dropping the use of ancestor subsumption and back subsumption, and using demodulation to pre vent O T T E R from retaining any of the twelve possible target axioms other than P4. The proof has length 13 and level 7 and required approximately 798 CPUseconds to obtain, completing with retention of clause (25793); the computer was a SPARCstation-10 (used on July 20, 1994). The proof of P5 from P4 was obtained even before we applied our original approach, when we were simply having the program apply a single condensed detachment step (to each of the thirteen axioms in turn) to see, in the context of ordering the axioms, which moves were forced. The proof has length 1 and level 1 and required .3 CPUseconds to obtain, completing with retention of clause (16); the computer was a SPARCstation-2 (used on July 18, 194). Our search of various experiments for a proof of P7 using P5 as the only axiom yielded none. We also failed to find the desired proof when using the just-
1398
Collected Works of Larry Wos
described approach that succeeded with P 3 as the only axiom. Therefore, using level saturation, we assigned the max-weight to 36 rather than to 32, reassigned the max-weight to 20 rather than to 24 (because a max-weight of 36 produces many more conclusions), and, more important, instituted the use of the dynamic hot list strategy with an assignment of 8 to the dynamicheat.weight. We also assigned the heat parameter to 2 rather than to 1. On a SPARCstation-10 (on July 20,1994), OTTER obtained the desired proof in approximately 1275 CPUseconds, completing with retention of clause (32512); the reported proof length is 46, and the level is 23. The actual proof length is 44; the extra two copies of deduced clauses are accounted for by being present both in the hot list, adjoined during the run, and in list(usable) after being chosen as the focus of attention. To obtain a proof of P8 from P7, we made the single change to our original approach of adding the use of the dynamic hot list strategy, again with the dynamicJieat.weight assigned to 8 and with the heat parameter assigned to 1. After all, that strategy seemed to make the difference in the preceding soughtafter proof. In approximately 65 CPU-seconds, the desired proof was obtained with (reported and actual) length 12 and level 8, completing with retention of clause (5759), and the computer used was a SPARCstation-10 (on July 19, 1994). Then, except for assigning heat to 1 (rather than to 2), with the same approach just described in the context of Pb as the only axiom, we turned to P8 with the objective of deducing P9. In approximately 436 CPU-seconds on a SPARCstation-10 (on July 20, 1994), the desired proof was obtained, with reported and actual length 58 and level 13, completing with retention of clause (17324). We next simply applied the approach again, but replacing the axiom of P8 with the axiom of P9 and replacing the target of P9 with the target of PYO. Still on a SPARCstation-10 (on July 20, 1994), O T T E R obtained the desired proof in approximately 24,495 CPU-seconds with reported and actual length 53 and level 13, with retention of clause (145282). Regarding our attack on finding a proof of PYM using PYO as the only axiom, we were indeed influenced by our early experiments that deduced XGK and no other axiom. Since purity was paramount, as we did in earlier-cited ex periments, we used a weight template (as the only member of a pick jmd.purge weight Jist) to prevent O T T E R from retaining the clause equivalent of XGK, risking the purging of similar formulas. (We did not rely on demodulation, for, at this point in our earliest experimentation, we had not yet begun to use that mechanism in the context of blocking the retention of various clauses.) We as signed max-weight to 36, reassigned it to 24 after 70 clauses were chosen as the focus of attention, assigned the pick_given_ratio to 4, and (for the hot list strat egy) assigned the heat parameter to 1. On the equivalent of a SPARCstation-2 (on July 18, 1994), O T T E R obtained the desired proof in approximately 4743 CPU-seconds with length 64 and level 25, with retention of clause (94387). On the same computer and same date, we had obtained (with our original approach) a proof of XGK from PYM in approximately 81 CPU-seconds; the proof has length 23 and level 11 and completes with retention of clause (3561).
Searching for Circles of Pure Proofs
1399
We obtained the last three proofs with the following approach, using a SPARCstation-10 (on July 21, 1994). Rather than assigning a max-weight, we had O T T E R (in effect) begin with none and periodically lower it through the use of set(controLmemory), which computes lower max.weights based on the memory usage in relation to the assigned (by the researcher) max_mem. We assigned to maxjnemory a limit of 15 megabytes, deliberately squeezing the program despite the use of a computer offering more than 80 megabytes. We assigned max_proofs to 1, the pick_given_ratio to 3, the heat parameter to 1 (for the hot list strategy), and the dynamic-heat.weight to 8 (for the dynamic hot list strategy). Two lists of demodulators were included, one to block the retention of all but the target (shortest single) axiom and the hypothesis (shortest single) axiom, and one to purge all conclusions that contain as a proper subterm a term of the form e(x, x) for any term x. (In other words, with regard to the second list of demodulators, we used a strategy we call the subtautology strategy 13 In approximately 342 CPU-seconds, XHK was deduced from XGK with a proof of reported length 94 and actual length 91 and level 34, with retention of clause (15803). In approximately 688 CPU-seconds, XHN was deduced from XHK with a proof of reported length 76 and actual length 72 and level 40, with retention of clause (21506). In approximately 480 CPU-seconds, P I was deduced from XHN with a proof of reported length 58 and actual length 55 and level 32, with retention of clause (15009). • T h i r d Circle of P u r e Proofs: With the invaluable assistance of OTTER, we found a (third) circle of pure proofs with the following ordering of the thirteen shortest single axioms: P I , P2, P3, P4, P5, P7, P8, P9, PYM, PYO, XGK, XHK, XHN, P I .
4
Pristine Proofs
We note that, although our original goal was that of finding (if one existed) a circle of pure proofs, far more was discovered through heavy use of McCune's automated reasoning program OTTER . Stronger than purity is the property of instance purity, which demands that, other than the hypothesis and the con clusion, no deduced step be even an instance of one of the other eleven shortest single axioms. An inspection of the proofs for each of the three circles shows that all of them are instance pure. Also stronger than purity is the property of subterm purity, which requires that, other than the hypothesis and the conclusion, no deduced step contain even a proper subterm that is an instance of one of the other eleven shortest single axioms. Except for the proof of PYM with P5 as hypothesis and the proof of P7 with P5 as hypothesis, all of the proofs used in the three circles are subterm pure. We note that we did revisit the study of deducing P7 from P5 to obtain a proof that is subterm pure; in our original pure proof, proper subterms
1400
Collected Works of Larry Wos
that are instances of PA are present. On a SPARCstation-10, in approximately 5724 CPU-seconds, the desired proof was completed with actual length 50 and reported length 52 (because of using the dynamic hot list strategy) and level 22, with retention of clause (84762). • Pristine Proofs: The proofs of which the three circles consist are indeed pristine, for the proofs are instance pure and, with one exception (that of PYM from P5), subterm pure (after replacing the original proof of P7 from P5). Were one to press forward (as we did after this article was virtually com plete), one might ask about one additional property, still in the spirit of being pristine. The property in question concerns the number of deduced steps shared by more than one proof, where the focus is on each of the circles (taken one at a time) of thirteen pure proofs. In the following way, the cited property extends the notion of a circle of pure proofs. Indeed, for a given circle of thirteen pure proofs, each of the shortest single axioms appears twice, once as a hypothesis, and once as a conclusion. If the concern is confined to the thirteen axioms, then, because of purity, two proofs selected from one of the circles of pure proofs have no intersection, or they touch at a single (formula) point, the end of one and the beginning of the other. For example, from the first circle, the P3-P2 proof and the P 7 - P 3 proof share P 3 and touch at no other point (with respect to the thirteen shortest single axioms). In the same context, the P3-P2 proof does not touch the P5-PYM proof. Curiosity naturally led us to broaden the scope of formula sharing to include all formulas of equivalential calculus and to focus on the deduced steps of the thirteen proofs for a given circle. If one uses various Unix features, one finds that, on the surface, the following seven deduced steps are shared by various proofs among the thirteen proofs of the first circle. P(e(e(e(x,e(y,e(z,x))),z),y)). P(e(e(e(x,y),x),y)). P(e(e(e(x,y),y),x)). P(e(e(x,y),e(y,e(e(z,x),z)))). P(e(e(x,y),e(y,x))). P(e(e(x,y),e(y,x))). P(e(x,e(e(y,z),e(y,e(z,x))))). Of these seven deduced steps (in the circle 1 proofs), 5 and 6 are identical. The first of the seven is present in the proof of XHN from P8, and in the proof of PYM from P5. The second is in the proof of P7 from XHK, and in the proof of P3 from P7. The third occurs twice in the proof of PYM from P5, because of the dynamic hot list strategy. The fourth occurs in the proof of P7 from XHK, and in the proof of P 3 from P7. The fifth (and hence the sixth, which is identical) occurs in three proofs: of XHK from P9, of P7 from XHK,
Searching for Circles of Pure Proofs
1401
and of P3 from P7. The seventh occurs in the proof of P9 from PYO, and in the proof of Pi from PI. Therefore, only 5 steps of the 265 deduced steps (of which the thirteen proofs of the first circle consist) are shared by more than one proof; OTTER (in effect) announces 266 because of a duplicate in one proof, resulting from the use of the dynamic hot list strategy. With the aid of various Unix utilities, regarding the thirteen proofs of the second circle, one finds that, on the surface, twelve deduced steps are shared by more than one proof, the following. (1) (2) (3) (4) (5) (6) (7) (8) (9) (10)
P(e(e(e(x,e(y,e(z,x))),z),y)). P(e(e(e(x,y),x),y)). P(e(e(e(x,y),y),x)). P(e(e(e(x,y),y),x)). P(e(e(e(x,y),y),x)). P(e(e(x,e(x,y)),y)). P(e(e(x,y),e(y,x))). P(e(e(x,y),e(y.x))). P(e(x,e(e(y,z),e(y,e(z,x))))). P(e(x,x)).
(11)
P(e(x,x)).
(12)
P(e(x,x)).
Of the twelve deduced steps, 3 and 4 and 5 are identical, as are 7 and 8, and as are 10 and 11 and 12. Therefore, only seven distinct steps occur. The first occurs in the proof of XHN from P8, and also in the proof of PYM from P5. The second occurs twice in the proof of P2 from XHK, because of the dynamic hot list strategy. The third (and fourth and fifth, which are identical) occurs twice in the proof of PYM from P5, and twice in the proof of P2 from XHK; duplicate deduced steps can be present in a proof when the dynamic hot list strategy is used. The sixth occurs in the proof of P9 from PYO, and occurs in the proof of P2 from XHK. The seventh (and hence eighth) occurs in the proof of P8 from P7, and occurs twice in the proof of P2 from XHK (because of the dynamic hot list strategy). The ninth occurs in the proof of P8 from P7, and occurs in the proof of P9 from PYO. The tenth (and hence eleventh and twelfth) occurs in three proofs: P9 from PYO, XHK from P3, and twice in P2 from XHK (because of the dynamic hot list strategy). Therefore, only 6 steps of the 284 deduced steps (of which the thirteen proofs of the second circle consist) are shared by more than one proof; O T T E R (in effect) announces 289, because of the dynamic hot list strategy. As for the third circle of pure proofs, the set of proofs behaves far less well in the sense that fifty-seven deduced steps are shared by more than one proof. Because of using the dynamic hot list strategy, which can cause a deduced step to appear more than once in a proof, OTTER announces a total of 517 deduced steps; actually, the number is 505. With respect to the property under discussion, which one might think of as a proof intersection property, the thirteen proofs of
CbJJected Works of Larry Wos
1402 the third circle are far from pristine.
5
Persuasions and Challenges
Our persuasions (or beliefs) naturally lead us to offer challenges. We have always held that an attempt to meet a challenge is often met with intrigue and with the eventual advance of some type for the field. We are so attracted to this position that we sometimes offer to ourselves a challenge—in the case of this article, the challenge of finding a circle of pure proofs for the thirteen shortest single axioms of equivalential calculus. The significance of the material that has resulted and that we have presented here rests with three factors. First, the pristine quality of the proofs that O T T E R has produced for each of the three circles of pure proofs offers charm and even beauty, from the viewpoint of mathematics and logic (see the bulleted items in Sections 2.4, 2.5, 3, and 4). Second, the reported successes powerfully illustrate how research is facilitated when one's assistant is McCune's automated reason ing program O T T E R ; in particular, its use sharply reduces real time, CPU time, and the likelihood of error. Third, the methodology developed to meet the chal lenge offers techniques for attacking a wide variety of questions and problems from areas having no relation to equivalential calculus. Regarding concrete challenges, one might attempt to find a subterm-pure proof of PYM from P5 to replace the corresponding proof that is not subterm pure and that is used in the first and second circle of proofs; our attempts have failed so far. One might attempt to find a circle of pure proofs such that no deduced step is common to two or more proofs; we have not studied this problem. Without losing purity, one might attempt to find replacement proofs for each of the given three circles of pure proofs, where the goal is to decrease their length, individually and collectively. Instead, one might seek a different circle of pure proofs whose collective proof length is "small".
6
Finale and Future Research
In this article, we have presented a methodology for attacking the question of finding a circle of pure proofs for the thirteen shortest single axioms for equivalential calculus. For an example of what the methodology has produced, we consider the following (circle) ordering of the thirteen shortest single axioms, an ordering that is the first we were given in the late 1970s. The ordering is P I , P2, P3, P4, P5, PI, P8, P9, PYM, PYO, XGK, XHK, XHN, PI. With indispensable aid from McCune's automated reasoning program O T T E R thirteen proofs were produced: the first deducing PI from P I (as the only axiom and with condensed detachment as the inference rule), the second deducing P3 from P 2 (as the only axiom), ..., and the thirteenth deducing P I from XHN
Searching for Circles of Pure Proofs
1403
(as the only axiom). In other words, O T T E R produced the needed proofs for the circle under study. Regarding purity, each of the thirteen proofs relies on its hypothesis (shortest single) axiom and its conclusion (shortest single) axiom and on none of the other eleven shortest single axioms. (We note that, although purity places no restrictions on proper instances and on proper subterms of any of the other eleven axioms, the research reported here also addresses those aspects.) For one indication of the difficulty of obtaining the desired pure proofs, to obtain any proof with XHN as hypothesis can prove most challenging. For a second indication of the difficulty, many approaches to deducing one shortest single axiom from another result in the completion of a proof that is not pure, that relies on the use of a third shortest single axiom. As but one indication of the power offered by O T T E R and by some of the strategies we used, which we shall touch upon almost immediately, the entire study (with the exception of the smallest portion borrowed from earlier research and the added experiment on August 12, 1994, that we reported in Section 2.4) was completed in three days, starting on July 18, 1994, and concluding on July 21, 1994. Indeed, in contrast to so much of research, the preparation of this article required far more time and, more significant, far more effort than did the study itself. Moreover, we note that the CPU time required to complete the circle of proofs was dramatically less than we would have estimated, given the complexity of the problem. In particular, as can be seen from the proofs presented in the Appendix and that were obtained during the preparation of this article, only 101,000 CPU-seconds were needed to find the (first) circle of pure proofs. Finally, we note that we found three circles of pure proofs for the thirteen shortest single axioms, and, though not our original goal, the proofs are also instance pure, free of proper instances of the axioms whose use is to be avoided. Further, if none of the deduced steps of a proof contains as a proper subterm an instance of an unwanted axiom, we say the proof is subterm pure. With O T T E R , we were able to find subterm pure proofs for all but one of the axioms. Unaided, a researcher would find it at least troublesome and at worst most difficult to test proofs for instance purity and for subterm purity, again illustrating the value of reliance on an automated reasoning program. Regarding strategy, both the hot list strategy and the dynamic hot list strat egy (the latter due to McCune) played a key role. The hot list strategy enables the researcher to designate various input clauses as meriting repeated immedi ate visiting, and even immediate revisiting, to complete the applications of the chosen inference rules, rather than to initiate such applications. One might, for example, conjecture that an added axiom (such as the cube of x is x) should be immediately used with each new clause that is retained, even before a clause other than the new clause is chosen as the focus of attention to drive the pro gram's reasoning. If that is the conjecture, then one places the clause corre sponding to the axiom in list(hot). The heat parameter governs the level (or depth) of the use of the hot list strategy. The dynamic hot list strategy enables the researcher to instruct the
1404
Collected Works of Larry Wos
program to adjoin during a run new members to the hot list. The parameter dynamicheat.weight provides the threshold for deciding which clauses to adjoin during the run. In addition, some experiments relied on the use of level saturation (breadth first or first come first serve) to direct the choice of where next to focus the program's attention, and some used the ratio strategy (the latter due to McCune). Regarding the ratio strategy, its actions are governed by the parameter pick,given_ratio. If, for example, this parameter is assigned the value 4, then O T T E R will choose (as the focus of attention) four clauses by conclusion com plexity, one by first come first serve, then four, then one, and the like. We also made occasional use of the subtautology strategy, which instructs the program to immediately purge on generation clauses containing terms of the form e(x, x), where the function e (in this study) denotes equivalent and where a; is a variable that, because demodulation is the mechanism that is used, captures terms. Among the other techniques on which the methodology rests, two merit mention. First, to prevent O T T E R from retaining the clause equivalent of some unwanted axiom, we used weighting (a strategy formulated by Overbeek) by including its pattern with an assignment of complexity that exceeds the chosen maximum weight allowed. This action has the risk of purging formulas that differ from the unwanted formula only in the choice of particular variables. This risk exists because, with O T T E R a weight template treats all of its variables as indistinguishable; nevertheless, this treatment is fortunate, as shown in this article. Second, when we wished to block consideration of all but the hypothesis axiom and its target, we used demodulation (see Section 2.5) in a rather complex manner. For future research, we suggest the study of other circles of pure proofs. We suggest that this avenue is of interest in contexts totally unrelated to equivalential calculus, as well as other circles focusing on the thirteen shortest single axioms. For example, perhaps the question of whether a circle of pure proofs exists for the three Moufang identities is still open. For related research, McCune suggests seeking an algorithm for transforming proofs that are not pure into proofs that are. For distantly related research, we suggest a study to deter mine why the methodology used to obtain the results we present here seems to promote purity of proof. Of a different nature entirely, we suggest for research a study of shortest proofs for various pairs of shortest single axioms. For the researcher interested in practical applications, we suggest extracting from the methodology various techniques that are of general use. For example, one might apply the VAR option (with demodulation) of Section 2.5 to design an efficient circuit that avoids certain undesirable subcircuits. For another example, one might apply some of the techniques to algorithm synthesis. For researchers interested in attacking problems whose solution might di rectly advance the field of automated reasoning, the following seem most appro priate. Of a global nature, we suggest a study of metarules for wisely choosing from among the options offered by O T T E R especially choosing from among the
Searching for Circles of Pure Proofs
1405
strategies this program offers. (Although each of the strategies is indeed inde pendent of any reasoning program, O T T E R is, from what we know, currently the only program that offers the entire menu.) Equally complicated is the research topic that focuses on what we call global linearity, in contrast to local linear ity. The latter concerns the drawing of conclusions at a more or less constant rate per CPU-second. The former concerns choosing as the focus of attention (to drive the program's reasoning) conclusions at a more or less constant rate. McCune's use of discrimination trees enables OTTER to perform at nearly local linear speed. As yet, we only have a faint notion for addressing the problem of global linearity. Were a program to offer global linearity comparable to O T TER'S offering of local linearity, (we conjecture that) a most significant increase in power would result. We close by noting that the data presented in this article strongly suggests that obtaining the answers to deep questions and the solution to hard problems virtually requires the use of strategy. Clearly (we believe), no single strategy suffices, nor will such an all-encompassing strategy ever exist. However, the advances in automated reasoning witnessed in just the past five years are far beyond what we would have predicted. Indeed, we feel certain that the results presented here would have been out of reach but five years ago, and, further, these results would have been difficult or impossible to obtain without McCune's program OTTER.
Remark 1. During the entire study reported here we had totally forgotten about some earlier joint research with our colleague McCune [4]. In that paper, we presented what might be called a near circle of proofs; purity had not yet been coined and was, almost certainly, lacking in the vast majority of the proofs. Remark 2. After the completion of this article, we were informed by Robert Veroff of an alternate attack on the problem of finding circles of pure proofs for the thirteen shortest single axioms, an attack in which he found 62,880 circles of pure proofs. Veroff used pure proofs from this article and pure proofs he found with the aid of OTTER. He searched for circuits in a directed graph, where the vertices correspond to the thirteen shortest single axioms. An edge from vertex i to vertex j exists only if there exists a pure proof of axiom j from axiom i. He wrote a simple algorithm to exhaustively search for all circuits.
Appendix To aid and stimulate research, we present here a sample input file and the proofs of which the first circle consists. When a line contains a "%", the characters from the first "%" to the end of the line are treated by the program as a comment. In the following," -" denotes logical not and " | " denotes logical or. In the proofs, two copies of an input clause denotes its presence in two input lists, one of which is the hot list. Also, as an example, [hyper,16,17,18] says that clause
1406
Collected Works of Larry Wos
(16) is the nucleus, clause (17) is unified with the first literal of (16), and clause (18) is unified with the second literal. A Sample Input File set(hyper_res). assign(max_weight,32). '/. Disallow clauses with weight strictly '/. greater than 3. '/. assign(max_given,1). '/, Limit the number of clauses chosen % to drive the reasoning to 1. assign(max_proofs,-l). % Place no limit on the number of proofs to be completed. clear(print_kept). 7, Do not enter into the output file clauses as they are retained. V, set(ancestor_subsume). V, Compare path lengths for derivations to the same conclusion. '/. set(back.sub). '/, Purge an existing clauses when a new clause captures such. '/, assign(max.seconds, 1200) . '/, Limit the CPU time. assign(max_mem,80000). % Limit the memory usage in kilobytes. assign(report,1800). '/, Place in output file a statistical summary every 30 CPU-minutes. % assign(max_distinct_vars, 4). '/, Prevent retention of a '/, clause containing strictly more than 4 distinct variables. 7, assign(pick_given_ratio,4). % Five clauses are chosen by V, weight and one by breadth first, repeatedly. assign(change_limit_after,50). % Change max_weight after 7, 50 clauses are chosen to drive the reasoning. assign(nev_max_weight,24). 'A Assign new max.weight to 24. assign(heat,l). 7% Limits the recursion through the hot list. X assign(dynamic.heat.weight,8). 7. Limits the weight on '/, clauses adjoined to the hot list during the run. set(order_history). 7, List ancestors in the order nucleus, 7, clause unifying with first literal, clause unifying with second. set(input_sos_first). 7, Choose for driving the reasoning 7% clauses from the input list(sos) before others. set(sos.queue). % Direct the search by first come, first serve. 7, 7, 7. 7. 7. 7. 7.
Used to direct the reasoning and to purge unwanted clauses. weight_list(pick_and_purge). Following are to block all but P3 and P7. weight(P(e(e(x,y),e(e(z,y),e(x,z)))),200). 7. Pl.YQL weight(P(e(e(x,y).e(e(x.z),e(z,y)))),200). 7. P2.YQF weight(P(e(e(e(x,y),z),e(y,e(z,x)))),200). 7. P4_UM weight(P(e(x,e(e(y,e(x,z)),e(z,y)))),200). 7. P5.XGF
Searching for Circles of Pure Proofs
7. 7. 7. 7. 7. 7. 7. 7, 7. 7t
weight(P(e(e(x,y),e(z,e(e(y,z),x)))),200). weight(P(e(e(x,y),e(z,e(e(z,y),x)))),200). weight(P(e(e(e(x,e(y,z)),z),e(y,x))),200). weight(P(e(e(e(x,e(y,z)),y),e(z,x))),200). weight(P(e(x,e(e(y,e(z,x)),e(z,y)))),200). weight(P(e(x.e(e(y,z),e(e(x,z),y)))),200). weight(P(e(x,e(e(y,z),e(e(z,x),y)))),200). Following is for tail strategy. weight (e($(l),$ (2) ),1). end_of_list.
1407
7. P8.YRM 7. P9.YR0 7. PYO 7. PYM X XGK 7. XHK 7. XHN
7. Used to complete applications of inference rules. list(usable). '/, Following clause is for condensed detachment. -P(e(x,y)) I -P(x) I P(y). end_of_list. 7. Used to initiate applications of inference rules. list(sos). '/, Following are all of the shortest single axioms for 7. equivalential calculus. 7. P(e(e(x,y),e(e(z,y),e(x,z)))) 7. Pl.YQL 7. P(e(e(x,y),e(e(x,z),e(z,y))); 7. P2.YQF 7. P(e(e(x,y),e(e(z,x),e(y,z))): 7. P3.YQJ 7. P(e(e(e(x,y),z),e(y,e(z,x))): 7. P4_UM 7. P(e(x,e(e(y,e(x,z)) ,e(z,y))): 7. P5.XGF P(e(e(x,e(y,z)),e(z,e(x,y)))) . •/i P7_WN 7. P(e(e(x,y),e(z,e(e(y,z),x))): 7. P8_YRM 7. P(e(e(x,y),e(z,e(e(z,y),x))); 7. P9.YR0 7. P(e(e(e(x,e(y,z)),z),e(y,x)); 7. PYO 7. P(e(e(e(x,e(y,z)),y),e(z,x)): 7. PYM 7. P(e(x,e(e(y,e(z,x)),e(z,y))): 7. XGK 7. P(e(x,e(e(y,z) ,e(e(x,z) ,y)))] 7. XHK 7. P(e(x,e(e(y,z) ,e(e(z,x) ,y)))] 7. XHN end_of_list. '/, Used mainly to detect proof completion and to monitor progress. list(passive). 7. Here are negations of the thirteen shortest single 7. axioms for equivalential calculus. -P(e(e(a,b),e(e(c,b),e(a,c)))) | $ANSWER(P1_YQL). -P(e(e(a,b),e(e(a,c),e(c,b)))) | $ANSWER(P2_YQF). -P(e(e(a,b),e(e(c,a),e(b,c)))) I $ANSWER(P3_YQJ). -P(e(e(e(a,b),c),e(b,e(c,a)))) | $ANSWER(P4_UM).
Collected Works of Larry Wos
1408
-P(e(a,e(e(b.e(a,c)),e(c,b)))) -P(e(e(a,e(b,c)),e(c,e(a,b)))) -P(e(e(a,b),e(c,e(e(b,c),a)))) -P(e(e(a,b),e(c,e(e(c,b),a)))) -P(e(e(e(a.e(b,c)),c),e(b,a))) -P(e(e(e(a,e(b,c)),b),e(c,a))) -P(e(a,e(e(b,e(c,a)),e(c,b)))) -P(e(a,e(e(b,c),e(e(a,c),b)))) -P(e(a,e(e(b,c),e(e(c,a),b)))) end_of_list.
I I I I I I I I I
$ANSWER(P5_XGF). $ANSWER(P7_WN). $ANSWER(P8.YRM). $ANSWER(P9_YR0). $ANSWER(PY0). $ANSWER(PYM). $ANSWER(XGK). $ANSWER(XHK). $ANSWER(XHN).
7. Following b l o c k s unwanted formulas of EC, excluding P7 and P3. make_evaluable(_ft_, $AND(_,_)). list(demodulators). ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( e ( x , y ) , e ( e ( z , y ) , e ( x , z ) ) ) ) - $T. 7. Pl.YQL ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( e ( x , y ) , e ( e ( x , z ) , e ( z , y ) ) ) ) - $T. 7. P2.YQF 7. ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( e ( x , y ) , e ( e ( z , x ) , e ( y , z ) ) ) ) 7. - $T. 7. P3.YQJ ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( e ( e ( x , y ) , z ) , e ( y , e ( z , x ) ) ) ) - $T. 7, P4_UM ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( x , e ( e ( y , e ( x , z ) ) , e ( z , y ) ) ) ) - $T. 7. P5.XGF 7. ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( e ( x , e ( y , z ) ) , e ( z , e ( x , y ) ) ) ) 7. - $T. 7. P7_WN ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( e ( x , y ) , e ( z , e ( e ( y , z ) , x ) ) ) ) - $T. 7. P8.YRM ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( e ( x , y ) , e ( z , e ( e ( z , y ) , x ) ) ) ) - $T. 7. P9_YR0 ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( e ( e ( x , e ( y , z ) ) , z ) , e ( y , x ) ) ) - $T. 7. PYO ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( e ( e ( x , e ( y , z ) ) , y ) , e ( z , x ) ) ) - ST. 7. PYM ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( x , e ( e ( y , e ( z , x ) ) , e ( z , y ) ) ) ) » $T. 7, XGK ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( x , e ( e ( y , z ) , e ( e ( x , z ) , y ) ) ) ) - $T. 7. XHK ($VAR(x) ft $VAR(y) ft $VAR(z)) -> P ( e ( x , e ( e ( y , z ) , e ( e ( z , x ) , y ) ) ) )
- $T.
7. XHN
end_of_list. '/, Used to immediately complete applications of inference rules. list(hot).
Searching for Circles of Pure Proofs
1409
'/, Following clause is for condensed detachment. -P(e(x,y)) ! -P(x) I P(y). '/, Following is hypothesis, P7 P(e(e(x,e(y,z)),e(z,e(x,y)))). '/. P7_WN end_of_list.
Thirteen Proofs for the First Circle, in Order P3 implies P2 > UNIT CONFLICT at 100.56 sec > 6583 [binary,6582.1,4.1] $ANSWER(P2_YQF). Length of proof is 8. Level of proof is 6. PROOF 1 [] -P(e(x,y)) I -P(x) | P(y). 2 [] P(e(e(x,y),e(e(z,x),e(y,z)))).
4 [] - P ( e ( e ( a , b ) , e ( e ( a , c ) , e ( c , b ) ) ) ) I $ANSWER(P2_YqF). 16 [] -P(e(x,y)) I -P(x) I P(y). 17 [] P ( e ( e ( x , y ) , e ( e ( z , x ) , e ( y , z ) ) ) ) . 18 [hyper,1,2,2] P ( e ( e ( x , e ( y , z ) ) , e ( e ( e ( u , y ) , e ( z , u ) ) , x ) ) ) . 19 (heat-1) [hyper,16,17,18] P ( e ( e ( x , e ( y , e ( z , u ) ) ) , e ( e ( e ( e ( v , z ) , e(u,v)),y),x))). 24 [hyper,1,19,19] P ( e ( e ( e ( e ( x , y ) , e ( z , x ) ) , e ( e ( e ( u , v ) , e(w,u)),v6)),e(e(y,z),e(v6,e(v,w))))). 26 [hyper,1,2,19] P ( e ( e ( x , e ( y , e ( z , e ( u , v ) ) ) ) , e ( e ( e ( e ( e ( w , u ) , e(v,w)),z),y),x))). 29 (heat»l) [hyper,16,24,17] P ( e ( e ( x , y ) , e ( e ( e ( y , z ) , e ( x , u ) ) , e(u,z)))). 152 [hyper,1,26,29] P ( e ( e ( e ( e ( e ( x , y ) , e ( z , x ) ) , u ) , e ( e ( v , e ( y , z ) ) , e(w,u))),e(w,v))). 159 [hyper,1,2,29] P ( e ( e ( x , e ( y , z ) ) , e ( e ( e ( e ( z , u ) , e ( y , v ) ) , e(v,u)),x))). 6582 [hyper,1,152,159] P ( e ( e ( x , y ) , e ( e ( x , z ) , e ( z , y ) ) ) ) . 6583 [binary,6582.1,4.1] $ANSWER(P2_YQF). P2 implies PI > UNIT CONFLICT at 13.17 sec > 1560 [binary,1559.1,3.1] $ANSWER(P1_YQL). Length of proof is 7. Level of proof is 5. PROOF 1 [] -P(e(x,y)) I -P(x) | P(y). 2 [] P(e(e(x,y),e(e(x,z),e(z,y)))).
3 [] - P ( e ( e ( a , b ) , e ( e ( c , b ) , e ( a , c ) ) ) ) I $ANSWER(P1_YQL). 16 [] -P(e(x,y)) I -P(x) | P(y).
1410
Collected Works of Larry Wos
17 [] P ( e ( e ( x , y ) , e ( e ( x , z ) , e ( z , y ) ) ) ) . 18 [hyper,1,2,2] P ( e ( e ( e ( x , y ) , z ) , e ( z , e ( e ( x , u ) , e ( u , y ) ) ) ) ) . 20 (heat-1) [hyper,16,18,17] P ( e ( e ( e ( x , y ) , e ( y , z ) ) , e(e(x,u),e(u,z)))). 21 [hyper,1,18,18] P ( e ( e ( x , e ( e ( y , z ) , e ( z , u ) ) ) , e(e(e(y,u),v),e(v,x)))). 52 [hyper,1,20,21] P ( e ( e ( x , y ) , e ( y , e ( e ( z , z ) , x ) ) ) ) . 56 [hyper,1,21,18] P ( e ( e ( e ( x , e ( y , z ) ) , u ) , e ( u , e ( e ( v , z ) , e(x,e(v,y)))))). 1502 [hyper,1,56,52] P ( e ( e ( e ( x , y ) , e ( e ( z , z ) , u ) ) , e ( e ( v , y ) , e(u,e(v,x))))). 1559 (heat-1) [hyper,16,1502,17] P ( e ( e ( x , y ) , e ( e ( z , y ) , e ( x , z ) ) ) ) . 1560 [binary,1559.1,3.1] $ANSWER(Pl_YqD. PI implies P8 > UNIT CONFLICT at 1208.41 sec > 27183 [binary,27182.1,9.1] $ANSWER(P8_YRM). Length of proof i s 10. Level of proof i s 6. PROOF 1 [] -P(e(x,y)) I -P(x) I P(y). 2 [] P ( e ( e ( x , y ) , e ( e ( z , y ) , e ( x , z ) ) ) ) . 9 [] - P ( e ( e ( a , b ) , e ( c , e ( e ( b , c ) , a ) ) ) ) I $ANSWER(P8_YRM). 16 [] -P(e(x,y)) I -P(x) I P(y). 17 [] P ( e ( e ( x , y ) , e ( e ( z , y ) , e ( x , z ) ) ) ) . 18 [hyper,1,2,2] P ( e ( e ( x , e ( e ( y , z ) , e ( u , y ) ) ) , e ( e ( u , z ) , x ) ) ) . 19 (heat-1) [hyper.16,17,18] P ( e ( e ( x , e ( e ( y , z ) , u ) ) , e(e(u,e(e(v,z),e(y,v))),x))). 21 [hyper,1,18,18] P ( e ( e ( x , y ) , e ( e ( x , z ) , e ( e ( u , y ) , e ( z , u ) ) ) ) ) . 26 [hyper,1,2,19] P ( e ( e ( x , e ( e ( y , e ( e ( z , u ) , e ( v , z ) ) ) , w ) ) , e(e(w,e(e(v,u),y)),x))). 37 [hyper,1,19.21] P ( e ( e ( e ( e ( x , y ) , e ( z , x ) ) , e ( e ( u , z ) , e ( v , u ) ) ) , e(v,y))). 38 [hyper,1,18,21] P ( e ( e ( e ( x , y ) , z ) , e ( e ( z , x ) , y ) ) ) . 422 [hyper,1,26,38] P ( e ( e ( x , e ( e ( y , z ) , u ) ) , e ( e ( e ( e ( v , z ) , e(y,v)),x),u))). 430 [hyper,1,38,37] P ( e ( e ( e ( x , y ) , e ( e ( z , y ) , e ( u , z ) ) ) , e ( e ( v , u ) , e(x,v)))). 453 (heat-1) [hyper,16,422,17] P ( e ( e ( e ( e ( x , y ) , e ( z , x ) ) , e(u,y)),e(u,z))). 27182 [hyper,1,453,430] P ( e ( e ( x , y ) , e ( z , e ( e ( y , z ) , x ) ) ) ) . 27183 [binary,27182.1,9.1] $ANSWER(P8_YRM).
Searching for Circles of Pure Proofs
1411
P8 implies XHN > UNIT CONFLICT at 32.77 sec > 1930 [binary,1929.1,15.1] $ANSWER(XHN). Length of proof is 19. Level of proof is 10. PROOF 1 [] -P(e(x,y)) | -P(x) I P(y). 2 [] P(e(e(x,y),e(z,e(e(y,z),x)))). 15 [] - P ( e ( a , e ( e ( b , c ) , e ( e ( c , a ) , b ) ) ) ) I $ANSWER(XHN). 16 [] - P ( e ( x , y ) ) I - P ( x ) I P ( y ) . 17 [] P ( e ( e ( x , y ) , e ( z , e ( e ( y , z ) , x ) ) ) ) . 18 [ h y p e r , 1 , 2 , 2 ] P ( e ( x , e ( e ( e ( y , e ( e ( z , y ) , u ) ) , x ) , e ( u , z ) ) ) ) . 20 ( h e a t - 1 ) [ h y p e r , 1 6 , 1 8 , 1 7 ] P ( e ( e ( e ( x , e ( e ( y , x ) , z ) ) , e(e(u,v),e(w,e(e(v,w),u)))),e(z,y))). 21 [ h y p e r , 1 , 1 8 , 1 8 ] P ( e ( e ( e ( x , e ( e ( y , x ) , z ) ) , e ( u , e(e(e(v,e(e(w,v),v6)),u),e(v6,w)))),e(z,y))). 22 ( h e a t - 1 ) [ h y p e r , 1 6 , 2 1 , 1 7 ] P ( e ( e ( e ( x , e ( y , e ( z , x ) ) ) , z ) , y ) ) . 26 [ h y p e r , 1 , 2 0 , 2 0 ] P ( e ( e ( x , e ( e ( e ( y , e ( e ( e ( z , e ( e ( u , z ) , v ) ) , y ) , e(v,u))),x),w)),v)). 29 ( h e a t - 1 ) [ h y p e r , 1 6 , 2 6 , 1 7 ] P ( e ( e ( x , e ( e ( y , e ( e ( e ( z , e ( e ( u , z ) , v ) ) , y),e(v,u))),e(w.x))),w)). 34 [ h y p e r , 1 , 2 , 2 2 ] P ( e ( x , e ( e ( y , x ) , e ( e ( z , e ( y , e ( u , z ) ) ) , u ) ) ) ) . 37 ( h e a t = l ) [ h y p e r , 1 6 , 3 4 , 1 7 ] P ( e ( e ( x , e ( e ( y , z ) , e(u,e(e(z,u),y)))),e(e(v,e(x,e(w,v))),w))). 62 [ h y p e r , 1 , 3 4 , 3 4 ] P ( e ( e ( x , e ( y , e ( e ( z , y ) , e ( e ( u , e ( z , e ( v , u ) ) ) , v ) ) ) ) , e(e(w,e(x,e(v6,w))),v6))). 64 [ h y p e r , 1 , 2 9 , 3 4 ] P ( e ( x , e ( y , e ( e ( e ( e ( z , e ( e ( u , z ) , v ) ) , y ) , e(v,u)),x)))). 66 [ h y p e r , 1 , 3 4 , 2 2 ] P ( e ( e ( x , e ( e ( e ( y , e ( z , e ( u , y ) ) ) , u ) , z ) ) , e(e(v,e(x,e(w,v))),w))). 68 ( h e a t - 1 ) [ h y p e r , 1 6 , 6 2 , 1 7 ] P ( e ( e ( x , e ( e ( e ( e ( y , e ( z , e ( u , y ) ) ) , u ) z),e(v,x))),v)). 70 ( h e a t - 1 ) [ h y p e r , 1 6 , 1 7 , 6 4 ] P ( e ( x , e ( e ( e ( y , e ( e ( e ( e ( z , e(e(u,z),v)),y),e(v,u)),w)),x),w))). 135 [hyper,1,68,34] P(e(x,e(e(e(y,e(z,e(u,y))),u),e(z,x)))). 143 [hyper,1,66,70] P(e(e(x,e(e(e(y,e(e(z,y),u)),e(u,z)), e(v,x))),v)). 301 [hyper,1,37,135] P(e(e(x,e(e(e(y,z),e(u,e(z,e(y,u)))), e(v,x))),v)). 330 [hyper,1,143,64] P(e(e(e(x,e(e(y,x),z)),e(e(u,e(e(v,u),w)), e(w,v))),e(z,y))). 1905 [hyper,1,330,301] P(e(e(e(e(x,e(e(y,x),z)),e(z,y)), e(u,e(v,e(w,u)))),e(w,v))). 1929 (heat-1) [hyper,16,1905,17] P(e(x,e(e(y,z),e(e(z,x),y)))).
1412
Collected Works of Larry Wos
1930 [ b i n a r y , 1 9 2 9 . 1 , 1 5 . 1 ] $ANSWER(XHN). XHN i m p l i e s P4 > UNIT CONFLICT at 770.69 s e c > 9778 [ b i n a r y , 9 7 7 7 . 1 , 6 . 1 ] $ANSWER(P4_UM). Length of proof i s 2 0 . Level of proof i s 14. PROOF 1 [] - P ( e ( x , y ) ) I - P ( x ) I P ( y ) . 2 [] P ( e ( x , e ( e ( y , z ) , e ( e ( z , x ) , y ) ) ) ) . 6 [] - P ( e ( e ( e ( a , b ) , c ) , e ( b , e ( c , a ) ) ) ) I $ANSWER(P4_UM). 16 [] - P ( e ( x , y ) ) I - P ( x ) I P ( y ) . 17 [] P ( e ( x , e ( e ( y , z ) , e ( e ( z , x ) , y ) ) ) ) . 18 [ h y p e r , 1 , 2 , 2 ] P ( e ( e ( x , y ) , e ( e ( y , e ( z , e ( e ( u , v ) , e(e(v,z),u)))),x))). 20 ( h e a t - 1 ) [ h y p e r , 1 6 , 1 8 , 1 7 ] P ( e ( e ( e ( e ( x , y ) , e ( e ( y , z ) , x ) ) , e(u,e(e(v,v),e(e(v,u),v)))),z)). 21 [ h y p e r , 1 , 1 8 , 1 8 ] P ( e ( e ( e ( e ( x , e ( y , e ( e ( z , u ) , e ( e ( u , y ) , z ) ) ) ) , v ) , e(w,e(e(v6,v7),e(e(v7,w),v6)))),e(v,x))). 24 [ h y p e r , 1 , 1 8 , 2 0 ] P ( e ( e ( x , e ( y , e ( e ( z , u ) , e ( e ( u , y ) , z ) ) ) ) , e(e(e(v,w),e(e(w,x),v)),e(v6,e(e(v7,v8),e(e(v8,v6),v7)))))). 27 [ h y p e r , 1 , 2 1 , 2 0 ] P ( e ( e ( x , e ( e ( y , z ) , e ( e ( z , x ) , y ) ) ) , e ( e ( e ( u , v ) , e(e(v,e(w,e(v6,e(e(v7,v8),e(e(v8,v6),v7))))),u)),w))). 30 ( h e a t - 1 ) [ h y p e r , 1 6 , 2 7 , 1 7 ] P ( e ( e ( e ( x , y ) , e ( e ( y , e ( z , e(u,e(e(v,w),e(e(w,u),v))))),x)),z)). 37 [ h y p e r , 1 , 2 , 3 0 ] P ( e ( e ( x , y ) , e ( e ( y , e ( e ( e ( z , u ) , e ( e ( u , e ( v , e ( v , e(e(v6,v7),e(e(v7,w),v6))))),z)),v)),x))). 42 ( h e a t - 1 ) [ h y p e r , 1 6 , 3 7 , 1 7 ] P ( e ( e ( e ( e ( x , y ) , e ( e ( y , z ) , x ) ) , e(e(e(u,v),e(e(v,e(w,e(v6,e(e(v7,v8),e(e(v8,v6),v7))))),u)), w)),z)). 58 [ h y p e r , 1 , 2 0 , 4 2 ] P ( e ( e ( x , e ( e ( x , y ) , e ( z , e ( e ( u , v ) , e(e(v,z),u))))),e(y,e(w,e(e(v6,v7).e(e(v7,w),v6)))))). 69 [ h y p e r , 1 , 5 8 , 2 4 ] P ( e ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( z , x ) , y ) ) ) , u ) , u ) , e(v,e(e(w,v6),e(e(v6,v),«))))). 70 ( h e a t - 1 ) [ h y p e r , 1 6 , 1 7 , 6 9 ] P ( e ( e ( x , y ) , e ( e ( y , e(e(e(e(z,e(e(u,v),e(e(v,z),u))),w),w),e(v6,e(e(v7,v8), e(e(v8,v6),v7))))),x)». 77 [ h y p e r , 1 , 2 4 , 6 9 ] P ( e ( e ( e ( x , y ) , e ( e ( y , e ( e ( e ( z , e ( e ( u , v ) , e(e(v,z),u))),w),w)),x)),e(v6,e(e(v7,v8),e(e(v8,v6),v7))))). 78 [ h y p e r , 1 , 3 0 , 7 0 ] P ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( z , x ) , y ) ) ) , u ) , u ) ) . 102 [ h y p e r , 1 , 2 1 , 7 7 ] P ( e ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( z , x ) , y ) ) ) , e(e(e(u,e(e(v,w),e(e(w,u),v))),v6),v6)),v7),v7)). 103 ( h e a t - 1 ) [ h y p e r , 1 6 , 1 0 2 , 1 7 ] P ( e ( e ( x , y ) , e ( e ( y , e ( e ( z , e ( e ( u , v ) , e(e(v,z),u))),e(e(e(w,e(e(v6,v7),e(e(v7,w),v6))),v8),v8))),x))).
Searching for Circles of Pure Proofs
1413
105 [hyper,1,42,78] P ( e ( e ( e ( e ( x , y ) , z ) , e ( y , e ( u , e ( e ( v , w ) , e(e(w,u),v))))),e(z,x))). 202 [hyper,1,20,105] P ( e ( e ( x , e ( e ( y , z ) , e ( e ( z , e ( u , x ) ) , y ) ) ) , u ) ) . 204 [hyper,1,105,103] P ( e ( e ( e ( e ( e ( x , e ( e ( y , z ) , e(e(z,x),y))),u),u),v).e(e(v,v6),e(e(v6,v),v)))). 871 [hyper,1,105,204] P ( e ( x , e ( e ( y , e ( e ( z , u ) , e ( e ( u , y ) , z ) ) ) , e(e(e(v,w),e(e(w.e(v6,x)),v)),v6)))). 9777 [hyper,1,202,871] P(e(e(e(x,y),z),e(y,e(z,x)))). 9778 [binary,9777.1,6.1] $ANSWER(P4_UM). P4 implies P5 > UNIT CONFLICT at 0.31 sec > 19 [binary,18.1,7.1] $ANSWER(P5_XGF). Length of proof is 1. Level of proof is 1. PROOF 1 [] -P(e(x,y)) | -P(x) | P(y). 2 [] P(e(e(e(x,y),z),e(y,e(z,x)))).
7 [] - P ( e ( a , e ( e ( b , e ( a , c ) ) , e ( c , b ) ) ) ) I $ANSWER(P5_XGF). 18 [hyper,1,2,2] P(e(x,e(e(y,e(x,z)),e(z,y)))). 19 [binary,18.1,7.1] $ANSWER(P5_XGF). P5 implies PYM > UNIT CONFLICT at 350.31 sec > 10267 [binary,10266.1,12.1] $ANSWER(PYM). Length of proof is 32. Level of proof is 14. PROOF 1 [] -P(e(x,y)) I -P(x) I P(y). 2 [] P(e(x,e(e(y,e(x,z)),e(z,y)))).
12 [] - P ( e ( e ( e ( a , e ( b , c ) ) , b ) , e ( c , a ) ) ) 16 [] - P ( e ( x , y ) ) I -P(x) I P(y).
I $ANSWER(PYM).
17 [] P(e(x,e(e(y,e(x,z)),e(z,y)))). 18 [hyper,1,2,2] P ( e ( e ( x , e ( e ( y , e ( e ( z , e ( y , u ) ) , e ( u , z ) ) ) , v ) ) , e ( v , x ) ) ) . 19 (heat-1) [hyper,16,17,18] P ( e ( e ( x , e ( e ( e ( y , e(e(z,e(e(u,e(z,v)),e(v,u))),w)),e(w,y)),v6)),e(v6,x))). 20 [hyper,1,18,18] P ( e ( x , e ( x , e ( e ( y , e ( e ( z , e ( y , u ) ) , e ( u , z ) ) ) , e(v,e(e(w,e(v,v6)),e(v6,w))))))). 21 (heat-1) [hyper,16,17,20] P ( e ( e ( x , e ( e ( y , e ( y , e ( e ( z , e ( e ( u , e (z, v)) ,e(v , u ) ) ) , e(w,e(e (v6, e(w, v7)) , e(v7,v6)))))),v8)),e(v8,x))). 26 [hyper,1,19,2] P ( e ( e ( x , e ( x , e ( e ( y , e ( e ( z , e ( y , u ) ) , e(u,z))),v))),v)). 29 [hyper,1,18,20] P ( e ( e ( e ( x , e ( e ( y , e ( x , z ) ) , e ( z , y ) ) ) ,
1414
Collected Works of Larry Wos
e(u,e(e(v,e(u,w)),e(w,v)))),e(v6,e(e(v7,e(v6,v8)),e(v8,v7))))) 30 [hyper,1,21,2] P ( e ( e ( e ( e ( x , e ( e ( y , e ( x , z ) ) , e ( z , y ) ) ) , e(u,e(e(v,e(u,w)),e(w,v)))),v6),v6)). 32 (heat-1) [hyper,16,30,17] P ( e ( e ( x , e ( e ( e ( y , e ( e ( z , e ( y , u ) ) , e(u,z))),e(v,e(e(w,e(v,v6)),e(v6,w)))),v7)),e(v7,x))). 35 [hyper,1,18,26] P ( e ( x , e ( y , e ( y , e ( e ( z , e ( e ( u , e ( z , v ) ) , e ( v , u ) ) ) , e(e(w,e(e(v6,e(w,v7)),e(v7,v6))),x)))))). 36 (heat-1) [hyper,16,17,35] P ( e ( e ( x , e ( e ( y , e ( z , e ( z , e(e(u,e(e(v,e(u,w)),e(w,v))),e(e(v6,e(e(v7,e(v6,v8)), e(v8,v7))),y))))).v9)),e(v9,x))). 48 [hyper,1,26,29] P ( e ( e ( e ( e ( x , e ( y , z ) ) , e ( z , x ) ) , e(u,e(e(v,e(u,w)),e(w,v)))),y)). 50 [hyper,1,18,30] P ( e ( x , e ( e ( e ( y , e ( e ( z , e ( y , u ) ) , e ( u , z ) ) ) , e(v,e(e(w,e(v,v6)),e(v6,w)))),e(e(v7,e(e(v8,e(v7,v9)), e(v9,v8))),x)))). 60 [hyper,1,18,35] P ( e ( e ( e ( x , e ( e ( y , e ( x , z ) ) , e ( z , y ) ) ) , e(e(u,e(e(v,e(u,w)),e(w,v))),e(e(v6,e(e(v7,e(v6,v8)), e(v8,v7))),v9))),v9)). 62 [hyper,1,36,2] P ( e ( e ( e ( x , e ( e ( y , e ( e ( z , e ( y , u ) ) , e ( u , z ) ) ) , e(e(v,e(e(v,e(v,v6)),e(v6,w))),v7))),v7),x)). 63 (heat-1) [hyper,16,17,62] P ( e ( e ( x , e ( e ( e ( e ( y , e (e(z, e ( e ( u , e ( z , v) ) , e ( v , u ) ) ) , e (e(w,e(e(v6,e(w,v7)) , e(v7,v6))),v8))),v8),y),v9)),e(v9,x))). 95 [hyper,1,32,50] P(e(e(e(x,e(e(y,e(x,z)),e(z,y))),u),u)). 104 [hyper,1,60,18] P(e(e(e(x,e(e(y,e(z,e(e(u,e(z,v)), e(v,u)))),w)),e(w,x)),y)). 124 [hyper,1,62,48] P(e(e(x,e(e(e(e(y,z),u),e(z,e(u,y))),v)), e(v,x))).
126 (heat-1) [hyper,16,124,17] P ( e ( e ( e ( x , y ) , e ( e ( y , z ) , x ) ) , z ) ) . 127 [hyper,1,63,2] P ( e ( e ( x , e ( e ( e ( y , x ) , e ( e ( z , e ( e ( u , e ( z , v ) ) , e(v,u))),e(e(w,e(e(v6,e(w,v7)),e(v7,v6))),v8))),v8)),y)). 143 [hyper,1,95,126] P ( e ( e ( e ( x , y ) , y ) , x ) ) . 148 [hyper,1,2,126] P ( e ( e ( x , e ( e ( e ( e ( y , z ) , e ( e ( z , u ) , y ) ) , u ) , v ) ) , e(v,x))). 154 [hyper,1,104,127] P ( e ( e ( e ( e ( e ( x , y ) , z ) , e ( y , e ( z , x ) ) ) , u ) , u ) ) . 177 [hyper,1,124,143] P ( e ( x , e ( e ( e ( e ( e ( e ( y , z ) , u ) , e(z,e(u,y))),x),v),v))). 222 [hyper,1,60,154] P ( e ( e ( e ( x , y ) , y ) , x ) ) . 230 (heat-1) [hyper,16.17,222] P ( e ( e ( x , e ( e ( e ( e ( y , z ) , z ) , y ) , u ) ) , e(u,x))). 338 [hyper,1,148,177] P ( e ( x , e ( e ( e ( y , e ( z , u ) ) , x ) , e ( e ( u . y ) , z ) ) ) ) . 345 (heat-1) [hyper.16,17,338] P ( e ( e ( x , e ( e ( y . e ( e ( e ( z , e ( u . v ) ) , y ) , e(e(v,z),u))),w)),e(w,x))). 1206 [hyper,1,230,338] P ( e ( e ( e ( x , e ( y , e ( z , x ) ) ) , z ) , y ) ) .
Searching for Circles of Pure Proofs
1415
1227 (heat-=l) [hyper,16,17,1206] P(e(e(x,e(e(e(e(y,e(z,e(u,y))), u),z),v)),e(v,x))). 1280 [hyper,1,345,222] P(e(x,e(e(e(e(y,e(e(e(z,e(u,v)),y), e(e(v,z),u))),x).w),v))). 10266 [hyper,1,1227,1280] P(e(e(e(x,e(y,z)),y),e(z,x))). 10267 [binary,10266.1,12.1] $ANSWER(PYM). PYM implies XGK > UNIT CONFLICT at 81.43 sec > 3562 [binary,3561.1,13.1] $ANSWER(XGK). Length of proof is 23. Level of proof is 11. pR00F 1 [] -P(e(x,y)) I -P(x) I P(y). 2 [] P(e(e(e(x,e(y,z)),y),e(z,x))).
13 [] - P ( e ( a , e ( e ( b , e ( c , a ) ) , e ( c , b ) ) ) ) I $ANSWER(XGK). 16 [] -P(e(x,y)) I -P(x) I P(y). 17 [] P ( e ( e ( e ( x , e ( y , z ) ) , y ) , e ( z , x ) ) ) . 18 [hyper,1,2,2] P ( e ( x , e ( y , e ( e ( e ( z , y ) , x ) , z ) ) ) ) . 19 (heat=l) [hyper,16,18,17] P ( e ( x , e ( e ( e ( y , x ) , e ( e ( e ( z , e ( u , v ) ) , u ) , e(v,z))),y))). 23 [hyper,1,19,18] P ( e ( e ( e ( x , e ( y , e ( z , e ( e ( e ( u , z ) , y ) , u ) ) ) ) , e(e(e(v,e(w,v6)),w),e(v6,v))),x)). 24 [hyper,1,19,2] P ( e ( e ( e ( x , e ( e ( e ( y , e ( z , u ) ) , z ) , e ( u , y ) ) ) , e(e(e(v,e(w,v6)).w),e(v6,v))),x)). 26 (heat-1) [hyper,16,23,17] P ( e ( e ( x , y ) , e ( e ( z , e ( u , e ( e ( e ( v , u ) , z ) , v))),e(e(y,e(w,x)),w)))). 27 (heat-1) [hyper,16,17,24] P ( e ( e ( x , y ) , e ( e ( e ( y , e ( z , x ) ) , z ) , e(e(e(u,e(v,w)),v),e(w,u))))). 41 [hyper,1,24,23] P ( e ( e ( e ( e ( x , e ( y , z ) ) , y ) , e ( z , x ) ) , e(u,e(v,e(e(e(w,v),u),w))))). 49 [hyper,1,26,18] P ( e ( e ( x , e ( y , e ( e ( e ( z , y ) , x ) , z ) ) ) , e(e(e(u,e(e(e(v,u),w),v)),e(v6,w)),v6))). 51 (heat-1) [hyper,16,17,49] P ( e ( e ( e ( e ( x , e ( e ( e ( y , e(e(e(z,y),u),z)),e(v,u)),v)),w),x),w)). 53 [hyper,1,24,27] P ( e ( e ( e ( x , y ) , e ( z , e ( e ( y , e ( u , x ) ) , u ) ) ) , z ) ) . 54 [hyper,1,23,27] P ( e ( e ( e ( x , e ( e ( e ( y , x ) , z ) , y ) ) , e ( u , z ) ) , u ) ) . 55 [hyper,1,27,18] P ( e ( e ( e ( e ( x , e ( e ( e ( y , x ) , z ) , y ) ) , e ( u , z ) ) , u ) , e(e(e(v,e(w,v6)),w),e(v6,v)))). 56 [hyper,1,27,2] P ( e ( e ( e ( e ( x , y ) , e ( z , e ( e ( y , e ( u , x ) ) , u ) > ) , z ) , e(e(e(v,e(w,v6)),w),e(v6,v)))). 84 [hyper,1,51,54] P ( e ( e ( e ( e ( x , y ) , z ) , x ) , e ( y , z ) ) ) . 89 [hyper,1,53,55] P ( e ( e ( x , e ( y , e ( z , e ( x , e ( e ( u , e ( e ( e ( v , u ) , w ) , v ) ) , e(z,w)))))),y)).
1416
Collected Works of Larry Wos
90 (heat-1) [hyper,16,17,89] P ( e ( e ( x , e ( y , e ( e ( z , e ( e ( e ( u , z ) , v ) , u ) ) , e(x,v)))),y)). 91 [hyper,1,53,56] P ( e ( e ( x , e ( y , e ( z , e ( x , e ( e ( u , v ) , e(z,e(e(v,e(w,u)),w))))))),y)). 118 [hyper,1,84,41] P ( e ( x , e ( e ( e ( e ( y , x ) , z ) , y ) , z ) ) ) . 307 [hyper,1,91,118] P ( e ( e ( e ( x , y ) , e ( z , e ( y , e ( e ( u , v ) , e(z,e(e(v,e(w,u)),w)))))),x)). 308 [hyper,1,90,118] P ( e ( e ( e ( x , y ) , e ( e ( z , e ( e ( e ( u , z ) , v ) , u ) ) , e(y,v))),x)). 322 (heat-1) [hyper,16,17,307] P ( e ( e ( x , e ( e ( y , z ) , e(u,e(e(z,e(v,y)),v)))),e(u,x))). 325 (heat-1) [hyper,16,308,17] P ( e ( e ( x , y ) , e ( x , e ( z , e ( e ( e ( u , z ) , y ) , u))))). 3561 [hyper,1,322,325] P(e(x,e(e(y,e(z,x)),e(z,y)))). 3562 [binary,3561.1,13.1] $ANSWER(XGK). XGK implies PYO > UNIT CONFLICT at 205.36 sec > 3496 [binary,3495.1,11.1] $ANSWER(PYO). Length of proof is 10. Level of proof is 8. p R0 0F 1 [] -P(e(x,y)) I -P(x) I P(y). 2 [] P(e(x,e(e(y,e(z,x)),e(z,y)))).
11 [] - P ( e ( e ( e ( a , e ( b , c ) ) , c ) , e ( b , a ) ) ) | $ANSWER(PY0). 16 [] -P(e(x,y)) I -P(x) I P(y). 17 [] P ( e ( x , e ( e ( y , e ( z , x ) ) , e ( z , y ) ) ) ) . 18 [hyper,1,2,2] P(e(e(x,e(y,e(z,e(e(u,e(v,z)),e(v,u))))),e(y,x))). 20 (heat-1) [hyper.16,18,17] P(e(e(e(e(x,e(y,z)),e(y,x)), e(z,u)),u)). 24 [hyper,1,18,20] P(e(x,e(e(e(y,e(z,u)),e(z,y)),
e(u,e(x,e(v,e(e(w,e(v6,v)),e(v6,w)))))))). 27 [hyper,1,20,18] P ( e ( e ( x , e ( e ( y , e ( z , x ) ) , e ( z , y ) ) ) , e ( u , u ) ) ) . 30 (heat-1) [hyper,16,17,27] P ( e ( e ( x , e ( y , e ( e ( z , e ( e ( u , e ( v , z ) ) , e(v,u))),e(w,w)))),e(y,x))). 38 [hyper,1,18,24] P ( e ( e ( e ( x , e ( y , z ) ) , e ( y , x ) ) , e ( e ( e ( u , e ( v , w ) ) , e(v,u)),e(w,z)))). 86 [hyper,1,30,2] P ( e ( e ( e ( x , x ) , e ( e ( y , e ( e ( z , e ( u , y ) ) , e ( u . z ) ) ) , v ) ) , v)). 89 (heat-1) [hyper,16,17,86] P ( e ( e ( x , e ( y , e ( e ( e ( z , z ) , e(e(u,e(e(v,e(w,u)),e(w,v))),v6)),v6))),e(y,x))). 542 [hyper,1,89,2] P ( e ( e ( x , e ( e ( e ( y , y ) , e ( e ( z , e ( e ( u , e ( v , z ) ) , e(v,u))),x)),w)),w)). 3495 [hyper,1,542,38] P ( e ( e ( e ( x , e ( y , z ) ) , z ) , e ( y , x ) ) ) .
Searching for Circles of Pure Proofs
1417
3496 [binary,3495.1,11.1] $ANSWER(PYO). XGK implies PY) > UNIT CONFLICT at 3442.39 sec > 79194 [binary,79193.1,10.1] $ANSWER(P9_YR0). Length of proof is 50. Level of proof is 23. PROOF 1 [] -P(e(x,y)) I -P(x) I P(y). 2 [] P(e(e(e(x,e(y,z)),z),e(y,x))).
10 [] - P ( e ( e ( a , b ) , e ( c , e ( e ( c , b ) , a ) ) ) ) I $ANSWER(P9_YR0). 16 [] -P(e(x,y)) I -P(x) I P(y). 17 [] P ( e ( e ( e ( x , e ( y , z ) ) , z ) , e ( y , x ) ) ) . 18 [hyper,1,2,2] P ( e ( x , e ( y , e ( z , e ( x , e ( z , y ) ) ) ) ) ) . 19 (heat-1) [hyper,16,18,17] P ( e ( x , e ( y , e ( e ( e ( e ( z , e ( u , v ) ) , v ) , e(u,z)),e(y,x))))). 20 [hyper,1,18,18] P ( e ( x , e ( y , e ( e ( z , e ( u , e ( v , e ( z , e ( v , u ) ) ) ) ) , e(y,x))))). 21 (heat-1) [hyper,16,20,17] P ( e ( x , e ( e ( y , e ( z , e ( u , e ( y , e ( u , z ) ) ) ) ) , e(x,e(e(e(v,e(w,v6)),v6),e(v,v)))))). 25 [hyper,1,19,2] P ( e ( x , e ( e ( e ( e ( y , e ( z , u ) ) , u ) , e ( z , y ) ) , e(x,e(e(e(v,e(w,v6)),v6),e(w,v)))))). 37 [hyper,1,21,18] P ( e ( e ( x , e ( y , e ( z , e ( x , e ( z , y ) ) ) ) ) , e(e(u,e(v,e(w,e(u,e(w,v))))),e(e(e(v6,e(v7,v8)),v8),e(v7,v6))))). 39 (heat-1) [hyper,16,17,37] P ( e ( x , e ( e ( x , e ( e ( y , e ( z , e ( u , e(y.e(u,z))))),v)),v))). 47 [hyper,1,39,18] P ( e ( e ( e ( x , e ( y , e ( z , e ( x , e ( z , y ) ) ) ) ) , e(e(u,e(v,e(w,e(u,e(w,v))))),v6)),v6)). 53 (heat-1) [hyper,16,17,47] P(e(e(x,e(y,e(z,e(x,e(z,y))))), e(u,e(v,e(w,e(u,e(w,v))))))). 74 [hyper,1,2,53] P(e(e(x,e(x,y)),y)). 75 (heat-1) [hyper,16,17,74] P(e(x,x)). 103 [hyper,1,74,18] P(e(x,e(y,e(x,y)))). Ill [hyper,1,103,103] P(e(x,e(e(y,e(z,e(y,z))),x))). 119 [hyper,1,103,75] P(e(x,e(e(y,y),x))). 128 [hyper,1,103,18] P(e(x,e(e(y,e(z,e(u,e(y,e(u,z))))),x))). 152 [hyper,1,119,103] P(e(e(x,x),e(y,e(z,e(y,z))))). 153 [hyper,1,119,75] P(e(e(x,x),e(y,y))).
154 170 171 172 357 363
[hyper,1,119,74] P ( e ( e ( x , x ) , e ( e ( y , e ( y , z ) ) , z ) ) ) . (heat-1) [hyper,16,17,152] P ( e ( x , e ( x , e ( y , e ( z , e ( y , z ) ) ) ) ) ) . (heat-1) [hyper,16,17,153] P ( e ( x , e ( x , e ( y , y ) ) ) ) . (heat-1) [hyper,16,17,154] P ( e ( x , e ( x , e ( e ( y , e ( y , z ) ) , z ) ) ) ) . [hyper,1,111,171] P ( e ( e ( x , e ( y , e ( x , y ) ) ) , e ( z , e ( z , e ( u , u ) ) ) ) ) . [hyper,1,111,74] P ( e ( e ( x , e ( y , e ( x , y ) ) ) , e ( e ( z , e ( z , u ) ) , u ) ) ) .
Collected Works of Larry Wos
1418
384 389 441 511 824
(heat-1) [hyper,16,17,357] P ( e ( e ( x , e ( y , y ) ) , x ) ) . (heat-1) [hyper,16,17,363] P ( e ( x , e ( y , e ( y , x ) ) ) ) . [hyper,1,384,25] P ( e ( e ( e ( x , y ) , e ( e ( e ( y , e ( x , z ) ) , z ) , u ) ) , u ) ) . [hyper,1,389,389] P ( e ( x , e ( x , e ( y , e ( z , e ( z , y ) ) ) ) ) ) . [hyper,1,111,170] P ( e ( e ( x , e ( y , e ( x , y ) ) ) , e ( z , e ( z , e(u,e(v,e(u,v))))))). 863 ( h e a t - 1 ) [ h y p e r , 1 6 , 1 7 , 8 2 4 ] P ( e ( e ( x , e ( y , e ( z , e ( y , z ) ) ) ) , x ) ) . 887 [ h y p e r , 1 , 1 1 1 , 1 7 2 ] P ( e ( e ( x , e ( y , e ( x , y ) ) ) , e ( z , e ( z , e(e(u,e(u,v)),v))))). 927 ( h e a t - 1 ) [ h y p e r , 1 6 , 1 7 , 8 8 7 ] P ( e ( e ( x , e ( e ( y , e ( y , z ) ) , z ) ) , x ) ) . 3064 [ h y p e r , 1 , 1 1 1 , 5 1 1 ] P ( e ( e ( x , e ( y , e ( x , y ) ) ) , e ( z , e ( z , e ( u , e(v,e(v,u))))))). 3116 ( h e a t = l ) [ h y p e r , 1 6 , 1 7 , 3 0 6 4 ] P ( e ( e ( x , e ( y , e ( z , e ( z , y ) ) ) ) , x ) ) . 3420 [ h y p e r , 1 , 8 6 3 , 2 ] P ( e ( e ( e ( x , e ( y , x ) ) , e ( y , z ) ) , z ) ) . 3464 [ h y p e r , 1 . 9 2 7 , 2 ] P ( e ( e ( x , e ( e ( y , e ( y , x ) ) , z ) ) , z ) ) . 4424 [ h y p e r , 1 , 3 1 1 6 , 2 ] P ( e ( e ( e ( x , e ( x , y ) ) , e ( y , z ) ) , z ) ) . 4641 [ h y p e r , 1 , 1 1 1 , 3 4 6 4 ] P ( e ( e ( x , e ( y , e ( x , y ) ) ) , e ( e ( z , e(e(u,e(u,z)),v)),v))). 4649 [ h y p e r , 1 , 3 4 6 4 , 1 8 ] P ( e ( x , e ( y , e ( x , e ( z , e ( z , y ) ) ) ) ) ) . 4674 ( h e a t = l ) [ h y p e r , 1 6 , 1 7 , 4 6 4 1 ] P ( e ( x , e ( y , e ( e ( z , e ( z , y ) ) , x ) ) ) ) . 5812 [ h y p e r , 1 , 4 4 2 4 , 4 6 4 9 ] P ( e ( e ( x , e ( x , y ) ) , e ( z , e ( z , y ) ) ) ) . 5973 [ h y p e r , 1 , 3 4 2 0 , 4 6 7 4 ] P ( e ( e ( x , e ( x , y ) ) , e ( z , e ( y , z ) ) ) ) . 16888 [ h y p e r , 1 , 4 4 1 , 5 9 7 3 ] P ( e ( x , e ( e ( e ( y , x ) , e ( y , z ) ) , z ) ) ) . 16893 [ h y p e r , 1 , 4 4 1 , 5 8 1 2 ] P ( e ( e ( e ( e ( x , y ) , e ( x , z ) ) , z ) , y ) ) . 16926 ( h e a t - 1 ) [ h y p e r , 1 6 , 1 7 , 1 6 8 9 3 ] P ( e ( x , e ( e ( y , z ) , e ( y , e ( x , z ) ) ) ) ) . 17658 [ h y p e r , 1 , 1 2 8 , 1 6 8 8 8 ] P ( e ( e ( x , e ( y , e ( z , e ( x , e ( z , y ) ) ) ) ) , e(u,e(e(e(v,u),e(v,u)),w)))). 17874 ( h e a t - 1 ) [ h y p e r , 1 6 , 1 7 , 1 7 6 5 8 ] P ( e ( x , e ( e ( y , z ) , e ( y , e ( z , x ) ) ) ) ) . 19456 [hyper,1,441,16926] P ( e ( e ( x , e ( y , z ) ) , e ( e ( y , x ) , z ) ) ) . 24676 [hyper,1,441,17874] P ( e ( e ( x , e ( y , z ) ) , e ( z , e ( y , x ) ) ) ) . 36056 [hyper,1,19456,16926] P ( e ( e ( e ( x , y ) , z ) , e ( x , e ( z , y ) ) ) ) . 79193 [hyper,1,24676,36056] P ( e ( e ( x , y ) , e ( z , e ( e ( z , y ) , x ) ) ) ) . 79194 [ b i n a r y , 7 9 1 9 3 . 1 , 1 0 . 1 ] $ANSWER(P9_YR0). P9 i m p l i e s XHK > UNIT CONFLICT a t 1469.51 s e c > 24535 [ b i n a r y , 2 4 5 3 4 . 1 , 1 4 . 1 ] $ANSWER(XHK). Length of proof i s 19. Level of proof i s 10. PR00F
1 [] - P ( e ( x , y ) ) I - P ( x ) | P ( y ) . 2 [] P ( e ( e ( x , y ) , e ( z , e ( e ( z , y ) , x ) ) ) ) . 14 [] - P ( e ( a , e ( e ( b , c ) , e ( e ( a , c ) , b ) ) ) ) I $ANSWER(XHK). 16 [] - P ( e ( x , y ) ) I - P ( x ) I P ( y ) . 17 [] P ( e ( e ( x , y ) , e ( z , e ( e ( z , y ) , x ) ) ) ) .
Searching for Circles of Pure Proofs
1419
18 [hyper,1,2,2] P ( e ( x , e ( e ( x , e ( y , e ( e ( y , z ) , u ) ) ) , e ( u , z ) ) ) ) . 19 (heat-1) [hyper,16,17,18] P ( e ( x , e ( e ( x , e ( e ( y , e ( z , e ( e ( z , u ) , v ) ) ) , e(v,u))),y))). 20 (heat-1) [hyper, 16,18,17] P ( e ( e ( e ( e ( x , y ) , e ( z , e ( e ( z , y ) , x ) ) ) , e(u,e(e(u,v),w))),e(w,v))). 23 [hyper,1,19,2] P ( e ( e ( e ( e ( x , y ) , e ( z , e ( e ( z , y ) , x ) ) ) , e(e(u,e(v,e(e(v,w),v6))),e(v6,v))),u)). 25 [hyper,1,20,20] P(e(e(e(e(e(x,y),z),y),x),z)). 27 (heat-1) [hyper,16,17,25] P(e(x,e(e(x,y),e(e(e(e(z,u),y),u), z)))). 29 [hyper,1,18,25] P(e(e(e(e(e(e(e(x,y),z),y),x),z), e(u,e(e(u,v),w))),e(w,v))). 30 (heat-1) [hyper,16,17,29] P(e(x,e(e(x,e(y,z)), e(e(e(e(e(e(u,v),w),v),u),w),e(v6,e(e(v6,z),y)))))). 33 [hyper,1,27,27] P(e(e(e(x,e(e(x,y),e(e(e(e(z,u),y),u),z))),v), e(e(e(e(w,v6),v),v6),w))). 47 [hyper,1,23,29] P(e(e(e(e(x,e(e(x,y),z)),u),e(z,y)),u)). 51 [hyper,1,29,30] P(e(e(x,e(e(x,y),e(z,y))),z)). 52 (heat-1) [hyper,16,17,51] P(e(x,e(e(x,y),e(z,e(e(z,u), e(y,u)))))). 57 [hyper,1,33,29] P(e(e(e(e(x,y),e(e(e(e(e(z,u),v),u),z),v)), y),x)). 155 [hyper,1,52,2] P(e(e(e(e(x,y),e(z,e(e(z,y),x))),u), e(v,e(e(v,w),e(u,w))))). 195 [hyper,1,57,51] P(e(e(x,y),e(y,x))). 204 (heat-1) [hyper,16,17,195] P(e(x,e(e(x,e(y,z)),e(z,y)))). 792 [hyper,1,51,155] P(e(e(e(e(e(x,y),e(z,e(e(z,y),x))),u), e(u,v)),v)). 1424 [hyper,1,204,47] P(e(e(e(e(e(e(x,e(e(x,y),z)),u), e(z,y)),u),e(v,w)),e(w,v))). 24534 [hyper,1,1424,792] P(e(x,e(e(y,z),e(e(x,z),y)))). 24535 [binary,24534.1,14.1] $ANSWER(XHK). XHK implies P7 > UNIT CONFLICT at 78273.10 sec > 98394 [binary,98393.1,8.1] $ANSWER(P7_WN). Length of proof is 39. Level of proof is 25. PROOF 1 [] -P(e(x,y)) I -P(x) I P(y). 2 [] P(e(x,e(e(y,z),e(e(x,z),y)))). 8 [] -P(e(e(a,e(b,c)),e(c,e(a,b)))) | $ANSWER(P7_WN). 16 [] -P(e(x,y)) I -P(x) | P(y). 17 [] P(e(x,e(e(y,z),e(e(x,z),y)))).
