10th International Conference on Automated Deduction: Kaiserslautern, FRG, July 24-27, 1990. Proceedings (Lecture Notes in Computer Science)

Lecture Notes in Artificial Intelligence Subseries of Lecture Notes in Computer Science Edited by J. Siekmann

Lecture Notes in Computer Science Edited by G. Goos and J. Hartmanis

Editorial

Artificial Intelligence has become a major discipline under the roof of Computer Science. This is also reflected by a growing number of titles devoted to this fast developing field to be published in our Lecture Notes in Computer Science. To make these volumes immediately visible we have decided to distinguish them by a special cover as Lecture Notes in Artificial Intelligence, constituting a subseries of the Lecture Notes in Computer Science. This subseries is edited by an Editorial Board of experts from all areas of AI, chaired by JOrg Siekmann, who are looking forward to consider further AI monographs and proceedings of high scientific quality for publication. We hope that the constitution of this subseries will be well accepted by the audience of the Lecture Notes in Computer Science, and we feel confident that the subseries will be recognized as an outstanding opportunity for publication by authors and editors of the AI community. Editors and publisher

Lecture Notes in Artificial Intelligence Edited by J. Siekmann Subseries of Lecture Notes in Computer Science

449 M.E. Stickei (Ed.)

10th International Conference on Automated Deduction Kaiserslautern, FRG, July 24-27, 1990 Proceedings

Springer-Verlag Berlin Heidelberg New York London Paris Tokyo Hong Kong Barcelona

Editor Mark E. Stickel Artificial Intelligence Center SRI International 333 Ravenswood Avenue, Menlo Park, CA 94025, USA

CR Subject Classification (1987): 1.2.3 ISBN 3-540-52885-7 Springer-Verlag Berlin Heidelberg N e w Y o r k ISBN 0-387-52885-7 Springer-Verlag N e w Y o r k Berlin Heidelberg

This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in other ways, and storage in data banks. Duplication of this publication or parts thereof is only permitted under the provisions of the German Copyright Law of September 9, 1965, in its version of June 24, 1985, and a copyright fee must always be paid. Violations fail under the prosecution act of the German Copyright Law. © Springer-Verlag Berlin Heidelberg 1990 Printed in Germany Printing and binding: Druckhaus Beltz, Hemsbach/Bergstr. 2145/3140-5432t0 - Printed on acid-free paper

~L~i

Li International Conference on Automated Deduction, Kaiserslautern, FIT Germany

Hambacher SchloB property of Landkreis Bad DOrkheim drawn by Prof. Horst R6mer, Krickenbach

Preface This volume contains the papers presented at the Tenth International Conference on Automated Deduction (CADE-10) held on 24-27 July 1990 in Kaiserslautern, West Germany, a famous center of automated deduction research. CADE is the major forum at which research on all aspects of automated deduction can be presented. Proceedings of previous CADEs are invaluable references for the field; this volume should be no exception. There were t09 papers submitted to CADE-10. Each was reviewed by three program committee members, and 42 papers were selected for presentation at the conference. Over eighty referees outside the program committee assisted in the reviewing process. The papers here represent the richness and diversity of the field. They range from theory to implementation and experimentation, from propositional to higher-order calculi and nonclassical logics; they refine and use a wealth of methods that includes resolution, paramodulation, rewriting, completion, unification, and induction; and they work with a variety of applications that includes program verification, logic programming, deductive databases, and theorem proving in many domains. Research in this field is conducted around the world: about half the papers are from the United States; Germany, the United Kingdom, and France are strongly represented; authors from Australia, Brazil, Finland, Japan, Korea, and Sweden are also present. This volume also contains abstracts of 20 implementations of automated deduction systems, and descriptions of tutorials given at the conference. I am indebted to the program committee for their effort and thought in organizing the program; to Hans-Jfirgen B~rckert and Hans J~rgen Ohlbach for making the local arrangements for the conference; to the invited speakers Robert Boyer and J Moore (Keynote Address), Woody Bledsoe (Banquet Address), Wolfgang Bibel, and Alan Bundy; to the presenters of tutorials at the conference; to Fernando Pereira and Bell Laboratories for hosting the program committee meeting; and to the organizations listed below for their financial and organizational support of CADE-10.

Mark E. Stickel Chairman, CADE-10

Program Committee Peter Andrews, Carnegie Mellon University Wolfgang Bibel, Technische Hochschute Darmstadt W. W. Bledsoe, University of Texas at Austin Alan Bundy, University of Edinburgh Robert Constable, Cornell University Jean-Pierre Jouannaud, Universit~ de Paris-Sud Deepak Kapur, State University of New York at Albany Matt Kaufmann, Computational Logic Inc. Claude KirchneT; INRIA Lorraine & CRIN Jean-Louis Lassez, IBM T. J. Watson Research Center Donald Loveland, Duke University Ewing Lusk, Argonne National Laboratory Michael McRobbie, Australian National University Dale Miller, University of Pennsylvania Hans Jiirgen Ohlbach, Universit/it Kaiserslautern Ross Overbeek, Argonne National Laboratory William Pase, Odyssey Research Associates Lawrence PauIson, Cambridge University Fernando Pereira, Bell Laboratories David Plaisted, University of North Carolina at Chapel Hitl JSrg Siekmann, Universit/it Kaiserslautern Mark Stickel, SRI International Richard Waldinger, SRI International Christoph Walther, Universit£t Karlsruhe

Local Arrangements IIans-Jiirgen Biirckert, DFKI, Kaiserslautern Hans Jiirgen Ohtbach, Universit~t Kaiserslautern

Referees S. Anantharaman O. Astrachan P, Attie F. Baader L. Bachmair S. Bailin B. Brock H.-J. Biirckert R. Butler J. Christian E. Clarke H. C0mon E. Contejean B. Courcelle D. Craigen M. Dauchet M. Davis J. Dix E. Dorenjoud M. Fitting L. Fribourg H. Ganzinger I. Gnaedig B. Gramlich M. Gray R. Helm M. Hermann L. Hines

K. Palem S. HStldobler C. Petrie J. Hsiang F. Pfenning M. Huhns W. Pierce D. Hutter A. Pr£cklein T. Huynh L. Puet J. Jaffar D. Reed G. N. Kartha M. Rusinowitch S. Kaufman D. Russinoff H. Kirchner M. Saaltink F. Klay R. S&ott E. Kounalis R. Shostak K. Kunen D. Simon D. Lankford R. Socher C. Lassez W. Stephan P. Lescanne R. Stevens C. Lingenfelder J. Stillman D. Lugiez V. S. Subrahmanian M. Maher S. Tison C. March6 C. Tretkoff K. Marriott M. Truszczynski N. McCain P. Viry W. McCune L. WMlen N. McPhee M. Wilding J. M/itler W. Winsborough X. Nie W. Young T. Nipkow H. Zhang A. Nonnengart W. Nutt

Support CADE-IO is supported by

International Joint Conferences on Artificial Intelligence, Inc. Adam Opel AG, Werk Kaiserslautern BASF AG, Ludwigshafen Daimler Benz AG, Stuttgart Deutsche Forschungsgemeins&aft (DFG), Bonn Dornier GmbH, Friedrichshafen Krupp Atlas Elektronik GmbH, Bremen Siemens AG, Mfinchen Stifterverband fiir die Deutsche Wissenschaft, Essen Volkswagen AG, Wolfsburg Assistance in organizing CADE-IO was given by

Deutsches Forschungszentrum f/ir Kfinstliche Intelligenz (DFKI), Kaiserslautern Universitiit Kaiserslautern SRI International, Menlo Park, California Bell Laboratories, Murray Hill, New Jersey

Table of Contents Session 1: K e y n o t e Address 8:30-10:00 Wednesday, 25 July 1990

A Theorem Prover for a Computational Logic Robert S. Boyer, J Strother Moore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1

Session 2 10:30-12:00 Wednesday

A Complete Semantic Back Chaining Proof System 16

X u m i n Nie, David A. Plaisted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Parallelizing the Closure Computation in Automated Deduction 28

John K. Slaney, Ewing L. Lusk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PARTHEO: A High-Performance Parallel Theorem Prover 40

J. Schumann, R. Letz . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Session 3 13:30-15:30 Wednesday

Substitution-based Compilation of Extended Rules in Deductive Databases 57

Sang Ho Lee, Lawrence J. IIenschen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Automatic Theorem Proving in Paraconsistent Logics: Theory and Implementation Newton C. A. da Costa, Lawrence J. Henschen, James J. Lu, V. S. Subrahmanian

72

Case-Free Programs: An Abstraction of Definite Horn Programs Toshiro Wakayama, T. H. Payne . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

87

Generalized Well-founded Semantics for Logic Programs Chitta Baral, Jorge Lobo, Jack Minker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

102

Session 4 13:30-15:30 Wednesday

Tactical Theorem Proving in Program Verification M. IIeisel, W. Reif, W. Stephan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

117

Extensions to the Rippling-Out Tactic for Guiding Inductive Proofs Alan Bundy, Frank van HarmeIen, Alan Smaill, Andrew Ireland . . . . . . . . . . . . . . . . .

132

Guiding Induction Proofs Dieter Hutter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

147

Term Rewriting Induction Uday S. Reddy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

162

×ll

Session 5 16:00-17:30 Wednesday

A Resolution Principle for Clauses with Constraints tIans-Jiirgen Biirckert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

178

Strq-veC_: The Strq-ve-based Subset Prover Larry H i n e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

193

Ritt-Wu's Decomposition Algorithm and Geometry Theorem Proving Shang-Ching Chou, X i a o - S h a n Gao . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

207

Session 6 8:30-10:00 Thursday, 26 July 1990

Encoding a Dependent-Type A-Calculus in a Logic Programming Language A m y Felty, Dale M i l l e r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

221

Investigations into Proof-Search in a System of First-Order Dependent Function Types David Pyre, Lincoln I/VaIten . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

236

Equality of Terms Containing Associative-Commutative Functions and Commutative Binding Operators is Isomorphism Complete David A. Basin

................................................................

251

Session 7 10:30-12:00 Thursday

An Improved General E-Unification Method Daniel J. Dougherty, Patricia Johann . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

261

Some Results on Equational Unification Patiath Narendran, Friedrich Otto . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

276

Unification in a Combination of Equational Theories: an Efficient Algorithm Alezandre B o u d e t

..............................................................