1420
Collected Works of Larry Wos
18 [hyper,1,2,2] P ( e ( e ( x , y ) , e ( e ( e ( z , e ( e ( u , v ) , e ( e ( z , v ) , u ) ) ) , y ) , x ) ) ) . 19 (heat-1) [hyper,16,17,18] P ( e ( e ( x , y ) , e ( e ( e ( e ( z , u ) , e(e(e(v,e(e(w,v6),e(e(v,v6),w))),u),z)),y),x))). 20 (heat-1) [hyper,16,18,17] P ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( x , z ) , y ) ) ) , e(e(u,v),e(e(w,v),u))),w)). 21 [hyper,1,18,18] P ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( x , z ) , y ) ) ) , e(e(e(u,e(e(v,w),e(e(uIw),v))),v6),v7)),e(v7,v6))). 27 [hyper,1,19,18] P ( e ( e ( e ( e ( x , y ) , e ( e ( e ( z , e ( e ( u , v ) , e(e(z,v),u))),y),x)),e(e(e(w,e(e(v6,v7),e(e(w,v7),v6))),v8), v9)),e(v9,v8))). 35 (heat«l) [hyper,16,27,17] P ( e ( e ( e ( e ( e ( x , y ) , e ( e ( e ( z , e ( e ( u , v ) , e(e(z,v),u))),y),x)),w),e(v6,e(e(v7,v8),e(e(v6,v8),v7)))),w)). 47 [hyper,1,21,20] P ( e ( e ( e ( x , y ) , e ( e ( e ( e ( z , e ( e ( u , v ) , e(e(z,v),u))),w),y),x)),w)). 56 [hyper,1,35,47] P ( e ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( x , z ) , y ) ) ) , e(u,e(e(v,w),e(e(u,w),v)))),e(e(e(v6,e(e(v7,v8), e(e(v6,v8),v7))),v9),vl0)),e(vl0,v9))). 67 [hyper,1,56,21] P ( e ( x , e ( e ( e ( e ( y , e ( e ( z , u ) , e ( e ( y , u ) , z ) ) ) , x ) , e(e(v,w),e(e(v6,w),v))),v6))). 74 [hyper,1,67,47] P ( e ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( x , z ) , y ) ) ) . e(e(e(u,v),e(e(e(e(w,e(e(v6,v7),e(e(w,v7),v6))),v8),v),u)), v8)),e(e(v9,vl0),e(e(vll,vl0),v9))),vll)). 81 [hyper,1,20,74] P ( e ( e ( e ( x , y ) , e ( e ( z , e ( e ( u , v ) , e(e(z,v),u))),x)),y)). 93 [hyper,1,67,81] P ( e ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( x , z ) , y ) ) ) , e(e(e(u,v),e(e(w,e(e(v6,v7),e(e(w,v7),v6))),u)),v)), e(e(v8,v9),e(e(vl0,v9),v8))),vl0)). 97 [hyper,1,81,47] P ( e ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( x , z ) , y ) ) ) , e(e(u,e(e(v,w),e(e(u,w),v))),e(v6,v7))),v7),v6)). 107 [hyper,1,20,93] P ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( u , z ) , y ) ) ) , u ) , x ) ) . 117 [hyper,1,107,107] P ( e ( x , e ( e ( y , z ) , e ( e ( e ( e ( u , v ) , e(e(x,v),u)),z),y)))). 136 [hyper,1,18,117] P ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( x , z ) , y ) ) ) , e(e(u,v),e(e(e(e(w,v6),e(e(v7,v6),w)),v),u))),v7)). 156 [hyper,1,97,136] P ( e ( e ( e ( x , y ) , e ( e ( z , y ) , x ) ) , e ( e ( u , v ) , e(e(z,v),u)))). 175 [hyper,1,107,156] P(e(e(e(e(e(x,y),e(e(z,y),x)),u),z),u)). 176 [hyper,1,81,156] P(e(e(x,y),e(x,e(e(z,u),e(e(y,u),z))))). 188 [hyper,1,107,175] P(e(e(e(x,y),e(e(e(e(z,u),e(e(v,u),z)),y), x)),v)). 279 [hyper,1,176,188] P(e(e(e(x,y),e(e(e(e(z,u),e(e(v,u),z)),y), x)),e(e(w,v6),e(e(v,v6),w)))). 280 [hyper,1,175,188] P(e(e(e(e(x,y),e(e(z,y),x)),e(e(z,u),v)),
Searching for Circles of Pure Proofs
1421
e(v,u))). 295 [hyper,1,280,280] P ( e ( e ( e ( x , y ) , x ) , y ) ) . 304 [hyper,1,280,176] P ( e ( e ( e ( x , y ) , e ( e ( e ( e ( z , u ) , z ) , y ) , x ) ) , u ) ) . 328 [hyper,1,295,280] P ( e ( e ( x , e ( e ( x , y ) , z ) ) , e ( z , y ) ) ) . 380 [hyper.1,107,304] P ( e ( e ( e ( x , y ) , e ( e ( z , x ) , z ) ) , y ) ) . 385 [hyper,1,81,328] P ( e ( e ( x , x ) , e ( y , e ( e ( z , u ) , e ( e ( y , u ) , z ) ) ) ) ) . 388 [hyper,1,176,380] P ( e ( e ( e ( x , y ) , e ( e { z , x ) , z ) ) , e ( e ( u , v ) , e(e(y,v),u)))). 389 [hyper,1,380,328] P ( e ( e ( x , y ) , e ( y , x ) ) ) . 396 [hyper,1,328,385] P ( e ( e ( e ( x , y ) , e ( e ( e ( e ( z , z ) , u ) , y ) , x ) ) , u ) ) . 402 [hyper,1,389,388] P ( e ( e ( e ( x , y ) , e ( e ( z , y ) , x ) ) , e ( e ( u , z ) , e(e(v,u),v)))). 426 [hyper,1,107,396] P ( e ( e ( e ( x , y ) , e ( e ( z , z ) , x ) ) , y ) ) . 433 [hyper,1,295,402] P ( e ( e ( x , e ( e ( y , z ) , y ) ) , e ( z , x ) ) ) . 500 [hyper,1,389,433] P ( e ( e ( x , y ) , e ( y , e ( e ( z , x ) , z ) ) ) ) . 516 [hyper,1,433,280] P ( e ( x , e ( e ( e ( y , z ) , e ( e ( u , z ) , y ) ) , e(e(u,v),e(v,x))))). 686 [hyper,1,500,500] P ( e ( e ( x , e ( e ( y , z ) , y ) ) , e ( e ( u , e ( z , x ) ) , u ) ) ) . 5430 [hyper,1,426,279] P ( e ( e ( e ( e ( x , y ) , e ( e ( z , y ) , x ) ) , u ) , e ( z , u ) ) ) . 12201 [hyper,1,686,516] P ( e ( e ( x , e ( e ( e ( y , e ( z , u ) ) , e ( y , z » , u ) ) , x ) ) . 98393 [hyper,1,5430,12201] P ( e ( e ( x , e ( y , z ) ) , e ( z , e ( x , y ) ) ) ) . 98394 [binary,98393.1.8.1] $ANSWER(P7_WN). P7 implies P3 > UNIT CONFLICT at 14999.29 sec > 176939 [binary,176938.1,5.1] $ANSWER(P3_YQJ). Length of proof is 28. Level of proof is 14. PROOF 1 [] -P(e(x,y)) | -P(x) I P(y). 2 [] P(e(e(x,e(y,z)),e(z,e(x,y)))).
5 [] - P ( e ( e ( a , b ) , e ( e ( c , a ) , e ( b , c ) ) ) ) I $ANSWER(P3_YQJ). 27 [] -P(e(x,y)) I -P(x) I P(y). 28 [] P ( e ( e ( x , e ( y , z ) ) , e ( z , e ( x , y ) ) ) ) . 29 30 32 35 36
[hyper,1,2,2] P ( e ( e ( x , y ) , e ( e ( x , e ( y , z ) ) , z ) ) ) . (heat-1) [hyper,27,28,29] P ( e ( x , e ( e ( y , z ) , e ( y , e ( z , x ) ) ) ) ) . [hyper,1,29,29] P ( e ( e ( e ( x , y ) , e ( e ( e ( x , e ( y , z ) ) , z ) , u ) ) , u ) ) . [hyper,1,29,30] P ( e ( e ( x , e ( e ( e ( y , z ) , e ( y , e ( z , x ) ) ) , u ) ) , u ) ) . [hyper,1,30,29] P ( e ( e ( x , y ) , e ( x , e ( y , e ( e ( z , u ) , e(e(z,e(u,v)),v)))))). 41 (heat-1) [hyper,27,28,36] P ( e ( e ( x , e ( e ( y , z ) , e(e(y,e(z,u)),u))),e(e(v,x),v))). 80 [hyper,1.35,29] P ( e ( x , e ( e ( y , x ) , y ) ) ) . 87 [hyper,1,80,80] P ( e ( e ( x , e ( y , e ( e ( z , y ) , z ) ) ) , x ) ) .
1422
Collected Works of Larry Wos
201 [hyper,1,29,87] P ( e ( e ( e ( x , e ( y , e ( e ( z , y ) , z ) ) ) , e ( x , u ) ) , u ) ) . 216 (heat-1) [hyper,27,201,28] P ( e ( e ( e ( x , y ) , x ) , y ) ) . 238 [hyper,1,29,216] P ( e ( e ( e ( e ( x , y ) , x ) , e ( y , z ) ) , z ) ) . 241 [hyper,1,216,32] P ( e ( e ( e ( x , e ( y , z ) ) , z ) , e ( x , y ) ) ) . 255 (heat-1) [hyper,27,28,241] P ( e ( x , e ( e ( e ( y , e ( x , z ) ) , z ) , y ) ) ) . 1764 [hyper,1,29,41] P ( e ( e ( e ( x , e ( e ( y , z ) , e ( e ( y , e ( z , u ) ) , u ) ) ) . e(e(e(v,x),v),w)),w)). 1799 (heat-1) [hyper,27,1764,28] P ( e ( e ( x , y ) , e ( y , x ) ) ) . 1842 [hyper,1,29,1799] P ( e ( e ( e ( x , y ) , e ( e ( y , x ) , z ) ) , z ) ) . 1843 [hyper,1,2,1799] P ( e ( x , e ( e ( x , y ) , y ) ) ) . 1923 [hyper,1,1843,1799] P ( e ( e ( e ( e ( x , y ) , e ( y , x ) ) , z ) , z ) ) . 2068 [hyper,1,1799,238] P ( e ( x , e ( e ( e ( y , z ) , y ) , e ( z , x ) ) ) ) . 2096 (heat-1) [hyper,27,28,2068] P ( e ( e ( x , y ) , e ( y , e ( e ( z , x ) , z ) ) ) ) . 2935 [hyper,1,1799,255] P ( e ( e ( e ( e ( x , e ( y , z ) ) , z ) , x ) , y ) ) . 17269 [hyper,1,1799,1842] P ( e ( x , e ( e ( y , z ) , e ( e ( z , y ) , x ) ) ) ) . 17345 (heat-1) [hyper,27,28,17269] P ( e ( e ( e ( x , y ) , z ) , e ( z , e ( y , x ) ) ) ) . 25963 [hyper,1,1923,2096] P ( e ( e ( x , y ) , e ( e ( z , e ( y , x ) ) , z ) ) ) . 28685 [hyper,1,241,2935] P ( e ( e ( e ( e ( x , y ) , e ( y , z ) ) , z ) , x ) ) . 88894 [hyper,1,25963,28685] P ( e ( e ( x , e ( y , e ( e ( e ( y , z ) , e ( z , u ) ) , u ) ) ) , x ) ) . 89072 (heat-1) [hyper,27,88894,28] P ( e ( e ( e ( x , y ) , e ( y , z ) ) , e ( z , x ) ) ) . 176938 [hyper,1,17345,89072] P ( e ( e ( x , y ) , e ( e ( z , x ) , e ( y , z ) ) ) ) . 176939 [binary,176938.1,5.1] $ANSWER(P3_YQJ).
References 1. Kalman, J., A shortest single axiom for the classical equivalential calculus, Notre Dame J. Formal Logic 19 (1978), 141-144. 2. Kalman, J., Condensed detachment as a rule of inference, it Studia Logica 42 (1983), 443-451. 3. McCharen, J., Overbeek, R., and Wos, L., Complexity and related en hancements for automated theorem-proving programs, it Computers and Mathematics with Applications 2 (1976), 1-16. 4. McCune, W., and Wos, L., Experiments in automated deduction with condensed detachment, in D. Kapur (ed.), Proc. 11th Int. Con/, on Auto mated Deduction (CADE-11), Lecture Notes in Artificial Intelligence, 607, Springer-Verlag, New York, 1992, pp. 209-223. 5. McCune, W., OTTER 3.0, Preprint MCS-P399-1193, Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL, November 1993. 6. Peterson, J., Shortest single axioms for the equivalential calculus, Notre Dame J. Formal Logic 17 (1976), 267-271.
Searching for Circles of Pure Proofs
1423
7. Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., Questions concerning possible shortest single axioms in equivalential calculus: An application of automated theorem proving to infinite domains, Notre Dame J. Formal Logic 24 (1983), 205-223. 8. Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., A new use of an automated reasoning assistant: Open questions in equivalential calculus and the study of infinite domains, Artificial Intelligence 22 (1984), 303356. 9. Wos, L., Automated Reasoning: S3 Basic Research Problems, PrenticeHall: Englewood Cliffs, NJ, 1987. 10. Wos, L., Meeting the challenge of fifty years of logic, J. Automated Rea soning 6(2) (1990), 213-222. 11. Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: Introduction and Applications, 2nd edn., McGraw-Hill, New York, 1992. 12. Wos, L., Personal information, Argonne National Laboratory, 1994. 13. Wos, L., Automating the Search for Elegant Proofs: An Experimenter's Notebook, Academic Press, San Diego, CA, 1995 (to appear).
T h e Power of Combining Resonance with H e a t LARRY WOS* Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL 60439-4844, U.S.A. e-mail: [email protected] (Received: 13 March 1995; in final form: 5 June 1995) A b s t r a c t . In this article, I present experimental evidence of the value of com bining two strategies each of which has proved powerful in various contexts. The resonance strategy gives preference (for directing a program's reasoning) to equations or formulas that have the same shape (ignoring variables) as one of the patterns supplied by the researcher to be used as a resonator. The hot list strategy rearranges the order in which conclusions are drawn, the rearranging caused by immediately visiting and, depending on the value of the heat pa rameter, even immediately revisiting a set of input statements chosen by the researcher; the chosen statements are used to complete applications of inference rules rather than to initiate them. Combining these two strategies often enables an automated reasoning program to attack deep questions and hard problems with far more effectiveness than using either alone. The use of this combination in the context of cursory proof checking produced most unexpected and satisfy ing results, as I show here. I present the material (including commentary) in the spirit of excerpts from an experimenter's notebook, thus meeting the frequent request to illustrate how a researcher can make wise choices from among the numerous options offered by McCune's automated reasoning program OTTER. I include challenges and topics for research and, to aid the researcher, in the Appendix a sample input file and a number of intriguing proofs. Key words: automated reasoning, hot list strategy, resonance strategy, proof checking
1
T h e Value of Strategy and of a Chronicle of Experiments
When the object of one's research is the completion of a sought-after proof, one encounters the obstacle of deciding where to focus one's attention. An auto mated reasoning program faces the same obstacle. In contrast, the obstacle of "This work was supported by the Mathematical, Information, and Computational Sciences Division subprogram of the Office of Computational Science and Technology, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted from the Journal of Automated Reasoning, Vol. 17, no. 1, 23-81 (August 1996) with kind permission from Kluwer Academic Publishers.
The Power of Combining Resonance with Heat
1425
immediately using one or more axioms at any point in the reasoning is faced by the program but not by the researcher. The severity of each of these obstacles, for an automated reasoning program, can be lessened markedly by relying, re spectively, on the resonance strategy and on the hot list strategy. When these two strategies are combined in an appropriate manner (discussed in this article), as the experimental evidence I present suggests, the result often is most satisfy ing. More generally, for sharply reducing the severity of virtually any obstacle, strategy frequently is the key. Indeed, from the mid-1960s until the late 1980s, I voiced the opinion re peatedly that far too little research focused on the formulation of additional strategies intended either to restrict or to direct the actions of an automated reasoning program. Perhaps the explanation for my effrontery or chutzpah rests with the successes of my research, successes that I still trace directly to the employment of strategy. I can report with great satisfaction that the period between the late 1980s and the mid-1990s has, in sharp contrast to the earlier years, witnessed the introduction of a number of intriguing strategies. Included among the new strategies are the kernel strategy [12] (for studying combinatory logic); McCune's ratio strategy [6]; the subtautology strategy [11]; McCune's tail strategy [13,11]; the recursive tail strategy [11]; and the two strategies that are of prime concern here, the resonance strategy [10,14] and the hot list strategy [15]. (All of the cited strategies, as well as others not cited, are offered by McCune's automated reasoning program OTTER [5], whose use plays a vital role in the research reported here.) It seems hardly coincidental that the cited period has also witnessed a sharp increase in the rate of deep questions answered and hard problems solved with substantial assistance of an automated reasoning program (see, for example, [12,7,8]). Although a given strategy may have aesthetic appeal and even beauty, its power is the ultimate test of its value. Here I chronicle various experiments, in part to show how one event leads to another and thus provide insight into research, and in part to show (in response to frequent requests) how one can effectively choose from among the numerous options offered by McCune's auto mated reasoning program OTTER; see Chapter 8 of [15] for additional guide lines for option choosing. Therefore, the style of this article will be somewhat reminiscent of an experimenter's notebook. As noted, featured in the experiments are two strategies, the resonance strat egy and the hot list strategy, briefly reviewed in Sections 1.1 and 1.2, respec tively. By itself, each of the two strategies has proved powerful in various con texts; in Section 5 I present experimental evidence of the value of combining (in two different ways) these two strategies. For example, the use of each combi nation in the context of cursory proof checking produced most unexpected and satisfying results, as I show in Section 5. Also playing a significant role in the program's search for new conclusions, stored as clauses, is Overbeek's weighting strategy [4,9,16] (which directs the search by complexity preference selection of clauses to initiate applications of the inference rules), as well as other strate-
1426
Collected Works of Larry Wos
gies that include McCune's ratio strategy, see [16] for a detailed discussion of the cited strategies and for a discussion of the clause language for representing information. (Throughout this article, I often use the term "clause" [9,16] inter changeably with the term conclusion, for conclusions that are drawn and input statements that characterize the problem under study are stored by OTTER as clauses.) More generally, while the focus in this article is on the resonance strategy combined with the hot list strategy, various strategies taken in combination have played a vital role in my research. Indeed, employment of strategies in combination often is the key to obtaining a sought-after result. 1.1. T H E RESONANCE STRATEGY
To use the resonance strategy, the researcher chooses equations and formulas because their symbol pattern (whose variables are treated as indistinguishable) appears to make each appealing for directing the program's attack. Such chosen equations or formulas are called resonators. The appeal rests with the conjecture that any equation or formula that matches the shape of an included resonator (symbol pattern of the type under discussion) merits immediate or almost im mediate attention for driving the program's reasoning. Two equations or two formulas, one of which is a resonator, match (in the sense used here) if and only if they are identical when all the variables are treated as indistinguishable. For each resonator that the researcher chooses to include in the input, a value is assigned (by the researcher) to reflect its conjectured significance. The smaller the value, the greater the significance. Resonators direct a program's search for new conclusions by giving to any matching equation or formula present in the database the value of the resonator, which in turn (typically) gives the equation or formula preference for being chosen to drive the program's reasoning. Sources for potentially powerful resonators include the elements of the special hypothesis of the theorem under study, the conclusions of the theorem, deduced steps of proofs of related theorems, and deduced steps of proofs completed while attempting to prove the (main) theorem in question. (The special hypothesis of a theorem of the form if P then Q refers to that part of P, if such exists, that excludes the underlying axioms and lemmas. For example, in the study of the theory that asserts that rings in which the cube of x = x are commutative, the special hypothesis consists of the equation xxx = x.) In general, when one begins the study of a new area, Overbeek suggests accumulating a set of resonators just as one accumulates a set of lemmas, where one simply accumulates the proof steps of the theorems as they are proved, perhaps starting with simple theorems. At least in the Argonne paradigm, one important effect of including res onators concerns the potential of rapidly adding to the pool of conjectured-tobe-useful lemmas. Indeed, when a conclusion is retained that matches a res onator, because of the (usually) small weight (value) that is assigned to the resonator and therefore assigned to the retained conclusion, the conclusion is
The Power of Combining Resonance with Heat
1427
quickly chosen as the focus of attention to direct the program's reasoning. Then, once it has served its purpose for initiating applications of the chosen inference rules, the conclusion is then made available to be used in the same m anner as lemmas included in the input list(usable) are used. Input clauses included in list(usable) are used to complete applications of an inference rule, and are never used to initiate applications. 1.2.
T H E H O T LIST STRATEGY
Use of the hot list strategy typically requires the researcher to choose from among the input statements that present the question or problem those that are conjectured to merit immediate visiting (as hypotheses) and, if the value assigned to the heat parameter is greater than 1, even immediate revisiting. The chosen statements are placed in the (input) hot list, and they are used one at a time or in combination (depending on the inference rule being applied) to complete inference rule applications, rather than to initiate applications. Where resonators are restricted to be correspondents of unit clauses, clauses free of the logical or symbol " I", members of the hot list are not subject to this restriction. Potentially powerful choices for members of the hot list include the elements of the special hypothesis and elements of the initial set of support. Also, when an inference rule in use relies on the use of some clause as a nucleus (as in hyperresolution), then placing a copy of such a clause in the hot list is often profitable. When the program decides to retain a new conclusion, before another con clusion is chosen from list(sos) as the focus of attention to drive the program's reasoning, the hot list strategy causes the new conclusion to initiate applica tions of the inference rules in use, with the remaining hypotheses (or parents) that are needed all chosen from the hot list. Members of the hot list, whether input or adjoined during a run, are not subject to back demodulation or back subsumption; in other words, clauses in the hot list are never rewritten with the discovery of new demodulators (rewrite rules), nor are they purged because of being captured by a newly retained clause. If one wishes the program during the run to adjoin new members to the hot list, one uses the dynamic hot list strategy [15] (which McCune formulated as an extension of the hot list strategy). If that is the choice, then one assigns an integer, positive or negative, to the dynamic_heat.weight parameter with the intention that conclusions that are retained and that have a pick-given weight (complexity) less than or equal to the assigned value will be adjoined to the hot list. (A clause technically has two weights, its pick-given weight which is used in the context of choosing clauses as the focus of attention to drive the program's reasoning, and its purge.gen weight which is used in the context of clause discarding; often the two weights are the same.) The dynamicJieat.weight assignment places an upper bound on the pick^given weight of clauses that can be adjoined to the hot list during the run.
1428
CoJiected Works of Larry Wos
When the heat parameter is assigned the value 1, conclusions that result from consulting the hot list (whether one is using the hot list strategy or the dynamic hot list strategy) have heat level 1. (By definition, input clauses have level 0, and a deduced clause has a level one greater than that of its parents.) If the program decides to retain a conclusion of heat level 1 and if the (input) heat parameter is assigned the value 2, then before another conclusion is chosen as the focus of attention, the heat-level-1 conclusion is used to initiate the search for conclusions of heat level 2 (with the hypotheses needed to complete the cor responding application of the inference rule chosen from the hot list). The heat parameter can be assigned to whatever positive integer the researcher chooses, with the objective of placing corresponding emphasis on the immediate use of the members of the hot list. If the parameter is assigned the value 0, then the hot list strategy will not be used. 1.3. T H E RESONANCE STRATEGY VERSUS THE H O T LIST STRATEGY
Whereas resonators have no true or false value, members of the hot list are treated as true, as lemmas or their equivalent. A second significant difference between resonators and members of the hot list concerns what I call temporary keying versus constant keying. Regarding temporary keying, a deduced clause that matches a resonator is assigned the value (typically a small positive integer) of the corresponding resonator and is, therefore, usually given great preference for keying the program's search for information; but that preference is brief in the following sense. After a clause A is chosen from list(sos) to be the focus of attention and considered with all of the input clauses that were placed in list (usable) (and hence not given set of support) and all of the clauses that were moved to list(usable) from list(sos) having served as the focus of attention, A is never again used to initiate inference rule applications. Once such a clause A ceases to be the focus of attention to direct or drive the program's reasoning, it is considered only as often as are the other clauses in list(usable) and not keyed on again, which is why I use the term temporary keying. On the other hand, each clause that is a member of the hot list is constantly keyed on (of course, assuming that the heat parameter is assigned a value greater than or equal to 1), in the sense that it is immediately considered with every newly retained clause, even if the retained clause is never chosen as the focus of attention.
2
The Field of Interest and Rules of Play
Throughout this article, I focus on two-valued sentential (or propositional) cal culus and feature the objective of finding shorter proofs. (Nevertheless, as sug gested by research not reported here, the approaches presented in this article are promising for other areas and for other objectives.) For the experiments I present, I choose as the axiom system for the calculus that of Lukasiewicz [3]
The Power of Combining Resonance with Heat
1429
consisting of LI, L2, and L3—the following expressed as clauses in OTTER notation, where the function i can be interpreted as implication, the function n as negation, and the predicate P as provable. (LI) (L2) (L3)
P(i(i(x,y),i(i(y,z),i(x,z)))). P(i
The inference rule I use is condensed detachment [1,2] captured by the use of hyperresolution [9,16] and the following clause, in which "-" denotes logical not and " I" denotes logical or. - P ( i ( x , y ) ) I -P(x) I P(y). My study focuses on various other axiom systems of two-valued sentential calculus: those of Church, Frege, Hilbert, (an alternate of) Lukasiewicz, and Wos [3,10]. In each experiment, I have the goal of deducing from the Lukasiewicz axiom system one or more of the other axiom systems under consideration. However, rather than seeking any proof, my goal is a set of proofs that are shorter than those of Lukasiewicz and, even better, proofs that offer research challenges in regard to their length. I shall show how I was able to obtain the desired shorter proofs and, far more satisfying, obtain them often in reasonable CPU time and with ease on my part. I shall, where possible, comment on why I made various choices and pursued various paths. By doing so, I intend to provide a means for someone to extend the reported research and, even better, to apply some of the given methodology to attacking other areas, perhaps culminating in the answers to questions that are currently open. I also have the objective of fulfilling a frequent request to illustrate how a researcher can wisely choose from among the numerous options offered by OTTER. As part of the game, I shall offer challenges and topics for study (see, for ex ample, Section 7) and, in the Appendix, a sample input file and various pleasing proofs to aid the researcher. I issue the following important warning: Because this article (as others I have recently completed) represents current research, even before it appears, I may have obtained better results. In no way (in my view) does that compromise or lessen the intrigue or long-term value of at tempting to meet one of the offered challenges. Indeed, quite the contrary, for an attempt to meet a challenge—even if it has already been met by another— can produce sharply different results, sometimes culminating in a significant advance for a field.
3
Combining Strategies
When one combines two different strategies, occasionally one produces a strategy with not-so-obvious properties. A powerful example of this occurrence is pro vided by combining the resonance strategy with the dynamic hot list strategy.
1430
Collected Works of Larry Wos
A second example offering power focuses on combining the resonance strategy with the (static) hot list strategy. First in order is an illustration of using the main strategies of interest in this article, followed by examples of combining strategies. 3.1. ILLUSTRATING THE USE OF THE FEATURED STRATEGIES
With the resonance strategy, the researcher supplies resonators in the input, equations or formulas that are unit clauses, free of logical or. For OTTER, the resonators are usually placed in one of three weight lists: weight Jist(pick_given), weight Jist(pick-and-purge), and (far less often) weight-list (purge-gen). The first of the three cited weight-lists is used by the program to aid the program in deciding which clause on which to focus next to drive its reasoning. The second weight-list is used for the same purpose but, in addition, is used to aid in deciding which clauses to discard upon generation. The third weightJist is used only to aid in deciding which clauses to discard upon generation. If no member of a weightJist matches a clause (where variables are treated as indistinguishable), the clause is given a (pick-given) weight equal to its symbol count; the same is true for its purge-gen weight. Because OTTER treats variables in weight templates as indistinguishable, one can conveniently include resonators for the program's use. To each resonator, as noted, the researcher assigns its value. One must always keep in mind that an included resonator is not a lemma or its equivalent; rather, a resonator is a symbol pattern used to give priority to clauses. When a clause matches a resonator (with, of course, the variables ignored), the priority assigned to it equals the value assigned to the matching resonator. The lower the value, the higher the priority. For the program OTTER, the following example illustrates the use of a resonator, a resonator that corresponds to what Lukasiewicz calls thesis 35; see Section 4 for a list of theses that merit experimentation. weight_list(pick_and_purge). weight(P(i(i(x,i(y,z)),i(i(x,y),i(x,z)))),2). end_of_list. The presence of this resonator causes OTTER to assign a weight of 2—indeed a small weight—to any deduced clause that matches it, a clause such as the following. P(i(i(x,i(y,z)),i(i(y,x),i(y,z)))). The clause contained in the resonator differs from the preceding clause only in the particular variables that occur; specifically, some occurrences of y are replaced by x and some of x by y. From the viewpoint of the resonance strat egy, the two clauses match, for variables are considered indistinguishable. To mechanically test a formula or equation for possibly matching a resonator, one
The Power of Combining Resonance with Heat
1431
first replaces in the resonator all occurrences of a variable with variables such that no two variables are identical, and then one determines whether a renam ing of the variables yields the formula or equation; if such a renaming exists, then the formula or equation matches a resonator. Because of being assigned a weight of 2, the preceding clause, if deduced and retained, will be given great preference for driving the program's reasoning. Further, if the clause is deduced, it will be retained unless the max_weight is assigned a value (integer) strictly less than 2 or unless some procedure such as subsumption interferes. If one wishes to experience the impressive impact of the inclusion of the cited resonator, one simply seeks a deduction of thesis 35 with and without its presence, using as axioms the three Lukasiewicz axioms given in Section 4. Indeed, I have an example where the inclusion of the pattern for thesis 35 sharply reduced the CPU time to prove the entire Church axiom system (consisting of theses 18, 35, and 49), in part by enabling OTTER to find a proof in which the last step is thesis 35 and that preceding it has the same shape. In contrast to resonators having no true or false value, members of the hot list are treated as true, as lemmas or their equivalent. Such members play an active role in the program's reasoning, even though they must wait to complete applications of inference rules rather than to initiate applications. Members of the hot list also differ from resonators in their treatment of variables; indeed, variables in the former are treated as any variable in an equation or formula is treated, in contrast to variables in the latter being treated as indistinguishable and (in effect) place holders for some variable. For example, the following two clauses (just used to illustrate the resonance strategy) are treated by the hot list strategy as distinctly different clauses. P(i(i(x,i(y,z)),i(i(x,y),i(x,z)))). P(i(i(x,i(y,z)),i(i(y,x),i(y,z)))). Indeed, the presence of the correspondent of either clause as a resonator suffices to cause the program to key on either if retained, whereas to cause the program to key on the two clauses when the hot list strategy is used, one must include both clauses in the hot list (in the following manner). list(hot). P(i(iOc,i(y,z)),i(i(x,y),i(x.z>))). P(i(i(x,i(y,z)),i(i(y,x),i(y,z)))). end_of_list. 3.2. EXAMPLES OF COMBINING STRATEGIES
In the context of combining strategies, sometimes the researcher knows of one or more lemmas or facts (expressible as a unit clause) that, if provable, would make excellent members of the input hot list. Of course, such statements should not be cavalierly placed in the hot list, for they may not be provable. Also,
1432
Collected Works of Larry Wos
sometimes the notion is that effectiveness would be sharply increased with the adjunction of one or more of the conjectured-to-be-valuable lemmas to the hot list during the run, if the program succeeds in proving any. In other words, sometimes the researcher would like the program, if a proof is produced of a given fact (expressed in the form of a unit clause), to then adjoin to the hot list the fact to be immediately visited with each newly retained clause. Intuitively, the wish is to give the program the ability to draw a conclusion and, if the conclusion matches a chosen target, then almost immediately use it to complete deductions. FVom the perspective of mathematics and logic, the idea is to give the program the ability to add during the run lemmas to immediately consider with each newly retained conclusion if the lemmas are proved. (In case one is tempted to simply say that a bit of programming would suffice for this type of if-then action, I note that the scope of combining both the resonance strategy and the dynamic hot list strategy is far greater than if-then.) Just what is needed is provided by a judicious use of the resonance strat egy combined with the dynamic hot list strategy. One places in the chosen weight-list, either the pick-and_purge weightJist or the pick-given weightJist, the resonators that match (ignoring variables) the desired lemmas, assigning to each resonator a value of, say, 2, and assigning to the dynamicJieat.weight a value of 2. With such an assignment, no clause whose pick-given weight is strictly greater than 2 can be adjoined (during the run) to the hot list. When and if the program deduces (proves) one of the desired lemmas, the corresponding clause will be assigned a pick-given weight of 2 because the matching resonator has been assigned a pick-given weight of 2. That new clause will be retained unless, of course, the max-weight is strictly less than 2 or subsumption interferes. Then, because the dynamic-heat.weight has been assigned the value 2, the newly re tained clause (having a pick-given weight of 2) will immediately be adjoined to the hot list (during the run). One does run the risk of having clauses adjoined to the hot list that one does not expect to be adjoined, namely, those that are not among the desired lemmas but, instead, match a resonator (with the variables ignored). (For example, the program would adjoin to the hot list during the run either or both of the clauses, if retained, that were used to illustrate the use of the resonance strategy if either were present as a resonator.) The fortune that results from this (so-to-speak) generality can be large or small, good or bad. For example, on the (possible) down side, if one combines the strategies in the cited manner and includes resonators that are easily matched, then the effectiveness of the program can be dramatically reduced, for too many clauses may be adjoined to the hot list during the run. The structure of the conclusions that are drawn by the program during a particular study sometimes provides a warning sign that effectiveness may be sharply reduced if the cited combination of strategies is used. Indeed, the inclusion of formulas (to be used as resonators) from equivalential calculus [1,2] in a study of that area of logic can be dangerous, for many formulas can match a single resonator.
The Power of Combining Resonance with Heat
1433
Rather related to the combination of strategies just discussed is that in which one uses the resonance strategy and the hot list strategy, the latter not in a dynamic manner. Such a combination acts like a mixture, in contrast to the preceding which acts like a compound. Indeed, when the resonance strategy is combined with the dynamic hot list strategy in the manner described, an interaction takes place, for, among other factors, the nature of the hot list can be materially affected by the nature of the list of resonators. Such is not the case when the hot list strategy is used in a static (rather than dynamic) manner. As the experiments discussed in Section 5 show, each of the two combinations is quite promising. For a combination of strategies that may merit study and that possesses sharply different properties when compared with either of the preceding com binations, I suggest combining the hot list strategy with level saturation. By definition, the level of input clauses is 0; the level of a deduced clause is one greater than the maximum of the levels of its parents. With the choice of level saturation to direct a program's search, the program is instructed first to deduce all clauses of level 1 within the constraints of max-weight and the like, next to deduce all clauses of level 2, and to continue until stopped by some condition; in other words, a breadth-first search is conducted. As noted, regarding the hot list strategy, assigning the value 1 (for example) to the heat parameter instructs a reasoning program to deduce clauses of heat level 1, and assigning the value 2 to deduce clauses of heat level 2 (both relative to the hot list). If one assigns the heat parameter the value, say, 3 and uses level saturation, then, when the program is deducing clauses of level j , it is also deducing some clauses of level j+3. In other words, the combination of the hot list strategy and level satura tion enables the program to "look ahead" into levels greater than that being explored. The aspect of looking ahead is also possessed by the use of the hot list by itself, for the immediate consideration of a newly deduced clause, rather than waiting until that clause is chosen (if ever) from the set of support to be used as the focus of attention, enables the program to look ahead by deducing clauses far earlier than they otherwise might be deduced. Perhaps the question that comes to mind concerns the properties of com bining all three strategies: resonance, the dynamic hot list, and level saturation. That question is left for future research, perhaps by others. What is next in order is a brief account of how the research that is the basis of this article commenced.
4
A Wellspring for Research
Next in order is the background and some results that together provide the basis for the research that is central to this article and that is reported in Section 5. The highlights of this section are displayed at its close.
1434
Collected Works of Larry Wos
In earlier research (to be documented in a forthcoming paper), my goal was to demonstrate the value of using the hot list strategy to bring within range the proofs of theorems that, before the formulation of the resonance strategy, had continually resisted the attack of an automated reasoning program. The area of study was two-valued sentential (or propositional) calculus, axiomatized by the three Lukasiewicz axioms (LI, L2, and L3) given near the beginning of Section 2. The inference rule in use was condensed detachment, captured by the use of hyperresolution and the three-literal clause given in Section 2. I had placed in the input hot list the clauses corresponding to the three Lukasiewicz axioms and the clause corresponding to condensed detachment. The target theorems were the following 68, called theses by Lukasiewicz [Lukasiewicz63]; theses 1, 2, and 3 are, respectively, LI, L2, and L3. (thesis_04) (thesis_05) (thesis_06) (thesis_07) (thesis_08) (thesis_09) (thesis_10) (thesis.ll) (th«8is_12) (thesis_13) (thesis.14) (thesis_15) (theBis_16) (thesis_17) (thesis.18) (thesis_19) (thesis_20) (thesis_21) (thesis_22) (thesis_23) (theais_24) (thesis_25) (thesis_26) (thesis_27) (thesis_28) (thesis_29) (thesis_30) (thesis_31) (thesis_32) (thesis_33) (thesis_34)
i(i(i(i(x,y),i(z,y)),u),i(i(z,x),u)) i(i(x,i(y,z)),i(i(u,y),i(x,i(u,z)))) i(i(x,y),i(i(i(x,z),u),i(i(y,z),u))) i(i(z,l(i(y,z),u)),i(i(y,v),i(zli(i(v,z),u)))) i(i(x,y),i(i(z,x),i(i(y,u),i(z,u)))) i(i(i(n(x),y),z),i(x,z)) i(x,i(i(i(n(x),x),x),i(i(y,x),x))) i(i(x,i(i(n(y),y),y)),i(i(n(y),y),y)) i(x,i(i(n(y),y),y)) i(i(n(x),y),i(z,i(i(y.x),x))) i(i(i(x,i(i(y,z),z)),u),i(i(n(z),y),u)) i(i(n(x),y),i(i(y,x),x)) i(x,x) i(x,i(i(y,x),x)) i(x,i(y,x)) i(i(i(x,y),z),i(y,z)) i(x,i(i(x,y),y)) i(i(x,i(y,z)),i(y,i(x,z))) i(i(x,y),i(i(z,x),i(z,y))) i(i(i(x,i(y,z)),u),i(i(y,i(x,z)),u)) i(i(i(x,y),x),x) i(i(i(x,y),z),i(i(x,u),i(i(u,y),z))) i(i(i(x,y),z),i(i(z,x),x)) i(i(i(x,y),y),i(i(y,x),x)) i(i(i(i(x,y),y),z),i(i(i(y,u),x),z)) i(i(i(x,y),z),i(i(x,z),z)) i(i(x,i(x,y)),i(x,y)) i(i(x,y),i(i(i(x,z),u),i(i(y,u),u))) i(i(i(x,y),z),i(i(x,u),i(i(u,z),z))) i(i(x,y),i(i(y,i(z,i(x,u))),i(z,i(x,u)))) i(i(x,i(y,i(z,u))),i(i(z,x),i(y,i(z,u))))
The Power of Combining Resonance with Heat
1435
(thesis_35) i ( i ( x , i ( y , z ) ) , i ( i ( x , y ) , i ( x , z ) ) ) (thesis_36) i ( n ( x ) , i ( x , y ) ) (thesis_37) i ( i ( i ( x , y ) , z ) , i ( n ( x ) , z ) ) (thesis_38) i ( i ( x , n ( x ) ) , n ( x ) ) (thesis_39) i ( n ( n ( x ) ) , x ) (theBis_40) i ( x , n ( n ( x ) ) ) (thesis_41) i ( i ( x , y ) , i ( n ( n ( x ) ) , y ) ) (thesis_42) i ( i ( i ( n ( n ( x ) ) , y ) , z ) , i ( i ( x , y ) , z ) ) (thesis_43) i ( i ( x , y ) , i ( i ( y , n ( x ) ) , n ( x ) ) ) (thesis_44) i ( i ( x , i ( y , n ( z ) ) ) , i ( i ( z , y ) . i ( x , n ( z ) ) ) ) (thesis_45) i ( i ( x , i ( y , z ) ) , i ( i ( n ( z ) , y ) , i ( x , z ) ) ) (thesis_46) i ( i ( x , y ) , i ( n ( y ) , n ( x ) ) ) (thesis_47) i ( i ( x , n ( y ) ) , i ( y , n ( x ) ) ) (thesis_48) i ( i ( n ( x ) , y ) , i ( n ( y ) , x ) ) (thesis_49) i ( i ( n ( x ) , n ( y ) ) , i ( y , x ) ) (thesis_50) i ( i ( i ( n ( x ) , y ) , z ) , i ( i ( n ( y ) , x ) , z ) ) (thesis_51) i ( i ( x , i ( y , z ) ) , i ( x , i ( n ( z ) , n ( y ) ) ) ) (thesis_52) i ( i ( x , i ( y , n ( z ) ) ) , i ( x , i ( z , n ( y ) ) ) ) (thesis_53) i ( i ( n ( x ) , y ) , i ( i ( x , y ) , y ) ) (thesis_54) i ( i ( x , y ) , i ( i ( n ( x ) , y ) , y ) ) (thesis_55) i ( i ( x , y ) , i ( i ( x , n ( y ) ) , n ( x ) ) ) (thesis_56) i ( i ( i ( i ( x , y ) , y ) , z ) , i ( i ( n ( x ) , y ) , z ) ) (thesis_57) i ( i ( n ( x ) , y ) , i ( i ( x , z ) , i ( i ( z , y ) , y ) ) ) (thesis_58) i ( i ( i ( i ( x , y ) , i ( i ( y , z ) , z ) ) , u ) , i ( i ( n ( x ) , z ) , u ) ) (thesis_59) i ( i ( n ( x ) , y ) , i ( i ( z , y ) , i ( i ( x , z ) , y ) ) ) (thesia_60) i ( i ( x , i ( n ( y ) , z ) ) , i ( x , i ( i ( u , z ) , i ( i ( y , u ) , z ) ) ) ) (thesis_61) i ( i ( x , y ) , i ( i ( z , y ) , i ( i ( n ( x ) , z ) , y ) ) ) (thesis_62) i ( i ( n ( n ( x ) ) , y ) , i ( x , y ) ) (thesis_63) i ( x , i ( y , y ) ) (thesis_64) i ( n ( i ( x , x ) ) , y ) (thesis_65) i ( i ( n ( x ) , n ( i ( y , y ) ) ) , x ) (thesis_66) i ( n ( i ( x , y ) ) , x ) (thesis_67) i ( n ( i ( x , y ) ) , n ( y ) ) (thesis_68) i ( n ( i ( x , n ( y ) ) ) , y ) (thesis_69) i ( x , i ( n ( y ) , n ( i ( x , y ) ) ) ) (thesis_70) i ( x , i ( y , n ( i ( x , n ( y ) ) ) ) ) (thesis_71) n ( i ( i ( x , x ) , n ( i ( y , y ) ) ) ) When (in my earlier research) the hot list strategy essentially unaided (by the use of other strategies or by guidance from the researcher) proved 44 of the 68 theses, I was not totally pleased, despite the slightly encouraging results. (For those who enjoy history, the study of the given 68 theses led directly to the formulation of the resonance strategy; its first use [10] proved all 68 in less than 16 CPU-minutes on a SPARCstation-l+.) In addition, in the study
1436
Collected Works of Larry Wos
reported here, I was after bigger game than proving a large fraction of the 68 theses. Specifically, I was intent upon proving a significant theorem, namely, that the three Lukasiewicz axioms provide an axiomatization for two-valued sentential calculus, where the targets were one or more of the other known axiom systems. The other axiom systems are (an alternate) from Lukasiewicz, consisting of theses 19, 37, and 59; from Church, consisting of theses 18, 35, and 49; from Frege, consisting of theses 18, 21, 35, 39, 40, and 46, of which thesis 21 is dependent on the other five; from Hilbert, consisting of theses 3, 18, 21, 22, 30, and 54, of which thesis 30 is dependent on the other five; and from Wos, consisting of theses 19, 37, and 60. Of course, since the members of the target axiom systems are all among the 68 theses, a proof of all 68 theses would (in effect) win the bigger game (by deducing each of the other five known axiom systems). I note that (in that earlier study) I was not focusing on any particular properties of the sought-after proofs, for example, proof length. By proof length, I mean the number of deduced steps, and I require that every deduced step be justified by the application of some inference rule. I had an inspiration. If (for the study reported here) I could find a means to have potentially powerful clauses adjoined to the hot list during the run, then the effectiveness of the hot list strategy could be further increased. The added power might enable OTTER to reach both objectives, that of proving more than 44 of the 68 theses, and that of deducing one or more of the other five known axiom systems, of course, using as hypotheses the three axioms of Lukasiewicz. Because my experiments have repeatedly shown that resonators of various types offer substantial power, my notion was to combine the resonance strategy with the dynamic hot list strategy. The idea was to include in the input highly attractive resonators. For this re search, a highly attractive resonator is a resonator such that, among the clauses that match it (ignoring variables), there exists at least one that, if deduced, would make a good addition to the hot list. So the burden shifted to deciding which clauses I would like adjoined to the hot list, if deduced. I reasoned (I believe) that, if including the three Lukasiewicz axioms in the hot list had in earlier research proved a good move—which it in fact had—then the inclusion of members of other known axiom systems would be a good move. Of course, as is probably obvious, I could not simply include (in the initial hot list) such members in the input, for I was not allowed to assume their deducibility. My solution was, other than L3, to place as a resonator in weight_list(pick_and .purge) the template corresponding to each of the (additional fourteen) members of the other five axiom systems, assigning to each a weight of 2. I also assigned the value 2 to the dynamicJieat.weight. The consequences of these two actions is that, if a clause matching one of the fourteen resonators is deduced, it will be assigned a pick-given weight of 2. If none of the other mechanisms (such as subsumption or max-weight) interfere, the clause will be retained. Because its weight is 2-and the dynamicJieat.weight is 2, the clause will immediately be adjoined to the hot list. I was more than willing to run the risk that clauses
The Power of Combining Resonance with Heat
1437
(other than the desired fourteen) not identical to, but similar to (if variables are ignored), a resonator would be adjoined to the hot list. For my experiment, I chose as options to assign the value 20 to max-weight, 5 to max.distinct-vars, 5 to the pick-given_ratio, 1 to the heat parameter, and 2 to the dynamic-heat.weight. The first two values were chosen because all 68 theses expressed as clauses have weight (in symbol count) less than or equal to 20— thesis 7 in fact has a weight of 20—and because none of the cited clauses relies on strictly more than five distinct variables. During the run, OTTER adjoined 41 new clauses to the hot list. Regarding the 68 theses, 52 were deduced— not extremely impressive. However, among those proved are theses 46 and 54, important because of being members, respectively, of the Frege axiom system and the Hilbert axiom system. More significant, I caught my bigger game: The Hilbert axiom system was proved, in approximately 1039 CPU-seconds on a SPARCstation-10 with a length of 50 and a level of 26. (The cited proof length is 54, the greater number explained by the presence of duplicate steps resulting from the use of the dynamic hot list strategy. In particular, when a clause is added to the hot list during the run, that clause is a copy, but with a different number, of the clause that is then added to list(sos). When duplicate steps occur in a proof, the cause rests with the use of a clause and also of its copy from the hot list. The designation heat=n asserts that the hot list was consulted at the n-th level to yield the corresponding clause. Note that the notation heat=n concerns the history of the clause, and says nothing about how the clause is used.) These (encouraging to me) results obtained by combining the resonance strategy and the dynamic hot list strategy (in the cited manner) provided the wellspring for the following research that is reported in Section 5. Highlights of Section 4• With the hot list strategy alone, OTTER proved 44 of the target 68 theses cited in this section, but proved none of the entire target axiom systems. • Using as resonators members of known axiom systems, the combination of the resonance strategy with the dynamic hot list strategy proved 52 of the 68 theses and also proved the Hilbert axiom system.
5
T h e Actual Research
To aid the researcher, appended to the end of this section are the displayed highlights. The just-cited success regarding the deduction of the Hilbert axiom sys tem naturally called for further testing of the power of combining resonance with heat. Both combinations merited experimentation, the resonance strategy with the hot list strategy and the resonance strategy with the dynamic hot list
1438
Collected Works of Larry Wos
strategy. Of the myriad of possibilities for experimentation, rather than seeking proofs without regard to their properties, my choice was to seek shorter proofs than were familiar to most researchers. The area of study was two-valued sen tential (or propositional) calculus, axiomatized by the three Lukasiewicz axioms (LI, L2, and L3) given near the beginning of Section 2. The inference rule in use was condensed detachment, captured by the use of hyperresolution and the three-literal clause given in Section 2. The targets were the Lukasiewicz proofs of the other five axiom systems. Taking into account the facts that Lukasiewicz combines proof steps and occasionally renames variables, his proof of the Church axiom system has length 33, of the FVege axiom system has length 41, of the Hilbert axiom system has length 34, of the alternate Lukasiewicz axiom system has length 37, and of the Wos system has length 39. Of course, technically, he had not proved the Wos axiom system, for it was not reported until 1991. Proof length is measured in number of applications of condensed detachment. My immediate goal was, if possible, to use a combination of resonance and heat to find proofs strictly shorter than those of Lukasiewicz. The first decision to make concerned the choice of resonators for use by the resonance strategy. The decision was indeed influenced by my deeming it best to attack each of the five axiom systems as a target one at a time. I started with the Church axiom system consisting of theses 18, 35, and 49. A natural first cut at a set of useful resonators focuses on the Lukasiewicz original proof, essentially consisting of 33 applications of condensed detachment. The 33 resonators corresponding to the deduced steps of that proof were obtained by using OTTER in a rigorous proof-checking mode, in contrast to its use in a cursory proof-checking mode; both types of proof checking are discussed shortly and discussed in more detail in Section 5.4. (To reflect their source and their use, I call such resonators Lukasiewicz-Church resonators, and, later in this section, I follow a similar naming convention.) As for the assignment to each resonator, I followed my custom of the past few years, assigning to each the value 2. Since I was intent upon testing my conjecture asserting that effectiveness can be sharply increased if one instructs the program to adjoin during the run new members to the hot list, where the new members are chosen because of matching an (input) resonator, I naturally assigned the dynamicJieat.weight the value 2. I was aware of the obvious danger, namely, that, in addition to adjoining to the hot list members of the Lukasiewicz proof, perhaps far too many other clauses would be adjoined during the run because of matching one of the thirty-three resonators. My choice for the initial members of the (input) hot list was dictated by following my own recommendation: Include in the hot list the members of the initial set of support. (I almost always rely on the use of the set of support strategy [9,16].) In this case, I therefore included the three Lukasiewicz axioms. Of course, I also included in the initial hot list the clause correspondent of condensed detachment; otherwise the hot list strategy would be disabled, for
The Power of Combining Resonance with Heat
1439
the use of hyperresolution requires (in this case) the nucleus to be a member of the hot list. Regarding the assignment to the (input) heat parameter, I reasoned that, if all went as planned, OTTER would deduce most or all of the clauses corresponding to the Lukasiewicz proof of the Church axiom system, and then adjoin each to the hot list during the run. Also, since weighting treats variables as indistinguishable, other clauses would most likely be adjoined to the hot list because of matching in shape one of the resonators. Therefore, the size of the hot list might become rather large. I was thus led to assign the value 1 to the heat parameter. As for the other options, my choices were in part based on more than thirty years of experimentation, in part based on the success reported in Section 4, and in part based on motivation lost to unrecorded history. I assigned max_weight the value 20, max.proofs the value -1 (to permit the program to complete as many proofs as allowed by the constraints placed on memory and CPU time, respectively, 60 megabytes and none), and max.distinct.vars the value 5 (to partially curb the rate of conclusion retention). I chose 20 for the max.weight because, in terms of symbol count and in the presence of the predicate P, the largest weight of theses 4 through 71 is 20; thesis 7 has weight 20.1 also assigned the pick.given_ratio the value 5.1 set hyperresolution as the inference rule (for condensed detachment), order -history (to instruct the program to list the ances tors in the order nucleus, major premiss, minor premiss), and set input_sos.first (to force the program to choose as the focus of attention the members of the initial set of support before choosing any deduced clause for that purpose). Be cause I chose to use the dynamic hot list strategy, for my weight Jist in which to place the chosen resonators, I used weight Jist (pick -and.purge). Had I instead used weight Jist(purge_gen), then clauses matching a resonator would have been given their piclugiven weight based on symbol count, for resonators in that weightJist affect only the computation of weight in the context of discarding clauses. In that event, almost certainly all such (matching) clauses would have failed to be adjoined to the hot list (during the run), contrary to my intention. As for the input clauses, I placed only those corresponding to the three Lukasiewicz axioms in llist(sos), I placed the clause for condensed detachment and those corresponding to the denials or negations of the five target axiom systems in list(usable), and I placed in list(passive) the negations or denials of the individual members of the five target axiom systems. My motivation for my choice regarding the initial set of support was my preference for initiating applications of hyperresolution with each of the Lukasiewicz axioms (in the beginning). My choice regarding the members of the (input) list(usable) was based on which clauses I wished to complete applications of hyperresolution, including providing a means for detecting when an entire axiom system had been deduced. In other words, I thought it possible that, although the Church axiom system was under study and the resonators were taken from a deduction of that system, other axiom systems might be deduced. As for the choice of the members of list(passive), I wished to monitor the progress of the program;
1440
Collected Works of Larry Wos
clauses in that list are used for forward subsumption and, important in this context, for unit conflict. I thus began my assault on the problem of finding (if possible) shorter proofs for one, or for all, of the five target axiom systems, at this point emphasizing the study of the Church axiom system. I won the first round, but only barely. Indeed, although all members of the Church axiom system as well as all members of the alternate Lukasiewicz axiom system were deduced (in approximately 79 CPUseconds on aSPARCstation-10), only the proof of the Church system (which has length 32 in contrast to the Lukasiewicz proof having length 33) completed, while the proof of the alternate Lukasiewicz system did not complete. The program reported a proof length of 38 for the Church axiom system, again explained by the presence of duplicate steps resulting from the use of the dynamic hot list strategy. The proof was completed in approximately 114 CPU-seconds, the added time explained when the discussion turns (almost immediately) to the mechanism for choosing the clauses on which to focus attention. As evidence that the hot list strategy played a key role, 15 of the 32 steps of the proof show heat=l in their history, meaning that a hot list member participated. (For the researcher interested in finer detail, we note that having the proofs of the individual members of an axiom system is far from satisfying when the goal is a proof of the entire system, for, among other drawbacks, the ensemble of individual proofs will almost certainly contain many duplicate steps.) But, one might immediately wonder, if all members of an axiom system were deduced (namely, the alternate of Lukasiewicz), then why was no proof of that axiom system completed? The answer rests with the mechanism for choosing clauses on which to focus to drive the program's reasoning. In particular, the choice among the retained clauses is based on pick-given weight, which is first determined by included weight templates present either in weight_list(pick_a.nd_purge) or in weightJist(pick-given), and then (if none apply) by symbol count. The clause correspondent of thesis 59 (the last member of the alternate Lukasiewicz sys tem that was deduced) was not chosen as the focus of attention; its weight is 15. Nor was the clause equivalent of thesis 37 chosen as the focus of attention, although its weight is only 11. Evidently, too many clauses were available with smaller weight. Had I included the resonators corresponding to theses 37 and 59, then the deduction of the corresponding clauses would almost immediately have caused them to be chosen as the focus of attention, resulting in the completion of a proof of the alternate Lukasiewicz axiom system because the remaining member (thesis 19) had in fact been chosen as the focus of attention. The ab sence of the cited resonators is explained by my intention to study the effects of using as resonators only the steps of a single proof of an entire axiom system in combination with the dynamic hot list strategy (in effect) directed by those res onators. Therefore, any additional resonator inclusion would have compromised my experiment. Regarding the cited danger in the context of clause adjunction to the hot
The Power of Combining Resonance with Heat
1441
list during the run, 265 clauses were adjoined. Perhaps those added clauses or perhaps the latitude permitted with the maxjweight of 20 caused the program to find the not-altogether-satisfying 32-step proof of the Church axiom system. On the other hand, it was a plus to have the use of the Lukasiewicz-Church res onators lead to a deduction of all members of another axiom system, namely, the alternate of Lukasiewicz. That result supports the claim that proof steps from one theorem are useful in increasing the effectiveness of a reasoning program when attacking related theorems. As a result of the first round yielding less progress than I was after, I im mediately reduced the max.weight to 2, vaguely in the spirit of proof checking. The idea was to confine the program's retention of information to those clauses matching one of the thirty-three resonators. The corresponding experiment also produced a 32-step proof of the Church axiom system, in approximately 133 CPU-seconds; eight of the steps are not present in the 32-step proof produced earlier with max.weight = 20. The partially redeeming property of deducing all members of another axiom system was even absent. I turned to Round 2. In Round 2, I continued to use the thirty-three resonators corresponding to the Lukasiewicz proof of the Church axiom system, conjecturing that their presence might again lead to other interesting proofs. However, I replaced the dynamic hot list strategy with the hot list strategy, thus avoiding the adjunction of clauses during the run, clauses that might have been the cause of the small amount of progress. In other words, I decided to explore the power of the other combination of resonance and heat. All other parameters and options were left unchanged from Round 1. Round 2 I rate a success. In approximately 31 CPU-seconds, OTTER de duced the Church axiom system, the proof being of length 29 and level 24; 9 of the deduced steps result from the use of the hot list strategy. In approximately 212 CPU-seconds, OTTER deduced the Frege axiom system, the proof being of length 40 and level 24; 14 of the deduced steps have heat=l in their history. In approximately 362 CPU-seconds, OTTER deduced the Hilbert axiom sys tem, the proof being of length 31 and level 22; 10 of the deduced steps have heat=l in their history. Also, although not completing the corresponding proof, the program did deduce all members of the alternate Lukasiewicz axiom system in approximately 563 CPU-seconds. The program failed to complete the proof because the clause correspondent of thesis 59 (the last member of the alternate Lukasiewicz system that was deduced) was not chosen as the focus of attention; its weight is 15. This experiment clearly (to me) yielded additional evidence of the value of using the hot list strategy and of the value of using as resonators steps of the proof of one theorem (the Lukasiewicz proof of the Church axiom system) to sharply increase the likelihood of proving related theorems. Highlights of Section 5: • With the goal of finding shorter proofs using the dynamic hot list strategy
Collected Works of Larry Wos
1442
combined with the resonance strategy, where the resonators correspond to the Lukasiewicz 33-step proof of the Church axiom system, a 32-step proof of the Church axiom system was completed. • When the dynamic hot list strategy was replaced with the hot list strategy, the Church axiom system was completed in 29 steps, the Frege axiom system was completed in 40 steps (in contrast to the Lukasiewicz 41step proof), and the Hilbert axiom system was completed in 31 steps (in contrast to the Lukasiewicz 34-step proof). 5.1. A PROMISING REFINEMENT
The approach formulated in this section is summarized at its close, and high lights are displayed. The inspiration for Round 3 was based in part on the results of Rounds 1 and 2 and in part on the results reported at the end of Section 4. The plan was to return to the combination of resonance and the dynamic hot list strategy, using as resonators (for my emphasis on the Church axiom system as main target) the thirty-three steps of the Lukasiewicz proof of the Church axiom system, also the members of the five axiom systems under attack, and also the members of the main target axiom system. To permit the hot list to have clauses adjoined to it during the run, but not so rapidly, I assigned the dynamicJieat.weight the value 2, a weight of 1 to the resonators corresponding to the members of the Church axiom system, a weight of 2 to the resonators that corresponded to the remaining members of the five axiom systems (of course, omitting L3), and a weight of 3 to the resonators that corresponded to the Lukasiewicz proof. (I include in the Appendix an input file of the type under discussion.) With the actions just described, because OTTER assigns a weight to a clause based on the earliest template in the input that matches it, the deduction, say, of the clause correspondent to thesis 18 (a member of the Church axiom system) would result in a weight of 1 being assigned to it. Such a clause, if deduced and retained, would be adjoined to the hot list during the run because of the assign ment of the value 2 to the dynamicJieat.weight. Also as a consequence of the cited actions, the deduction of a member of the Lukasiewicz proof of the Church axiom system would, in most cases, cause that clause to be assigned a weight of. 3. Because the dynamicJieat.weight is assigned the value 2, such a clause would not be adjoined to the hot list during the run. Except for max_weight, it seemed reasonable to leave the other options unchanged. Regarding max.weight, two values were appealing: that of 20, and that of 3. Therefore, as with Round 1, Round 3 consisted of the corresponding two experiments. When the max.weight was assigned the value 20, where proof length is the criterion, I think I can say without hesitation that the experiment failed badly. The proofs ranged in length from 44 for the Church axiom system to 51 for the Wos axiom system. Perhaps the failure resulted from the wrong clauses being
The Power of Combining Resonance with Heat
1443
adjoined to the hot list during the run, in this case, those corresponding to members of other axiom systems that are (at the same time) not among the members of the Church axiom system. Nevertheless, all five axiom systems were deduced, and approximately 63 CPU-seconds was all that was required. On the other hand, Round 3 was a success when the max.weight was assigned the value 3. In approximately 6 CPU-seconds, OTTER completed a 27-step proof of level 21 of the Church axiom system (but, because of duplicate steps, announced the proof to be of length 28); in approximately 63 CPU-seconds, the program completed a length 29 and level 23 proof of the Hilbert axiom system. Also of interest, the proof of the Church axiom system is compact [11] in that it is precisely a proof of one of the members of the system, namely, thesis 35; I return to the subject of compact proofs throughout this section and also in Sections 6 and 7. Informally, as an example, if the theorem has the form P implies the and of Q, R, and S, then a proof of the theorem is compact if and only if it is a proof of precisely one of Q, R, or S (of course, with no extra steps). Progress was (to me) more than satisfactory. Indeed, perhaps a fairly pow erful method for finding shorter proofs had been formulated. I did test and evaluate this refinement, as reported in Section 5.2. That the hot list strategy played a key role is evidenced by the fact that 9 of the 27 steps in the deduction of the Church axiom system show heat=l in their history, and 10 of the 29 steps in the deduction of the Hilbert axiom system show heat=l. For the curious, 23 of the 27 proof steps of the Church axiom system are present in the proof of the Hilbert axiom system. Regarding the resonance strategy, in particular, the resonators corresponding to the deduced steps of the Lukasiewicz proof of the Church axiom system, 4 steps of the just-cited 27-step proof and 3 of the just-cited 29-step proof are not among them; 1 of the 27 steps and 2 of the 29 steps do not match, when variables are ignored, any of the 33 resonators corresponding to the Lukasiewicz proof. Rather than turning immediately to using the refined approach for an at tack on finding shorter proofs (than those of Lukasiewicz) for the other axiom systems, I (in effect) paused to proof check my result regarding the 27-step proof of the Church axiom system. Such a move is typical in my research. The proof checking I instructed OTTER to do is of a cursory nature, in con trast to rigorous proof checking; see Section 5.4. In particular, I placed in weight_list(pick_and-purge) resonators corresponding to the deduced steps of the 27-step proof of the Church axiom system, each with an assigned weight of 2. By then assigning a max-weight of 2, which I did, the program is virtually guaranteed to retain a clause only if it matches a resonator. Regarding the other options used in Round 3, I made but one change: I removed the use of the hot list. Therefore—so I have always expected, with almost certainty—the program will simply reproduce (with far less CPU time than originally required) the proof whose steps are captured with weight templates. (This cited strong conviction will play an important role later in this section.) OTTER did essentially return the expected 27-step proof of the Church axiom system. Not astounding to me,
1444
Collected Works of Larry Wos
the order, and hence the history, was slightly different, but no new deduced steps were present. Closer inspection provided an explanation for the different step order and history (and hence, technically, different proof). Indeed, the reduction in the assigned max.weight from 3 to 2 had prevented the program from delaying as choice for the focus of attention the clause corresponding to one of the proof steps. In addition, the use of the hot list strategy in Round 3 had enabled OTTER to deduce certain proof steps earlier than occurred in the cursory proofchecking run. An obvious experiment to make then was to assign the max.weight the value 3 and add the use of the hot list strategy, in the manner used in Round 3. That experiment did in fact yield a proof, but not the one being proof checked. Instead, a 30-step proof was found, 9 steps of which are present because of using the hot list strategy. The proof is not compact. Five of the deduced steps are not among the 33 of which the Lukasiewicz proof consists. Tantalizing (to me), the 30-step proof contains all 27 steps of the proof found in Round 3, but the 27-step proof is not a subproof of the 30-step proof. (Of a different nature entirely, tantalizing also is the fact that cursory proof checking can, occasionally, yield no proof at all, a subject discussed in Section 5.4 with an example.) Before leaving the so-called proof-checking attack on the Church axiom sys tem, one more experiment was in order, that in which the dynamic hot list strategy is added to the preceding options. Instead of the 27-step proof being proof checked, perhaps unforeseen, OTTER found a 29-step proof, announcing a proof of length 33 containing duplicate steps resulting from using the dynamic hot list strategy. Of the 29 deduced steps, 14 show heat=l in their history. Of the steps of the earlier-cited 27-step proof, all are members of the 29-step proof, but the former is not a subproof of the latter. The explanation for the different results obtained with cursory proof checking in combination with the hot list strategy, the dynamic hot list strategy, or neither rests with the perturbing of the search space that can occur. For example, use of the hot list strategy enables a program to draw conclusions far earlier than it might otherwise draw them. To close this section and set the stage for presenting the results of testing the refined approach, a summary of it at the general level is in order. The general notion is to combine the resonance strategy with the dynamic hot list strategy in a manner that encourages additions to the hot list during the run, but only if the addition matches a resonator that captures some significant result. Three sets of resonators are placed in weightJist(pick.and_purge), with all members of the first set assigned a weight of t, all members of the second set a weight of j , and all members of the third set a weight of k, where i < j < k. The dynamic-heat-weight is assigned the value j , and (usually) the max.weight is assigned the value k. In the typical experiment reported here, i = l,j = 2, and k = 3. At the syntactic level, the resonators of the first set are symbolically iden tical to the clause equivalents of the targets of the experiment. For example,
The Power of Combining Resonance with Heat
1445
the targets (in the sense used here) of an experiment designed to deduce the Church axiom system are its individual members. Since, by definition, variables in a resonator are ignored, it is the functional shape that the targets provide. The resonators so chosen capture the individual targets. In a similar manner, resonators of the second set are obtained by choosing powerful formulas or equa tions of the field from which the problem is taken, such as the members of other axiom systems. Finally, the resonators of the third set correspond (in the sense just described) to the steps of some proof of interest in the field. Because of the assigned weights—if the max.weight is small enough, say 3, to cause the program to exclude from retention any clause unless it matches a resonator—preference for directing a program's reasoning is first given to a clause that matches a resonator in the first set, second to a member that matches a resonator in the second set, and third to a member that matches a resonator in the third set. On the other hand, if one wishes other clauses to be retained and used to direct the reasoning, clauses whose weight will be based solely on symbol count, then one chooses the max_weight accordingly, but greater than k. If one wishes the program to (possibly) expand the hot list during the run by adjoining clauses that do not match a resonator, one assigns a (larger) j to give the program the needed latitude. In the vast majority of cases, the weight of a clause is strictly greater than 3 when measured by symbol count. If a clause matches two resonators, that appearing earliest in the input dictates the weight of the clause, for weighting (in OTTER) focuses on the first template that matches. Similarly, in the context of adjoining a clause to the hot list during the run, if the clause matches, say, a resonator in the first set and one in the third set, the clause will be adjoined. If the clause matches a resonator in the third set but not in either the first or second, because of the weight it will be assigned (that of the matching resonator) and because of the assigned value to the dynamicJieat.weight, the clause will not be adjoined to the hot list. Intuitively, behind this layered-resonator refinement is the notion that any target that is deduced and retained merits use (more than any other deduction) for driving the program's reasoning and also merits inclusion in the hot list. The inclusion in the hot list of such a clause makes it available for the remainder of the run for immediately completing rather than initiating applications of an inference rule, where, because of using the hot list strategy, (in this context) the initiation of the the application occurs by immediately focusing on each new clause that is retained before any other clause is chosen as the focus of attention. Similar observations apply to any clause that is deduced and retained and that is a (designated) significant formula or equation in the field under study. Such a clause is given slightly less preference for driving the program's reasoning, but, in the context of the hot list, it is treated no differently from a deduced and retained target clause. Finally, deduced and retained conclusions that are steps of the chosen proof are given high preference for directing the reasoning, but less preference than either of the other two types of conclusion. Such a clause is not, however, given the role for immediate consideration with each newly retained
1446
Collected Works of Larry Wos
clause for completing an application of an inference rule. Because resonators treat variables as indistinguishable, deduced and retained conclusions other than targets, significant formulas and equations, and steps of the chosen proof may receive the type of classification just discussed. But perhaps that is how it should be, for such a conclusion does have the same functional shape as a member of one of the three classes. Highlights of Section 5.1: • The layered refinement is a strategy that combines the dynamic hot list strategy with the resonance strategy, where three sets of resonators are used, the last assigned a weight greater than the assigned dynamic Jieat.weight. • With the layered refinement—using for the first set of resonators the three members of the Church axiom system, for the second set fourteen members of five target axiom systems, and for the third set the thirty-three deduced steps of the Lukasiewicz proof of the Church system—OTTER completed a 27-step proof of the Church axiom system and a 29-step proof of the Hilbert axiom system. 5.2. TESTING AND EVALUATING THE REFINEMENT
Next in order was to test the conjecture that the refinement of combining res onance and heat was indeed fairly powerful. The approach consists of com bining the resonance strategy and the dynamic hot list strategy in the follow ing manner. Three sets of resonators are chosen, the first corresponding to the target(s)—for example, the members of the Church axiom system—the second corresponding to formulas or equations that have proved powerful (such as the members of the five axiom systems), and the third corresponding to the proof steps of some published result. All members of the first set are assigned the same small weight, a weight less than the assignment to the dynamicJieat.weight. All members of the second set are assigned the same weight, a weight slightly larger than that assigned to the members of the first set but still less than or equal to the dynamicJieat.weight. All members of the third set are assigned the same weight, a weight one larger than that assigned to the dynamicJieat.weight. Fi nally, a small value, say 2, is assigned to the dynamicJieat.weight, and the max_weight is assigned to be one greater, say 3. The idea is to (1) rely on res onators that correspond to useful steps of some proof; (2) prevent an addition to the hot list during the run, as a result of the deduction of any of those res onators (with a few exceptions); and (3) at the same time use as resonators the exceptions and (possibly) other interesting formulas or equations in a manner that permits the size of the hot list to grow not too rapidly during the run.
The Power of Combining Resonance with Heat
1447
5.2.1. The Lukasiewicz-Hilbert Resonators The highlights of this subsection are displayed at its close. To test the power of the approach by applying it to other axiom systems as the focus of attention, in the context of finding shorter proofs, I first turned to an attack on the Hilbert axiom system (consisting of theses 3, 18, 21, 22, 30, and 54, of which thesis 30 is dependent on the other five). The most appealing approach (to me) was to parallel the most successful experiment focusing on the Church axiom system (discussed in Section 5.1). Therefore, I (in effect) turned to the successful part of Round 3, replacing the 33 resonators corresponding to the Lukasiewicz proof of the Church axiom system with resonators that correspond to the 34 deduced steps of the Lukasiewicz deduction of the Hilbert axiom system. (For the curious, 6 of the deduced steps of the Lukasiewicz proof of the Church axiom system are not present in his proof of the Hilbert axiom system; hence, of the 34 resonators being used, 7 are not used in Round 3. Regarding the resonators corresponding to the 68 theses 4 through 71, 4 of the 33 resonators for the Church study are not among them, and 4 of the 34 resonators for the Hilbert study are not among them.) Each resonator was assigned a weight (priority) of 3. The dynamic hot list strategy was used, with the dynamicJieat.weight assigned the value 2. The max.weight was assigned the value 3. In weightJist(pick-and.purge) I placed the following: first, the 5 resonators corresponding to the members of the Hilbert axiom system (excluding L3), each assigned the value 1; second, the 14 correspondents of the members of the five axiom systems under study, each with a weight of 2; and third, the 34 resonators being used. As in the Church study, just in case marvelous events occurred regarding short proofs, I included as possible targets for proof all five axiom systems. Success was the result. In approximately 3 CPU-seconds on a SPARCstation10, a deduction of the Hilbert axiom system was completed. The length of the deduction is 26 (but announced as 27 because of the duplicate step resulting from the use of the dynamic hot list strategy), and the level is 18. Regarding the role of the dynamic hot list strategy, 8 of the 26 steps show heat=l. In view of the fact that the Lukasiewicz proof has length 34, the result suggests that the approach being tested is indeed powerful. Regarding the actual deduced formulas, 25 of the 26 are among the 34 deduced steps of the Lukasiewicz proof of the Hilbert axiom system. I find such aspects piquant, that a rearrangement of formulas (and, of course, their respective history) permits omitting (in this case) 9 and requiring but 1 additional. Even more evidence of the usefulness of the approach under study was pro vided by a glance at the output. In approximately 2 CPU-seconds, even before the Hilbert axiom system was proved, a proof was completed of the alternate Lukasiewicz axiom system, that consisting of theses 19,37, and 59. The proof has length 26 (which is also the announced length) and level 19. The Lukasiewicz proof has length 37. Of the 26 deduced steps, 8 show heat=l, and 6 are not
1448
Collected Works of Larry Wos
present among the 34 steps of the Lukasiewicz proof of the Hilbert axiom sys tem. Taking into account the facts that the max.weight was assigned the value 3, that no formula can have (in symbol count) such a small weight, and that resonators are treated (in effect) as templates with their variables ignored, one has rather substantial evidence of the value of the resonance strategy in general and, in particular, of the resonators that were used. The choice of resonators is dictated by the approach being evaluated. Still more evidence of the power of the approach is found in the output. In particular, in approximately 2 CPU-seconds, before completing a proof of the Hilbert axiom system, a proof is completed of the Wos axiom system (consisting of theses 19, 37, and 60). The proof has length 27 (which is also the announced length) and level 20. Of the 27 deduced steps, 9 show heat=l, and 7 are not present among the 34 steps of the Lukasiewicz proof of the Hilbert axiom sys tem. The proof, whose last step is thesis 60, contains as a subproof that of the alternate Lukasiewicz axiom system. Then, after deducing the Hilbert axiom system, OTTER completed a proof of the Church axiom system, one of length 28 and level 21. Of the deduced steps, 8 have heat=l in their history, and 7 are not present among the 34 steps of the Lukasiewicz proof of the Hilbert system. Highlights of Section 5.2.1: • With the layered refinement—using for the first set of resonators five members (excluding L3) of the Hilbert axiom system, for the second set fourteen members of five target axiom systems, and for the third set the thirty-four deduced steps of the Lukasiewicz proof of the Hilbert system— OTTER completed a 26-step proof of the Hilbert axiom system, a 26-step proof of the alternate Lukasiewicz axiom system, a 27-step proof of the Wos axiom system, and a 28-step proof of the Church axiom system. 5.2.2. The Lukasiewicz-Lukasiewicz Resonators The highlights of this subsection are displayed at its close. To continue testing and evaluating the refined approach, I replaced the 33 Lukasiewicz-Church resonators (used in Round 3) with those corresponding to the Lukasiewicz proof of his alternate system, the system consisting of theses 19, 37, and 59. The Lukasiewicz proof has length 37. (For the curious, 5 of the deduced steps of the Lukasiewicz proof of the Church axiom system are not present in his proof of the alternate Lukasiewicz axiom system; hence, of the 37 resonators being used, 9 are not used in Round 3. Regarding the resonators corresponding to the 68 theses 4 through 71, 4 of the 37 resonators are not among them.) As dictated by the refined approach, weight Jist(pick_and.purge) consisted of three-lists: the resonators corresponding to the members of the alternate Lukasiewicz axiom system, each assigned a weight of 1; followed by the resonators corresponding to the members of the five target axiom systems,
The Power of Combining Resonance with Heat
1449
each assigned a weight of 2; followed by the 37 Lukasiewicz-Lukasiewicz res onators, each assigned a weight of 3. Max-weight was assigned the value 3 and the dynamic_heat.weight the value 2. Again, in case marvelous events occurred regarding short proofs, I included as possible targets for proof all five axiom systems. In approximately 2 CPU-seconds, OTTER completed a 27-step proof of level 19 of the alternate Lukasiewicz axiom system. The proof is compact, being in fact a proof of thesis 59. Regarding the role of the hot list strategy, 9 of the 27 deduced steps show heat=l. Especially in the context of seeking shorter proofs, the result compares favorably with the Lukasiewicz proof, for his has length 37. A comparison of this 27-step proof and the 26-step proof (of the same axiom sys tem) found when using the Lukasiewicz-Hilbert resonators leads to an example of the delight and piquant behavior sometimes encountered in automated rea soning, mathematics, and logic. In particular, the 27-step proof comes very close to containing the 26-step proof as a subproof, of course, with a renumbering of the clauses. The single step of the longer proof is used once in a later application of condensed detachment, and the result of that application is present in the shorter proof, but with a different pair of ancestors. Further, the two ancestors are present in the longer proof. Therefore, indeed the 26-step proof is almost a subproof of the 27-step proof. Of substantial interest and (to me) satisfaction is the fact that the use of the Lukasiewicz-Hilbert resonators produced a shorter proof than did the use of the Lukasiewicz-Lukasiewicz resonators, for it suggests how useful and powerful steps from one proof can be when used as resonators for attacking a related theorem. Next, one finds in the output produced by the experiment a 28-step proof of the Wos axiom system, that consisting of theses 19, 37, and 60. The proof was completed in approximately 2 CPU-seconds, having a level of 20. The proof is compact, being in fact a proof of thesis 60. As an indication of the potential offered by the hot list strategy for sharply reducing the CPU time required to complete an assignment, one finds, among the 10 steps with heat—1, the last step of the proof, the deduction of the clause equivalent of thesis 60. Were it not for the hot list strategy causing the program to immediately choose for the focus of attention an ancestor of the last step—at least in the Argonne paradigm—the program would have been forced to wait until that ancestor had been chosen because of its weight (priority). Under different conditions, such an ancestor might not be chosen until much CPU time had elapsed, or perhaps never chosen, thus substantially delaying or even preventing the program from completing the desired proof. Then, in approximately 4 CPU-seconds, OTTER completed a proof of the Hilbert axiom system, a proof of length 28 (but announced length 29) and level 19. Of the deduced steps, 10 show heat=l. Finally, the program deduced the Church axiom system, with a proof of length 30 and level 21, 10 of whose steps show heat=l.