292

Session 8 13:30-15:30 Thursday

SLIM: An Automated Reasoner for Equivalences, Applied to Set Theory Alan F. M c M i c h a e l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

308

An Examination of the Prolog Technology Theorem-Prover M a r k Tarver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

322

Presenting Intuitive Deductions via Symmetric Simplification Frank Pfenning, Dan N e s m i t h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

336

Toward Mechanical Methods for Streanflining Proofs William Pierce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

351

Xlll

Session

9

13:30--15:30 Thursday

Ordered Rewriting and Confluence Ursula Martin, ~Ibbias Nipkow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

366

Complete Sets of Reductions with Constraints Gerald E. Peterson . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

381

Rewrite Systems for Varieties of Semigroups Franz Baader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

396

Improving Associative Path Orderings Joachim Steinbach : . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

411

Session

10: Invited

Talk

16:00-17:00 Thursday

Perspectives on Automated Deduction Wolfgang Bibel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Session

426

11

8:30-10:00 Friday, 27 July 1990

On Restrictions of Ordered Paramodulation with Simplification Leo Bachmair, Haratd Ganzinger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

427

Simultaneous Paramodulation Dan Benanav . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

442

Hyper Resolution and Equality Axioms without Function Substitutions Yusuf Ozturk, Lawrence Henschen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Session

456

12

10:30-12:00 Friday

Automatic Acquisition of Search Guiding Heuristics Christian Suttner, Wolfgang Ertel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

470

Automated Reasoning Contributes to Mathematics and Logic L. Wos, S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, R. Butler ... 485

A Mechanically Assisted Constructive Proof in Category Theory James A. Altucher, Prakash Panangaden . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

500

XIV

Session 13 13:30-15:30 Friday

Dynamic Logic as a Uniform Framework for Theorem Proving in Intensional Logic Heikki Tuominen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

514

A Tableaux-Based Theorem Prover for a Decidable Subset of Default Logic Camilla B. Schwind . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

.............................

528

Computing Prime Implicants Peter Jackson, John Pals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

543

Minimizing the Number of Clauses by Renaming Thierry Boy de la Tour . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

558

Session 14 13:30-15:30 Friday

Higher Order E-Unification Wayne Snyder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

573

Programming by Example and Proving by Example Using Higher-order Unification Masami Hagiya . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588 Retrieving Library Identifiers via Equational Matching of Types Mikael Rittri . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

603

Unification in Monoidal Theories Werner Nutt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

618

Session 15: I n v i t e d T a l k 16:00-17:00 Friday

A Science of Reasoning: Extended Abstract Alan Bundy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

633

System Abstracts The TPS Theorem Proving System Peter B. Andrews, Snail Issar, Dan Nesmith, Frank Pfenning . . . . . . . . . . . . . . . . . . .

641

Schemata Frank M. Brown, Carlos Araya . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

643

Cylindric Algebra Equation Solver Frank M. Brown, Carlos Araya . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

645

The Oyster-Clam System Alan Bundy, Frank van Harmelen, Christian Horn, Alan Smaill . . . . . . . . . . . . . . . . .

647

A High-Performance Parallel Theorem Prover Ralph Butler, Ian Foster, Anita Jindal, Ross Overbeek . . . . . . . . . . . . . . . . . . . . . . . . . . .

649

×Y

The Romulus Proof Checker Carl EichenIaub, B r u c e Esrig, J a m e s HOok, Carl Klapper, GarreI P o t t i n g e r . . . . . .

651

IMPS: An Interactive Mathematical Proof System W i l l i a m M. Farmer, Joshua D. G u t t m a n , F. J a v i e r T h a y e r . . . . . . . . . . . . . . . . . . . . . .

653

UNICOM: A Refined Completion Based Inductive Theorem Prover B e r n h a r d Gramlich . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

655

The Theorem Prover of the Program Verifier Tatzelwurm T h o m a s I(duJ:l, Nicolas Zabel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

657

RCL: A Lisp Verification System Matt Kaufmann

................................................................

659

ORME: An Implementation of Completion Procedures a~ Sets of Transitions Rules Pierre Lescanne . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

661

OTTER 2.0 William McCune ...............................................................

663

DISSOLVER: A DisSolution-based Theorem Prover N e l l V. Murray, E r i k Rosenthal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

665

TRIP: An Implementation of Clausal Rewriting Robert N i e u w e n h u i s , Fernando Orejas, Albert Rubio . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

667

OSCAR J o h n L. Pollock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

669

EXPERT THINKER: An Adaptation of F-Prolog to Microcomputers RonaId W. S a t z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

671

A Prolog Technology Theorem Prover M a r k E. Stickel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

673

A General Clause Theorem Prover G e o f f Sutcliffe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

675

LISS--The Logic Inference Search System A. A . Voronkov . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

677

ACE: The Abstract Clause Engine D. A. W o l f r a m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

679

Tutorials Tuesday, 2~ J u l y 1990

High-Performance Automated Theorem Proving E w i n g Lusk, W i l l i a m M c C u n e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

681

Reasoning and Representation with Concept Languages Jiirgen Miiller, Franz Bander, B e r n h a r d Nebel, W e r n e r Nutt, Gert Smolka . . . . . . .

681

×YJ

,kProlog A m y Felty, Elsa Gunter, Dale Miller, Frank Pfenning . . . . . . . . . . . . . . . . . . . . . . . . . . .

682

Equational Unification Claude Kirchner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

682

Compilation Techniques for Logics Hans Jiirgen Ohlbach, Andreas Herzig . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

683

High-Performance Theorem Provers: Efficient Implementation and Parallelisation J. Schumann, R. Letz, F. Kurfess . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

683

Rewrite-Based Theorem Proving Jieh Hsiang, Jean-Pierre Jouannaud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

684

Program-Synthetic Deduction Richard Waldinger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

684

Computing Models of Propositional Logics Paul Pritchard~ John Slaney . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

685

Author

686

Index

.............................................................

Keynote Address

A Theorem Prover for a Computational Logic Robert S. Boyer 1 J Strother Moore C o m p u t a t i o n a l L o g i c , Inc., Suite 290 1717 W . 6th St. A u s t i n , T e x a s 78703 U.S.A.

Abstract We briefly review a mechanical theorem-prover for a logic of recursive functions over finitely generated objects including the integers, ordered pairs, and symbols. The prover, known both as NQTHM and as the Boyer-Moore prover, contains a mechanized principle of induction and implementations of linear resolution, rewriting, and arithmetic decision procedures. We describe some applications of the prover, including a proof of the correct implementation of a higher level language on a microprocessor defined at the gate level. We also describe the ongoing project of recoding the entire prover as an applicative function within its own logic.

1 Introduction We feel honored to be invited to give the keynote address for CADE-10. We thank Mark Stickel and the program committee for the invitation. It has been suggested that we discuss our theorem prover and its application to proving the correctness of computations. We have been working on our prover, on and off, since about 1972 [9]. This prover is known both as the Boyer-Moore theorem prover and as NQTHM. (pronounced en-que-thum, an acronym for "New, Quantified THeoreM Prover," an uninspired parochialism that has taken on a life of its own). The details of our prover and its applications have been extensively presented in several books and articles. In fact, from these publications the prover has been recoded by at least three other groups. In this paper, we will (a) very briefly review the prover and its applications, (b) provide pointers to the literature on the prover and its applications, and (c) discuss ACL2, a new development of the prover which involves recoding it in its own logic, a subset of applicative Common Lisp. In the subsequent discussion, we will make reference to two books, which are the main references on NQTHM. They are (a) A Computational Logic [11] which we will abbreviate as " A C L " and (b) A Computational Logic Handbook [18] which we will abbreviate as " A C L H " . Although a decade old, ACL still provides a rather accurate description of many of the prover's heuristics and some simple applications, whereas the much more recent ACLH accurately describes the current logic and user interface.

1Mailing address: Computer Sciences Department, University of Texas at Austin, Austin, Texas 78712 U.S.A.

2 The

Logic

Although many theorem provers, especially those of the resolution tradition, are designed to work with arbitrary collections of first order axioms, NQTHM is designed to be used mainly with the fixed set of axioms we provide, typically augmented by a number of definitions provided by the NQTHM user. Questions one might ask about the NQTHM theory are "What are the well-formed formulas, what are the axioms, and what are the rules of inference?" The precise answers to these questions may be found in Chapter 4 of ACLH. Roughly speaking, in that chapter, we present our logic (the Boyer-Moore Logic or NQTHM Logic, as it is sometimes known) by starting from standard first order logic as in [70] and then adding some axioms that describe certain data structures, including the integers, ordered pairs, and symbols. We include in the logic a principle of definition for recursive functions over these data structures. Among our rules of inference is a schema for proof by induction. This schema would be merely a derived rule of inference were we to cast our induction axioms in the traditional form. The syntax of our logic is close to that of Lisp. In fact, from the time we started writing our prover [9] we have regarded it as a theorem prover for a theory of Lisp functions. Some of the earliest theorems we proved mechanically were inspired by some of McCarthy's seminal papers on the logic of Lisp, including [54], [56], and [58]. Because Lisp may be viewed as both a logic and a programming language, we have always found it a most natural setting in which to express theorems about computations and other parts of constructive mathematics. Both the axioms of the NQTHM logic and the conjectures it entertains are quantifier free, or, more precisely, implicitly universally quantified " o n the far outside." In fact, NQTHM does not include rules for manipulating quantifiers at all. However, by using recursive functions, we are able to express many of the things that one usually expresses with quantifiers when dealing with "finite" objects such as trees of integers. For example, to state and prove the uniqueness and existence of prime factorizations [11], we define recursive functions which factor integers and which compute whether two finite sequences of integers are permutations of one another. This practice of using recursive functions to do work one might do with quantifiers may have been originated by Skolem in [71], who was perhaps the earliest to demonstrate that arithmetic could be built up using entirely constructive methods. Skotem's program is further carried out in [34]. Here is an example of a definition that one might give to the prover for a function that appends, i.e. concatenates, two lists: Definition.

( ~ P X Y) (IF (LISTP X) (CONS (CAR X) Y)

(APP (CDR X) Y))

In rough English, this definition says that to append a list X to a list Y, if X is nonemtpy, then construct (i.e. CONS) the list whose first element is the first element of X, i.e. (CAR X) , and whose other elements are the result of appending the rest of X, i.e. (CDR X), and Y. On the other hand, if x is empty, just return Y. A simple example of a theorem that one might ask NQTHM to prove is the associativity of ~D~,p, which one would state as

Theorem. ( ~ P (APt' X Y) Z) =

(APP X

(APP ~ Z))

We discuss a proof of this theorem below when we describe the induction heuristic. 3 The Prover 3.1 H o w to G e t a C o p y NQTHM is a Common Lisp program whose source files require about one million characters. NQTHM runs in a variety of Common Lisps including Lucid, Allegro, Symbolics, and KCL. It is publicly available, but a license is now required. We have recently started to require a license to keep track of copies at the strong suggestion of one of our sponsors. We previously distributed the same code without copyright or license. At the time of this writing, a copy may be obtained without fee by anonymous ftp from Internet site cli.com (start with the file /pub/nqthm/README) or on tape for a modest fee by writing to the authors at Computational Logic, 1717 W. 6th St., Austin, Texas 78703. The currently released version of NQTHM was first released in July of 1988, and no bugs affecting soundness have been reported as of the time of this writing. The chapter of ACLH on installation describes in complete detail how to bring up NQTHM from the sources. 3.2 W A R N I N G : Difficulty of Use It is hard, perhaps impossible, to use NQTHM effectively without investing a substantial amount of time learning how to use it. To avoid disappointment, a prospective user should probably be prepared first to understand most of two rather long books, ACL and ACLH. Almost all of the successful users of NQTHM have in fact also taken a course from us at the University of Texas at Austin on proving theorems in our logic. Based upon teaching related courses at Stanford, our former student N. Shankar advises that a user unfamiliar with the heuristics employed in the prover, as described in great detail in ACL, is very unlikely to direct the prover to prove anything significant. Besides precisely describing the logic of NQTHM, ACLH also serves as a user's manual, describing in great detail all of the commands with which one can direct the prover. 3.3 H e u r i s t i c C h a r a c t e r o f N Q T H M NQTHM is a heuristic theorem-prover. By heuristic, we mean that we have coded guessing strategies for searching through the space of possible proofs for conjectures. For example, NQTHM guesses when it is best to cut off "back chaining". If the guess is wrong, which it can easily be, then no proof may be found. As another example, NQTHM often guesses an induction to try, when all other proof techniques cease to be applicable. If the guess is wrong, then NQTHM will irrevocably go chasing down a search path that is probably totally fruitless. On the other hand, because NQTHM does have heuristics, NQTHM is able to find proofs for what we believe is a remarkable number of theorems. One crude measure of the effectiveness of NQTHM is that it is always is able to make an above average grade on the final examinations we give to our students in an introductory graduate course on proving theorems in the NQTHM logic. We were inspired in part to build a theorem prover that is heuristic by the success of W. W. Bledsoe [4], [5] in writing such theorem provers, including one that guessed inductions based upon the terms in the conjecture. One of the major concerns in the literature on automated reasoning in the 60's and 70's was with the completeness of proof procedures. NQTHM is certainly not complete, except when guided by a knowledgeable user.

3.4 Induction Perhaps the most important heuristic in NQTHM is the induction heuristic. The key to the success of our induction heuristic is that it is closely tied to the principle of recursive definition which we employ. For example, to prove the associativity of APP, mentioned above, NQTHM would guess to induction on X by CDIK i.e. by the length of the first argument. This induction mirrors the way that APP recurses. An important part of the induction heuristic is filtering out suggested inductions which are "not likely" to work, such as the induction on Y by CDR in the theorem above. The NQTHM practice of not permitting quantification but of permitting the user to define recursive functions to express what might otherwise require quantification has an effect of forcing the user to hint implicitly how to prove conjectures: try inductions that mirror the definitions of the recursive functions used in the conjectures. This heuristic is startlingly successful for the NQTHM logic. 3.5 Simplification Besides induction, the other most important theorem proving component in NQTHM is the simplifier. The simplifier combines rewriting (cf. [74] and [4]) with linear and binary resolution and subsumption (cf. [65] and [53]). The simplifier also includes a semi-decision procedure for a part of arithmetic, based upon ideas in [36]. An aspect of our simplifier that accounts for much of its effectiveness is a "type set" facility which keeps track, for each expression actively under consideration, a bit-mask's worth of information indicating a conservative estimate of the " t y p e " of the expression in terms of the basic data types of the NQTHM Logic. The type set procedure, like most of the current simplifier, is described in ACL. 3.6 O t h e r Heuristics Of considerably less significance than induction or simplification are various NQTHM routines which are named "elimination of destructors," "cross fertilization," "generalization,"and "elimination of irrelevance." The structure of NQTHM, at least as it was in 1979, is described in complete detail in ACL. That work remains a largely accurate description of NQTHM except for (a) the integration of the arithmetic decision procedure, described in [19], (b) the addition of metafunctions and an efficient representation for large constant terms, described in [12], (c) some simplifications of the induction machinery that have never been documented, (d) the axiomatization of an interpreter for partial recursive functions [20], and (e) an implementation of a derived rule of inference called "functional instantiation" [8]. 4 T h e I m p o r t a n c e o f t h e U s e r in F i n d i n g P r o o f s Although NQTHM is quite capable of finding proofs for some simple theorems with which even graduate students may struggle, we think of NQTHM as more of a proof checker than as a theorem-prover. What do we mean by this distinction? It is perhaps not possible to spell out clearly what the distinction is. However, whenever we have in mind an interesting theorem for NQTHM to prove, we almost always expect to have to suggest to NQTHM what the main intermediate steps to the proof are. We do expect NQTHM to do a great deal of tedious work filling in minor details. And when filling in such minor details, NQTHM very often exposes minor oversights in our statement of theorems. The situation is entirely

different for some "real theorem-provers," such as those of Wu and Chou [27], which one expects to decide quickly any theorem in their domain. The earliest version of NQTHM [9] had no facility for user guidance. The power of that early version of the prover may be very crudely characterized by saying that, starting from Peano's axioms, and analogous axioms for lists, the prover could not prove anything much more difficult than the associativity of multiplication or the correctness of an insertion sort algorithm. In order to permit NQTHM to prove theorems harder than these (without "cheating" by adding additional formulas as axioms), the most important step we took was to permit the user to suggest "lemmas," i.e. intermediate theorems, which would f'trst be proved by NQTHM and then made available for use in subsequent proofs, mainly by the simplifier [10]. Permitting the use of lemmas on the one hand makes NQTHM feel more like a proof checker than a theorem prover, but on the other hand itpermits the checking of a very substantial part of elementary number theory [66], even including Gauss's law of quadratic reciprocity (the crown jewel of number theory), and the correctness of some interesting algorithms [ 16].

5 Our Motivation: Computer System Correctness Given that NQTHM is not a very "smart" theorem prover, one might well ask why we have kept working on it for so many years! Our main motivation has been to develop NQTHM into a system that can be used in a practical way to check the correctness of computer systems, thereby reducing the frequency of bugs in computer programs. The idea of proving the correctness of algorithms is at least as old as Euclid's demonstration of the correctness of an algorithm for finding the greatest common divisor of two integers [29]. The idea of correctness proofs is also clearly stated in the classic papers of Goldstine and von Neumann [73] that describe the first yon Neumann machine and how to use it. In those papers fifteen programs, including a sort routine, are specified, coded in machine language, and proved correct. Although correctness proofs were undoubtedly constructed by many early programmers, publications about this idea seem rare until the 60s, when McCarthy [56], Floyd [30], Hoare [35], and Burstall [26] described means for proving the correctness of programs written in higher level languages. Subsequently a rather sizable literature on the subject has developed. Proofs of the correctness of computing systems seem to be much longer, much more tedious, and much more error prone than proofs in ordinary mathematics. The additional length is due to the fact that the computing systems may easily require hundreds of pages of specification, whereas most propositions in mathematics can easily be stated in a few pages -- even if one includes the axiomatization of set theory, analysis, and algebra. The tediousness and error level are perhaps due to this length and also to the fact that many parts of computing systems are mathematically boring. The idea of mechanically checking proofs of correctness of computing systems has been pursued by many researchers, e.g. those mentioned in the review article [7]. Research on this topic has grown to the extent that there are several research laboratories (e.g. the Computer Science Laboratory of SRI International) and several small companies (e.g. our own Computational Logic, Inc. and Richard Platek's Odyssey Associates, Inc.) which devote a major portion of their efforts to research on this topic.

6 Applications We and others have used NQTHM to check the correctness of many small programs. However, after many years of effort, we are beginning to see mechanical correctness proofs of entire small computing systems. By far, the most significant application of NQTHM has been to a prove the correctness of a computing system known as the CLI Stack, which includes (a) a microprocessor design (FM8502) based on gates and registers [38], (b) an assembler (Piton) [61] that targets FM8502, and (c) a higher level language (micro Gypsy) [76] that targets Piton. We have also seen a proof of correctness of a small operating system kernel (KIT) [2]. Except for the Piton work, all of these projects represent Ph.D. dissertations in computer science which we supervised at the University of Texas. FM8502, Piton, micro Gypsy, and Kit are documented in one place, a special issue of the Journal of Automated Reasoning [62]. Another major application of NQTHM is the Ph.D. work of N. Shankar in proof checking Godel's incompleteness theorem [69]. The text of this proof effort is included in the standard distribution of NQTHM, along with Shankar's checking of the Church-Rosser theorem. On pp. 4-9 of ACLH, we enumerate many other applications of NQTHM, including those in list processing, elementary number theory, metamathematics, set theory, and concurrent algorithms. Descriptions of some of these applications may be found in [16, 66, 12, 21, 17, 67, 68, 69, 20, 60, 28, 51, 37, 52, 13, 14, 15, 22, 77] and also in [1, 31, 32, 33, 40, 75, 3, 48, 44, 41, 42, 39, 45, 23, 24, 25]. Recently colleagues of ours at Computational Logic, Inc., Bill Young and Bill Bevier, have used NQTHM to construct mechanically checked proofs of properties relating to faulttolerance. A key problem facing the designers of systems which attempt to ensure fault tolerance by redundant processing is how to guarantee that the processors reach agreement, even when one or more processing units are faulty. This problem, called the Byzantine Generals problem or the problem of achieving interactive consistency, was posed and solved by Pease, Shostak, and Lamport [64, 50]. They proved that the problem is solvable if and only if the total number of processors exceeds three times the number of faulty processors and devised an extremely clever algorithm (the "Oral Messages" Algorithm) which implements a solution to this problem. Bill Young and Bill Bevier, have just finished developing a machine checked proof of the correctness of this algorithm using NQTHM. Matt Kaufmann, of Computational Logic, Inc., has made extensive additions to NQTHM, building a system called "PC-NQTHM" on top of NQTHM, which many find more convenient than NQTHM for checking proofs. Information about PC-NQTHM and some extensions and applications may be found in [46, 49,45, 47, 63, 43, 76]. Among the theorems which Kaufmann has checked with PC-NQTHM are: • Ramsey's theorem for exponent 2 (both finite and infinite versions), with explicit bound in the finite case [41, 46]. • Correctness of an algorithm of Gries for finding the largest "true square" submatrix of a boolean matrix [40]. • The Cantor-Schroeder-Bernstein theorem [46]. • The correctness of a Towers of Hanoi program. • The irrationality of the square root of 2. • Correctness of a finite version of the collapsing function of Cohen forcing.