1450
Collected Works of Larry Wos
Highlights of Section 5.2.2: • With the layered refinement—using for the first set of resonators the three members of the alternate Lukasiewicz axiom system, for the sec ond set fourteen members of five target axiom systems, and for the third set the thirty-seven deduced steps of the Lukasiewicz proof of the alternate Lukasiewicz system—OTTER completed a 27-step proof of the alternate Lukasiewicz axiom system, a 28-step proof of the Wos axiom system, a 28step proof of the Hilbert axiom system, and a 30-step proof of the Church axiom system. 5.2.3. The Lukasiewicz-Frege Resonators The highlights of this subsection are displayed at its close. The next test for the refined approach was to apply it to an attack on finding a shorter proof for the Frege axiom system, which consists of theses 18, 21, 35, 39, 40, and 46, with thesis 21 dependent on the other five theses. Therefore, in addition to the (new) resonators with weight 1 (corresponding to the members of the Frege axiom system) and with weight 2 (corresponding to the 14 members of the five axiom systems), respectively, a new third set to replace that used in the preceding experiment was inserted, namely, a set of 41 resonators (each with a weight of 3) corresponding to the Lukasiewicz proof. In approximately 44 CPU-seconds, a deduction of the Frege axiom system was completed; its length is 37 (but announced as 39), and its level is 21. Of the deduced steps, 11 show heat=l. Last, in approximately 49 CPU-seconds, a 31-step proof of level 22 was completed of the Hilbert axiom system; 10 of the steps show heat=l. Highlights of Section 5.2.3: • With the layered refinement—using for the first set of resonators the six members of the Frege axiom system, for the second set fourteen members of five target axiom systems, and for the third set the forty-one deduced steps of the Lukasiewicz proof of the Frege system—OTTER completed a 37-step proof of the Frege axiom system and a 31-step proof of the Hilbert axiom system. 5.2.4- The Lukasiewicz-Wos Resonators There remained but one test, that focusing on the use of 39 resonators corre sponding to the Lukasiewicz proof of the Wos axiom system. Of course, Lukasiewicz did not know of that axiom system, as far as I am aware; indeed, as remarked earlier, it was not found until 1991. Because, typically, a proof of the Wos system is very closely related to a proof of the alternate Lukasiewicz axiom sys tem, one might expect to get results similar to those reported earlier when the
The Power of Combining Resonance with Heat
1451
Lukasiewicz-Lukasiewicz resonators were used. In fact, the results were almost identical in that, except for a renumbering of the clauses, the same proofs were found by OTTER. Even the CPU time was essentially unchanged. Regarding the order in which the proofs were completed, the only change was that the Wos axiom system was proved before the alternate Lukasiewicz system was. 5.3. TESTING AND EVALUATING A VARIANT OF THE REFINEMENT
The approach formulated in this section is summarized at its close, and, with the exception of Section 5.3.5, highlights are displayed at the close of each subsection. Studies not reported in this article suggested that a variant of the layeredresonator refinement merited experimentation. Resonance and heat still pro vided the basis, but, rather than the dynamic hot list strategy, the hot list strategy was used. To allow clauses that do not match a resonator to play a (possibly) big role, the max_weight was assigned the value 20 rather than 3; if measured in symbol count, 20 is greater than or equal to the weight of each of theses 4 through 71. As in the refinement tested and evaluated in the pre ceding section, three sets of resonators were used. The first set consisted of the correspondents to members of the axiom system mainly in focus, for example, that of Church, each assigned a weight of 1. The second set consisted of the correspondents of the 14 members (other than L3) of the five axiom systems that have been studied throughout this article, each assigned a weight of 2. The third set consisted of the correspondents of the proof steps taken from a success reported earlier here, for example, the deduced steps of the 27-step proof of the Church axiom system (cited in Section 5.1), each with a weight of 3. Not included as part of the refinement studied in the preceding section, McCune's ratio strategy [16] was used. The following command suffices. assign(pick_given_ratio,3). With the command just cited, OTTER is instructed to choose (for the focus of attention) three clauses by weight, one by first come first serve (or breadth first), then three, then one, and the like. The ratio strategy blends (subject to the assignment of the pick-givenjratio parameter) a bit of level saturation with (usually more) choosing of clauses for the focus of attention by weight. Finally, as an addition, McCune's ancestor subsumption [16] is used, in turn necessitating (for practical reasons) the use of back subsumption. By compar ing derivation proof length whenever a retained conclusion is deduced a second time, the use of ancestor subsumption enables a program to directly and ex plicitly attack the problem of seeking shorter proofs. With the use of ancestor subsumption, when a conclusion is drawn more than once, the program retains the copy reached by the shorter path. The following two commands are what is needed. set(ancestor_subsume).
1452
Coiiected Works of Larry Wos
set(back_sub). The general plan was to test and evaluate the variant (in which the dynamic hot list strategy is replaced by the hot list strategy and ancestor subsumption is used) by conducting five experiments, each experiment designed to extend the results of its (so-to-speak) earlier counterpart. Each of the five experiments would be what might be called self-referential in the following sense. For ex ample, for the second experiment, the elements of the first of the three sets of resonators to be used correspond to the members of the Hilbert axiom system (excluding L3), and the elements of the third set correspond to the 26 proof steps of the proof of the Hilbert axiom system, the proof (cited in Section 5.2.1) obtained by using the Lukasiewicz-Hilbert resonators. I suggest "self-referential" as the classification precisely because the source for the third resonator set is a proof of the Hilbert axiom system found by featuring that system and, at the same time, the emphasis in the experiment is on that axiom system. I say "emphasis", noting that, although all five axiom systems are targets for finding shorter proofs, the most likely progress will occur with the axiom system being featured in the first and third resonator sets. Regarding the ensemble of five experiments, one might wonder about the merit of replacing the set of resonators corresponding to a proof by another such set when the two sets have a large intersection. Indeed, the 27 resonators used in the first experiment in which the Church axiom set is featured share in common 21 resonators with the 26 resonators used in the second experiment in which the Hilbert axiom set is featured. So one might hazard that the second experiment might not merit conducting. A partial answer is contained in the observation that one simple but key lemma, if omitted from consideration, can block the discovery of a pleasing proof or the completion of a proof far shorter than one has in hand. Highlights of Section 5.3: • Quite effective is a variant of the layered refinement; rather than using the dynamic hot list strategy, the variant combines the hot list strategy with the resonance strategy, where three sets of resonators are used, the last corresponding to deduced steps of a proof obtained with the layered refinement. 5.3.1. Experiment 1, Focusing on the Church Axiom System The highlights are displayed at the close of this subsection. In Experiment 1 for testing the variant, I used for the first set of resonators the correspondents to the members of the Church axiom system, which con sists of theses 18, 35, and 49. For the third set, I used 27 resonators corre sponding to the proof steps of the Church axiom system obtained by using the
The Power of Combining Resonance with Heat
1453
Lukasiewicz-Church resonators. As in all five experiments, I used for the sec ond set of resonators correspondents of the members of the five target axiom systems, excluding the correspondent of L3 because of being in the hot list. As noted, (in all five experiments and consistent with the refinement featured earlier) members of the first set are each assigned a weight of 1, of the second set each a weight of 2, and of the third set each a weight of 3. The main goal of Experiment 1 was to find a proof of the Church axiom system in which strictly fewer than 27 applications of condensed detachment are required. Any other breakthroughs regarding "short" proofs would be a bonus and would also be evidence of the value of relying on resonators corresponding to the steps of one proof when attacking a related proof. OTTER completed four proofs of the Church axiom system, of respective lengths 30, 29, 27, and—of some satisfaction—26. The latter has level 19 and was completed in approximately 2004 CPU-seconds on a SPARCstation-10 with retention of clause (49484). The proof is compact, being a proof of thesis 35 and containing as subproofs proofs of theses 18 and 49. Of the 26 deduced steps, 6 show heat=l and 5 are not present in the 27-step proof used to influence the search. Also in the run, the program completed six proofs of the Hilbert axiom system, of respective lengths 42, 39, 32, 31, 33, and 29, the latter having level 23. That proof was found in approximately 4847 CPU-seconds, completing with retention of clause (96572). Immediately one might wonder at the sequence of proofs getting shorter and shorter, then longer, then even shorter. After all, the use of ancestor subsumption is intended to promote the discovery of ever-shorter proofs. To begin with, a glance at the output file shows that six proofs are found for thesis 54 (a member of the Hilbert axiom system), the last three of respective lengths 36, 29, and 25. Any proof of the Hilbert axiom system must contain a proof of thesis 54 as well as a proof of the other members of the system. Ancestor subsumption has the object of finding shorter proofs of individual conclusions, not of the and of a set of conclusions, and the target axiom systems under attack have the form of an and of its members. The shorter of two proofs of, say, thesis 54 can have fewer deduced steps by avoiding the use of formulas that, unfortunately, are needed for proving one or more of the other members of the axiom system. In the limiting case, one can imagine finding proofs of the individual members such that, though each is pleasingly short, no deduced step is present in two or more proofs. The resulting proof of the and of the members might indeed be lengthened markedly when compared with a proof containing, as subproofs, not so short proofs of the individual members. Similar remarks hold for seeking shorter proofs for (deductions of) a single thesis. However, in the presence of forward subsumption, one does not find the proof (deduction) of a unit clause followed later by a longer proof of that clause. The clause that would be needed for the second proof is forward subsumed by the earlier copy. The reason one does see longer proofs of the and of a set of unit clauses rests with the fact that forward subsumption is not applied to copies
1454
Collected Worfcs of Larry Wos
of the empty clause and the empty clause is the result of the corresponding application of hyperresolution, where the nucleus is the clause equivalent of the negation of the and of the members of the axiom system under study. (One would clearly wish to avoid subsumption being applied to copies of the empty clause, especially when one is after more than one proof in a single run.) In regard to proof length, for theorems whose conclusion has the form the and of elements representable by unit clauses as well as theorems whose conclu sion is representable with a single unit clause, the use of ancestor subsumption together with back subsumption can occasionally cause duplicate steps to be present in a proof. Therefore, the proof length given by the program can be greater than the actual proof length. A duplicate step occurs in a proof when (1) a retained clause A is used to deduce a clause B that is in the proof, and hence A as its ancestor is in the proof; (2) later a clause C is deduced that is a copy of A but obtained with a strictly shorter derivation path, and hence C is retained because of ancestor subsumption, and A is purged because of back subsumption; and (3) C is used as an ancestor of a clause D that is also in the proof. (When a clause is removed by back subsumption from the database of clauses usable for drawing conclusions, it is still available for proof recovery.) In such an event the actual proof length is strictly less than the figure cited by the program. Indeed, no need exists for the clause C, for A serves nicely in place of it. Further, one may be able to produce a yet shorter proof by purging, if such exists, the clauses that are on the path to C if they are not needed elsewhere in the proof. One thus has a taste of how complicated the seeking of shorter proofs is; no practical algorithm exists, as far as I know. Far more on the subject of seeking shorter proofs and on the obstacles that can be encountered is found in Chapter 3 of [11]. Of more interest, one finds in the run a proof of the alternate Lukasiewicz axiom system, a proof of length 26 and level 19, completed in approximately 1793 CPU-seconds with retention of clause (47689). The interest comes in part from the fact that use of the Lukasiewicz-Lukasiewicz resonators produced a 27-step proof, and it comes in part from the fact that all deduced formulas in the 26-step proof are among those of the 27-step proof. But for a small amount of reshuffling and a slight difference in ancestry, the shorter proof would be a subproof of the longer. Essentially the same relation holds for the 27-step proof of the Wos axiom system found in the same run when compared with the 28-step proof found using the Lukasiewicz-Wos resonators. The shorter proof has level 20, required approximately 1827 CPU-seconds to find, and was completed with retention of clause (47959). Finally, in the run, one finds eight proofs of the Frege axiom system, ranging in length from 40 to 31 (the last). The 31-step proof, which has level 19, was found in approximately 9797 CPU-seconds, completing with retention of clause (149314). Seven of its deduced steps show heat=l and, more interesting to me, 7 of its deduced steps are not among the 37-step proof found by using the Lukasiewicz-Frege resonators. The latter figure illustrates how resonators (in
The Power of Combining Resonance with Heat
1455
this case, 27 from a proof of the Church axiom system) can enable a program to (in effect) outline a major part of a sought-after proof. Taken as a whole, the preceding results suggest that the variant is promising. Therefore, I turned to the second experiment. Highlights of Section 5.S.1: • With the variant of the layered refinement—using for the first set of res onators the three members of the Church axiom system, for the second set fourteen members of five target axiom systems, and for the third set the twenty-seven deduced steps of the layered-refinement proof of the Church system—OTTER completed a 26-step proof of the Church axiom system, a 29-step proof of the Hilbert axiom system, a 26-step proof of the alter nate Lukasiewicz axiom system, a 27-step proof of the Wos axiom system, and a 31-step proof of the Frege axiom system. 5.3.2. Experiment 2, Focusing on the Hilbert Axiom System The highlights are displayed at the close of this subsection. As already noted, Experiment 2 featured the Hilbert axiom system, with the first set of resonators the correspondents of its members (excluding L3) and the third set the correspondents of the 26 deduced steps of the proof obtained with the Lukasiewicz-Hilbert resonators. OTTER completed two proofs of the Hilbert axiom system, of respective lengths 26 and 27, both of level 18. The first was completed in approximately 16 CPU-seconds, with retention of clause (3922). The proof is identical to that found with the Lukasiewicz-Hilbert resonators. In approximately 68 CPU-seconds, with retention of clause (10329), the pro gram found a 29-step proof of the Church axiom system, one of level 20. Of the deduced steps, 7 show heat=l and 9 are not among those of the 27-step proof of the Church axiom system obtained with the Lukasiewicz-Church resonators. In approximately 68 CPU-seconds OTTER found a 35-step proof of the Frege axiom system, but, a bit more satisfying, in approximately 14,464 CPUseconds, the program then found a 34-step proof. That proof has level 20 and was completed with retention of clause (177222). Only in the past few years, as a result of McCune's advances in the design of automated reasoning programs, has it been more than practical to pursue proofs relying on the retention of clauses numbering in the hundreds of thousands. The cited 34-step proof offers a piquant property: It contains as a subproof the 29-step proof of the Church axiom system. Also of some satisfaction is the shortening in length to 34 when compared with the length of 37 for the proof obtained with the LukasiewiczFrege resonators reported in Section 5.2.3. Of the 34 deduced steps, 11 are not among those of the 37-step proof. Regarding the alternate Lukasiewicz axiom system, two proofs were found of respective lengths 26 and 25. The second was found in approximately 10
1456
CoiJected Works of Larry Wos
CPU-seconds with retention of clause (2903); it has level 18. In view of the fact that the original Lukasiewicz proof has length 37 and the fact that the proof obtained with the Lukasiewicz-Lukasiewicz resonators (reported in Section 5.2.2) has length 27, the shortening of proof length provides more evidence of the value of the variant under testing. The 25-step proof contains but one formula, the following, not present in the 27-step proof obtained with the LukasiewiczLukasiewicz resonators. P(i(i(i(n(x),y),z),i(i(n(y),x),z))). As for the Wos axiom system, approximately 7 CPU-seconds sufficed to find a 27-step proof of level 20, completing with retention of clause (2124). Two items are of some interest. First, all formulas of the 27-step proof are among those of the 28-step proof found using the Lukasiewicz-Wos resonators (of Section 5.2.4) and in the same order. In fact, the shorter proof comes very close to being a subproof of the longer. Second, for reasons unknown to me— although, ordinarily, a proof of the Wos axiom system is obtained by adjoining one more condensed detachment step to the corresponding proof of the alternate Lukasiewicz axiom system, a step to deduce thesis 60—such did not occur in the run under discussion. Highlights of Section 5.3.2: • With the variant of the layered refinement—using for the first set of res onators five members (excluding L3) of the Hilbert axiom system, for the second set fourteen members of five target axiom systems, and for the third set the twenty-six deduced steps of the layered-refinement proof of the Hilbert system—OTTER completed a 26-step proof of the Hilbert ax iom system, a 29-step proof of the Church axiom system, a 25-step proof of the alternate Lukasiewicz axiom system, a 27-step proof of the Wos axiom system, and a 34-step proof of the Frege axiom system. 5.3.3 Experiment 3, Focusing on the Frege Axiom System The highlights are displayed at the close of this subsection. Next in order is Experiment 3, an experiment that proved somewhat reward ing. Featured in the experiment is the Frege axiom system. Indeed, the first set of resonators (each assigned a weight of 1) consisted of the correspondents of its members, namely, theses 18, 21, 35, 39, 40, and 46, of which thesis 21 is dependent on the other five. The third set consisted of the 37 correspondents of the deduced steps of the proof of the Frege axiom system obtained with the Lukasiewicz-Frege resonators. Perhaps of interest, of the 27 resonators in the third set in Experiment 1, all but 2 are among the 37 resonators of the third set of this (Frege) experiment.
The Power of Combining Resonance with Heat
1457
OTTER found eight proofs of the Frege axiom system, of respective re ported lengths of 36, 39, 35, 36, 33, 37, 37, and 35. The first was completed in approximately 13 CPU-seconds with retention of clause (3365), and the last was completed in approximately 21,497 CPU-seconds with retention of clause (189431). I used the term "reported proof length", for, as commented earlier, the use of ancestor subsumption coupled with back subsumption can lead to the presence of duplicate steps in a proof. Such is the case in the last of the eight proofs; in particular, two copies of the clause equivalent of thesis 39 are present. As demonstrated in Section 5.3.4 when cursory proof checking takes center stage, occasionally proofs of the duplicate-step type serve well in the context of seeking shorter proofs. In the same run, the program completed three proofs of the Church axiom system, of respective lengths 29, 27, and 25 and of respective levels 21, 20, and 18. The time required for the proofs ranged from approximately 11 CPUseconds to 21,497 CPU-seconds. The last proof completed with retention of clause (189430). As yet another delight of mathematics, the 25-step proof is a subproof of the cited 34-step proof of the Frege axiom system. The deduction of a 25-step proof was satisfying, for it was the shortest obtained in this study so far. As for the Hilbert axiom system, seven proofs were found, of respective lengths (in order) 37, 35, 32, 31, 33, 32, and 29. For whatever it signifies, the last has level 18, and all the others have level 22 or 23. The required time in CPU-seconds ranges from approximately 65 to 8311. Where the first proof completed with retention of clause (8942), the last completed with retention of clause (119991). Regarding the alternate Lukasiewicz axiom system, in approximately 3331 CPU-seconds, OTTER found a length 26 and level 19 proof, completed with retention of clause (79082); no other proof of that system was found. All 26 de duced formulas are among the 27 of the proof of the system using the LukasiewiczLukasiewicz resonators; in fact, the former is close to being a subproof of the latter. Contrary to expectation, the single proof of the Wos axiom system that was found does not follow the pattern of being the proof of the alternate Lukasiewicz system (found earlier in the run) with one additional formula adjoined at the end, namely, the clause form of thesis 60. Indeed, the proof has announced length 29 and actual length 28, containing two copies of the clause correspondent of thesis 22, which, incidentally, is not a member of the axiom system. That level 20 proof was found in approximately 3385 CPU-seconds, completing with retention of clause (79344). It contains one formula not present in the 28-step proof obtained with the Lukasiewicz-Wos resonators. Highlights of Section 5.S.S: • With the variant of the layered refinement—using for the first set of res-
1458
Collected Works ofL&rry Wos onators the six members of the Frege axiom system, for the second set fourteen members of five target axiom systems, and for the third set the thirty-seven deduced steps of the layered-refinement proof of the Frege system—OTTER completed a 33-step proof of the Frege axiom system, a 25-step proof of the Church axiom system, a 29-step proof of the Hilbert axiom system, a 26-step proof of the alternate Lukasiewicz axiom system, and a 28-step proof of the Wos axiom system.
5.3.4- Experiment 4, Focusing on the Alternate Lukasiewicz Axiom System The highlights are displayed at the close of this subsection. Experiment 4, which featured the alternate Lukasiewicz axiom system, pro duced an unexpected and most satisfying result, as will be seen. Perhaps the success can be traced in part to the fact that, of the 27 resonators of which the third set consisted in the experiment, 8 are not present in the 27 used in Experiment 1. The members of this third set correspond to the 27 deduced steps of the proof of the alternate Lukasiewicz axiom system obtained by using the Lukasiewicz-Lukasiewicz resonators. In Experiment 4, the first set of resonators correspond to the members of the axiom system, namely, theses 19, 37, and 59. Four proofs of respective lengths 26, 34,35, and 34 of the axiom system being featured were found, the first of level 19. Approximately 6 CPU-seconds were required as well as the retention of clause (1921). Except for the presence of one formula of the 27-step proof of the alternate Lukasiewicz axiom system (obtained by using the Lukasiewicz-Lukasiewicz resonators), the order of formulas is the same in both the 26-step and the 27-step proofs of that axiom system. Then, as is so typical, in approximately 6 CPU-seconds the program found a 27-step proof (of level 20) of the Wos axiom system, a proof whose first 26 deduced steps are those of the just-cited 26-step proof of the alternate Lukasiewicz axiom system. As for the Hilbert axiom system, the shortest that was found in Experiment 4 has announced length 37 and level 18, completing in approximately 4904 CPUseconds with retention of clause (102102). Closer inspection shows that 5 of the 37 steps are duplicates, suggesting (as discussed in Section 6) that a perhaps far shorter proof can be easily obtained. The shortest proof of the Frege axiom system found in the run has length 35 and level 20, requiring approximately 70 CPU-seconds, and completing with retention of clause (10678). The best I have saved for last. Five proofs of the Church axiom system were found, of respective announced lengths 29, 36, 36, 31, and 30. The first proof completed in approximately 70 CPU seconds with retention of clause (10687), and the last (of level 19) completed in approximately 4201 CPU-seconds with retention of clause (98477). Although on the surface the cited results are far from striking, hidden within them is a treasure, in particular, within the last two proofs. Each of the two proofs contains three duplicate steps. Therefore, their respective actual lengths are 28 and 27. The promised "most satisfying result", rather than resting with the cited actual lengths, rested with a possible
The Power of Combining Resonance with Heat
1459
implication. Specifically, perhaps one or more of the duplicate steps would be found to be the end of a chain of formulas (used for its derivation) such that no member of the chain was needed elsewhere in the proof. In other words, perhaps hidden in either or both of the last two cited proofs (found in the run featuring as target the alternate Lukasiewicz axiom system) one might find a "short" proof of the Church axiom system. I was further encouraged in that regard when I found in the run, among the proofs of thesis 35, two of respective lengths 24 and 23. Indeed, many of the proofs found by OTTER of the Church axiom system are precisely a proof of thesis 35, in other words, are compact. Therefore, before turning to Experiment 5—featuring the Wos axiom system and expected to produce little more of interest because of the (frequently) close relation of its proof to a proof of the alternate Lukasiewicz axiom system—two runs, each in the spirit of cursory proof checking, were in order. The first of the two calls for the use of 23 resonators, the correspondents of the proof steps of the 23-step proof of thesis 35. The second of the two focuses on the 24-step proof. In both, I assigned the value 3 to each resonator and the value 3 to max.weight. The idea was, in a cursory manner, to proof check each of the two proofs by preventing the program from retaining any clause that failed to match one of the resonators in use. Of course, one could merely read through the proofs to see whether theses 18 and 49 were present to decide whether the proofs were compact and were, in fact, proofs of the entire Church axiom system. However, such is ordinarily not my preference; indeed, I find it of greater interest to see what results from an appropriate OTTER run. Sometimes a prize is won; sometimes insight is gained; sometimes an idea for a new strategy is born. Two additional experiments, also somewhat in the spirit of proof checking, merited conducting, experiments respectively focusing on the 27-step and 28step proof of the Church axiom system, each found in the run for Experiment 4. The object would be to settle the question concerning what would occur when and if the proofs were purged of duplicate steps and, possibly, of additional steps used only in the derivation of a duplicate step. Perhaps either or both experiments would unearth a hidden proof, hidden within the longer one in which duplicate steps are present. Because of their position in the output file—the 24-step proof of thesis 35, the announced 31-step proof of the Church axiom system, the 23-step proof of 35, and the announced 30-step proof of the Church axiom system—I thought it quite likely that the four contemplated experiments would pair off in the following (probably obvious) manner. It seemed likely that use of either the 30 resonators (including 3 duplicates) or the 23 resonators in a cursory proofchecking run would produce the same proof of the Church axiom system. The implication is that, in either case, OTTER would produce a 23-step proof. With similar reasoning, use of either the 31 resonators (including 3 duplicates) or the 24 resonators would lead to the same proof of the Church axiom system, a proof of length 24. Especially when compared with the Lukasiewicz proof of the Church axiom system, which has length 33, the completion of a 23-step proof
1460
Collected Works of Larry Wos
would mark an important advance and would offer strong evidence of the value of the variant under study. In less than 1 CPU-second, use of the 23 resonators produced the hopedfor 23-step proof of the Church axiom system, a proof of level 19, completing with retention of clause (57). As for the use of the 30 resonators (including 3 duplicates), the only change concerns the completion on retention of clause (61). Regarding a comparison of the clauses that correspond to the 23 resonators with the 23 deduced steps of the proof, only the order was changed, implying that the proof that was found differed at least somewhat from the 23-step proof of thesis 35. The result also showed that the 27-step proof extractable from the announced 30-step proof does indeed contain unneeded formulas, 4 of them, used in the derivation of the 3 duplicate steps. Even more exciting were the results of the experiments respectively relying on the 24 resonators and on the 31 resonators (including 3 duplicates). With the 24 resonators, in less than 1 CPU-second with retention of clause (56), OTTER found a level 18 and length 22 proof of the Church axiom system. With the 31 resonators (including 3 duplicates), the result was the same except for relying on the retention of clause (61). In addition to avoiding the use of 2 of the 24 steps in the 24-step proof of thesis 35 (the following), the order was indeed changed. P(i(x,i(i(x,y).y))). P(i(i(i(n(i(x,y)),x).z),z)). The result also showed that the 28-step proof extractable from the announced 31-step proof does indeed contain unneeded formulas, 6 of them, used in the derivation of the 3 duplicate steps. Probably more important, the success illus trates the usefulness of the type of cursory proof checking under discussion. Highlights of Section 5.3.4: • With the variant of the layered refinement—using for the first set of res onators the three members of the alternate Lukasiewicz axiom system, for the second set fourteen members of five target axiom systems, and for the third set the twenty-seven deduced steps of the layered-refinement proof of the alternate Lukasiewicz system—OTTER completed a 26-step proof of the alternate Lukasiewicz axiom system, a 27-step proof of the Wos axiom system, a 32-step proof of the Hilbert axiom system, a 35-step proof of the Frege axiom system, and a 27-step proof of the Church axiom system, • Also completed were a 24-step and a 23-step proof of thesis 35, significant because, often, a proof of that thesis is a proof of the entire Church axiom system. • In a cursory proof-checking mode, use of the 24-step proof of thesis 35 quickly led to a 22-step proof of the Church axiom system.
The Power of Combining Resonance with Heat
1461
5.3.5. Experiment 5, Focusing on the Wos Axiom System Although little was expected in Experiment 5 (featuring the 28 resonators cor responding to the deduced steps of the proof of the Wos axiom system ob tained with the Lukasiewicz-Wos resonators) because of the close relation to Experiment 4 (relying on 27 resonators), it required conducting. The experi ment produced the expected results, the same proofs as those produced with Experiment 4 and with little change in CPU time or in clause numbering. The presence of 9 rather than 8 resonators not among those of Experiment 1 was of no consequence. 5.4.
P R O O F CHECKING WITH
OTTER
This section provides a taste of two types of proof checking that are possible with OTTER, cursory proof checking and rigorous proof checking. (The subject is treated in far greater detail in Chapter 10 of [11].) Briefly, the difference between the two types of proof checking rests with the precision that is required. When rigorous proof checking is the assignment, success requires that a proof be produced that is identical, including ancestor information, to that being proof checked. Since the proof being checked may be incomplete, may indeed be missing steps that are implicit, the program is required to complete the proof by supplying all steps explicitly. In such an event, obviously one cannot claim with certainty that the program has produced the precise proof that is, for example, supplied by the author in a paper being refereed. I have thought for years that, eventually, an automated reasoning program will be quite useful in materially aiding one in refereeing papers, especially in checking proofs that are often difficult to validate if left to one's own device. When cursory (rather than rigorous) proof checking is the assignment, suc cess requires that a proof be produced that resembles that being proof checked; in particular, far less precision is required. Indeed, success may be marked by the completion of a proof that is more elegant than that serving as the target, more elegant, for example, by being shorter or by avoiding the use of some class of terms such as those of the form n(n(t)) for any term t, where n denotes negation. Regarding the use of OTTER, in rigorous proof checking (as illustrated shortly) the program is given (where possible) a detailed proof including the ancestors and inference rule used to obtain each deduced step. The program is prevented from straying from the detailed proof. When asked to cursory proof check, (as illustrated in the preceding sections and reviewed immediately) the program is given guidelines (in the form of weight templates) to direct its search for a proof, with the implicit permission to stray a bit from the guidelines.
With no guarantee that OTTER will return the proof being checked, to cursory proof check a proof, one places weight templates that correspond to its deduced steps in weightJist(pick_ancLpurge), each assigned a small weight, say,
1462
Collected Works of Larry Wos
3. The idea is to give preference (over other clauses should any be retained) to any clause that resembles (with its variables ignored) one of the deduced steps of the proof. OTTER treats the variables in a weight template as indistinguishable, which turns out to be an advantage in research, as discussed and illustrated in this article. Indeed, the cited treatment enables the researcher to easily use the resonance strategy. To virtually guarantee that the program retain a clause only if it resembles a proof step, one assigns to the max-weight the value assigned to the included weight templates. Despite the use of a tight max.weight, the treatment of variables in weight templates does permit the program to retain clauses other than those in the proof being checked, which is the main reason that cursory proof checking does not guarantee that a proof completed by the program will be identical to that in hand. In addition, other factors may cause the program to draw conclusions in an order different from that of the proof under study. Section 5.3.4 offers a fine example of how the drawing of conclusions in an order different from that of the proof under study can produce a proof other than that in hand and, even better, produce a more elegant proof. Indeed, when cursory proof checking was applied to a 24-step proof of thesis 35, OTTER produced a 22-step proof all of whose steps are among the 24, but in a different order. As a bonus (and as noted), the proof is of greater interest, for it is a 22step proof of the entire Church axiom system. The result was most satisfying, especially when compared with the Lukasiewicz proof of length 33. In contrast to finding a more elegant proof, because the program may con sider conclusions in an order different from that of the proof under study, occa sionally a less satisfying proof is produced, one with greater length, for example. Even worse, the program may fail to complete any proof, a phenomenon that did puzzle me for a while until the following occurred to me. Let A be a step of the proof that is being cursorily proof checked, and assume that A is deduced and retained. Next assume that A is chosen as the focus of attention, and assume that its use leads to the retention of two clauses, B and E, such that B is a later step in the proof and E is not in the proof. Almost certainly, the clause E matches a resonator, but, of course, it is not identical to any. Then assume that the choice of B as the focus of attention leads to the deduction of C, an even later step in the proof, but assume that E subsumes C, preventing its retention. Where C would be used to draw conclusions, the program can use E. But if the nature of E is such that its use leads to a clause that subsumes the needed clause that the use of C would have yielded, and if the subsuming clause does not match any of the resonators, then the small max-weight can cause the program to immediately discard the subsuming clause. The result can be that no proof is completable within the conditions under which the program is running. Now, if the situation just described occurred where the hot list strategy was not used, then its use might perturb the order in which clauses are deduced enough to avoid what I have just hypothesized. If the described situation oc-
The Power of Combining Resonance with Heat
1463
curred when the hot list strategy was used, but the dynamic hot list strategy was not, then adding the use of the dynamic hot list strategy might be just what is needed to obtain proofs. On the other hand, use of the dynamic hot list strategy might be the problem, and, therefore, removing its use might be enough to enable the program to find the sought-after proof. I have not verified my hy pothetical example by instructing O T T E R to set (very .verbose), which places in the output file copious detail, permitting one to carefully analyze what actually occurred. In sharp contrast to the just-cited hypothetical example that illustrates how cursory proof checking can fail to produce any proof, much less that being checked, rigorous proof checking does not encounter this situation. Indeed, when O T T E R is instructed to rigorously proof check by using demodulation coupled with weighting in a manner to be illustrated, no conclusions are retained other than those in the proof under consideration. Because of the basic search algo rithm used by O T T E R and because of the effect weighting has on the choice of clause on which to focus attention, their order will usually differ from that of the proof in hand. The differences are not important in the sense that a reshuf fling and renumbering will produce the desired order of deduced steps. In other words, despite the different order of retained conclusions, the program is still (in effect) proof checking the given proof. To retain the conclusions of interest and, at the same time, reject all others, the idea conceptually is to test each con clusion to see if its ancestry is acceptable. If the ancestry passes the test, then, through demodulation, one of the desired conclusion numbers (corresponding to a step of the proof being checked) is planted in the clause. If the test fails, then demodulation does not plant a desired conclusion number, and through weighting the clause is purged. The following commands provide the promised illustration, giving one a taste of how it works. To provide the basis for the rigorous proof checking, in the following manner, the clauses that capture the hypotheses of the proof are assigned numbers that correspond to the order of the hypotheses. list(sos). P(cl,i(i(x,y),i(i(y.z).i(x,z)))). P(c2,i(i(n(x),x),x)). P(c3,i(x,i(n(x),y))). end_of_list. Next, to enable the program to accept conclusion identification numbers and correctly plant the corresponding ancestry history, the clause for condensed detachment (or that which is needed for the type of reasoning in use) is modified in the following manner. '/, The f o l l o w i n g modified c l a u s e i s used w i t h h y p e r r e s o l u t i o n V. f o r condensed d e t a c h m e n t . -P(u,i(x,y)) I -P(v,x) | P(rew(u,v),y).
1464
Collected Works of Larry Wos
Because all retained conclusions will have as an argument an identification num ber, the denial clauses (for example, that for the Church axiom system) must be modified. -P(x,i(q,i(p,q))) I -P(y.i(i(p,i(q,r)),i(i(p,q),i(p,r)))) I - P ( z , i ( i ( n ( p ) , n ( q ) ) , i ( q , p ) ) ) I $ANSWER(step_allBEH_Church_FL_18_35_49).
As expected, such clauses are placed in list (usable). With the preceding as the basis for the rigorous proof checking, next in order is an illustration of the type of demodulator that takes the ancestor numbers and plants, if appropriate, the correct conclusion number. list(demodulators). V, Following e s s e n t i a l l y mirrors the Lukasiewicz proof with h i s t o r y . EQ(rew(cl,cl),q4). EQ(rew(c4,c4),c5). EQ(rew(c4,cl),c6). EQ(rew(c5,c6),c7). EQ(rew(c7,cl),c8). EQ(rew(cl,c3),c9). end_of_list. As is probably obvious, the preceding is just the initial segment of the Lukasiewicz derivation of theses 4 through 71. Not obvious was the necessity to add con densed detachment steps to cope with his practice of combining steps, of re naming variables, and the like. To (in effect) complement the actions of demod ulation in the context of rigorous proof checking, one includes the following for weighting. weight_list(pick_and_purge). weight ( P ( r e w ( $ ( 0 ) , $ ( 0 ) ) , $ ( D ) , 99). end_of_list. One then includes an assignment of max-weight, say the value 80, that is strictly less than that appearing in the template. (One immediately sees a sharp dif ference between rigorous and cursory proof checking. In the former, a weight template and a max.weight are included to purge unwanted clauses; in the lat ter, weight templates and max-weight are included to enable the program to retain desired clauses.) The following close look at the given demodulators and their interaction with the given weight template is merited. OTTER begins by applying condensed detachment (through the use of the cited, modified three-literal clause) to two copies of the first of the three Lukasiewicz axioms, that denoted by cl. Before an attempt to apply demodu lators, the following clause (including the ancestor history) is deduced. P(rew(cl,cl),i(i(i(i(x.y),i(z,y)),u),i(i(z,x),u))).
The Power of Combining Resonance with Heat
1465
The cited clause is immediately demodulated by using the first of the cited demodulators to produce the following. P(c4,i(i(i(i(x,y),i(z,y)),u),i(i(z,x),u))). As the notation correctly suggests, the program has deduced the clause equiv alent of thesis 4 as its second argument; its first argument is the corresponding identifier. Had the clause remained in the cited undemodulated form—which would occur if the needed demodulator were omitted from the input—then it would be assigned a weight greater than 99. In that event, it would be imme diately discarded because of having a weight strictly greater than the assigned max.weight. For a second example of clause discarding, when the program applies con densed detachment to the third and second Lukasiewicz axioms (denoted, re spectively, by c3 and c2), the application succeeds. However, the corresponding formula is not present in the proof that Lukasiewicz gives of theses 4 through 71. Therefore, no demodulator is included to rewrite the subexpression rew(c3,c2). The clause is then given a weight greater than 99, and it is immediately dis carded because of having a weight that exceeds the assigned max.weight. Of course, rather than the few demodulators that are listed, one includes a full set, one for each deduced step of the proof being rigorously checked. Also, as observed, one might be forced to include additional demodulators to cope with combined steps. If one wishes a research topic relevant to the material of this section, one might attempt to devise a means to cause the program to produce a proof in which the order of its steps precisely matches that of the proof in hand. Of a totally different nature, one might focus on research designed to extend the cited rigorous proof checking to the case in which paramodulation and demodulation occur in the proof to be checked.
6
Best Results
Whether an advance is actually significant is conjectural often until years have passed. Still, when one has sought a result with repeated experiments, much CPU time, and perhaps the most powerful automated reasoning program—of course, I refer to OTTER—and when that result has eluded one, then obtaining it (at least subjectively) is significant. This section features such results, almost all of which rely on the resonance strategy combined with the hot list strategy; see the Appendix for the corresponding proofs. Although many of the cited re sults were obtained with earlier research, they are included to provide additional evidence of the value of combining resonance and heat and also to set the stage for the challenges issued in Section 7. When compared with the layered refine ment or with its variant, that earlier research has the disadvantages of requiring far more from the researcher, being substantially less algorithmic, and being
1466
Collected Works of Larry Wos
dramatically more complex and lengthy both in real time and in CPU time. Despite the disadvantages, in some cases, intriguing proofs were completed. To obtain the first result of interest, I began my attack with the use of resonators corresponding to the 22-step proof of the Church axiom system cited in Section 5.3.4. Reminiscent of both the layered refinement and its variant, I assigned a weight of 3 to each of the 22 resonators. My goal was that of finding a shorter proof of that system. A direct attack was made by relying on the use of ancestor subsumption and, of course for practical considerations, therefore also on back subsumption. To give OTTER more latitude, max.weight was assigned the value 32. However, rather than maintaining this assignment—for fear of drowning the program—the max_weight was reduced to 20 after 70 clauses had been chosen as the focus of attention to drive the program's reasoning. For this purpose, the following two commands were included. assign(change_limit_after,70). assign(new_max_veight,20). I chose 20 as the new max.weight, for that is the weight in symbol count of the longest thesis among theses 4 through 71. I assigned the pick^given_ratio the value 2 with the notion that the use of long clauses found early in the output might result in a breakthrough. I also assigned max.distinct.vars the value 5. Finally, borrowing from the promising refinement introduced in Section 5.1 and from the variant introduced in Section 5.3, I included before the set of twenty-two resonators two sets of resonators: the first correspondents of the three members of the Church axiom system, each assigned a weight of 1, and the second correspondents to fourteen members of known axiom systems, each assigned a weight of 2. For reasons I cannot supply, I chose not to rely on the hot list strategy. Success occurred, but not mainly in the context of the cited goal regarding the Church axiom system. Indeed, although a 22-step proof of the Church axiom system was found that I had never seen before—it differs by one formula— OTTER completed a 29-step proof of the Frege axiom system, a proof I had never seen before and one that is shorter than any reported earlier in this article for that system. The difference in the two 22-step Church proofs rests with the replacement of the second of the following two formulas by the first. P(i(n(i(i
The Power of Combining Resonance with Heat
1467
sense), little else was used from among OTTER's numerous options. On the one hand, based on my rather intense study of this axiom system approximately eighteen months ago, I thought it most likely that the program would merely return the same 29-step proof. That study had also produced a 29-step proof (which I shall call Proof 1), but a proof that differs in ten of its deduced steps. Substantially more effort and CPU time (those months ago) had strongly indi cated that a shorter proof would be difficult to discover, if indeed such a proof existed. On the other hand, perhaps the newer 29-step proof (Proof 2) would open the way to finding a shorter proof; after all, in general, the current studies (reported here) were readily yielding new proofs. To my delight and astonishment, OTTER and cursory proof checking pre vailed. In approximately 2 CPU seconds (on a SPARCstation-2) with retention of clause (82), the program completed a level 17 and length 28 proof of the Frege axiom system, a proof given in the Appendix especially for the researcher who wishes to attempt to improve on the result. Regarding compactness of the proof, the longest subproof that is a proof of one of the members of the axiom system has length 23. All 28 deduced steps are among the 29 steps of Proof 2, but in a different order. Contained within the 28-step proof is a 23-step proof of the Church axiom system, a proof that is compact in that it is also a proof of thesis 35; the 23-step proof is in fact a subproof of the 28-step proof. Because adding the use of the hot list strategy sometimes (as seen shortly) yields additional results of interest, I added the strategy with the heat parameter assigned the value 1. Essentially the same 28-step proof was found, showing that the com bination of resonance and heat would have sufficed; the order of the deduced steps was perturbed quite a bit. The following four successes provide an excellent example regarding the role of the hot list strategy (superimposed on the use of the resonance strategy) in yielding additional results of interest. By a sharply different research path, far more lengthy and arduous than that which is the basis of this article, OTTER completed a 22-step proof of the Church axiom system. (The proof is called Proof 4 in [11].) Proof 4 relies on eight formulas not present in the 22-step proof cited in Section 5.3.4. Cursory proof checking applied to Proof 4 (whose steps were used as resonators) merely returns Proof 4 which, by the way, is compact, being a proof of thesis 35. However, when the hot list strategy is used (with the clause for condensed detachment and those for the three Lukasiewicz axioms in the hot list), the so-called modified cursory proof checking does not return Proof 4. Instead, the program completes a 21-step proof, given in the Appendix as an example of one of the best proofs of which I know. The proof is compact, being a proof of thesis 35. All deduced steps are present in Proof 4, but their order is quite different. Summarizing, the hot list strategy proved to be most useful,
its use yielding a proof of length 21; I currently (on March 31, 1995) know of no strictly shorter proof. As the following shows, the cited occurrence is by no means unique, suggesting that use of the resonance strategy combined with the use of the hot list strategy, even in the context of cursory proof checking, can
1468
Collected Works of Larry Wos
be most fruitful. When the just-discussed approach was applied to a 24-step proof (whose steps were used as resonators) of the Hilbert axiom system (found through the pursuit of a lengthy and different research path than reported here), with the hot list strategy used in a cursory proof-checking mode a 23-step proof was completed, and without it the 24-step proof was returned. The 23-step proof is given in the Appendix. All 23 deduced formulas are among the 24 of the 24-step proof, but their order is sharply changed. Within the 23-step proof, the longest subproof of a member of the Hilbert axiom system has length 21. When the approach was applied to a 25-step proof of the alternate Lukasiewicz axiom system (found with the aforementioned lengthy research path), with the hot list strategy a 24-step proof was found, and without it the same 25-step proof was returned. The 24-step proof is given in the Appendix. All 24 deduced formulas are among the 25 of the 25-step proof, but their order is sharply changed. Within the 24-step proof, the longest subproof of a member of the alternate Lukasiewicz axiom system has length 23. When the approach was applied to a 26-step proof of the Wos axiom system (found in the lengthy study), with the hot list strategy a 25-step proof was completed, and without it the 26-step proof was returned. The 25-step proof is given in the Appendix. All 25 deduced formulas are among the 26 of the 26-step proof, but their order is sharply changed. Within the 25-step proof, the longest subproof of a member of the Wos axiom system has length 24. A glance at the various proofs in the Appendix shows how and where the hot list strategy played a role. As noted, the designation heat=n asserts that the hot list was consulted at the n-th level to yield the corresponding clause. For those interested in history, I was indeed surprised when cursory proof check ing combined with the hot list strategy was applied to the 22-step proof of the Church axiom system and the result was the discovery of a 21-step proof. For many, many months I had sought a proof of that length without success. That success led me immediately to the experiments that culminated in the reported discoveries of the cited proofs for the other four axiom systems. In contrast and most piquant, applying this modified cursory proof checking often leads to nothing more than a rearrangement of the proof steps whose correspondents are used as resonators. Also worth noting is the fact that inclusion of resonators that correspond to the members of the axiom system being featured, each as signed for its weight the value 1, can produce a compact proof where one was lacking, but often a proof that is not shorter and, sometimes, is even longer. The use of additional resonators, the use of the hot list strategy, and other option choices can each perturb the search space materially, which in turn can produce unforeseen results. If one experiences suspicion at the realization that the approach discussed in this section, when successful, always led to a reduction of one in the length of the completed proof, I can only say that I sympathize. Currently, I have no
The Power of Combining Resonance with Heat
1469
explanation.
7
Challenges and Possible Research
Regarding challenges, for openers, I suggest seeking shorter proofs than those I found for the five axiom systems. The proofs are presented in the Appendix. For the Church axiom system, the shortest I have found to this date (April 1, 1995) has length 21 (applications of condensed detachment, the required inference rule in this context), length 28 for Frege, length 23 for Hilbert, length 24 for (the alternate of) Lukasiewicz, and length 25 for Wos. In some cases, uniqueness is not present in the sense that other proofs exist of the same length for various axiom systems. For example, I know of four proofs of length 21 for the Church axiom system. Were the suggestion a starred exercise, I would give a hint: Perhaps allowing six or more distinct variables in retained conclusions might be fruitful. For a related challenge, one might seek "short" compact proofs for each of the five axiom systems. As a reminder, for example, a proof of the Hilbert axiom system (consisting of theses 3, 18, 21, 22, 30, and 54, of which thesis 30 is dependent on the other five) is compact if and only if it is a proof of one of the six members, of course, with no extra steps. Among the few compact proofs of which I know, I have seen four of length 22 for the Church axiom system, and four of length 21 also for that system [11]. Intuitively, combining proof brevity and proof compactness increases the challenge, for the less room within the proof of a single member of an axiom system, the more difficult it is to squeeze in the proofs of the other members. For a third challenge, one could (so to speak) turn the tables on Lukasiewicz, using one of the five axiom systems for the hypothesis. For example, one could use as the (starting) axioms the Church axiom system consisting of theses 18, 35, and 49. Then, as a replacement for the Church system as a target, one would have the Lukasiewicz axiom system (consisting of LI, L2, and L3), of course, with the other four target systems, from Frege, Hilbert, (the alternate of) Lukasiewicz, and Wos. The goal would be that of finding short proofs, compact proofs, and short and compact proofs. One could rely on the approach taken in this article, or one might formulate an entirely different approach. Of a general nature, for research, I recommend as tough topics the seeking of metarules for deciding when to use which strategy and when to use which combination of strategies. Some light might be shed on the topic by analyzing why one choice of options promotes finding shorter proofs, where another results in finding no proofs at all. Of yet a different character, one might seek other areas for which the resonance strategy, the hot list strategy, the dynamic hot list strategy, and different combinations of these strategies are most effective.
1470
8
Collected Works of Larry Wos
Conclusions and Observations
In this article, I have studied the use of strategies in various combinations. I have shown that, when strategies are used in combination—often, but not always— the result is far more effective than used singly. The evidence was gathered from experiments with McCune's automated reasoning program OTTER. Fea tured are the resonance strategy, the hot list strategy, and the dynamic hot list strategy. Also used are the ratio strategy and weighting. McCune formulated the ratio strategy and the dynamic hot list strategy (as an extension of the hot list strategy); Overbeek formulated weighting. Although the context of my experiments focuses on finding shorter proofs and on combinations of strategies, a closer inspection of the material presented here strongly suggests that, for totally unrelated studies, individually or in com bination the strategies used throughout offer impressive power for overcoming obstacles that naturally arise. For one example, without using an appropriate strategy, a person or a program can easily get trapped in a valley of conclusions of similar or identical complexity. One way to overcome this obstacle is to use the resonance strategy, which asks the researcher to conjecture which equations or formulas are such that their respective patterns (ignoring variables) merit marked preference for initiating applications of the inference rules in use. For a second example, sometimes the desired proof requires crossing a high plateau, consisting of three or more consecutive and complex conclusions. The resonance strategy can be of assistance here also, and so too can the hot list strategy, the latter asking the researcher to choose from among the statements that charac terize the problem those that merit repeated immediate visiting and possibly immediate revisiting to complete applications of inference rules rather than to initiate applications. Then one sometimes is certain that a level saturation ap proach is best, but is concerned about forcing the program to search rapidly growing levels of conclusions. If level saturation is combined with the hot list strategy with, say, the heat parameter assigned the value 3, then the program will deduce some conclusions at level j+3 when it is actually exploring level j . In other words, this combination enables the program to (so to speak) "look ahead". As a final example, should the researcher prefer an automated reasoning program to adjoin during the run clauses to the hot list if they are proved and if they also match a symbol pattern (ignoring variables) that appears appealing, a combination of the resonance strategy with the dynamic hot list strategy may provide precisely what is needed. My experiments did elicit satisfaction and even surprise. Among the unex pected occurrences, when I applied a version of cursory proof checking to a given proof, rather than successfully proof checking the proof, sometimes OTTER found a more elegant proof. On the other hand, sometimes the proof checking simply failed totally, yielding no proofs, not even of any of the members of the axiom system whose proof was being checked. Of such mysteries automated rea soning is made. But, of such mysteries also the mind of a good mathematician
The Power of Combining Resonance with Heat
1471
or a good logician is made. Whether mysteries of the cited types will be solved is left to the future. However, access to McCune's powerful automated reasoning program OTTER provides invaluable assistance in bringing that future closer while, in the present, serving as a powerful assistant for research.
Appendix So often, my research has been fruitful directly because of access to specific proofs. Independent of that aspect, I occasionally am presented with a proof that I had thought could not exist. Prompted by such factors and the intention that such charming "short" proofs (as those cited in this article) not be lost, I include here the most satisfying (to me) proofs of the five axiom systems for two-valued sentential (or propositional) calculus: those of Church, Frege, Hilbert, (an alternate of) Lukasiewicz, and Wos. The proofs may serve well to stimulate research, for, among other reasons, they provide needed targets. As is no doubt obvious, for each proof, the inference rule that is used is condensed detachment (from the viewpoint of logic) and hyperresolution (from the viewpoint of automated reasoning), and the hypotheses are the three Lukasiewicz axioms, LI, L2, and £3. In each proof (expressed in clause no tation acceptable to OTTER), "-" denotes logical not, " I " denotes logical or, the function t can be interpreted as implication, the function n as nega tion, and the predicate P as provable. When the input contains the command set(order.history), [hyper,28,2712,30] says that clause (28) is the nucleus, clause (2712) is unified with the first literal of (28), and clause (30) is unified with the second literal. Note that, when the dynamic hot list strategy is used, the listed proof length (by OTTER) may be strictly greater than the actual proof length because the use of this strategy can lead to the presence of duplicate steps. Also note that, in the following proofs, the presence of two copies in the input of any of them says that the hot list strategy played a role; when two copies appear, one is in the hot list, and the other is in list(usable) or in list(sos). The clause number gives its relative position in the database of retained clauses. I also include here a sample input file to facilitate the research of others. When a line contains a "%", the characters from the first "%" to the end of the line are treated by the program as a comment. Sample Input File set(hypor.res). assign(max_veight,3). X Disallow clauses with weight strictly greater thin 3. assign(max_proofs,-l). X Placs no liait on ths nunber of proofs to be coapleted. clear(print_kept). X Do not sntsr into ths output fils clauses as tbsy are retained. claar(back_sub). X Prsvant purging of existing clausss whan a naw clause captures such. X assign(aax_seconds,1200). X Liait the CPU tiae. assigntaax.men,60000). X Liait the maaory usage in kilobytes. assign (report, 900). X Place in output file a statistical suanary every 16 CPU-ainutea. assign(max_distinct_vars,5). X Do not keep clauses with aore than 5 distinct variables. assign(pick_given_ratlo,5). X Five clauses are chosen by weight and
1472
Collected Works of Larry Wos
X on* by breadth firet, rapaatadly. aasign(h*at,l). X Limits tha racursion through tha hot list. assign(dynamic_heat_weight ,2). X Limits weight on elausaa adjoined to hot list during run. sat(ordsr.hlstorj). X List aneastors in tha ordsr nuclsus, X claus* unifying with flrat literal, clausa unifying with sacond. sat(input_sos_first). X Choosa for driving tha raasoning clausas from tha input list(sos) X bafor* othars. X aat(sos_quaua). X Diract tha aaarch by first coma, first sarva. weight_list(pick_and_purge). X Following ara tha members of tha Church systan. weight (P(i(z,l(y,z»).l). weight(P(i(i) . K K x . y ) .i(x.z)))) ,1) . weight (P
waight(P,y>,i.l,y»»,2). weight(P,z)),i(z,i(i2). X Following ara corraapondanta to tha Lukasiewicz 33-stap proof of tha Church ayatam. weight(P(i(l(l(i(z,y>,l(z.y)).u).l(i(z,x),u))),3). weight(P(i(i(i(n(z).y),z),l(z,z))),3). weight(P(i(l(z,i(y,z)),l(i(u,y),i(x.l(u.z))))),3). welght(P(l(i(z,y),i(i(i(x,z),u),i(i(y.x).u)))).3). weight(P(i(i(x,i(i(y.z),u)),i(l(y,v),i(z,i(l(v,z),u))))),3). weight(P(i(z,i(i(i(n(z),y),z),l(i(u,y),z)))),3). weight(P(i(i(l(n(iCi(n(x),x),x)),y),z),i(l(u>y),z))),3). weight (P(l(i(z.i(i(n(y).y)>y)).l(l(n(y),y),y))),3). weight(P(l(z.1(1 (n(y) ,y) , y » ) .3). weight(P(l(l(n(x),y).i(z,l(i(y.x),x)))),3). weight a>(i(i,l(y,x)»,3). weightCP(i(i(x,i(n(y),z)),i(i(i3). weight(P(i(i(l(x,y).z).i(i(z,x),x))),3). weight(P(l(i(i(l(x,y>,y),z),l(i(l(y,u),x),z))),3). weight(P(i(i(i(z,y).z)>l(l(x.z),z))).3). weight(P(i(i(x,y),i(i(l(z,z),u),l(i(y>u),u)))).3). weight(P(l(i(i(z,y),z))l(l(z,u),i(l(u,z),z)))).3). weight(P.i(l(y.l(x.i<x.u))).i(z,i(x,u))))),3). weight(P(l(l(x.l(y.i(z,u))),i(i(z,z),i(y,l(z,u))))),3). weight(P(l(i(x.l(y,z)),i(i(x.y),l(x,z)))),3). X Following are templates corresponding to the 68 theses 4-71 to be proved. X weight(P(l(l(i(i(z,y),i(z,y)),u),i(i(z.z).u))).2).
The Power of Combining Resonance with Heat
X X 51 X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X
v«ight(P(iU(x,l i(l(l(x,z> > u),l(i.u)>,i,i(x,i(i,y>).iUCn(y) > y),y))) > 2). v»ight(P(l(x,i(i(n(y).y),y))),2). w.ight(P(i(i(n(x),y),i))),2). Might(P(i(i(i(x,iCl(y.z),z)),u),i(i(n(z),y),u))),2). w«igl>t(P(i(i(ii(x),y) ,i(i(y,x) ,x))) ,2). wight(p(i(x.x)),2). v.ight,x)>),2). w.ight(P(l(x,i(y,x))),2). wight(P(i(i(i(x,y),z),i(y,z))) > 2). w.ight(P(i(x,i(i(x,y),y))),2). wltfit(p(i(i(x,i(y,z».i(y > i(x.z»)),2). »lglit(P(i(i(x,y) > i(i(z,x),i(z,y)))),2). w«igiit(P(i> ,u) ,i(i(y.l<x,z)) ,u») ,2) . «lght.2). v.lght(P,z).i(i(x.u).i(i(ii,y).z)))),2). wight(P(i 2). w«ight(P(i(i(x,l(y,l(z > tt))).i(i(z,x),i(y.i(z.u))))),2). wigM(P(i(i(x,i(y.z)> ,i(i(x,y) , i ( x , z ) » ) ,2) . wight(P(i(n(x),i(x,y))),2). n.ight(P(i(i(i(x,y) ,x) ,i(n(x).»))) .2). «lght(P(iU(x,n(x)),ii(x))),2>. w«ig)it(P(i(n(n(x)),x)),2). v.ight i(n(y).D<x)))),2). w«i^it l(y.n(x)))),2). wight(P(i(i(n(x) ,y) ,i(n(y) ,x))) ,2). w.ight,n(y)).i(y,x)>) > 2). w»ifht(P(l(i(i(n(x),y).z).i(i(n(y) t x),z))),2). w»ight(P(i(i(x,i(y,z)).i(x,l(n(z),n(y))))),2). wi«Jit(P(i(i(x > i(y,B(z»).i(x.l(z > n(y))))),2). v.igbt(P,z),i(l(n<x),y),z))),2). w.ight(P(i(i(n(x) ,y) ,i(i(x,z) .Ki(z.y) ,y)))) .2). v«ight(P(i(i(i y),i(i ,i(i(z,y) ,iU<x,z> ,y)))) .2). w«ight(P(i(i(x,l(n(y),z».i(x,i(l(u > z),t(i(y ( u),z))))),2). »i^>t(P(i(i(x,y).i(i(z.y).l(i(n(x),z).y)))),2). w.ight(P(i(i(n(n(x)),y) > i(x,y))),2). w»ight(P(i(x,i(y,y))).2). wight(P(i(n(i(x,x)),y)).2). wight(P(i(iCn(x),n(i(y,y))),x)),2). v.lght(Pt(P(i. wifhUPUUCUx.nCym.y))^). »ight(P(i(x.l(n(y>,nU(x > y))))).2).
1473
1474
Collected Works of Larry Wos
X walgut(P(l(x,i(y,n(i(x.n(y)))))).2). X walght(P(n(i(i(x,x),n(i(y,y))))>.2>. and_of_list. X Usad to coaplota application! of infaranca rulaa. liat(uMbla). X Tha following clausa ia uaad with hyparrasolution for condanaad datacnaant. -P(i(x,y» I -P(x) I P(y). X Tha following dlajunctions, axcapt thosa mantioning Scott, X ara tha nagatlon of known axiom systaas. -P(i(p,i(q,p))) I -PU(i(p,i(q,r)),i)) I -P(i ,p» I -P I -P(i(i(p,q).i(n(q),n(p)») I -P(i(l(p,i(q,r)),i(q,i(p,r))» I $ANSVER(stsp.allFraga_18_35_39_40_46_21). X 21 is dapandant. -P(i(p,i(q,p))) I - P U C K p . i C q . r ^ . K q . K p . r ) ) ) ) I -P(i(l(q.r).l(i(p.q),i(p,r)))) I -P(i(p,i(n(p).q))) I -P(i(i(p,q),i(i(n(p).q).q))) I -P(i(i(p,i(p,q)) ,i(p,q))) I *ANSWER(stap.allHilbart.l8.21_22.3.64.30). X 30 is dapandant. -P(i(p.i(q,p))) I -P(i I - P U ( K n C p ) ,p) ,p)) I -P(i(p,i(D(p).q») I tANSWER(stsp.allLuka. 1.2.3). X X X X
-P(i(p,p>) I -P(i(p.i(q.p)>) I -P(i(i(p.i(q.r)).i(q,i(p.r)») I -P(i(i(i(p,q),p),p)> I -P(i(i(p,i(q,r)).i(i(p,q).i(p,r)))) I -P(i(n(n(p)),p)) I -P(i(p.n(n(p)))) I -P(i(i(p,q) ,i(n(q),n(p)))) I »AHSWHKstap_allSeott_orig_16.18_21_24_36_39_40_46).
X -PUCp.p)) I -P(i(p,i(q,p))) I -P(i(i(p,i(q,r)),i(q,l(p,r)))) I X -P(iCl(i(p.q),p),p)> I -P(l(l(p,i(q,r)),i(i(p,q).i(p,r)))) I X -PCi(n(n(p)),p)> I -P(i(p,n(n(p)))) I -P(i(i(n(p),n(q» ,i(q,p))) I X *«IBWER(stap.allSeott.orig0.16.18.21_24.35.39.40.49). and.of.list. X Uaad to initiata applications of infaranca rolas. list(sos). X Tha following thraa ara Luka, 1 2 3. P(i(l(x,y).i(i(y,x).l(x.2)))). P(i(i(nCx),x),x)). P(i(x,i(n(x),y))). and.of.list. X Usad BSinly to datact proof completion and to monitor prograss. llst(pusiva). X -PU(i. X -P(i(i(p,i(q,r)),i(i(s.q),i(p,i(s,r))))) I $AHS(nag_th_06). X -P(i(i(p,q),i(i(i(p.r),s)>i(i(q>r).s)))) I $AMS(nag_th.06). X -P(i(i(t.i(l(p(r).s)),i(l(p,q).i(t,i(i(q,r),s))))) I »JUIS(nag_th_07). X -P(i(i(q,r)ll(i(p>q).l(i(r,s),l(p,s))))) I $JUIS(nag_th_08). X -P(iCi(i(n(p),q).r).i(p,r)>) I $ANS(nag.th_09). X -P(iCp,i(i(i(n(p),p).p),i(i(q,p).p)))) I «ANSCnag_th_10). X -P(i(i(q.i(i(n(p),p),p)),i(i(n(p),p),p))) I $JWS(nag.th.ll). X -P(i(t,i(l(n(p).p),p))) I »A*S(nag_th_12). X -P(l(i(n(p),q),i(t.i(i(q,p),p)))) I »AMS(nag_th_13). X -P(i(i(i(t.i(i(q,p).p)),r),i(i(n(p).q),r))) I »ANS(nag_th_14). X -P(i(i(n(p),q),i(i(q,p),p))) I »AMS(nag.tb_15).
The Power of Combining Resonance with Heat
X -PU(p.p)) I *ANS(nag_th_16). X -PUCp,iUCq,p),p>)> I $AMS(nag_th_17). -PU),i(q,l(p,r)))) I *ANS(nag.th.21). -P(i(i(q.r).i(i(p,q)>l(p,r)))) I $ANS(nag_th_22). X -P(l(i(i(q,i(p.r))la),l(l(p,i(q.r)).a))) I $ANS(nag_th_23). X -P(i(i(i(p,q),p),p)) I tAMS(nag_th_24). X -P(i(i(i(p,r),i),l(l(p.q),i(i(q.r),()))) I *ANS(nag_th.2S). X -P(i(i(l(p,q),r),iKp.q))) I *ANS(nag_th_30). X -P(i(i(p,a),i(i(i(p,q),r),i(i(a,r),r)))) I $A*S(nag_th_31). X -P(i(l(i(p,q),r).i(i(p,s),i(ir)))) I $ANS(nag.th.32). X -P(i(l(p,8),i(i(.,i(q,i(p,r))),i(q,i(p,r))))) I $JWS(nag_th_33). X -P(i(i(a.i(q,i(p,r))),l(l(p,a),l(q,l(p,r))))) I t*HS(nag_th_34). -P(i(i(p.l(q,r)),l(i(p,q),i(p,r)))) I *JUIS(nag_th_35). X -P(i(n(p),lCp.q))) I tAHS(nag_th_36). -P(i(i(i I $*MS(nag.th.47). X -P(iU(n(p),q),i(n(q>,p») I *AMS(nag.th_48). -P(i(l(n(p),n(q)),i(q.p») I *ANS(nag_th_49). X -P(i(l(i(n(q).p),r),i(i(n(p),q),r))) I *MIS(nag.th.80). X -P(i(l(p>i(q,r)),i(prl(n(r)>n(q)))» I $ANS(nag.th.81). X -P(i(i(p.i(q.n(r))),i(p,i(r>n(q))))) I *ANS(nag.th.S2). X -PUU(n(p),q),iU(p,q).q))) I *AMS(nag.th.S3). -P(l(i(p,q),i(l(n(p),q),q))) I $ANS(nag_th_64). X -P(i(i(p,q),i(i(p.n(q)),n(p)))) I *ANS(nag.th.5S). X -P(i(i(i(i(p,q).q),r),i(i(n(p),q).r))> I $ANS(nag_th_S6). X -P(l(i(n(p),r),i(i(p,q).i(l(q,r),r)))) I $AHS(nag_th_57). X -P(i(i(i(i(p.q).i(l(q.r).r)),a),i(i(n(p),r),a))) I $ANS(nag_th_88). -P(i(l(n(p),r),i(i(q,r),i(i(p.q).r)))) I $ANS(nag.th.59). -P(i) I $AMS(nag_th_6S). X -P(i(n(i(p,q)),p)) I «AKS(nag.th_66). X -P(i(n(i(p,q)),n(q)>) I $AKS(nag_th.67). X -P(i(n(i(p,n(q))),q)) I $AHS(nag.th.68). X -P(i(p,i(n(q),n(l(p,q))))) I $JUfSCnag_tn_69). X -P(i(p,i(q,n(i(p,n(q)))))) I $ANS(nag_th_70). X -P(n(i(i(p,p),n(i(q,q))))) I $AKS(nag.th_71). and_of_liat. X X X X X X X
Following list can bs usad to purga unvantad fornulas of various typaa. liat(damodulatora). (n(n(x)) - Junk). (n(n(n(x))> - Junk). (i(i(x,x),y) - Junk). (i(y,i(x.x)) - junk). (i(n(i(x.x)).y) - Junk).
1473
Collected Works of Larry Wos
1476
X X X X X X
(Ky.n(Kx.x))) - junk). (Kjunk.x) - Junk). (i(x,Junk) • junk).
liat(hot). X Tha following clausa ia uaad with hyparrasolution for condansad datachaant. -PU(x.y)) I -P(x) I P(y). X Tha following thraa ara Luka, 1 2 3. P(i(i(x.y),i(i(y,z),i(x.z)))). P(i(i(n(x),x),x)). P(i(x.l(n(x),y))). and.of.llst.
A 31-Stap Proof of the Church A x i o m S y s t e m
Ottar 3.0.2b*. lug 1994 Tha job vaa atartad by woa on altair.mca.anl.gov, Fri Mar 31 15:04:46 1996 Tha coaaund waa "ottar302c". > EMPTY CLAUSE at 1.65 aac > 77 [hypar,4,49,71,46] *MSVER(atap_allBEH_Church_FL_18_3S_49).
Langth of proof ia 21.
Laval of proof la 15.
PHOOp 1 [] -P(i(x,y)> I -P(x) I P(y). 4 [] -P(i(p,i(q,p)>) I - P ( i ( i ( p , i ( q , r ) ) , i ( i ( p , q ) , i ( p . r ) ) ) ) I *ANSUEX(atap_allBER_Church_FL_18_35.49). 8 □ PU(l(x.y),i(i(y,z).i(x,z)))). 9 □ P(i(i(n(x),x).x>). 10 □ P ( i ( x , i ( n ( x ) , y ) ) ) . 28 [] - P ( i ( x , y ) ) I -P(x) I P(y). 26 □ P ( i ( i ( x , y ) . i ( i ( y . x ) , l ( x , z ) ) ) ) . 27 □ P ( l ( l ( i ( i ) , i ) , t » . 28 □ P ( i ( x , i ( n ( x ) , y ) ) ) . 29 33 34 35 36 37 38 39 40 42 46 46 48 49 51 53 56 60 65 69 71 77
I -P(i(i(n(p) ,n(q)) . i ( q . p ) ) )
[hypar,1.8,8] P ( i ( i ( i ( i ( x , y ) , i ( z , y ) ) . i : ) , i ( i ( z , x ) ,u))) . [hypar. 1,8.10] P ( i ( i ( i ( n ( x ) ,y) , x ) , i ( x , « ) ) ) . [hypar,1,10,9] P ( l ( n ( i ( i ( n ( x ) , x ) , x ) ) , y ) ) . (haat-1) thypar,26,26,34) P ( i ( l ( x , y ) , i ( n ( i ( i ( n ( x ) , x ) , z ) ) , y ) ) ) . [hypar.1,29,29] P ( i ( l ( x , i ( y , x ) ) , i ( i ( u , y ) , i ( x , i ( u , z ) ) ) ) ) . (haat-1) Chypar.25.36,27] P ( i ( i ( x , y ) . i ( i ( n ( i ( y , z ) ) , i ( y , z ) ) , i ( x . z ) ) ) ) . [hypar,1,33,35] P ( i ( x , l ( n ( l ( i ( n ( y ) , y ) , y ) ) , z ) ) ) . [hypar,1,36,37] P ( i ( l ( x , i ( n ( l ( y , z ) ) , i ( y , z ) ) ) , i ( i ( u , y ) , i < x , l ( u , z ) ) ) ) ) . [hypar.l.39,38] P ( i ( l ( x , i ( n ( y ) , y ) ) , i ( z , i ( x , y ) ) ) ) . [hypar,1,29,40] P a ( i < n < x ) , y ) , i ( x , i ( i ( y , x ) , x ) ) ) ) . [hypar,1,39,42] P ( i ( i ( x , i ( y , z ) ) , i ( i ( n ( z ) , y ) , i ( x , z ) ) ) ) . (haat-1) [hypar,26,46,28] P ( i ( i ( n ( x ) , n ( y ) ) , i ( y , x ) ) ) . [hypar,1,36,45] P ( i ( i ( x , i ( n ( y ) , z ) ) , i ( l ( u , i ( z , y ) ) , i ( x , i ( u , y ) ) ) ) ) . [hypar,1,33,46] P ( i ( x , l ( y , x ) ) ) . (haat-1) [hypar,25,26,49] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . [hypar,1,29,48] P ( i ( l ( n ( x ) , y ) , i ( i ( z , i ( u , x ) ) . i ( i ( y , u ) , i ( z , x ) ) ) ) ) . [hypar,1,51,46] P ( i ( n ( x ) , i ( x , y ) ) ) . [hypar,1,45,55] P ( i ( l ( n ( x ) , y ) , l ( n ( y ) , x ) ) ) . [hypar,1,60,55] P ( i ( n ( i ( x , y ) ) , x ) ) . [hypar,1,63,65] P ( i ( i ( x , i ( y . l ( z , u ) ) ) , i ( i ( z , y ) , i ( x , i ( z , u ) ) ) ) ) . (haat-1) [hypar,26,69,26] P ( i ( i ( x , i ( y , z ) ) , i ( i ( x , y ) , i ( x , z ) ) ) ) . [hypar,4,49,71,46] tANSVER(atap_allBEH.Church_FL.18_3S_49) .
The Power of Combining Resonance with Heat
A 2 8 - S t e p P r o o f o f t h e Frege A x i o m S y s t e m Otter 3.0.2b+, Aug 1994 Tha job vaa atartad by wo» on altalr.mca.anl.gov, Wad Mar 22 11:12:34 1995 Tha command waa "otter302c". > EMPTY CLAUSE at 1.96 aac > 82 [hypar,2,44,72,60,67,77,46] $ANSVER(atep_allFrege_18_35.39_40_46.21). Langth of proof ia 28.
Level of proof ia 17.
PHOOF
1 [] - P ( i ( x , y ) ) | -P(x) I P(y). 2 [] - P ( i ( p , i ( q . p ) ) ) I - P ( i ( i ( p , l ( q , r ) ) , l ( l ( p , q ) , i ( p , r ) ) ) ) I -P(i(n(n(p)>,p)) I -P(i(p,n(n(p)))) I - P ( i ( i ( p , q ) . l ( n ( q ) , n ( p ) ) ) ) I - P ( l ( l ( p , i ( q , r ) ) , l ( q , i ( p , r ) ) ) ) I $ANSWER(step_allFrege_18_3S_39_40_46_21). 8 [] P ( i ( i ( x , y ) , i ( i ( y , z ) . l ( x , z ) ) ) ) . 9 [] P ( i ( i ( n ( x ) , x ) , x ) ) . 10 □ P ( i ( x , l ( n ( x ) , y ) ) ) . 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 44 46 51 53 54 58 60 65 67 69 72 77 82
[hyper,1,8,8] P ( i ( i ( i ( l ( x , y ) , l ( z , y ) ) , u ) , i ( i ( z , x ) , u ) ) ) . [hyper,1,8,10] P ( l ( i ( i ( n ( x ) , y ) , z ) , l ( x , z ) ) ) . [hyper,1,10,9] P ( i ( n ( i ( l ( n ( x ) , x ) , x ) ) , y ) ) . Chyper.1,25,26] P ( i ( l ( x , l ( y , z ) ) , i ( l ( u , y ) , l ( x , i ( u , z ) ) ) ) ) . [hyper, 1,25,8] PU(i(x.y> , l ( l ( l ( x , z ) , u ) , l ( l ( y , z ) , u ) ) ) ) . [hyper,1,29,30] P ( l ( i ( x , l ( l ( y , z ) , u ) ) , l ( l ( y , v ) , l ( x , i ( i ( v , z ) , u ) ) ) ) ) . [hyper,1,30,28] P ( i ( l ( l ( n ( i ( l ( n ( x ) , x ) , x ) ) , y ) , z ) , i ( i ( u , y ) , z ) ) ) . Chyper.1,32,9] P ( i ( i ( x , l ( i ( n ( y ) ,y) , y » ,i(i(n . [hyper, 1,27,33] P ( i ( x , i { i < n ( y ) , y ) , y » ) . [hyper,1,31,34] P ( i ( l ( n ( x ) , y ) , i ( z , i ( l ( y , x ) , x ) ) ) ) . [hyper,1,8,35] P ( l ( l ( l ( x . l ( i ( y . z ) , z ) > , n ) , i ( l ( n ( z ) , y ) , u ) ) ) . [hyper,1,36,9] P ( l ( i ( n ( x ) , y ) , i ( i ( y . x ) , x ) ) ) . [hyper, 1,29,37] P ( i ( i ( x , i ( y , z » , l ( i ( n ( z ) ,y) , i ( x , z ) ) ) ) . [hyper,1,31,38] P ( i ( i ( n ( x ) , y ) , l ( i ( z , i ( u , x ) ) , i ( l ( y , u ) , l ( z , x ) ) ) ) ) . [hyper,1,29,38] P ( i ( i ( x , i ( n ( y ) , z ) ) , l ( l ( u , l ( z , y ) ) , l ( x , l ( u , y ) ) ) ) ) . [hyper,1,38,10] P ( i ( i ( n ( x ) , n ( y ) ) , l ( y , x ) ) ) . [hyper,1,27,41] P ( i ( x , i ( y , x ) ) ) . [hyper,1,40,44] P ( i ( i ( x , i ( y , z ) ) , i ( y , l ( x , z ) ) ) ) . [hyper,1,46,10] P ( i ( n ( x ) , i ( x , y ) ) ) . [hyper,1,38,61] P ( i ( i ( n ( x ) , y ) , i ( n ( y ) , x ) ) ) . [hyper,1,8,61] P ( i ( i ( U x , y ) ,z) ,i(n(x) , z ) ) ) . [hyper,1,53,61] P ( i ( n ( i ( x , y ) ) , x ) ) . [hyper, 1,64,9] P(l(n(n(x)> ,x)) . [hyper,1,39,58] P ( l ( l ( x , l ( y , l ( z , u ) ) ) , l ( l ( z , y ) , l ( x , l ( z , u ) ) ) ) ) . [hyper,1,41,60] P ( l ( x . n ( n ( x ) ) ) ) . [hyper,1,39,60] P ( i ( i ( x , l ( y , n ( z ) ) ) , l ( l ( z , y ) , l ( x , n ( z ) ) ) ) ) . [hyper,1,65,8] P ( i ( i ( x , l ( y , z ) ) , i ( l ( x , y ) , i ( x , z ) ) ) ) . [hyper,1,69,61] P ( l ( l ( x , y ) , i ( n ( y ) , n ( x ) ) ) ) . [hyper,2,44,72,60,67,77,46] «ANSWER(atep_allFrege_18_35_39_40_46_21).
A 2 3 - S t e p P r o o f of t h e H i l b e r t A x i o m S y a t e m Otter 3.0.2b+, Aug 1994 Tha job waa atartad by woa on altair.mca.anl.gov, Frl Mar 31 17:12:66 1995 The command waa "otter302c*. > EMPTY CLAUSE at 2.43 aec > 87 [hyper,3,50,53,56,10,81,83] ♦ANSWER(atep.allHilbert.18.21.22.3.54.30). Length of proof ia 23. PROOF
Level of proof i s 15.
1477
Collected Works of Larry Wos
1478
1 [] - P U U . y ) ) I -P(x) I P(y>. 3 [] -PCi(p.iCq.p))) I - P ( l ( l ( p , i ( q . r ) ) . i ( q , i ( p , r ) ) ) ) I - P ( i ( i ( q , r ) , i ( i ( p . q ) , i ( p . r ) ) ) > I -P(i(p,i(n,q),q)» I -P(i(i(p,i(p,q)>,i . 25 0 - P ( i ( x , y » I -P(x) I P(y). 26 n P ( i ( i ( x , y ) , i ( i ( y . z ) , i ( x , z ) ) ) ) . 27 t] P ( i ( i ( n ( x ) , x ) . x ) > . 28 □ P ( l ( x . l ( n ( x ) . y ) ) ) . 29 33 34 35 36 37 38 39 40 41 43 44 45 47 50 S3 55 56 63 70 78 81 83 87
[hypar,1,8.8] P U ( i ( i ( i ( x , y ) , i ( z , y ) ) ,u) , i ( l ( z , x ) ,u))) . Cb.yp»r,l,8,10] P ( i ( i ( i ( n ( x ) , y ) , z ) , i ( x , z ) ) ) . [hyper, 1,10,9] P ( i ( n ( l ( l ( n ( x ) , x ) , x ) ) , y ) ) . ( h u f l ) [hyper.25.33,27] P ( l ( x , x ) ) . (haat-1) [hypar. 25,26,34] P ( l ( l ( x , y ) , l ( n ( l ( l ( n ( z ) ,z) , z ) ) , y ) ) ) . [hyper,1,29,29) P ( i ( i ( x , i ( y , z ) ) , i ( i ( u , y ) , l ( x , i ( u , z ) ) ) ) > . (heat-1) [hypar.25,37,27] P ( i ( i ( x , y ) , i ( i ( n ( i < y , z ) ) , i ( y , z ) ) , l ( x , z ) ) ) ) . [hyper.l,33,36] P ( i ( x , i ( n ( i ( i ( n ( y ) , y ) , y ) ) , x ) ) ) . [hyper,1,37,38] P ( i ( l ( x , l ( n ( l ( y , z ) ) , i ( y , z ) ) ) , i ( i ( u , y ) , l ( x , i ( u , z ) ) ) ) ) . [hypar,1,40,39] P ( l ( l ( x , l ( n ( y ) , y ) ) , l ( z , i ( x , y ) ) ) ) . [hyper,1,29,41] P ( i ( i < n ( x ) , y ) , i ( z , i ( i ( y , x ) , x ) ) ) ) . [hyper.1,40,43] P ( i ( l ( x , l ( y , z ) ) , l ( l ( n ( z ) , y ) , l ( x , z ) ) ) ) . ( h u f l ) [hyper.26.44.28] P ( i ( i ( n ( x ) , n ( y ) ) , l ( y , x ) ) ) . [hyper,1,37,44] P < l ( i < x , l ( n < y ) , z » , l ( i ( u , i ( z , y ) ) , l ( x , i ( u , y ) ) ) ) ) . [hyper,1,33,45] P ( l ( x , l ( y , x ) ) ) . [hyper,1,47,60] P ( i ( i ( x , i ( y , z ) ) , i ( y , i ( x , z ) ) ) ) . (heat-1) [hyper, 25,53,28] P ( i ( n ( x ) , i ( x , y » ) . (heet-1) [hyper, 25, S3,26] P U ( i ( x , y ) , i ( i ( z , x ) , i ( z , y ) ) » . [hyper,1,44,65] P ( i ( i ( n ( x ) , y ) . i ( n ( y ) . x ) ) ) . [hyper,1,47,63] P ( i ( l ( x , i ( y , z ) ) , i ( i ( n ( y ) , z ) , i ( x , z ) ) ) ) . [hyper,1,70,36] P ( i ( i ( n ( x ) . y ) . i ( l ( x , y ) , y ) ) ) . [hyper,1,53,78] P ( i ( i ( x , y ) . i ( i ( n ( x ) , y ) , y ) ) ) . [hyper,1,78,65) P ( i ( i ( x , l ( x , y ) ) , i ( x , y ) ) ) . [hyper,3,50,53,56.10,81,83] llNSVER(stap_allHilbart_18_21_22_3_54_30).