7 W o r k in P r o g r e s s : A C L 2 We are currently constructing an entirely new version of our prover. The name of the new system is A Computational Logic for Applicative Common Lisp, which might be abbreviated as "ACL ACL" but which we abbreviate as "ACL2". Whereas NQTHM has been available for some time, extensively documented, and widely used, ACL2 is still very much under development. Hence the following remarks are somewhat speculative. Instead of supporting "Boyer-Moore logic", which reflects an odd mixture of functions vaguely, but not consistently, related to Lisp 1.5 and Interlisp, ACL2 direcdy supports perfectly and accurately (we hope) a large subset of applicative Common Lisp. That is, ACL2 is to applicative Common Lisp what NQTHM is to the "Boyer-Moore logic", a programming/theorem proving environment for an executable logic of recursive functions. More precisely, we have identified an applicative subset of Common Lisp and axiomatized it, foUowing Steele's [72] carefully. Because arrays, property lists, input/output and certain other commonly used programming features are not provided applicatively in Common Lisp (i.e., they all involve the notion of explicit state changes), we axiomatized applicative versions of these features. For example, when one "changes" an array object, one gets a new array object. However, we gave these applicative functions very efficient implementations which are in complete agreement with their axiomatic descriptions but which happen to execute at near von Neumann speeds when used in the normal von Neumann style (in which " o l d " versions of a modified structure are not accessed). The result is "applicative Common Lisp" which is also an executable mathematical logic. Like NQTHM, the logic of applicative Common Lisp provides a definitional principle that permits the sound extension of the system via the introduction of recursive functions. Unlike NQTHM, however, functions in applicative Common Lisp may be defined only on a subset of the universe. Like NQTHM, the new logic provides the standard first order rules of inference and induction. However, the axioms are different since, for example, NQTHM and ACL2 differ on what (CAR NZT.) is. Most importantly for the current purposes, we claim that all correct Common Lisps implement applicative Common Lisp directly and that, unlike NQTHM' s logic, applicative Common Lisp is a practical programming language. ACL2 is a theorem prover and programming/proof environment for applicative Common Lisp. ACL2 includes all of the functionality of NQTHM (as understood in the new setting) plus many new features (e.g., congruence-based rewriting). The source code for ACL2 consists of about 1.5 million characters, all but 43,000 of which are in applicative Common Lisp. That is, 97% of ACL2 is written applicafively in the same logic for which ACL2 proves theorems. The 3% of non-applicative code is entirely at the top-level of the read-eval-print user interface and deals with reading user input, error recovery and interrupts. We expect to implement r e a d applicatively and limit the non-applicative part of ACL2 to the essential interaction with the underlying Common Lisp host system. Thus, in ACL2 as it currently stands, the definitional principle is implemented as a function in logic, including the syntax checkers, error handlers, and data base handlers. The entire "Boyer-Moore theorem prover" -- as that term is now understood to mean "the theorem prover Boyer and Moore have written for ACL2" -- is a function in the logic, including the simplifiers, the decision procedures, the induction heuristics, and all of the proof description generators.

The fact that almost all of ACL2 is written applicatively in the same logic for which it is a theorem prover allows the ACL2 source code to be among the axioms in that definitional extension of the logic. The user of the ACL2 system can define functions, combine his functions with those of ACL2, execute them, or prove things about them, in a unified setting. One need only understand one language, Common Lisp, to use the " l o g i c " , interact with the system, interface to the system, or modify the system. DEFMACRO can be used to extend the syntax of the language, users can introduce their own front-ends by programming within the logic, and all of the proof routines are accessible to users and have exceptionally clear (indeed, applicative) interfaces. Many new avenues in metatheoretic extensibility are waiting to be explored. We believe we have taken a major step towards the goal of perhaps someday checking the soundness of most of the theorem prover by defining the theorem prover in a formalized logic. At the time of this writing, we have completely recoded all of the functionality of NQTHM, but have only begun experimentation with proving theorems. However, our preliminary evidence is that there will be no substantial degradation in performance, even though ACL2 is coded applicatively.

8 Conclusions 8.1 Proof Checking as a Mere Engineering Challenge In our view it seems humanly feasible to write mechanical proof checkers for any part of mathematics and to check mechanically any result in mathematics. There has been much doubt cast on the feasibility of formal proofs, even by such respected authorities as Bourbaki [6] But formalized mathematics cannot in practice be written down in full, and therefore we must have confidence in what might be called the common sense of the mathematician ... We shall therefore very quickly abandon formalized mathematics ... We believe that we have enough practical evidence to extrapolate that mechanical proof checking any mathematical result is feasible, not some mere theoretical possibility which would require a computer the size of the universe. We can make no definite claim about the cost of doing such proof checking, given a suitable proof checker, but we suspect that in the worst case it is somewhere between approximately ten and one hundred times as expensive as doing careful hand proofs at the level of an upper level undergraduate mathematics textbook. In a few areas of mathematics, such as those described by [27] the cost is much less than doing careful hand proofs. We are optimistic that research by top mathematicians will expand the areas in which mechanical theorem-provers are better than most mathematicians. 8.2 Checking the Correctness of Computing S y s t e m s Almost as a corollary to the preceding view, we assert that it is humanly feasible to check mechanically the correctness of computer systems against formal specifications for those systems. Moreover, we believe that the reliability of computing systems could and should be increased significantly by requiring that critical systems be formally specified and that their correctness with respect to those specifications be mechanically checked. Again, we make no definite claim about the cost of doing such certification, but given that, for example, there exist microprocessors that are in control of nuclear weapons, we believe that the cost of doing such checking may well be less than the cost of not doing such checking.

8.3 Formalizing the Real World Although the correcmess of algorithms and even systems is something that is reasonably clearly understood from a mathematical point of view, it remains a major and largely unexplored area of research to formalize the interactions of computing systems with the "real world." Even correctly formalizing the behavior of a typical industrial microcontroller, with its myriad timers, interrupts, buses, and A/D converters seems to be on the edge of the state of the art of formalization. Any claim that a computing system has been formally proved to interact safely with the world is no better than the accuracy with which the behavior of the world has been formalized. The difficulty of accurately formalizing the behavior of the world does not diminish the fact that typically a very large part of what any computing system is supposed to do (especially the internal workings) can be formally specified, and that part is suitable for scrutiny with formal, mechanical proof attempts.

9 Acknowledgements We want to express our thanks to a number of people who have contributed significantly towards making NQTHM a successful prover. The first version of our prover was developed in the amazingly fertile environment of Edinburgh University in the period 1971 to 1974. While working in Bernard Meltzer's Metamathematics Unit (which then became the Department of Computational Logic), we had the joy of working with such figures as J.A. Robinson, Bob Kowalski, Pat Hayes, Alan Bundy, Aaron Sloman, and Woody Bledsoe. In nearby groups, such as the Department of Machine Intelligence, we found inspiration from the likes of Rod Burstall, Donald Michie, Robin Popplestone, Gordon Plotkin, Michael Gordon, Bruce Anderson, David Warren, Raymond Aubin, Harry Barrow, John Darlington, and Julian Davies. The time and place seemed to be embued with quiet inspiration. It is hard for us to imagine that our prover could have put down its roots anyplace else. John McCarthy's influence on our work has been major. His invention of Lisp gave us a language [55, 59] in which to write NQTHM. His papers on proof checking, e.g. [57], and the mathematical theory of computation [58] gave us incentive to write a prover for program verification, reasoning techniques to encode, and sample theorems on which to work. We have mentioned above Woody Bledsoe's influence on our work in showing how to write heuristic theorem provers similar to ours. We thank Rod Burstall for his inspiring and elegant paper on structural induction [26]. We thank Burstall, Michie, and Popplestone for use of the POP2 system running on an ICL 4130 on which we coded the earliest version of our prover. POP2 is a Lisp-like language with an Algol-like syntax and many features ahead of its time, including streams and abstract data types, which influenced the design of the shell construct in the NQTHM logic. At SRI International and Xerox PARC (JSM), we translated our prover into Lisp and made major extensions to it. We owe a debt of thanks to many people there for their support and encouragement, including Robert W. Taylor, Warren Teitelmann, Peter Deutsch, Butler Lampson, Jack Goldberg, Peter Neumann, Karl Levitt, Bernie Elspas, Rob Shostak, Jay Spitzen, Les Lamport, Joe Goguen, Richard Waldinger, Nils Nilsson, and Peter Hart. We owe our user community a major debt. In particular, we acknowledge the contributions of Bill Bevier, Bishop Brock, S.C. Chou, Ernie Cohen, Jimi Crawford, David Goldschlag, C.H. Huang, Warren Hunt, Myung Kim, David Russinoff, Natarajan Shankar, Mark

10 Woodcock, Matt Wilding, Bill Young, and Yuan Yu. In addition, we have profited enormously from our association with Matt Kaufmann, Hans Kamp, Chris Lengauer, Norman Martin, John Nagle, Carl Pixley, and Bill Schelter. Topher Cooper has the distinction of being the only person to have found an unsoundness in a released version of our system. We also most gratefully acknowledge the support of our colleagues at the Institute for Computing Science at the University of Texas, now almost all at Computational Logic, especially Don Good and Sandy Olmstead who created and maintained at the Institute a creative and relaxed research atmosphere with excellent computing facilities. In 1986 we moved our entire verification research group (and its atmosphere) off campus and established Computational Logic, Inc. Notwithstanding the contributions of all our friends and supporters, we would like to make clear that NQTHM is a very large and complicated system that was written entirely by the two of us. Not a single line of Lisp in our system was written by a third party. Consequently, every bug in it is ours alone. Soundness is the most important property of a theorem prover, and we urge any user who finds such a bug to report it to us at once. The development of our logic and theorem prover has been an ongoing effort for the last 18 years. During that period we have received financial support from many sources. Our work has been supported for over a decade by the National Science Foundation and the Office of Naval Research. Of the many different grants and contracts involved we list only the latest: NSF Grant DCR-8202943, NSF Grant DCR81-22039, and ONR Contract N00014-81K-0634. We are especially grateful to NSF, ONR, and our technical monitors there, Tom Keenan, Bob Grafton, and Ralph Wachter, for years of steady support and encouragement. The development of our prover is currently supported in part at Computational Logic, Inc., by the Office of Naval Research. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of Computational Logic, Inc., ONR, or the U.S. Government. We have received additional support over the years from the following sources, listed chronologically: Science Research Council (now the Science and Engineering Research Council) of the United Kingdom, Xerox, SRI International, NASA, Air Force Office of Scientific Research, Digital Equipment Corporation, the University of Texas at Austin, t h e Venture Research Unit of British Petroleum, Ltd., and IBM. We thank Bill Schelter for the numerous suggestions he has made for improving the performance of NQTHM under Austin-Kyoto Common Lisp. Thanks to Anne Boyer for editing this and other writings. Finally, we wish to express one negative acknowledgement. The research group assembled at Edinburgh in the early 70's was scattered to the winds by the "Lighthill Report," the devastatingly negative review of artificial intelligence in Britain conducted by Sir James Lighthill. If computing becomes the dominant branch of both science and engineering, as seems possible, we hope that renowned computer scientists, if asked, will take the greatest care to review new developments in physics with humility, not arrogance, and not attempt to quash new developments that do not fit into old paradigms of science.

11

References 1. W. Bevier. A Verified Operating System Kernel. Ph.D. Th., University of Texas at Austin, 1987. 2. W. R. Bevier. "Kit and the Short Stack". Journal of Automated Reasoning 5, 4 (1989), 519-530. 3. William Bevier, Matt Kaufmann, and William Young. Translation of a Gypsy Compiler Example into the Boyer-Moore Logic. Internal Note 169, Computational Logic, Inc., January, 1990. 4. W.W. Bledsoe. "Splitting and Reduction Heuristics in Automatic Theorem Proving". Artificial Intelligence 2 (1971 ), 55-77. 5. W. Bledsoe, R. Boyer, and W. Henneman. "Computer Proofs of Limit Theorems". Artificial Intelligence 3 (1972), 27-60. 6. N. Bourbaki. Elements of Mathematics. Addison Wesley, Reading, Massachusetts, 1968. 7. R. S. Boyer and J S. Moore. "Program Verification". Journal of Automated Reasoning 1, 1 (1985), 17-23. 8. R. S. Boyer, D. M. Goldschlag, M. Kaufmann, and J S. Moore. Functional Instantiation in First Order Logic, Report 44. Computational Logic, 1717 W. 6th St., Austin, Texas, 78703, U.S,A., 1989. To appear in the proceedings of the 1989 Workshop on Programming Logic, Programming Methodology Group, University of Goteborg. 9. R. S. Boyer and J S. Moore. "Proving Theorems about LISP Functions". JACM 22, 1 (1975), 129-144. I0. R. S. Boyer and J S. Moore. A Lemma Driven Automatic Theorem Prover for Recursive Function Theory. Proceedings of the 5th Joint Conference on Artificial Intelligence, 1977, pp. 511-519. I1. R. S. Boyer and J S. Moore. A Computational Logic. Academic Press, New York, 1979. 12. R. S. Boyer and J S. Moore. Metafunctions: Proving Them Correct and Using Them Efficiently as New Proof Procedures. In The Correctness Problem in Computer Science, R. S. Boyer and J S. Moore, Eds., Academic Press, London, 1981. 13. R. S. Boyer and J S. Moore. A Verification Condition Generator for FORTRAN. In The Correctness Problem in Computer Science, R. S. Boyer and J S. Moore, Eds., Academic Press, London, 1981. 14. R. S. Boyer and J S. Moore. The Mechanical Verification of a FORTRAN Square Root Program. SRI International, 1981. 15. R. S. Boyer and J S. Moore. MJRTY - A Fast Majority Vote Algorithm. Technical Report ICSCA-CMP-32, Institute for Computing Science and Computer Applications, University of Texas at Austin, 1982. 16. R. S. Boyer and J S. Moore. "Proof Checking the RSA Public Key Encryption Algorithm". American Mathematical Monthly 91, 3 (1984), 181-189.

12 17. R. S. Boyer and J S. Moore. "A Mechanical Proof of the Unsolvability of the Halting Problem". JACM31, 3 (1984), 441-458. 18. R. S. Boyer and J S. Moore. A Computational Logic Handbook. Academic Press, New York, 1988. 19. R. S. Boyer and J S. Moore. Integrating Decision Procedures into Heuristic Theorem Provers: A Case Study with Linear Arithmetic. In Machine Intelligence 11, Oxford University Press, 1988. 20. R. S. Boyer and J S. Moore. "The Addition of Bounded Quantification and Partial Functions to A Computational Logic and Its Theorem Prover". Journal of Automated Reasoning 4 (1988), 117-172. 21. R. S. Boyer and J S. Moore. A Mechanical Proof of the Turing Completeness of Pure Lisp. In Automated Theorem Proving: After 25 Years, W.W. Bledsoe and D.W. Loveland, Eds., American Mathematical Society, Providence, R.I., 1984, pp. 133-167. 22. R. S. Boyer, M. W. Green and J S. Moore. The Use of a Formal Simulator to Verify a Simple Real Time Control Program. In D. Gries, et. al, Ed., Beauty Is Our Business, Springer, 1990. To Appear. 23. A. Bronstein and C. Talcott. String-Functional Semantics for Formal Verification of Synchronous Circuits, Report No. STAN-CS-88-1210. Computer Science Department, Stanford University, 1988. 24. A. Bronstein. MLP : String-functional semantics and Boyer-Moore mechanization for the formal verification of synchronous circuits. Ph.D. Th., Stanford University, 1989. 25. A. Bronstein and C. Talcott. Formal Verification of Synchronous Circuits based on String-Functional Semantics: The 7 Paillet Circuits in Boyer-Moore. C-Cube 1989 Workshop on Automatic Verification Methods for Finite State Systems. LNCS 407, 1989, pp. 317-333. 26. R. Burstall. "proving Properties of Programs by Structural Induction". The Computer Journal 12, 1 (1969), 41-48. 27. S. Chou. Mechancial Geometry Theorem Proving. Reidel, 1988. 28. Benedetto Lorenzo Di Vito. Verification of Communications Protocols and Abstract Process Models. Ph.D. Th., University of Texas at Austin, 1982. 29. T.L. Heath (translation and commentary). The Thirteen Books of Euclid's Elements. Dover, New York, 1908. p. 298, Vol 2., i.e. Proposition 2, Book VII. 30. R. Floyd. Assigning Meanings to Programs. In Mathematical Aspects of Computer Science, Proceedings of Symposia in Applied Mathematics, American Mathematical Society, Providence, Rhode Island, 1967, pp. 19-32. 31, David M. Goldschlag. "Mechanically Verifying Concurrent Programs with the BoyerMoore Prover". IEEE Transactions on Software Engineering (September 1990). To appear. 32. David M. Goldschlag. Mechanizing Unity. In Proceedings of the IFIP TC2/WG2.3 Working Conference on Programming Concepts and Methods, M. Broy and C. B. Jones, Eds., Elsevier, Amsterdam, 1990.

13 33. David M. Goldschlag. "Proving Proof Rules: A Proof System for Concurrent Programs". Compass '90 (June 1990). 34. R. L. Goodstein. Recursive Number Theory. North-Holland Publishing Company, Amsterdam, 1964. 35. C. A. R. Hoare. "An Axiomatic Basis for Computer Programming". Comm. ACM 12, 10 (1969), 576-583. 36. L. Hodes. Solving Problems by Formula Manipulation. Proc. Second Inter. Joint Conf. on Art. Intell., The British Computer Society, 1971, pp. 553-559. 37. C.-H. Huang and C. Lengauer. "The Automated Proof of a Trace Transformation for a Bitonic Sort". Theoretical Computer Science 1, 46 (1986), 261-284. 38. W. A. Hunt. "Microprocessor Design Verification". Journal of Automated Reasoning 5, 4 (1989), 429-460. 39. Matt Kaufmann. A Formal Semantics and Proof of Soundness for the Logic of the NQTHM Version of the Boyer-Moore Theorem Prover. Internal Note 229, Institute for Computing Science, University of Texas at Austin, February, 1987. 40. Matt Kaufmann. A Mechanically-checked Semi-interactive Proof of Correctness of Gries's Algorithm for Finding the Largest Size of a Square True Submatrix. Internal Note 236, Institute for Computing Science, University of Texas at Austin, October, 1986. 41. Matt Kaufmann. An Example in NQTHM: Ramsey's Theorem. Internal Note 100, Computational Logic, Inc., November, 1988. 42. Matt Kaufmann. Boyer-Moore-ish Micro Gypsy and a Prototype Hardware Expander. Internal Note 73, Computational Logic, Inc., August, 1988. 43. Matt Kaufmann. A Mutual Recursion and Dependency Analysis Tool for NQTHM. Internal Note 99, Computational Logic, Inc., 1988. 44. Matt Kaufmann. A User's Manual for RCL. Internal Note 157, Computational Logic, Inc., October, 1989. 45. Matt Kaufmann and Matt Wilding. A ParaUel Version of the Boyer-Moore Prover. Tech. Rept. 39, Computational Logic, Inc., February, 1989. 46. Matt Kaufmann. DEFN-SK: An Extension of the Boyer-Moore Theorem Prover to Handle First-Order Quantifiers. Tech. Rept. 43, Computational Logic, Inc., 1717 W. 6th St, Suite 290, Austin, Texas, June, 1989. 47. Matt Kaufmann. Addition of Free Variables to an Interactive Enhancement of the BoyerMoore Theorem Prover. Tech. Rept. 42, Computational Logic, Inc., Austin, Texas, May, 1989. 48. Matt Kaufmann. A Mechanically-checked Correctness Proof for Generalization in the Presence of Free Variables. Tech. Rept. 53, Computational Logic, Inc., Austin, Texas, March, 1990. 49. Matt Kaufmann. An Integer Library for NQTHM. Internal Note 182, Computational Logic, Inc., March, 1990.