A 2 4 - S t e p P r o o f o f t h e A l t e r n a t e Lukasiewicz A x i o m S y s t e m Otter 3.0.2M, Aug 1994 The job ins started by wos on sltair.mcs.uil.gov, Fri Mar 31 18:33:12 1995 Ths coasund was "otter302c". > EMPTY CLAUSE at 2.64 ssc $ANSWER(step_allLuka.x.l9.37_59).
> 93 [byp*r,5,51,63,85]
Lsngth of proof is 24. Laval of proof is IS. PROOF 1 [] -P). 10 [] P(i(x,i(a(x).y))). 25 [] -PU(x.y)) I -P(x) I P(y). 26 [] P(i(i(x,y),i(i(y.z),i(x,z)))). 27 [) P(i(i(n(x),x),x)). 28 0 P(i(x,i(a(x),y)». 29 [hypar,l,8,8] P(i(i(i(i(x,y),i(z,y)),u),i(i(z,x),u))). 33 [hypar.1,8,10] P(i(i(i(n(x),y),z),i(x,z))). 34 [hyper.1,10,9] P(i(a(l(i(a(x),x),x)),y)).
The Power of Combining Resonance with Heat
35 36 37 38 39 40 42 44 45 47 49 61 54 55 57 68 63 67 72 78 85 93
(heat-1) [hyper,25,26,34] P ( l ( l ( x , y ) , i ( n ( i ( i ( n ( z ) , z ) , z ) ) , y ) ) ) . [hyper,1.29,29] P ( i ( l ( x , l ( y , z ) ) , l ( l ( u , y ) , i ( x . i ( u , z ) ) ) ) ) . (heat-1) [hyper.25,36,27] P < i ( i ( x , y ) , i < i ( a ( l ( y , z ) ) , l ( y , z ) ) , l ( x , z ) ) ) ) . [hyper,1,33,35] P ( i ( x , i ( n ( i ( i ( n < y ) , y ) , y ) ) , z ) > ) . [hyper,1.36.37] P ( i ( i ( x , l ( n ( i ( y , z ) ) , i ( y , z ) ) ) , l ( l ( u , y ) , i ( x , i ( u , z ) ) ) ) ) . [hyper,1,39,38] P ( i ( i ( x , i ( n ( y ) , y ) ) , l ( z , i ( x , y ) ) ) ) . [hyper,1,29,40] P ( i ( i ( n ( x ) , y ) , i ( z , i ( i ( y . x ) . x ) ) ) ) . [hyper,1,39,42] P ( i ( i ( x , i ( y , z ) > , i ( i ( n ( z ) , y ) , i ( x , z ) ) ) ) . (heat-1) [hyper,25,44.28] P(l(i(n(x) ,n(y)) , l ( y , x ) ) ) . [hyper, 1,36,44] P ( i ( i ( x , i ( n ( y ) , z ) ) , i ( i ( u , i ( z , y ) ) , i ( x . i ( u , y ) ) ) ) ) . Chypar.1,33,45] P ( i ( x , i ( y , x ) ) ) . (heat-1) [hyper.25,26.49] P ( i ( l ( l ( x , y ) , z ) , i ( y , z ) ) ) . [hyper,1,47,42] P ( l ( i ( x , i ( l ( i ( y , z ) , z ) , u ) ) , l ( l ( n ( z ) , y ) , i ( x , u ) ) ) ) . [hyper,1,47,49] P ( i ( i ( x , i ( y . z ) ) , l ( y , l ( x , z ) ) ) ) . (heat-1) [hyper,25,55,28] P ( l ( n ( x ) , i ( x , y ) ) ) . (heat-1) [hyper,26.55,26] P ( l ( l ( x , y ) , i ( l ( z , x ) , i ( z , y ) ) ) ) . [hyper,1,8,57] P ( i ( i ( l ( x , y ) , z ) , i ( n ( x ) , z ) ) ) . [hypar,1,8,58] P ( i ( i ( i ( i ( x , y ) , i ( x , z ) ) , u ) , l ( i ( y , z ) , u ) ) ) . [hypar,1,47,63] P ( i ( i ( x . i ( y , z ) ) , i ( i ( i ( z , u ) , y ) , i ( x , z ) ) ) ) . Chypar.1,67,72] P ( l ( i ( x . y ) , l ( l ( i ( y , z ) , u ) . l ( i ( u . x ) , y ) » ) . Chyp«r,l,54,78] P ( i ( i ( n ( x ) , y ) , i ( i ( z , y ) , i ( i ( x , z ) , y ) ) ) ) . [hypar.5,51,63,85] $*NSWER(lt«p.allLuka.x.l9.37.59).
A 2 5 - S t e p P r o o f of t h e Woa A x i o m S y s t e m Ottsr 3.0.2b+, Aug 1994 Th« job i u atartad by wos on altalr.mcs.anl.gov, Frl Mar 31 20:47:12 1995 Ths comaand was "ott«r302c*. > EMPTY CLAUSE at 3.61 sac $AHSWER(stap.allWos.x.l9.37.60).
Length of proof i s 25.
> 110 [hyper,6,61,63,101]
Laval of proof Is 16.
PROOF
1 [] - P ( i ( x , y ) ) I -P(x) I P(y). 6 [] - P ( l ( i ( i ( p . q ) . r ) , i ( q , r ) ) ) I - P ( l ( l ( l ( p , q ) , r ) , i ( n ( p ) , r ) ) ) I - P ( i ( i ( s , i ( n ( p ) , r ) ) , i ( s , i ( i ( q , r ) , i ( l ( p , q ) , r ) ) ) ) ) I *ANSVER(step_allVos_x_19_37_60). 8 [] P ( l ( l ( x , y ) , i ( l ( y , z ) , i ( x , z ) ) ) ) . 9 [] P ( i ( i ( n ( x ) , x ) , x ) ) . 10 □ P ( l ( x , l ( n ( x ) , y ) ) ) . 25 □ - P ( i ( x , y ) ) I -P(x) I P(y). 26 □ P ( l ( l ( x , y ) , i ( i ( y , z ) . i ( x . z ) ) ) ) . 27 [] P ( i ( i ( n ( x ) , x ) , x ) ) . 28 0 P ( i ( x , i ( n ( x ) , y ) ) ) . 29 33 34 36 36 37 38 39 40 42 44 45 47 49 51 54 55
[hyper,1,8,8] P ( i ( i ( l ( l ( x , y ) , l ( z , y ) ) , u ) , l ( i ( z , x ) , u ) ) ) . [hyper,1,8,10] P ( i ( l ( i ( n ( x ) , y ) , z ) , l ( x , z ) ) ) . [hyper,1,10,9] P ( l ( n ( l ( i ( n ( x ) , x ) , x ) ) , y ) ) . Cheat-1) [hyper,25,26,34] P ( i ( l ( x , y ) , l ( n ( l ( i ( n ( z ) , z ) , z ) ) , y ) ) ) . [hyper,1,29,29] P ( l ( i ( x , i ( y , z ) ) , l ( l ( u , y ) , i ( x , i ( u , z ) ) ) ) ) . (heat-1) [hyper,25,36,27] P ( i ( i < x , y ) , i ( l < n ( l ( y , z » , i < y , z ) ) , l ( x , z ) ) ) ) . [hyper,1,33,35] P ( i ( x , l ( n < i ( i ( n ( y ) , y ) , y ) ) , z ) ) ) . [hyper, 1,36,37] P U ( l ( x . i ( n ( l ( y , z ) > , i ( y , z ) ) ) , i ( i ( u , y ) , i ( x , i ( u , z ) ) ) ) ) . [hyper,1,39,38] P ( l ( l ( x , l ( n ( y ) , y ) ) , i ( z , i ( x , y ) ) ) ) . [hyper,1,29,40] P ( i ( l ( n ( x ) , y ) , i ( z , l ( l ( y , x ) , x ) ) ) ) . [hyper,1,39,42] P ( l ( l ( x , i ( y , z ) ) , l ( l ( n ( z ) , y ) , i ( x , z ) ) ) ) . (heat-1) [hyper,25,44,28] P ( l ( l ( n ( x ) , n ( y ) ) , i ( y , x ) ) ) . [hyper, 1,36,44] P ( l ( l ( x , i ( n ( y ) , i ) ) , i a ( u , i ( z , y ) ) , i ( x , i ( u , y ) ) ) ) ) . [hyper,1,33,45] P ( i ( x , i ( y , x ) ) ) . (heat-1) [hyper,25,26.49] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . [hyper,1,47,42] P ( i ( i ( x , i ( i ( i ( y , z ) , z ) , u ) ) , i ( i ( n ( z ) , y ) , i ( x , u ) ) ) ) . [hyper,1,47,49] P ( i ( i ( x , i ( y , z ) ) , i ( y , l ( x , z ) ) ) ) .
1479
1480
Collected Works of Larry Wos
67 ( h M t - l ) [hyp«r,25,55,28] P(i(n(x) , l ( x , y ) ) ) . 58 (h«at-l) Chyp«r.25,68,26] P U ( l ( x , y ) , i ( i ( z , x ) , i ( z , y ) ) ) ) . 63 fcypwr, 1,8,87] P ( i ( i ( i ( x , y ) , z ) , i < n ( x ) , z ) ) ) . 67 [hypw.l,8,660 P ( i ( i ( i ( i ( x , y ) , i ( x , z ) ) , u ) , l ( i ( y , z ) , u ) ) ) . 73 [hyptr.1,47,63] P ( i ( i ( x , i ( y , z > ) , i ( i ( i ( z , u ) , y ) , i ( x , z ) ) » . 81 thyp«:,l,67,73] P ( l ( i ( x , y ) , i ( i ( i ( y . z ) , u ) . i ( i ( u . x ) , y ) > > ) . 89 Chyp.r,l,M,81] P ( i ( l ( n ( x ) , y ) , i ( i ( z , y ) , l ( i ( x , z ) , y ) ) ) ) . 101 [hyp«r,l,58,89] P ( l ( i ( x , l ( n ( y ) , z ) ) , l ( z , i ( l ( u , z ) , i ( i ( y , u ) , z ) ) ) ) ) . 110 Chyp*r,6,61,63,101] *AMSVER(«t«p_*llVo»_i_19_37_60).
References 1. Kalman, J., A shortest single axiom for the classical equivalential calculus, Notre Dame J. Formal Logic 19 (1978) 141-144. 2. Kalman, J., Condensed detachment as a rule of inference, Studia Logica 42 (1983) 443-451. 3. Lukasiewicz, J., Elements of Mathematical Logic, Pergamon Press: Oxford, 1963. 4. McCharen, J., Overbeek, R., and Wos, L., Complexity and related en hancements for automated theorem-proving programs, Computers and Mathematics with Applications 2 (1976) 1-16. 5. McCune, W., Otter 3.0, Preprint MCS-P399-1193, Mathematics and Com puter Science Division, Argonne National Laboratory, Argonne, Illinois, November 1993. 6. McCune, W., and Wos, L., Experiments in automated deduction with condensed detachment, in D. Kapur (ed.), Proceedings of the Eleventh International Conference on Automated Deduction (CADE-11), Lecture Notes in Artificial Intelligence, Vol. 607, Springer-Verlag, New York, 1992, pp. 209-223. 7. Padmanabhan, P., and McCune, W., Automated reasoning about cubic curves, Computers and Mathematics with Applications 29 (1995) 17-26. 8. Padmanabhan, P., and McCune, W., Single identities for ternary Boolean algebras, Computers and Mathematics with Applications 29 (1995) 13-16. 9. Wos, L., Automated Reasoning: 33 Basic Research Problems, PrenticeHall: Englewood Cliffs, NJ, 1987. 10. Wos, L., Automated reasoning and Bledsoe's dream for the field, in Auto mated Reasoning: Essays in Honor of Woody Bledsoe, R. S. Boyer (ed.), Kluwer Academic Publishers: Dordrecht, 1991, pp. 297-345. 11. Wos, L., The Automation of Reasoning: An Experimenter's Notebook with OTTER Tutorial, accepted for publication by Academic Press (1995).
The Power of Combining Resonance with Heat
1481
12. Wos, L., The kernel strategy and its use for the study of combinatory logic, J. Automated Reasoning 10 (1993) 287-343. 13. Wos, L., Meeting the challenge of fifty years of logic, J. Automated Rea soning 6 (1990) 213-232. 14. Wos, L., The resonance strategy, Computers and Mathematics with Appli cations 29 (1995) 133-178. 15. Wos, L., Searching for circles of pure proofs, J. Automated Reasoning, accepted for publication (1995). 16. Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: Introduction and Applications, 2nd edn., McGraw-Hill: New York, 1992.
The Hot List Strategy* LARRY WOS and GAIL W. PIEPER Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL 60439-4844, U.S.A. e-mail: wosQmcs.anl.gov; pieverOmcs.anl.gov (Received: 15 September 1997; accepted: 13 October 1997) A b s t r a c t . Experimentation strongly suggests that, for attacking deep questions and hard problems with the assistance of an automated reasoning program, the more effective paradigms rely on the retention of deduced information. A significant obstacle ordinarily presented by such a paradigm is the deduction and retention of one or more needed conclusions whose complexity sharply delays their consideration. To mitigate the severity of the cited obstacle, I formulated and feature in this article the hot list strategy. The hot list strategy asks the researcher to choose, usually from among the input statements characterizing the problem under study, one or more statements that are conjectured to play a key role for assignment completion. The chosen statements—conjectured to merit revisiting, again and again—are placed in an input list of statements, called the hot list. When an automated reasoning program has decided to retain a new conclusion C—before any other statement is chosen to initiate conclusion drawing—the presence of a nonempty hot list (with an appropriate assignment of the input parameter known as heat) causes each inference rule in use to be applied to C together with the appropriate number of members of the hot list. Members of the hot list are used to complete applications of inference rules and not to initiate applications. The use of the hot list strategy thus enables an automated reasoning program to briefly consider a newly retained conclusion whose complexity would otherwise prevent its use for perhaps many CPU-hours. To give evidence of the value of the strategy, I focus on four contexts: (1) dramatically reducing the CPU time required to reach a desired goal, (2) finding a proof of a theorem that had previously resisted all but the more inventive automated attempts, (3) discovering a proof that is more elegant than previously known, and (4) answering a question that had steadfastly eluded researchers relying on an automated reasoning program. I also discuss a related strategy, the dynamic hot list strategy (formulated by my colleague W. McCune), that enables the program during a run to augment the contents of the hot list. In the Appendix, I give useful input files and interesting proofs. Because of frequent 'This work was supported by the Mathematical, Information, and Computational Sciences Division subprogram of the Office of Computational and Technology Research, U.S. Depart ment of Energy, under Contract W-31-109-Eng-38. Reprinted from the Journal of Automated Reasoning, Vol. 22, 1-44, 1999, with kind permission from Kluwer Academic Publishers.
The Hot List Strategy
1483
requests to do so, I include challenge problems to consider, commentary on my approach to experimentation and research, and suggestions to guide one in the use of McCune's automated reasoning program OTTER. Key words: automated reasoning programs, hot list strategy, OTTER.
1
Paradigms and Motivation
Two distinctly different paradigms exist for automating logical reasoning. A key difference between the two paradigms concerns whether to accrue new deduced conclusions. Perhaps the most effective approaches where no new information is retained are based on Prolog technology. Among the more effective approaches in which new information is accrued are the computational logic paradigm and the clause language paradigm [17, 18, 21]. The former provides the basis for the Boyer-Moore program [1, 2] (mainly used for program verification), and the latter (in the Argonne variant) provides the basis for McCune's OTTER [7, 8]. Based on my own experiments spread over more than thirty years, and supported by comments from other researchers in automated reasoning, I currently have little doubt that an automated attack on deep questions and hard problems virtually requires the accrual of information—sometimes more than 300,000 deduced facts, relations, and lemmas. With the retention of so many deduced conclusions, however, the program needs a means for selecting where next to focus its attention. Typically, the researcher instructs the program to use either weighting (conclusion complexity) or level saturation. With level saturation, in the vast majority of cases, the size of the levels of retained conclusions grows so rapidly that the objective remains out of reach. Therefore, of the two cited direction strategies, weighting is ordinarily far more effective. However, with its use, one encounters a significant obstacle: A needed conclusion may have been retained, but, because of its complexity, the program delays focusing on it—sometimes forever. Why does the complexity of a conclusion have this effect? The answer rests with the fact that (1) the program typically chooses as the focus of attention retained conclusions by less complex first and (2) the program typically lacks effective means for looking ahead and identifying good choices from among very complex conclusions. To address just such an obstacle, I formulated the hot list strategy. 1.1. TYPES OF STRATEGY AND THE H O T LIST
For increasing the power of automated reasoning programs, the area of research that offers the greatest promise is strategy. My preference is for strategy that restricts reasoning, but clearly strategy that directs reasoning is also vital. The hot list strategy perhaps belongs in neither category. Its use rearranges the order in which conclusions are drawn.
Collected Works of Larry Wos
1484
Specifically, the hot list strategy asks the researcher to choose, from among the statements characterizing the question under attack, those that might be especially useful and merit revisiting again and again. The chosen statements are consulted by the program repeatedly, for completing (rather than initiating) applications of inference rules. Indeed, with the hot list strategy, members of the hot list are automatically and immediately considered with each newly retained clause, before another conclusion is chosen from list(sos) to be the focus of attention to drive the program's reasoning. 1.2.
A MOTIVATING EXAMPLE
Consider the following theorem from algebra. The theorem asserts that commutativity can be proved in rings in which, for every element x, the cube of x equals x. The mathematical proof begins with xxx = x and substitutes the square of v + w for x\ in other words, instantiation is employed, an inference rule that is not offered by OTTER. (Instantiation should not be offered by a program, for currently no means is known for wisely applying it; in other words, one encounters an important difference between mathematics and logic on one hand and automated reasoning on the other.) The left side becomes the cube of v + w, and the right side is simply v 4- w; call this equation (1). After ex panding and simplifying with the hypothesis xxx = x, the left side becomes v + w + vxrw + vwv + vww + tow + www + wwv. Call the resulting equation (2). Equation (3) is obtained from equation (2) by subtracting v + w from both sides. For equation (4), set v = w and simplify with the hypothesis xxx = x. One now has the key lemma 0 = 6x, taken from a proof shown to me by S. Winker. From the viewpoint of automated reasoning with paramodulation as the inference rule, the corresponding proof (in clause notation) begins by paramodulating (into the clause equivalent of) x(xx) = x, with the focus on the into term xx, from the clause equivalent of left distributivity, with the focus on the left-hand argument. After appropriate demodulation, the result is the clause equivalent of equation (2). No clause equivalent of equation (1) is produced, other than the intermediate result obtained by applying the unification to the into clause of the preceding paramodulation. Then, to obtain equation (4), the program can first deduce the clause equivalent of equation (3) by various means, for example, a nonstandard use of demodulation; see Section 2.2 showing how the hot list strategy can replace such an approach. At this point, one has an illustration of the obstacle under discussion: The clause equivalent of equation (3) has weight equal to 37, if measured purely in symbol count. Such a "heavy" clause will be delayed from consideration—if ever—for a substantial amount of CPU time, for many, many clauses will almost certainly be retained with weight less than 37. Therefore, the clause equivalent of equation (4), the desired lemma, will not be adjoined to the growing database of deduced conclusions for far, far too long.
The Hot List Strategy
1485
This situation is not uncommon. Experiments repeatedly encounter the ob stacle of the program's needing to consider some retained conclusion C whose complexity (weight) is so great that far too much CPU time is required before that conclusion is chosen as the focus of attention to initiate applications of some inference rule. When this occurs, the program is prevented from access to those conclusions that would otherwise be deduced. With the hot list strategy, however, the obstacle is far less formidable. In deed, in the case under discussion, the obstacle is overcome. Specifically, when I attempted to obtain a proof of the 0 = 6a; lemma with the hot list strategy, only 0.3 CPU-seconds were required, compared with approximately 17 CPU-seconds without the strategy. 1.3. A BRIEF GLIMPSE INTO HISTORY
Motivated by my wish to give a reasoning program the power to easily prove the cited lemma, 0 = 6a;, in the context of the theorem that asserts that rings are commutative in the presence of xxx = x, I introduced the concept of the hot list in the mid-1980s. My notion focused on paramodulation and no other inference rule. Approximately a decade later (on November 2, 1993), McCune implemented the hot list strategy in OTTER 3.0. Significantly, he generalized my original notion by admitting the use of the hot list for all inference rules. He also generalized the notion of the hot list strategy by formulating a dynamic version to complement my static version; see Section 4.1. For historical interest, I now correct an error found in some of my earlier writings. Specifically, OTTER was not the first program to offer the hot list strategy. Rather, the strategy was first offered in the program ITP [6] in the mid-1980s. This information escaped me because of my lack of experimentation with ITP, in turn explained (in part) by the program being menu driven rather than file driven; I sharply prefer the latter. 1.4.
AREAS BENEFITED AND CHALLENGES PRESENTED
To enable researchers to estimate the potential of the hot list strategy, I present (in Section 5) the results of various experiments in lattice ordered groups, in Robbins algebra, and in logic calculi. The evidence (given in Section 5) support ing the value of the hot list strategy focuses on four areas: dramatically reducing the CPU time required to produce proofs, finding proofs that had previously resisted all but the more inventive attacks, discovering proofs more elegant than had been known, and answering a question previously considered intractable for an automated reasoning program. To encourage researchers—especially mathematicians and logicians—to use the hot list strategy (as well as other strategies), I include (in the Appendix) var ious input files that are acceptable to the powerful automated reasoning program OTTER, and I include interesting proofs as well. (The input clauses and proofs
Collected Works of Larry Wos
1486
are also available on the Web; see the RL htpp://www.mcs.anl.gov/people/wos/ hotlist-input.html.) Also, to increase the likelihood of success when using the hot list strategy, I include (in Section 6) diverse hints. Finally, I offer a challenge problem for researchers (see Section 7).
2
Relation to Other Strategies, Procedures, and Inference Rules
The hot list strategy shares several features with other strategies and inference rules implemented in the automated reasoning program OTTER. In this section, I focus first on the possible relevance of the set of support strategy, then (in order) on demodulation, AC-unification, and linked inference rules. 2.1. S E T OF SUPPORT STRATEGY
Like the hot list, the set of support strategy was motivated by the study of a single (and very simple to prove) theorem: Commutativity can be proved for groups of exponent 2, those in which the square of x (for every element x) is the identity e. My notion (regarding the set of support strategy) was to restrict the applications of the inference rules in use and to force the search to key on information chosen by the researcher. To implement the strategy, the researcher places the key information in an input list, the initial set of support. Such is also the case for implementing the hot list strategy: The researcher places what is conjectured to be key information in an input list, the hot list. New conclusions for which the set of support strategy plays a role are recursively traceable to the initial set of support; new conclusions for which the hot list strategy plays a role are recursively traceable to the initial hot list. For a second way in which the two strategies are related, I have always recommended that the special hypothesis (clauses) be included in the initial set of support, and I typically recommend that such information also be placed in the initial hot list. For a third similarity, just as the newly retained conclusions in which the set of support strategy plays a role are added to the set of support list, so also can clauses be added to the hot list if the dynamic version of the hot list strategy, due to W. McCune, is in use (see Section 4.1 for details). Finally, the conclusions that are retained and that are traceable to the initial set of support can be used, without violating the set of support strategy, to deduce additional conclusions; such is also the case for clauses deduced with the hot list strategy, depending on the value assigned to the heat parameter. Of the cited similarities between the two strategies, perhaps the most im portant concerns keying the program's search on information selected by the researcher. As for a key difference, a member from the set of support is chosen to initiate an application of an inference rule (when the set of support strategy is in use); in
The Hot List Strategy
1487
contrast, the members of the hot list come into play only after a clause has been chosen as the focus of attention to drive the program's reasoning. Indeed, the members of the hot list are used only to complete an application of an inference rule. For a second important difference, the main object of the set of support strategy is to restrict the program's reasoning; on the other hand, the object of the hot list strategy is to rearrange the order in which conclusions are drawn. 2.2.
DEMODULATION
Demodulation is used by many programs for simplification and canonicalization. A dramatic improvement in efficiency is often due directly to automatically applying various equalities (demodulators) to each deduced conclusion. In the mid-1980s, no doubt influenced by the effectiveness of using demod ulation, I conjectured that the automatic consideration by paramodulation of each newly retained clause with each member of a chosen set of equalities might also prove to be a powerful move. The chosen set of equalities would be placed on a list to be called the hot list. Of course, for the hot list strategy, two constraints on the actions of the program must be relaxed: (1) In contrast to demodulation, rather than requiring that no instantiation of variables be permitted in the into clause, full two-way unification must be permitted; and (2) in contrast to the usual use of inference rules, rather than having the program wait until the newly retained clause is chosen as the focus of attention, the program must be allowed to immediately use it as one of the parents in the attempt to draw additional conclusions. Indeed, with the hot list strategy, members of the hot list are automatically and immediately considered by paramodulation, if in use, and by any other inference rule in use (as McCune suggested by way of a generalization) with each newly retained clause, before another conclusion is chosen from list(sos) to be the focus of attention to drive the program's reasoning. As noted in Section 1.2, one can also use the hot list strategy to replace cer tain nonstandard uses of demodulation. In particular, the use of demodulation at the literal level can enable a program to apply extended cancellation. Instead, clauses that function as nuclei and that capture various types of cancellation can be placed in the (input) hot list, and hyperresolution can be used as one of the inference rules. Then, when the program decides to retain a new clause, before another clause is chosen as the focus of attention to initiate applications of inference rules, the clause will be processed with cancellation of the type present in the hot list. One might find this alternative more attractive than either (1) waiting for the clause to be chosen as the focus of attention to then be considered with included clauses for cancellation or (2) using demodulation in some usual form or some nonstandard form.
Collected Worics of Larry Wos
1488
2.3.
AC-UNIFICATION
For this objective, one begins by including in the hot list a clause for associativity and a clause for commutativity, assigning the heat parameter the value 2, and invokes the use of paramodulation. Then, for each newly retained clause before another clause is chosen from list(sos) to be the focus of attention, the program will automatically apply paramodulation to the new clause together with that for associativity and also apply the inference rule to the new clause together with that for commutativity. For each newly retained clause, the two clauses that are so deduced will have heat level 1, and they will be retained depending on the other input parameters and subsumption and such. Then, because of the assignment of the value 2 to the heat parameter, the heat-level-1 clauses (under discussion) that are retained will each immediately be considered by paramodulation with associativity and also with commutativity. In the case under discussion, a limited form of associative-commutative unification is used. Of course, also in use in a limited way in this case is associative unification and commutative unification, at heat level 1 and at heat level 2. Also deduced at heat level 2 are clauses to which associativity has been applied twice and to which commutativity has been applied twice. Use of the hot list strategy in the described manner can produce clauses early in a run that, because of the reassociation and commuting of terms, admit further canonicalization. By choosing the appropriate assignment of the heat parameter, one has control over the amount of AC-unification that is used. I find this alternative to AC-unification appealing, for I have always been wary of a general and full use of that form of unification. Indeed, a full use of ACunification can drown a program in unwanted conclusions; in general, for prac tical considerations, restrictions must be imposed. If associative unification without commutativity is desired, a clause for asso ciativity is included in the hot list, and no clause for commutativity is included. 2.4. LINKED INFERENCE RULES
Use of the hot list strategy can also (in effect) partially substitute for access to linked inference rules [11, 16]. Consider the case in which the clause C is deduced, the decision is to retain C, C has high weight, and, were it not for the fact that a particular term t in C was left associated, paramodulation would apply to C and a clause corresponding to the special hypothesis with the into term being the right association of t. With linked paramodulation, one could use associativity as a link to right associate t in C to then permit the result to unify appropriately with the special hypothesis clause. If one was using the hot list strategy with associativity and the special hypothesis clause in the hot list, and if the heat parameter was assigned the value 2, then the decision to retain C would immediately trigger the application of paramodulation to C and the clause for associativity. Then, if the decision was to retain the result,
The Hot List Strategy
1489
immediately paramodulation would consider the reassociated version of C with the special hypothesis clause. Linked paramodulation does not work precisely as does the hot list strategy. Among the differences is that concerning so-called intermediate clauses. Specif ically, once the program begins an application of a linked inference rule, the weight of a clause that is temporarily deduced on the way to the linked conclu sion is ignored. Linked paramodulation cannot produce an intermediate clause whose weight prevents the continuation of the application of linked paramod ulation. In particular, in the example just discussed, the reassociation of the clause C because of using associativity as a link cannot prevent completion of the application of the linked inference rule because of the weight of the reasso ciated clause. In contrast, with the hot list strategy, the reassociated C must be retained in order to permit its consideration with the special hypothesis clause. (I am curious about the possible usefulness of considering each clause with mem bers of the hot list before the decision concerning retention is made.) A second difference concerns the possible use of demodulation. The intermediate clauses resulting from a partial application of a linked inference rule are not subject to demodulation, but their correspondents are with the hot list strategy.
3
Intuitive View of t h e Hot List Strategy
In the following sense, one sees that the use of the hot list strategy enables an automated reasoning program to "look ahead". Assume that paramodulation is the only inference rule in use and that a clause A has just been selected to be considered (by paramodulation) with each of the various clauses that have already been chosen as the focus of attention. Let H be a member of the hot list, and assume that the assignment to the appropriate input parameter (called heat) permits consideration of H with each new clause that the program decides to retain. Also assume that the program is choosing where next to focus its attention based purely on symbol count and that the weight (number of symbols) of A is 12. Let C be a clause with weight 25 that is deduced from A and some earlier-considered clause such that the program decides to retain C. Finally, assume that, prior to the decision to retain C, the consideration of A has resulted in the retention of ten new clauses each with weight 15. Ordinarily, without the intervention of the hot list strategy, the program would not consider applying paramodulation to C and another clause until after focusing first on the ten newly retained clauses each with weight 15. Quite likely the consideration of C would be delayed further, for the focus on the weight-15 clauses would probably result in the retention of additional clauses of weight less than 25. However—and here is how the use of the hot list strategy enables the pro gram to look ahead—before another clause is chosen as the focus of attention, paramodulation is applied to C and H. If the application yields a clause D with
1490
Collected Works of Larry Wos
weight 10 that is retained, then the program will have almost immediate access to the use of D for initiating applications of inference rules. Otherwise, without the hot list strategy and assuming that H was available to be used, the program would be forced to wait for D to be deduced when C is chosen as the focus of attention—if C is ever chosen. Indeed, as soon as A has completed its role as the focus of attention, D will be chosen to initiate applications of inference rules if all eligible clauses have weight greater than 10. In addition to the deduction of D, other low-weight clauses might be retained whose parents are C and H, and still others from C and some other member of the hot list. If the size of the hot list is small, the researcher need not in general worry about the program being forced to cope with an avalanche of clauses of the type under discussion. In effect, the program looks ahead to deduce just those immediate descendants of C whose other parent is a member of the hot list, assuming that the heat parameter is assigned the value 1. Such a deduced clause D has heat level equal to 1 (defined formally in Section 4). If the value the researcher assigns to the (input) heat parameter is 2, then after the program decides to retain a clause D with heat level 1 but before another clause is chosen as the focus of attention (in this case) paramodulation is applied to D and each member of the hot list, before that newly retained clause is used in its fullest to initiate applications of inference rules. Any clause that is so deduced has heat level equal to 2. Clauses of heat level 2 are immediate descendants of immediate descendants of a newly retained clause. If the program does retain clauses of heat level 2, then the program is looking even further ahead.
4
Formalism, a Powerful Option, and an Illustration
In this section, I give needed definitions, discuss parameters and options, and employ one or more of the notations acceptable to McCune's program OTTER. I then briefly turn to a discussion of the dynamic hot list strategy, and I close this section with an illustration of the use of the hot list strategy. When I use the phrase "clause or its equivalent", I am not restricting the definitions and terminology to OTTER-like programs. Rather, I intend that the appropriate adjustment(s) be made when the program in use requires input in some other form. Often, I use the term "clause" to mean "clause or its equivalent". DEFINITION, INITIAL AND EXTENDED HOT LIST. The initial hot list is a (possibly empty) set of clauses (or their equivalent) selected by the researcher and included in the input. Depending on the exercising of appropriate options, the initial hot list can be extended by adjoining new members to it during a run. Each member of the hot list (initial and extended) is eligible for automatic and immediate consideration to complete applications of the inference rules in
The Hot List Strategy
1491
use, with the requirement that the application of one of those inference rules be initiated by focusing on a clause (or its equivalent) that the program has decided to retain. In particular, no inference rule is permitted to apply to a set of clauses all of which are members of the hot list. DEFINITION, HEAT LEVEL. The heat level of a clause is 0 if and only if no clauses of the hot list participate in the application of an inference rule; the heat level of a clause is 1 if and only if (1) clauses from the hot list participate and (2) the heat level of the clause initiating the application of the inference rule is 0; for n > 2, the heat level of a clause is n if and only if the heat level of the clause that initiates the application of the inference rule is n — 1. Regarding the eligibility of the members of the hot list, the (input) parameter known as heat must be assigned a value greater than or equal to 1 for members to be eligible for use. In other words, permission must be given to deduce clauses with heat level greater than or equal to 1. To instruct OTTER to attempt to deduce clauses with heat level 1, one adds a single command to the input file. If the value in the command of the following type is equal to 1, after OTTER decides to retain a newly generated clause A but before another clause is chosen as the focus of attention (to drive the program's reasoning), each inference rule in use is applied to A (as if A were the focus of attention) and the appropriate number of clauses H in the hot list, where that number is determined by the inference rule being applied. assign(heat,1). The default of the parameter heat is 1. For example, if paramodulation is being applied, then A is considered with each H in the hot list; if hyperresolution is being applied, then, consistent with the requirements of nucleus and satellites, all subsets of clauses from the hot list are considered with A. Any clause B deduced from A and one or more clauses H is treated as all deduced clauses are treated (with regard to subsumption, weighting, demodulation, and the like). If such a clause B is used in a proof, the proof will show for that clause (heat=l), meaning that its heat level is 1. To enable OTTER to deduce and possibly use clauses whose heat level equals 2, one modifies the preceding command to be the following. assign(heat,2). With this modified command, after OTTER decides to retain a newly generated clause B whose heat level equals 1 but before another clause is chosen as the focus of attention, each inference rule in use is applied to B (as if B were the focus
of attention) and the appropriate number of clauses H in the hot list, where that number is determined by the inference rule being applied. As expected, any clauses that are deduced whose heat level equals 2 are treated as all deduced clauses are treated.
1492
Collected Works of Larry Wos
Of course, one can assign to the heat parameter values greater than 2. An assignment of the value 0 instructs the program not to consult the hot list. 4.1. DYNAMIC H O T LIST STRATEGY
As a powerful option, OTTER can also be instructed to dynamically adjoin new clauses to the hot list during the run. This extension of the hot list, developed by McCune, relies on a command of the following type. assign(dynamic_heat_weight, 20). With this command as part of the input, OTTER will—during a run—adjoin to list(hot) any clause that (1) the program has decided to retain and (2) the program has assigned a weight less than or equal to 20. (Clauses adjoined to list (hot) during a run must have an assigned weight less than or equal to the max-weight currently in use.) The dynamic hot list strategy shares some similarity with the set of support strategy. Specifically, one expects or intends that clauses dynamically adjoined to list(hot) play a key role in a program's attack on the question or problem under study, just as one wishes, ideally, that clauses dynamically adjoined to list(sos) play a key role. Of course, as experimentation repeatedly shows, the ideal case (for the set of support strategy) is not even approximated: Typically, a few CPU-minutes suffices to produce a large and growing list(sos), many of whose members will never be chosen as the focus of attention to drive the program's reasoning. The most common cause for a clause not being chosen as the focus of attention is its high weight or complexity. Perhaps in the future, this deficiency will be sharply reduced by having the program automatically (and possibly self-analytically) move certain clauses from list(sos) to list (usable) before they are chosen as the focus of attention; see Section 13.4 of [21]. List(sos) is the name of the list of clauses that have not yet been chosen as the focus of attention but are recursively traceable to the initial set of support or were in the initial set of support. List(usable) consists of the input clauses that were part of the problem description but not placed in the initial set of support and also the clauses that were selected from list(sos) to be the focus of attention to drive the program's reasoning. However, an immediate move of a clause to list(usable) will permit its use only for inference rule completion, not for inference rule initiation. 4.2. AN ILLUSTRATION
For an example of a somewhat elaborate use of the hot list strategy, consider the following excerpt from an input file, where "|" denotes logical or, "-" denotes logical n o t , the predicate P can be interpreted as "provable", the function i can be interpreted as "implication", and the function n as "negation". (When a line contains a "%", the characters from the first "%" to the end of the line are treated by the program as a comment.)
The Hot List Strategy assign(heat,3). list(hot). '/, Following is for condensed detachment. -P(i(x,y)) | -P(x) I P(y). '/, Following is Meredith's single axiom. P(i(i(i(i(i(x,y),i(n(z),n(u))),z),v),i(i(v,x),i(u,x)))). 7. Following were proved in temp.otter3.meredith.hot.out P(i(x,i(y,x))). P(i(i(i(x,y),z),i(y.z))). P(i(x,i(n(x),y))). P(i(n(n(x)),x)). P(i(n(n(x)),x)). P(i(i(i(x,y),z),i(n(x),z))). P(i(x,n(n(x)))). P(i(x,n(n(x)))). P(i(i(n(x),x),x)). P(i(i(x,i(x,y)),i(xIy))). end_of_list.
1493
'/. CN-CAM
The theorem under study asserts that Meredith's axiom is a single axiom for two-valued sentential (or propositional) calculus; see [10]. I give Meredith's proof in the Appendix. As one sees, the inference rule used in the study is condensed detachment, used by Kalman in his landmark study of equivalential calculus [4, 5]; hyperresolution is used. Typically, in such investigations, the only clauses used to initiate applications of an inference rule are unit clauses. Therefore, for the hot list strategy to be usable, one must include at least one nucleus in the hot list; the cited nucleus is the only such clause in the study. After all, as commented earlier, with the hot list strategy, all but the initiating clause for the application of each inference rule must be members of the hot list. Similarly, because the nucleus contains two negative literals, the hot list must also contain at least one other positive clause to permit the use of the hot list strategy to complete applications of condensed detachment through the use of hyperresolution. In the given example, I included in the hot list Meredith's axiom and various members of known axiom systems, each of which had been proved in a prior experiment. The assignment of the value 3 to the heat parameter instructs OTTER to attempt to deduce clauses with heat level less than or equal to 3. Whether any clauses that are thus deduced are retained depends, of course, on other parameters, such as the max.weight parameter (which places an upper bound on the weight of a retained clause).
Collected Works of Larry Wos
1494
5
Experiments
At this point, I present evidence of the power of the hot list strategy by dis cussing various experiments, comparing results with and without the use of this strategy. The experiments focus on four separate contexts: (1) reducing the amount of CPU time to complete a proof, (2) producing a proof of a theorem previously out of reach without much intervention by the researcher, (3) finding elegant proofs (in terms of length), and (4) answering challenging questions. 5.1. REDUCING THE CPU
TIME
In this subsection, I demonstrate that using the hot list strategy can reduce CPU time. However, since no panacea exists, in Section 5.3 one sees that using the hot list strategy can increase CPU time. I begin with a theorem concerned with lattice ordered groups. The theorem was brought to my attention by I. Dahn at the 1994 QED workshop. The the orem (which I call LOGTi for Lattice Ordered Groups Theorem 1) asks one to prove that, for each element x in a lattice ordered group, x is equal to the prod uct of its positive part pp(x) and its negative part np(x), where 1 is the identity of the group, pp(x) is the union of x and 1, and np(x) is the intersection of x and 1. The following (in another notation acceptable to OTTER) gives the axioms, needed definitions, and various members of a complete set of reductions for groups. Regarding the notation in the following, i denotes inverse, 1 the group identity, u union, n intersection, pp positive part, and np negative part; !» denotes "not equal". (The anomaly of having associativity of both union and intersection expressed as they are results from the manner in which I was given the problem; OTTER, when processing the input, interchanges their respective arguments so that the left-associated argument is on the left.) The significance of the line of dashes in the following will become clear when I focus on the set of support strategy. x * x. ( x * y ) * z - x* ( y * z ) . 1*X -
X.
X*l
X.
-
i(x)*x - 1. x*i(x) - 1. i ( l ) • 1. i(i(x)) - x. i(x*y) - i(y)*i(x). n(x,x) » x. u(x,x) ■ x. n(x,y) ■ n(y,x). u(x,y) - u(y,x). n(x,n
The Hot List Strategy
1495
u(x,u(y,z)) - u(u(x,y),z). u ( n ( x , y ) , y ) - y. n ( u ( x , y ) , y ) » y. x*u(y,z) « u ( x * y , x * z ) . x*n(y,z) = n(x*y,x*z). u(y,z)*x « u(y*x,z*x). n(y,z)*x « n(y*x,z*x). pp(x) = u ( x , l ) . np(x) = n ( x , l ) . pp(a)*np(a) != a. Dahn noted that the theorem had been proved in 30 CPU-seconds on a SPARCstation-10 by a program called Discount. (Actually, in addition to the SPARCstation-10, simultaneously two other computers were used, each a SPARCstation-2; after 30 CPU-seconds, Discount announced the theorem provable, but an additional 90 CPU-seconds was required to return the proof.) For my study of LOGTl with OTTER, my colleague McCune in part paved the way; he chose a Knuth-Bendix approach with the following symbol ordering. lex([l,a,u(_,_),n(_,_),*(_,_),i(_),pp(_),np(_)]). McCune assigned max.weight the value 15 (for a bound on the complexity of retained conclusions, measured in symbol count) and assigned the value 4 to the pick-given-ratio. (This latter assignment instructs OTTER to focus on four conclusions based on their complexity, one by first come first serve, then four, then one, and the like.) Finally, McCune placed all clauses in list(sos), in effect instructing OTTER not to use the set of support strategy. On a SPARCstation2, OTTER found a proof (given in the Appendix), of length 33, in approximately 19,280 CPU-seconds. Following McCune's lead, I then took up the attack, using a SPARCstation10 (approximately two times faster than the SPARCstation-2). I report here (not in chronological order) the results of two experiments. In the first, I chose for the hot list precisely the positive clauses in the initial (input) set of support—the clauses given earlier that follow the line of dashes— assigned the heat parameter the value 1. The experiment produced a proof (given in the Appendix), of length 32, in approximately 3148 CPU-seconds. When the run was terminated, after choosing as the focus of attention 3122 clauses, 12,187 (of which 1714 were hot) were retained and 4,670,281 (of which 61,980 were hot) were generated. This experiment provides the inexperienced researcher with a simple rule to follow for choosing clauses for the hot list and for assigning the heat parameter. The second experiment provided more dramatic evidence of the power of the hot list in reducing CPU time. The hot list consisted of the members of the set
Collected Works of Larry Wos
1496
of support used in the just-cited experiment (the positive clauses found after the line of dashes given earlier) augmented by the clauses for commutativity of union and of intersection and the clauses for left and right inverse. I assigned a value of 2 to the heat parameter. The experiment produced a proof, of length 42, in approximately 347 CPU-seconds. 5.2.
BRINGING A THEOREM WITHIN RANGE
In the preceding subsection, I provided evidence of the value of using the hot list strategy to sharply reduce the CPU time required to complete an assignment. Here, my focus is on the use of this strategy to bring within range theorems whose proof resisted various automated attempts. The area is Robbins algebra, an area that I find fascinating mainly for three factors. First, just three axioms suffice to study this algebra, the following expressed in yet one more notation acceptable to OTTER, where one can interpret the function n as complement and the function + as union. EQ(+(x,y),+(y,x)). % commutativity Eq(+(+(x,y),z), + (x, + (y,z))). '/, associativity EQ(n(+(n(+(x,y)),n(+(x,n(y))))),x). '/, Robbins axiom
Second, at least on the surface, Robbins algebra is a natural target for auto mated reasoning; indeed, one can easily study this field by using paramodulation and choosing various options to control this inference rule or by using paramod ulation within a Knuth-Bendix approach. Third, and so intriguing, the question of whether every Robbins algebra is a Boolean algebra was open until McCune with his program EQP answered it in the affirmative [9]; in fact, Tarski and his students failed to answer the question. The question is posed in [3]. My focus here is on RAJZ, a theorem that provides a splendid challenge for automated reasoning programs, especially those that do not offer AC-unification or induction. In terms of the "ordering relation" on the elements of Robbins algebra, the theorem says that the existence of two elements c and d with d less than or equal to c together with the Robbins axioms is all that is needed to imply Boolean. The theorem was first proved by Winker using induction [12, 13]; McCune later obtained a proof with AC-unification. My goal, for years, has been to prove the theorem without induction and without AC-unification. In 1996,1 made yet another attempt. I assigned heat the value 1 and placed in the (input) hot list only the clause corresponding to the special hypothesis, c 4- d = c. I assigned max.weight the value 30, the pick-given .ratio the value 3, and max_distinct.vars the value 3 and included clear(eq-units_both.ways). Regarding weight templates, in weight Jist (pick_given), I included two to respectively purge associative variants in four and five variables, one to purge expressions in which n(n(n(t))) terms occur, and the template for the tail strategy. The inclusion of the template for the tail strategy causes OTTER to prefer clauses in the equality predicate whose
The Hot List Strategy
1497
right-hand argument is short. Success: In approximately 44,926 CPU-seconds, OTTER produced a proof of length 80 and level 18, with retention of clause (66147). In fairness, I must admit that I also succeeded vrithout the hot list strategy. Indeed, in approximately 9770 CPU-seconds, OTTER produced a proof (given in the Appendix) of length 78 and level 16, with retention of clause (48308). Nevertheless, my delight at finding such a proof—for the first time, with and without the hot list—remains unbounded. 5.3. FINDING ELEGANT PROOFS
One measure of the elegance of a proof is its brevity. In this subsection, I show how the hot list strategy has proved useful in the search for elegant proofs, in the context of proof length. Note that no practical algorithm appears to exist for searching for short proofs, and note that numerous obstacles, some of which are indeed subtle, are encountered in such a search; see [21], which takes the form of an experimental notebook. I focus on the formulas known as XHK and XHN, each of which alone is strong enough to provide a complete axiomatization for equivalential calculus. P(e(x,e(e(y,2),e(e(x,z),y)))). P(e(x,e(e(y,z),e(e(z,x),y)))).
'/. XHK 7. XHN
To prove either of the corresponding theorems (by deducing one of the other known single axioms) provides an excellent test for ideas and for programs. Indeed, whether either is a single axiom was an open question until Winker obtained proofs with excellent insight, many computer runs, much time, and considerable assistance from one of Argonne's automated reasoning programs [14, 15]. As an indication of the difficulty offered by the two benchmark theo rems, (not counting the predicate P) Winker's 84-step proof for XHK relies on the use of a formula of length 71, and his 159-step proof for XHN relies on the use of a formula of length 103. To enable researchers to conduct similar experiments, here is a complete list of the shortest single axioms for equivalential calculus, each expressed in clause notation. 'I, Following are a l l of the s h o r t e s t single axioms '/, for e q u i v a l e n t i a l calculus. P ( e ( e ( x , y ) , e ( e ( z , y ) , e ( x , z ) ) ) ) . */. Pl.YQL P ( e ( e ( x , y ) , e ( e ( x , z ) , e ( z , y ) ) ) ) . '/. P2.YQF P ( e ( e ( x , y ) , e ( e ( z , x ) , e ( y , z ) ) ) ) . 7. P3.YQJ P ( e ( e ( e ( x , y ) , z ) , e ( y , e ( z , x ) ) ) ) . 7. P4.UM P ( e ( x , e ( e ( y , e ( x , z ) ) , e ( z , y ) ) ) ) . 7. P5.XGF P ( e ( e ( x , e ( y , z ) ) , e ( z , e ( x , y ) ) ) ) . 7. P7.WN P ( e ( e ( x , y ) , e ( z , e ( e ( y , z ) , x ) ) ) ) . 7. P8.YRM P ( e ( e ( x , y ) , e ( z , e ( e ( z , y ) , x ) ) ) ) . 7. P9.YR0
Collected Works of Larry Wos
1498
P(e(e(e(x,e(y,z)),z),e(y,x))). P(e(e(e(x,e(y,z)),y).e(z,x))). P(e(x,e(e(y,e(z,x)),e(z,y)))). P(e(x,e(e(y,z),e(e(x,z),y)))). P(e(x,e(o(y,z),e(e(z,x),y)))).
7. PYO X PYM */. XGK 7. XHK 7. XHN
From various experiments, I had found a 27-8tep proof showing that XHK is a single axiom and a 24-step proof showing that XHN is also a single axiom. I decided next to use the hot list strategy to attempt to find even shorter (more elegant) proofs. I began with XHN, using a level-saturation approach, assigning the value of 36 to max_weight and the value of 2 to each of 24 resonators corresponding to the steps of the 24-step proof I had obtained. I included in list (passive) the negations of each of the other twelve shortest single axioms, expecting a deduction of UM only. I assigned the value 1 to the heat parameter and placed in the hot list the clauses corresponding to XHN and the condensed detachment nucleus. In approximately 38 CPU-seconds (on the equivalent of a SPARCstation-2), OTTER deduced UM with a proof of length 22 and level 11, with retention of clause (864). When I then deleted the use of the resonance strategy [19, 23], in approximately 770 CPU-seconds OTTER deduced UM with a proof of length 20 and level 14, with retention of clause (9777). Why did the hot list strategy succeed? A key rests with the effect the strat egy has when level saturation is being used. For an illustration of how this combination causes the program to look ahead, assume the heat parameter is assigned the value 1, that condensed detachment is in use, and that the hot list contains the needed clauses (such as that for condensed detachment and, say, the shortest single axiom candidate under study). When a level-1 clause A is deduced and retained and the hot list strategy is in use, A will immediately be used to initiate applications of condensed detachment with the clauses needed to complete the applications chosen from the hot list. If condensed detachment succeeds, yielding a clause B, B will have level 2 (and heat level 1). If B is retained, it will be placed among the level-1 clauses, even though it has level 2. Keep in mind that, very likely, the program is still generating level-1 clauses and simply paused, because of the use of the hot list strategy. Then, when the program is using the level-1 clauses to deduce those of level 2, B (of level 2) will be used; but its use will generate level-3 clauses, which, if retained will be placed among the level-2 clauses. In addition, because of the use of the hot list strategy, such a level-3 clause C will be used immediately. If clauses are deduced and retained, they will be of level 4, but be placed among those of level 2, just as B was deduced and placed among the level-1 clauses. Regarding the successful completion of the cited 20-step proof, a glance at the output file shows that the program was deducing and retaining clauses of level 11 when it found and used a level-14 clause to complete the proof. In other words, the program, because of using the hot list strategy in conjunction with
The Hot List Strategy
1499
level saturation, was able to look ahead into higher levels. One thus sees how the program found a different proof, one of length 20, by traversing a sharply different search path. To determine the effect on CPU time, on a computer that is perhaps 1.3 times as fast as a SPARCstation-10,1 conducted two experiments. Approximately 38 CPU-seconds suffices with level saturation and without the hot list strategy, in contrast to approximately 306 CPU-seconds with the combination of level saturation and the hot list strategy. Again, for part of the explanation, one need only glance at the corresponding output files, finding that level 10 completes with clause (87) when the hot list strategy is not in use, and level 10 completes with clause (1488) when it is in use. These two figures further illustrate how the hot list strategy, when level saturation is in use, causes the program to look ahead into higher levels. The figures also illustrate a disadvantage of using this combination of strategies, for the size of the levels can grow far more rapidly. One final experiment merits discussion. In the spirit of cursory proof checking (as opposed to rigorous proof checking), both covered in [21], I used as resonators the 20 steps of the just-cited proof, assigned a value of 2 to each, and assigned to the max.weight the value 2. Again, I used the hot list strategy, motivated by a distantly related experiment in another logic calculus, an experiment that yielded under similar conditions an even shorter proof; see [24] and Section 3.4 of the technical report [26] that is a far longer version of this article. I was not rewarded: OTTER merely returned the 20-step proof already discussed. On a whim, I repeated the experiment with one change, that of omitting the use of the hot list strategy. I was more than startled, for OTTER completed a 19step proof of level 14 (given in the Appendix), showing that a shorter proof can be found with cursory proof checking either by adding the use of the hot list strategy or (in this case) by removing its use. I know of no shorter proof establishing XHN to be a single axiom for equivalential calculus, a fact that implicitly poses a possible research question. Next I turned to a study of XHK, applying a similar approach to that which yielded the 20-step proof that XHN is indeed a shortest single axiom for equiv alential calculus. In one of several experiments, I assigned max.weight the value 48, used ancestor subsumption (and, therefore, used back subsumption), as signed the pick_given.ratio the value 3, reassigned the max.weight to the value 20 after 30 clauses were chosen as the focus of attention, and used the hot list strategy with the heat parameter assigned the value 1.1 placed in the hot list the clauses corresponding to XHK and the condensed detachment nucleus. I used the pick.and.purge weight.list and included, for the resonance strategy, weight templates corresponding to the steps of the earlier-mentioned 27-step proof, which completed with a deduction of YRO. OTTER succeeded in finding a 26-step proof. Four of the steps reflect the use of the hot list strategy, each showing (heat=l). As with XHN, one additional experiment merits citing because of the progress that resulted. However, rather than cursory proof checking providing the key,
Collected Works of Larry Wos
1500
parameter changes proved to be crucial. Regarding the changes, I assigned the pick_given_ratio the value 2 rather than 3, instructed the program to reduce the max_weight from 48 to 24 after 50 clauses were chosen as the focus of attention, and used for resonators weight templates that correspond to the 26 steps of the just-cited proof. OTTER succeeded in finding a 23-step proof of level 19 (given in the Appendix), but, rather than deducing YRO, the proof completed with the deduction of YQL. Again, four of the steps reflect the use of the hot list strategy, each showing (heat=l). 5.4. ANSWERING CHALLENGING QUESTIONS
In Section 5.1, I focused on the theorem LOGTI to show how the hot list strategy can be used to sharply reduce the time required to find a proof. In this subsection, I focus on another problem in lattice ordered groups, LOGT2, which provides evidence of how the hot list strategy can be used to obtain a solution to an interesting question whose answer had eluded researchers. Again, Dahn brought the original theorem to my attention. In this case, however, his program had not been able to obtain a proof. One is asked in LOGTI to prove a relation among inverse, intersection, and union, a relation whose negation is the following, where i denotes inverse, n denotes intersection, and u denotes union. i(n(a,b)> !-
u(i(a),i(b)).
As the problem was proposed to me, one is permitted to use essentially the entire underlying theory. I began by discarding all nonunit clauses and all new (not in the input for LOGTI) equalities but two, the following. u(x,n(y,z)) * n(u(x,y),u(x,z)). n(x,u(y,z)) - u(n(x,y),n(x,z)). I added in list(sos) the two positive equalities to the input for LOGTi (of course, omitting the denial of its conclusion) and added the negative equality to list(passive). I chose a level saturation approach, using the following command. set(sos_queue). I assigned the value 2 to the heat parameter and used the following hot list. list(hot). n(x,y) - n ( y , x ) . u(x,y) » u ( y , x ) . i(x)*x - 1. x*i(x) « 1. u ( n ( x , y ) , y ) - y. n ( u ( x , y ) , y ) « y.
The Hot List Strategy
1501
x*u(y,z) - u(x*y,x*z). x*n(y,z) - n(x*y,x*z). u(y,z)*x » u(y*x,z*x). n(y,z)*x - n(y*x,z*x). u(x,n(y,z)) » n(u(x,y),u(x,z)). n(x,u(y,z)) » u(n(x,y),n(x,z)). end_of_list. I also used resonators from an earlier success, each assigned the value 2. With the hot list strategy, OTTER produced a proof in approximately 1826 CPU-seconds with length 37 and level 15, with retention of clause (6698). By comparison, without the hot list strategy, OTTER produced no proof. The explanation for the success rests with the following. With level satura tion and the heat parameter assigned the value 2, when a new clause is retained at, say, level 4, the hot list strategy will first immediately generate clauses of level 5 (and heat level 1) and then, if any of them are retained, use them to immediately generate clauses of level 6 (and heat level 2). So, in one sense, the use of the hot list strategy with a breadth-first search enables a program to look ahead; see Section 6.2 for more discussion. Rather than simply turning to another topic, I mention here one additional set of experiments concerning LOGT2. The results of the experiments nicely illustrate how narrow can be the window of opportunity to answer a difficult question and how intertwined various procedures often are. Whereas one of the experiments yielded the shortest proof (given in the Appendix) of LOGT2 of which I know—a proof of length 22—the other experiments yielded no proof of any type. The 22-step proof was found by dropping the use of level saturation, assigning the value 10 rather than 6 to the pick.given_ratio, assigning the value 3 rather than 2 to the heat parameter, and using a hot list consistent with the recommendation (given in Section 6.1) concerning "short and simple" clauses that occur in the input set of clauses. The hot list consisted of the following ten clauses. l*x = x. x*l = x. i(x)*x = 1. x*i(x) - 1. i ( l ) - 1. i ( i ( x ) ) - x. n(x,x) = x. u(x,x) = x. u ( n ( x , y ) , y ) - y. n ( u ( x , y ) , y ) - y. The other options and assignments were the same as were used in the cited suc cessful level-saturation run for LOGT2. Although some of the other experiments
Collected Works of Larry Wos
1502
from the set failed to yield a proof, they were each most valuable, for their re spective failure provides evidence of how narrow is the window of opportunity. In one of the experiments that failed to yield any proof, except for dropping the use of level saturation, the experiment was identical to that which yielded the 37-step proof; in other words, the hot list consisted of the elements used in the level-saturation experiment that succeeded. In another experiment that failed, the hot list consisted of just the following two clauses. i(x)*x - 1. x*i(x) - 1. In my view, the narrowness of the window of success is not a weakness of the hot list strategy; rather, it simply reflects the depth of mathematics and the fact that no panacea exists.
6
Recommendations and Hints for Using t h e H o t List Strategy
This section is devoted to guidance and notions about using the hot list strategy most effectively. I begin with a few recommendations, then follow with more specific hints for choosing parameters. 6.1. RECOMMENDATIONS
I recommend that an input clause placed in list(hot) also be placed in some other list. (Among the exceptions was that discussed earlier, at the end of Section 2.2, in the context of cancellation.) For example, if an input clause would ordinarily be included to complete the application of an inference rule rather than initiate the application, then I recommend that, if the clause is placed in list(hot), it also be placed in list (usable). As an aside, and independent of the hot list strategy, clauses one suspects are best used to complete rather than initiate inferences belong, in my view, in list(usable). As another aside, I conjecture that the effectiveness of an automated reasoning program would be increased if, when such a (completion) clause is retained, it were immediately placed in list(usable) rather than being placed in list(sos). This option is not offered by OTTER or, for that matter, from what I know by any program, and it might make an interesting research problem. When one is studying logic calculi (in which condensed detachment is used in the presence of the inference rule hyperresolution), I recommend placing a clause of the following type both in list(usable) and in list(hot). - P ( i ( x , y ) ) 1 -P(x) I P ( y ) . This clause is best used to complete applications of an inference rule, and almost never to initiate them.
The Hot List Strategy
1503
On the other hand, if I were using OTTER to apply the hot list strategy to study rings in which the cube of (every element) x is x, I would place the clause equivalent of xxx = x both in list(sos) and in list(hot). I would take this action even though such a clause is best used to initiate applications of an inference rule, rather than complete an application. One might be puzzled by this recommendation, for clauses in list(sos) are best used to initiate applications of an inference rule, while clauses in the hot list are used only to complete applications. Nevertheless, my experience with the hot list strategy suggests that the inclusion (in the hot list) of such clauses adds to the effectiveness of this strategy. As a global recommendation, I suggest including in the hot list those clauses that correspond to the special hypothesis of the proposed theorem under attack. Such clauses also, in my view, are wisely placed in list(sos). For a related global recommendation, I suggest the hot list consist of those equations from the input set of support having eight or fewer symbols (ignoring parentheses and commas) whose right-hand argument is a single symbol, con stant or variable. Of course, I have in mind that predicates, functions, and the like are represented with single letters. The hot list can also be augmented with all similar "short and simple" clauses taken from the usable list. I recommend using the dynamic hot list strategy when one suspects that some of the clauses adjoined during the run merit repeated visiting as hypotheses for completing applications of an inference rule. In particular, I recommend the assignment of a small value for the dynamicJieat.weight, enough to permit new clauses to be adjoined to the hot list during the run, but not so big as to cause the hot list to become large. Even a small value can drown the hot list, if the weight -list contains templates that both have smaller values assigned to them and are frequently matched during the run. Indeed, one must exercise care when combining the dynamic hot list strategy with the resonance strategy. For example, if one includes resonators corresponding to formulas from equivalential calculus, because many formulas can match a single resonator, havoc may be the result. A clue is provided when one sees that OTTER is spending substantial CPU time on a single clause that is chosen as the focus of attention. Regarding assignments for the values for the heat and the dynamic Jieat.weight parameters—with the exceptions just noted and those discussed in Section 6.2— I can only suggest experimentation. One might profitably glance at some of the experiments I feature in Section 5; see also [20, 21, 22, 23] and especially [24] and [25]. (Of the various references, [24] is the choice for the researcher wishing far more detail concerning tendencies exhibited by the options offered by OTTER.) Before I turn to hints for using the hot list strategy, the following observation needs utterance. The use of the hot list strategy, as is the case for various options offered by OTTER that affect the search space, can produce unexpected results. For example, an assignment of the value 2 to the heat parameter can yield for a given problem a shorter proof than previously in hand, where an assignment of the value 1 may yield no proof. Indeed, in the latter case, the program might
1504
Collected Works of Larry Wos
inform the user that the set of support has gone empty. The explanation rests with the reordering of the space of drawn conclusions and canonicalizations that can occur with procedures such as demodulation and subsumption. For a second example, a small hot list may produce no proof, a slightly larger one may produce the best proof one has seen, and an even larger hot list may produce a proof of little interest. See Section 5.4 for examples of the type just discussed. In general, when one takes actions that change the search, one can expect that a longer clause might be needed to get a proof or expect other odd occurrences. 6.2. HINTS REGARDING THE H O T LIST STRATEGY
To complement the cited general recommendations, I offer the following more specific suggestions and examples. The first bulleted item concerns early exper imentation; the remaining items pertain to use of the hot list at any time in one's research. • Especially in the beginning of one's experiments, I recommend that the heat parameter be assigned the value 1, and I recommend that the (in put) hot list consist of the clause or clauses that correspond to the special hypothesis of the theorem under attack. For example, if the theorem con cerns groups in which the cube of x is the identity e, then the special hypothesis is the equation xxx = e. When studying some logic calculus, for a second recommendation, I suggest the axioms of the theory (if fewer than eight in number) and the nonunit clause (if such is used) correspond ing to condensed detachment. For a third recommendation, if the theorem under study offers no special hypothesis, or if the special hypothesis is messy (consisting of several nonunit clauses, for example), then I suggest putting in the hot list the elements of the (input) set of support that take the form of positive unit clauses. On the other hand, especially when no special hypothesis exists (as when one is studying some logic calculus), I repeat my second recommendation. • A value of 2 or greater for the heat parameter is suggested when one wishes a recursively heavier emphasis on the members of the hot list. The inclusion of an input hot list (and, of course, the use of the hot list strategy) is suggested when one conjectures that certain input clauses have been identified as meriting repeated consideration as hypotheses for drawing conclusions by completing applications of an inference rule. • By placing in the (input) hot list clauses for associativity and commutativity, one can use the hot list in place of a limited form of AC-unification. The greater the value assigned to the heat parameter, the more AC-unification that occurs. However, effectiveness can be severely impaired with asso ciativity in the hot list if the heat parameter is assigned the value 3 or greater.
The Hot List Strategy
1505
• Combining a level saturation search with the hot list strategy often pro duces impressive results. For a taste, when the program is adjoining clauses at level 4, with the hot list strategy in use and the heat parameter assigned the value 2, the program also is deducing (for possible retention) clauses at level 6. In the obvious sense, the cited combination permits the pro gram to look ahead, and the distance is greater than or equal to the value assigned to the heat parameter. For example, although the heat parame ter was assigned the value 1 when studying XHN, a proof of level 14 was completed as the program was deducing clauses of level 11.
7
Conclusions and a Challenge
In this article, I have featured the hot list strategy, presenting numerous per tinent experiments. I have also discussed briefly the dynamic hot list strategy. The hot list strategy asks the researcher to provide an input list (called the hot list) of statements (clauses) that the automated reasoning program uses to complete, in contrast to initiate, applications of the inference rules in use. Ordi narily, one chooses for the members of the hot list clauses that are conjectured to merit revisiting repeatedly, clauses on which to key the program's attack. The dynamic hot list strategy (formulated by McCune) extends the hot list strategy to permit the program to adjoin members to the hot list during the run. Both formulations address the inaccessibility of certain retained clauses, for far too long, because of their complexity. The evidence presented in this article shows that the hot list strategy can be used successfully in at least four con texts: reducing CPU time, finding proofs of theorems previously out of reach without much intervention of the researcher, finding more elegant proofs, and answering a question whose answer had steadfastly eluded researchers relying on an automated reasoning program. Continuing in the tradition begun at Argonne National Laboratory approxi mately three decades ago (in the early 1960s), I close with a challenging problem for interested researchers. • Evaluate the effectiveness of the hot list strategy, using as members of the hot list generated clauses, rather than retained clauses. This incarnation or modification of the hot list strategy would permit the program to draw conclusions that are children of clauses that might be discarded because of being too complex as measured in weight.
Appendix As promised, here I present input files and proofs. The input files are intended to facilitate the further study by researchers of the areas touched on in this article. They also are intended to serve as templates for research in other areas
1506
Collected Works of Larry Wos
of mathematics and logic. In some cases, I include lines preceded with "%", which McCune's program OTTER treats as a comment. The input files, as well as the proofs given here, provide the merest taste of what one can do with OTTER; more is found in my new book [24]. One of my main reasons for including specific proofs is my strong convic tion that likelihood of experimentation producing valuable results is sharply increased. Indeed, when the objective is the formulation of, say, a new strategy or new inference rule or the testing of a reasoning program, I have always been more than puzzled at the nonchalance of some regarding the value of having in hand a proof of the theorem under attack. Few (if any) means are better for measuring progress than seeing how many proof steps of a given proof have been produced with the new approach or the program under evaluation. I begin with an input file that can be used to initiate one's attack on finding a means for an automated reasoning program to prove, definitely not in a proof checking mode, that Meredith's single axiom suffices for an axiom system for two-valued sentential calculus. To aid one's research, I also include (essentially) Meredith's proof; it was produced with a cursory proof-checking run, using his steps as resonators and assigning max-weight the value 2. Input File for Studying Meredith's Single Axiom (at (hypar.ras). assignCaax.vaight, 28). aaaign(chanfa_liait.aftar, 2000). assignGiavjux.waight, 20). usign(aax_proofs, - 1 ) . claar(print.kapt). claar(back.sub). u « l g n ( u x _ B M , 110000). assign(r •port, 1800). assign(aax_dlstinct_vars, 7 ) . assign(piek_givan_ratio, 3 ) . asslgn(haat,l). sat(ordsr.hlstory). sat(lnput_sos_iirst). vaight.list(pick.glvan). X Tha following i s Maradith's singla axioa. »aight(PU(i,i(y,z)>),2). vaight(P,i(i(z,x),l(z,y)))),2). saight(P(i(i(x,i(x,y)).i(x.y))),2). »aight(P(i(iCx,i(y,z)).i(l(x.y),i(x,z)))),2). waight(P(i(i(i(x,y).z),i(n(x),z))),2). «aignt(P(i(n(n(x)),x)),2). »alght(P(i(x,n(n(x)))),2). waight(P(i(i(x,y),i(n(y),n(x)))).2). »aijat(P(i(i(n(x) ,n(y» ,i(y,x))) ,2) . »aight(P(i(i(x,y)(l(i(n<x),y),y))),2). waifht(P(i(i(n(x),y),i(i(z,y),l(i(x.z),y)))),2).
The Hot List Strategy
1507
weight(P(i(i(x,i(n(y).z)),i(x,i(i(u,z),l(i(y,u),z))))),2). X Following Is for recursive tail strategy. veight(i($U),t(2)),l>. end.of.list. list(usable). X Following is for condensed detachment. -P(i(x,y)) I -P(x) I P(y). X
The following disjunctions sxs known axiom systems.
-P(i(q,i(p,q))) I -P(i(i(p,i(q,r)).l(i(p>q),i(p,r)))) I -P(i(n(n(p)),p)) I -P(i(p,n(n(p)))) | -P(i(i(p,q),l(n(q).n(p)))) I -P(i(i(p.i(q,r)),i(q.i(p,r)))) I *ANSVER(step_allFrege_18_35.39.40_46_21). X 21 is dependent. -P(i(q,i(p.q))) I -P(i(i(p,i(q.r)).i(q,i(p,r)))) I -P(i(i(q,r) ,i(i(p.q) ,i(p,r)))) I -P(i(p,i(n(p),q))) I -P(i(i(p,q),i(i(n(p).q),q») I -P(i(i(p,i(p.q)) ,i(p.q))) I *AMSWER(stsp.«llHilbsrt. 18.21.22.3.54.30). X 30 is dapsndant. -P(i(q,i(p,q))) I -P(i(l(p,l(q,r)),l(i(p,q),i(p,r)))) *ANSUER(stsp.allBEH.Church.FL.18.35.49).
I -P(i(i(n(p) ,n(q)) ,i(q,p))) I
-P(i(i(i(p,q),r),i(q,r))) I -P(i(i(i(p,q),r),i(n(p),r))) $ANSVER(step_allLuka.x.l9_37_S9).
I -P(i(i(n(p),r),l(i(q,r),l(i(p.q),r)))) I
-P(i(i(i(p,q),r),i(q,r))) I -P(l(l(i(p.q),r),i(n(p),r))) I -P(i(i(s,i(n(p),r)),i(s,iz),i(i,i))». X P(i
X CN-CAM
list(passive). - P ( i ( i ( p , q ) . i ( i ( q , r ) , i ( p . r ) ) ) ) I $ANSVER(step_Ll). - P ( i ( i ( n ( p ) , p ) , p ) ) I *ANSWER(stap.L2). - P ( i ( p , i ( n ( p ) , q ) ) ) I t«(SWER(stap.L3). - P ( i ( q , i ( p . q ) ) ) I $JU(SWER(stap.l8). - P ( i ( l ( l ( p , q ) , r ) , i ( q , r ) ) ) I «JWSWER(stap.l9). - P C K K p . K q . r ^ . K q . K p . r ) ) ) ) I tlHSVER(step_21). - P ( i ( i ( q , r ) . i ( i ( p , q ) , l ( p , r ) ) ) ) I M»SVER(step_22). - P ( i ( i ( p , i ( p , q ) ) . l ( p , q ) ) ) I «*MSWER(stap.30). - P ( i ( i ( p , i ( q , r ) ) , i ( i ( p . q ) , l ( p . r ) ) ) ) | $»NSWER(step_35). - P ( i ( i ( l ( p , q ) , r ) , l ( n ( p ) . r ) ) ) I »ANSyER(atep.37). - P ( i ( n ( n ( p ) ) , p ) ) I *AHSVER(atep_39). - P ( i ( p , n ( n ( p ) ) ) ) I ti(NSWER(stap.40). - P ( i ( i ( p , q ) , i ( n ( q ) , n ( p ) ) ) ) I *AHSWER(step_46). - P ( i ( i ( n ( p ) , n ( q ) ) , i ( q , p ) ) ) I $AMSWER(step_49). - P ( i ( i ( p , q ) . i ( i ( n ( p ) , q ) , q ) ) ) I *ANSVER(step_54). - P ( i ( i ( n ( p ) , r ) , i ( i ( q , r ) , i ( i ( p . q ) , r ) ) ) ) I $A»SWER(stap.S9). -P(i(iCs,i(n(p> , r ) > , i t s , i ( i ( q , r ) , i ( i ( p , q ) , , . ) ) ) ) ) | $jutSWER(step_60). - P ( i ( n ( n ( a ) ) , a > ) I $ANSWE»(lama_24). - P ( l ( a , n ( n ( a ) ) ) ) I $ANSVER(lemma_29). - P ( i ( i ( a , b ) , i ( i ( c , a ) , i ( c , b ) ) ) ) I *ANSUER(lajuna.25). - P ( i ( i ( a , b ) , i ( n ( b ) , n ( a ) ) ) ) I $ANSVER(lemaa_36). and.of.list.
Collected Works of Larry Wos
1508
list(demodulators). X (n(n(x)) - junk). (o
X CH-CAM
Meredith's Proof > H O T Y CLAUSE »t
1.35 sec
> 58 [hyper,6,67,47,38]
SANSWERUuka,[1,2,3]). Length of proof is 41.
Level of proof is 30.
PROOF 1 [] - P U ( x . y ) ) I -P(x) IP(y). 6 [] - P ( i ( i ( p , q ) , i ( i ( q , r ) , i ( p , r ) ) ) ) I - P ( i ( i ( n ( p ) , p ) , p ) ) I - P ( i ( p , i ( n ( p ) , q ) ) ) I $ANSVER(Luka,[1,2,3]). 7 D P(i(i(i(i(i(x,y),i(n(z),n(u))),z),v),i(i(v.x).i(u,x)))). 8 [hyper,1,7,7] P ( i ( i ( i ( i ( x , y ) , i ( z , y ) ) , i ( y , u ) ) , i ( v , i ( y , u ) ) ) ) . 9 [hyper,1,7,8] P ( i ( i ( i ( x , i ( n ( y ) , z ) ) , u ) . i ( y , u ) ) ) . 10 [hyper,1,7,9] P ( i ( i ( i ( x , x ) , y ) , i ( z , y ) ) ) . 11 [hyper,1,10,10] P ( i ( x , l ( y , i ( z , z ) ) ) ) . 13 [hyper,1,7.11] P ( l ( i ( i ( x , i ( y , y ) ) , z ) , i ( u , z ) ) ) . IS [hyper,1,7,13] P ( i ( i ( i ( x , y ) , z ) , i ( y , z ) ) ) . 17 [hyper,1,15,7] P ( i ( x , i ( i ( x , y ) , i ( z , y ) ) ) ) . 18 [hyper.1,15,17) P ( i ( x , i ( i ( i ( y , x ) , z ) , i ( u , z ) ) ) ) . 19 [hyper, 1,17,9] P ( l ( l ( i ( i ( i ( x , i ( n ( y ) , z ) ) , u ) , i ( y , u ) ) , v ) , i ( w , » ) ) ) . 20 [hyper, 1,7,18] P ( i ( l ( i ( i ( i ( x , i ( i ( i ( y . z ) , i ( n ( u ) , n ( v ) ) ) , u ) ) , » ) , l ( v 6 , v ) ) , y ) , i ( v , y ) ) ) . 21 [hyper, 1,7,19] P ( l ( l ( i ( x , y ) , i ( z , i ( n ( n ( y ) ) ,u))) , i ( v . l ( z , i ( n ( u ( y ) ) , u ) ) ) ) ) . 22 [hyper. 1,7,20] P ( l ( l ( i ( x , y ) , i ( z , i ( i ( i ( y , u ) , i ( n ( v ) , n ( x ) ) ) , » ) ) ) , i(w,l(z,i(i(l(y.u),l(n(r),n(x))),v))))). 23 [hyper,1,21,7] P ( l ( x . i ( l ( y , z ) , i ( n ( n ( y ) ) , z ) ) ) ) . 24 [hyper.1,22,17] P ( l ( x , l ( l ( l ( y , z ) , u ) , i ( i ( i ( z , v ) , i ( n ( u ) , n ( y ) ) ) , u ) ) ) ) . 25 [hyp«r,1,23,23] P ( l ( l ( x . y ) , l ( n ( n ( x ) ) , y ) ) ) . 26 [hyper, 1,7,23] P ( i ( i ( i ( i ( x , y ) , i ( n ( n ( x ) ) , y ) ) , z > , i ( u , z ) » . 27 [hyper, 1,24,24] P ( i ( i ( i ( x . y ) , z ) , i ( i ( i ( y , u ) , i ( n ( z ) , n ( x ) ) ) , z ) ) ) . 29 [hyper,1,10,25] P ( i ( x . i ( n ( n ( y ) ) , y ) ) ) . 30 [hyper,1,27,18] P ( i ( i ( i ( x , y ) , i ( n ( l ( l ( i ( z , i ( u , x ) ) , » ) , i ( w , T ) ) ) , n ( u ) ) ) , i(i(i(z,i(u,x)).v).i(if.v)))). 31 [hyper,1,17,29] P ( l ( i ( i ( x . i ( n ( n ( y ) ) , y ) ) , z ) , l ( u , z ) ) ) . 32 [hyper,1,7,30] P ( l ( i ( i ( i ( i ( x , l ( y . i ( z , u ) ) ) , » ) , i ( w , v ) ) , z ) , i ( v 6 , z ) ) ) . 33 [hyper.1,7,32] P ( i ( i ( i ( x , y ) , i ( z , i ( u , l ( y , v ) ) ) ) , i ( w , i ( z , i ( u , i ( y , v ) ) ) ) ) ) . 34 [hyper,1,33,7] P ( i ( x . i ( i ( y , i ( y , z ) ) , i ( u , i ( y , z ) ) ) ) ) . 35 [hyper,1,34,34] P ( i ( i ( x , i ( x , y ) ) , i ( z , l ( x , y ) ) ) ) . 36 [hyper,1,35,36] P ( i ( x , i ( i ( y , i ( y , z ) ) . i ( y , z ) ) ) ) . 37 [hyper,1,36,36] P ( i ( l ( x , i ( x , y ) ) , i ( x , y ) ) ) . 38 [hyper.1,9,37] P ( i ( x , l ( n ( x ) , y ) ) ) .
The Hot List Str&tegy
39 40 42 43 46 47 48 49 60 62 53 54 55 57 58
1509
Chyp«r,l,37,31] P ( i ( i ( i < x , l ( n ( n ( y ) ) . y ) ) , z ) , z ) ) . B»yp«r,1,37,263 P ( i ( i ( l ( l < x , y ) , i ( a ( n ( x ) ) , y ) ) , z ) , z ) ) . [hyp«r,l,26,39] P < i ( n ( n ( i U ( x , l ( n ( n ( y ) ) , y ) ) , z ) ) ) , z ) ) . [hyp«r,1,7,40] P ( i { i ( n ( x ) , x ) , l ( y , r ) ) ) . [hyp«r,1,18,42] P ( i ( i ( i ( x , i ( n ( n ( i ( i ( y , i C n ( n ( z ) ) , z ) ) , u ) ) ) , u ) ) , v ) , i ( w , v ) ) ) . [hyp«r,l,37,43] P ( i ( i ( n ( x ) , x ) , x ) > . [hyp«r,1.7,46) P ( l ( i ( i ( x , n ( i ( i ( y , i ( n { o ( z ) ) , z ) ) , n ( u ) ) ) ) , v ) , i ( u , v ) ) ) . Chyp«r, 1,48,47] P ( i ( x , n ( i ( l ( y , i ( n ( i i < z ) ) . z ) ) , n ( x ) ) ) ) ) . Chyp«r,1,18,49] P ( i ( i U ( x . i ( y , n ( i ( i ( z . i ( n ( n ( u ) ) ,u)) , n ( y ) ) ) ) ) , v ) . i ( w , v ) ) ) . Chypwr.1.37,60] P ( i ( i ( i ( x , i ( y , n ( i ( i ( z , i ( n ( n ( u ) ) , u ) ) , n ( y ) ) ) ) ) , v ) , v ) ) . Chyp«r,l,7,52] P ( l ( i ( x , y ) , i ( i ( i ( z , i ( n ( n ( u ) ) , u ) ) , n ( n ( x ) ) ) , y ) » . Diyp«r,1,53,53] P ( i ( i ( i ( x . i ( n ( n ( y > ) , y ) ) , n ( n ( i ( z . u ) ) ) ) , l ( l ( i ( v , l ( n ( n ( w ) ) , v ) > , n ( n ( z ) ) ) , u ) ) ) . [hyp«r,l,7,54] P ( i ( i ( i ( i ( i ( x , i ( n ( n ( y ) ) , y ) ) , n ( n ( z ) ) ) , u ) , v ) , i ( l < z , n ) , r ) ) ) . Chyp.r.1,55,7] P ( i ( i ( x , y ) , i ( i ( y , z ) , i ( x , z ) ) ) ) . Chypcr,6,57,47,38] $JWSVER(Luka, [1,2,3]) .
I now give an input file for proving LOGTl. Through appropriate modifica tion, one can use the file to study lattice ordered groups. The 32-step proof I give immediately after the file is obtained by assigning the heat parameter the value 1 (rather than 2) and by commenting out in the hot list the clauses for commutativity of union and of intersection and those for inverse. I then give McCune's 33-step proof of LOGTl. Input File for Studying LOGTl ••tOmuth.bondil). l«x([l,a,u(_,_),n<..._),«(_._).i(_),pp(_),npO]). usign(m*x_v*icht, 15). mssign(B&x_proof*, 36). u«lgn(Bax.B«s, 40000). uiign(pick_giv«n_r«tio, 6 ) . a»«lgn(h«»t, 2 ) . u«ign(r«port, 900). X s«t(r«ftlly_
X.
(x»y)«z - x» (y»z). l«x - x. x«l - x. i(x)»x - 1. x«i(x) - 1. i ( l ) - 1. iUCx)) - x. l(x«y) - i ( y ) « i ( x ) . n(x,x) - x. u(x,x) - x. o(x,y) - n ( y , x ) . u(x,y) • u ( y , x ) . n(x,n(y,z)) - n ( n ( x , y ) , z ) . u(x,u(y,z)) - u ( u ( x , y ) , z ) . •nd.of.liit. liit(»o»). u(n(x,y),y) - y. n(u(x,y),y) - y. x*u(y,z) ■ u(x«y,x*z). z*n(y,z) - n ( x » y , x » z ) . u(y,z)«x - u(y»x,z«x).
1510
Collected Works of Larry Wos
n(y,z)»x - n(y*x,z»x). pp(x) - u ( x , l ) . np(x) - n ( x , l ) . pp(»)«np(») ! - a. •nd_of_list. llst(passivs). pp(a)«np(a) !- a I $ANSWER(st*p.d33). i(q)*q*r !- r I $UI3UER(st*p.d01). u(n(q,r).q) I - q I tANSUHl(stsp_d02). u(q,n(r,q)) I- q I $ANSWER(«t*p.d03). n(u(q,r),q) !- q I *iHSUEK(st«p.d04). u(q,u(r,q)) !- u(r,q) I tANSWERdtap.dOS). u(q,n(q,r)) I- q I $ANSWER(st«p_d06). n(q,n(r,q)) !- n(r.q) I *AHSWER(»t«p.d07). u(q,u(q,r)) !- u(q,r) I »AJtSVER(«tap_d08). u(n(q,r),n(q,n(r,»))) !• n(q,r) I IAHSWER(.t.p.d09). u ( i ( u ( q , r ) ) * q , i ( u ( q , r ) ) * r ) !- 1 I «AHSWER(.t.p.dlO). n ( i ( n ( q , r ) ) « q , l ( n ( q . r ) ) « r ) I- 1 I lAMSWERdt.p.dll). n(u(x,x»x),u(x,l)) - x I *AMSWHl(stap_dl2). n(u(x.x*x),u(l,x)) - x I t*MSUn(st*p.dl3). u(l(tt(q,r))*q,l) ! - 1 I »AISVER(.t.p_dl4). u ( l ( u ( l . q ) ) , l ) !• 1 I ♦ANSWHK.t.p.dlB). u(l(u(q,r))»q»s,s) ' - * I UNSVHl(it.p_dl6). n ( l , l ( u ( l , q ) ) ) I- Ktt(l.q)) I «JKSVER(stsp_dl7) . n ( i ( n ( q , r ) ) * r , l ) !- 1 I UMSVERUt.p.dlS). n ( i ( n ( q , l ) ) , l ) !- 1 I *ANSVER(stap_dl9). u ( l , i ( n ( q , l ) ) ) I- Kn(q,l>) I «AHSKER(stap_d20). n ( u ( l , x ) , u ( x , x * x ) ) - x I *JUrSKER<«t«p_d21>. u ( a ( q , l ) , D ( q , i < u ( l , r ) ) ) ) !- n(q,l) I *ANSWER(st«p_d22). u ( i ( u ( q , r ) ) , i ( q ) ) I- i(q) I $ANSWER(stap_d23). u ( i ( u ( i ( q ) , r ) ) , q ) !- q I $ANSWER(stap.d24) . u ( i ( u ( q . l ( r ) » , r ) I- r I *ANSWER(.t.p.d25). u(q.i(u(r,i(q)>>) !- q I *AKSWER(«t.p.d26). n ( q , l ( u ( r , i ( q ) » ) !- i ( u ( r , t ( q ) ) ) I «ANSWER(stap_d27). u ( i ( q ) , i ( n ( q , r ) » !- l(n(q,r)) I *ANSVER(st«p_d28). u ( n ( q . l ) , i ( u < l , l ( q ) ) ) ) !- n(q,l) I $ANSWER(stap_d29). i ( n ( q , D ) !- u ( l , i ( q ) ) I $»NSVER<st«p_d30). n(u(q»r,r),u(r,l(q)*r)) !- r I $ANSVER(stap_d31). n(u(l,q).u(q.q«q>) !- q I *ANSVER(stap_d32). •nd.of.list. list(hot). X (x»y)»z - x« (y»z). n(x,y) - n(y,x). u(x,y) - u(y,x). Xn(n(x,y),z) - n(x,n(y,z)). % u(u(x,y),z) - u(x,u(y,z)). pp(x) - u ( x , l ) . np(x) • n ( x , l ) . i(x)*x - 1. x»i(x) - 1. u(n(x,y) ,y) - y. n(u(x,y) ,y) - y, x»u(y,z) - n ( x » y , x * z ) . x*n(y,z) ■ n(x*y,x*z). u(y,z)*x - u ( y * x , z » x ) . n(y,z)*x - n ( y » x , z » x ) . •nd.of.list.
A Quicker Proof of LOGT1 > UNIT CONFLICT »t 3148.67 sac > 23567 [binary,23565.1,86.1] $F. Length of proof is 32. Laval of proof is 13.
The Hot List Strategy
1511
PROOF
36 [] 37 [] 40 [] 41 [] 44,43 46,45 48,47 50,49 51 [] 64,53 56,55 63 0 64 □ 66,65 68,67 70,69 71 [] 74,73 76,75 78,77 82,81 84,83
u(n(x,y),y) - y. n(u(x,y),y) - y. u(y,z)«x - u(y«x,z«x). n(y,z)»x - n(y»x,z»x). [] (x«y)»z • x«y«z. [] l»x - x. [] x»l - x. [] i(x)«x - 1. x«i(x) - 1. [] 1(1) - 1. [] i ( i ( x ) ) - x. n(x.y) - n(y,x). u(x,y) - u(y,x). [] n(n(x,y),z) - n ( x , n ( y , z ) ) . [] u(u(x,y),z) - u(x,u(y,z>). [] u(n(x.y).y) - y. n(u(x,y),y) - y. [] x«u(y,z) - u ( x « y . x » z ) . [] x»n(y,z) - n(x«y,x»z). [] u(x,y)*z - u(x«z,y«z). [] pp(x) - u ( x , l ) . t] np(x) - n ( x , l ) .
85 [d«mod,82,84,76,78,46,48] n(u(a»a,a) ,u(», 1) ) !- a. 88 [para.into,69.1.1.1,63.1.1] u(n(x,y),x) « x. 94 (haat-1) tpara_into,88.1.1.1,37.1.1] u(x,u(y,x)) - u(y,x). 100 [para_froB,69.1.1,67.1.1.1] u(n(x,y),u(y,z)) - u ( y , z ) . 103,102 (haat-1) [para.into,100.1.1.1,37.1.1] u(x,u(x,y)) - u(x,y). 107 [para_into,71.1.1.1,64.1.1] n(u(x,y),x) - x. 111,110 [para_lnto,71.1.1,63.1.1] n(x,u(y,x)) - x. 123 [para_xroB,88.1.1,67.1.1.1] u(n(x,y),u(x,z)) - u(x,z). 141 [para_into,107.1.1,63.1.1] n(x,u(x,y)) - x. 152,151 [para_into.73.1.1,49.1.1] u(i(u(x,y))»x,i(u(x,y))»y) - 1. 154 (haat-1) [para_iroB,151.1.1,37.1.1.1] n ( l , l ( u ( x , y ) ) » y ) - i(u(x,y))»y. 307,306 [para_lrOB,123.1.1,141.1.1.2,daBod,66] n(x,n(y,u(x,z))) - n ( x , y ) . 818 [para_into,151.1.1.1.1.1,102.l.l.daaod,103,74,152] u ( i ( u ( x , y ) ) » x , l ) - 1. 833 (haat-1) [para_iroa,818.1.1,40.1.l.l.daaod,46,44,46] u(i(u(x,y))«x«z,z) - z. 866 [para_into,818.1.1.1,47.1.1] u ( i ( u ( l , x ) ) , 1 ) - 1. 931 [para_iron,866.1.1,306.1.1.2.2] n ( i ( u ( l , x ) ) , n ( y , l > ) - n ( i ( u ( l , x ) ) , y ) . 957 (haat-1) [para_xroa,931.1.1,36.1.1.1] u ( n ( i ( u ( l , x ) ) ,y) , n ( y , D ) - n ( y , l ) . 1413 [para.into,833.1.1.1.2,51.l.l.d.mod,48] u(l(u(x,y)) , i ( x ) ) - i d ) . 1416 [para_into,833.1.1.1.2,49.l.l.daaod,48] u ( i ( u ( i ( x ) , y ) ) , x ) - x. 1443 [para.into,1416.1.1.1.1,94.1.1] u ( i ( u ( x , i ( y ) ) ) , y ) - y. 1460 [para.into,1416.1.1,64.1.1] u ( x , i ( u ( i ( x ) , y ) ) ) - x. 1567 [para.iroa,1443.1.1,141.1.1.2] n ( i ( u ( x , l ( y ) ) > , y ) - i ( u ( x , l ( y ) ) ) . 1662,1661 [para_into,1413.1.1.1.1,88.1.1] u ( i ( x ) , i ( n ( x , y ) ) ) - i(n(x,y)>. 1684 [para.iroa,1413.1.1,141.1.1.2] n ( l ( u ( x , y ) ) , i ( x ) ) - i ( u ( x , y ) ) . 1705 ( h a a f 1) [para.into, 1684.1.1.1.1,36.1.1,daaod,70] n(l(x) , l ( n ( y , x ) } ) - i d ) . 1910 [para.into,1705.1.1.1,S3.1.1,damod,S4] n ( l , i ( n ( x , l ) ) ) - 1. 1933,1932 (haat-1) [para_froB,1910.1.1,36.1.1.1] u ( l , l ( n ( x , l ) ) ) - i ( n ( x , l ) > . 7237,7236 [para.into,957.1.1.1,1567.1.1] u ( i ( u ( l , i ( x ) ) ) , n ( x , 1 ) ) - n < x , l ) . 7252,7251 [para_froB,7236.1.1,1460.1.1.2.l.damod,68,1662,1933] i ( n ( i , D ) - u ( l , l ( x ) ) . 7302 [para.from,7236.1.1,lS4.1.1.2.1.1,daBod,7252,76,78,46,60,48,307,lll,7237,72S2,76,78,46 > S0,48] n ( u ( x , l ) , u ( l , i ( x ) ) ) - 1. 7338 (haat-1) [para.froB.7302.1.1,41.1.1.1,daaod,46,78,46,78,46] n(u(x«y,y),u(y,i(x)»y)) - y. 23565 [para.into,7338.1.1.2.2,61.l.l,d«B0d,56,56,56,56] n(u(x»x,x),u(x,l>) - x. 23567 [binary,23565.1,85.1] *F.
1512
Collected Works of Larry Wos
McCune's 33-Step Proof of L0GT1 > UNIT CONFLICT *t 19280.69 H C > 34171 [binary,34169.1,1674.1] 8F. Lanjta of proof i» 33. Laval of proof Is 10. PROOF 3,2 [] (x»y)«z - x»y»z. 5,4 [] l»x - x. 7,6 [] x«l - x. 8 CJ i(x)»x - 1. 10 □ x»l(x) - 1. 16,14 [] i(i(x)> - x. 20 t) u(x,x) - x. 22 C] n(x,y) - n ( y , x ) . 23 [) u(x,y) - u(y,x). 24 [) n(n(x,y),z) - n ( x , n ( y , z ) ) . 27,26 C] u ( u ( x , y ) , i ) - u ( x , u ( y , z ) ) . 28 0 u(n(x,y) ,y) - y. 30 (3 n(u(x,y) ,y) - y. 33,32 [] x«u(y,z) - u(x«y,x»z). 35,34 C] x*n(y,z) - n(x»y,x»z). 37,36 [] u(x,y)»z - u(x»z,y»z). 39,38 C] n(x,y)»z - n(x»z,y«z). 41,40 CJ pp(x) " u ( x , l ) . 43,42 [] np(x) - o ( x , l ) . 44 [d«Bod,41,43,35,37,6,7] n(u(a*a,&) ,u(a, 1)) !- a. 46,45 [para_xroa,8.1.1.2.1.1.1,d*nod,5] i(x)*x*y - y. 60 [para_into,28.1.1.1.22.1.1] u(n(x,y),x) - x. 62 [par*.into,28.1.1,23.1.1] u(x.n(y,x>) - x. 64 [para.into.30.1.1.1,23.1.1] n(u(x,y).x) - x. 70 [para.into,60.1.1.1,30.1.1] u(x,u(y,x)) - u ( y , x ) . 74 [para.lnto,60.1.1,23.1.1] u(x,n(x,y)) - x. 79,78 Cpara_frco,62.1.1.30.1.1.1] n(x,n(y,x)) - n ( y , x ) . 88,87 Cpara_into,26.1.1.1,20.1.1] u(x,u(x,y)) - u ( x , y ) . 107 [para_lnto,74.1.1.2,24.1.1] u ( n ( x , y ) , n ( x , n ( y , z ) » - n ( x , y ) . 120,119 Cpara.into,32.1.1,8.1.1] u(l(u(x,y))>x,l(u(x,y))«y) - 1. 134,133 tpara.lnto.34.1.1,8.1.1] n. 19584 [para.into,1783.1.1.2,2699.1.1] u ( n ( x , l ) , i ( u ( l , i ( x ) ) ) ) - n ( x , l ) . 19808 Cpara_froa, 19584.1.1,2567.1.1.2.l.draod,27,2649,1169] i ( n ( x , D ) - u ( l , l ( r ) ) . 20017 Cpara.froa,19808.1.1,45.1.1.1,daaod,39,6,3S,37,5,46,37,5] n(u(x»y,y) , u ( y . i ( x ) * y » - y. 34169 [para_lnto,20017.1.1.1.1,8.1.1,d«aod,15] n(u(l,x),u(x,x*x)> - x. 34171 [binary,34169.1,1674.1] $F.
The following input file can be used, with suitable modifications, to study Robbins algebra. It was used to prove VL47T5. The commented-out weight tern-
The Hot List Strategy
1513
plates illustrate, if comments are removed, how one can used the resonance strategy by keying on the positive proof steps from a related theorem. Input File for Studying Robbins Algebra sst(knuth_bandix). claar(aq_units_both_ways). sat(ind«x_for_back_deBOd) . sat (dynaBic_daatod_l8x_d8p). X aat(lax_rpo). sst(procaas.input). X sat (display.taraa). ast(input_soa_first). daar(print_kapt). claar(print_nav_daaod). clsar(print_back_daaod). assign(Bax_proofa, 2 ) . asaignCreport, 1800). assign(Bax_vsight, 30). assign(pick_givan_ratio, 3 ) . assign(Bax_aaa, 80000). X a»eign(haat,l). X assign(dyna«ic_haat_waight, 2 ) . assigsdax.diatinct.vars, 3). l a x ( [ a , b, c, d, «, f. g ( x ) , n(x), X lrpo_lr_status([*(x,x)]).
«-<x,x)]).
waight_list(pick_givan). X Following is hypothesis. X waight(EQC+(c,d),c),2). X Following ars positive staps from a 31-atap proof of +(c,c) " ct X tha union of c and c • c, aodifiad to not msntion constants. X wsight(EC.(n(f(n(+(x,y)) ,n(+(y.n(x))))),y),2). X waight(Eq(n(*(n(+(x,y)) ,n(f(n(y) ,x)))) ,x) .2). X waight(Eq(n(*(n(+(x,+(y,z))),n(*(z.n(+(x.y)))))).z).2). X waight(EQ(n<*(n(+(x,y)).n(-»(n(x),y)))),y).2). X waight(EQ(n(+(D(*(x,n(y)))>n(*(y,x)))),x),2). X walght(EQ(n(+(n(t(n(x),y)),n(t(y,x)))).y),2). X waight(EQ(n(*(n(*(x,t(y.z))),n(+(y,n(*(x,z))))))>y)>2). X waight(EQ(D(*(n(*(x,+(y,z))),n(+(x,n(*(z,y)))))),x),2). X waight<EQ(n(+(n(*(x,-»(y,z))),n(-Kn(+(x,z)).y)))).y),2). X walght(EQ(n(*(n(»(D) ,n(+($(l) ,n(«(l)))))) ,«(D) ,-2) . X walght(EQ(+(«U) ,♦(*■<» ,x)), HK1). x)),-l). X walght(EQ(n(*(t(l).n(*(n<«(l)),♦(«(!),n($(l))))))).n(«(l))).-3). X waight(EQ(n(*(n(+(*a),x)).n(+(n($(l)).+(x.n(*($(l),n($(l))))))))).x),-2). X waight(EQ(+(«(l),+<x,*(l))),♦(«(»,x)),-l). X waight(Eq(n(*(n(«. X waight(EQ(n(+(n(+(*(l),x)),n(+(n(t(l)),+(x,«(l)))))),+(x,»(l))),-2). X vaighUEQXICD.td. + W n . y ) ) ) . ♦ («(».♦(x.y))).-l). X waight(EQ<*(*U),n(-K$(l),n(*(l))))).$(l)),-2). X waight(EQ<+(t(l),+(x,n<+(*(l),n{*(l)))))),+(*(l).x)),-2). X w.ight(EQ(+(x,n(+($(l),n(*(l)))))(x),0). X wsight(EQ(+(n(*(»(l),n($(l)))),x),x),0). X walght(EQ(n(*(n(x),n(+($(l).«(x.n(*(l))))))),x)>0). X waight(EU(n(*(n(x),a(n(x)))),n(*(*(l),n($(l))))),0). X walght(EQ(n(*(x,n(x))),n(«<»(l),n($(l))))),0). X waight(EQ(n(n(+(x,n(n(x))))),x),2). X waight(EQ(n
Collected Works of Larry Wos
1514
«i^it(E<)<*(x,+(x.+(x>+(x,x))))l + (x,t(i>*(x,t(x>x)))))t 600). X Following Is for tall stratagy. vaight(Eq($a),»(2», 1), X Folloving 1* for discarding tripla s. vaight(n(n(nU))>, 500). •nd.of.list. list(usabla). EQ(x,x). EQ(*(x,y),*(y,x)). EQC*(+(x,y).x),+(x, + ( y . z » ) . •nd.of.list. list(sos). Eq(n(»(n(+(x.y)),n(*(x,n(y))))),x). X Robbins axiom EQ(*(c,d),e). X hypothasis -EQ(+(n(+(a.n(b))).n(+(n(a),n(b)))),b). X denial of Huntington axiom and.of.list. list(passiva). -EQ(+(x,x),x) I *ANS(stap.thm). -EQ(n(n(n(n(a)*b)+n> I $ANS(st«p.m03). -EQ((n(n(n(n(a)+b)+n(a+b)+a)+n(b*a))),«) I »ANS(st»p.m04). -EQ<(n(n. -EQ<(n(n(e*n(d«n(c>))*n(d+n(e))»,d) I $AHS(st«p_m08). -EQ((n(n(c+n(c*n(d+n(c))))«n(c4n(d«n(c))))),c) I SAHS(atap_B09). -EQ((n(d
X X X X X
list(daaodulators). EQ(*(x,y),+(y,x)). EQ(+(*(x,y).x),»(x.+(y.x))). EQ(n(*(n(*(x,y)).n(i-(x.n(y))))).x). and.of.list.
X X X X X X
list(hot). EQ(+(e,d),c). X nypothasls Eq(n(»(n(*(x,y)).n(+(x,n(y))))).x). EQ(+(x,y),+(y,x>). EQ(+(*(x,y),x),+(x.+(y,z))). and.of.list.
X Bobbins axiom
X Robbins axiom
In view of the historical significance of finding a proof of RAT§ without induction and without AC-unification, I include the following proof.
The Hot List Strategy
1515
A Historically Significant Proof of RATH > UNIT CONFLICT at 9770.64 Mc Laagth of proof i s 78.
> 48310 [biaary,48308.1,1.1] t/UfS<st«p_tttm) .
Laval of proof i s 16.
PROOF 1 [] -Eq(x*x,x) I *ANS(stsp_th«). 29,28 [] H}(x+y,y*x). 31,30 [] Eq((x+y)+z,x+y+z). 32 D EQ(n(n(x*y)tn(x-m(y))),x). 35,34 [] E q ( o d , c ) . 37 [para_iato,32.1.1.1.1.1,30.1.1,da«od,31] EQ(n(n(x*yfz)*n(x+y+n(z))),x+y). 39 [para.iato,32.1.1.1.1.1,28.1.1] Eq(n(n(x*y)+n(y+n(x))) ,y) . 41 [para_iBto,32.1.1.1.1,32.1.1] Eq(D(x+n(n(x*y)*n(n(x+n(y))))),n(x*y)). 43 [para.into,32.1.1.1.2.1.2,32.l.l.daaod,29] EQ(n(n(xty)*n(xtn(y*z)*n(y*n(z)))),x). 45 [para_iato,32.1.1.1.2.1,28.1.1] EQ(n(n(x+y)+n(n(y)*x)) ,x) . 52,51 [para_fro«,34.1.1,30.1.1.1] EQ(c*d*x,c+x). 61 [para.into,37.1.1.1.1.1.2,28.1.1] Eq(n(n(x+y+z)-m(x+z*n(y))),x+z). 63 [para.iato,37.1.1.1.1.1,28.l.l.daaod,31] EQ(n(n(x*y+z)+n(z+x+n(y))),z+x). 71 [para.from,37.1.1,32.1.1.1.2,daaod,29,31] BJ(n(x+y*n(n(x+y+z)+x+y+n(z))),n(x*y*z)). 75 [para.into,51.1.1.2,28.1.1] Eq(c*x+d,c+x). 79 Epsxa.froB.51.1.1,32.1.1.1.1.1] EQ(n(n(c»x)*n(c*n(d+x))),c). 81 [para.iato,75.1.1.2,30.1.1] Eq(ctxty+d,c+x*y). 90,89 [para.froa,75.1.1,30.1.l.l.daaod,31,31] EQ(cfx*d+y,c->x+y). 95 [para.into,39.1.1.1.1.1,34.1.1] EQ(n(n(c)+n(d+n(c))) ,d) . 97 [ p a r a . i a t o , 3 9 . 1 . 1 . 1 . 1 . 1 , 3 0 . 1 . 1 ] EQ(n(n(x+yfz)+n{z*n<x*y))) ,z) . 101 [para_into,39.1.1.1.1,39.1.1] EQ(n(x+n(n(x+n(y))+n(n(y+x)))),a(x+a(y))). 115 [para.into,39.1.1.1.2.1,28.1.1] EQ(n(n(xty)+n(n(x)*y)),y). 119 [para.iato.39.1.1.1,28.1.1] EO(n(n(x+n(y))+n(y+x)),x). 126,125 [para.froa,39.1.1,32.1.1.1.1] EQ(n(x*n(a(y+x)+n(aCx+n(y))))),n(y*x)). 131 [para.iato,41.1.1.1.2.1.1.1,28.1.1,das»d,126] EQ(a(x*y),n(y+x)). 166,165 [para_iato,131.1.1.1.30.1.1] Eq(a(x+y*z),a(z*x*y)). 173 [para_from,131.1.1,39.1.1.1.2.1.2,d»aod,31] EQ(n(n(x<-y+z)+a(z+n(y+x))),z). 195 [ p a r a . i a t o . 4 5 . 1 . 1 . 1 . 2 . 1 . 1 , 3 9 . 1 . 1 ] EQ(a(a(x*n(yH)+n(z+a(y)))-fn(z+x)) , x ) . 199 [para_iato,45.1.1.1.2,95.l.l.daaod,29,29] EQ(a(d+a(c»B(d+a(c)))) ,a(d*n(c))) . 203 [para_iato,45.1.1.1.2,45.l.l.daaod,166,29,29] EQ(n(x+n(y+x*a(n(y)»x))),n(n(y)*x)). 209 [para.iato,45.1.1.1,28.1.1] EQ(a(a(a(x)*y)*n(y*x)).y). 229 [ p a r a . i n t o , 4 3 . 1 . 1 . 1 . 1 , 9 S . l . l ] EQ(a(d*B(n(c)+a(n(d*n(c))*x)-Hi(n(d*n(c))*a(x)))),a(c)). 267 [para.into,115.1.1.1.1.1,30.1.1] EQ(n(n(x+y*z)+n(n(x*y)*z)),z). 325 [para_into,119.1.1.1.1.1,30.1.1] EQ(n(n(x+y+n(z))+a(z+x»y)),x*y). 329 [para_from,119.1.1,43.1.1.1.2.1.2.2,damod,166,29,29] EQ(n(n(x*n(y*n(r)))♦n(i+y+n(y*z ♦n(y«a(z))))).x). 361 [para_into,209.1.1.1.2.1,30.1.1] EQ(n(a(a(x)*y+z)*n(y*z+x)),y*z). 411 [ p a r a . i a t o . 7 9 . 1 . 1 . 1 . 1 . 1 , 2 8 . 1 . 1 ] EQ(n(n(x+c)*a(c«i(d*x))),c). 651 [para_iBto,411.1.1.1,28.1.1] EQ(n(n(c*n(d*x))+n(x+c)),e). 739 [para.into,81.1.1.2,28.1.1,daaod,31,90] EQ(c«x+y,c+y*x). 755 [para_lato,739.1.1.2,739.l.l.daaod,29] EQ(ctc*x«y,c*c*y+x). 862,861 [para_from,61.1.1,32.l.l.l.2,damod,29,31] Eq(a(x*y+n(a(x*z+y)+x*y+n(z))),n(x*z+y)). 889 [para_iBto,97.1.1.1.1.1.2.78.1.1,d«mod,31] EQ(a(n(x*c*y)tn(y*d*a(x*c))),y+d). 903 [para_iato,97.1.1.1.1.1,28.1.1,damod,31] Bq(n(a(x*y»z)«i(y+B(z+x))),y). 1000,999 [para.lnto,63.1.1.1.1.1.2,739.l.l.danod,31,31] EQ(o(a(x+e+y+z)+n(z+y+x4n(e))),z+y+x). 1047 [para.into,63.1.1.1,28.1.1] EQ(n(n(x+y+n(z))+a(y*z+x)),x+y) . 1829 [para.into,71.1.1.1.2.2.1.1.1.2,28.l.l.danod,862] EQ(a(x+y+z),a<x+z+y)). 1997 [para_into,173.1.1.1.2.1.2.1,75.1.1.damod,31] EQ(a(n(x+d+c*y)«n(y+a(c*x))),y). 2087,2086 [para.from,173.1.1,119.1.1.1.2,damod,29] EQ(n(x+a(n(x+n(y*z))ta(n(z*y+x)))), n(x*n(y+z))). 2410 [para.into,267.1.1.1.1.1.2,28.1.1] EQ(n(n(xtyfz)-fn(n(xtz)+y)),y). 2416 [para.iato,267.1.1.1.1.1,28.1.1,damod,31] EQ(a(B(x+y*z)*a(n(z*x)+y)),y). 3178 [para.iato,903.1.1.1.2.1.2.1,51.l.l.daaod,31] HKa(a(d+x+y+c)+a(y+a(c*x))),y). 3294 [para_iBto,101.1.1.1.2.1.1.1.2,131.1.1.damod,31,2087] EQ(n(x*n(y+z)),n(x*a(z+y))). 4032 [para.iato,2410.1.1.1.2.1.1,32.l.l.daood,29] EQ(n(n(i*y)*n(n(x-»z)*y+n(x*n(z)))),y). 4064 [para.iato,2416.1.1.1.2.1.1.1,75.1.1,damod,31] EQ(a(B(x+d*y*c)+B(a(c+x)+y)),y). 4887,4886 [para.into,165.1.1.1.2,28.1.1] Eq(a(x*y*z),a(y+xtz)).
Collected Works of Larry Wos
1516
5674 Cpar«_lnto, 1829.1.1.1,28. l . l . d u o d , 3 1 ] H}(n(x+y+z) ,n(z+y+x)). 7392 [para_lnto,1997.1.1.1.2.1.2.1,34.1.1] EQ(n(n(d+d*c*x)*n(xtn(c))),x). 7662 tp«ra_into,7392.1.1.1.1.1.2.2,28.1.1] EQ(n(n(d+d*x+c)+n(xtn(c))) , x ) . 7710 Cp*»_lnto,7562.1.1.1,28.1.1] H},x). 9589,9688 [par«_into, 1 9 6 . 1 . 1 . 1 . 2 . 1 , 3 4 . l . l . d u o d , 2 9 ] Eq(n(n(c)+n(d+n(x+c)+n(c+n(x>))) , d ) . 9834 [paxi_iDto,4064.1.1.1.1.1.28. l . l . d u o d , 3 1 . 3 1 ] EQ(n(n(d+x+c+y) + n(a(c+y) + x)),x). 9998 [p«ra_xroB,199.1.1,3178.1.1.1.2,daaod,29,35,29,4887,52,29] EQ(n(n(d-m(c))+n(c+n(d*n(c)))),d). 10020 tpara.xroa,199.1.1,6S1.1.1.1.1.1.2,duod,29] EQ(n(n(c+n(d+n(c)))-fn(c+n(c*n(d*n{e))))),c). 10049,10048 [p»r»_froB,9998.1.1,2416.1.1.1.2,donod,29,4887,29] Eq(n(d+n(d«n(c)*n(c+n(d*n(c))))), n(c+n(d*n(e)))). 12883,12882 [p»r»_into,229.1.1.1.2.1.2.2,7710. l.l.duod,29,36,29,36,29,35,29,29,4887,10049] EQ(n(c*n.n(c)). 12889,12888 [b»e]t_duod, 10020. d u o d , 12883,12883] EQ(n(n(e)+n(c+n(c))) , e ) . 12954 [ p a r a . i r u . 12888.1.1,203.1.1.1.2.1.2.2,duod,29,12889] EQ(n(n(c+n(c))*n(c*c+n(c+n(c)))) , c ) . 16947,16946 Cp»riL_fro«, 12954.1.1,9834.1.1.1.2,duod,29,31,4887,62,29] E)(n(c+n(c+n(c)+ n(c+c*n(c+n(c) )) )) ,n(c-»c+n(e+n(c)) ) ) . 19738 [pura.into,325.1.1.1.1.6674.1.1] EQ
Next, for those interested in equivalential calculus, I give two short proofs. The first is the shortest of which I know that the formula XHN implies the formula UM, and the second is the shortest of which I know that the formula XHK implies the formula YQL. A Short Proof for XHN Implies UM > UIIT CONFLICT mt Length of proof la 19.
0.30 HC
> 38 Cbinary,37.1,6.1] UXSVBUM.UM).
Loral of proof i s 14.
PROOF
1 □ -P(o(x,y)> I -P(l) I P(y). 2 (] PCa(x.a(a,a(a(y,a(z.a,a(a(v,x),u))»,x»>. 19 [hyper,1,18,18] P(.{«(.(«(x,«(y,«(.<x.«),«{. , « < « ( T 7 , V ) , V 8 ) » > , . ( » , X ) » . 20 Chypor,1,18,2] PC«(.(«(«(x.y).»(.(y.i),x)),.(u,.(.(y,»),.(.(»,u),v>))),i)). 21 [hyper. 1,19,20] P(.(e(x,e(e(y,x),e(e(x.x),y))),e(e(eC»,T),.(e(»,e(y.e(v6,e(e(v7,v8), O(.(T«,T«),»7)»»,«)).W))).
22 [hyper, 1,18,20] P(«(.(x.«(y.«(.(x,u),.(.(u,y).x)))),.(.(.(v.v),«(.(y,i),»)),.(v€,.(«(»7,»8). O(O(T«,»«>,T7)»»).
23 [hyper,1.21.2) P(e(.(.(x,y),e(e(y,e(x..(,x)),e<e(e(tt.»),e(e,»».w)),i». 26 (hyper,1,20.28] P(e(e(x,o(o(x.y),e(z,e(e(tt,T>,o(e(T,z),tl))))),e(y,o(v,o(e(T6,T7),e(o(v7,v),v6)))))).
The Hot List Strategy
1517
27 [hyp«r,l,26,22] P ( « ( « ( « < « ( x . « ( « ( y , z ) , « ( « ( z , x ) , y ) ) ) , u ) , u ) , « ( y . « ( « ( w , y 6 ) , « < a ( y 6 , y ) , w ) ) ) ) ) . 28 [hypar,1,22,27] P ( « ( a < « ( x , y ) . « < « ( y , a ( a ( a ( z . « ( « ( u , v ) , a < « ( y , z ) , u » ) ,v) , » ) > , x ) ) , • (v6,a<«,»(a»». 30 tb.ypar.1,20,28] P,y))),u),u)). 31 [hyp»r,1,19,28] P ( . ( . ( . ( . ( X , . ( . ( T , X ) , . ( . ( i , x ) , y ) ) ) , . ( . ( . ( u , . ( . ( v , w ) . •(•(w,u),v))),v6),v6)),yT),»7)). 32 [hypar,1,26,30] P(a(a(a(a(x.y),z).a(y.a(u,a(a(y,ir) ,«(a(v,u) , y ) ) ) ) ) , a ( z , x ) ) ) . 33 [hypar,l,30,31] P ( a ( a ( x , y ) , a ( a ( y , a ( « ( z , a ( a ( u , v ) . • ( • ( v , z ) , u ) » . • ( • ( • ( W , « ( « ( T 6 , V 7 ) , • (•(v7.v),v6))),v8).v8)»,x))). 34 [hypar.1,20,32] P ( a ( a ( x , a ( a ( y , z ) , a ( a ( z . a ( u , x ) ) , y ) ) ) , u ) ) . 38 [hypar,1,32.33] P ( a ( a ( a ( a ( a ( x , a ( a ( y . z > , a ( a ( z , x ) , y ) ) ) , u ) , u ) , v ) , a ( a ( v , v 6 ) , a ( a ( y 6 , v ) , v ) ) ) ) . 36 [hypar,1.32,35] P ( a ( x , a ( a ( y , a ( a ( z . u ) , a ( a ( u , y ) , z ) ) ) , a ( a ( a ( v , v ) , • ( • ( « , a ( v 6 , x ) ) , v ) ) , v 6 ) ) ) ) . 37 [hypar, 1,34.36] P ( a ( a ( a ( x , y ) , z ) , a ( y . a ( z , x ) ) ) ) . 38 [binary,37.1,6.1] $ANSVER(P4_UM).
A Short Proof for XHK Implies YQL > UWT C0KFL1CT at 380.90 w
> 4789 [binary, 4788.1,3.1] 8AMSUEll(Pt_YQL> .
Langth of proof i i 23. Laval of proof i s 19. PK00F 1 U -P(a(z,y)) I -P(z) I P(y). 2 [] P(a(z.a(a(y,z),a(a(z,z).y)))>. 3 Cl - P ( a ( a ( a . b ) . a ( a ( c . b ) , a < a , e ) ) ) ) | lAMSVERCPl.YQL). 16 C] -P(a(z,y)) I -P(z) I PCjr). 17 [J P,y>)». 18 [hypar. 1,2,2] P ( a ( a ( * , y > . a ( a ( a ( z . a ( a ( u . y > , a ( a ( z . y ) , u ) ) ) . y ) , x ) ) ) . 19 (haat-1) ttyp.r.16,17,18) P(a(a(z.y),a(a(a(a(z.u).a(a(a(y,a(a(v.y6),a(a(v,v6),v)>),u),z)>,y) , z ) ) ) . 20 (haat-1) [hypar.16,18,17] P ( a ( a ( a ( z . a ( a ( y , z ) , a ( a ( x . z ) , y ) ) ) , a ( a ( u , y ) , a ( a ( w , y > , u ) ) ) , v ) ) . 21 [hypar,1,18,18] P(a(a(a(z.a(a(y,z) , . ( . ( z , z ) . y ) ) ) , a ( a ( a ( u , a < a ( y . v ) , a ( a ( u , y ) , v ) ) ) , v 6 ) ,»7)) , . ( y 7 , v 6 ) ) ) . 27 [hypar, 1,19,18] P ( a ( a ( a ( a ( z , y ) , a ( a ( a ( z , a ( a ( u , y ) , . ( . ( z , y ) , u ) ) ) , y ) , z ) ) , a ( a ( a ( v , a ( a ( y 6 , y 7 ) . a(a(v,y7).y6))),y8),y9)),a(y9,y8))). 35 (haat-1) [hypar,16,27,17) P ( a ( a ( a ( a ( a ( x , y ) . a ( a C a ( z , a ( a ( u , y ) , . ( . ( z . y ) , u ) ) ) , y ) , z ) ) , w ) , a(v6,a(a(y7,y8),a(a(y6.y8),y7)))).w)). 47 [hypar,1,21,20] P ( a ( a ( a ( x . y ) , a ( a ( a ( a ( z , a ( a ( u , y ) , a ( a ( z . y ) . u ) ) ) , v ) , y ) . » ) ) , » ) ) . 58 [hypar,1,35,47] P ( a ( a ( a ( a ( x , a ( a ( y , z ) , a ( a ( z , z ) , y ) ) ) , a ( u , a ( a ( v , v ) , a ( a ( u , v ) , y ) ) ) ) , a ( a ( a ( v 6 , a ( a ( y 7 , y 8 ) , a(a(y6.y8),v7))),v9),vl0)),a(yl0,y9>)). 77 [hypar,1.S8.21) P ( a ( z , a ( a ( a ( a ( y , a ( a ( z . u ) . a ( a ( y , u ) , z ) ) ) , z ) , a ( a ( y , w ) , a ( a ( y 6 . v ) , v ) ) ) , v 6 ) ) ) . 81 [hypar, 1,77.47] P ( a C a ( a ( a ( x , a ( a ( y , z ) , a ( a ( z , z ) , y ) ) ) , a ( a ( a ( u , y ) , a ( a ( a ( a ( w , a ( a ( y 6 , v 7 ) , a(a(v,v7).y6))),y8),y).u)).y8)),a(a(v9,yl0),a(a(yll,yl0),v9))),yll)). 91 D>ypar,1,20,81] P ( . ( . ( . ( x , y ) , a ( a ( z , a ( a ( u . y ) , a ( a ( z , y ) , » ) ) ) , x ) ) , y ) ) . 93 [hypar,1,77,91] P ( a C a ( a ( a ( x , a ( a ( y , z ) , . ( . ( x , z ) , y ) ) ) . . ( . ( . ( u . y ) , . ( . ( v . . ( . ( v 6 . v 7 ) , a(a(w,v7),y6))),u)),v)).a(a(y8,y9),a(a(yl0,y9),y8))),vl0)). 97 [hypar.1,91.47] P ( a ( a ( a ( a ( x , a ( a ( y , z ) , a ( a ( x , z ) , y ) ) ) , a ( a ( u , a ( a ( v , v ) , a ( a ( u , v ) , v ) ) ) , a ( v 6 , v 7 ) ) ) , v 7 ) , v 6 ) ) . 121 [hypar,1,20,93] P ( a ( a ( a ( z , a ( a ( y , z ) , a ( a ( u , z ) , y ) ) ) . u ) , z ) ) . 133 [hypar,1,121,121] P(a(x,a(a(y.z),a(a(a(a( , a ( a ( a ( a ( v , y 6 ) , a ( a ( y 7 , v 6 ) , v ) ) , v ) ,u))) , y 7 ) ) . 177 [hypar,1,97,154] P ( a ( a ( a ( x , y ) , a ( a ( z , y ) , z ) ) , a ( a ( u , y ) , a ( a ( z , y ) , u ) ) ) ) . 181 [hypar,1,121,177] P ( a ( a ( a ( a ( a ( z , y ) , a ( a ( z , y ) , z ) ) , u ) , z ) , u ) ) . 197 [hypar,1,121,181] P ( a ( a ( a ( z , y ) , a ( a ( a ( a ( z . u ) , a ( a ( y , u ) , z > ) , y ) , z ) ) , v » . 219 [hypar, 1,181,197] P ( a ( a ( a ( a ( z , y ) , a ( a ( z . y ) , x ) ) , a ( a ( z , u ) , v ) ) , a ( y , u ) ) ) . 240 [hypar, 1,18,219] Pta(a(a(z.a(a(y,2) , a ( a ( z , z ) , y ) ) ) ,a(u,v)) ,a(a(a(v,y6) , a ( a ( y 7 , v 6 ) , » ) ) ,a(a(v7,v) , u ) ) ) ) . 4776 [hypar, 1,219,240] P ( a ( a ( a ( z , y ) , a ( a ( j , u ) , a ( a ( y , v ) ,a(a(y,v> , v ) ) ) ) , a ( y ( x , u ) , z ) ) ) , 4788 (haat-1) [hypar, 16,4776,17] P ( a ( a ( z , y ) . a ( a ( z . y ) ,aCz,z)))) . 4789 [btnary.4788.1,3.1] *»)iSVE».(Pl_YQL).
To close this article, I give the shortest proof of which I know for LOGTZ.
A Short Proof of LOGT2 > UNIT CONFLICT at 3566.71 sac
> 19786 [binary, 19784.1,1.1] *ANSWER(step_thn).
Collected WorJcs of Larry Wos
1518
Lanfth of proof la 22.
Laval of proof i t 10.
PROOF I [] i(n(«,b)> •- u(i(a).l(b))l*ANSWER(atap_tha). 4 [] i(x)*x - 1. 5 [] x»i(x) - 1. 10 □ u(n(x,y),y) - y. II [] n(u(x,y),y) - y. 13 [] x«y«z - (x«y)«z. 16,14 [copy,13,flip.1] (x«y)»z - x»y»z. 17,18 □ l»x - x. 19,18 [] x*l - x. 20 [] l(x)»x - 1. 34 □ n(x.y) - n(y,x). 35 [] u(x.y) - u(y,x). 39 [] u(x,u(y,z)) - u ( u ( x , y ) , z ) . 40 [copy,39,flip. 1] u(u(x.y),z) - u ( x , u ( y , z ) ) . 46 □ u(n(x,y),y) - y. 61,60 □ x*u(y,z) - u(x»y,x»z). 64 O u(x,y)»z - u(x»z.y»x). 61 □ n(x.u(y,z)) - u(o(x,y) , n ( x , z ) ) . 66 [para_into,46.1.1.1,34.1.1] u(n(x,y),x) - x. 70,69 (b.aat-1) [ p a r a _ l n t o , 6 6 . 1 . 1 . 1 , l l . l . l ] u(x,u(y,x)) - u ( y , x ) . 73 [para_fro»,46.1.1,40.1.1.1.flip.1] u(a(x,y) , u ( y , z ) ) - u ( y , z ) . 76,76 (haat-1) Cpara_lnto,73.1.1.1,ll.l.l] u(x,u(x,y)) - u(x,y). 151,160 Cpara_into,50.1.1,20.1.1,flip.l] u(i(u(x,y))«x,i(u<x,y))«y) - 1. 164 [para.into,150. 1.1.1.1.1,75.l.l.danod,76,51,151] u(i(u(x,y))*x,1) - 1. 166 [para_into,lS0.1.1.1.1.1.69.1.1,daBOd,70,51,161] u ( i ( u ( x , y ) ) * y , l ) - 1. 342 [para_ijito,64.1.1.1,166.1.1,daaod,17,16,17,Uip.l] u(i(u(x,y))»y*z,z) - z. 344 [par*.into,64.1.1.1,164.1.1,daaod,17,16,17,flip.l] u(l(u(x,y))*x*z,z) - z . 364 (haat-1) [para_into.342.1.1.1.2,4.l.l.damod,19] u ( i ( u ( x , i ( y ) ) ) , y > - y. 366 (haat-1) [para.lnto,344.1.1.1.2,6.1.1,daaod,19] u(i(u(x,y)) , i ( x ) ) - i ( x ) . 371,370 (haat-2) [ p a r a _ i n t o , 3 5 6 . l . l . l . l , 1 0 . 1 . 1 ] u ( l ( x ) , i ( n ( y , x ) ) ) - i ( n ( y , x ) ) . 514 [para.into.344.1.1.35.1.1] u(x,i(u(y,z))*y*x) - x. 518 ( h . » t - l ) [para_into,514.1.1.2.2,4.1.1,daa>od,19] u ( x , l ( u ( l ( x ) , y ) ) ) - x. 526 (haat-2) [para_fro»,518.1.1,11.1.1.1] n ( x , i ( u ( i ( x ) , y ) ) ) - i ( u ( l ( x ) , y ) > . 599,598 [para.into.356.1.1.1.1,65.1.1] u ( i ( x ) , l ( n ( x , y ) ) ) • i ( n ( x , y ) ) . 1009 [para_fro»,354.1.1,61.1.1.2,flip.l] u ( n ( x , i ( u ( y , i ( z ) ) ) ) , n ( x , x ) ) - n ( x . z ) . 1033 [para.into,518.1.1,40.1.1] u ( x , u ( y , l ( u ( i ( u ( x , y » , z ) ) ) ) - u ( x , y ) . 13284 [para_into,1009.1.1.1,626.1.1] u(i(u(l(x),i(y))),n(x,y)) -n(x,y). 19784 [para_froa,13284.1.1,1033.1.1.2.2.1,daaod,371,599] Kn(x.y)) - u(i(x) ,i(y)). 19786 [binary, 19784.1,1.1] tANSWER(atap_tha) .
References
[1] Boyer, R., and Moore, J, A Computational Logic. New York: Academic Press, 1979. [2] Boyer, R. S., and Moore, J S., A Computational Logic Handbook, 2nd edn., New York: Academic Press, 1998 (also Web information ftp://ftp.cs.utexas.edu/pub/boyer/nqthm/index.html). [3] Henkin, L., Monk, J., and Tarski, A., Cylindric Algebras, Part I, NorthHolland, Amsterdam, 1971.
The Hot List Strategy
1519
[4] Kalman, J., "A shortest single axiom for the classical equivalential calculus", Notre Dame J. Formal Logic 19 (1978) 141-144. [5] Kalman, J., "Condensed detachment as a rule of inference", Studia Logica 42 (1983) 443-451. [6] Lusk, E., and Overbeek, R., The Automated Reasoning System ITP, Tech nical Report ANL-84-27, Argonne National Laboratory, Argonne, IL, 1984. [7] McCune, W., OTTER 2.0 Users Guide, Technical Report ANL-90/9, Ar gonne National Laboratory, Argonne, IL, 1990. [8] McCune, W., OTTER 3.0 Reference Manual and Guide, Technical Report ANL-94/6, Argonne National Laboratory, Argonne, IL, 1994. [9] McCune, W., "Solution of the Robbins problem", J. Automated Reasoning, accepted for publication, 1997. [10] Meredith, C. A., "Single axioms for the systems (C,N), (C,0), and (A,N) of the two-valued propositional calculus", J. Computing Systems 1 (1953) 155-164. [11] Veroff, R., and Wos, L., "The linked inference principle, I: The formal treatment", J. Automated Reasoning 8(2) (1992) 213-274. [12] Winker, S., "Robbins algebra: Conditions that make a near-Boolean algebra Boolean", J. Automated Reasoning 6(4) (1990) 465-489. [13] Winker, S., "Absorption and idempotency criteria for a problem in nearBoolean algebras", J. Algebra 153(1) (1992) 414-423. [14] Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., "Questions concerning possible shortest single axioms in equivalential calculus: An ap plication of automated theorem proving to infinite domains", Notre Dame J. Formal Logic 24 (1983) 205-223. [15] Wos, L., Winker, S., Veroff, R., Smith, B., and Henschen, L., "A new use of an automated reasoning assistant: Open questions in equivalential calculus and the study of infinite domains", Artificial Intelligence 22 (1984) 303-356. [16] Wos, L., Veroff, R., Smith, B., and McCune, W., "The linked inference principle, II: The user's viewpoint", in R. E. Shostak (ed.), Lecture Notes in Computer Science, Vol. 170, Springer-Verlag, New York, 1984, pp. 316-332. [17] Wos, L., Automated Reasoning: 33 Basic Research Problems, Prentice-Hall, Englewood Cliffs, NJ: 1987. [18] Wos, L., Overbeek, R., Lusk, E., and Boyle, J. Automated Reasoning: In troduction and Applications, 2nd edn., McGraw-Hill, New York, 1992. [19] Wos, L., "The resonance strategy", Computers and Mathematics with Ap plications (special issue on automated reasoning) 29(2) (1995) 133-178. [20] Wos, L., "Searching for circles of pure proofs", J. Automated Reasoning 15(3) (1995) 279-315.
1520
Collected Works of Larry Wos
[21] Wos, L., The Automation of Reasoning: An Experimenter's Note book with OTTER Tutorial, Academic Press: New York, 1996 (see http://www.mcs.anl.gov/people/wos/index.html for input files and infor mation on shorter proofs). [22] Wos, L., "OTTER and the Moufang identity problem", J. Automated Rea soning 17(2) (1996) 215-257. [23] Wos, L., "The power of combining resonance with heat", J. Automated Reasoning 17(2) (1996) 23-81. [24] Wos, L., "Automating the search for elegant proofs", J. Automated Rea soning, accepted for publication, 1997. [25] Wos, L., "Experiments concerning the automated search for elegant proofs", Technical Memorandum ANL/MCS-TM-221, Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL, 1997. [26] Wos, L., "Experiments with the hot list strategy", Technical Memorandum ANL/MCS-TM-232, Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL, 1997.
OTTER and the Moufang Identity Problem LARRY WOS* Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL 60439-4844} U.S.A. e-mail: [email protected] (Received: 26 September 1995) Abstract. This article provides additional evidence of the value of using an automated reasoning program as a research assistant. Featured is the use of Bill McCune's program OTTER to find proofs of theorems taken from the study of Moufang loops, but not just any proofs. Specifically, the proofs satisfy the prop erty of purity. In particular, when given, say, four equivalent identities (which is the case in this article), one is asked to prove the second identity from the first, the third from the second, the fourth from the third, and the first from the fourth. If the proof that 1 implies 2 does not rely on 3 or 4, then by definition the proof is pure with respect to 3 and 4, or simply the proof is pure. If for the four identities one finds four pure proofs showing that 1 implies 2, 2 implies 3, 3 implies 4, and 4 implies 1, then by definition one has found a circle of pure proofs. By finding the needed twelve pure proofs, this article shows that there does exist a circle of pure proofs for the four equivalent identities for Moufang loops and for all orderings of the identities; however, for much of this article, the emphasis is on the first three identities. In addition—in part to promote the use of automated reasoning programs and to answer questions concerning the choice of options—featured here is the methodology that was employed and a discussion of some of the obstacles, some of which are subtle. The approach relies on paramodulation (which generalizes equality substitution), on demod ulation, and—so crucial for attacking deep questions and hard problems—on various strategies, most important of which are the hot list strategy, the set of support strategy, and McCune's ratio strategy. To permit verification of the re sults presented here, extension of them, and application of the methodology to other unrelated fields, a sample input file and four proofs (relevant to a circle of pure proofs for the four identities) are included. Research topics and challenges are offered at the close of this article. Key words: automated reasoning, OTTER, Moufang loops, circle of pure proofs. 'This work was supported by the Mathematical, Information, and Computational Sciences Division subprogram of the Office of Computational and Technology Research, U.S. Depart ment of Energy, under Contract W-31-109-Eng-38. Reprinted from the Journal of Automated Reasoning, Vol. 17, 215-257, 1996, with kind permission from Kluwer Academic Publishers.
Collected Works of Larry Wos
1522
1
The Problem, the History, and the Objectives
Automated reasoning programs are now (in 1995) used to answer open questions and prove interesting theorems from a wide variety of disciplines; see [12, 13, 18, 19]. Two programs that have proved most useful in this context and that are readily available to researchers are Bill McCune's OTTER [10] and Robert Boyer and J Moore's Nqthm [1]. The fields in which successes have occurred include universal algebra, algebraic geometry, logic calculi, program verification, and chip design. At least in mathematics and in logic—with added insight regarding the use of OTTER—far more is within reach. One of the objectives of this article is to add to that needed insight by il lustrating various features of OTTER; see the sample input file and four proofs given in the Appendix. In that context, some light will be shed on making wise choices from among the numerous options offered by McCune's program. By ex ploring some of OTTER's options, this article will acquaint the researcher with various techniques for using this program as an assistant. Additional knowledge and understanding regarding OTTER and, more generally, regarding automated reasoning can be gleaned from consulting three books [17, 15, 23]. The first of the three books provides a thorough introduction to automated reasoning and, therefore, serves well for learning more about various inference rules, strategies, and procedures cited in this article, for example, pwramodulotion, the set of sup port strategy, and demodulation. The second book offers research problems in automated reasoning, and its fourth chapter provides a rather extensive review of the field. The third book (to be published shortly) contains a diskette of OT TER, demonstrates in detail how research in various fields was conducted with this program, and (in Chapter 8) gives guidelines for option choosing. This article has for a second objective the demonstration of the usefulness of OTTER to answer questions that have remained unanswered for many years; see the cited history given shortly. Such demonstrations may encourage researchers totally unfamiliar with automated reasoning to experiment with a reasoning program. The final and most pressing objective is to present the specific problem under study, the methodology for attacking the problem, and the resulting successes. With the objectives stated, next in order is the promised history. In the mid-1960s, I first heard (from Wayne Cowell, a colleague at Argonne National Laboratory) about Moufang loops [11], formally defined in Section 2. Informally, a Moufang loop is an algebraic structure in which multiplication is the operation; however, one's usual intuition is interfered with because certain expected laws do not hold. Indeed, reasoning about such structures is made more difficult because associativity is replaced by an identity of the following type, where multiplication is the implicit operator. Axiom, Moufang 1: (xy)(zx) = (x(yz))x
OTTER and the Moufang Identity Problem
1523
1 was informed that, in the presence of the axioms for a loop (given in Section 2), Moufang 1 is equivalent to Moufang 2, which is in turn equivalent to Moufang 3. Axiom, Moufang 2: ((xy)z)y = x{y(zy)) Axiom, Moufang 3: x(y(xz)) = ((xy)x)z Such in fact is the case. (A fourth equivalent Moufang identity, given later in this section, will also be of concern in this article; the fourth Moufang identity is the mirror image of the first Moufang identity with the lefthand and righthand arguments interchanged, and the third identity is the mirror image of the second.) When presented with n equivalent identities (such as the three Moufang identities just given), properties, or definitions, mathematicians and logicians sometimes seek an aesthetic property that can be termed purity of proof [22]. Intuitively (with the formal definitions given in Section 2), purity asks for n proofs showing that identity 1 implies 2, 2 implies 3, ..., identity n implies iden tity 1 such that, other than the hypothesis and conclusion, no identity among the n is present in a proof. For the (first) three Moufang identities, three proofs would be required. However, such was not available. Instead, the proof of the equivalence of the (first) three identities first showed that 1 implies 2, next that 2 implies 3, then—and here is the so-called flaw in the context of purity—that 3 implies 2, and finally that 2 implies 1. (To be faithful to the proof given by Bruck [2], I note that he proves Moufang 1 if and only if Moufang 2, then Mo ufang 2 if and only if Moufang 3; hence, purity is absent. See also [3].) In other words, the proof consisted of four, rather than three, subproofs. To show how the implied open question was answered—that focusing on the possible existence of three pure proofs for the equivalence of the (first) three Moufang identities—is central to this article. Without access to OTTER, such proofs might have remained out of reach. Indeed, although I made some effort in the mid-1960s to use an automated reasoning program to study Moufang loops, too little power was at that time offered by such programs. Clearly, as one learns here, the situation has changed, in part because of the significant advances in the design of such programs—OTTER is a fine example— and in part because of the formulation of powerful strategies. Of the strategies that did not exist in the mid-1960s, the ones that play the more important role in this article are McCune's ratio strategy [10, 23] and the hot list strategy [20, 22, 23]. Both for the ordering 1, 2, 3 (of the Moufang identities) and the ordering 1, 3, 2, this article heavily emphasizes showing how the needed proofs were obtained. However, after learning of the fourth Moufang identity (given almost immediately), I tested the methodology (featured here) by successfully applying it to finding the needed twelve pure proofs, the twelve pure proofs that show that all orderings of the four Moufang identities admit a circle of pure
Collected Works of Larry Wos
1524 proofs;
Section 8.
Axiom, Moufang 4: x((yz)x) = (xy){zx). (Only a historical accident caused the emphasis to be placed on the first three identities.) Before turning to the formal elements of this article, one might wish the answers to three questions. How does the methodology used here relate to that used in the study of pure proofs for the thirteen shortest single axioms for equivalential calculus [22]? Why are Moufang loops of interest? What makes the property of purity significant? Regarding the first question, in [22], the object is to produce (if possible) a circle of pure proofs for some ordering of all thirteen shortest single axioms for equivalential calculus. Where that area of logic is not concerned with equality, the study of Moufang loops is, thus introducing various complications in that the use of demodulation is virtually required; see Section 3. Naturally, therefore, a different inference rule was used; instead of hyperresolution, paramodulation (which generalizes equality substitution) was used. Regarding strategy, the set of support strategy played a key role here, the hot list strategy and the ratio strategy played a key role here and in the study of equivalential calculus, but level saturation and the dynamic hot list strategy were not used here. For this study of Moufang loops, the methodology did not rely on a phase designed to see how many of the sought-after conclusions could be deduced given an equation as hypothesis. Such a phase was included in the equivalential-calculus study because many possible orderings of the thirteen shortest axioms exist and the idea was to partially determine which were more likely to succeed in yielding a circle of pure proofs. As for the second question (for whose answer I thank Ken Kunen), Moufang loops are of interest in part because of their relation to group theory, which itself is of substantial interest to mathematicians and physicists. For example, every subloop generated by two elements is in fact a group. For a second example, every subloop generated by three elements such that (ab)c = a(bc) is a group. Because of having so many subloops that are groups, much nontrivial structure is present in a Moufang loop. Chein found all 159 non-group Moufang loops of order less than 64. An attempt at finding all such non-group Moufang loops of order 64 may be computationally difficult indeed. Various open questions are of interest. For example, does every finite Moufang loop contain Sylow P-subgroups for all primes p that divide its order? (For those interested in loops and related structures such as quasigroups, see [4, 5, 6, 14]; the two papers by Fenyves might provide interesting ideas for future research in automated reasoning, and the other two cited references provide a good picture of the modern uses of loops, Moufang loops, and quasigroups, each formally defined in Section 2.) Regarding the third question, purity of proof is related to proof elegance, as are proof length and proof structure (with respect to the type of term that is
OTTER and the Moufang Identity Problem
1525
present or absent). An interest in purity is also distantly related to an interest in the independence of axioms that characterize a set of structures. For example, in group theory, one can dispense with the axioms of right inverse and right identity, for they are provable from the remaining axioms. Then, to perhaps add to one's intuition concerning the significance of purity of proof, one might keep in mind the sometimes-expressed preference for proofs that avoid the use of certain lemmas (such as the inverse of the inverse of x equals x) or avoid the use of a law such as commutativity, and the seeking of a proof avoiding some type of term (such as n(n(t)) for any term t, where n denotes negation). Finally, though only distantly related, an interest in purity (to me) is somewhat reminiscent of the seeking of single axioms for some variety, for example, the seeking of a single axiom for all groups such that (for all elements x) the 17th power of x equals the identity e. It must be noted that the notion of pure proof is indeed sensitive to the particular formal framework that is in use.
2
Definitions and Notation
A quasigroup is a set in which multiplication is denned and in which unique left and right solution exist. For example, regarding right solution, for all x and all y, there exists a unique z such that xz = y. A loop is a quasigroup in which an identity exists, a 1 with lx = xl = x. A Moufang loop is a loop satisfying any one of the four equivalent Moufang identities given in Section 1; of course, satisfaction of one of the four means satisfaction of all of the four, the following given in a notation acceptable to the program OTTER. (When a line contains a "%", the characters from the first "%" to the end of the line are treated by OTTER as a comment.) '/, Axiom, Moufang (x * y) * (z * x) '/, Axiom, Moufang ((x * y) * z) * y '/, Axiom, Moufang x * (y * (x * z)) '/, Axiom, Moufang x * ((y * z) * x)
1: = (x * (y * z)) * x. 2: = x * (y * (z » y)). 3: - ((x * y) * x) * z. 4: - (x * y) * (z * x ) .
The Moufang identities just given are expressed in one of the notations accept able to OTTER, McCune's automated reasoning program used for the experi ments and the successes reported here. Although such expressions, in the strict sense that I normally use the term, are not clauses (see [15, 17]), throughout this article, I shall be cavalier and use the term clause loosely to include such expressions. Also, I am somewhat cavalier when referring to a Moufang identity, sometimes meaning the equation
1526
Collected Works of Larry Wos
and sometimes meaning its encoding for OTTER. If Moufang 1, 2, 3, and 4 were expressed in clause form (in the notation I often use), they would appear in the following manner; of course, as expected, one could use EQUAL as the predicate. '/• Axiom, Moufang 1: EQ(prod(prod(x,y),prod(z,x)),prod(prod(x,prod(y.z)),x)). '/. Axiom, Moufang 2: EQ(prod(prod(prod(x,y),z),y),prod(x,prod(y,prod(z,y)))). '/, Axiom, Moufang 3: EQ(prod(x,prod(y,prod(x,z))),prod(prod(prod(x,y),x),z)). '/. Axiom, Moufang 4: EQ(prod(x,prod(prod(y,z),x)),prod(prod(x,y),prod(z,x))).
When equality is present in a problem, typically I choose as the inference rule paramodulation [15, 17] because this inference rule builds in equality-oriented reasoning (in fact, it generalizes equality substitution). If that is the choice— because paramodulating from or into nonunit clauses can sharply reduce the effectiveness of a program—I prefer a set of unit clauses, clauses (or their equiv alent) free of the (logical) or symbol, in OTTER the symbol "|". Logical not is denoted in OTTER by " -". The following units can be used to study Moufang loops, using any one of (or all four) Moufang identities. x » x. x * rs(x,y) " y. 7. right solvable '/, right solution is unique (implies left cancellation) rs(x, x * y) » y. '/, left solvable ls(x,y) * y = x. ls(x * y , y) » x. 7, left solution is unique '/, (implies right cancellation) 1 * x ■ x. 'I, left identity x * 1 » x. V. right identity (x * y) * (z * x) - (x * (y * z)) * x. '/. Axiom, Moufang ((x * y) * z) * y - x * (y * (z * y)). '/, Axiom, Moufang x * (y * (x * z)) « ((x * y) * x) * z. '/, Axiom, Moufang x * ((y * z) * x) - (x * y) * (z * x). '/, Axiom, Moufang
1 2 3 4
The study reported here relied on the use of the first seven cited units and, taken one at a time, a Moufang identity; until Section 8, the focus is on the first three identities. The researcher interested in studying Moufang loops with the aid of OTTER might begin by proving the following useful property of inverses. For all x, there exist a left and a right inverse of x, and, further, they are equal. Next, one might prove that cancellation, left and right, follows from the given units; see
OTTER
and the Moufang Identity
Problem
1527
the sample input file given in the Appendix for the two laws. Finally, one might explore the use of cancellation in place of the uniqueness units. If the cancellation laws are employed, which take the form of nonunit clauses, then the inference rule UR-resolution [15,17] is used in addition to paramodulation. Different from the approach taken in this article, Kunen studied Moufang loops briefly, using unit clauses for left and right inverse (not assuming the two are equal), for left and right identity, and (one at a time) for one of the first three Moufang identities, and using two nonunit clauses for (extensions of) the cancellation laws. Regarding the presence of the unit clause x = x (reflexivity of equality), standard practice strongly recommends its inclusion when paramodulation is in use (explicitly or, as with a Knuth-Bendix approach, implicitly), for proofs often terminate with the deduction of a statement of the form a != a for some a where a is a constant. Next, needed are the definitions of circle of proofs and pure proof, for the problem to be featured asks one to find, if such exists, a circle of pure proofs for the (first) three Moufang identities. D e f i n i t i o n , circle of proofs. For a set of k equivalent elements—formulas, equations, properties, conditions, or definitions—a circle of proofs is a sequence of proofs such that the first proof shows that the first element implies the second, the second proof shows that the second element implies the third, ..., and the k-th proof shows that the fc-th element implies the first. D e f i n i t i o n , p u r e proof w i t h respect t o a set of e l e m e n t s . For a set of elements—formulas, equations, properties, conditions, or definitions—a proof of element j from element i is pure with respect to the set of elements if and only if it does not rely on the use of any of the elements but the j - t h and the i-th. The presence of a proper instance of an element other than the j - t h or i-th does not render the proof impure. If such instances are absent, by definition, the proof is instance pure. Further, if none of the deduced steps contains as a proper subterm an instance of an unwanted element, by definition, the proof is subterm pure. In response to a natural query, note that purity is not lost when the proof contains a n element derived from that which is unwanted. For example, if Mo ufang 3 is unwanted, purity is not lost in the presence of an equation that is derived from Moufang 3 by multiplying one of its terms by the identity 1. For a second and more interesting example, purity is not lost if one of the intermediate steps (resulting from demodulation) is an equation derivable from Moufang 3 by applying left division. Somewhat related, in Section 3.1, the subtlety of purity in the context of reasoning backward (from the denial of the desired conclusion) is addressed with an example.
Collected Works ofL&rry Wos
1528
3
Obstacles and Subtleties
Ordinarily my approach to attacking a new problem is to make one or more runs and see what I can learn by examining the corresponding output file(s). For but one example, I might discover that a type of term is present in many, many clauses and conjecture that such terms, and hence the clauses containing them, are best purged immediately upon generation. In this study, however, I first discussed the problem with my colleague McCune, for I thought it likely that various obstacles could be recognized and circumvented early. Indeed, our discussions did help to identify certain obstacles and to shape the approach (presented in this article) that was subsequently used to obtain the desired proofs. Also, though indirectly, those discussions set the stage for and perhaps even dictated the number and nature of the experiments central to this article; see Section 4 in relation to Sections 3.1 and 3.2. 3.1. POSSIBLE APPROACHES
Although finding any proof regardless of its properties might prove more than challenging, the most obvious—and perhaps most formidable—obstacle is the requirement of purity. Three approaches to deriving pure proofs are possible: an approach based on a forward search, using the denial of the conclusion only to detect proof completion; an approach based on a backward search, using the axioms and hypotheses of the theorem only to complete applications of an inference rule; and an approach based on a bidirectional search, reasoning both forward and backward. In [22] where the focus is on circles of pure proofs for thirteen shortest single axioms of equivalential calculus, forward proofs are a virtual necessity in that condensed detachment is the inference rule in use (from the viewpoint of logic). (In the study of this area of logic, a backward search is ordinarily impractical, for reasoning backward from the denial of some desired conclusion typically forces the program to cope with very long clauses.) However, for the current study of Moufang loops, having the program produce a proof relying solely on reasoning forward—thus making its examination for purity straightforward (on the sur face) although perhaps painful—might be impractical from the perspective of automated reasoning. (Indeed, one learns in Section 3.2 that, at least when de modulation is used, one cannot merely examine the deduced steps of the proof to see if an unwanted equation is present and, if not, then accurately claim that the proof is pure; in particular, an unwanted equation might be present as an in termediate step that results from demodulation.) In fact, as frequently occurred in the experiments featured here, a strictly forward search failed to yield any proof. (However, if one insists with the understanding that no proofs may be completed, one can instruct OTTER to make a forward search by placing the negation of the target equation in the passive list of clauses. Clauses in that list are used only for detecting unit conflict, which signals proof completion, and for
OTTER and the Mouf&ng Identity Problem
1529
applying forward subsumption.) If a forward proof is out of reach, one is then forced to instruct the program to seek a backward proof or a bidirectional proof. The following syntactic example of a backward proof (included simply for illustration) shows that a mere reading of the proof does not suffice where purity is concerned. The axioms of the example are, in clause form, (1) through (3). (1)
P.
(2)
-P I Q.
(3)
-Q | R.
The theorem to prove asserts that P implies R. The following proof is one of contradiction, beginning with clause (4), the negation or denial of the conclusion of the theorem, and reasoning backward. (4)
-R.
The assignment is to produce a pure proof, pure with respect to the axiom represented with clause (5). (5)
Q.
The proof uses clause (4) to deduce clause (6), which is then used to deduce clause (7), which contradicts clause (1). (6) (7)
-q. -P.
The claim that the proof consisting of clauses (1) through (4) followed by clauses (6) and (7) is pure with respect to clause (5) is, as my colleague McCune has (in effect) pointed out, total sophistry. Of course, the backward proof does not explicitly contain clause (5), but, if it is transformed into a forward proof, clause (5) is indeed present. Put another way, clause (5) is "really" present in the proof, even if not explicitly. One thus sees that the cited obstacle of finding a proof that is indeed pure is subtler than it might first appear. The third possible approach, a bidirectional proof, proceeds forward and backward, using the negative equality (arising, from assuming, say, that Moufang 2 is not deducible from Moufang 1) to deduce additional negative equal ities. Unfortunately, when a bidirectional search produces a proof—just as is the case when a backward search produces a proof—one must transform the proof into a strictly forward proof to be then checked to see that an unwanted equation is not present. Such checking is error prone if done by hand; one can, of course, have OTTER do the work instead, but some effort and some additional instructions to the program will be required. I shall give an example of how to proceed in that regard at the close of Section 7.
1530
Collected Works of Larry Wos
3.2. T H E MEANS TO SEEK PURITY
Independent of the approach taken, there is the problem of devising a method (for the program to apply) to avoid the use, implicitly or explicitly, of some unwanted equation. OTTER offers two mechanisms to block the use of some unwanted equation (or clause): weighting [8, 15, 17] and demodulation [15, 17]. The following command and weight Jist illustrate how weighting is used. assign(max_veight,20). weight_list(purge_gen). '/, Blocking use of Moufang 3. weight((x * (y * (x * z)) - ((x * y) * x) * z),1000). end_of_list. The inclusion of the cited command and weight Jist in the input file will prevent OTTER from retaining the clause equivalent of Moufang 3, for it will be as signed a purge-gen weight strictly greater than the max-weight. (The purge_gen weight is used for deciding whether or not to retain a clause, in contrast to the pick-given weight which is used to decide where next to focus attention. The max.weight places an upper bound on the weight, or priority, of retained clauses. When no weight template applies, the purge-gen weight and the pick-given weight are measured solely in terms of symbol count.) Because variables in a weight template are treated as indistinguishable, the use of weighting to block, say, the retention of Moufang 3 will also block the retention of any clause that resembles Moufang 3, where the differences rest with the particular occurrences of variables. Whether or not the preceding property is a disadvantage, there does exist a far more serious problem in using weighting to seek pure proofs if, because of other considerations, demodulation is also in use. (The use of demodulation might be virtually required to prevent the program from retaining a huge number of clauses that would otherwise be simplified and then purged with subsumption.) Regarding the more serious problem, for but one example, the program may apply an inference rule to a set of hypotheses, then apply a sequence of de modulators, and one of the intermediate clauses (before the demodulation is complete) may be Moufang 3. Weighting would have no effect in the situation under discussion. In such an event, although Moufang 3 would not be explicitly present in the proof, it would be used implicitly; therefore, the proof (in a true sense) would not be pure with respect to Moufang 3. In place of weighting to block the use of an unwanted equation, such as Moufang 3, OTTER offers demodulation used in the following manner. list(demodulators). 'A Blocking use of Moufang 3. EQ((x * (y * (x * z)) - ((x * y) * x) * z ) , $T). Eq((((x * y) * x) * z - x * (y * (x * z ) ) ) , $T). end_of_list.
OTTER and the Moufang Identity Problem
1531
(Note that this use of demodulation focuses on demodulating an entire clause, in contrast to the far more common use that focuses on a term. Also note that, rather than a single demodulator, two demodulators are included, one to cope with Moufang 3 as given in this article, and one to cope with the case in which its arguments are interchanged.) When OTTER demodulates a clause to $T, true, the clause is automatically purged. Just as the use of weighting to seek pure proofs has pitfalls, so also does the use of demodulation. With demodulation as the means for blocking the participation, explicitly or implicitly, of an unwanted equation, three pitfalls exist. The first pitfall, easily avoided but commonly encountered, concerns the orientation of demodulators. With OTTER, one can give a lexical ordering in the following way. lex(t$T,a>b,c>d,e,l,_*_,rs(_,_),ls(_,_),-(_,_)]). As given, $T is treated as lighter than other terms. Were one to err (as I in fact did at one point early in the study) and place $T at the righthand end of the list, then the cited equalities (for blocking the use of Moufang 3) would not apply. The second pitfall concerns the use of back demodulation, a procedure that is so often of value in increasing the effectiveness of a program. To instruct the program to back demodulate clauses stored in its database—which means to rewrite by simplifying and canonicalizing each, if possible, with every newly adjoined demodulator—one uses the following command. set(back_demod). In the presence of this command, when a newly retained clause is made into a demodulator, the program attempts to apply it to all clauses currently retained. The key to the possible pitfall is contained in the modifier "all", for, indeed, even existing demodulators can be back demodulated. Therefore, if misfortune occurs, the two input demodulators (used to block the retention of Moufang 3) can be back demodulated. As a matter of history, in some of the experiments preceding those reported in this article, such occurred, necessitating the commenting out of the command, thus avoiding the use of back demodulation. The final pitfall concerns the choice of demodulating inside out or outside in. The default in OTTER is inside out, correctly suggesting that, in the majority of cases, that is the preferred choice. However, such demodulation can cause the program to present a proof in which, say, Moufang 3 is implicitly present. Indeed, when a sequence of demodulators is being applied inside out, one of the intermediate clauses might in fact be the clause equivalent of an unwelcome equation, the equation whose presence prevents the proof from being pure. At that point, it may well happen that neither of the two cited equalities (used to block, for example, Moufang 3) gets applied, because of the inside-out path. The appropriate action to take is to include the following command. set(demod_out_in).