14 50. Leslie Lamport, Robert Shostak, and Marshall Pease. "The Byzantine Generals Problem". ACM TOPLAS 4, 3 (July 1982), 382-401. 51. C. Lengauer. "On the Role of Automated Theorem Proving in the Compile-Time Derivation of Concurrency". Journal of Automated Reasoning 1, 1 (1985), 75-101. 52. C. Lengauer and C.-H. Huang. A Mechanically Certified Theorem about Optimal Concurrency of Sorting Networks. Proc. 13th Ann. ACM Symp. on Principles of Programming Languages, 1986, pp. 307-3t7. 53. D. Loveland. Automated TheoremProving: A Logical Basis. North Holland, Amsterdam, 1978. 54. J. McCarthy. "Recursive Functions of Symbolics Expressions and their Computation by Machine". Communications of the Association for Computing Machinery 3, 4 (1960), 184-195. 55. J. McCarthy. The Lisp Programmer's Manual. M.I.T. Computation Center, 1960. 56. J. McCarthy. Towards a Mathematical Science of Computation. Proceedings of IFIP Congress, 1962, pp. 21-28. 57. J. McCarthy. Computer Programs for Checking Mathematical Proofs. Recursive Function Theory, Proceedings of a Symposium in Pure Mathematics, Providence, Rhode Island, 1962, pp. 219-227. 58. J. McCarthy. A Basis for a Mathematical Theory of Computation. In Computer Programming and Formal Systems, P. Braffort and D. Hershberg, Eds., North-Holland Publishing Company, Amsterdam, The Netherlands, 1963. 59. J. McCarthy, et al. LISP 1.5 Programmer's Manual. The MIT Press, Cambridge, Massachusetts, 1965. 60. J S. Moore. "A Mechanical Proof of the Termination of Takeuchi's Function".

Information Processing Letters 9, 4 (1979), 176-181. 61. J. S. Moore. "A Mechanically Verified Language Implementation". Journal of

Automated Reasoning 5, 4 (1989), 461-492. 62. J. S. Moore, et. al. "Special Issue on System Verification". Journal of Automated

Reasoning 5, 4 (1989), 409-530. 63. Matt Kaufmann. A User's Manual for an Interactive Enhancement to the Boyer-Moore Theorem Prover. Tech. Rept. 19, Computational Logic, Inc., Austin, Texas, May, 1988. 64. Marshall Pease, Robert Shostak, and Leslie Lamport. "Reaching Agreement in the Presence of Faults". JACM 27, 2 (April 1980), 228-234. 65. J. A. Robinson. "A Machine-oriented Logic Based on the Resolution Principle". JACM 12, 1 (1965), 23-41. 66. David M. Russinoff. "An Experiment with the Boyer-Moore Theorem Prover: A Proof of Wilson's Theorem". Journal of Automated Reasoning 1, 2 (1985), 121-139.

15 67. N. Shankar. "Towards Mechanical Metamathematics". Journal of Automated Reasoning 1, 4 (1985), 407-434. 68. N. Shankar. A Mechanical Proof of the Church-Rosser Theorem. Tech. Rept. ICSCACMP-45, Institute for Computing Science, University of Texas at Austin, 1985. 69. N. Shankar. Proof Checking Metamathematics. Ph.D. Th., University of Texas at Austin, 1986. 70. J. R. Shoenfield. Mathematical Logic. Addison-Wesley, Reading, Ma., 1967. 71. Y. Skolem. The Foundations of Elementary Arithmetic Established by Means of the Recursive Mode of Thought, without the Use of Apparent Variables Ranging over Infinite Domains. In From Frege to Godel, J. van Heijenoort, Ed., Harvard University Press, Cambridge, Massachusetts, 1967. 72. G. L. Steele, Jr. Common Lisp The Language. Digital Press, 30 North Avenue, Burlington, MA 01803, 1984. 73. J. von Neumann. John yon Neumann, Collected Works, Volume V. Pergamon Press, Oxford, 1961. 74. L. Wos, et al. "The concept of demodulation in theorem proving". Journal of the ACM 14 (1967), 698-709. 75. Matt Kaufmann and William D. Young. Comparing Gypsy and the Boyer-Moore Logic for Specifying Secure Systems. Institute for Computing Science, University of Texas at Austin, May, 1987. ICSCA-CMP-59. 76. W. D. Young. "A Mechanically Verified Code Generator". Journal of Automated Reasoning 5, 4 (1989), 493-518. 77. Yuan Yu. "Computer Proofs in Group Theory". Journal of Automated Reasoning (1990). To appear.

A COMPLETE SEMANTIC BACK CHAINING PROOF SYSTEM*

Xumin Nie 1 David A. Plaisted Department of Computer Science University of North Carolina at Chapel Hill Chapel Hill, North Carolina 27599 Abstract

We discuss a sequent style clause-based proof system that supports several important strategies in automatic theorem proving. The system has a goal-subgoal structure and supports back chaining with caching; it permits semantic deletion, sometimes using multiple models; it is also a genuine set of support strategy; and it is complete for first order logic in clause form. 1. I n t r o d u c t i o n

Several strategies are important for automatic theorem proving. First is back chaining with caching. Back chaining is a fundamental problem solving method; any proof system that cannot do it is handicapped from the start. Caching is used to avoid repeated solution of the same subgoal. Second is semantic deletion, that is, subgoals fail if they are false in one of a collection of interpretations. Semantic deletion allows the use of problem dependent knowledge to reduce the search space. Third is a genuine support strategy [17] which concentrates on t h e theorem. This strategy is important when there are many assertions, because it focuses the search on relevant assertions. We wilt discuss a sequent style clausebased complete proof system that supports these strategies. The proof system is a refutation-based strategy, in contrast to other subgoal methods like Gentzen style systems. We will first introduce some terminology and the modified problem reduction format. Then we will present the system and its soundness and completeness proofs. Some issues concerning the system are discussed next, followed by the discussion of related work. Several examples conclude the paper.

1.1. T e r m i n o l o g y A term is a well formed expression composed of variables, constant symbols and function symbols, A n a t o m is an expression of the form P(h . . . . . t,) where

*This work was supported in part by the National Science Foundation under grant DCR8516243. 1Current Address: Institute for Programming and Logics, Department of Computer Science, University of Albany, State University of New York, Albany, NY 12222

17 t~ (1 < i < n) are terms and p is a predicate symbol. A literal is an atom or an atom preceded by a negation sign -,. A literal is positive if it is an atom, negative if it is an atom preceded by -,. For an atom A , A = -, -,A. A clause is a disjunction of literals. A Horn-like clause is an expression L :- L1, L2 . . . . . Ln, which represents a clause L v -,L 1 v --,L2 • • • --,L., where L is called the head literal and the clause body is the set of L,'s (i = I . . . . . n). A clause C is converted into a Horn-like clause HC as follows. One of the literals or the reserved literal F A L S E is chosen as the head literal of HC and all other literals in C are negated and put in the clause body of I-IC. A clause containing n literals corresponds to n + l Horn-like clauses. These n + l Horn-like clauses are called contrapositives of each other. For example, the four contrapositives of the clause P v -,Q v --tR are (FALSE :- -~e, Q, R), (P :- Q, R), (.-,Q :- --,P, R) and (-,R :- Q, -,P). A Horn-like clause whose head is F A L S E is called a goal clause.

A simplified first order formula (a formula in negation normal form) is a quantifier-free first order formula containing no logical symbols other than -~, ^ and v, also each negation symbol --, occurring in the formula is applied to an atom. A clause is a simplified first order formula by definition. An interpretation I for a simplified first-order formula W consists of a domain D together with (1) For each n-ary P,: D" ~ -{T, F}-.

predicate

symbol

P

in

W,

an

associated

function

(2) For each n-ary function symbol G in W, an associated function Gz: D" --. O. The logical symbols are interpreted in I in the usual way. A n interpretation instance of a term or a simplified first-order formula W, denoted by W~, is obtained from W by substituting all variables occurring in W with some elements in D. We use E to stand for existential and U to stand for universal. For a simplied first-order formula W, we use I l=e W to denote the fact that there is an interpretation instance W of W which is interpreted to be T by I; we use I l=u W to denote the fact that the interpretation I interprets all the interpretation instances W of W to be T; We use I Ice W to denote I I=v --,W and use I Icy W to denote I l=g -,W. We call an interpretation I a model for a simplified first-order formula W if I I=v W. A n interpretation I is a model for a set of simplified firstorder formulae is it is a model for each formula in S. We use I-- and I== to denote derivability and validity, respectively.

1.2. Modified Problem Reduction Format

The modified problem reduction format [8] is an extension of Prolog-style H o r n clauses logic programming to full first order logic. It uses Prolog style back chaining without contrapositives and handles non-Horn clauses using case analysis. The input clauses to the modified problem reduction format are given as Horn-like clauses. For each clause C, only one Horn-like clause H C will be needed; the clause heads of the input clauses must be a positive literal (for

18

clauses containing positive literals) or F A L S E (for all-negative clauses). The modified problem reduction format has an inference rule for each input clause plus the a s s u m p t i o n a x i o m s and the case analysis rule. If S is a set of Horn-like clauses, we obtain a set of inference rules from S for the modified problem reduction format as follows: For each Horn-like clause L : - L x , L~ . . . . L n in S, we have the following clause rule. We call the r's on the left of the arrow ~ the a s s u m p t i o n list.

Clause Rules [P0-*L1 => r ~ - . L d , [r~--*Lz => P2---~L2]. . . . . P0---~L => Pn--.L

[Pn_I--~L. --> rn---~L.]

We also have the a s s u m p t i o n a x i o m s and the case analysis rule.

Assumption Axioms F--+L => P-.L if L E r F-,-d, => F , -,L--*~L

L is a literal.

L is a positive literal.