1532
4
Collected Works of Larry Wos
Theorems and Experiments
Two possible circles of pure proofs exist for the (first) three equivalent Moufang identities; the fourth Moufang identity comes into play in Section 8. Circle 1 (for the first three identities), if it exists, consists of three proofs: a proof that Moufang 1 implies Moufang 2, a proof that is pure with respect to Moufang 3; 2 implies 3, pure with respect to 1; and 3 implies 1, pure with respect to 2. In other words, for Circle 1, the identities are ordered 1, 2, 3, 1. The only other possible order is 1, 3, 2, 1, and corresponding to that order is Circle 2. Therefore, to explore the possible existence of either of the two circles, there exist six possibly true theorems to attack. For each of the six purported theorems—taking into account the discussion of Section 3 and my continued interest in the use of strategy—a sequence of five experiments are in order. For each of the six purported theorems, the first exper iment was designed to determine whether any proof can be found by OTTER, ignoring purity. This program offers a wide variety of options and strategies. However, at least currently, no algorithm or metarules exist for making effective choices; experience and intuition are generally the basis for option choosing. (In [23], Chapter 8 does offer some biased guidelines in that regard.) The fact that a theorem has already been proved by some means (typically by a researcher) is, at this time (in 1995), no guarantee that a proof of it is within range of an automated reasoning program. Since for all six theorems OTTER produced a proof, the other four experi ments (in the sequence of five) each focused on finding a pure proof. The second experiment (conducted mainly out of curiosity) focused on the use of weighting to block the unwanted Moufang identity. Again, in all six cases, the second ex periment produced a proof, but a proof not guaranteed to be pure. Therefore, as discussed in Section 3, to guarantee that proofs produced are pure, weighting was replaced by demodulation in the third experiment. The third experiment succeeded in all six cases. Actually, as already discussed, a caveat must be is sued: In particular, if the proof is bidirectional, then the lack of purity may be hidden within that part of the proof that proceeds backward from the assumed falseness of the theorem. In such an event, either some hand computation is needed, or some not-so-standard use of OTTER is required. In either situation, misfortune is possible in that purity may be absent from the bidirectional proof. In all six cases, a proof was produced by the third experiment, and therefore, for the fourth and fifth experiments, efficiency became an equal concern. The fourth experiment explored the use of the hot list strategy [20, 22, 23] to see what effect its use would have on efficiency and on proof length. Because the fourth experiment succeeded (in all six cases), the fifth experiment explored a heavier use of the hot list strategy. The fifth experiment in all cases succeeded. However, as it turned out, in four of the six cases (in the context of Experiment 5), an attempt at a (strictly) forward proof failed, necessitating action to (so to speak) convert a bidirectional proof into a forward proof; see Section 7 for
OTTER and the Moufang Identity Problem
1533
the actions that were taken. (Incidentally, I chose not to be concerned about converting bidirectional proofs for any of Experiments 1 through 4 because purity was proved for all six theorems in the context of Experiment 5, after the converting procedure was applied to the four cases where it was needed; see Section 7 for the procedure.)
5
Successes and Options
To gain some understanding and some insight into the options that were used and the significance of the changes in them within a sequence of experiments, some background information is in order. In addition to providing a clearer picture of how the problem focusing on the (first) three Moufang identities was solved, this background information is intended to aid researchers in the use of OTTER in totally unrelated areas, to show how decisions were made, and to (in part) satisfy the frequent request for giving guidance for making choices from among the numerous options offered by McCune's program. Although (as Ken Kunen did in some successful experimentation [7]) one can include cancellation laws among the axioms, my preference is for a repre sentation in which no nonunit clauses (or their equivalent) are present. This preference is consistent with my goal of demonstrating that the use of an auto mated reasoning program often requires little guidance in the context of adding various lemmas. Because equality is the relation, paramodulation is the choice, a choice that (because of efficiency considerations) asks for the inclusion of few or no nonunit clauses in the input. (Whether a Knuth-Bendix approach, which re lies on paramodulation, is effective is left to future research, possibly by others.) Also different from Kunen, no input demodulators were included with the pur pose of using them for canonicalization, for I had no conjecture regarding which would be useful. Instead, OTTER was instructed to set(process.input), a com mand that makes some or all input clauses into demodulators. To permit new demodulators to be adjoined during the run, the command set(dynamic.demod) was included. The preceding two commands were included because of the con viction that efficiency would be severely decreased without the presence of de modulators. As expected from the discussion of Section 3, set(demod.outJn) was the command, to instruct demodulation to be from the outside in (rather than inside out). As those familiar with my views expect, I emphasized the use of strategy: Three were used, part or all of the time. With the command assign(pick_given. ratio,3), McCune's ratio strategy [10, 17, 23] was used, chosen because numer ous experiments in various areas strongly suggest that the likelihood of suc cess is increased when some of the reasoning is driven by focusing on complex clauses retained early in the attack. With this command, OTTER was instructed to choose (for the focus of attention to direct the program's reasoning) three clauses by weight (symbol complexity, in this case), one by first come first serve
1534
Collected Works of Larry Wos
(or breadth first), then three, then one, and the like. The ratio strategy blends (subject to the assignment of the pick-givenj-atio parameter) a bit of level sat uration with (usually more) choosing of clauses for the focus of attention by weight. More important to the research was the use of the hot list strategy, chosen to cause the program to immediately consider the clauses in the hot list with each newly retained clause. Use of the hot list strategy typically requires the researcher to choose from among the input statements that present the question or problem those that are conjectured to merit immediate visiting (as hypothe ses) and, if the value assigned to the heat parameter is greater than 1, even immediate revisiting. The chosen statements are placed in the (input) hot list, and they are used one at a time or in combination (depending on the infer ence rule being applied) to complete inference rule applications, rather than to initiate applications. Members of the hot list are not subject to any restriction regarding unit and nonunit clauses. Potentially powerful choices for members of the hot list include the elements of the special hypothesis and elements of the initial set of support. (The special hypothesis of a theorem of the form if P then Q refers to that part of P, if such exists, that excludes the underlying axioms and lemmas. For example, in the study of the theory that asserts that rings in which the cube of x = x are commutative, the special hypothesis consists of the equation xxx = x.) Also, when an inference rule in use relies on the use of some clause as a nucleus (as in hyperresolution), then placing a copy of such a clause in the hot list is often profitable. Further, if a needed nucleus is absent from the hot list, then (with the rarest exceptions) the program cannot use the hot list strategy for that case, for the strategy requires that, other than the ini tiating clause, all remaining clauses used in an application of the corresponding inference rule be present in the hot list. The exceptions occur when a nucleus is used to initiate an application of an inference rule, which is indeed rare in the experiments with which I am familiar. When the program decides to retain a new conclusion, before another con clusion is chosen from list(sos) as the focus of attention to drive the program's reasoning, the hot list strategy causes the new conclusion to initiate applica tions of the inference rules in use, with the remaining hypotheses (or parents) that are needed all chosen from the hot list. Members of the hot list, whether input or adjoined during a run, are not subject to back demodulation or back subsumption; in other words, clauses in the hot list are never rewritten with the discovery of new demodulators (rewrite rules), nor are they purged because of being captured by a newly retained clause. If one wishes the program during the run to adjoin new members to the hot list, one uses the dynamic hot list strategy [20, 22] (which McCune formulated as an extension of the hot list strategy); see Section 6.3. If that is the choice, then one assigns an integer, positive or negative, to the dynamicJieat.weight parameter with the intention that conclusions that are retained and that have a pick-given weight (complexity) less than or equal to the assigned value will be
OTTER and the Moufang Identity Problem
1535
adjoined to the hot list. (A clause, or its equivalent, technically has two weights, its pick-given weight which is used in the context of choosing clauses as the focus of attention to drive the program's reasoning, and its purge-gen weight which is used in the context of clause discarding; often the two weights are the same.) The dynamic_heat_weight assignment places an upper bound on the pick-given weight of clauses that can be adjoined to the hot list during the run. When the heat parameter is assigned the value 1, conclusions that result from consulting the hot list (whether one is using the hot list strategy or the dynamic hot list strategy) have heat level 1. (By definition, input clauses have level 0, and a deduced clause has a level one greater than that of its parents.) If the program decides to retain a conclusion of heat level 1 and if the (input) heat parameter is assigned the value 2, then before another conclusion is chosen as the focus of attention, the heat-level-1 conclusion is used to initiate the search for conclusions of heat level 2 (with the hypotheses needed to complete the cor responding application of the inference rule chosen from the hot list). The heat parameter can be assigned to whatever positive integer the researcher chooses, with the objective of placing corresponding emphasis on the immediate use of the members of the hot list. If the parameter is assigned the value 0, then the hot list strategy will not be used. Finally, as expected if one is familiar with my research, the set of support strategy [15, 17] was used, contributing significantly to program efficiency (see Section 6.1). (This strategy was chosen and used in the manner discussed here to prevent the program from exploring the entire theory of loops.) Because attempts at completing forward proofs (each in a single run) failed the majority of the time, the denial of the conclusion to be proved was placed in list(sos), the initial set of support. The only other member of that list was the hypothesis. For example, when attacking the theorem that asserts the deducibility of Moufang 1 from Moufang 3, list(sos) contained two clauses, the equivalent of Moufang 3 and the equivalent of the negation of Moufang 1. (For the researcher wishing some information immediately regarding placing all clauses in the initial set of support, I can report with satisfaction that, other than in a few cases, the results for all five experiments, for each of the six theorems attacked, required less CPU time when the two-element set of support was used; see Section 6.1 for more detail.) Regarding option changes from experiment to experiment, the minimal changes were made in order to gain the most meaningful information in the context of effectiveness. For example, the only differences between the third and the fifth experiment when attacking the theorem that asserts that Moufang 2 implies Moufang 3, with the constraint that Moufang 1 not be used (explicitly or im plicitly), was the addition of a hot list (for the fifth experiment) and the setting of the heat parameter. For a second example, three differences existed between the fourth experiment focusing on proving that Moufang 1 implies Moufang 3 with Moufang 2 not participating at all and the fourth experiment focusing on proving that Moufang 2 implies Moufang 1 with Moufang 3 not participating
1536
Collected Works of Larry Wos
at all. First, regarding list(sos) (the initial set of support), Moufang 1 and the negation of Moufang 3 are replaced by Moufang 2 and the negation of Moufang 1. Second, regarding list(demod), which is the input list of demodulators, two equalities corresponding to Moufang 2 are replaced by two corresponding to Moufang 3; the choice of input demodulators is dictated by the choice of which identity to avoid being present, implicitly or explicitly, in a completed proof. Perhaps unexpected, two equalities are included, for the program must be in a position to cope with the deduction of the unwanted identity with the lefthand and righthand arguments interchanged. The third difference rests with the con tents of list(hot), the initial hot list. When Moufang 1 is the hypothesis, a copy of it appears in list(hot) in addition to appearing in list(sos). When Moufang 2 is the hypothesis, then a copy of it appears in list(hot) as well as in list(sos). The choice of which clauses to place in the initial hot list is a reflection of the recommendation to place key clauses in list(hot), in the two cited cases the clause that corresponds to the hypothesis of the theorem under attack. Regarding the five experiments taken as a sequence, for a given implication, say Moufang 3 implies Moufang 2, many options were shared. Among them, max.weight was assigned the value 20, pick-given.ratio was assigned the. value 3, max_proofs was assigned the value 2, and max_mem was assigned the value 20000 (20 megabytes). Also in common were set(dynamicdemod) (to adjoin new demodulators during the run), set(demod.outJn) (for outside-inside demodula tion), set(process-input) (to make some or all input clauses into demodulators), and set(para.into) and set(para_from) (both for the inference rule paramodulation). With respect to the latter two set commands, OTTER is instructed, for each clause chosen as the focus of attention to drive its reasoning, to paramodulate from that clause and also to paramodulate into that clause with all of the clauses available in list(usable). Because paramodulation's performance deteri orates markedly when a nonunit clause is involved, in all five experiments (for each of the six theorems under attack), the commands set(para-into_units_only) and set(para.from_units_only) are included. (As it turned out, the preceding two commands to cope with a possible need played no role, for nonunit clauses were never included.) Other than clauses corresponding to a Moufang identity or the negation of one, all input clauses were placed in list(usable), were not placed in the initial set of support. For each of the six theorems, the first experiment in the sequence of five fo cused merely on provability. Indeed, no actions were taken to block the presence in a proof of the unwanted Moufang identity. Despite the lack of a guarantee when using weighting to block an unwanted equation or formula (as discussed in Section 3), Experiment 2 extended Experiment 1 by including a single weight template in weight-list (purge_gen), an inclusion of the following type. weight_list(purge_gon). '/■ Blocking use of Moufang 3. weight((x * (y * (x * z)) - ((x * y) * x) * z),1000).
OTTER and the Moufang Identity Problem
1537
end_of_list. In the third through the fifth experiment (for each theorem of the six), to guarantee (with one proviso) purity, weighting was replaced by demodulation, in the following manner. list(demodulators). '/, Blocking use of Moufang 3 . EQ((x * (y * (x * z)) - ((x * y) * x) * z ) , $T). EQ((((x * y) * x) * z - x * (y * (x * z ) ) ) , $T). end_of_list. As for the proviso, forward proofs were often difficult to complete, necessitat ing in many cases a bidirectional search. The example given in Section 3.1 (in terms of P, Q, and R) correctly suggests that proofs containing steps resulting from reasoning backward from a negative clause can "hide" the presence of an unwanted equation or formula. As (in effect) promised earlier, I show in Section 7 how OTTER was used to replace the so-called backward portion of the proof with a forward portion, maintaining the restriction of blocking the unwanted identity. The fourth and fifth experiments in each of the six sequences extended the third experiment by adding the use of the hot list strategy. In the fourth ex periment, the (input) hot list contained a single element. For example, when Moufang 3 was the hypothesis, then a copy of it was placed in list(hot). In the fifth experiment also included in list(hot) were the axioms of a loop, those clauses (excluding that for reflexivity) that were also present in list(usable). 5.1. T H E FIRST CIRCLE
At this point, comparisons are in order. For the first circle (focusing on the first three identities), three proofs are of interest: a proof that Moufang 1 implies Moufang 2, pure with respect to Moufang 3; a proof that Moufang 2 implies Moufang 3, pure with respect to Moufang 1; and a proof that Moufang 3 im plies Moufang 1, pure with respect to Moufang 2. As commented in Section 1, (from what I know) the third proof was absent in prior studies of Moufang loops. Instead, the proof that Moufang 3 implies Moufang 1 relied on the use of Moufang 2. The first theorem for discussion asserts that Moufang 1 implies Moufang 2. However, purity is not relevant to the first of the sequence of five experiments, for that experiment is concerned merely with completing any proof. (All ex periments in this article were conducted on a SPARCstation-10. For brevity, although the CPU times that are cited are indeed approximate figures, each is given without the reminder of "approximately".) In 125 CPU-seconds, a forward proof was produced of length 73 (paramodulation steps) and level 20, complet ing with retention of clause (1876). (By definition, input clauses have level 0,
1538
Collected Works of Larry Wos
and a deduced clause has a level one greater than that of its parents; demodula tors do not count among parents of a deduced clause.) The use of demodulators in deducing a clause affects neither proof length nor proof level. The second and third experiments (of the sequence of five) produced the same proof with similar statistics. In the fourth experiment (in which the hot list strategy was introduced), some ground was gained, and some was lost. A shorter proof (based solely on reasoning forward) was found, one of length 58 and level 19, completing with the retention of clause (2707). However, the CPU time required to find the proof increased to 589 CPU-seconds. For the curious, quite often more CPU time is required to complete a shorter proof. The fifth experiment was most satisfying. A length 28 and level 14 proof was found, completing with retention of clause (611). In addition to the sharp reduction in proof length, less than 4 CPU-seconds were required. The only drawback at all was that the proof contains one deduced step produced by reasoning backward from the denial of the theorem. Two experiments sufficed to replace that step with a forward reasoning step. Of less interest, in 30 CPUseconds (in the same run) OTTER did complete a forward proof of length 82 and level 23, with retention of clause (1478). With the cited step replacement, each of the five experiments in fact yielded a pure proof. The cited successes with the study of Moufang 1 implies Moufang 2 im mediately called for the study of Theorem 2, Moufang 2 implies Moufang 3. The first experiment—testing the difficulty of obtaining any proof, regardless of purity—produced a proof in 771 CPU-seconds with retention of clause (2783). The proof has length 55 and level 16. Except for one step, the proof is for ward; a subsequent experiment produced the desired replacement step to yield a forward proof. The second experiment essentially imitated the first. The third differed somewhat, producing a proof in 866 CPU-seconds with retention of clause (2778). The proof has length 52, level 16, and, except for one step, is a forward proof. A single experiment provided the needed replacement step to yield a forward proof. Even the fourth experiment was similar, yielding a 57step proof of level 14, completing with retention of clause (2013). To obtain the proof, 591 CPU-seconds were required. Again, one additional experiment sufficed to replace one step to produce a forward proof. The breakthrough in the context of CPU time, as in the study of the first theorem of Circle 1, occurred with the fifth experiment. Indeed, a 50-step proof of level 17 was produced in 19 CPU-seconds with retention of clause (1294). The proof contains one step resulting from reasoning backward from the negation of the theorem, a step that was easily replaced with one experiment. It turned out that, again, (with the cited step replacements) the proofs yielded by the five experiments focusing on the second theorem of Circle 1 are pure (with respect to Moufang 1). To complete the study of Circle 1, the third theorem became the focus, the theorem asserting the deducibility of Moufang 1 from Moufang 3. Of course,
OTTER and the Moufang Identity Problem
1539
purity with respect to Moufang 2 was key. In 555 CPU-seconds, the first experi ment yielded a 47-step proof of level 16 with retention of clause (2359). The proof contains two steps of so-called backward reasoning. The experiment to replace the two steps with forward reasoning succeeded, but, rather amusing, only one replacement step was needed. (On the other hand, as shown by example in Sec tion 7, sometimes the replacement of one step of backward reasoning can require the use of two steps of forward reasoning.) The second and third experiments essentially mirrored the first. The fourth experiment produced a 55-step proof of level 16 in 1910 CPU-seconds with retention of clause (2491). As in the first experiment, the single experiment designed to replace two backward-reasoning steps with forward-reasoning steps found one step that was sufficient. Again, the fifth experiment was the most satisfying, but not as dramatically as with the first and second theorems. In 103 CPU-seconds, OTTER produced a 68-step proof of level 22, completing with retention of clause (1860). As was becoming the custom, one experiment produced a forward-reasoning step to replace the single step resulting from reasoning backward. With the cited step replacements, all five proofs are pure. 5.2. T H E SECOND CIRCLE
Three theorems, 4, 5, and 6, are the focus for Circle 2. Theorem 4 asserts that Moufang 2 implies Moufang 1, of course, with the additional objective of finding a proof pure with respect to Moufang 3. Theorem 5 has Moufang 3 for its hypothesis and Moufang 2 as its conclusion, and purity is with respect to Moufang 1. Finally, Theorem 6 has Moufang 1 as its hypothesis and Moufang 3 as its conclusion, and purity is with respect to Moufang 2. Theorem 4 was proved in the first experiment in 193 CPU-seconds with reten tion of clause (1980). The proof has length 24 and level 12. A single experiment provided a forward-reasoning step to replace the one step that resulted from rea soning backward. The second and third experiments were essentially copies of the first. The fourth yielded a 37-step proof of level 12 in 202 CPU-seconds with retention of clause (1562). A single experiment provided a forward-reasoning step to replace the one step that resulted from reasoning backward. The fifth experiment was minutely pleasing, for 51 CPU-seconds sufficed to produce a proof, one of length 62 and level 19, completing with retention of clause (1640). A single experiment provided a forward-reasoning step to replace the one step that resulted from reasoning backward. With the cited step replacements, the proofs yielded by the five experiments focusing on the first theorem (Theorem 4) of Circle 2 are pure. Theorem 5 proved to be more difficult than did Theorem 4, requiring in the first experiment 573 CPU-seconds and the retention of clause (2351). The resulting 47-step proof of level 16 is a forward proof. The second and third experiments essentially mirrored the first. The fourth required 752 CPU-seconds and the retention of clause (2030) to complete a forward proof of length 66 and
Collected Works of Larry Wos
1540
level 17. The fifth experiment produced the desired proof in 205 CPU-seconds with retention of clause (2091), a proof of length 60 and level 22 that is a forward proof. All five proofs are pure and are also forward proofs. The study of Theorem 6 was more rewarding than was the study of either Theorem 4 or Theorem 5, as one sees from the following data. The first ex periment produced a proof of length 59 and level 19 in 41 CPU-seconds with retention of clause (1622). One experiment sufficed to produce a step to con vert the 59-step bidirectional proof to a forward proof. The second and third experiments essentially matched the first. The fourth experiment proved to be a singular failure, requiring 667 CPU-seconds and the retention of clause (2740) to complete a 93-step proof of level 25. The proof contains one step resulting from reasoning backward, easily replaced to produce a forward proof by conducting a single experiment. The fifth experiment, however, was indeed satisfying. Less than 3 CPUseconds were required to produce a 30-step proof of level 15, and only 614 clauses were retained before the proof was completed. In addition, the proof offered a piquant property: To replace the only step resulting from backward reasoning, to produce a forward proof, required two forward-reasoning steps. With the cited step replacements, the proofs yielded by the five experiments focusing on the third theorem (Theorem 6) of Circle 2 are pure.
6
Insight Regarding the Use of Strategy
To complement the preceding material of this article, this section is devoted to a more detailed discussion of various strategies. Program performance can indeed be sharply enhanced by a judicious use of strategy. Even further, my more than thirty years of use of an automated reasoning program convinces me that relying heavily on strategy is essential when attacking deep questions and hard problems. The evidence is drawn, as expected, from experimentation. 6.1. THE SET OF SUPPORT STRATEGY In the thirty experiments reported here, a natural question concerns the role of the set of support strategy, a strategy that restricts a program's reasoning to drawing conclusions that are recursively traceable to the input clauses placed in list(sos). In particular, what is the effect on program performance if this strategy is not used? Much of the answer is contained in a comparison of the results obtained from conducting experiments in pairs, each pair consisting of one experiment with and one without the set of support strategy. To conduct an experiment without the set of support strategy, (with OTTER) one places all clauses in list(sos). (As a practical matter, the clause for reflexivity of equality, x = x, can be placed in the input usable list, for almost never is the program permitted to apply paramodulation into or from a variable; such permission
OTTER and the Moufang Identity Problem
1541
would, with few exceptions, drown a program in drawn conclusions, for unifi cation would always succeed.) In keeping with an accurate account of history, I note that I conducted thirty experiments without using the set of support strategy before conducting the thirty with its use, the latter being the basis of this article. To have done so is not in keeping with my usual approach of heavily relying on the set of support strategy, as anyone familiar with my research can attest. The explanation (for my omission of the use of the set of support strat egy) rests either with inadequate attention to detail or with a preoccupation with the problem under study. Among the favorable comparisons, Theorem 2 provides relevant evidence, the theorem that asserts the deducibility of Moufang 3 from Moufang 2. In the first experiment (in which no attempt was made to block the use of Moufang 1), without the set of support strategy, a 52-step proof of level 18 was completed, requiring 1897 CPU-seconds. On the other hand, with the set of support strategy, a 55-step proof of level 16 was completed, only requiring 771 CPU-seconds. Why the shorter proof without the strategy, yet requiring roughly 2.5 times as much CPU time? First, in the unsupported proof, the first three steps are yielded by applying paramodulation to combinations of various axioms for a loop (see Section 2 for the definition), and none of the parents of any of these steps is Moufang 2 or the negation of Moufang 3. Nevertheless, amusing enough, two of the three steps are found in the proof obtained by using the set of support strategy with list(sos) containing only Moufang 2 and the negation of Moufang 3. When the axioms of a theory are placed in list(sos), OTTER is given permission to explore the underlying theory, seeking lemmas and such. To ensure that the members of list(sos) are considered before other clauses for driving the program's reasoning, the following command is included. set(input_sos_first). The second factor regarding the difference in CPU time and the difference in proof length rests with the fact that, by placing Moufang 2 and the negation of Moufang 3 in list(sos) and the axioms in list(usable), the program is prevented from exploring the basic theory. Although the result will usually be the inacces sibility to various lemmas, in general far fewer paths of inquiry are traversed. Indeed, without the use of the set of support strategy, to complete the proof, perhaps as many as 303,551 clauses were generated of which 1575 were retained. When the strategy was used, the proof was completed after generating perhaps as many as 289,428 clauses of which 1563 were retained. (Precision regarding how many clauses were generated is lacking, for the run was not terminated im mediately after finding the first proof in either case.) More significant, to obtain a proof without the aid of the strategy, 363 clauses were chosen as the focus of attention to drive the program's reasoning. In contrast, with the strategy, 340 clauses were chosen. For a second example, still focusing on Theorem 2 (of the first circle), the fourth experiment also shows the value of using the set of support strategy.
1542
Collected Works of Larry Wos
Without the strategy, 1811 CPU-seconds were required to obtain a proof; in contrast, with the strategy, 591 CPU-seconds were required. As noted, the fourth experiment of each sequence of five relies on the use of the hot list strategy, where (the initial) list(hot) contains the hypothesis of the theorem and no other clauses. A third example is provided by staying with Theorem 2 but switching to the fifth experiment, that in which the (initial) hot list was expanded to include the axioms of a loop. Without the set of support strategy, 171 CPU-seconds were required to produce the desired proof; with the strategy, only 19 CPU-seconds were required. For additional evidence, the focus switches to Theorem 5, the theorem as serting the deducibility of Moufang 2 from Moufang 3. This theorem is in an obvious sense the converse of Theorem 2, the theorem that was just under scrutiny. In the context of the first of the five experiments, without the set of support strategy, 1615 CPU-seconds were required to obtain a proof; with the strategy, 573 CPU-seconds were required. Perhaps unexpected in view of the decrease in CPU time, 2311 clauses were retained in order to complete a proof without the strategy, in contrast to the requirement of retaining 2351 with it. The additional CPU time is mainly accounted for by the need to choose as the focus of attention 362 clauses when the strategy was not used, in contrast to choosing 331 clauses as the focus of attention when the strategy was used. With the strategy, OTTER generated roughly 250,000 clauses and retained 1344 to produce a proof. In contrast, without the set of support strategy, to complete a proof, the program generated roughly 277,000 clauses of which 1309 were retained. An example of proof lengthening by using the set of support strategy is found in the context of Theorem 2. Theorem 5 provides an example of proof shortening: In the context of Experiment 1, without the strategy, the first completed proof has length 54 and level 17; with the strategy, the first completed proof has length 47 and level 16. One might find it piquant to note that the shorter proof was obtained without the use of the three lemmas used as the first three deduced steps in the longer proof, lemmas obtained by applying paramodulation to pairs of axioms for a loop. In other words, the use of three lemmas from the theory of loops (ignoring the property of being Moufang) did not aid OTTER in finding a shorter proof. The fourth and, to some extent, the fifth experiments (focusing on Theorem 5) also provide evidence of the value (in the context of efficiency) of using the set of support strategy. In the fourth experiment, without the strategy, 2420 CPUseconds were required to produce a proof; with its use, 752 CPU-seconds were required. The first of the two cited proofs has length 34 and level 11; despite the reduction in the required CPU time, the second has length 66 and level 17. In the fifth experiment (in which an extensive hot list was used), 256 CPU-seconds were required to produce a proof without the aid of the set of support strategy; with its aid, 205 CPU-seconds were required. Where the first of the two cited
OTTER and the Moufang Identity Problem
1543
proofs has length 35 and level 16, the second has length 60 and level 22. The story would hardly be complete without an example of an increase in CPU time when the set of support strategy is used. For that example, Theorem 1 suffices, in the context of the fourth experiment. As a reminder, the theorem asserts the deductibility of Moufang 2 from Moufang 1. The experiment's objec tive is to find a proof that is pure with respect to Moufang 3, using the hot list strategy with but one element in list(hot), namely, Moufang 1. Without the set of support strategy, 364 CPU-seconds is enough to yield a 68-step proof of level 17. However, although this strategy is considered by many researchers in auto mated reasoning to be the most powerful strategy for restricting a program's reasoning, 589 CPU-seconds were required to complete a proof with the use of the set of support strategy. The proof has length 58 and level 19. The cited data supports my usual recommendation, the following. Recommendation. In the vast majority of cases, the power of a program's at tack is significantly increased if one uses the set of support strategy. Without additional knowledge, ordinarily, the most effective choice for the initial set of support is the union of the special hypothesis and the negation (or denial) of the conclusion. In the presence of a set 5 of axioms, the special hypothesis of a theorem of the form P implies Q is P. For example, in ring theory, the ad ditional hypothesis that the cube of x = x (for every x) is sufficient to prove commutativity. If the given recommendation is followed regarding which input clauses are to be placed in list(sos), then the elements of the (initial) set of support are the clauses corresponding to xxx = x and the assumed falseness of commutativity. 6.2. T H E RESONANCE STRATEGY
In addition to the set of support strategy and the hot list strategy, OTTER offers other strategies that can sharply increase program performance, for ex ample, the resonance strategy [21]. The objective of the resonance strategy is to enable the researcher to suggest equations or formulas expressed as unit clauses, called resonators, each of whose symbol pattern (all of whose variables are con sidered indistinguishable) is conjectured to merit special attention for directing a program's reasoning. To each resonator, one assigns a value reflecting its rel ative significance; the smaller the value, the greater the significance. My notion in formulating this strategy was that the steps of a known proof of one theorem might indeed be effective if used to direct an automated reasoning program in its search for a proof of a related theorem. Resonators are not lemmas, do not have t r u e or false values. Instead, any equation or formula that matches an included resonator is given the value of the matching resonator and is, therefore, given a corresponding preference for being chosen as the focus of attention to direct the program's reasoning. A clause matches a resonator if and only if, when all variables in both are treated as the same variable, the two are identical. After completing the research on which this article is mainly based, it seemed
1544
Collected Works of Larry Wos
natural to experiment briefly with the resonance strategy to see what effect its use would have, leaving a more thorough investigation either to a future article or to other researchers. My notion was to choose one proof from among the proofs produced by the thirty experiments featured in this article, and use the (positive) deduced steps of that proof as resonators. Equations or formulas containing logical not or containing logical or are never used as resonators. What criteria would be reasonable for choosing the key proof? Although, other than aesthetics, no persuasive justification can be given, three criteria taken together appealed to me. First, narrow the choice to one from among those six experiments in which a substantial hot list was used, the fifth of each sequence of five for the six theorems. Intuitively, if the use of such a hot list could sharply reduce the CPU time required to obtain a proof—which it often did, as reported here—then perhaps the proofs thus obtained offered some special property. Second, narrow the list further by focusing on experiments that yielded a proof in less than 30 CPU-seconds. More intuition: perhaps such a de gree of effectiveness would be inherited. Third, from the narrowed list, choose the experiment that reduced the required CPU time the most. Applying the cri teria selects the fifth experiment focusing on Theorem 2, that in which Moufang 2 as hypothesis is used to deduce Moufang 3 while blocking the participation of Moufang 1. From the first proof yielded by the fifth experiment concerned with The orem 2, forty-nine resonators were chosen, the positive deduced steps. Each was assigned a pick-given weight of 2 (to give any matching clause that is retained a high priority for being chosen as the focus of attention), and a weight_list(pick-and_purge) was used. The same set of support was used. In each of the following experiments, the only change from its original form was the addition of the use of the resonance strategy (as described). The third criterion for choosing the resonators to be used suggested which of the thirty experiments to revisit first, namely, the first experiment focusing on Theorem 2. From the viewpoint of CPU time, the target was 771 CPU-seconds, the time required to obtain a proof on the first visit to the experiment under consideration. How satisfying: With the addition of the resonance strategy, only 12 CPU-seconds (approximately) were required. Where the first visit completed a proof upon retention of clause (2783), the second visit completed a proof upon retention of clause (895). As for the explanation for the dramatic reduction in CPU time, the first visit required choosing 340 clauses as the focus of attention to drive the reasoning; in contrast, the second visit required but 63. When the proof was completed in the first visit, 29,000 clauses had been generated of which 1563 were retained. In contrast, in the revisiting, 13,000 were generated of which 519 were retained upon completion of the proof. Closer inspection of the two runs revealed additional riches. Where the proof obtained in the first visit has length 55 and level 16, the proof obtained in the second visit has length 40 and level 12. As one can see from the data, the use of 40 clauses (for the proof) out of 519 is more impressive than using 55 out of
OTTER and the Moufang Identity Problem
1545
1563. Of the 40 deduced steps in the shorter proof, 20 were not present in the longer proof. Immediately, one might wonder about the direct role of the resonators. In particular, how many of the 40 steps are among the 49 resonators? The answer is 31. In that resonators are treated as if their variables are indistinguishable, the natural question to answer next concerns how many of the 40 deduced steps match (in the sense discussed earlier in the context of the resonance strategy) a resonator. That question can easily be answered by taking the 49 resonators and making all of their variables the variable x, then applying the same actions to the 40 deduced steps, and finally making a comparison. Noting that 31 of the 40 steps are among the resonators, I fully expected that almost all of the 40 steps would match a resonator (in the sense used here). I was wrong: Indeed, the number increased merely by 1, from 31 to 32. Among other conclusions, one could envision having a strong preference for using the hot list strategy, which, therefore, dictated running Experiment 5 for Theorem 2 first before running Experiment 1, and then (out of curiosity, at least) using the corresponding resonators to run Experiment 1. Unfortunately, such a sequence of experiments (when compared with the sequence presented in this article) would have hidden the value of the hot list strategy. Still, all in all, the cited results hint at the power offered by combining the set of support strategy, the hot list strategy, and the resonance strategy. The impressive (to me) reduction in CPU time virtually demanded some additional experimentation. Of the other twenty-nine experiments that might be revisited, clearly the most charming and provocative focused on Theorem 5, for the following reason. Theorem 5 is the converse of Theorem 2, interchanging the hypothesis and conclusion of the latter. Therefore, to expect any significant decrease in CPU time to obtain a proof of Theorem 5 by using resonators from a proof of Theorem 2 is indeed counterintuitive. To provide the simplest comparison, the obvious choice from among the sequence of five experiments to revisit was the first of the five. Where in the first visiting 573 CPU-seconds were required to obtain a proof of Theorem 5, in the revisiting (with the use of the 49 resonators taken from a proof of Theorem 2) 238 CPU-seconds were required. In the first of the two runs, the completed proof has length 47 and level 16; in the second, the proof has length 33 and level 15. Of the 33 deduced steps, 6 are not present in the 47-step proof. Regarding the direct role of the resonance strategy, 18 of the 33 steps are not identical to one of the 49 resonators. In the context of resonator matching, 15 steps do not match a resonator, which (when compared with the preceding experiment in which 8 do not match) in part explains why the decrease in required CPU time was less dramatic. Prom among the remaining twenty-eight experiments meriting revisiting, I chose but three for testing the power of the resonance strategy, keying on the same forty-nine resonators; the other twenty-five must wait for future research by me or by another researcher. The first of the three focused on Theorem 4,
1546
Collected Works of Larry Wos
Experiment 1. (My emphasis on the first of the sequence of five experiments throughout this subsection is explained by the conjecture that the most inter esting results would be found in that context.) The first visit to that experiment yielded a 24-step proof of level 12 in 193 CPU-seconds, with retention of clause (1980). The revisiting (with the resonance strategy) produced a proof of length 32 and level 12 in 14 CPU-seconds, with retention of clause (917). Of the 32 deduced steps, 19 are not found among the deduced steps of the proof produced in the first visiting. Only 6 of the 32 are not identical to one of the 49 resonators, and only 5 do not match one of the resonators (in the sense used in the context of the resonance strategy in which all variables are treated as indistinguishable). Again one finds a rather impressive decrease in CPU time in the context of the first visit and the (second) revisiting, and also finds that a large fraction of the deduced steps of the proof produced by the revisiting match one of the included resonators. One could hardly call such correlations merely coincidental. The second of the three experiments focused on Theorem 1, (in effect) the converse of Theorem 4. Again, the first of the sequence of five experiments was the target. In 125 CPU-seconds, a 73-step proof of level 20 was produced, with retention of clause (1876). With the resonance strategy, only 6 CPU-seconds were required, completing a proof of length 28 and level 12, with retention of clause (817). Of the 28 deduced steps, 11 are not present in the much longer proof. Regarding the role of the resonance strategy, 10 of the 28 steps are not identical to any of the 49 resonators, and 6 do not match any of the resonators. For the final experiment (of the three relying on the 49 resonators), I chose a so-to-speak self-referential experiment. Specifically, what would occur in the contexts of CPU time and proof length when the 49 resonators taken from the proof of Theorem 2, Experiment 5, are used to influence the search for a proof of that same theorem when revisiting the same experiment? The answers are that the CPU time increased from 19 CPU-seconds to 25 CPU-seconds, but the proof length decreased from 50 to 41; the level decreased from 17 to 15 also. In the revisiting, the proof completed upon retention of clause (1834), after 56 clauses had been chosen as the focus of attention to drive the reasoning. In the first visit, the proof completed upon retention of clause (1294), after 77 clauses had been chosen as the focus of attention. Where did the extra CPU time go, in view of finding a shorter proof and focusing on fewer clauses to drive the program's reasoning? The additional 6 CPU-seconds is almost equally divided with the weighing of clauses—which is to be expected in view of the inclusion of 49 weight templates as opposed to none—and the use of the hot list strategy, which I cannot explain. The preceding data strongly supports the thesis that, through the use of the resonance strategy, deduced steps of the proof of one theorem con be of substantial value in seeking the proof of a related theorem. However, as the following data shows—and as one would almost certainly predict—the choice of resonators sometimes aids the program not at all, or even interferes with its performance. When, for example, one takes as resonators the positive steps of
OTTER
and the Moufang Identity
Problem
1547
the first proof found for Theorem 1 in Experiment 5, of which there are 27, and uses them to seek a proof of Theorem 2, Experiment 1, the performance of the program is harmed. Indeed, without the resonators, O T T E R completes a proof in 771 CPU-seconds; with the 27 resonators, the CPU time increases to 1404 CPU-seconds. Also, the proof length increases, from 55 to 64, and the level increases, from 16 to 18. But the situation often is confusing and often lacks consistency, as the following shows. When the same 27 resonators are used to seek a proof of Theorem 1, Experiment 1, the CPU time decreases to 4 CPU-seconds from 125, the proof length decreases to 33 from 73, and the level decreases to 15 from 20. 6.3.
T H E DYNAMIC H O T LIST STRATEGY
Closely related to the hot list strategy, which plays a key role in obtaining the results featured in this article, is the dynamic hot list strategy. Although I did not use the latter strategy, its use might indeed prove valuable in a study of this type and might provide an interesting research topic. McCune, recognizing the value of enabling a program to adjoin elements to the hot list during a run, extended the hot list strategy to the dynamic hot list strategy. T h e same heat parameter governs the degree to which the hot list is revisited when a new clause is retained. On the other hand, unlike the hot list strategy, a second input parameter affects the dynamic hot list strategy, namely, the dynamicJieat.weight. The dynamicheat.weight assignment places an upper bound on the pick-given weight of clauses that can be adjoined to the hot list during the run. For example, one might wish the program to add to the hot list during the run any retained clause whose pick-given weight (whether determined by a weight template or by symbol count) is less than or equal to 4. In that event, one includes the following command. assign(dynamic_heat.weight,4). A far more intriguing and intricate example concerns the case in which the researcher wishes the program to adjoin to the hot list during the run certain clauses if they are deduced and retained. As an illustration, one might wish the hot list to contain the clause equivalent of the property of commutativity of product if the corresponding equation is deduced and retained. The follow ing actions suffice. First, one begins by relying on a strategy that combines the power of the resonance strategy with that of the hot list strategy (in its dynamic incarnation); see [20]. Second, one assigns, say, the value 2 to the dy namicJieat.weight (by using the just-cited assign command with 4 replaced by 2). Finally, one includes the following. weight_list(pick_and_purge). weight(EQ(prod(x,y),prod(y,x)),2). end_of_list.
Collected Works of Larry Wos
1548
Of course, one must assign to the max_weight a value greater than or equal to 2 to permit the program to retain the clause encoding of commutativity of product, if that clause is deduced. If the cited equality clause is deduced, it will be assigned a weight of 2, of course assuming that no earlier weight template applies and that the clause is not demodulated. The clause will be retained if subsumption does not purge it. Because of having a weight of 2, which is also the value assigned to the dynamicJieat.weight parameter, the clause will be adjoined to the hot list during the run—as desired. 6.4. A N ALTERNATIVE STRATEGIC APPROACH
For studying Moufang loops and other areas in which equality plays a major role, one other strategy and one other approach merit mention. The strategy is the tail strategy [23], a strategy that gives preference to equations whose second argument is short. To instruct OTTER to use the tail strategy, one includes the following command. weight(Eq($(l),$(2)),1). The command can also be expressed in the following manner. weight«$(l) - $(2)),1). I found this strategy, formulated by McCune when he was studying equivalential calculus [16], useful in attacking problems from Robbins algebra and other areas. Regarding a sharply different alternative than used in this article, by includ ing the following command, one can rely on a Knuth-Bendix approach. set(knuth_bendix). By including the cited command, the program is instructed to continually at tempt to make all positive equalities into demodulators (rewrite rules) and, more generally, to rely (as much as possible) on seeking a complete set of reductions. Studies focusing on various aspects of group theory, for example, have profited from using Knuth-Bendix; see [9] and [18]. Unfortunately, too often, the use of this approach consumes an inordinate amount of CPU time in demodulation. Therefore, a most attractive (to me) but difficult research problem to attack con cerns some compromise between full reliance on Knuth-Bendix and full reliance on paramodulation (as shown in the included input file).
7
Proof Anomalies and Proof Conversion
The oddities and anomalies that one finds in proofs can contain clues to means for increasing program performance. Three anomalies are cited here without any suggestion regarding their significance. First, the replacement of a step re sulting from reasoning backward by one or more steps resulting from reasoning
OTTER and the Moufang Identity
Problem
1549
forward often can require the use of paramodulation rather than the use of demodulation. Indeed, sometimes the backward reasoning step benefits by fo cusing on an equation that is free of variables, thus permitting demodulation to be used. When that part of the reasoning is replaced by reasoning forward from the appropriate equations, often the program must focus on equations in which variables abound, thus requiring paramodulation, for two-way unification can be required. Before turning to the second anomaly, an example of the preceding phe nomenon is in order, an example showing how a single step of backward reason ing can require as a replacement two steps of forward reasoning. The example is taken from the replacement of steps resulting from reasoning backward by steps resulting from reasoning forward in the context of Experiment 5 focusing on the deducibility of Moufang 3 from Moufang 1 (Theorem 6). Perhaps a thorough study of the example can show how to proceed in obtaining forward proofs in a single run, rather than obtaining bidirectional or backward proofs that then are transformed into forward proofs. The first set of clauses is taken from that part of the proof where reasoning backward occurs. > UNIT CONFLICT a t 2.97 s e c > 615 [ b i n a r y , 6 1 4 . 1 , 1 0 . 1 ] $ANS(m3). 10 [] x - x. 27 [ c o p y . 2 6 , f l i p . 1 ] ((a*b)*a)*c != a* (b* ( a * c ) ) I $ANS(m3). 29,28 [ p a r a _ i n t o , 2 4 . 1 . 1 . 1 . 2 , 1 9 . 1 . 1 , d e m o d , 2 2 ] (x*y)*x ■= x* ( y * x ) . 331,330 ( h e a t - 1 ) [ p a r a . i n t o , 3 1 6 . 1 . 1 . 2 , 4 . 1 . 1 , f l i p . 1 ] r s ( r s ( x , l ) , y ) = x*y. 585,584 ( h e a t « l ) [ p a r a . i n t o , 5 7 3 . 1 . 1 . 1 . 2 . 1 , 6 . 1 . 1 , demod,271,396,331,526,129] (x* ( y * x ) ) * z - x* (y* ( x * z ) ) . 614 [ p a r a _ f r o m , 3 3 0 . 1 . 2 , 2 7 . 1 . 2 . 2 . 2 , d e m o d , 2 9 , 5 8 5 , 3 3 1 ] a* (b* ( a * c ) ) ! = a* (b* (a*c)) | $ANS(m3). To replace the cited negative equality, clause (614), the following two-step proof was used (based on forward reasoning). > UNIT CONFLICT at 0.17 sec > 25 [ b i n a r y , 2 3 . 1 , 7 . 1 ] $ANS(m3). Length of proof i s 2 . Level of proof i s 2 . PROOF 2 [] (x*y)*x - x* ( y * x ) . 3 [] (x* ( y * x ) ) * z = x* (y* ( x * z ) ) . 5 [] r s ( r s ( x , l ) , y ) - x*y. 7 [] ( ( a * b ) * a ) * c != a* (b* ( a * c ) ) I $ANS(m3). 17,16 [ p a r a _ i n t o , 5 . 1 . 2 , 2 . 1 . 2 ] r s ( r s ( x , l ) , y * x ) - (x*y)*x. 23 [ p a r a _ f r o m , 5 . 1 . 2 , 3 . 1 . 1 . 1 , d e m o d , 1 7 ] ( ( x * y ) * x ) * z - x* (y* ( x * z ) ) . Regarding a possible template for the choice and precise placement of the various clauses OTTER uses to produce the needed steps of forward reasoning, see the example given at the close of this section, just after the discussion of the third
1550
Collected Works of Larry Wos
anomaly. However, note that one may be forced to modify the template, for example, by commenting out dynamicdemod or by adding clauses to the input list of demodulators or by taking some other (not necessarily) small action. Regarding the second anomaly, when one closely examines a proof in which backward reasoning occurs, where the goal is to discover the obstacle to com pleting a proof in which only forward reasoning occurs, the following can be unearthed. The forward step merely requires the paramodulation from a clause A into a clause B to yield a clause C, which, if nothing interferes, would com plete a proof by contradiction by providing unit conflict with the negation of the conclusion or with the negation of the conclusion with its two arguments inter changed. In such an event, one might theorize that the forward proof could be obtained merely by placing in list(passive) both the negation of the conclusion and its flip, with the two arguments interchanged. When I tried an experiment of the type under discussion, the sought-after forward proof was not produced. Instead, I found that indeed paramodulation was applied from A into B, but interference took place. Specifically, before unit conflict was detected, demod ulation was applied to C, where the demodulators are a form of associativity (whose general and well-known form does not hold in Moufang loops), followed by demodulation with B. To my surprise, the result of the cited demodula tion was a clause that was an instance of reflexivity of equality and was thus subsumed by x = x, which was present in list(usable). For the third anomaly, which was discovered directly as a result of the justcited experiment, one might experience something like bewilderment by trying the following. One selects an experiment reported in this article or one selects an experiment from one's own research and revisits it with one small modification, the removal of the clause x = x for reflexivity. I was motivated to do so by the possibility that a forward proof would be discovered in the absence of reflexivity and its power for subsumption. My choice was to revisit one of the experiments featured in Section 6.2, the experiment in which forty-nine resonators were used in the study of proving Moufang 3 from Moufang 2, Experiment 5. Rather than rediscovering the 39-step proof that was found in the experiment, OTTER found a shorter proof, one of length 35. I do find such oddities piquant, disturbing, and, most of all, counterintuitive. At this point, I provide an example (as promised) of how steps resulting from reasoning backward from the negation of the conclusion can be replaced by steps whose nature is forward reasoning. The focus is on the proof of Theorem 2, Experiment 5. That proof contains one step resulting from reasoning backward from the flip of the negation of the theorem. The flip of an equality is produced by OTTER by simply interchanging the lefthand and righthand arguments. The following three clauses are present in which != occurs, the third being a deduced clause. 25 [] a* (b* (a*c)) !- ((a*b)*a)*c I $ANS(m3). 26 [copy,25,flip.1] ((a*b)*a)*c !- a* (b* (a*c)) I $ANS(m3).
OTTER and the Moufang Identity Problem
1551
138 [para_into,26.1.1.1.1,57.1.2,demod,58,28] (a* (b*a))*c != a* (b* (a*c)) | $ANS(m3). Clause (138) is used to complete the proof when considered with the following clause, clause (1294), to obtain unit conflict. 1294 (heat-1) [para.from,1281.1.1,3.1.1.1,demod,1087] (x* (y*x))*z = x* (y* (x*z)). The object is to replace clause (138) with a clause resulting from reasoning forward, a clause that gives unit conflict when considered with the negation of Moufang 3 or with its flip, clauses (25) and (26), respectively. The first step of the procedure is intended to prevent reasoning backward. Therefore, clauses (25) and (26) are placed in list(passive). Clauses in that list do not participate in the reasoning; they are used only to determine proof com pletion (by detecting unit conflict) and for forward subsumption. The next move is designed to have the paramodulation involve clause (1294) rather than clause (138); clause (138) must not be derived. With clause (26) in this converting procedure in list(passive) and from the facts that clause (57) was paramodulated into clause (26) and the result was demodulated with clause (58) and clause (28), two actions are taken. Clause (1294) is placed as the only clause in list(sos), and (the following) clauses (27) and (57) are placed in list(usable), along with the clause for reflexivity. 58,57 (heat-1) [para_into,29.1.1,9.1.1,demod,20,22,flip.1] l s ( x , l ) * y = x*y. 28,27 [para_into,23.1.1.1.1,19.1.1,demod,20] (x*y)*x = x* (y*x). A pair of numbers, such as 58,57, says that clause (58) is a copy of clause (57), the former used as a demodulator, and the latter used for paramodulation (in this case). Of course, all of the history is stripped from the clauses when they are placed in the various input lists. Also, as is obvious, no need exists for placing clauses (57) and (58) both in list(usable), for they are identical; a similar remark holds for clauses (28) and (27). What is not obvious is that none of the cited clauses is placed in list (demodulators), the reason being that I conjectured that demodulation with these clauses would not be needed. (Sometimes, to find the needed forward steps, clauses may need to be inserted into the input demodulator list.) As for options, with a few exceptions, one can use those of the experi ment that produced the proof being converted to a forward proof. One can drop the use of the hot list strategy, and one is advised to avoid the use of set(process_input), thus preventing any of the input clauses from being demod ulated. What may surprise the researcher, as it did me, is the fact that clause (27) and clause (1294) were enough to produce (by applying paramodulation) the desired clause to unit conflict with clause (26).
Collected Works of Larry Wos
1552
8
Extending Purity to the Fourth Moufang Identity
To test the possible value and scope of a new methodology, a profitable approach is to find a problem that was not in the set of problems that precipitated the study that led to formulating the methodology. This section features such a problem, brought to my attention by Ken Kunen. In particular, he notes that focusing on three equivalent Moufang identities is a historical accident, for a fourth identity [6] (the following expressed in a notation acceptable to OTTER) is of equal interest; the identity is the mirror image of Moufang 1. '/, Axiom, Moufang 4: x * ((y * z) * x) - (x * y) * (z * x). When Kunen brought this identity to my attention, he also suggested that, rather than seeking circles of pure proofs, one might search for a set of pure proofs that, if found, shows that all possible orderings of the four Moufang identities admit a corresponding circle of pure proofs. Twelve proofs are needed. One could begin by seeking a proof that Moufang 1 implies Moufang 2 such that the proof is pure with respect both to Moufang 3 and to Moufang 4, in contrast to requiring (as was the case earlier in this article) purity with respect to Moufang 3 alone. Almost immediately upon learning of this fourth identity, I applied the methodology used in this article to searching for the desired twelve proofs. Here I give the results and briefly detail some of the highlights. Rather than a sequence of experiments, my choice was to attempt to go to the heart of the matter, in particular, by focusing on the fifth experiment. After all, the approach on which the fifth experiment is based had proved the most powerful, when compared with the other four elements of the sequence of five. My plan was simply to take the corresponding input file for attacking, say, Moufang 1 implies Moufang 2 and merely add demodulators to block the use of Moufang 4. For a second illustration, for the sought-after proof of Moufang 1 from Moufang 4, the plan called for taking the input file (for Experiment 5) that includes, say, Moufang 3 as hypothesis and the negation of Moufang 1 (as the denial of the sought-after conclusion) and replacing Moufang 3 with Moufang 4 and adding two demodulators for blocking the use of Moufang 3. In most respects, the plan worked beautifully. Indeed, ten of the twelve proofs were yielded quite readily. However, the proof that Moufang 2 implies Moufang 1 that is pure with respect to both Moufang 3 and Moufang 4 and the proof that Moufang 3 implies Moufang 1 that is pure with respect to both Moufang 2 and Moufang 4 gave trouble. The culprits had to be the two demodulators that were added to block the use (in a proof) of Moufang 4, for no other change was made from the corresponding two experiments that had succeeded (as discussed earlier in this article). One of culprits in fact caused OTTER to deduce -$T, where $T denotes true; hence, the empty clause was deduced, where it was not wanted.
OTTER and the Moufang Identity Problem
1553
In order to circumvent this unfortunate occurrence, $T was replaced through out the input file by the constant junk, and a weight Jist was included containing one template, the following. weight(junk,1000) . The idea is to demodulate any unwanted clause to the constant junk (rather than to $T), and then purge any clause containing junk. Therefore, weightJist(purge_gen) was used. A smaller value than 1000 would have sufficed, as long as the value exceeded the value assigned to the max.weight. The modification succeeded, and the final two proofs (of the desired twelve) were completed. In point of fact, many of the runs yielded two proofs of the sought-after result. Measured in CPU time, the most difficult to obtain required approximately 1084 CPU-seconds (on a SPARCstation-10). The theorem was that of proving Moufang 1 from Moufang 2, and it was the second proof that required the time. That proof was sought because its use made easier the task of converting the backward-reasoning fraction of a bidirectional proof into a forward proof; see Section 7 for the approach. Its length is 48, and its level is 17. Of the set of proofs that were produced, the longest consists of 83 deduced steps; its level is 23; and the theorem is that of deducing Moufang 2 from Moufang 1, the second proof. On the other hand, some proofs were produced almost immediately, having length 2 and level 2. Summarizing, the research featured in this article suggests that use of the hot list strategy is most effective for this type of problem. Also, the use of demodu lation to prevent the participation of unwanted equations succeeds, although in a few cases its use is supplemented with the use of weighting. Finally, motivated by Kunen's suggestion, I applied the methodology for seeking pure proofs to the ensemble of the four Moufang identities, not only yielding their equivalence, but also yielding the desired twelve pure proofs. As a corollary, all orderings of the four Moufang identities admit a circle of pure proofs, for example, the ordering 1, 3, 2, 4, 1 and the ordering 1, 4, 2, 3, 1. To put totally to rest any notion that, with enough effort, CPU time, and ingenuity, pure proofs can always be found regardless of the ordering, a brief review of the study of the thirteen shortest single axioms for equivalential cal culus suffices. Were the parallel situation to hold for equivalential calculus, then one could select any two of the thirteen shortest single axioms and prove that the first implies the second with a proof that is pure with respect to the other eleven. However, quite the opposite is true. Specifically, although one can of course select any of the thirteen and prove any of the remaining twelve—for each by itself is a complete axiom system—for many pairs of formulas, purity of proof is often unobtainable, regardless of the effort, CPU time, and ingenuity involved. For a striking example of an impenetrable barrier, note that the first application of condensed detachment (the inference rule often used to study this area of logic) to the axiom known as UM with itself yields that known as XGF. Therefore, with UM as hypothesis, any sequence of deduced steps must contain
1554
Collected Works of Larry Wos
XGF as the first step, in turn implying that only one pure proof (with respect to the other shortest single axioms) is possible when condensed detachment is the inference rule in use, namely, that of XGF. Because of the use of demodulation (which captures instances of demodula tors), and because of (where needed) application of the technique of Section 7 for replacing steps of backward reasoning with steps of forward reasoning, all twelve proofs are pure even with respect to instances of the undesired equa tions, and none of the proofs contains hidden use of an unwanted equation; see the syntactic example given in Section 3.1 regarding a backward proof. In other words, among other properties, none of the proofs relies upon as an intermediate step (resulting from demodulation) the use of an equation to be avoided, which is where the outside-in demodulation comes into play. The presence of instance purity for the proofs, although not an objective, adds nicely to the result. As a final note for the curious, in the context of quasigroups rather than loops, the four Moufang identities are provably equivalent even when the two axioms regarding the identity element 1 are absent. With small modifications, the methodology presented here found a circle of pure proofs for the four iden tities, with the ordering 1, 2, 4, 3. The proofs range in length from 32 to 391 deduced steps. Their difficulty, measured in CPU time, ranges from 6 CPUseconds to 27,175 CPU-seconds; the latter time is for the theorem that asserts the deducibility of Moufang 1 from Moufang 3. Of note is the use of the res onance strategy to obtain the cited proof requiring 27,175 CPU-seconds. The resonators are those proof steps that do not mention the identity element 1 and that are from the proof that Moufang 3 implies Moufang 1 when the two axioms for the identity element 1 are present. Without the resonance strategy, even after more than 71,000 CPU-seconds, no proof was obtained. These two experiments taken together give additional evidence of the value of using for resonators proof steps from a related theorem. Quite a challenge for automated reasoning is offered by the theorem that asserts the deducibility of Moufang 3 from Moufang 2, where the two axioms for the identity 1 are absent, and where purity with respect to Moufang 1 and Moufang 4 is required; indeed, I failed to find such a proof. A similar situation is presented when Moufang 3 is the hypothesis and Moufang 2 is the conclusion.
9
Review, Conclusions, and Future Research
Featured in this article is the problem of finding, if such exist, three pure proofs that together prove the equivalence of the (first) three identities known as the Moufang identities. A proof that Moufang 1 implies Moufang 2 is pure with respect to Moufang 3 if and only if Moufang 3 is not present in the proof, explicitly or implicitly. Although Bruck supplied proofs of the equivalence of the (first) three iden tities [2], an open question remained, one that (in effect) is concerned with
OTTER and the Moufang Identity Problem
1555
the following flaw in the proofs. The equivalence was established by showing that Moufang 1 implies Moufang 2, 2 implies 3—and here is the flaw—rather than showing directly that 3 implies 1, so-to-speak two proofs were presented respectively showing that 3 implies 2 and that 2 implies 1. Aesthetically, in mathematics and in logic, when asked to establish the equivalence of a set of properties or definitions, one prefers a circle of pure proofs (as formally defined in Section 2). To answer the implied open question (focusing on the first three Moufang identities), one must order the three identities and then supply three proofs that, for the ordering, are each pure. For example, the ordering might be 1, 3, 2, which would then ask for a proof that 1 implies 3 that is pure with respect to 2, a proof that 3 implies 2 that is pure with respect to 1, and a proof that 2 implies 1 that is pure with respect to 3. This article shows that both orderings admit a circle of pure proofs, namely, 1, 2, 3, and 1, 3, 2. Perhaps equally important, the method for obtaining the required proofs with substantial assistance from McCune's program OTTER is detailed. Access to the details enables one to verify the results independently and to extend the studies on which this article is based. In addition, this in formation provides some insight for researchers who might wish to use OTTER for attacking questions totally unrelated to those featured here. To further that possibility, the Appendix offers a sample input file and four proofs (for the circle of pure proofs for the ordering 1, 2, 3, 4 of all four Moufang identities); see Sec tion 8. In Section 8, the method is successfully applied to the study of a fourth Moufang identity [6] (brought to my attention by Ken Kunen) in the context of obtaining twelve pure proofs, the proofs needed to establish that all orderings admit a circle of pure proofs. The method, through the use of demodulation outside-in, produces a bonus: The proofs are free of the use of instances of the unwanted equations, even in the context of the intermediate steps resulting from demodulation. Nor do the proofs contain the hidden use of an unwanted equa tion (as discussed in Section 3.1 where the focus is on proofs featuring reasoning backward from the denial of the theorem under study). That aspect was verified by finding steps resulting from forward reasoning to replace any that resulted from reasoning backward. I thus continue the practice of acquainting researchers with the use of OTTER and its options, showing how and why to make various choices. The three strategies that played the key role are the hot list strategy (see Section 5), the set of support strategy (see Section 5 and Section 6.1). and Mc Cune's ratio strategy (see Section 5). The first of these three strategies derives its power from rearranging the order in which conclusions are drawn, enabling the program to draw conclusions far sooner than it would otherwise. Indeed, use of the hot list strategy permits an automated reasoning program to "look ahead". The second derives its power from restricting the reasoning, thus avoiding nu merous paths of inquiry. The third strategy derives its power from combining a search based on conclusion complexity with one based on breadth first. Throughout this article, data is sprinkled regarding CPU time, clause re-
1556
Collected Works of Larry Wos
tention, proof length, and the like. As one quickly discovers, anomalies occur among the data. Research that culminates in explaining the anomalies might be quite useful in the fuller context of using an automated reasoning program to solve problems in mathematics and in logic. Such research might also shed needed light on the topic of option selection. Indeed, research that succeeds in producing some effective metarules for option choosing would clearly be signif icant. Among the features of OTTER covered here, features that can be put to good use in a variety of contexts, are techniques for blocking the use of unwanted equations or formulas and diverse strategies for increasing the effectiveness of an automated reasoning program. Of the two techniques for preventing the participation of an unwanted equation or formula, weighting and demodulation, the latter can be used to guarantee one's objective, where the former (though useful) admits loopholes. The picture and subtleties are discussed in some detail in Section 3. In the context of future research, Section 6.2 focuses on the resonance strat egy, a strategy that encourages the user of the program to supply symbol pat terns (in the input) that can sharply influence the preference given to retained conclusions. The preference or priority assigned to retained conclusions directs the program in its choice of where next to focus its attention. Also of interest for future research is the dynamic hot list strategy (see Section 6.3), formulated by McCune as an extension of the hot list strategy. This strategy enables an automated reasoning program to adjoin new clauses to the hot list during the run. Although the question central to this article was answered by finding two circles of pure proofs (for the first three Moufang identities), many of the proofs lacked one aesthetic property. In particular, many of the proofs (obtained in the primary runs) contained a step resulting from reasoning backward from the negation of the conclusion to be proved, and, occasionally, two such steps were present. Therefore, to satisfy the aesthetic constraint of having access to proofs all of whose steps result from forward reasoning, additional runs were needed; see Section 7. An interesting and challenging research topic focuses on finding some means to obtain in a single run the desired forward proof, for each of the six theorems that were featured in this article. Also meriting research is the study of "short" proofs and the study of "elegant" proofs; the two properties are often tightly coupled, but not necessarily. The strategies discussed in this article have proved useful for research of the type just cited. The data presented here support various conclusions. First, quite likely, the question central to this article would still be open were it not for McCune's pro gram OTTER. Second, of a more general character, the data given throughout this article provides substantial evidence of the power of the hot list strategy, of the power of the set of support strategy, and of the virtual requirement of using strategy when attacking deep questions and hard problems with such a program. Indeed, a glance at the CPU times with and without the strategies
OTTER and the Moufang Identity Problem
1557
is most encouraging regarding the value of strategy. No longer is memory the obstacle to effective research with the assistance of a reasoning program; CPU time is the dominant concern.
Appendix To aid and stimulate research, I present here a sample input file (for use with McCune's program OTTER) and the four proofs of which the first circle con sists, for the ordering 1, 2, 3, 4 of the four Moufang identities. The follow ing sample input file provides a beginning. When a line contains a "%", the characters from the first "%" to the end of the line are treated by the pro gram as a comment. In the proofs, two copies of an input clause denotes its presence in two input lists, one of which is the hot list. Also, as an example, [paraJnto,24.1.1.1.2,19.l.l.demod,22] says that clause (2 4) is the into clause, clause (19) is the from clause, and clause (22) is used as a demodulator. The notation 24.1.1.1.2 says that the term of interest is the second subargument of the first subargument of the first argument of the first literal. When OTTER lists in a proof a pair of numbers, such as 28,27, to designate the clause number of a retained clause, the clause is used both as a demodulator and as a parent in the application of some inference rule; the higher number designates the use as a demodulator.
1558
Collected Works of Larry Wos
Sample Input File op(400,ifx, *) . '/. make all association explicit '/, set (ur.res). '/. The following two commands prevent paramodulation involving a '/, nonunit clause. set(para_into_units_only). set(para_from_units_only). set(para_into). X Paramodulate \fIinto\fR the chosen clause. set(para_from). '/. Paramodulate \f Ifrom\fR the chosen clause. set (order_eq) . X Flip arguments if righthand heavier than */. lefthand. set(dynamic_demod). X Adjoin demodulators during the run. X set(back_demod). X Apply new demodulators to retained clauses. set(lrpo). X Activate the LRPO ordering for orienting '/, equalities and deciding dynamic demodulators. set(demod_out_in). X Demodulate from outside to inside. set(process_input). Treat input clauses as if they were X generated by applying an inference rule. clear(print.kept). X Do not enter in the output file clauses V, as they are retained. lex([$T,a,b,c,d,e.l._»_,rs(_,_),ls(_,_),-(_,_)]). X Order the '/. symbols for demodulation. assign(max_weight,20). % Limit the complexity of retained clauses. assign(max_mem,20000). X Limit the memory use to 20 megabytes. assign(pick_given_ratio,3). X Three clauses are chosen by X weight and one by breadth first, repeatedly. as8ign(max_proofs,2). X Limit the number of completed proofs X to 2. as8ign(report,90). X Every 90 CPU seconds, write a statistical X summary into the output file. assign(heat,l). X Limits the recursion through the hot list. X The following list can be used to purge unwanted equations X of various types. X weight_list(purge_gen). X Blocking use of Moufang 1. X weight(((x * y) ♦ (z » x) - (x * (y * z)) * x),1000). X Blocking use of Moufang 2. X weight(((x * y) * z) * y - x * (y * (z * y)),1000). X Blocking use of Moufang 3. X weight((x • (y » (x » z)) - ((x ♦ y) * x) * z),1000). X end_of_list.
OTTER and the Moufang Identity Problem
*/, Used to complete applications of inference rules. list(usable). x « x. x * rs(x,y) - y. V. right solvable rs(x, x * y) » y. '/, right solution is unique 7, (implies left cancellation) ls(x,y) * y « x. '/, left solvable ls(x * y , y) - x. '/, left solution is unique 7, (implies right cancellation) '/. identity: 1 »x - x. X * 1 - X.
7. left cancellation '/, x»y !» u I x»z != u 7, right cancellation 7, y*x !- u I z*x != u end.of_list.
I y » z. I y « z.
'/. Used to initiate applications of inference rules. list(sos). '/, A consequence of left and right surjective: '/, It's all that is needed here. '/. x ♦ R(x) - 1. X L(x) * x = 1. '/, The following negate left and right inverse. 7. d « y !- 1. •/. y » e !- 1. '/, actually, L and R turn out to be the same in a Moufang loop '/, Axiom, Moufang 1: '/. (x * y) * (z * x) =■ (x * (y » z)) ♦ x. '/, Axiom, Moufang 2: ((x » y) * z) * y = x » (y * (z * y)). 7. Axiom, Moufang 3: '/, x * (y * (x * z)) = ((x * y) * x) » z. '/, Axiom, Moufang 4: % x * ((y * z) * x) = (x » y) * (z * x ) .
1559
1560 7. Negation Axiom, Moufang 1: 7. ((a * b) * (c » a) !- (a * (b * c)) * a)
Collected Works of Larry Wos
I $ANS(ml).
'/, Negation Axiom, Moufang 2: 7. ((a * b) * c) ♦ b !- a ♦ (b * (c * b)) I $ANS(m2). 7, Negation Axiom, Moufang 3: a * (b * (a * c)) !« ((a » b) * a) * c I $ANS(m3). 7. Negation Axiom, Moufang 4: 7. a « ((b * c) * a) !- (a » b) * (c ♦ a) I $ANS(m4). end_of_list. 7. Used mainly to detect proof completion and to monitor progress. 7. list (passive). 7. ((a * b) * (c * a) !- (a * (b * c)) * a) I $ANS(ml). 7. ((a * b) ♦ c) * b !- a * (b * (c ♦ b)) I $ANS(m2). 7. a » (b * (a * c)) !- ((a * b) ♦ a) * c I $ANS(m3). % a * ((b * c) * a) !- (a * b) « (c » a) I $ANS(m4). 7. end_of_li8t.
7, The following list can be used to purge unwanted equations % of various types. list(demodulators). 7, Blocking use of Moufang 1. EQ(((x * y) * (z * x) « (x * (y * z)) ♦ x ) , $T). EQ(((x ♦ (y * z)) ♦ x - ((x » y) » (z * x))). $T). 7. Blocking use of Moufang 2. 7. EQ((((x * y) » z) » y - x * (y ♦ (z * y))), $T). 7. EQ(((x * (y » (z ♦ y))) - (((x * y) ♦ z) ♦ y)), IT). 7. Blocking use of Moufang 3. 7. EQ((x • (y * (x * z)) - ((x ♦ y) * x) * z), $T). 7. EQ((((x ♦ y) * x) » z - x ♦ (y ♦ (x * z))), $T) . 7, Blocking use of Moufang 4. EQ((x » ((y * z) * x) - (x ♦ y) » (z » x)). $T). EQ(((x « y) * (z * x) - x * ((y ♦ z) * x)). $T). end_of_list. 7, Used for the hot list strategy. list(hot). '/, Axiom, Moufang 1: % (x * y) * (z » x) - (x ♦ (y ♦ z)) « x.
OTTER and the Moufang Identity
Problem
1561
'/, Axiom, Moufang 2: ((x * y) * z) * y = x » (y » (z * y)). 7. Axiom, Moufang 3: 7. x » (y * (x ♦ z)) = ((x * y) * x) » z. 7, Axiom, Moufang 4: 7. x * ((y « z) * x) =» (x » y) * (z * x). x * rs(x,y) ■ y. '/, right solvable rs(x, x * y) » y. 7, right solution is unique (implies left cancellation) ls(x,y) * y » x. 1. left solvable ls(x * y , y) » x. 7, left solution is unique (implies right cancellation) '/, identity: I * x = x . x ♦ 1 - x. end.of.list.
Four Proofs in Order for the First Circle for the Four Moufang Identities
Moufang 1 implies Moufang 2 Otter 3.0.4, August 1995 The job was started by voa on merlin.mcs.anl.gov, Thu Aug 31 21:36:46 1995 The command was "otter304". > UNIT CONFLICT at 3.96 sec > 616 [binary,615.1,12.1] $ANS(m2). Length of proof is 29. Level of proof is 14. PROOF 6 [] x*rs(x,y) = y. 7 [] rs(x,x»y) = y. 8 [] ls(x,y)*y = x. 9 [] ls(x*y,y) = x. 10 [] l*x - x. II [] x*l - x. 12 [] x = x. 13 [] x*rs(x,y) = y. 16,15 [] rs(x,x*y) = y. 17 [] ls(x,y)»y - x. 19 [] ls(x*y,y) = x.
1562
Collected Works of Larry Wos
22,21 [] l*x » x. 24,23 [] x*l - x. 25 [] (x*y)* (z*x) - (x* (y*z))*x. 26 [copy,25,flip.1] (x» (y»z))*x - (x*y)« (z*x). 28 [] ((a*b)*c)*b !- a» (b» (c*b)) I $ANS(m2). 30,29 [para.into,26.1.1.1.2,21.1.1,demod,24] (x*y)*x - x* (y*x). 31 [para.into,26.1.1.1.2,17.1.1,demod,30,flip.1] ( x * l s ( y , z ) ) « (z*x) - x* (y*x). 33 [para_into,26.1.1.1.2,13.1.1,demod,30,flip.l] (x*y)* (rs(y,z)*x) - x* (z*x). 37 [para_into,26.1.2.1,13.1.1,damod,30] x* ((rs(x,y)*z)*x) = y*(z*x). 43 (heat-l) [para_into,29.1.1.1,6.1.1,flip.1] x* (rs(x,y)»x) = y*x. 47,46 (heat-l) [para.from,29.1.1,9.1.1.1] ls(x» (y»x),x) = x*y. 70,69 (heat-l) [para_from,33.1.1,7.1.1.2] rs(x»y,x* (z»x)) = rs(y,z)*x. 113 [para_fron,26.1.1,15.1.1.2] ra(x* (y*z),(x*y)* (z*x)) = x. 126,125 (heat-l) [para_into,113.1.1.2.1,ll.l.l,demod,70,22]
rs(x,x)»y = y. 136,135 [para.into,125.1.1,23.1.1] r s ( x . x ) - 1. 176 [para.from,43.1.1,15.1.1.2] rs(x,y*x) ■ rs(x,y)*x. 204 (heat-l) [para.into,176.1.1.2,10.1.1.demod,136,flip.1] r 8 ( x , l ) * x » 1. 209 [para.from,204.1.1,26.1.2.2,demod,30,24] x* ( ( y * r s ( x , l ) ) » x ) - x*y. 213 [para.from,204.1.1,26.1.2.1,demod,30,22] r s ( x . l ) * ((x*y)*rs(x,D) - y » r s ( x , l ) . 216,215 [para.from,204.1.1,19.1.1.1] l s ( l . x ) - r e ( x . l ) . 223 (heat-l) [para.from,209.1.1,7.1.1.2,demod,16,flip.1] ( x * r s ( y , l ) ) * y « x. 244 (heat-l) [para.from,213.1.2,9.1.1.1,demod,47] r s ( x , l ) « (x*y) - y. 246 [para.from,31.1.1,15.1.1.2,demod,70] r s ( l s ( x , y ) , x ) * z = y*z. 248 (heat-l) [para.into,246.1.1,11.1.1,demod,24] r s ( l s ( x , y ) , x ) - y. 258 [para.into,223.1.1.1.2,248.1.1,demod,216] (x*y)*rs(y,l) = x.
OTTER and the Moufang Identity
Problem
1563
267,266 (heat-1) [ p a r a . i n t o , 2 5 8 . 1 . 1 . 1 , 8 . 1 . 1 , f l i p . 1 ] ls(x,y) » x*rs(y,l). 268 (heat-1) [para_into,258.1.1.1,6.1.1] x*rs(rs(y,x),1) - y. 312 [para.into,244.1.1.1,248.l.l.demod,267,22] x* (rs(x,l)*y) - y. 326 (heat-1) [para.into,312.1.1.2,6.1.1,flip.1] r s ( r s ( x , l ) , y ) - x»y. 523 [para_from,268.1.1,37.1.1.2.1,flip.l] x* ( r s ( r s ( y , r s ( z , x ) ) , l ) » z ) ■ z* (y*z). 528,527 [para_from,268.1.1,244.1.1.2,flip.1] rs(rs(x,y),l) - rs(y,l)*x. 530,529 (heat-1) [para.from,523.1.1,7.1.1.2,demod,528,528] rs(x,y* (z*y)) » ((rs(x,l)*y)*z)*y. 615 [para.from,326.1.2,28.1.2,demod,530,528,126] ((a»b)»c)*b != ((a*b)*c)*b I $ANS(m2). 616 [binary,615.1,12.1] $ANS(m2). Moufang 2 implies Moufang 3 Otter 3.0.4, August 1995 The job was started by wos on merlin.mcs.anl.gov, Thu Aug 31 21:39:13 1995 The command was "otter304". > UNIT CONFLICT at 19.30 sec > 1279 [binary,1277.1.140.1] $ANS(m3). Length of proof is 51. Level of proof is 17. PROOF 5 [] ((x*y)*z)*y 6 [] x*rs(x,y) = 7 [] rs(x,x*y) » 8 [] ls(x,y)*y 9 [] ls(x*y,y) = 10 [] l*x - x. 11 [] x*l - x.
13 [] 15 [] 18,17 19 [] 22,21
«= x* (y* (z*y)). y. y. x. x.
x»rs(x,y) = y. rs(x,x*y) = y. [] l s ( x , y ) * y = x. ls(x*y,y) = x. [] l*x - x.
1564
Collected Works of Larry Wos
24,23 [] x*l - x. 25 [J ((x*y)*z)*y = x» (y* (z*y)). 27 [] »♦ {b* (a»c)) !- ((a*b)*a)»c I $ANS(m3). 28 [copy,27,flip. 1] ((a»b)*a)*c !- a* (b* (a*c)) I $ANS(m3). 30.29 [para_into,25.1.1.1.1,21.1.1,demod,22] (x*y)*x « x* (y*x). 31 [para_into,25.1.1.1.1,17.1.1] (x»y)*z - l s ( x . z ) * (z» (y*z)). 32 [para.into.25.1.1.1.1,13.1.1] (x*y)*rB(z,x) z» ( r s ( z . x ) * ( y * r 8 ( z , x ) ) ) . 36,35 [para.into,25.1.1.1,23.1.1,demod,22] (x*y)*y - x* (y*y). 38,37 [para.into.25.1.1.1.13. l . l . f l i p . 1 ] x» (y» (rs(x*y,z)*y)) » z*y. 41 (heat-1) [ p a r a . i n t o , 2 9 . 1 . 1 . 1 , 6 . 1 . 1 , f l i p . 1 ] x* (rs(x,y)*x) - y*x. 60,59 (heat-1) [para.into,31.1.1,11.1.1,demod,22,24,flip.1] l s ( x , l ) * y - x»y. 70 (heat-1) [para_from,31.1.2,7.1.1.2] r s ( l s ( x , y ) , ( x * z ) * y ) - y* (z*y). 110 (heat-1) [para_from,35.1.1,7.1.1.2] rs(x*y,x* (y*y)) = y. 120 [para_from,25.1.1,19.1.1.1] l s ( x * (y» (z*y)),y) - (x*y)*z. 122 [para_from,25.1.1,15.1.1.2] rs((x»y)*z,x* (y* (z*y))) = y. 129,128 (heat-1) [ p a r a . i n t o , 1 2 0 . 1 . 1 . 1 , 8 . 1 . 1 , f l i p . 1 ] ( l s ( x , y * (z*y))*y)*z - l s ( x , y ) . 136 (heat-1) [para.into,122.1.1.2,8.1.1,demod,129] r s ( l s ( x , y ) , x ) - y. 138 [para.into,59.1.1,23.1.1,demod,24] l s ( x , l ) « x. 140 [para.into,28.1.1.1.1,59.1.2,demod,60,30] (a* (b*a))»c !- a* (b* (a*c)) I $ANS(m3). 142,141 [para.from,138.1.1,136.1.1.1] r s ( x , x ) - 1. 216 [para_from,41.1.1,31.1.2.2] (x*rs(y,z))*y - l s ( x . y ) * (z*y). 223 [para.from,41.1.1,15.1.1.2] rs(x,y*x) - rs(x,y)»x. 230 (heat-1) [para.into,216.1.2.2,10.1.1,demod,18] ( x * r s ( y , l ) ) * y - x. 260 (heat-1) [para.into,223.1.1.2,10.1.1,demod,142,flip.1] r s ( x , l ) * x - 1. 276 [para.into,260.1.1.1.136.1.1] x * l s ( l , x ) - 1. 281,280 (heat-1) [para.from,276.1.1,7.1.1.2,flip.1] l s ( l . x ) - rs(x.l).
OTTER and t i e Moufang Identity
Problem
286 [para_from,260.1.i,25.1.1.1.1,demod,22,flip.l] r s ( x , l ) » (x* (y*x)) - y»x. 288 [para.from,260.1.1,15.1.1.2] r s ( r 8 ( x , l ) , l ) « x. 299 (heat-1) [para.into,286.1.1.2.2,8.1.1,demod,18] r s ( x . l ) * (x*y) - y. 305 [para.from,276.1.1,31.1.2.2.2,demod,281,281,24,281,18] (x*y)*rs(y,l) - x. 308,307 (heat-1) [ p a r a . i n t o , 3 0 5 . 1 . 1 . 1 , 8 . 1 . 1 , f l i p . 1 ] ls(x.y) - x*rs(y,l). 309 (heat=l) [para.into,305.1.1.1,6.1.1] x»rs(rs(y,x),1) - y. 339 [para.into,37.1.2,31.1.2,demod,38,308] (x*ra(y,l))* (y« (z*y)) - (x*z)»y. 348,347 (hoat-1) [para.into,339.1.1.2.2.8.l.l.domod,308,flip. 1] (x» ( y * r s ( z , l ) ) ) * z - ( x * r s ( z , l ) ) » (z*y). 361 [para.into,230.1.1.1,32.l.l.domod,30,348,22] x» ( ( r a ( x , l ) * r a ( x , l ) ) * (x»y)) - y. 366,365 [para.into,230.1.1.1,29.1.1,demod,348] ( r s ( x , l ) » r s ( x , l ) ) » (x»y) - r a ( x , l ) » y . 370 (heat-1) [para.from,361.1.1,7.1.1.2,demod,366] r8(x,y) - ra(x,l)»y. 392 [para.into,299.1.1.1,288.1.1] x» ( r s ( x , l ) * y ) - y. 407 [para.into,299.1.1.2,13.1.1] r s ( x , l ) * y - r s ( x . y ) . 409,408 (hoat-1) [ p a r a . i n t o , 3 9 2 . 1 . 1 . 2 , 6 . 1 . 1 , f l i p . 1 ] r a ( r 8 ( x , l ) , y ) = x*y. 437 (heat-1) [para.from,407.1.1,9.1.1.1,demod.308] ra(x,y)*ra(y,l) = r s ( x . l ) . 446 [para.from,299.1.1,19.1.1.1,demod,308] x«ra(y*x,l) » r s ( y , l ) . 463 (heat-1) [para.from,446.1.1.7.1.1.2,flip.1] ra(x*y,l) - r 8 ( y , r a ( x , l ) ) . 536,535 [para.from,309.1.1,299.1.1.2,tlip.1] ra(ra(x,y),l) » ra(y,l)*x. 613 [para.from,370.1.2,35.1.2.2,demod,36,flip.1] x*ra(y,r8(y,D) ■» x* ( r 8 ( y , l ) * r s ( y , D ) . 652,651 (heat-1) [para.into,613.1.1,8.1.1,demod,308,536,536, 36,142,22,flip. 1] (x* (y*y))» ( r 8 ( y , l ) * r s ( y , D ) - x. 963 [para.from,437.1.1,110.1.1.1,demod,409] x* ( r s ( x . y ) * ( r s ( y , l ) » r 8 ( y , l ) ) ) - r s ( y . l ) .
1473
1566
Collected Works of Larry Wos
995,994 (heat-1) [para.from,963.1.1,7.1.1.2] r s ( x , r s ( y , l ) ) « rs(x,y)« ( r s ( y , l ) * r s ( y , l ) ) . 1023,1022 [para.from,463.1.1,407.1.1.1,demod,995,flip.1] rs(x*y,z) - ( r s ( y . x ) * ( r s ( x , l ) * r s ( x , l ) ) ) * z . 1063,1062 [para.from,535.1.1,407.1.1.1,flip.1] r8(rs(x.y),z) - (rs(y,l)*x)*z. 1074 [para.from,535.1.2,37.1.1.2.2.1.1,demod,1063.142,22] r s ( x . l ) * (y* ((rs(y,x)*z)*y)) - z*y. 1077.1076 (heat-1) [para.from,1074.1.1.7.1.1.2.demod.1063, 142,22.flip.1] x* ((rs(x,y)*z)*x) - y* (z»x) . 1270 [para.into,70.1.1.2.1,407.1.1,demod,308,1023,995,652, 1063,142.22] (x*y)» (rs(y,z)*x) - x» (z*x). 1277 (heat-1) [para.from,1270.1.1,5.1.1.1,demod,1077] (x* (y«"x))*z - x* (y» (x*z)). 1279 [binary,1277.1,140.1] $ANS(m3). Moujang 3 implies Moufang 4 Otter 3 . 0 . 4 , August 1995 The job was started by wos on merlin.mcs.anl.gov, Thu Aug 31 15:53:30 1995 The command was "otter304". > UNIT CONFLICT at 10.56 sec > 1133 [binary,1132.1,28.1] $ANS(m4). Length of proof i s 30. Level of proof i s 13. pR00F 5 [] (x*y)* (z*x) = (x* (y*z))*x. 6 [] x*rs(x,y) - y. 7 [] rs(x,x*y) - y. 8 [] l s ( x , y ) * y - x. 9 [] l s ( x * y , y ) = x. 10 [] l*x - x. 11 [] x*l - x. 14,13 [] x*rs(x,y) - y. 16,15 [] rs(x,x*y) «= y. 20,19 [] ls(x*y,y) - x. 22.21 [] l*x « x. 24.23 [] x*l - x. 25 [] x» (y* (x*z)) - ((x*y)»x)*z.
OTTER and the Moufang Identity
Problem
27,26 [copy,25,flip.1] ((x*y)*x)*z - x* (y* (x*z)). 28 [] a* ((b*c)*a) != (a«b)» (c*a) I $ANS(m4). 29 [para.into,26.1.1.1.1,23.1.1,demod,22] (x*x)*y - x* (x*y). 34,33 [ p a r a . i n t o , 2 6 . 1 . 1 . 1 . 1 , 1 3 . l . l . f l i p . 1 ] x* ( r s ( x . y ) * (x*z)) - (y*x)*z. 36,35 [para.into,26.1.1,23.1.1,demod,24] (x*y)*x » x* (y*x). 37 [para_into,26.1.1,13.1.1,demod,36,flip.1] x* (y* (x*rs(x* (y*x),z))) « z. 39 (heat-1) [ p a r a . i n t o , 2 9 . 1 . 1 , 6 . 1 . 1 , f l i p . 1 ] x* (x*rs(x«x,y)) = y. 43 (heat=l) [para.from,29.1.1,7.1.1.2] rs(x*x,x* (x*y)) » y. 58 (heat-1) [para.into,33.1.1.2.2,11.1.1,demod,24] x* (rs(x,y)»x) = y»x. 65 (heat-1) [para_into,33.1.2.1,5.1.2,demod,34,27,flip.1] ((x»y)» (z*x))*u = x* ((y*z)» (x*u)). 70,69 (heat-1) [para_from,33.1.1,7.1.1.2] rs(x,(y»x)*z) = rs(x,y)» (x*z). 83,82 (heat«l) [para_from,35.1.2,5.1.2.1,demod,27] (x*y)* (x*x) = x» (y» (x»x)). 91,90 (heat=l) [ p a r a . i n t o , 3 7 . 1 . 1 . 2 . 2 . 2 , 7 . 1 . 1 , f l i p . 1 ] (x* (y*x))*z = x* (y« (x»z)). 103 [para.from,26.1.1,19.1.1.1,demod,36] l s ( x * (y* (x»z)),z) - x» (y*x). 114,113 (heat-1) [para.into,103.1.1.1.2,8.1.1] l s ( x * y , z ) - x* ( l s ( y , x * z ) * x ) . 115 (heat-1) [para.into,103.1.1.1,10.1.1,demod,114,114,91, 22,22,22,22,24] x» (ls(y,x*y)*x) - x. 120,119 (heat-1) [para.from,103.1.2,5.1.2.1,demod,83,114, 3 6 . 2 0 , f l i p . 1 ] x* ((y*x)*x) - x* (y* (x*x)). 147 [para.from,29.1.1,19.1.1.1,demod,114,114,36,120] x* (x* ( l s ( y , x * (x*y))» (x»x))) - x*x. 151 [para.from,29.1.2,15.1.1.2,demod,70] r s ( x . x ) * (x*y) - x*y. 154,153 (heat-1) [para.into,147.1.1.2.2.1.2.2,10.1.1,demod, 22,22,22,24,24,24] l s ( x . x ) - 1. 176,175 (heat-1) [para.from,151.1.1,9.1.1.1,demod,154,flip.1] rs(x,x) » 1. 239 [para.from,39.1.1,IS.1.1.2,flip.l]x*rs(x*x,y) - r s ( x , y ) . 258,257 (heat-1) [para.from,239.1.1,7.1.1.2,flip.1] rs(x*x,y)» r a ( x , r s ( x , y ) ) .
1567
Collected Works of Larry Wos
1568 273
[para.from.58.1.1,43.1.1.2.2,demod,258,16] rs(x,y*x) = r s ( x , y ) » x . 292,291 (heat-1) [ p a r a _ i n t o , 2 7 3 . 1 . 1 . 2 , 1 0 . 1 . 1 , d e a o d , 1 7 6 , f l i p . l ] r s ( x , l ) * x - 1. 356 [para.from,291.1.1.33.1.1.2.2,demod,24,14,flip.l] (x*r8(y,l))»y - x. 360 [para.from,291.1.1,26.1.1.1.1,demod.22,flip.1] r s ( x , l ) » (x* ( r s ( x , l ) * y ) ) » r s ( x , l ) * y . 367,366 (heat-1) [para.from,356.1.1.9.1.1.1] ls(x.y) - x*rB(y,l). 373 (heat-1) [para.into,360.1.1.2.2,6.1.1,demod,14] r s ( x , l ) « (xfy) - y. 553,552 [para.from,373.1.1,19.1.1.1,demod,367] x*rs(y*x,l) - r 8 ( y , l ) . 1132 [para.from,65.1.1.115.1.1,demod,367,553,292.24] x* ((y*z)*x) - (x*y)« (z*x). 1133 [binary,1132.1,28.1] $ANS(m4). Moufang 4 implies Moufang 1 Otter The job was Wed Sep The command
3 . 0 . 4 , August 1995 s t a r t e d by wos on merlin.mc8.anl.gov, 6 10:14:31 1995 was "otter304".
> UNIT CONFLICT a t 0.31 sec > 124 [binary,123.1,12.1] $ANS(ml). Length of proof i s 3. Level of proof i s 2. PROOF 12 [] x - x. 22,21 [] l*x - i . 23 [] x*l - x. 25 [] x* ((y»z)*x) - (x*y)» (z*x). 26 [] (a*b)» (c*a) !- (a* (b*c))*a I $ANS(ml). 27 [copy,26,flip.1] (a* (b«c))»a !- (a*b)* (c*a) I $ANS(ml). 29,28 [para_into,25.1.1.2.1,23.1.1,demod,22,flip.l] (x*y)*x - x* (y*x). 123 [para_into.27.1.2,25.1.2,demod,29] a» ((b*c)*a) !- a* ((b*c)*a) I $ANS(ml). 124 [binary,123.1,12.1] $ANS(ml).
OTTER and the Moufang Identity Problem
1569
References 1. Boyer, R. S., and Moore, J S., A Computational Logic Handbook, Academic Press: New York, 1988 (also Web information http://www.cli.com/software/nqthm/ obtaining.html). 2. Bruck, R. H., A Survey of Binary Systems, Springer-Verlag: Berlin, 1971. 3. Chein, O. Moufang Loops of Small Order, Memoirs of the American Mathe matical Society 13, issue 1, no. 197, January 1978. 4. Chein, O., Pflugfelder, H. 0., and Smith, J. D. H., Quasigroups and Loops: Theory and Applications, Heldermann Verlag: Berlin, 1990. 5. Fenyves, F., "Extra loops I, Publicationes Mathematicae Debrecen 15, 235238 (1968). 6. Fenyves, F., "Extra loops II, Publicationes Mathematicae Debrecen 16, 187192 (1969). 7. Kunen, K., Private communication (1994). 8. McCharen, J., Overbeek, R., and Wos, L., "Complexity and related enhance ments for automated theorem-proving programs, Computers and Mathematics with Applications 2, 1-16 (1976). 9. McCune, W., and Wos, L., "Application of automated deduction to the search for single axioms for exponent groups, pp. 131-136 in Logic Programming and Automated Reasoning, Lecture Notes in Artificial Intelligence, Vol. 624, ed. A. Voronkov, Springer-Verlag: New York, 1992. 10. McCune, W., OTTER 3.0 Reference Manual and Guide, Technical Report ANL-94/6, Argonne National Laboratory, Argonne, Illinois, 1994. 11. Moufang, R. "Zur Struktur von Alternativkorpern, Math. Ann. 110, 416430 (1935). 12. Padmanabhan, R., and McCune, W., "Automated reasoning about cubic curves, Computers and Mathematics with Applications (special issue on auto mated reasoning) 29, no. 2, 17-26 (January 1995). 13. Padmanabhan, R., and McCune, W., "Single identities for ternary Boolean algebras, Computers and Mathematics with Applications (special issue on auto mated reasoning) 29, no. 2, 13-16 (January 1995). 14. Pflugfelder, H. O., Quasigroups and Loops: Introduction, Heldermann Verlag: Berlin, 1990.
1570
Collected Works of Larry Wos
15. Wos, L., Automated Reasoning: 33 Basic Research Problems, Prentice-Hall: Englewood Cliffs, N.J., 1987. 16. Wos, L., "Meeting the challenge of fifty years of logic, J. Automated Rea soning 6, no. 2, 213-222 (1990). 17. Wos, L., Overbeek, R., Lusk, E., and Boyle, J., Automated Reasoning: In troduction and Applications, 2nd ed., McGraw-Hill: New York, 1992. 18. Wos, L., "Automated reasoning answers open questions, Notices of the A MS 5, no. 1, 15-26 (January 1993). 19. Wos, L., "The kernel strategy and its use for the study of combinatory logic, J. Automated Reasoning 10, no. 3, 287-343 (June 1993). 20. Wos, L., "The power of combining resonance with heat, J. Automated Rea soning (accepted for publication). 21. Wos, L., "The resonance strategy, Computers and Mathematics with Ap plications (special issue on automated reasoning) 29, no. 2, 133-178 (January 1995). 22. Wos, L., "Searching for circles of pure proofs, J. Automated Reasoning (ac cepted for publication). 23. Wos, L., The Automation of Reasoning: An Experimenter's Notebook with OTTER Tutorial, accepted for publication by Academic Press (1996).
Automating t h e Search for Elegant Proofs LARRY WOS* Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, IL 60439-4844, U.S.A. e-mail: [email protected] (Received: 3 January 1997) Abstract. The research reported in this article was spawned by a colleague's request to find an elegant proof (of a theorem from Boolean algebra) to replace his proof consisting of 816 deduced steps. The request was met by finding a proof consisting of 100 deduced steps. The methodology used to obtain the far shorter proof is presented in detail through a sequence of experiments. Although clearly not an algorithm, the methodology is sufficiently general to enable its use for seeking elegant proofs regardless of the domain of study. In addition to (usually) being more elegant, shorter proofs often provide the needed path to constructing a more efficient circuit, a more effective algorithm, and the like. The methodology relies heavily on the assistance of McCune's automated reasoning program OTTER. Of the aspects of proof elegance, the main focus here is on proof length, with brief attention paid to the type of term present, the number of variables required, and the complexity of deduced steps. The methodology is iterative, relying heavily on the use of three strategies: the resonance strategy, the hot list strategy, and McCune's ratio strategy. These strategies, as well as other features on which the methodology relies, do exhibit tendencies that can be exploited in the search for shorter proofs and for other objectives. To provide some insight regarding the value of the methodology, I discuss its successful application to other problems from Boolean algebra and to problems from lattice theory. Research suggestions and challenges are also offered. Key words: automated reasoning, elegant proofs, Otter, Boolean algebra.
1
Problem Origin
Two independent themes are central to this article. One is concerned with ev idence of advances made in automated reasoning, and the other is concerned with a methodology for attacking the general problem of finding shorter proofs. Though independent, both themes are addressed by a single success with a 'This work was supported by the Mathematical, Information, and Comp utational Sci ences Division subprogram of the Office of Computational and Techno logy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted from the Journal of Automated Reasoning, Vol. 21, 135-175 (1998) with kind permission from Kluwer Academic Publishers.
Collected Works of Larry Wos
1572
specific problem posed by W. McCune. Using his program OTTER [5, 6, 7], McCune had obtained an 816-step proof of a theorem in Boolean algebra; he calls the theorem DUAL-BA-3 in a recent monograph by him and his colleague R. Padmanabhan [8]. The problem he posed to me was to find a far more elegant proof than his 816-step proof, with the focus strictly on proof length. This article shows how the request was met by finding a proof of length 100, details the methodology that was used, and demonstrates that automated reasoning has met an important test measuring its advance. 1.1
MEASURING PROGRESS
The early years of a field are quite often occupied with developing the theory, for mulating necessary components, and—where a computer is involved—designing and implementing programs. Eventually, however, the field must be evaluated. In the case of automated reasoning, crucial to an evaluation is the testing of its programs on problems supplied by others. By solving a problem supplied by an other researcher (in this case, McCune), I provide yet more evidence of the value of automated reasoning. The successful gathering of the evidence is especially appealing—even piquant—because McCune also designed and implemented the very program, OTTER, I used to solve the problem he posed. 1.2
A METHODOLOGY OR AN ALGORITHM?
Although the problem that is solved concerns the finding of an elegant proof for a specific theorem, where elegance focuses solely on proof length, the research that produced the desired solution also resulted in the formulation of a general methodology for automating the search for elegant proofs, where elegance is not confined to proof length. Where proof length is the concern, the methodology is iterative, usually beginning with a "long" proof and, if the methodology suc ceeds, culminating with a "short" proof. As shown in Section 4, later stages of the methodology use results obtained in earlier stages; for example, the proof steps of a proof completed in Experiment j are used to guide the search for a shorter proof in Experiment A:, where j is less than k. Ideally, the world wishes access to an algorithm. Perhaps disappointing to some, the approach presented here is indeed not an algorithm. In fact, my ex periments suggest that an algorithm for producing shorter proofs is in the main impractical. Nevertheless, certain program options and parameters are benefi cial, and, to aid the researcher who wishes to use OTTER, in Section 3 I discuss tendencies concerning their use. For example, quite often the setting of a smaller (rather than a larger) maximum (max.weight) on the length of retained con clusions promotes the completion of shorter proofs. This phenomenon is by no means dependent on the use of OTTER; indeed, with his program EQP, Mc Cune was able to answer the long-standing open question on Robbins algebra
Automating the Search for Elegant Proofs
1573
by producing a 194-step proof when the max_weight was assigned the value 60, and he later obtained an 86-step proof when the max-weight was assigned the value 50 (with no other changes made). An intuitive explanation asserts that the presence in a proof of a complicated formula or equation forces the inclusion of numerous steps used to extract from the complicated item what is needed. Where I have some notion of the type just given, I supply it. Perhaps such hints will enable a researcher to explain which tendencies hold in which cases and why. Although I do not share in the view, I have colleagues who suspect that a practical algorithm can be found. I offer this as a topic for research, if one is so disposed. Indeed, just as the experiments of many years provided the basis for McCune's formulation of an autonomous mode for OTTER to apply—a mode that automatically sets options and makes choices that the researcher would otherwise make—perhaps the experiments covered in this article will provide a basis for a far more automated approach for finding shorter proofs. If such were to occur, the practical consequences would be significant, for mathematics, circuit design, program synthesis, and the like. 1.3
PERSPECTIVE
To put in perspective the research reported here and to provide some insight into the difficulty of pursuing the topic of a more fully automated search for elegant proofs, two items merit mention. First, I have studied such an automated ap proach for some years now; see [17]. However, my in-depth experiments focused mainly on problems in which equality played little or no role. The presence of equality presents many subtle obstacles, some of which concern the use of de modulation. For example, even a simple experiment whose object is to cursorily check a given proof by supplying as weight templates the proof steps, each as signed a weight of say fc, coupled with an assignment of k to the max.weight can result in OTTER completing no proof at all. Second, none of my experiments had ever begun with a proof of such magni tude, in this case, a proof of length 816. Perhaps the longest proof that initiated an experiment in my earlier studies was one of length 63. Because of these two factors, the culmination of my research in producing a 100-step proof was most startling. 1.4
ELEGANCE—IMPORTANCE AND PROPERTIES
The search for elegant proofs has continuously played a key role in mathematics and in logic. Such a search can lead to the discovery of new, important relation ships, and it can also lead to the formulation of significant concepts. In addition to the aesthetic aspects of elegance of concern to mathematics and logic, practi cal aspects also exist, easily illustrated when the focus is on proof length. Indeed, the methodology here may also serve well in the context of constructing more
1574
Collected Works of Larry Wos
efficient circuits, synthesizing more effective algorithms, and the like. Often a "short" proof (when it is, in effect, constructive) can be used to provide the needed path, for example, by using an answer literal to extract from the proof the sought-after object. The desired object might be a circuit relying on few AND gates or an algorithm in which divide rarely occurs. Although what precisely makes a given proof elegant is subject to debate, five properties merit mention: proof length, term structure, variable abundance, deduced-step complexity, and compactness. Each of the cited properties has aes thetic appeal, but each is also relevant to practical considerations, for example, in circuit design. Here I focus mainly on the first property (proof length), giving brief attention to the second through the fourth properties. (Should one happen to wonder whether proof length is indeed relevant to elegance, one need only examine the history of mathematics, for example, that focusing on the various proofs of the Church-Rosser theorem.) As for the fifth property of elegance, compactness, I introduced and studied it in [17, 19]. (Because of its newness, the concept merits immediate focus. By example, a proof of a theorem of the form P implies the and of Q, R, and S is compact if and only if it is a proof of exactly one of Q, R, or S, implying that the other two proofs are subproofs.) The likelihood of finding a proof that is elegant with respect to one or more of the cited five properties can be sharply increased if an automated reasoning program is heavily relied upon, a program such as OTTER. Throughout this article, the first of the five properties, proof length, has a rather precise meaning, namely, the number of deduced steps explicitly present in the proof. The qualifier "rather" is present because intermediate steps result ing from the use of demodulation (for canonicalization) are not counted in proof length. Compared with the typical use in mathematics, the treatment of proof length in logic is more likely to be precise. The explanation rests with the frequent practice in mathematics of omitting many obvious steps (for example, those arising from applying symmetry of equality). In fact, on many an occasion, I have heard a logician say that mathematicians only outline proofs. In contrast, in various areas of logic (such as equivalential calculus [2, 16]), all deduced steps are explicitly presented. Further, various areas of logic require the use of a specific inference rule, a rule such as condensed detachment [3, 16]. Seldom is a specific inference rule cited in a mathematics paper or book. The second property of elegance, term structure, refers to the type of term present in a proof. For example, does the proof (say, from group theory) contain terms of the form inverse (inverse(t)) for some term t, or does the proof (say, from many-valued sentential calculus) contain terms of the form n(n(t)) where n denotes negation, or does the proof contain terms in which nested divide instructions occur? Just as a proof may offer added elegance because of being terse, so also may it offer elegance by avoiding some type of term. The third property of elegance, variable abundance, refers to the number of distinct variables required by one or more deduced steps of the proof. For
Automating the Search for Elegant Proofs
1575
example, the proof might require (for one of its deduced steps) the use of five distinct variables. In the vast majority of cases, requiring a smaller number of distinct variables adds to elegance. The fourth property of elegance, deduced-step complexity, is concerned with the length as measured in symbols of the formulas, equations, or clauses present in the proof. (I sometimes use the term "clause" in a less strict fashion to refer to equations and the like written in various notations acceptable to OTTER.) Exclusive of commas or parentheses, a proof may derive some of its elegance from avoiding the use of any deduced steps that are complex (with respect to length). Indeed, when a proof contains formulas or equations that appear to be "messy" in that a lengthy array of symbols is encountered, the scientist often evinces disappointment, and sometimes comments on the lack of "elegance". Of the four properties of elegance discussed in this article, the first (proof length) presents the most difficulty. The concern for proof length presents the type of challenge that is not directly addressable with an automated reasoning program and (apparently) is not effectively addressable with an algorithm. To dispel the thought that the use of a (frequently impractical) breadth-first (or level-saturation) approach suffices, consider the case in which such an approach yields at level 3 a proof of length 7 and at level 4 a proof of length 4; see Chapter 3 of [17] for a more detailed discussion. On the other hand, (as will be seen) the concern for the second through the fourth properties of elegance is directly addressable with a program such as OTTER and, at least in theory, can be attacked algorithmically. (The fifth property of elegance, compactness, also presents difficulty, not admitting an algorithmic attack that is practical.)
1.5
A NARROW WINDOW
To attack the tough problem of finding "short" proofs, OTTER offers various means—although far from producing an algorithm; see Section 2. (Regarding the other aspects of elegance discussed in this article, one learns that OTTER offers, in most cases, just what is needed.) What becomes clear (in Section 4, where an abbreviated sequence of experiments illustrating the basic methodology is presented) is the narrowness of the path that leads to success. (A far more detailed treatment of the crucial experiments is given in [20}.) For example, a change from the value 9 to the value 10 in the assignment of but one input parameter results (sometimes) in the completion of no proofs, in contrast to the completion of a proof marking significant progress. Nevertheless, when the goal is proof-length reduction, certain tendencies seem to hold regarding option choices and parameter assignments. In that re gard, Section 7 presents a shortcut to moving toward the objective of finding a "short" proof, an approach that might be termed a pseudo-algorithm, and Section 3 discusses tendencies exhibited by various parameters and strategies.
Collected Works of Larry Wos
1576
2
T h e Target Theorem and an Arsenal of Weapons
Next in order are two items: a presentation of the specific theorem that serves as the target, and a discussion of the various weapons OTTER offers for attempting to reach the target. In particular, I address three pressing questions with regard to proof length, namely, which weapons played the key role, how they were used, and in what order. The discussion sets the stage for viewing (in Section 4) some of the crucial sequence of experiments that answer these questons; the experiments culminated in the completion of a 100-step proof to replace the 816step proof serving as the starting point. In addition, in contrast to the indirect attack on the first property of elegance, the discussion shows how OTTER can be used to directly address the second, third, and fourth cited properties of elegance. To aid the researcher interested in using OTTER for both similar and totally dissimilar objectives, the experiments are accompanied by some commentary explaining why certain choices were made. The following equations capture the theorem (DUAL-BA-3) to be proved, where x@ denotes the complement of x and where the two inequalities arise from, respectively, negating the theorem to be proved and negating its dual. x » x. x * (y + z) - (x x + (y * z) - (x x + x« « 1. x * xC « 0. (x * yO) + ((x * (x * xO) + ((x * (x * y«) + ((x * (x + yO) * ((x + (x + xO) * ((x + (x + yO) * ((x + (A * B) + B !- B (A + B) ♦ B !■ B
* y) + (x * z ) . + y) * (x + z ) .
x) + (y« * x)) z) + (xfi * z)) y) + (yfl * y)) x) * (y« + x)) z) * (xC + z)) y) * (yC + y)) I $Ans(A2). | $Ans(A4).
» -
x. z. x. x. z. x.
The theorem under study asserts that, excluding the two equations in which != occurs, the given set of equations is an axiomatization of Boolean algebra; both McCune and I placed both equations in the passive list for our respective studies. (Earlier work [8] showed that it is sufficient to derive either of the two absorption laws, whose respective negations are captured by the two equations in which != occurs; because of duality, a proof of one of the negated equations provides a proof of the other.) The context of the problem was the search for a Boolean algebra axiomatization consisting of an independent self-dual set of two equations. (A set is self-dual if and only if the dual of each equation is also in the set.) In fact, the ten equations (given earlier) lead directly to such an
Automating the Search for Elegant Proofs
1577
axiomatization by applying a method due to Padmanabhan and Quackenbush [9). Each equation of the pair has length 1103, measured in symbol count. This theorem DUAL-BA-3 was used to find the first known independent self-dual 2basis for Boolean algebra. The theorem is significant in that, from preliminary results, deriving either absorption law showed that the set of ten equations is a basis for Boolean algebra. By using Pixley reduction, the set of ten equations can be reduced to an equivalent self-dual set of two equations, which is easily shown to be independent. McCune had succeeded in obtaining a proof with OTTER, a proof of length 816, counting five steps resulting from "copy" followed either by "flip" (which interchanges the arguments of an equation) or by demodulation, and counting one step resulting from back demodulating an input equation with another input equation. (The proof length is increased by the use of "flip" if and only if the equation that is flipped is also present in the proof; both forms of an equation are retained when eq_units_both_ways is set; the use of Kunth Bendix automatically sets this option.) He asked me to find a more elegant proof, adding (in jest) that the goal was a proof of length 100 but, realistically, a 200-step proof would indeed be impressive. In addition to the incentive of finding a proof that McCune would consider elegant, the theorem offered a challenge rather different from my earlier stud ies seeking shorter proofs. Specifically, those earlier studies [15, 17, 19] focused mainly on areas of logic, areas in which the equality relation was totally absent; in contrast, the theorem of interest relies exclusively on the equality relation. (Most of the other theorems used here to test the power of the methodology also rely on the equality relation and on no other. For the actual proofs produced by the methodology, or proofs of a similar flavor, see [8] or either of the following two Web addresses, http://www.mcs.anl.gov/home/mccune/ar/monograph/ or http://www.mcs.anl.gov/people/wos/index.html.) Therefore, new obstacles no doubt would be encountered, for problems featuring equality behave (in math ematics and especially in automated reasoning) sharply differently from those in which equality is not present or present barely. 2.1
ATTACKING PROOF LENGTH
Anticipation of new obstacles to overcome naturally suggested I quickly review some of OTTER's arsenal of weapons that might be useful in seeking a shorter proof for the given theorem. I began with a study of the approach McCune had used to find any proof, the approach that culminated in his finding an 816step proof. He used three familiar weapons: weighting, the ratio strategy, and a Knuth-Bendix approach. Specifically, McCune used a max.weight (maximum weight) of 28 to limit the complexity (measured in symbol count) of retained clauses, a limit that I maintained for the first fourteen experiments, some of which are reported here. To direct the program's reasoning, he used his ratio strategy [7, 17], assigning a value of 4 to the pick_given_ratio. That assignment
1578
Collected Works of Larry Wos
instructs OTTER to choose as the focus of attention four clauses by weight (complexity, whether determined by weight templates or by symbol count), one by breadth first (first come, first serve), then four, then one, and the like. It seemed obvious to me that, for seeking shorter proofs, both max_weight and the ratio strategy would prove most useful—perhaps even required—no doubt relying on a variety of assignments for their respective values. McCune also used a Knuth-Bendix approach for drawing conclusions and for canonicalization. I adopted this weapon also, although not specifically for proof shortening. From my earlier studies focusing on finding shorter proofs, I added three weapons to the cited arsenal: the resonance strategy [15, 17], the hot list strat egy [17, 18], and McCune's dynamic hot list strategy [16, 17, 18]. Regarding the resonance strategy, its objective is to enable the researcher to suggest equa tions or formulas, called resonators, each of whose symbol pattern (all of whose variables are considered indistinguishable) is conjectured to merit special at tention for directing a program's reasoning. To each resonator one assigns a value reflecting its relative significance; the smaller the value, the greater the significance. In contrast to directing a program's reasoning, the objective of the hot list strategy is to rearrange the order in which conclusions are drawn. The rear ranging is caused by immediately visiting and, depending on the value of the (input) heat parameter, even immediately revisiting a set of input statements chosen by the researcher and placed in an input list, called list(hot). The chosen statements are used to complete applications of inference rules rather than to initiate them. The dynamic hot list strategy has the same objective as does the hot list strategy. However, whereas the (static) hot list strategy is restricted to using clauses that are present when the run begins, the dynamic hot list strategy has access to members adjoined to the list(hot) during the run. The input heat parameter governs the amount of recursion that is permitted for both the hot list strategy and the dynamic hot list strategy. The input dynamic_heat_weight parameter assignment places an upper bound on the pick-given weight of clauses that can be adjoined to the hot list during the run. (A clause technically has two weights: its pick-given weight, which is used in the context of choosing clauses as the focus of attention to drive the program's reasoning, and its purge.gen weight, which is used in the context of clause discarding; often the two weights are the same. If no member of a weight Jist matches a clause, where variables are treated as indistinguishable, the clause is given a pick-given weight equal to its symbol count; the same is true for its purge-gen weight.) Each of the cited three strategies, as well as other weapons offered by OTTER, plays a vital role in the context of the first property (proof length) of elegance.
Automating the Search for Elegant
2.2
Proofs
1579
ATTACKING OTHER PROPERTIES OF ELEGANCE
On the other hand, far fewer weapons are needed when the concern is the second, the third, or the fourth property. Further, whereas a focus on proof length requires the use of a methodology, each of properties 2 through 4 can be directly addressed with one or more features offered by OTTER. For pertinent material, see [15, 17, 19]. Indeed, when the second property, that of term structure, is the concern, one can rely either on O T T E R ' s treatment of demodulation or on weighting. Regarding the use of demodulation, consider the case in which one wishes to avoid terms of the form n(n(t)) for any term t, and assume that the only predicate present is P. The following set of demodulators will suffice; O T T E R discards clauses that are demodulated to $T for true. (One can think of the function n as negation and the function i as implication.) list(demodulators). (n(n(x)) » junk). (i(junk.x) » junk). (i(x,junk) » junk). (n(junk) - junk). (P(junk) = $T). end_of_list. A careful analysis of the demodulators in the given list shows that iteration will demodulate (rewrite) a deduced but unwanted conclusion (that takes the form of a unit clause) eventually to $T, standing for true. Regarding the use of weighting, in addition to placing entire equations or formulas in a weightJist (as is the case for resonators), one can place subex pressions in a weightJist. If, for example, the type of elegance that is desired asks for the absence of all terms of the form inverse(inverse(t)) for terms t (say, in a study of group theory), one can include an appropriate weight template. In the case under discussion, the following weight template can be included in weightJist (purge_gen) or in weightJist (pick jind-purge), with the intention that the program purge deduced conclusions containing the undesired subexpression. weight(inverse(inverse($(l))),1000). Because of the presence of this template, the purgcgen weight of any deduced conclusion containing the cited type of term will be increased by at least 1000, if no other weight template interferes. (The use of $ ( 1 ) causes the term in the corresponding position, whether complex or not, to be multiplied by 1.) If the max.weight is strictly less than 1000, such a conclusion will be immediately purged, unless its weight is sufficiently reduced because of the actions of yet another template. One thus has a taste of how O T T E R offers a means for directly addressing the concern for term structure in the context of elegant proofs. Because of the way weighting is implemented in OTTER, it can be used to serve another purpose, namely, to purge an entire class of unwanted equations
Collected Works of Larry Wos
1580
through the use of the resonance-restriction strategy. With this strategy, con clusions that match a resonator are purged; of the conclusions that are retained, the choice for the focus of attention to direct the reasoning is based on symbol count. As for the relevance to elegance, one can imagine having identified a class of equations or formulas that are to be avoided, if elegance is to be increased, a class all of whose members have the same functional shape, differing only in the presence of the particular variables. For example, the class to be avoided might contain the following equations. (x* (x* (x* (x*
((y+z)* ((z+y)* ((y+z)* ((z+y)*
(y+u)))* (y+u)))* (y+u)))* (y+u)))*
((x*y)+ ((x*y)+ ((y*x)+ ((y*x)+
(x* (x* (x* (x*
(z*u))C (z*u))C (z*u))« (z*u))«
) ) ) )
-
(x* (x* (x* (x*
(y+y))*l. (y+y))*l. (y+y))*l. (y+y))*l.
If the intent is to avoid these equations and others of their class differing only in the particular variables that occur, one need only select an equation of the class and use it as a resonator, assigning to it a value greater than the max-weight. Placing the chosen resonator in weight-list(purge^en) or in weight Jist(pick-and.purge) will, if nothing else interferes, cause the program to purge any deduced conclusion that is in the undesired class. Any member of the undesired class will suffice as the chosen resonator—one of the beautiful as pects of the resonance strategy—for (by definition) all variables in a resonator are treated as indistinguishable. (For more details concerning the resonancerestriction strategy, see Sections 4.2 and 5.2 in [17].) Regarding the third cited property of elegance, that focusing on variable abundance, OTTER offers precisely what is needed with a command of the following type. assign(max_distinct_vars,5). With the inclusion of this command, the program will purge any deduced clause that contains more than five distinct variables. The use of that feature alone can result in the completion of a proof that is far more attractive than the proof produced without using that feature. As for the fourth cited property of elegance, deduced-clause complexity, the feature that is relevant can be easily guessed, namely, the option to assign a chosen value to max-weight. For example, if no weight templates are included in the input, OTTER will assign as the purge.gen weight to each deduced clause its symbol count, of course ignoring commas and parentheses. Therefore, if one wishes the program to seek a proof in which no deduced step has a length exceeding, say, k, one merely assigns to max-weight the value k. No problem exists if, at the same time, one wishes to include weight templates to guide the program's search without interfering with the stated intention. In such an event, one places the guiding templates in weightJist(pick-given); no template in that list is consulted when computing the purge_gen weight, the weight used to decide whether to retain a new conclusion in the context of its complexity.
Automating the Search for Elegant Proofs
3
1581
Making Choices and Identifying Tendencies
Consistent with my promise regarding tendencies, this section offers notions gathered from experimentation. Indeed, as one learns here, studies with OTTER suggest that some types of parameter assignment tend to be more effective than others. This observation holds whether the objective is that of finding shorter proofs (featured in this article) or the objective is that of finding any proof. The tendencies are discussed in lieu of a practical algorithm. (Of course, the word tendency is the correct term, for exceptions abound no matter which option, parameter, strategy, and the like is the focus.) That no such algorithm exists (which is my position) might be less surprising if one pauses to note that a mathematician who is asked for an algorithm for finding any proof would, at best, be amused. (The experiments that are cited in this section are discussed in Section 4 and, more fully, in [20].) 3.1
MAX.WEIGHT
One of the more innocent-appearing parameters that governs the actions of OTTER is that which places a maximum on the weight (complexity) of retained information, namely, max.weight. Tendency 1. Assignment of a smaller max_weight rather than a larger tends to produce shorter proofs, tends to promote finding any proof, and tends to reduce the CPU time required to complete the designated task. Intuitively, my guess is that long and messy formulas or equations force the program to include numerous steps to unpack the information that they contain. Perhaps the situation is like the gift that is in a box, which is in a box, which is in yet another box, and the like, with the actual object of delight buried deeply within the nested boxes. To immediately answer a natural question, I note that I typically choose to assign max.weight (in the beginning of an attack) a value between 20 and 30. 3.2
T H E H O T LIST STRATEGY
Just as the values assigned to parameters can be crucial, so also can the choice of strategy or strategies. Tendency 2. Use of the hot list strategy tends to promote the finding of shorter proofs, tends to promote the finding of any proof, and tends to reduce the CPU time that is required to complete the assigned task. The presence or absence of the hot list strategy can produce sharply contrast ing results. Whereas its use in Experiment 26 enabled OTTER to complete the
Collected Works of Larry Wos
1582
desired 100-step proof, the corresponding experiment differing only in the omis sion of the hot list strategy completed no proofs. Such contrasting results are explained by the rearranging of the order in which conclusions are drawn. Indeed, without the hot list strategy, the retention of a new clause does not cause the program to immediately choose that new clause to initiate an application of the inference rules in use, as is the case when the hot list strategy is in use. (Nevertheless, this tendency in no way implies that such immediate initiation is necessarily an advantage. In particular, the new demodulators that might be retained with the use of the hot list strategy might get in the way, might rewrite some clause into a form that blocks finding a shorter proof or, for that matter, finding any proof.) Tendency 3. Use of clauses in the hot list that are representable in a few (perhaps less than 10) symbols—with the added property that the right-hand argument is a single symbol, variable or constant—tends to promote reaching the desired objective. Tendency 4. Inclusion of a clause in the hot list that corresponds to the added hypothesis of a theorem—for example, when studying ring theory, the assump tion that the cube of x is x for all x—tends to promote program effectiveness. The analogue of this tendency is found in many mathematics books and papers where a proof continually leans on the added hypothesis of the theorem in focus to derive one step after another. Tendency 5. Use of clauses in the hot list corresponding to associativity or commutativity tends to sharply decrease the effectiveness of a reasoning pro gram. If a clause, such as that for commutativity, easily matches terms within each newly retained conclusion, then the program can become preoccupied over and over, sharply reducing the number of clauses chosen from the set of support to initiate inference rule application. As the cited tendencies suggest, the content of the (input) hot list can be indeed critical. For example, in Experiment 26 if one uses for the input hot list that used throughout many of the experiments reported in Section 3 and in [20] (just two clauses), no proofs are returned; in contrast, with the following four clauses in the hot list, the desired 100-step proof is found. (As one clearly sees, the clauses do not adhere to Tendency 3; but the discussion focuses on tendencies, not on rigorous rules.) x x x x
* + + *
(y (y xC xC
+ * -
z) =• (x * y) + (x * z ) . z) - (x + y) * (x + z ) . 1. 0.
Automating the Search for Elegant Proofs
1583
Obviously, at least one of the two additional clauses (in the hot list) enables the immediate deduction and retention of one or more needed clauses. (As a reminder, the clauses in the hot list are used to complete application of inference rules.) However, as experimentation shows, sometimes a greater value assigned to the heat parameter harms rather than helps, and sometimes additional members in the hot list impede rather than aid progress. The answers to the questions of how and when to use the hot list strategy rest with the properties of the correspondingly perturbed space of retained conclusions; currently, the only means for making the appropriate decisions is through experimentation. Tendency 6. Adjoining clauses frequently to the hot list during a run, in the context of the dynamic hot list strategy, tends to sharply decrease program effectiveness. The performance tends to increase if clause adjunction during a run consists of the type of clause classed as useful in the context of the static hot list strategy. Tendency 7. Assignment of a value of 1 to the input heat parameter, for both the static and the dynamic hot list strategy, tends to promote the finding of shorter proofs and tends to promote the completion of any proof. Higher values tend to becalm the program, forcing it to remain in one place for a long time before choosing a new initiating clause from the set of support. Other tendencies regarding the use of McCune's dynamic hot list strategy are more difficult to identify at this time, for its use has received relatively small experimental attention so far. The answers to other questions about the hot list strategy—the value as signed to the input heat parameter or the content of the (input) hot list, for example—rest with the properties of the correspondingly perturbed space of retained conclusions. Currently, the only means for making the appropriate de cisions is through experimentation. Indeed, as the following shows, the value assigned to the (input) heat pa rameter can save or lose the day. Whereas the value 3 in Experiment 26 worked well, the value 1 yielded no proof of either the target conclusion or of the dual. (I ignored the case for the value 2 because its use in Experiment 25 did not produce the desired 100-step proof.) In the cited case, the smaller value did not permit the program to deduce clauses of heat level greater than 1, and at least one such clause must have played a significant role. 3.3
THE RESONANCE STRATEGY
The resonance strategy is designed to cope with obstacles such as cul de sacs or dead ends. Indeed, often experiments lead to a sequence of shorter and shorter
Collected Works of Larry Wos
1584
proofs that reach a point conjectured to be far from what is possible—and yet no further progress occurs. To escape such a cul de sac, the resonance strategy is recommended, using proof steps from the last "good" proof or from some earlier or related proof. Tendency 8. Resonators that correspond to proof steps of a closely related theorem aid the program, whether the objective is proof-length reduction or simply proof finding (of any proof). In the limiting case for the resonance strategy, steps from a proof of a theorem obtained in an earlier experiment, if used as resonators, tend to be useful for finding an even shorter proof in a later experiment. An explanation for this phenomenon asserts that such steps (of course, depending on the other option and parameter choices) can tightly direct a program's search, but not restrict the program to finding the already-completed proof. Note that, in contrast to lemmas that should be true when included in an attack, resonators have no truth value. Indeed, when a resonator is used that corresponds to a step of an earlier proof of the theorem under study or corresponds to a proof step of another theorem, its inclusion does not play the role of an included lemma. For a fuller discussion of the relation of resonators to lemmas, see [15]. The added needed latitude to enable a new proof to be completed is derived from such elements as a max.weight whose value is perhaps ten times the value assigned to each of the resonators, usually a small value such as 2. (However, if some of the resonators match many retained clauses, their effectiveness can be totally destroyed and, worse, no proof is found because the program becomes mired in focusing on a large number of similar clauses.) 3.4
T H E RATIO
STRATEGY
Only relatively recently did I and my colleagues at Argonne find useful a levelsaturation or breadth-first search; see [14] for relevant data. Formerly, our pref erence was for a search based on the complexity of clauses that might initiate applications of inference rules. Currently, McCune and I typically rely on the ratio strategy, which combines both direction strategies. Tendency 9. Assignment of small values, but not the smallest, to the pick^given .ratio tends to promote the finding of a shorter proof and tends to promote the completion of any proof. When the smallest possible value, 1, is assigned to the pick_given.ratio param eter, the program is instructed to place equal weight (for choosing clauses to initiate applications of the inference rules in use) on first-come first-serve infor mation and on information of least complexity. If misfortune smiles, first-come first-serve information (that saved as the program's attack begins) will include
Automating the Search for Elegant Proofs
1585
statements whose complexity equals the maximum allowed in the experiment. As conjectured, the use of messy formulas or equations can interfere with the seeking of shorter proofs. On the other hand, if one assigns the pick_given_ratio a large value (such as 20), then the program will likely consider few complicated conclusions to initiate applications of an inference rule. More than rarely, such a conclusion proves to be the key to unlocking the puzzle, to finding a shorter proof or to finding any proof. In fact, the cited phenomenon is precisely why McCune formulated the ratio strategy. To immediately answer a natural question, I note that I typically favor an assignment of either the value 3 or the value 4 to the pick_given_ratio. 3.5
ANCESTOR SUBSUMPTION
The only means offered by OTTER for directly attacking the problem of finding shorter proofs is by using ancestor subsumption (which, for practical reasons, requires the use of back subsumption). This procedure compares the derivation path lengths when presented with two copies of the same deduced conclusion and retains the copy reached by the strictly shorter path. Tendency 10. Use of ancestor subsumption tends to promote the finding of shorter proofs; however, use of ancestor subsumption tends to sharply increase the required CPU time if the goal is simply finding o proof. For an example of the fact that shorter subproofs do not necessarily lead to a shorter total proof, see Chapter 3 of [17].
4
A Tortuous P a t h t o Success
At this point, the focus is on various experiments whose objective was to find a proof of DUAL-BA-3, a proof far shorter than McCune's 816-step proof. Only barely was I seriously seeking a proof of length 100, McCune's original request (though said in jest). I conducted more than one hundred experiments, the result of which was indeed a 100-step proof and, perhaps more important, a general methodology for seeking "short" proofs. Immediately preceding Section 5, a table of twenty-six of the more interesting experiments is given, the details of which are covered in [20]. In this article, I focus on far fewer experiments, noting that setbacks did occur; my objective is mainly to illustrate the methodology, to show how it was developed and used, and to provide data supporting the tendencies regarding option choices and parameter assignments. Earlier studies seeking shorter proofs [15, 17, 19] virtually demanded the use of the resonance strategy, if the goal of finding a 100-step proof (or, for that matter, a 400-step proof) were to be reached. As for which equations to use as resonators, again virtually no thought was required. Indeed, experiments in
CoMected Works of Larry Wos
1586
areas other than Boolean algebra had shown that deduced steps from the proof of a theorem (even if only distantly related to the target theorem) often serve well as resonators, whether the goal is a sharp reduction in CPU time required to complete any proof or the goal is to find a shorter proof. In fact, steps from the proof of a target theorem often serve well as resonators for improving one's results regarding the target theorem. Note that, typically, Experiment fc+1 uses as resonators proof steps of a proof obtained in Experiment k. Therefore, I began (in Experiment 1) by using as resonators the 811 deduced steps of McCune's proof, starting with a clause obtained by back demodulation, but not including the earlier clauses produced by "copy". Almost all the experiments reported in the remainder of this article were conducted on a SPARCstation-10. For brevity, the CPU times are cited without the reminder that they are only approximations. Also, note that all resonators placed in a weight-list must be unit clauses, free of " | " (the logical or sym bol). Therefore, when I discuss positive deduced steps of a proof to be used as resonators, implicit is the requirement that each be a unit clause. 4.1
A FINE START: EXPERIMENT 1
In Experiment 1, each resonator (each of the 811 deduced steps of McCune's proof) was assigned the value 2. All resonators were placed in the pick_and_purge weight-list. This placement instructed OTTER to assign both a pick-given weight and a purge_gen weight of 2 to any deduced clause that matched any of the 811 resonators, where (in the resonator case) two clauses match if they are identical when all variables are treated as indistinguishable from each other. The steps of McCune's proof that are deduced and retained are thus used to influence OTTER's search for a proof; indeed, because of being assigned the small pick-given weight of 2, they are given preference (over most or all clauses) for being chosen to initiate an application of the inference rule or rules in use. Also (of slightly lesser significance) the deduction of a step of McCune's proof will almost certainly lead to its retention, at least in the context of max-weight, for such a step will be assigned a purge.gen weight of 2. In Experiment 1, the max-weight was assigned the same value McCune used, namely, 28. Since the pick-given_ratio remained unchanged from that used to obtain the 816-step proof, namely, that of 4, the presence of clauses matching a resonator would only guide OTTER's search, for every fifth clause used to initiate an ap plication of an inference rule would be chosen by first come, first serve. Such guiding rather than totally controlling the search gives the program the oppor tunity of finding a proof different from McCune's and, more to the point, a chance of finding a shorter proof. In 1613 CPU-seconds on a SPARCstation-10 with retention of clause (15257), OTTER completed a proof of length 680 and level 78; the level of McCune's proof is 89. (The two levels are given to provide yet one more measure of the difference between the two proofs; level will not be cited for the remaining
Automating the Search for Elegant Proofs
1587
experiments, but it is given in Table 1.) Five of its steps result from applying copy to an input clause, followed either by flip to interchange arguments or by demodulation, and one step results from back demodulating an input clause with another input clause. (This added information is given in the event that one wishes to measure proof length beginning with the first use of paramodulation. For the remainder of this article, the figures for proof length will be taken from an OTTER run; the program counts steps of the cited types in its computation.) Because McCune was equally interested in a "short" proof of the dual, its negation, captured by the following clause, was also included. (A + B) * B != B. Even more impressive in the context of proof length reduction, the dual was also proved, the proof having length 628; its level is 67, completing in 1608 CPU-seconds with retention of clause (15031). Perhaps startling—and certainly charming—except for the clause correspond ing to negating the dual, the proof of the dual is a subproof of the proof of the primary conclusion. To remove any doubt concerning technicalities, of course the proof of the dual, being one of contradiction, relies on the negation of the dual, whereas the proof of the primary conclusion relies on its negation; clearly, the negation of the dual is not present in the proof of the primary conclusion, and conversely. 4.2
T H E H O T LIST STRATEGY: EXPERIMENT 2
Whether the focus is on the target conclusion or on its dual, this fine start on a path to finding a far shorter proof does not imply that all always went according to plan—the path was unpredictable, as shown in Table 1. However, with this satisfying reduction in proof length from 816 to 680 or 628 (whichever choice is made), the stage was nicely set for Experiment 2. The only change made from Experiment 1 was that of adding the use of the hot list strategy with the heat parameter assigned the value 1. The object was to gain some insight into the value of using this strategy (coupled with the resonance strategy) in the context of seeking a shorter proof for the target theorem. Of course, the addition of the hot list strategy naturally presented the ques tion of which clauses to place in list(hot). Typically, a practice that has served well is to place in the hot list the clauses corresponding to the special hypothesis. (The special hypothesis of a theorem of the form if P then Q refers to that part of P, if such exists, that excludes the underlying axioms and lemmas. For exam ple, in the study of the theory that asserts that rings in which, for every x, the
cube of x = x are commutative, the special hypothesis consists of the equation xxx — x.) A less precise rule that often is effective suggests for the members of the hot list those clauses in the initial set of support that are "simple", where simplicity usually means expressed in a small number of symbols. The second
Collected Works of Larry Wos
1588
rule is the one that was used. Therefore, the following two clauses were placed in list(hot). x + xQ - 1. x * x9 - 0. Neither clause is directly relevant to the conclusion of the theorem, namely, (x*y)+y - y, nor to its dual, namely, (x+y)*y - y. Nevertheless, the presence of the cited two clauses in the (input) hot list, as the following data shows, produced enough of a reduction in proof length to clearly be of interest, and even piquant (to me). A 607-step proof of the conclusion obtained by McCune was completed in 3702 CPU-seconds with retention of clause (23437); a 606-step proof of the dual was also completed in the experiment. 4.3
RESONANCE AND THE DYNAMIC H O T LIST STRATEGY: E X PERIMENT 3
The next experiment, Experiment 3, was mainly influenced by a practice re flecting earlier successes (in other areas) in seeking shorter proofs, successes in which the resonance strategy played a key role [15, 17, 19]. The practice is it erative, using the deduced proof steps from one experiment as resonators in a later experiment. The first decision I had to make was to choose between the proof steps of the so-called primary conclusion and those of the dual of the conclusion. Although the two proofs completed in Experiment 2 are of almost equal length, 607 (for the primary) and 606 (for the dual), later experiments (as with Experiment 1) might not share this almost-equal-length property. Influencing my decision were two factors. First, aesthetics virtually demanded staying with the conclusion of McCune's 816-step proof; to do otherwise would in a sense be cheating, be loading the dice. Second, science virtually demanded using the primary conclu sion, for many situations to which one might wish to apply the methodology might lack a dual. (As an aside, an interesting area for research concerns using as resonators proof steps of the dual in an iterative attack on seeking a shorter proof, either of the primary or of the dual.) Therefore, with few exceptions, the choice of proof steps of the primary conclusion rather than the dual was the rule for most of the sequence of experiments to be discussed, as was the omission of the type of clause obtained with copy. Only when I hoped to extract a few extra droplets of proof-length reduction did I violate this rule. Data regarding the dual will not come into play or be presented until Experiment 18, where its use became crucial; [20] covers that data.
Automating the Search for Eiegant Proofs
1589
Therefore, for Experiment 3, 602 resonators were used, each assigned a value of 2. In other words, five of the 607 possible resonators were not included, those in which copy was applied to an input clause. One other change was made for Experiment 3, namely, the introduction of the dynamic hot list strategy. However, rather than simply adding the use of this strategy, the idea was to imitate a combination strategy that had proved most effective, namely, that of combining the resonance strategy with the dynamic hot list strategy; see [19]. The combination strategy is, intuitively, an if-then type of strategy: If a clause is retained that matches a member of a chosen set of resonators, then adjoin that clause to the hot list during the run. The notion is that the adjunction to the hot list (during the run) of "short" clauses might produce an even shorter proof, for the use of short clauses in the input hot list had resulted in progress. Therefore, the decision was to choose from among the 602 resonators to be used those expressed in five or fewer symbols (counting spaces, commas, and parentheses, but not counting the period), assign to each the value 1, and assign to the (input) dynamic_heat.weight the value 1. The consequences of this decision are that (1) any clause that is deduced and that matches a resonator with weight 1 will also be assigned a pick-given weight of 1—because the resonators were placed in the pick_and.purge weightJist—and (2), if such a clause is retained, it will be adjoined to the hot list during the run, because of its weight and because the dynamic-heat.weight has been assigned the value 1. (The value assigned to the dynamic-heat.weight places an upper bound on the pick-given weight of clauses that can be adjoined to the hot list during a run.) Of the 602 resonators to be used, 19 were assigned the value 1; they were placed in the pick-and.purge weightJist before the 602 resonators. Therefore, ignoring the assigned value, 19 weight templates appeared twice. The earliest weight template that matches a clause is that which is used to assign the weight to the clause; so the second copy of a template with assigned value of 2 did not interfere with the assignment of 1 as the weight of a clause matching one of the 19 used in conjunction with the dynamic hot list strategy. Summarizing, if a "short" clause (as just defined) was retained that matched a "short" clause of the proof completed in Experiment 2, then that clause was adjoined to the hot list during the run. Experiment 3 was markedly successful. In 321 CPU-seconds with retention of clause (9789), a proof (of the primary conclusion) of length 344 was completed. Thus the iterative approach was working well, having cut the required number of steps to prove the primary conclusion more than in half. 4.4
LAYERING RESONATORS: EXPERIMENT 4 THROUGH 7
As one sees in the preceding section, the use of a set of resonators does not re quire that each member of the set be assigned the same value. Indeed, a subset of the resonators used in Experiment 3 was assigned the value 1 (with the remain-
1590
Collected Works of Larry Wos
ing assigned the value 2) with the intention that any retained clause matching a resonator whose assigned value is 1 be added to the hot list. Experiment 3 (as noted) employed the dynamic hot list strategy. Although I dropped the use of the dynamic hot list strategy for the next four experiments (as well as for all experiments other than 3, 14, and 23), for Experiments 4 through 7 I still used a layered set of resonators, meaning that not all of the resonators were assigned the same value. In particular, for Experiment 4, resonators represented in seven or fewer symbols were assigned the value 1, and the remaining were assigned the value 2. As expected, all of the resonators correspond to proof steps from the proof completed in Experiment 3. Experiment 4 produced more progress, completing a proof of the desired theorem in 111 CPU-seconds with retention of clause (5871), a proof of length 325. As one might expect because of the iterative nature of the methodology, for Experiment 5 new resonators were used, those corresponding to the proof steps of the proof obtained in Experiment 4. The same type of layering of resonators was employed. Experiment 5 produced another significant reduction in proof length, completing a 287-step proof with retention of clause (9400) in 164 CPUseconds. Experiment 5 was followed by numerous failures in the context of finding shorter proofs. For a taste of how much ground could be lost with ineffective choices of the parameters and the strategies, one of the unsuccessful experiments completed a proof of length 514, virtually proving that an algorithm is not being discussed, merely a methodology. Also strongly and correctly suggested are the subtlety, intricacy, and complexity of seeking shorter proofs; indeed, the process is quite delicate in the sense that the slightest change in a parameter assignment can result either in finding no proofs or in finding a rather shorter proof. Regarding what was tried, the value of the heat parameter was assigned 1 sometimes and sometimes 2, and sometimes the hot list strategy was not used. The max_weight was assigned various values, from 12 to 36. Although the usual assignment for the pick_given_ratio was 4, sometimes 3 was chosen. Diverse moves were made in the context of the choice and layering of resonators. One learns that the methodology is experimental, often requiring playing with various combinations of parameter assignments and strategy choices whose effects are indeed unpredictable. In short, not much worked—until Experiment 6 was conducted. Experiment 6 differed from Experiment 5 in two ways. First, as expected, the resonators were the correspondents of the proof steps of the proof (of the pri mary conclusion) obtained in Experiment 5, in place of those from Experiment 4. Second, the resonators that correspond to a step obtained with back demod ulation were given a weight of 4 rather than 2, to delay their consideration for initiating applications of an inference rule. (This added action resulted directly from a remark my colleague McCune made concerning the possible value of be ing able to apply all relevant demodulators at once in sequence, rather than by
Automating the Search for Elegant Proofs
1591
means of a set of sequences, each producing another step in the proof.) The ideal case explains the assignment of higher weight to correspondents of proof steps obtained with back demodulation. Imagine that the proof under con sideration (whose steps are to serve as resonators) contains a chain of clauses, A, B, C, D, E, obtained by applying back demodulation: back demodulation ap plied to A yields B, back demodulation applied to B yields C, similarly D from C, and E from D. In the ideal case, when the program (relying on the resonators from the just-mentioned proof) was seeking a shorter proof, the deduction of A would find already present and in the needed order the demodulators that had been used to respectively deduce B through E. In that event, A would be successively demodulated to yield B through E, but—and here is the point—A, B, C, and D would be intermediate steps, and they would therefore not be explicitly present in the proof to add to its length. Thus, by causing the program to delay considering for the focus of attention clauses that (in the proof whose steps are used as resonators) were obtained by back demodulation, perhaps such clauses would not be needed to complete a proof, preferably a shorter proof. Nevertheless, because the ideal case seldom occurs (regardless of the context), assigning such a high weight that the type of clause under discussion is in fact purged asks for serious trouble. After all, a clause that was obtained with back demodulation might have been a parent (when paramodulation was used) of a crucial clause; indeed, its absence might prevent the program from completing any proof, much less a shorter one. Of course, as one might predict from the preceding, Experiment 6 succeeded, completing a 260-step proof with retention of clause (5977), requiring 80 CPUseconds. After additional unsuccessful attempts to find a proof of length strictly less than 260, the conditions for a successful experiment were determined. For this experiment, Experiment 7, two changes were made from Experiment 6. First, as expected with this iterative methodology that relies on the results of earlier experiments to be used for later experiments, the resonators used in Experiment 7 were the proof steps of the proof completed in Experiment 6. The assignment of their values followed the pattern of Experiment 6. Second, because of some of the data gathered in the unsuccessful runs, the pick_given_ratio was assigned the value 7, rather than 4. The intention was to use complex clauses retained early in the run less often than was the case in Experiment 6. Another significant reduction was obtained, in that OTTER completed a 236-step proof, requiring 63 CPU-seconds and the retention of clause (5092). For but one data point that might be of interest, 30 steps of the 236-step proof are not among the 260-step proof obtained in the preceding experiment. 4.5
PERTURBING THE SEARCH SPACE: EXPERIMENT 15
Experiments 8 through 14 (as shown in Table 1) produced slow but steady progress. Experiment 15 (of the 26 detailed in [20]) reflected some of the diffi-
1592
Collected Works ofL&rry Wos
culty that was being encountered in attempting to find a proof of length strictly less than 207, the length of the proof completed in Experiment 14. For that ex periment, use of the dynamic hot list strategy was dropped, and the max_weight was reduced from an assignment of 28 to one of 20; 28 had been the assigned value until this experiment. The reduction was designed to perturb the search space by avoiding the retention of numerous complex clauses; recall that the ratio strategy, which was still in use and with an assignment of the value 9 to the pick-given_ratio, permits a program to focus on complex clauses, especially those retained early in the run. Also, consistent with the discussion of tendencies given in Section 3, the conjecture was that a smaller max_weight might enable OTTER to find a shorter proof. As expected, the resonators were the correspon dents of the proof steps of the proof completed in Experiment 14. However, as yet another example of returning to what worked earlier, those corresponding to a step obtained with back demodulation were assigned a weight of 4 rather than assigned a weight of 2 (as was the usual case in this sequence of experiments). Finally, for the first time, a direct attack on proof length was initiated, by adding the use of ancestor subsumption and (as almost always then required) also adding the use of back subsumption. With the use of ancestor subsumption, when a conclusion is drawn more than once, the lengths of the corresponding derivation path lengths are compared; the program retains the copy reached by the shorter path. The experiment succeeded nobly, completing a 185-step proof in 28 CPUseconds. Not only was the realistic goal reached—a goal that McCune had classed as impressive—but the result provided incentive to seek the goal he had suggested in jest, namely, a proof of length 100. 4.6
FOCUSING ON THE DUAL: EXPERIMENT 18
At this point, I encountered an impasse. Various moves produced no progress. Therefore, in desperation—or from the belief that far more was possible—I made an additional modification to the methodology. For Experiment 18, rather than choosing for resonators proof steps of the primary conclusion, the dual was used, from Experiment 17. A significant change was made regarding the values assigned to the resonators. Although those with ten or fewer symbols in them were still assigned the value 1, those used as demodulators and that showed back-demod in their history were assigned the value 2, with the remaining assigned the value 4. The notion was that progress might occur if clauses used as demodulators that in addition were obtained with back demodulation were given preference for being chosen as the focus of attention to drive the program's reasoning. Although still based far more on intuition than on analysis, the idea also was to have certain clauses used as demodulators available earlier than they might otherwise be, in turn perhaps reducing the need for the presence (in a completed proof) of clauses obtained from back demodulation. The pick-given ratio was assigned the value 9, and the
.Automating the Search for Elegant Proofs
1593
max.weight was assigned the value 14. Experiment 18 completed a 153-step proof of the primary conclusion in 16 CPU-seconds. Although still not the main goal, the dual was proved, with a 145-step proof, in 14 CPU-seconds. Not only was the proof length decreasing, so also was the required CPU time. In case one is tempted to assert that such is expected, various experiments in diverse fields do not support such an assertion. Nevertheless, when less and less CPU time is required, the methodology under study at least gives the appearance of power. Before continuing the account of the results of the sequence of experiments, I give some commentary concerning the role of the resonance strategy. Of the 153 steps of the proof of the primary conclusion obtained in Experiment 18, 24 of them are not among the resonators that were used in the experiment. Recall that the resonators correspond to the proof steps of the dual proved in Experiment 17. Thus—precisely in the spirit of the resonance strategy—one has a nice illustration of the value of using as resonators the proof steps of a related theorem when attacking the main target theorem. Perhaps even more persuasive, 21 steps of the 153 do not match at the resonator level any of the resonators that were used, where (as a reminder) matching in this context means treating all variables as indistinguishable from each other. In the given example, the resonance strategy can be viewed as having supplied a detailed outline of a proof, with OTTER finding the remaining needed steps. 4.7
V I C T O R Y : E X P E R I M E N T S 25 AND 26
Except for changes regarding the use of the hot list strategy, Experiment 25 was indeed similar to Experiment 24, of course using for resonators the proof steps of the completed proof (from the dual still) from Experiment 24. The (input) heat parameter was assigned the value 2 rather than 1 to permit recursion, and the following four clauses were placed in the input hot list. x x x x
* + + *
(y (y xfi xfi
+ * = -
z) « (x * y) + (x * z ) . z) - (x + y) * (x + z ) . 1. 0.
When the heat parameter is assigned the value 1, conclusions that result from consulting the hot list (whether one is using the hot list strategy or the dynamic hot list strategy) have heat level 1. If the program decides to retain a conclusion of heat level 1 and if the (input) heat parameter is assigned the value 2, then before another conclusion is chosen as the focus of attention, the heat-level-1 conclusion is used to initiate the search for conclusions of heat level 2 (with the
hypotheses needed to complete the corresponding application of the inference rule chosen from the hot list). Assigning a value of 2 to the heat parameter certainly has great potential for perturbing the search space, and, at this stage of the search for a "short" proof,
1594
Collected Works of Larry Wos
such perturbation seemed imperative. Placing additional clauses in the hot list, whether dynamically or input, also sharply increases the likelihood that the search will be perturbed. Indeed, the hot list strategy was formulated to enable a program to draw conclusions far sooner than it would otherwise; with the use of the strategy, the order in which conclusions are drawn is usually dramatically rearranged. The first proof completed in Experiment 25 was that of the dual, a proof of length 108, in 8 CPU-seconds. For the record, in the context of the dual, ground finally was lost. However, in 9 CPU-seconds, OTTER completed a 102-step proof of level 44 of the target conclusion. Almost as rewarding as finding such a short proof was the fact that the (primary) target had been proved in fewer steps than had the dual, which was not the case for so many of the experiments reported here. The result led to the conjecture that, with a few experiments based on fiddling with the parameters and option choices, a singular event would occur: OTTER would complete a 100-step proof of the target. (That numbers such as 100 would have appeal for a mathematician must amuse many.) For Experiment 26, I assigned heat the value 3 rather than 2 (or 1, as was the case for so many experiments). For resonators, I chose the proof steps of the proof completed in Experiment 25, that of the primary target and not the dual. The return to focusing on proof steps of the primary conclusion as the source for resonators was in part because of the length of its proof (102) in Experiment 25 and in part because it is the target of the study. The assignment of values to the resonators was that used in so many of the cited experiments, namely, 1, 2, and 4. I assigned max_weight the value 4 rather than 14. The assignment of the value 4 to max.weight merits a short explanation. The notion was that of preventing the program from retaining any clause that does not match (at the resonator level) one of the resonators, match in the sense that all variables are considered indistinguishable. With Experiment 26, my not-so-well hidden and actual goal was reached: OTTER completed a 100-step proof of level 44 of the target of the study in 6 CPU-seconds. As for the dual, its proof has length 99 and level 44, also requiring 6 CPU-seconds. The results of each experiment are summarized in Table 1. Because the level of a proof gives yet one more measure of its difficulty, the table also gives that information. (By definition, the level of input clauses is 0; the level of a deduced clause is one greater than the maximum of the levels of its parents.)
Automating the Search for Elegant Proofs
1595
Table 1: The Road from an 816-Step Proof to a 100-Step Proof Experiment Length Level Time (sec) 1 680 78 1613 2 606 78 3701 3 344 53 321 4 325 52 111 5 287 44 164 6 260 45 80 7 236 63 43 8 235 43 51 9 233 43 51 10 229 42 52 11 225 42 51 12 224 41 51 13 219 39 47 14 207 44 50 15 185 41 28 16 176 47 31 17 211 67 69 18 153 51 16 19 136 51 12 20 172 64 38 21 136 43 13 22 126 45 11 23 131 49 13 24 122 51 9 25 102 44 9 26 100 44 6
5
Obstacles t o Finding Short Proofs
To provide additional insight into why the path that began with a proof of length 816 and ended with a proof of length 100 was of necessity tortuous and, at the same time, to show why the various parameters and options exhibit tendencies only, the following general but brief discussion of obstacles is in order. (Chapter 3 of [Wos96a] focuses in detail on the obstacles to finding shorter proofs and the means to overcome them.) My purpose is twofold: first, by discussing various obstacles, to give some feeling for the difficulty of finding such a short proof; and, second, by touching on the consequences of different choices, to provide some understanding of the complexity of option choosing in this context. To begin with, the presence of the equality relation introduces an element often not present, namely, the need for demodulation (the use of rewrite rules
1596
Collected Wbris of Larry Wos
for simplification and canonicalization). Indeed, without demodulation, in the vast majority of cases (when equality is relied upon heavily), the program will drown in redundant information—the same fact expressed in too many tightly coupled ways; see [13]. For but one example, the program might deduce that a + b = c, that 0+(a + b) = c, that a + b = c + 0, and the like. For the theorem (DUAL-BA-3) featured in Sections 2 and 4, demodulation was indispensable, whether the goal was that of finding a shorter proof or, for that matter, finding any proof. When demodulators are present, the order in which demodulators are applied can be crucial, sometimes producing the needed equation to complete the assign ment, but sometimes preventing its discovery. To complicate matters further, without an arduous analysis, one must simply wait and see which demodulator is applied before which, for example, when one chooses to use a Knuth-Bendix approach (in which demodulators are adjoined during the run). The situation is rather like creating a grammar, a set of rules (the analogue of demodulators) that affect sentence structure; when the order of rule application changes, the sentence structure changes, not always in a manner that best fits the objective. The discovery and addition of demodulators are of course dependent on the choice of options and the assignment of values to the parameters. For a simple example, whereas a max.weight of 20 might enable a program to deduce and retain a demodulator (rewrite rule) expressed in 20 symbols, a max.weight of 16 might prevent its deduction, much less its retention. Regarding the tendency of smaller max.weight to promote the completion of a shorter proof, one thus sees that an obstacle does indeed exist and that the word tendency is appropriate. One also has a glimpse of why the path culminating in the discovery of a 100-step proof was of necessity tortuous. For a subtler example, assume that the max.weight is well chosen in the sense that it itself presents no obstacle, and consider two cases: an assignment of the value 6 to the pick_given.ratio, and an assignment of the value 7. On the surface, one not familiar with the ratio strategy might hastily assert that this small difference (6 versus 7) could be of little import. Actually, as shown by some of the experiments not detailed here, quite the opposite is the case. Indeed, in some experiments a change of 1 in the value assigned to the pick-given .ratio resulted in the program completing no proofs, whereas before the change a shorter proof was found. Again one sees how a pick_given.ratio of 6 rather than 7 having the (possible) tendency of promoting the completion of a shorter proof might be in conflict with another obstacle. Also, the fact that the search is so touchy (as illustrated) suggests that the path from the 816-step proof to the 100-step proof was understandably tortuous. Compared with the preceding two examples, regarding the seeking of shorter proofs, a direct attack based on using ancestor subsumption may yield far more sinister and unintuitive results. As a reminder, ancestor subsumption (which, for practical reasons, requires the use of back subsumption) compares the derivation path lengths when presented with two copies of the same deduced conclusion
Automating the Search for Elegant Proofs
1597
and retains the copy reached by the strictly shorter path. On the surface, one might surmise that ancestor subsumption is precisely what is needed to find shorter proofs and, perhaps further, that its use is guaranteed to find the shortest proof. Such a surmise is so far from the truth that the term "sinister" is in fact justified. Actually, the truth is captured by the aphorism Shorter subproofs do not necessarily a shorter total proof make. For a glimpse of what can go wrong when using ancestor subsumption (with finer detail given in Chapter 3 of [17]), begin by assuming A is a clause that is present in all proofs of the theorem under study. (The assumption, though not necessary, permits focusing on a simple example.) Second, assume that A occurs well before the end of any proof (also not a needed assumption). Next, assume that there exist two subproofs of A of respective lengths 5 and 3, where length is measured solely in terms of deduced clauses. Then assume that, other than A, the two subproofs share no steps in common. If two proofs of the theorem under consideration are completed respectively based on the two subproofs such that, ignoring A, all of the steps of the first subproof are present in the second total proof and such that none of the steps of the second subproof are present in the first total proof, then quite often the first total proof is shorter than the second (despite the presence of a longer subproof of A). Nevertheless, the use of ancestor subsumption does tend to result in the finding of a shorter proof, but, as the example shows, only tends to. Finally, although one is free to use or ignore ancestor subsumption, the situation regarding forward subsumption is radically different: The use of the latter is virtually required, if one is to avoid being buried in useless information. Nevertheless, trouble can occur with the use of forward subsumption, somewhat reminiscent of that discussed for ancestor subsumption; see [20] for some detail.
6
Applying t h e Iterative Methodology
At this point, one might naturally conjecture that the effectiveness of the method ology is derived (perhaps inadvertently) in some way from the specific theorem DUAL-BA-3. In the following, I present evidence that refutes this conjecture. The emphasis is still on theorems in which equality is the dominant relation. Each of the theorems discussed in this section was studied by McCune and Padmanabhan and proved by OTTER; each answers a question that was open before OTTER's attack. 6.1
TESTING IN THE SAME FIELD
The first bit of evidence still concerns Boolean algebra, specifically, a theorem in which equality is the only relation. In [8], the theorem is denoted by DUAL-BA5; with its proof, an open question was answered. The following clauses capture the theorem to be proved.
Collected Works of Larry Wos
1598
x ■ x. y + (x * (y * z ) ) - y. (<x * y> + (y * z ) ) + y - y. (x + y) * (x + y«) - x. y * (x + (y + z ) ) - y. ((x + y) * (y + z)) * y - y. (x * y) + (x * y«) - x. x + y « y + x. x * y ■ y * x. (x + y) + z - x + (y + z ) . (x * y) * z * x * (y * z ) . (A * B) + (A * C) !- A * (B + I B + BC !« A + AC.
X LI '/. L3 '/. Bl 7. L2 7. L4 7. B2
C) I (A + B) * B !- B
The theorem asserts that the equations L1-L4, Bl, and B2 are a basis for Boolean algebra. To prove the theorem, one is asked to show that three conclu sions hold, respectively corresponding to a distributive law, an absorption law, and the fact that x+xe is a constant, which explains the presence of the last of the given clauses. In particular, the clause is obtained by negating the and of the three conclusions. As in the theorem DUAL-BA-3, a starting point was supplied by McCune; he had obtained with OTTER a proof of length 119 and, as with DUAL-BA-3, was interested in a more elegant proof. The goal was to find a proof of length 100 or less. My approach was iterative, in the sense detailed earlier. The following summarizes the highlights. For the first experiment of significance, the pick_given_ratio was assigned the value 4, max_weight the value 23, and heat the value 1. The following two clauses were placed in the (input) hot list. x+y»y+x. x*y-y*x.
The assigned values were those used by McCune; the choice of clauses for list(hot) was based on the usual rule of including simple clauses. The resonators were the correspondents of the deduced steps of McCune's 119-step proof. In 115 CPU-seconds with retention of clause (12600), OTTER completed a proof of length 103. As is so typical in view of my interest in the hot list strategy, the experiment was then repeated with but one change: The heat parameter was assigned the value 2 rather than 1. In 206 CPU-seconds with retention of clause (18556), a 91-step proof was completed. Then, following the iterative aspects of the approach, the next experiment mirrored the preceding, except that I used as resonators those corresponding to 87 positive deduced steps of the 91-step proof. In 192 CPU-seconds with retention of clause (22114), OTTER completed a 63-step proof, a reduction in proof length that was (for me) indeed unexpected. (As I recall, further resonator replacement, unfortunately, led nowhere.) Then,
Automating the Search for Eieganfc Proofs
1599
as called for if one is curious about how well the cited tendencies hold, a slight variant of the experiment was conducted, in which the value 1 (instead of 2) was assigned to the heat parameter. In 48 CPU-seconds with retention of clause (9397), a 118-step proof was found. The last two cited results together provide a nice illustration of why a prac tical algorithm for finding shorter proofs would be difficult to produce—perhaps even out of reach—and they also provide some insight into why the methodology presented in this article was formulated. Specifically, although many experiments suggest that assigning the value 1 to the (input) heat parameter (when the hot list strategy is in use) is the most effective assignment, here one witnesses a far better result obtained with an assignment of the value 2. Again one sees that strategies and parameters exhibit tendencies only, rather than obey hard and fast rules. At the same time the first of the two items (the 63-step proof) suggests that an even more elegant proof might be obtainable if one were to conduct a quite extensive set of experiments. Such a set of experiments would involve assigning a small time limit for each run and simply trying numerous combinations of option choices and parameter assignments, still emphasizing the methodology that proved so successful with the theorem DUAL-BA-3. One can easily feel impatience at the prospect of having to set up one experiment after another, even though the use of OTTER is often so rewarding and even though the modifications in each case take little actual time. McCune again came to the rescue: With shell scripts, he wrote a program, super-loop, that systematically and sequentially sets up and runs experiments that focus on combinations of a variety of user-chosen options and assignments. To use super-loop, one attaches to the end of the designated input file a set of commands of the following type. '/. end of fixed p a r t meta_hot_set(2,3,4). x+y=y+x. x*y«y*x. (x + y) + z - x + (y + z ) . (x * y) * z a x * (y * z ) . end_of_list. assign(heat,2,1,0,3). assign(pick_given_ratio,4,5,6,7,8,9,10,12). assign(max_weight,5,10,15,20,25). flag(ancestor_subsume,set,clear). For example, using the remainder of the specified input file, in one experiment OTTER will assign max.weight the value 15 and the pick-given ratio the value 7, will set ancestor.subsume, and will use three of the given four clauses in the context of the hot list strategy.