Case Analysis Rule [Po-'~L => rl, .-,M--.L], [P1, M - . L => P l , M--.L] r0--*L => I'I"-+L

Ir01<_lrlt

Let's briefly explain the modified problem reduction format. Subgoals are of the form F--.L where r' is a list of literals and L is a literal, P-+L is to be understood as r D L. P1--.L => r2--*L may be read as "transforms to"; F~--.L is the subgoal to be solved and I~z-~L is the subgoal solved. I'2 will be rl with extra assumptions added to make rz-.L solvable. If the clause set contains only H o r n clauses, the modified problem reduction format will behave exactly like Prolog. If the clause set contains non-Horn clauses, the assumption axioms and the case analysis rule will be used and case analyses will be performed. The idea is: for each negative literal -,L in the clause body of a Horn-like clause, we first assume -,L to be true (by adding it to the assumption list) and obtain the proof under this assumption. Then we assume L to be true and obtain the proof under this assumption. The transformation I'~--.L => r2--+L is the device for introducing the assumptions and the case analysis rule performs the case analyses. The readers can refer to [8] for a complete discussion of the modified problem reduction format. We only give the soundness and completeness theorems. [IS is used to denote derivability using the inferences rules from S.

Soundness Theorem: If [--s r~--.L => Fz--+L, then the list r~ is a prefix of the list I'2 and S 1== r2 D L.

19

Completeness

Theorem:

A

set

of

clauses

S

is

unsatisfiable

iff

I-

s "-'* F A L S E => ---, F A L S E .

2. A Semantic Proof System The modified problem reduction format can be generalized as follows. Suppose we are given a set S of clauses and an interpretation M for S which interprets the literal F A L S E to be T. For the moment, we will assume that the input clauses are all the contrapositives and all the clauses of the form F A L S E : - L 1 ,L2 . . . . . L , where --,L1 v -4_,2 v • • • v --tLn is a clause in S. We have the following set of inference rules. For each Horn-like clause L : - L1, L2 . . . . . Ln, the clause rule M [ = E L , [Fo----*L1=> FI'-'+L1] , [FI"*L2 => Fz'+L2] . . . . .

[F,,_l--'-*Ln => F,,"--*Ln]

P0---~L => Pn---,L The case analysis rule M I---EL, [P0---~L=> P~, -~N--~L], IF 1 , N--*L => Pl , N--~L]

Irol
p0---~L => F1..-~L The assumption axioms are F--,L=>F---~L if L E F I'---~--,L => P, -,L--,-~L

L is a literal.

L is a positive literal.

Note that the semantic proof system differs from the modified problem reduction in that contrapositives are used and the semantic tests M I=~ L are added to the rules. We will prove the soundness and completeness of the system. We only deal with the ground case, which can be lifted to first order logic in the usual way. Given a set of clauses S and an interpretation M for S, we denote by I--sM derivability in this system.

Theorem 1 (soundness): If 1--~t Ft---,L => F2--+L, then the list I'1 is a prefix of the list r2 and S 1== r2 ~ L. Proof. We can prove this by induction on the size of the proof, i.e., the number of times the inference rules are used, making use of the length restriction in the case analysis rule (This theorem is the same as the soundness theorem in [8]). Q.e.D. T h e o r e m 2 (completeness) A set of clauses S is unsatisfiable iff for any interpretation M for S, l--sM--* F A L S E => ~ F A L S E .

Proof. Let atom(S) denote the set of set of literals --,L where L E atom(S). Let interpreted true by M, then M C atom(S) atom A (E atom(S)), either A E M or

atoms in S and N-atom(S) denote the M be the set of literals in S which are U N-atom(S) U {FALSE}. For every -,A E M. Specifically, F A L S E ~ M.

20

Consider the following set of inferences rules which includes all the clauses rules from S as described above, plus the assumption axioms P---.L => F--.L if L E I" F--~L => 1", L-..,L if MIC.EL and the case analysis rule MI=EL, [Po--~L => Fl, N---,L], [rl, ~ N ~ L => r~, ~N--*L] trol_ FI--*L where N is a literal. This system is complete from the proof of theorem 6 in [8], if we regard all the literals in M as positive and all other literals as negative. The completeness of the semantic proof system follows if we observe that the semantic proof system merely fixes the order of the two cases for each application of the case analysis rule. Obviously it does not matter in which order the case analysis is done. Q.E.D.

3. D i s c u s s i o n

The modified problem reduction format is a special case of the semantic proof system where M = atom(S) t3 {FALSE}. Both the modified problem reduction format and the semantic proof system support back chaining with caching. We will elaborate on this issue and other issues related to the semantic proof system. Back Chaining with Caching. One advantage of the semantic proof system is that it supports true back chaining, which resolution strategies fail to do. In back chaining, goals are expressed as subgoals, which are similarly expressed, and each subgoal is solved separately. Caching means that a subgoal is solved only once. If a subgoal is solved, its solution is remembered; if a subgoal fails, it is not attempted again. In resolution, many subgoals can occur together in the same clause. If there are a number of choices for how each subgoal could be solved, these choices get multiplied together. As a result, the number of clauses generated could be much larger than the number of subgoals. If caching is used in a back chaining system, the search space is proportional to the number of subgoals. In resolution, however, the search space could be considerably larger. Consider the example of H o r n clauses. If back chaining is used on a set of Horn clauses, all the subgoals are unit clauses. Thus the search space consists entirely of unit clauses. Once a subgoal has been solved and its solution recorded, it never needs to be solved again. Thus the search time is roughly proportional to the number of subgoals (literals) seen times the number of solutions generated. However, using all-negative resolution, which is the closest approach to back chaining in resolution, the search space will contain clauses having many literals and can be proportional to the number of clauses seen, which may be larger than the number of

21 literals. We do not mean to imply that resolution is always inferior, however. Semantic Deletion. A n o t h e r advantage of the semantic proof system is that it allows deletion of false subgoals in an arbitrary interpretation. Semantic deletion can be made stronger in several ways. First, consider the input clause L :-L1 ,L2 . . . . . Ln. M is the interpretation used. Suppose a subgoal P0---~L is attempted. The use of the clause rule [Po--~L1 => Py-~L,],

[P1---~L2 = >

F2---*L2] . . . . .

[P._r--*L,, => P.-*L~]

Fo---~L => Fn--*L can be stopped if there exists a literal L~ among L1,L2, . . . . L n such that L~ is a positive literal and M I ~ Li and --,(LiEF0), even if MI=EL. This is because when FI_I-+Li is attempted, the only way to solve it is to use the assumption axiom since M I ~ L~. But it is impossible to have any extra positive literal in Fi-i other than those already in F0, since the assumption axiom only adds negative literals and the case analysis rule, although adding positive literals, only add them to the subgoals of ri_l~L,. Second, a new solution F0---~L need not be cached, in case caching is performed, if MI#EL since the subgoals of the form F---~L will never be attempted except using the assumption axioms. Third, consider the case analysis rule. Suppose the clause set is S = so (3 G where G are all the goal clauses and we have several models M~ . . . . . Mk for S0. The application of the case analysis rule can be stopped if there exists an Mi among M x . . . . . M k such that M i lee rl -'-~L, where Pt---.L is as in the case analysis rule. This follows from the soundness theorem since $1 1== rl--*L. Finally, consider the clause L:-LI,L2, . . . . Ln. If M lee L, this clause will never be used in the semantic proof system. Thus we need not to include such clauses in the input. In general, we only need to include those clauses whose heads are existentially satisfied by M.

Set of Support Strategy. The set of support strategy [17] is a powerful and completeness preserving restriction strategy for resolution. In this strategy, the clause set is divided into two sets A and T where S = A U T and A f3 T = O . A usually represents the axioms and the special hypotheses and is satisfiable and T, which is called the set o f support, represents the negation of the theorem. A resolution operation is only allowed for two clauses if at least one of them comes from the set of support directly or indirectly. The modified problem reduction format is not compatible with the set of support strategy because its goal clauses are always all-negative clauses which do not always come from the negation of the theorem. The semantic p r o o f system is a set of support strategy, because, given an interpretation M, we only need those clauses as goal clauses that are false in M. This means that we need not to include all the Horn-like clauses of the form FALSE:-LI, L 2 ..... L n where - . L ~ v ~ L 2 v • . • v - ~ L n is a clause, contrary to what we have stated earlier. If M is a model of the axioms, then only clauses from the theorem will be false in M, giving us a true set of support strategy. A stronger result can be obtained: it is only necessary to have one goal clause according to some interpretation M. Suppose S is an unsatisfiable clause set. A s s u m e that S = A U T and A fq T = Q and A is satisfiable, where A represents

22 the axioms the special hypotheses and T represents the negation of the theorem. Further assume T = {C1, C2 . . . . . C,}. If there exists an interpretation M such that M I=v A and M l=v C/ (i = 1 . . . . . n-l) and M I¢u C,, we can use C, as the only goal clause according to the interpretation M. If such an interpretation does not exist, then we k n o w 1== (A U {C1, C2 . . . . . C,_~}) D C,. Thus A U {C~, C2 . . . . . Cn_~} = S, is unsatisfiable since S is. We can apply the same argument to S, to conclude the proof. We may not know what goal clause to pick, but in a given proof, only one goal clause need be used. Gelernter's System. If the clause set consists of only H o r n clauses and the interpretation only interprets negative unit clauses to be false, the semantic proof system is the same as Geternter's method. Furthermore, no contrapositive will be needed. Thus the semantic proof system is a generalization of Gelernter's method to full first order logic. Contrapositives and Interpretation. The Prolog-style extension to full first order logic (non-Horn clauses) using the Model Elimination procedure [6] requires the use of all the contrapositives if the clause set is non-Horn [13]. The modified problem reduction format, on the other hand, does not need any contrapositives. Using contrapositives sometimes costs efficiency since it effectively increases the number of clauses. More importantly, though, it can lead to unnatural search behavior and makes the search process difficult to control. See [8] for some examples. However, our experience has shown that, for non-Horn problems especially, some contrapositives can significantly help to improve the efficiency of the prover based on the modified problem reduction format. This is because less case analysis is needed. The problem is to decide which contrapositives to use. As we have noted, given an interpretation M for a set of clause S, we only need to include the Horn-like clauses whose clause head is existentially satisfied by M. Thus the semantic proof system brings a solution to this problem by making use of problem domain knowledge represented in an interpretation. Now the question is how to design an interpretation for a given theorem. This is not a trivial question. It is difficult to automate since problem domain knowledge is usually required and it is hard to give a precise description of what is a suitable interpretation. The difficulty for a h u m a n to design an interpretation lies in the interpretation of the skolem functions [15]. Usually, however, a human has a natural interpretation in mind when he states a theorem. A method for designing interpretations for a set of clauses is proposed in [15]. This method is a general method and can be slightly modified to select.the input clauses for the semantic proof system. The basic idea of Wang's method is to put together all the clauses containing the same uninterpreted symbol, often skolem function symbols, and use some interpretation rules to interpret the uninterpreted symbol. We will briefly present Wang's method and the modification below.