Collected Works of Larry Wos
1600
With access to super-loop and with a quick review of the methodology used to yield the 100-step proof of DUAL-BA-3, I decided to run the sequence of experiments determined by the just-cited set of commands, with one addition, namely, the use of the resonance strategy. I chose for the resonators the steps of McCune's proof of length 119, assigning to each the value 2. Except for the cited variations from experiment to experiment, the approach was reminiscent of that used to obtain the 103-step proof discussed earlier. I set the time limit to 120 CPU-seconds. In the 209th experiment (directed by super-loop), a 30-step proof (of DUALBA-5) was completed in 15 CPU-seconds. The crucial option choices and pa rameter assignments that were used were an assignment of the value 8 to the pick_given_ratio and the value 25 to the max.weight and the setting of ancestor subsumption; the hot list strategy was not used. The cited result provides yet one more data point supporting the fact that elements such as max.weight obey tendencies only. 6.2
FURTHER TESTING
The success with DUAL-BA-3 (when studied with the methodology central to this article) coupled with the just-cited success with DUAL-BA-5 motivated the study of DUAL-BA-2; see [McCune96]. The theorem asserts that the following seven clauses axiomatize Boolean algebra. (x + y) * y ■ y. x * (y + z) ■ (x * y) + (x * z ) . x + xC - 1. p ( x , y , z ) - (x*yfi) + ((x*z) + (yC * z ) ) . p(x,x,y) * y. p(x,y,y) " x. p(x,y,x) - x. For the study, the following clause was also included because of the use of paramodulation. x » x.
The theorem asks one to prove three properties of Boolean algebra, the same three properties proved in DUAL-BA-5, namely, a distributive law, an absorp tion law, and the fact that x+xft is a constant. If one denies the and of the three properties, one obtains the following clause. A + (B * C) != (A + B) * (A + C) I (A * B) + B !- B I B * B« !- A * Afi. To initiate the study (with the goal of fulfilling McCune's request for a more elegant proof), I used his 135-step proof. The iterative approach led to
Automating the Search for Elegant Proofs
1601
the completion of a 93-step proof. Then, by using super-loop focusing on 89 deduced steps of the 93-step proof as resonators, an 86-step proof was com pleted. The proof was found in the 87th experiment directed by super-loop. Regarding options and values, the pick-given_ratio was assigned the value 5, the max.weight was assigned the value 8, ancestor subsumption was used, and the hot list strategy was not used; 6 CPU-seconds sufficed to produce the 86-step proof. Super-loop was again used, focusing on 82 deduced steps from the 86-step proof as resonators. In the third experiment, in 3 CPU-seconds with the value 12 assigned to the pick-given_ratio, the value 8 assigned to max.weight, and the use of ancestor subsumption, an 83-step proof was completed. I then had an inspiration, most likely resulting from some earlier experi ments with Robbins algebra. In the next use of super-loop, I merely cleared eq_units_both-ways. (If this flag is set, then unit equality clauses, positive and negative, can be stored in both orientations; see [7].) In the seventh experi ment, in 4 CPU-seconds, with the pick_given_ratio assigned the value 12, the max.weight assigned the value 16, and the use of ancestor subsumption, OTTER found an 81-step proof. By following the type of iteration just illustrated, a 77-step proof was com pleted, in 3 CPU-seconds. The experiment required assigning the value 12 to the pick-given_ratio, assigning the value 8 to the max_weight, assigning the value 1 to the heat parameter, using ancestor subsumption, and setting the flag eq_units_both_ways; only 3 CPU-seconds were required. The hot list contained the following four clauses. x + x
1. « y. = x. - x.
The result was obtained in the 221st experiment directed by super-loop. 6.3
BROADENING THE T E S T
To test the iterative methodology further, I shifted focus from Boolean algebra to quasilattices, focusing on the theorem denoted by QLT-3. McCune and his col league Padmanabhan [8] had obtained with OTTER the first known equational proof that the following self-dual equation can be used to specify distributivity. (((x " y) v z) " y) v (z " x) - (((x v y) " z) v y) " (z v x) (All earlier proofs are model-theoretic.) The proof I was asked to replace with a more elegant proof has length 183.
As with DUAL-BA-3, this theorem taxed the iterative methodology greatly, in the sense that many experiments were required to reach the best result, a proof of length 108 and level 14, completed in 166 CPU-seconds. Among the points of interest are the fact that McCune's proof (used as the starting point)
Collected Works of Larry Wos
1602
has level 24 and the fact that, in contrast to many of the so-called final experi ments in a study, this one required a few CPU-minutes. Also of interest, perhaps suggesting the difficulty of obtaining such a short proof and even suggesting the charm of the proof, the use of super-loop produced no further progress. For the researcher intrigued by the challenge of finding a shorter proof, the following clauses can be used to attack the problem. x - x. X
~ X -
X.
x - y - y - x. (x ~ y) " z ■ x " (y " z ) . X V X ■ X.
x v y ■ y v x. (x v y) v z ■ x v (y v z ) . (x * (y v z)) v (x * y) - x * (x v (y " z)) " (x v y) - x v (((x * y) v z) * y) v (z " x) A " (B v C) !- (A * B) v (A "
(y v z ) . (y " z ) . - (((x v y) ~ z) v y) " (z v x ) . C).
Then, I used the methodology to attack another theorem chosen by McCune from quasilattices. The theorem, QLT-5 [8], asserts that the following self-dual equation can be used to express modularity in quasilattices. (x " y) v (z " (x v y)) - (x v y) " (z v (x " y)) As in the preceding problem, the object was to find a proof even more elegant than that first obtained by McCune using OTTER, the first known equational proof. The so-called target proof has length 125 and level 19. To consider the problem, I used the following clauses. x » x. x * x » x. x * y - y * x. (x " y) " z - x * (y " z ) . X V X ■ X.
x v y » y v (x v y) v z x " (x v y) x v (x * y) X
*
X ■
x. » x v (y v z ) . = x. » x.
X.
x * y « y * x. (x * y) * z ■ x * (y * z ) . x * (x v y) - x. x v (x * y) » x. A " B ! - A * B.
Automating the Search for Elegant Proofs
1603
Before the use of super-loop was invoked, the basic methodology eventually led to a 95-step proof. Then, for some obscure reason, I initiated the attack with super-loop by using as resonators 101 deduced steps of a proof of length 106, obtained early in the use of the basic methodology. Perhaps the reason was that use of the 95-step proof would lead no further, that it would place the program in a cul de sac, whereas starting a bit further back might avoid the dead end. As in some of these experiments, the approach was to use super-loop to find (if successful) a shorter proof, then use the positive deduced steps of the shorter proof for the next use of super-loop. In Experiment 3745 of the last use of super-loop, with the pick-given .ratio assigned the value 9, the max-weight assigned the value 15, the heat parameter assigned the value 1, and the use of ancestor subsumption, 7 CPU-seconds suf ficed to yield a proof of length 30 and level 13. Two clauses, the following, were present in list(hot). X V X=X.
x v y«y v x. This result was singularly satisfying, and it demonstrated splendidly (because of occurring in Experiment 3745) the value of using super-loop. 6.4
A PROMISING SHORTCUT
With little doubt, one interested in finding a more elegant proof than that in hand might wish access to an approach that is far less complex, an approach that requires far fewer iterations and judgments to be made. The following two-step approach is easy to apply and often does yield impressive results. For the first step of the methodological shortcut, one merely takes the input file that produced the target proof and adds the use of the hot list strategy. For the (input) hot list, one chooses for its members so-called simple or short clauses (as was the case with DUAL-BA-3, the theorem that is the focus for much of this article). If successful, the program will find a shorter proof and will find it in far less CPU time. If the first step succeeds, for the second step, one then takes the input file used in the first step and adds the use of the resonance strategy. The resonators are the correspondents of the positive deduced steps (required to be unit clauses) of the proof obtained in the first step of the abridged approach. The results of applying the just-cited two-step approach to various theorems are next in order. Quite naturally, the first theorem that was attacked was DUAL-BA-3; see Section 4. Three experiments were conducted. The first was designed to find (if possible) a proof without the use of the hot list strategy or the resonance strategy. The second experiment, as dictated by the two-step approach, differed from the first only in its use of the hot list strategy. The members of the hot list were the following. x + x« - 1.
Collected Works of Larry Wos
1604 x * xfl - 0.
The third, again dictated by the approach, added the use of the resonance strategy, where the resonators were the correspondents of the positive deduced steps yielded by the second experiment. Of course, I was somewhat prepared for the possibility that any of the three experiments might fail to complete a proof. Fortune smiled: Each of the three experiments produced a proof. In order (on the equivalent of a SPARCstation-10), the CPU times in seconds are 6681, 585, and 242. The respective lengths are 803, 515, and 475. The ensemble of the three experiments suggests that the shortcut is promising, having reduced the proof length from 803 to 475. (Regarding the proof length of 803, in contrast to the expected 816, apparently the precise input file used by McCune is lost to antiquity.) Next, three corresponding experiments were conducted for the theorem DUALBA-5. As expected, the first experiment produced a proof of length 119; it was completed in 52 CPU-seconds. Two clauses, the following, were then placed in the hot list. x+y-y+x. x*y=y*x.
The second experiment required 100 CPU-seconds to complete a proof of length 160. These results were a surprise, for adding the use of the hot list strategy so often reduces the CPU time and yields a proof of smaller length. I was most fascinated. Also, I was most intrigued to determine what would happen if I used so many resonators, those corresponding to the positive deduced steps of the 160-step proof (only 101 were used in the first visit to this theorem, as discussed in Section 6). Therefore, as if nothing untoward had occurred, 159 resonators were adjoined, and the third experiment was conducted. In 36 CPU-seconds, a proof of length 47 was found. The result, which vindi cated the shortcut, is indeed satisfying, if one takes into account that the best proof obtained with the basic methodology followed by the use of super-loop has length 30. The next target was DUAL-BA-2. The first experiment behaved as expected in regard to proof length, completing a proof of length 135 in 55 CPU-seconds. The following clauses were then placed in the hot list for the second experiment. x + x® ■ p(x,x,y) p(x,y,y) p(x,y,x)
1. - y. - x. - x.
Reminiscent of the preceding study, the second experiment required 229 CPUseconds to complete a proof, one of (not enticing) length 150. When 144 res onators were then adjoined, corresponding to positive deduced steps of the 150step proof, 36 CPU-seconds were sufficient to find a proof of length 120.
Automating the Search for Elegant Proofs
1605
Regarding further evidence, two additional theorems were studied with the two-step shortcut. Each is found in [8], and by proving each, an open question was answered. The first, QLT-1, is from quasilattices. The following clauses were used to attack this theorem. X X
= X. X
=
X.
y = y (x - y) -
X
X
V X
»
"
X.
Z
*
X
- (y - z ) .
X.
V y - y V X. (x v y) v Z * X v (y v z ) . (x " (y v z ) ) v (x * y) - x • (y v z ) . (x v (y " z ) ) - (x v y) - x i' (y * z ) .
X
x " (y v (x " z)) = x " (y v z ) . A * (B v C) != (A * B) v (A " C). The first nine clauses axiomatize quasilattices. The theorem asserts that the tenth clause is a new way to express distributivity in quasilattices. The eleventh clause is the denial of distributivity. McCune had obtained a 47-step proof. In the three experiments with the shortcut methodology, I obtained proofs of length 47, 46, and 61, respectively. The time required was 3, 6, and 5 CPU-seconds. The conclusion is that the shortcut was far from effective for this theorem. However, the results naturally led to an experiment in which the hot list was trimmed from the following four members to just two, the first and the third. X
~ X »
X.
x - y = y - x. X V X "
X.
x v y » y v x. This move led to a proof of length 19, completed in 5 CPU-seconds. Then when resonators were adjoined that correspond to the positive deduced steps of the 19-step proof (to satisfy the natural curiousity), in 3 CPU-seconds, a proof of length 21 was found. Finally, I thought one additional experiment must be run. The reasoning was that if progress was made by trimming the size of the hot list, and if some of that progress was then lost, perhaps a reduction in max.weight was in order with all other items left unchanged. After all, as noted in Section 3.1 with the discussion of Tendency 1, the use of a smaller max.weight tends to promote the finding of a shorter proof. In 1 CPU-second, after changing the max-weight from 19 to 15, OTTER completed a proof of length 8. (For the researcher who wonders how wild is the space of proofs, one of the experiments focusing on this theorem yielded a proof of length 386, providing an impressive contrast to the proof of length 8.)
1606
Collected Works of Larry Wos
One perhaps unfortunate conclusion from this ensemble of experiments fo cusing on QLT-1 is that even the shortcut methodology benefits from tinkering. Yet, if one steps back from the study a bit, tinkering should be expected, for mathematics and logic so seldom admit an algorithmic approach when the prize is an elegant proof. Before turning to the last theorem on which the promising shortcut was tested at this time, I answer the following natural question that an experienced researcher might ask. What results are obtained if one conducts three experi ments using the effective max.weight (15) rather than that which was originally used (19) and using the smaller hot list? If, in addition to testing the shortcut, one has the goal of finding an elegant proof, the new set of three experiments begins rather explosively, completing in 5 CPU-seconds a proof of length 25. The second experiment brings the excitement and the attempt to a halt, pro ducing no proof when the smaller hot list is then added. Other paths are left as research topics and challenges, especially where the goal is to find a proof of length strictly less than 8. The final theorem that was studied in the context of the promising shortcut is denoted by McCune as LT-8. This theorem from lattice theory says that the meet (intersection) operation is unique in the sense that, given a set L of elements that have the same join (union) operation and two possibly different meet operations, the two meet operations are the same. The following clauses were used to study this theorem, again suggested by McCune. x • x. '/• (v,~) is a lattice. X " X » X.
x - y - y - x. (x * y) " z = x * (y " z). X V X » X.
x v y * y v x. (x v y) v z = x v (y v z). x * (x v y) = x. x v (x ~ y) " x . '/, equations to make (v,«0 a lattice. X * X - X.
x * y » y * x. (x * y) * z = x * (y * z). x * (x v y) = x. x v (x * y) ■ x. A * B !- A * B. McCune's proof, used as a target, has length 19. In the first experiment (in which neither the hot list strategy nor the resonance strategy was used), 50 CPU-seconds were required to produce a proof of length 19. For the second experiment, use of the hot list strategy was added with the following clauses in
Automating the Search for Elegant Proofs
1607
the hot list. X " X » X. X V X » X.
x - y = y - x. x v y = y v x. The required time increased to 119 CPU-seconds, completing a proof of length 18. For the third experiment, 18 resonators were adjoined, the correspondents of the deduced steps of the just-cited proof. Although but 1 CPU-second sufficed, the resulting proof still has length 18; in that it has a different level, the proof is different from the 18-step proof yielded by the second experiment. In the second 18-step proof, commutativity of join was not required. Of the deduced steps, five are not shared by the two 18-step proofs. Annoyed by the insignificant decrease in proof length, influenced by what occurred in the study of QLT-1, and motivated by the objective of presenting McCune with a more elegant proof and the objective of offering an interesting challenge, I conducted two tightly coupled additional experiments. First, I re moved from the hot list the two clauses that encode commutativity. Such an action is in the spirit of Tendency 5 of Section 3.2. In 55 CPU-seconds, OT TER produced a 19-step proof. The proof contains the same deduced clauses as the 19-step proof obtained when neither the hot list strategy nor the resonance strategy was used. Then, I used the 19 deduced steps as resonators, noting that three of them are not among the 18 that were used in the third experiment (that which yielded an 18-step proof). Success occurred: In 1 CPU-second, a proof was completed, one of length 14. Immediately, this advance motivated me to tinker just a bit more, seeking an extra drop (or perhaps more) of satisfaction. When the pick-given_ratio (which had been assigned the value 4) was commented out, causing OTTER to choose as the focus of attention clauses by weight only, 1 CPU-second sufficed to complete a 13-step proof.
7
Research, Review, and Remarks
The focus in this article has been on automating the search for elegant proofs. Al though a precise definition of elegance is debatable, four properties are studied: proof length, term structure, variable abundance, and deduced-step complexity. The first of these four is featured. 7.1
P R O O F LENGTH—HAZY AND COMPLICATED
Clearly, proof length is somewhat hazy. For example, frequently in a mathe matics book, one finds a proof in which symmetry and transitivity of equality are used implicitly only. For OTTER, their use would normally be explicit and, if used, add to the proof length. On the other hand, the use of demodulators
1608
Collected Works of Larry Wos
(rewrite rules, for example, in the context of canonicalization) does not ordi narily contribute to proof length, for mathematics or for OTTER. Proof length in this article and for OTTER measures the number of specific steps that are present but that are not part of the input. (Sometimes, the cited length of a proof is not what is expected, for proof length does not measure, for example, the number of equality substitutions; in particular, as noted, the substitutions resulting from the use of demodulators do not contribute to proof length. If one wishes to see explicitly all substitutions and their effect, as one might with a preference for a different definition of proof length, OTTER offers the needed feature, namely, build-proof_object, which gives all of the gory details.) There fore, here most or all ambiguity regarding this aspect of elegance is removed. Proof length-especially when the goal is to find a "short" proof—naturally brings one face to face with cul de sacs and, most piquant, the need to follow a tortuous path that is often indeed narrow. For example, some experiments yield no proof at all unless the pick-given_ratio is assigned the value 11; all other values yield nothing. For a second example—especially because of the appeal of proving lemmas early—intuitively, one might conjecture that it is always profitable to have the program focus on the clauses in the initial set of support before focusing on any deduced clause (to drive the reasoning); in fact, such a move sometimes leads to finding no proofs at all. Still, as discussed in Section 3, tendencies do exist regarding the values assigned to parameters and the choice and use of strategies. One might wonder why the task of seeking shorter proofs is so complicated. At least for problems in which equality is featured, the answer rests in part with demodulators (rewrite rules). Indeed, even a small change in the order in which demodulators are found and applied can dramatically change the program's performance, the paths pursued, and the results obtained. Nevertheless, such diverse behavior is typically what is required, if the objective is to find "short" proofs. Often, the objective is reached only by radically perturbing the search space. Fortunately, an iterative methodology (featured in this article) now exists for automating the search for shorter proofs. Although the methodology is clearly not an algorithm—a practical algorithm appears to be out of reach—the evi dence given here suggests that the methodology can be indeed effective. One of the more graphic illustrations concerns starting with a proof of length 816 (of the theorem DUAL-BA-3) and, by applying the approach, eventually obtaining a proof of length 100. The approach relies heavily on OTTER, McCune's au tomated reasoning program. In Section 4, the key experiments from among the 26 fully covered in [20] are detailed with commentary; they are summarized in Table 1 at the end of that section.
Automating the Search for Elegant Proofs
7.2
1609
RESEARCH PROBLEMS
To add to the interest in the study of automating the search for elegant proofs, I offer here several challenging research problems. Solutions to these problems will increase the power of automated reasoning programs. Research Problem 1. My main research, in the context of elegance, has fo cused on theorems in which equality was the only or the dominant relation and on theorems featuring the use of condensed detachment. The research problem to solve (and one that is related to the material in this article) asks for tech niques for finding elegant proofs when the equality relation is heavily mixed with relations not concerned with equality, as occurs, for example, in the study of set theory. Just as reported here, this area of research most likely will meet with cul de sacs and occasionally require reliance on a proof far from the best in hand. Such is the nature of searching for elegant proofs. Research Problem 2. One of the most difficult problems to solve concerns correctly identifying the key ingredient for finding elegant proofs, for proving a new theorem, and for completing a difficult assignment when one is relying on the assistance of an automated reasoning program. As one expects, my answer is access to a variety of strategies, some to restrict the reasoning and some to direct it. For evidence, the following experiment suffices. Again, the theorem in focus is DUAL-BA-5, but with three changes from the earlier discussion. The restriction on paramodulation that blocks paramodulation into nonunit clauses was removed, the use of what is called basic paramodu lation [1] was added, and the focus was changed to a proof of distributivity only. Using one of his automated reasoning programs, McCune produced an 18-step proof. He then used Veroff's hints strategy [11], using as hints the steps from the 18-step proof, and obtained a 17-step proof of DUAL-BA-5. Finally, I then used super-loop with McCune's approach (of relying on hints), and OTTER found a 16-step proof of DUAL-BA-5; OTTER also found a 13-step proof of distributivity. Research Problem 3. Regarding research of a more general nature, (in the context of automated reasoning) clearly merited is solving the problem of for mulating strategies aimed at dramatically reducing the CPU time required to complete proofs. Admittedly, such reductions do not impress all researchers. However, often overlooked is the fact that theorems and, even more significant, open questions that were out of reach will become within reach of such a pro gram as the required CPU time decreases sharply. Rather than with the reduction in time—which one might suggest is obtain able merely by using a more powerful computer—the significance rests with the cause of the reduction. Specifically, if the saving in time results from sharply reducing the number of paths to be traversed—which is not addressable with
Collected Works of Larry Wos
1610
a faster computer—progress is occurring. Indeed, as Bledsoe remarked more than once, the fastest computer is not the solution, for the space of possible conclusions to be deduced is indescribably large. Were it not for access to strategy, (it seems clear to me) an attack on deep questions or hard problems would almost always fail, for there exist far too many ways to get lost. Despite years of experience and the accrued intuition, even the talented mathematician or logician can get lost, often pursuing one false lead after another. The use of strategy, such as the set of support strategy, decreases the likelihood of the program getting lost and tends to focus its attention on more profitable paths of inquiry. Ideally, additional strategies offering power somewhat comparable to that offered by the set of support strategy would mark a most significant advance for automated reasoning. 7.3
T H R E E K E Y IDEAS
Three ideas are central to the research presented in this article. First, with out the use of a program such as OTTER, many elegant proofs would remain undiscovered. Second, I am certain that the greatest advances in automated reasoning when measured by the power to prove a theorem will result from the formulation of yet more strategies, some to restrict the reasoning and some to direct it. Third, OTTER functions as an invaluable research assistant for the study of mathematics or logic. I can say with conviction that if one learns how to use OTTER, one will in the long run save many more hours than one spends in the learning, especially if one's interest is an area of abstract algebra.
Acknowledgments I thank Ross Overbeek for his invaluable suggestions regarding this article, es pecially those concerning the inclusion of material on tendencies. I also thank Robert Boyer and Robert Veroff for their excellent guidance. Finally, I thank Gail Pieper for her significant insights.
References 1. Bachmair, L., Ganzinger, H., Lunch, C , Snyder, W., Basic paramodulation and superposition, in Proc. CADE-1J, Lecture Notes in Artificial Intelli gence, Vol. 607, D. Kapur (ed.), Springer-Verlag, Berlin, 1992, pp. 462-476. 2. Kalman, J., A shortest single axiom for the classical equivalential calculus, Notre Dame J. Formal Logic, 19 (1978), 141-144. 3. Kalman, J., Condensed detachment as a rule of inference, Studia Logica 42 (1983), 443-451.
Automating the Search for Elegant Proofs
1611
4. Lukasiewicz, J., The equivalential calculus, in Jan Lukasiewicz: Selected Works, L. Borkowski (ed.), North-Holland, Amsterdam, 1970, pp. 250-277. 5. McCune, W., OTTER 2.0 Users Guide, Technical Report ANL-90/9, Argonne National Laboratory, Argonne, Illinois, 1990. 6. McCune, W., What's New in OTTER 2.2, Technical Memorandum ANL/MCS-TM-153, Mathematics and Computer Science Division, Argonne National Laboratory, Argonne, Illinois, 1991. 7. McCune, W., OTTER 3.0 Reference Manual and Guide, Technical Report ANL-94/6, Argonne National Laboratory, Argonne, Illinois, 1994. 8. McCune, W., and Padmanabhan, R., Automated Deduction in Equational Logic and Cubic Curves, Lecture Notes in Computer Science, Vol. 1095, Springer-Verlag, Heidelberg, 1996. See http://www.mcs.anl.gov/home/mccune/ar/monograph/ for additional information. 9. Padmanabhan, R., and Quackenbush, R. W., Equational theories of algebras with distributive congruence, Proc. of A MS, 41(2) (1973), 373-377. 10. Scott, D., Private communication, 1990. 11. Veroff, R., Using hints to increase the effectiveness of an automated reason ing program: Case studies, J. Automated Reasoning, 16(3) (1996), 223-239. 12. Wos, L., Automated reasoning and Bledsoe's dream for the field, in Auto mated Reasoning: Essays in Honor of Woody Bledsoe, R. S. Boyer (ed.), Kluwer Academic Publishers, Dordrecht, 1991, pp. 297-345. 13. Wos, L., Overbeek, R., and Lusk, E., Subsumption, a sometimes underval ued procedure, in Festschrift for J. A. Robinson, J.-L. Lassez and G. Plotkin (eds.), MIT Press, Cambridge, Mass., 1991, pp. 3-40. 14. Wos, L., and McCune, W., The application of automated reasoning to ques tions in mathematics and logic, Annals of Mathematics and Al, 5(1992), 321-370. 15. Wos, L., The resonance strategy, Computers and Mathematics with Appli cations (special issue on automated reasoning), 29 (2) (1995) 133-178. 16. Wos, L., Searching for circles of pure proofs, J. Automated Reasoning, 15(3) (1995), 279-315. 17. Wos, L., The Automation of Reasoning: An Experimenter's Note book with OTTER Tutorial, Academic Press, New York, 1996. See http://www.mcs.anl.gov/people/wos/index.html for input files and infor mation on shorter proofs.
1612
Collected Works of Larry Wos
18. Wos, L., OTTER and the Moufang identity problem, J. Automated Reason ing, 17(2) (1996), 259-289. 19. Wos, L., The power of combining resonance with heat, J. Automated Rea soning, 17(1) (1996) 23-81. 20. Wos, L., Experiments Concerning the Automated Search for Elegant Proofs, Tech. Memo ANL/MCS-TM-221, Mathematics and Computer Science Di vision, Argonne National Laboratory, Argonne, Illinois, 1997.
Otter The CADE-13 Competition Incarnations
WILLIAM M c C U N E and LARRY WOS* Mathematics and Computer Science Ditnsion, Argonne National Laboratory, Argonne, IL, USA. email: { mccune, wos} Qmcs. anl. gov Abstract. This article discusses the two incarnations of Otter entered in the CADE-13 Automated Theorem Proving Competition. Also presented are some historical background, a summary of applications that have led to new results in mathematics and logic, and a general discussion of Otter. Key words: Automated theorem proving, competition, Otter, automated rea soning, equational deduction, paramodulation, resolution.
1
Introduction
Otter [17, 19] is an automated deduction system for first-order logic with equal ity. Two versions of Otter were entered in the CADE-13 Automated Theorem Proving System Competition, and the main purpose of this article is to give a detailed presentation of our entries. The first version (called Otter-304z) is es sentially Otter 3.0.4 operating in its autonomous mode, and the second (called Otter-Wos) is a minor variation of Otter 3.0.4. Because this article also serves as a general reference and overview of Otter, we also present some background, a summary of applications of Otter, and features of Otter that are not directly related to the competition. 1.1
HISTORICAL BACKGROUND
Research in automated theorem proving at Argonne started in 1962. We have always placed great importance on implementing and testing our ideas, so many 'Supported by the Mathematical, Information, and Computational Sciences Division sub program of the Office of Computational and Technology Research, U.S. Department of Energy, under Contract W-31-109-Eng-38. Reprinted from the Journal of Automated Reasoning, Vol. 18, no. 2, 211-220 (April 1997) with kind permission from Kluwer Academic Publishers.
1614
Collected Works of Larry Wos
computer programs have been written. The first generation consisted mainly of two programs. PG1 (Program 1), designed by Dan Carson, George Robinson, and Wos in 1963, had the unit preference strategy [37]; experimentation with PG1 led to the set of support strategy [39] and demodulation [40]. The program RG1 [38], designed by George Robinson and Wos in 1967, had binary resolution, factoring, paramodulation, demodulation, and the set of support strategy. The second generation, started by Ross Overbeek in 1970, was based on the NIUTP (Northern Illinois University Theorem Prover) series [10, 11], which evolved into AURA (Automated Reasoning Assistant) and its variants [28], with contributions from Brian Smith, Rusty Lusk, Bob Veroff, Steve Winker, and Wos. The NIUTP/AURA generation (written mostly in IBM assembly lan guage, with some PL/1) included the first high-performance implementations of hyperresolution, demodulation, and paramodulation, and it introduced unitresulting resolution and weighting. The result was the first practical set of pro grams in that their use led to answers to several open questions in equivalential calculus [41], ternary Boolean algebra [30] and semigroups [32]. The third generation of Argonne theorem provers, started in 1980 by Over beek, Lusk, and McCune, consisted mostly of the LMA [9] (Logic Machine Architecture), a toolkit (written in Pascal) for building deduction systems, and ITP (Interactive Theorem Prover), constructed with LMA. The function ality of ITP was similar to that of AURA. The motivations for LMA and ITP were sound software engineering and portability. Several experimental theorem provers based on technology for compiling logic programs were also part of the third generation. Otter is a member of the fourth generation. We started writing code for a new theorem prover in June 1987, and by December it was useful for our research on inference rules and search strategies. The program was later named Otter (Organized theorem-proving techniques for effective research). Other members of the fourth generation are ROO [8] (Radical Otter Optimization), by John Slaney, Lusk, and McCune, which is a parallel version of Otter; FDB [1] (For mula DataBase), by Overbeek and Ralph Butler, which is a unification and in dexing toolkit; MACE [16] (Models And CounterExamples), by McCune, which searches for finite models; and EQP [18] (EQuational Prover), by McCune, a program for equational logic, which incorporates associative-commutative uni fication. Aside from effective inference rules and strategies for proving theorems, speed and portability were the main considerations in building Otter, so C was used. The functionality of AURA and ITP, especially the inference and search meth ods, was quite useful in practice, so Otter retained most of it. However, low-level algorithms such as indexing techniques [13] were improved, resulting in sharp speedups over ITP. Major releases of Otter occurred at CADE-9 in May 1988 (version 0.9), in January 1989 (version 1), in March 1990 (version 2), and in January 1994 (version 3). The current version is 3.0.4, released in August 1995.
Otter: The CADE-13 Competition Incarnations
1.2
1615
APPLICATIONS OF OTTER
Otter has been applied to several areas of mathematics and logic, and many new results have been obtained with its use. Examples of such results are the existence of fixed point combinators in fragments of combinatory logic [23, 33], logic calculi with condensed detachment [25], single axioms for group calculi [12, 15], single axioms for group theory and subvarieties [14, 24, 4, 2, 5], single axioms for ternary Boolean algebra [27], equational theorems about cubic curves [26], single axioms for lattice-like algebras [20], self-dual bases for groups and for lattices [21], implicational axioms for groups and Abelian groups [22], Robbins algebra [18, 31], Moufang loops [21, 6, 7], illiative combinatory logic [3], and proofs with particular properties [34, 35, 36].
2
Architecture
Otter reads an input file containing a set of formulas and some control infor mation. The set of formulas represents the theory and denial of the conclusion (all proofs are by contradiction), and the control information consists of vari ous switches and parameter settings for specifying the inference rules and search strategies. As Otter searches, it writes information (including the proof, if found) to an output file. We now summarize how Otter works. See the manual [17] for details on the material in this section. 2.1
LOGIC
Otter applies to statements in classical first-order (unsorted) logic with equality. It accepts as input either clauses or quantified formulas. Quantified formulas (which may contain V, 3, V, A, ->, —»,«-») are immediately transformed to clauses. All of Otter's inference rules and search algorithms operate on clauses. 2.2
INFERENCE RULES
Otter's main inference rules are based on resolution or paramodulation. The res olution inference rules known to Otter are binary resolution, hyperresolution, negative hyperresolution, unit-resulting resolution, and linked unit-resulting res olution. Equational deduction is done with binary paramodulation and various forms of demodulation. (We sometimes classify demodulation as a rewriting rule rather than as an inference rule.) Factoring is not built into resolution and paramodulation; it is considered to be a separate inference rule. Otter has one additional inference rule (called gL) for problems about cubic curves in algebraic geometry. It is a generalization rule that applies to equations and is derived from the property of cubic curves that for some kinds of statement
Collected Works of Larry Wos
1616
P, if P holds at some point on a cubic curve, then P holds at every point on the curve. See [21] for details and applications. 2.3
CONTROL
An Otter process can be viewed as a closure computation with redundancy con trol; that is, Otter attempts to compute the closure of a set of input statements under a set of inference rules, applying deletion rules (subsumption and demod ulation) that typically preserve logical completeness of the inference system. The computation is driven by a loop. 2.3.1
The Inference Loop
Otter maintains three lists of clauses. Usable. These clauses are available for application of inference rules. They actively participate in the search. Sos. These clauses are waiting to participate in the search through applica tion of inference rules. (Members of sos that are equations may be participating as demodulators.) Demodulators. These are equations that are used as rewrite rules. Mem bers of demodulators may occur in usable or sos as well. The inference loop operates mainly on clauses in lists sos and usable: While sos is not eapty and no refutation has bean found, 1. Select a clause, the given-clause, in sos; 2. Move given-clause froa sos to usable; 3. Infer and process new clauses using the inference rules in effect; each new clause oust have the given-clause as one parent and aeabers of usable as other parents; retained clauses are appended to sos; End of while loop.
The processing of inferred clauses (Step 3 above) involves many optional retention tests and other procedures; the most important ones are listed here. Given newly inferred clause C, 1. Deaodulate C (with aeabers of list Demodulators); 2. Orient equality literals in C; 3. Discard C if weight(C) > the aax-weight paraaeter; 4. Discard C if it la subsuaed by a aeaber of usable or sos; 5. Check if C conflicts with any clause in usable or sos; 6. If C has passed the retention tests, then a. (optional) if C is an oriented equation, append it to Demodulators and rewrite all aeabers of usable or sos; b. discard aeabers of usable or sos subsuaed by C; c. (optional) Factor C;
The inference loop can be seen as a simple implementation of the set of support strategy, because no inferences are drawn in which all of the participants are in the initial usable list. That is, the initial sos list is the initial set of support: all lines of deduction must start with a clause in the initial sos list.
Otter: The CADE-13 Competition Incarnations
1617
The loop can also be used to drive a Knuth-Bendix completion procedure. If the initial sos list consists of the initial set of equations, all equations (input and derived) can be oriented into terminating demodulators, a restricted form of paramodulation is used, and the inference loop terminates because sos is empty, then the resulting usable list is a complete set of reductions for the theory. Our strategies for equational theorem proving evolved separately from the KnuthBendix completion, but in some cases they are similar. Two term ordering methods are available for orienting equations and guaran teeing termination of demodulation. The lexicographic recursive path ordering (LRPO) is used in the autonomous modes, with default symbol precedence con stants X high-arity -<•••-< binary -< unary, and within arity, the lexicographic ASCII ordering. The ad hoc method (which does not always guarantee termina tion) orders terms by user-assigned weights. Selection of the given clause in Step 1 of the inference loop is the most important aspect of the search process; it is the next path to explore. The default selection is the smallest clause in sos, which we call best-first search. Instead, the user may specify a breadth-first search, in which the first clause in sos is selected (sos operates as a queue). We have found that a combination of best-first and breadth-first search is frequently quite valuable, and one of Otter's parameters, the pick-given-ratio, can be used to specify a ratio: a value of n means that through n iterations of the inference loop, the smallest clause is selected, then in the next iteration the first clause is selected, and so on. Discarding large clauses (Step 3 in the processing of newly derived clauses) interferes with completeness, but it is quite important in practice. If maxweight= oo, clauses are retained and appended to sos at a much higher rate than they are removed as given clauses. As a result, most retained clauses never enter the search, and memory is wasted. If many of those clauses become de modulators, much time is spent (and wasted) using them to try to demodulate previous clauses. Thus, a good value for the max-weight parameter is impor tant to achieving a well-behaved search [18]. We frequently make several initial searches, varying the max-weight parameter until a good value is found. When multiple searches are not done (in particular in Otter's autonomous mode) the parameter control-memory is used to dynamically adjust the max-weight pa rameter based on the amount of memory available. 2.3.2
The Autonomous Mode
Although Otter is not an interactive program, we typically use it in an interactive way. We run a search, examine the output, change the switches and parameters to adjust Otter's behavior, then start another search, and so on. Because this kind of multiple search is still an art form, we have not attempted to automate it. However, Otter has a fully automatic mode, called the autonomous mode, which is useful for inexperienced users, easy problems, situations in which Otter is called from another program, and comparison with other programs.
Collected Works of Larry Wos
1618
In the autonomous mode, Otter unconditionally sets several options and partitions clauses into the usable and sos lists. Otter then checks its input for the following properties: whether all clauses are prepositional, whether all clauses are Horn, whether the equality relation is present, and, if equality is present, whether equality axioms are present. The autonomous mode algorithm is the following. set Bax-aea to 12 Megabytes; sat control-aaaory flag; •at pick-givan-ratio parameter to 4; sat procass-lnput flag; placa positiva clauses In sos list; placa nonpositiva clausas in usable list; if (all clauses are propositional) than sat propositional flag; sat hyperresolutlon flag; else if (nonunits are present) then set hyperresolutlon flag; if (all clausas are Horn) then clear ordered-hyperresolution flag; else set factoring flag; sat unit-deletion flag; if (equality is present) then set knuth-bendix flag; if (equality axioms are present) then clear paramodulation flags;
The max-mem parameter limits the amount of memory available for stor age of clauses and related data structures, the process-input flag causes input clauses to be processed as if they were derived clauses, the propositioned flag causes several optimizations particular to propositional clauses to be in effect, the ordered-hyperresolution flag (set by default) prevents satellites from resolv ing on nonmaximal literals, the unit-deletion flag causes each unit clause, say P, to be used as a rewrite rule P = TRUE to simplify nonunit derived clauses, and the knuth-bendix flag causes several additional options to be set so that the search resembles Knuth-Bendix completion (see [17]). The two competition entries named Otter-304z were run in the (ordinary) autonomous mode. 2.3.3
The Auto- Wos Mode
A different version of the autonomous mode, called auto-wos, was created specif ically for the CADE-13 competition. The first reason for this was so that Otter could compete in the "monolithic" class, which does not allow different modules of code to be called based on properties of the input clauses. The second reason was so that we could use a different paramodulation strategy. The auto-wos algorithm is the following. 1. set flags process-input, control-aenory, hyperresolutlon, knuth-bendix, para-froa-units-only, unit-deletion, factor; 2. clear flag index-for-back-deBOd-flag;
Otter: The CADE-13 Competition Incarnations
1619
3. set pick-given-ratio paraoeter to 4; 4. if (every positive clause in sos is ground) then move all positive clauses to sos;
The property that makes auto-wos mode "monolithic" is that (nearly) all modules used for some type of input in ordinary autonomous mode are used for all types of problem in auto-wos mode. For example, clauses are indexed for paramodulation, and paramodulation is called even if no equality literals are present; and hyperresolution and factoring are called even if no nonunit clauses are present. The flag index-for-back-demod (default set if back demodulation is in effect) causes all terms in all clauses to be indexed so that they can be found if they can be rewritten by a newly derived demodulator. We clear this flag because indexing all terms is an expensive operation and very wasteful if no equality is present. The second, and more practical, feature of auto-wos mode is that paramod ulation from nonunit clauses is prohibited. This restriction is incomplete in general, but it is quite useful in practice. The competition entry named Otter-Wos was run in the auto-wos mode. 2.4
TUNING FOR THE COMPETITION
For both Otter-304z and Otter-Wos, the value of the max-mem parameter was increased from 12 megabytes to 20 megabytes. This change affects performance because it can change the set of retained clauses; in particular, the behavior of the control-memory feature, which automatically adjusts the max-weight pa rameter, depends on the value of max-mem. The auto-wos mode (thus Otter-Wos) was tuned with the 391 "Eligible Mixed" set of TPTP problems. First, we experimented with the initial set of support. The TPTP classifies each input clause as "axiom", "hypothesis", or "conjecture". (Otter-304z does not use this information.) To decide the initial sos list, we experimented with several rules of the form sos «— hypothesis U conjecture; if P(sos), then sos «— sos U /(axiom); for various properties P and functions / . In the end, we used the rule with P = "all positive clauses are ground" and / = "positive clauses". Second, we experimented with the hot list strategy [36], which causes Otter to give special emphasis to key clauses; results indicated that our current hot list strategies are best used in the iterative-search mode rather than in autonomous modes, so the hot list strategy was not used for the competition.
3
Implementation
Otter is written in the C programming language, which was chosen for exe cution speed and portability. It contains about 35,000 lines of code (including
1620
CoJJected Works of Larry Wos
comments). Clauses and terms are stored in shared data structures, which speed some of the indexing and inference operations and save memory. Specially de signed and tuned indexing algorithms [13] are used to access terms and clauses for subsumption operations, application in inference rules, and application of demodulators. Otter is designed to run in a UNIX-like environment, but versions (with several limitations) are available also for DOS computers and Macintoshes.
4
Performance in the Competition
Otter-304z in the unit equality competition. Otter placed first, proving 43 of 50 theorems in 2750 seconds. In second place was Waldmeister, with 37 proofs in 4730 seconds. Otter's performance is not surprising to us because application to real problems has driven its development and because we have focused on equational applications in the past few years. Otter-304z in the mixed/open competition. Otter placed second in this category, with 28 proofs of 50 theorems in 7314 seconds. The winner was SPASS, with 32 proofs in 6244 seconds. Otter's performance was not surprising to us because most of these theorems are non-Horn, and many contain a mixture of equality and nonequality relations; we have worked on very few applications with these properties, and no special tuning was done for this area. Otter-Wos in the mixed/monolithic competition. Otter placed sec ond, with 32 proofs of 50 theorems in 6037 seconds. The winner was E-SETHEO, with 36 proofs in 5655 seconds. We can compare these with the mixed/open competition, because the same set of theorems was used. The positive effect of the paramodulation restriction more than offset the wasted indexing operations for theorems without equality. Both E-SETHEO and Otter did better than we expected when compared with the mixed/open results. In the design of the competition, the open/monolithic distinction was made because it was thought that the open systems would have an unfair advantage. In this competition, at least, the monolithic systems did better, so perhaps the mixed/open and mixed/monolithic categories should be judged together. In that case, E-SETHEO wins, Otter-Wos places second, SPASS is very close behind in third, and Otter-304z is sixth. Otter's performance in the competition clearly points to its strengths in unit equality reasoning and its weaknesses in non-Horn deduction and on problems with a mixture of equality and nonequality relations. A strength not evident from the competition is deduction in Horn theories, and a weakness not evident is propositional unsatisfiability.
Otter: The CADE-13 Competition Incarnations
5
1621
Conclusion
One of the most important features of the results can be seen in the tables of runtimes for each system on each theorem [29]. Most of the theorems on which the top finishers failed were proved easily by at least one system. Each of the unit equality theorems was proved by at least one system, and 45 of 50 were proved in less than 20 seconds by at least one system. Of the mixed theorems, 46 were proved by at least one system, and 44 were proved in less than 17 seconds by at least one system. These results support our long-held position that the best method for automated deduction is a variety of methods.
References 1. Butler, R. and Overbeek, R.: Formula databases for high-performance resolution/paramodulation systems, Journal of Automated Reasoning 12(2) (1994), 139-156. 2. Hart, J. and Kunen, K.: Single axioms for odd exponent groups, Journal of Automated Reasoning 14(3) (1995), 383-412. 3. Jech, T.: Otter experiments in a system of combinatory logic, Journal of Automated Reasoning 14(3) (1995), 413-426. 4. Kunen, K.: Single axioms for groups, Journal of Automated Reasoning 9(3) (1992), 291-308. 5. Kunen, K.: The shortest single axioms for groups of exponent 4, Computers and Mathematics with Applications 29(1 (1995), 1-12. 6. Kunen, K.: Moufang quasigroups, Journal of Algebra 83 (1996), 231-234. 7. Kunen, K.: Quasigroups, loops, and associative laws, J. Algebra83 (1996). To appear. 8. Lusk, E. and McCune, W.: Experiments with ROO, a parallel automated deduction system, in: B. Fronhofer and G. Wrightson (eds.), Parallelization in Inference Systems, LNAI, 590, Springer-Verlag, Berlin, 1992, pp. 139-162. 9. Lusk, E., McCune, W. and Overbeek, R.: Logic machine architecture: Kernel functions, in: D. Loveland (ed.), Proc. of CADE-6, LNCS, 138, SpringerVerlag, Berlin, 1982, pp. 70-84. 10. McCharen, J., Overbeek, R. and Wos, L.: Complexity and related enhance ments for automated theorem-proving programs, Comp. Math, with Appli cations 2 (1976), 1-16.
1622
Collected Works of Larry Wos
11. McCharen, J., Overbeek, R. and Wos, L.: Problems and experiments for and with automated theorem-proving programs, IEEE Trans. Comp. C-25(8) (1976), 773-782. 12. McCune, W.: Automated discovery of new axiomatizations of the left group and right group calculi, Journal of Automated Reasoning 9(1) (1992), 1-24. 13. McCune, W.: Experiments with discrimination tree indexing and path in dexing for term retrieval, Journal of Automated Reasoning 9(2) (1992), 147-167. Invited paper. 14. McCune, W.: Single axioms for groups and Abelian groups with various operations, Journal of Automated Reasoning 10(1) (1993), 1-13. 15. McCune, W.: Single axioms for the left group and right group calculi, Notre Dame J. Formal Logic 34(1) (1993), 132-139. 16. McCune, W.: A Davis-Putnam Program and its Application to Finite First-Order Model Search: Quasigroup Existence Problems, Tech, Report ANL/MCS-TM-194, Argonne National Laboratory, Argonne, IL, May 1994. 17. McCune, W.: OTTER 3.0 Reference Manual and Guide. Tech. Report ANL94/6, Argonne National Laboratory, Argonne, IL, 1994. 18. McCune, W.: 33 basic test problems: A practical evaluation of some paramodulation strategies. Preprint ANL/MCS-P618-1096, Argonne Na tional Laboratory, 1996. 19. McCune, W.: Otter, 1996.
http://www.mcs.anl.gov/home/mccune/ar/otter/,
20. McCune, W. and Padmanabhan, R.: Single identities for lattice theory and weakly associative lattices. Preprint MCS-P493-0395, Argonne National Laboratory, 1995. 21. McCune, W. and Padmanabhan, R.: Automated Deduction in Equational Logic and Cubic Curves, LNAI, 1095, Springer-Verlag, Berlin, 1996. 22. McCune, W. and Sands, A. D.: Computer and human reasoning: Single implicative axioms for groups and for Abelian groups, American Math. Monthly, December 1996. To appear. 23. McCune, W. and Wos, L.: The absence and the presence of fixed point combinators, Theoretical Computer Science 87 (1991), 221-228. 24. McCune, W. and Wos, L.: Application of automated deduction to the search for single axioms for exponent groups, in: A. Voronkov (ed.), Logic Program ming and Automated Reasoning, LNAI, 624, Springer-Verlag, Berlin, 1992, pp. 131-136.
Otter: The CADE-13 Competition Incarnations
1623
25. McCune, W. and Wos, L.: Experiments in automated deduction with con densed detachment, in: D. Kapur (ed.), Proceedings of CADE-11, LNAI, 607, Springer-Verlag, Berlin, 1992, pp. 209-223. 26. Padmanabhan, R. and McCune, W.: Automated reasoning about cubic curves, Comp. Math, with Applications 29(2) (1995), 17-26. 27. Padmanabhan, R. and McCune, W.: Single identities for ternary Boolean algebras, Comp. Math, ivith Applications 29(2) (1995), 13-16. 28. Smith, B.: Reference Manual for the Environmental Theorem Proven An Incarnation of AURA. Tech. Report ANL-88-2, Argonne National Labora tory, 1988. 29. Sutcliffe, G. and Suttner, C : The Results of the CADE-13 ATP System Competition. Journal of Automated Reasoning 18(2) (1997). 30. Winker, S.: Generation and verification of finite models and counterexam ples using an automated theorem prover answering two open questions, J. ACM 29 (1992), 273-284. 31. Winker, S.: Robbins algebra: Conditions that make a near-Boolean algebra Boolean, Journal of Automated Reasoningfi{4) (1990), 465-489. 32. Winker, S., Wos, L. and Lusk, E.: Semigroups, antiautomorphisms, and involutions: A computer solution to an open problem, I, Math. Comp. 37 (1981), 533-545. 33. Wos, L.: The kernel strategy and its use for the study of combinatory logic, Journal of Automated Reasoning 10(3) (1993), 287-343. 34. Wos, L.: Searching for circles of pure proofs, Journal of Automated Rea soning 15(3) (1995), 279-315. 35. Wos, L.: Otter and the Moufang identity problem, Journal of Automated Reasoning 17(2) (1996), 215-257. 36. Wos, L.: The power of combining resonance with heat, Journal of Automated Reasoning 17(1) (1996), 23-81. 37. Wos, L., Carson, D. and Robinson, G.: The unit preference strategy in theorem proving, in AFIPS Proc. 26, Spartan Books, 1964, pp. 615-621. 38. Wos, L. and Robinson, G.: Paramodulation and set of support, in IRIA Symposium on Automatic Demonstration, Springer-Verlag, 1968, pp. 276310. 39. Wos, L., Robinson, G. and Carson, D.: Efficiency and completeness of the set of support strategy in theorem proving, J. J 4 C M 1 2 ( 4 ) (1965), 536-541.
1624
Collected Works of Larry Wos
40. Wos, L., Robinson, G., Carson, D. and Shalla, L.: The concept of demodu lation in theorem proving, J. A CM 14(4) (1967), 698-709. 41. Wos, L., Winker, S., Smith, B., Veroff, R. and Henschen, L.: A new use of an automated reasoning assistant: Open questions in equivalential calculus and the study of infinite domains, Artificial Intelligence 22 (1984), 303-356.
Larry Wos Programs That Offer
Fast, Flawless, Logical Reasoning Confused by too many reasonable conclusions? Sort them out through automated reasoning using special strategies that logically restrict and direct the search for the answer. The English detective Sherlock Holmes and Star Trek's Mr. Spock could reason logically and flawlessly, always. Some people you know have that ability, sometimes. Unfortunately, without perfect reasoning, diverse problems arise, like bugs in computer programs (if a sort program places Sun before Intel, more than disappointment is experienced); flaws in chip design (one type of Pentium chip became infamous several years ago because of a flaw); and errors in mathematical proofs (paper with a title of the form "On an Error by MacLane" is easily remembered, but not with pleasure—at least by MacLane). How can the likelihood of such disasters be reduced? One answer is automated reasoning. The focus of automated reasoning is the design and implementation of com puter programs that flawlessly apply logical reasoning to reach the objective, whether the area of interest is circuit design, program verification, theorem proving, puzzle solving, or something else. Featured in this article is the versa tile program OTTER—developed by researcher William McCune [3]—that you can use to attack problems in each of these areas, especially to sharply reduce the likelihood of disaster. (For lots more on automated reasoning at Argonne National Laboratory, including pointers to obtaining an automated reasoning program called OTTER, as well as new results, neat proofs, and puzzles, see www.mcs.anl.gov/home/mccune/ar/.) Fortunately, you can easily obtain your own personal copy of OTTER, which is included on a diskette in [9]. That book also shows the process by which Reprinted with permission from CACM, Vol. 41, no. 6, 87-102 (June 1998).
1626
Collected Works of Larry Wos
significant discoveries are made using an automated reasoning program. You can obtain a copy of the OTTER source code through the Argonne Web page. Finally, for those who want a taste of using OTTER immediately, try the Son of BirdBrain hot-link on the same Web page. Before you decide whether access to an automated reasoning program will sharply increase your likelihood of success, you might wonder how its reasoning differs from your own and from that of other ordinary humans. You might also be curious about how its strategic attack differs from an attack a person typically takes. I believe—although some of my colleagues do not entirely share my views—that precious little is known about how people consciously reason, especially when attacking a deep problem. The eureka experience is well documented. Jules Henri Poincare, the French mathematician, 1854-1912, after failing to solve a problem on which he had worked for months, suddenly knew its solution. I have had a similar experience: waking at 3 A.M., instantly aware of what was needed to solve a problem in abstract algebra. The subconscious mind is a marvel. A computer program (of the type under discussion) has no subconscious mind, nor intuition, nor, for that matter, experience on which to draw. Also in sharp contrast to the way people reason is an automated reasoning program's use of specific and well-defined inference rules for drawing conclusions. People, I have discovered, seldom use specific rules for drawing conclusions, even when the subject is mathematics. In addition, people often wish to reason from pairs of statements, whereas a reasoning program like OTTER offers various means of drawing conclusions from statements taken three or more at a time. Compared with reasoning, even less is known about how a person selects appropriate data from a huge amount of information—specifically, which tech niques (strategies) are used to restrict the reasoning and which are used to direct it. Indeed, how does the disciplined mind escape drowning in useless conclusions, and how does such a mind avoid getting lost? If you question researchers, you will find that an explicit strategy is seldom used, in contrast to the case in playing chess or playing poker. If a reasoning program is to serve well as an assistant, however, the use of explicit strategies (I use the plural deliberately) is an absolute necessity. Strategies for restricting and strategies for directing a program's reasoning have intrigued me for decades. Figure 1 lists some of the more powerful ones my colleagues and I have formulated. Through such strategies, a reasoning program can avoid drowning in new conclusions and avoid getting lost. Also, by using such strategies, OTTER can attack a wide variety of problems from diverse areas. (You might find it interesting to note that one of my most important contributions to the field was the introduction, in 1963, of the use of strategy by automated reasoning programs. I am almost equally proud of having intro duced the term "automated reasoning" in 1980; it captures far better than the traditional term "automated theorem proving" the remarkable diversity of these computer programs.) OTTER has been remarkably successful in such attacks,
Programs That Offer Fast, Flawless, Logical Reasoning
1627
not the least of which is its answering of various questions that had resisted mathematicians for decades. (For such a success with a related program, see Figure 2. For evidence of how well automated reasoning is doing, see Figure 3.) But to answer a pressing question, OTTER will never replace people. Rather, it is intended to complement the approach taken by a person, not to emulate it.
The Program OTTER Through the sponsorship of the U.S. Department of Energy and its predeces sors, researchers at Argonne have been designing and implementing automated reasoning programs for more than 30 years. William McCune worked for several years on earlier reasoning programs before producing—in approximately four months—the first version of OTTER in 1987. The 1998 version of OTTER con sists of more than 24,000 lines of C and can be used on workstations, PCs, and Macintoshes. OTTER (Organized Theorem-proving Techniques for Effective Research) de rives its name in part from its original intended use and in part from the delight of using it—in the same way one delights in watching the aquatic mammal of the same name. The program was designed and implemented for a number of reasons, including to give a person using it access to a tireless team member, offering (1) a wide variety of automated means for drawing conclusions that fol low inevitably from the assumptions that are supplied and (2) diverse powerful strategies for controlling the program's reasoning.
Problems Solved with Logical Reasoning The following five example problems, each involving logical reasoning, provide a taste of what a reasoning program (such as OTTER) can do for you. They also suggest charming choices you can make for the inference rules the program uses to draw conclusions; the strategies for restricting and directing its reasoning; and features, such as those for rewriting information into a canonical form. The examples also hint at unpleasant features of using automated reasoning programs: the input language; the need to be explicit about trivial information; and the dangers of implicit information and irrelevant information, both of which affect the program's chances of success. Perhaps as compensation for your labor, however, the program protects you in various ways. For example, a person might easily think of the brother of Bob's aunt as Bob's uncle—which is not necessarily the case. An automated reasoning program would not make such a possibly incorrect translation. The five problems may help you find new applications, professional and recreational, for automated reasoning. You will discover, among other things, that a program like OTTER does not imitate the approach a person ordinarily
Collected Works of Larry Wos
1628
takes, which is why the term Iartificial ntelligence—especially in view of AI's original intent in the 1960s—does not apply. Databases. This example is vaguely reminiscent of a simple database problem. You have some knowledge and, by drawing some conclusions, hope to determine whether an assertion is true. Here is the problem: You are told that Joy, who is married and not male, is the managing editor of the Journal of Automated Reasoning and that the only person who left the parking lot before 5 P.M. was not female. You are then told that Joy left the parking lot before 5 A.M. Finally, you are asked to prove that this last assertion is false. Elementary reasoning suffices. You first conclude that Joy is female; you then use that conclusion to deduce that Joy did not leave the parking lot before 5 P.M. A contradiction is obtained— you have completed a proof by contradiction and, in particular, solved the prob lem by showing that the last assertion is false. If you look closely, you see that you ignored two items of information—that Joy is a managing editor and that Joy is married—and at the same time used one item of information that was not given explicitly-—that people are female or male. What would happen if the same example were given to an automated rea soning program? So that you can briefly experience what can be less pleasant, I give some of the possibly pertinent information in clause form [12] (one of the language representations OTTER recognizes), where logical not is denoted by «_!) .
Joy i s not male:
-MALE(Joy).
Joy is managing editor of JAR:
EDITOR(Joy).
Without more information, the program would fail to draw any conclusions. Why? First, it does not "know" that each person is female or male; it must be told so with, for example, the following clause, where logical or is denoted by Kin.
FENALE(x)
I MALE(x).
(Your conclusion that x is a variable is indeed correct, implicitly ranging over all people.) For that matter, the program does not even "understand" the concept of female or of male. Indeed, without the information that every person is female or male (which you used implicitly), the program would be helpless. Even with that information, the program would require additional help. You would have to choose some specific inference rule-a rule of reasoning with which to draw conclusions. OTTER (and many other such programs) could use a rule, such as unit-resulting resolution, which works in the following way: The program takes the clause asserting that Joy is not male and unifies it with one of the literals in the clause asserting that each person is female or male. In particular, all occurrences of the variable x in the female-or-male clause are replaced with the term Joy. Then, the -MALE(Joy) literal cancels the (just-
Programs That Offer Fast, Flawless, Logical Reasoning
1629
obtained) MALE(Joy) literal (because the two literals are identical but opposite in sign), and the useful conclusion is reached and stored in the following clause: FEMALE(Joy). (For those who are curious about other ways OTTER reasons, and especially about how its reasoning sharply differs from that expected of a person, see the circuit design and the two-inverter problem later in the article.) Does OTTER have enougha data to succeed now? Perhaps, but unless you add strategy, the odds are high that the program would get lost, at least for problems of greater depth. One of the key strategies used by OTTER to restrict its reasoning is the set of support strategy [12]. You tell the program which state ments presenting the problem are (in effect) general information. This strategy restricts the program from applying an inference rule to a set of items all of which are among the general-information statements. The program is there fore prevented from exploring the underlying theory from which the problem is taken, thereby almost always sharply increasing its efficiency. Strategy—explicit strategy—is vital to OTTER and to any reasoning pro gram attacking deep questions; for more on the various strategies used by OT TER, see [12], and Figure 1. In contrast, a person seldom if ever uses explicit strategy. In no way does this fact mean that people are not brilliant at prob lem solving; indeed, we are. It means that OTTER is not designed to emulate a person's reasoning, perhaps explaining why OTTER makes such a valuable team member—complementing the approach a person might take. Circuit design. In language, the and of two statements is true if and only if each is true; otherwise, the and is false. In circuit design, in effect, the same holds: An AND gate takes two inputs and outputs 1 if and only if each input is 1; otherwise, the AND gate outputs 0. In this example, you are asked to design a number of different circuits, but you are constrained to avoid the use of AND gates because their cost has risen sharply. Rather than taking a complicated approach, you decide to use OR gates and NOT gates. You rely on one single simplification, or "canonicalization" rule: The and of A and B = not (not (.A) or not(S)). OTTER can apply such a rule, as well as other such rules, without error, at the rate of 5,000 rules per CPU second. (In contrast to its lack of under standing of most concepts, OTTER "understands" equality, as demonstrated in this and the next example.) Perhaps you are puzzled. Application of such a simplification rule is hardly difficult and not particularly prone to error. But now imagine being presented with 17,000 simplification rules (called demodulators [12] in automated reason ing) and an expression rewritten into its final form only after 1,766 demodulators have been applied. For an additional measure of the chore that simplification and canonicalization can present, I note that in one of the greatest successes with a reasoning program—the answering of an open question concerning Robbins algebra [4]—more than 500,000 CPU seconds were spent on demodulation, ap-
Collected Works of Larry Wos
1630
proximately 75% of the total run time; also see [2] and Figure 2 for a statement of the Robbins problem, which had resisted mathematicians for 60 years. Now you see how what might seem innocent on the surface, namely, simplification, can be a nightmare if attacked by hand rather than by computer. Arithmetic and mathematics. You are given the following two well-known p roperties of arithmetic (and of group theory):
x + -x = 0 y + (-y + z) = z and are asked to deduce a third well-known, useful, and powerful property:
y = (-y)OTTER offers an inference rule, called paramodulation [12], that does almost all of the work needed to draw this conclusion immediately. (Paramodulation, ex plored later, is more general than equality substitution.) With paramodulation, the program deduces y + 0 = -(-y), which, assuming that (as is usually the case) the following simplification rule is applied, is rewritten to the desired result: w+0= w With paramodulation, an automated reasoning program finds conclusions of (in a sense) maximum generality. People, on the other hand, typically seek a conclusion that mirrors earlier experience and intuition, although that con clusion may lack the needed generality, in turn preventing them from finding the desired information by, say, completing the sought-after proof. Unification indeed saves the day, by finding the most general replacement for variables that, when applied to the two expressions of concern, yields two identical expressions. When the needed most general replacement for variables is overlooked—which can happen easily if done by hand—chaos can result. For but one example, a specific conclusion might be drawn, rather than a needed general conclusion. An automated reasoning program is not subject to such misfortune. A difficult puzzle. Like Lewis Carroll, the 19th-century English mathemati cian and author of Alice in Wonderland, and Raymond Smullyan, the logician and professor of philosophy at Indiana University, many people are fascinated by puzzles. You might find the following billiard ball puzzle stimulating and useful, and want to offer it to colleagues, friends, loved ones, and strangers. There are 12 billiard balls, 11 of which are identical in weight. The remaining ball—the odd one—has a different weight. You are not told whether it is heavier or lighter. You have a balance scale for
Programs That Offer Fast, Flawless, Logical Reasoning
1631
weighing the balls. Can you find which ball is the odd ball in three weighings? And can you also find whether it is lighter or heavier than the others? The heart of the problem concerns the constraint of the three weighings. (I'll give you a hint about solving the puzzle just after mentioning the number of solutions that were found; stop reading here if you wish to solve the puzzle independently.) Without such a constraint, you could choose two billiard balls and weigh one against the other with the scale. If they balanced, you would mark each as standard, as one of the 11 with identical weight. If they did not balance—even better—you would learn something crucial, putting them aside and marking them as undecided. You would then know that the remaining 10 were of identical weight, and it would be a trivial matter to ascertain which was the odd ball and whether it was lighter or heavier. But the billiard ball puzzle, like life itself, is not that easy, and you may be surprised to learn that OTTER found more than 40 nontrivially distinct solutions [12] for this puzzle— while some people were still working on one. (Hint: Begin by weighing four balls against four balls.) Circuit design and the two-inverter problem. The following problem has been included on various exams given to Ph.D. candidates in engineering. The challenge to the circuit designer is twofold: meet all the restrictions and ensure that the circuit behaves as desired. A person might follow one unrewarding line of reasoning after another, getting lost in the myriad of paths leading nowhere. An automated reasoning program succeeds easily [12]. Can you solve the follow ing problem? Using as many AND and OR gates as you like, but using only two NOT gates, design a circuit according to the following specification: There are three inputs—il, i2, and i3—and three outputs—ol, o2, and o3. The outputs are related to the inputs in the following simple way: ol = not(il), o2 = not(i2), o3 = not(i3). Remember, you can use only two NOT gates. (Once you have tried your hand, you might want to glance at the pictorial result in Figure 4, translated from OTTER's success.)
A Grand Return on the Investment These problems give some idea how complex reasoning often is for a person—and for a computer program. You should also have some feeling for the value of using an automated reasoning program, especially for attacking difficult problems. How comforting it is to know that none of the reasoning contains an error, that
1632
Collected Works of Larry Wos
the program does not tire, and that it explores paths of reasoning that would be too exhausting for a person. Further, we would still be in the dark about some of the problems whose solutions are now known were it not for the role played by a program like OTTER. The five example problems are no problem for OTTER; otherwise, I would have used "better" examples. But OTTER, as well as other automated reasoning programs, has answered numerous and far more challenging questions, some of which defied experts for years [4, 5, 9]. Nevertheless, a miracle is not at hand. OTTER's principal successes have been in mathematics and logic, finding answers to open questions concerning combinatory logic, lattice theory, and algebraic geometry. The reason why de pends largely on the fact that these areas offer concise descriptions of their underlying theories. Access to such a concise description (a set of axioms, for example) is often missing when one contemplates a new application of auto mated reasoning. Consider what would happen if you wanted to determine whether certain properties held in field theory (a branch of physics), relying on the assistance of an automated reasoning assistant. First, you would have to formulate the precise concepts that are needed. Then, you would have to find a way to map the salient concepts into the language accepted by whatever automated reasoning program you intended to use. In another example, if you were studying astronomy, the concepts of planet, star, galaxy, universe, and the like might be tough nuts to crack. For a problem taken directly from industry (a problem on which a colleague ad I worked), imagine that an assembly line is producing cars—some painted blue, some green; some with air conditioning; some with power windows; and the like—and you know that the line's efficiency is severely reduced if the cars are sequenced randomly. For example, flushing the painter to refill it with blue and green alternately is not ordinarily efficient; similarly, since installing air conditioning can be time consuming, a sequence of cars all requiring this feature might not be the best. An automated reasoning program might indeed aid you in finding a good car-sequencing algorithm, but you would need to convey the crucial information; for a discussion of the approach taken to this job-scheduling problem, see [6]. (The car-sequencing problem is representative of a class of optimization problems typically studied in the field of operations research.) Both tasks—"axiomatization" and representation in the program's language—can be trying, even formidable. Nevertheless, once all is in place, the return on such an investment can be astounding. Automated reasoning programs (such as OTTER and the program of Boyer and Moore [1]) have, for example, been used in research [5, 9] and applications [11] to • Produce a fully automated proof of the correctness of a division circuit that implements the floating-point IEEE standard.
Programs That Offer Fast, Flawless, Logical Reasoning
1633
• Produce correctness proofs of security systems. • Verify commercial-size adder and multiplier circuits. • Achieve new mathematics, such as new results in quasigroups and in nonEuclidean geometry. • Settle open questions, such as finding minimal axiom sets. • Confirm conjectures, such as that of Higmann, and the paradox of Gerard. Reasoning programs have also been used by educators in undergraduate logic courses and in upper-level courses in interactive theorem proving. And as a recreational example, automated reasoning programs have turned out to be excellent assistants in puzzle solving. (For easy and hard puzzles, including variations on the well-known checkerboard-and-dominoes puzzle, see [12] and the OTTER Web site.)
Computer-oriented Reasoning vs. Person-oriented Reasoning Does automated reasoning mirror the classic approach to artificial intelligence? Does OTTER reason somewhat the way a person does? The answer to both questions is a resounding no, if one adheres to the strictest definitions. Unification is at the heart of automated reasoning. You have probably con jectured, correctly, that unifying expressions is not typical of what a person does. Reasoning focusing on equality offers another example of what OTTER does well and what a person sometimes finds arduous. As evidence, focusing on the following three equations, return to the puzzle problem and the use of paramodulation. You obtain te third equation by way of a well-chosen replacement of terms for variables in each of the first two equations, followed by an equals-for-equals substitution from the lefthand argument of the modified first equation into a proper subterm of the lefthand argument of the modified second equation: x H—x = 0 y + (-y + z) = z y
+ o = -(-y)
Indeed, if you replace all occurrences of x in the first equation with — y and all occurrences of z in the second with — (—y), then you are ready to apply the final equality-substitution step to obtain the third equation. Paramodulation com bines the variable-replacement step and the equality-substitution step; it finds the most general replacement yielding identical subexpressions (through unifi cation); and it produces the conclusion without an intermediate (so to speak)
1634
Collected Works of Larry Wos
subconclusion—and in one step. I suspect that you do not need a more com plicated illustration of paramodulation to be persuaded that a person might not always find the appropriate variable replacement and might therefore miss drawing a key conclusion. On the other hand, if you want an example of what a person does well and what OTTER does not even attempt, you need to turn to what is called instanti ation. Although perhaps without actual use of the formal name "instantiation," you may have seen this inference rule being used by some lecturer or author when a formula or equation is presented with, say, variables x, y, and z and a possibly mysterious conclusion is presented next by replacing (instantiating) z with uv + vv (with u and v being variables); y by a(b + c) for the constants a, b, and c; and x by the familiar and well-known number 2. The mysteriousness (if present) results from the lack of explanation for this particular instantiation (choice of instances) from among the infinite possibilities that could have been chosen. For that reason, OTTER (and similar programs) do not offer instan tiation as an inference rule; I know of no effective strategy for wisely choosing from among the infinite set of instances usually available. Aware that an automated reasoning program does not rely on instantia tion to draw conclusions, you might wonder what inference rules it does use, in addition to UR-resolution (used in the databases problem example) and paramodulation (used in the arithmetic and mathematics problem example). You are correct if you conjectured that UR-resolution requires the conclusion to be nonempty and free of logical or. OTTER also offers an inference rule— called hyperresolution—that yields conclusions free of logical not. the program frequently applies both inference rules to a set of statements containing more than two items—which is not the way a person usually reasons. The program also offers you binary resolution, a rule that always focuses on pairs of state ments without any constraint on the conclusion that is drawn—which is like a person's reasoning. Even with such diverse rules for drawing conclusions, all would still be lost were it not for strategy. The program's reasoning must be restricted and must also be directed; see, for example, the arithmetic and mathematics problem and Figure 4. Further, to be most effective, some means is needed for the program to benefit from what you know and what you do well. Indeed, you might wish to combine a person's experience, intuition, and reasoning with the reasoning power of a program like OTTER. In a sense, OTTER lets you do just that—through the use of strategy—as shown in the following examples. • You have some experience that suggests one subexpression merits prefer ence over another, such as one involving sum over one involving product. You can use the weighting strategy [12] to guide the program accordingly. In another example, you might want to design circuits with minimal, but perhaps some, use of OR gates. With weighting, you can instruct the pro-
Programs That Offer Fast, Flawless, Logical Reasoning
1635
gram to follow your preference. • Your intuition—or even a wild guess—tells you that the steps of a proof you have in hand could be used profitably to find a proof only distantly related. Either of two strategies—hints [7] or resonance [9]—can be used to achieve your intent. • You conjecture that certain statements in the problem description, as par ents, merit immediate visiting and even immediate revisiting when con clusions are to be drawn. You can have your way by using the hot list strategy [10]. Using these and other strategies, and guided by your own reasoning, experi ence, and intuition, OTTER can assist you in solving a wide variety of problems.
A Replacement for People? OTTER is not a replacement for a person. As noted, it cannot draw on intuition or experience, nor can it formulate new concepts. Such a program does not learn, nor is it self-analytical in the following sense: When you choose an approach to attacking a problem, you often monitor (in some fashion) your progress and, based on that monitoring, modify that approach as you go along. Someday, but not now, an automated reasoning program will have that self-analytical capacity (see [8]). An automated reasoning program lacks common sense, cannot judge the accuracy of your statements, and cannot test for omissions in the problem description. It trusts you. In many other ways, however, a program like OTTER provides excellent incentives for relying on it instead of relying exclusively on a person. First, OTTER is remarkably powerful, being able to draw thousands of conclusions per second. And it does not tire, continuing to draw conclusions at virtually the same rate even after millions of conclusions have been drawn. OTTER does not leave huge gaps in its reasoning, gaps that would force you to guess the not-always-obvious omitted steps. It explicitly presents its work in an output file, including the history of each of its conclusions. If your initial attack on a problem fails, you can examine what OTTER has done and modify your approach or correct the input. You might, for example, find that the problem description is inconsistent. Moreover, OTTER can have multiple personalities (without the attendant psychological problems). In particular, if you have access to a number of com puters, you can apply a multifaceted attack, having the program try different approaches on different machines. Such a multifaceted attack might enable you to explore radically different approaches that might ordinarily be rejected be cause of the required effort.
1636
Collected Works of Larry Wos
OTTER was not designed to replace people, or even to imitate people. Will it or will any other automated reasoning program replace scientists and engi neers? Never. Unquestionably, automated reasoning has made great strides in the past few years. But at most, I expect automated reasoning programs to enable people to devote their energy and time to bigger pictures, having reason ing programs attack smaller problems quickly and flawlessly and, occasionally, without assistance answer deep questions.
REFERENCES 1. Boyer, R., and Moore, J A Computational Logic Handbook. New York: Academic Press, 1988 (seealsowww.cli.com/software/nqthm/obtaining.html). 2. Kolata, G. With major math proof, brute computers show flash of reason ing power. New York Times, Dec. 10, 1996, Cl. 3. McCune, W. OTTER 3.0 reference manual and guide. Technical Report ANL-94/6, Argonne National Laboratory, Argonne, 111., 1994. 4. McCune, W. Solution of the Robbins problem. J. Autom. Reasoning 19, 3 (Dec. 1997) 277-318. 5. McCune, W., and Padmanabhan, R. Automated Deduction in Equational Logic and Cubic Curves. Lecture Notes in Computer Science 1095. SpringerVerlag, Heidelberg, Germany, 1996; see also www.mcs.anl.gov/home/mccune/ar/ monograph/. 6. Parrello, B., Kabat, W., and Wos, L. Job-shop scheduling using auto mated reasoning: A case study of the car-sequencing problem. J. Autom. Reasoning 2, 1 (1986), 1-42. 7. Veroff, R. Using hints to increase the effectiveness of an automated rea soning program: Case studies, J. Autom. Reasoning 16, 3 (June 1996), 223-239. 8. Wos, L. Automated Reasoning: S3 Basic Research Problems. Prentice-Hall, Englewood Cliffs, N.J., 1987. 9. Wos, L. The Automation of Reasoning: An Experimenter's Notebook with OTTER Tutorial. Academic Press: New York, 1996. 10. Wos, L. OTTER and the Moufang identity problem. J. Autom. Reasoning 17, 2 (October 1996), 259-289. 11. Wos, L., and Pieper, G., eds. Special issue on automated reasoning. Com puters and Mathematics with Applications 29, 2 (Feb. 1995), 133-178.
Programs That Offer Fast, Flawless, Logical Reasoning
1637
12. Wos, L., Overbeek, R., Lusk, E., and Boyle, J. Automated Reasoning: fntroduction and Applications, 2nd ed., McGraw-Hill, New York, 1992. This work was supported by the Mathematical, Information, and Computational Sciences Division subprogram of the Office of Computational and Technology Research, U.S. Department of Energy, under Contract W-31-109-Eng-38 LARRY W O S ([email protected]) is a senior mathematician in the Mathematics and Computer Science Division of Argonne National Laboratory. He is president of the Association for Automated Reasoning, a member of the editorial board of the Journal of Automated Reasoning (which he founded in 1983), and the first recipient of the Herbrand Award in Automated Deduction, presented in 1992. Unit Preference (Wos): Directs a program's reasoning by preferring nonempty statements free of logical or as parents for drawing conclusions. Set of Support (Wos): Restricts a program's reasoning by preventing it from drawing conclusions whose parents are all among statements the user (in effect) designates as general information. Weighting (Overbeek): Directs a program's reasoning by giving priority to terms the user selects and restricting a program's reasoning by discarding new conclusions whose complexity exceeds a user-chosen upper bound. Ratio (McCune): Directs a program's reasoning by focusing on a combination of least-complex information and first-come first-served information, where the combination is determined by the user. Resonance (Wos): Directs a program's reasoning based on the inclusion of formulas and equations that the user conjectures merit high priority. Hints (Veroff): Directs a program's reasoning based on the inclusion of formulas and equations that the user conjectures merit proving. Hot List (Wos): Rearranges conclusion-drawing by visiting and revisiting as parents statements that the user conjectures to be especially significant. From Variable (Wos): Restricts a program's reasoning in the context of equalityoriented reasoning (paramodulation) by preventing it from substituting from a variable. Into Variable (Wos): Restricts a program's reasoning in the context of equalityoriented reasoning (paramodulation) by preventing it from substituting into a variable. Figure 1. Examples of strategy
1638
Collected Works of Larry Wos
Figure 3. Progress in automated reasoning
As background for the Robbins problem, note that a Boolean algebra is the mathematical abstraction of the study of logical and, or, and not. The Robbins problem asks if the following three axioms completely characterize Boolean algebra, where + can be thought of as logical or, and the function n can be thought of as logical not. x + y » y + x. 7. Commutativity of + (x + y) + z - x + (y + z). '/, Associativity of + n(n(n(x) + y) + n(x + y)) » y. '/, Robbins axiom From a set-theoretic perspective, + can be thought of as union and the function n as complement. Figure 2. The Robbins problem
Programs That Offer Fast, Flawless, Logical Reasoning
1639
D-4
Figure 4. Solution to the two-inverter puzzle, which asked for the design of a circuit in which there are three inputs and three outputs and only two NOT gates