23 Given a natural interpretation I for a t h e o r e m and the natural interpretations of the function symbols and predicate symbols, we need to interpret the uninterpreted symbols. W e call a simplified first-order formula an i n t e r p r e t a t i o n n o r m a l f o r m (INF) if it is in the following form: LIv ...

vLkv[C1A ...

ACh]

where Li's are literals and Ci's are clauses. Note that, corresponding to each I N F • • • v L k V [C1 A • • • A Ch], there is an equivalent set of clauses L 1 v • • • v L ~ v C1, L1 v •.. v L k V Cz ..... L I V • • • V L k V Ch. There are two special cases of INF: a clause L1 v • • • v Lk is in I N F f o r m where h = 1 and C1 = [ ] and a f o r m u l a C~ A • • • A Ch is in I N F f o r m where k = 1 and L 1 = F]. L 1v

We usually c o m b i n e all the clauses containing the same skolem function symbol into I N F form, t h e n interpret the symbol according to the i n t e r p r e t a t i o n r u l e s . There are two interpretation rules for formulae in I N F form. In addition to interpreting skolem function symbols, these rules can be used to select all the necessary contrapositives. F o r each interpretation instance of an I N F f o r m L1V

"'"

VLkV[C1A

"'"

ACh]

R1 if I I=E [-,Lx ^ • • • ^'~Lk], t h e n for each i (l_
if I l=u [L~v . . . that I ]=~ -,C~.

VLk], t h e n there should be at most one i (1 < i < h )

such

This rule simply states that there should be as few rules as possible for any subgoal. E a c h L i (1 _< i __
:-

"~L1 , . • • ,

L m :-- , L

Lm

:-

1,

• ..,

"~L1 , . • • ,

~Lk

, ~C1.

" n L k , "nC2.

"Lk

, "~Ch.

Consider the task of proving Lm. Rule R2 states that there should be only o n e rule for proving Lm since there is at m o s t one Cj such that I I=~ -,Cj. S u b g o a l Identification. L e t ' s consider the inference rule

24 F, -,L --. L => P, -,L ~ L r---~ L => P ---~L This rule is sound since it is a degenerated case of the case analysis rule [r --, f = > r , L - - , f ]

I t , -~L -~ f = > r , -~L ~ f l

F--* L => I'--* L

where r ~ L => r, L --* L is the assumption axiom in our system. It is often easier to prove r, -,L - , L than r --, L since we can use the negation of the subgoal. This can be regarded as a limited use of the ancestry resolution as in Model Elimination. This technique can be used for any subgoal and we need heuristics to guide its use. One useful heuristics is to use the technique on subgoal L if L is at or near the top-level and is true in all the interpretations that we provide. Use of this technique is very important for proofs of several "hard" problems, including the intermediate value theorem. 4. Related Work

Quite a number of similar proof systems that support some of the strategies have been studied. Gelernter's Geometry Theorem Prover [5] is the earliest system, which proves theorems in plane geometry; it uses back chaining and represents semantic information using diagrams; false subgoals are deleted. The inference system in Gelernter's system is similar to that of Prolog and only complete for Horn clauses. The semantic proof system is a generalization of Gelernter's system to first order logic. Reiter [9] proposes a natural deduction system which uses arbitrary interpretations to delete false subgoals. Reiter's system is not complete for first order logic. It is not clear how caching can be done in Reiter's system. The M E procedure [6] supports back chaining and is a set of support strategy. No semantic deletion can be performed in ME. Caching is not easy to do in ME, because the number of subgoals may be large due to the ancestor lists. Slagle [12] proposes semantic resolution which is a generalization of hyperresolution to an arbitrary interpretation. Slagle's system gives a semantics criterion for restricting which resolutions are performed. Our semantic proof system is in the spirit of Slagle's system. But Slagle's system cannot support back chaining and it can only use one interpretation. Sandford [11] proposes Hereditary Lock resolution which combines lock resolution [4] and the model strategy in [7]; it also gives a semantic criterion for restricting resolutions. This also fails to support back chaining. The resolution-based semantically guided hierarchical deduction [15, 16] uses only false resolvents in some interpretation as goal clauses, but it does not seem to be a set of support strategy. The connection graph method [2] can achieve many refinements to resolution [10]. However, in the connection graph method, subgoals and solutions are not explicitly represented, nor is there a method for deleting subgoals false in an interpretation. There is no provision for caching subgoals and solutions either. But, it is possible that the connection graph method could be modified to accommodate these strategies.

25 5. Some Examples It was easy to implement the semantic proof system, using the existing implementation of the modified problem reduction format [8]. We will discuss several examples and show the experimental results. Intermediate Value Theorem (IMV). If a function f is continuous in a real closed interval [a, b], where f(a) < 0 and f(b) > 0, then ~ x [(a < x) ^ (x < b) ^ (f(x) = 0)]. The input clauses of IMV can be found in [16]. Further discussion of this problem can be found in [1, 3]. We have designed an interpretation for IMV using the two interpretation rules. At the same time, we select the necessary contrapositives based on the interpretation. Some contrapositives are determined to be unnecessary. For example, one of the clauses is p(f(x),O) V --,p(a,x) V ~p(x,b) V --,p(x,h(x)) where p(x, y) - x < y and h is a skolem function. Note that any reasonable interpretation will not interpret -,p(a,x) o r ~p(x,b) to be T. Thus the Horn-like clauses with ~p(a,x) o r -.,p(x,b) being heads are unnecessary. The ground subgoals which are false in the interpretation are deleted (we only deal with ground subgoals for the sake of simplicity). Without the contrapositives, our prover fails to obtain a proof for even an instantiated version of IMV. However, when we use contrapositives and delete the ground subgoals interpreted to F in the interpretation, the same prover obtains a proof for the instantiated version of IMV. The prover automatically performs the instantiation at the top-level according to the interpretation and solves the two subgoals (f(1) < 0 and f(1) > 0) separately using the technique of subgoal identification. Schubert's Statement [14]. This problem has been the subject of much study. We have done several experiments on it. The prover gets a proof for this problem in 748 seconds, without any contrapositive, on a SUN 3/60 workstation using ALS-Prolog. 8921 inferences are performed. With all the contrapositives, the prover takes 730 seconds to get a proof. 7939 inferences are performed. It does not makes a big difference to use an interpretation to delete false subgoals for some reason. We would like to point out that the proof obtained using contrapositives is much smaller than the one without contrapositives. Attaining Minimum (or Maximum) T h e o r e m (AM8). A continuous function f in a closed real interval [a, b] attains its minimum (or maximum) in this interval [16]. Some contrapositives are added when we design an interpretation for it. Without the contrapositives, the prover can not obtain a proof. The prover finds a proof in about 2 hours with the contrapositives. A look at the proof tells why. The added contrapositives reduce the number of case analyses by solving some negative subgoals, quite a few of them in this problem, directly.

26 6. Conclusion

We have presented a complete sequent style clause-based proof system. The system supports back chaining with caching and is compatible with the set of support strategy. It allows semantic deletion using an interpretation. What is also interesting about the semantic proof system is that it provides an answer to the problem about how contrapositives are handled in similar systems. We need to do more research on the effect of semantic deletion in the semantic proof system. We have experienced several occasions where it has adverse effect on the performance of the prover to delete subgoals that are false in an interpretation. References

[1] Ballantyne, A. and W.W. Bledsoe, "On Generating and Using Examples in Proof Discovery", Machine Intelligence, V 10, pp. 3-39, Harwood, Chichester 1982. [2] Bibel, W., "Automated Theorem Proving", Friedr. Vieweg & Sohn Verlagsgesellschaft MbH, Braunschweig 1982. [3] Bledsoe, W.W., "Using Examples to Generate Instantiations for Set Variables", Technical Report No. ATP-67, Department of Computer Science, University of Texas at Austin, July 1982. [4] Boyer, R., '~ocking: A Restriction of Resolution", Ph.D. dissertation, University of Texas at Austin, Austin, TX, 1970. [5] Gelernter, H., "Realization of a Geometry Theorem-Proving Machine", Proc. ICIP, pp. 273-282, Paris UNESCO House, 1959. [6] Loveland, D.W., "A Simplified Format for the Model Elimination TheoremProving Procedure", J. ACM, Vol. 16, No. 3, pp. 349-363, July 1969. [7] Luckham, D., 'Refinement Theorems in Resolution Theory", Proc. IRIA Syrup. Automatic Demonstration, Versailles, France, 1968, Springer-Verlag, New York, pp. 163-190, 1970. [8] Plaisted, D.A., "Non-Horn Clause Logic Programming Without Contrapositires", Journal of Automated Reasoning, Vot. 4, Nov. 3, September 1988. [9] Reiter, R., "A Semantically Guided Deductive System for Automatic Theorem Proving", I E E E Transaction on Computers, Vol. C-25, No. 4, pp. 328-334, April 1976. [10] Robinson, J.A., "A Machine-oriented Logic Based on the Resolution Principles", JACM 12, pp. 23-41, 1965. [11] Sandford, D.M., "Using Sophisticated Models in Resolution Theorem Proving", Lecture Notes in Computer Science, No. 90, G. Goos and J. Hartmanis eds, Springer-Verlag, 1980.

27 [12] Slagle, J.R., "Automatic Theorem Proving with Renamable and Semantics Resolution", JACM, Vol. 14, No. 4, pp. 687-697, October 1967. [13] Stickel, M.E., "A PROLOG Technology Theorem Prover", Journal of Automated Reasoning, Vol. 4, No. 4, pp. 353-380, 1988. [14] Walther, C., "A Mechanical Solution of Schubert's Steamroller by Manysorted Resolution", Proc. 8th AAAI, pp. 330-334, 1984. [15] Wang, T.C., "Designing Examples for Semantically Guided Hierarchical Deduction", Proc. of lJCAI, pp. 1201-1207, 1985. [16] Wang, T.C. and W.W. Bledsoe, '~ierarchical Deduction", Journal of Automated Reasoning, VoI. 3, No. 1, 1987. [17] Wos, L.T., G.A. Robinson and D.F. Carson, "Efficiency and Completeness of the Set of Support Strategy in Theorem Proving", J. ofACM, Vol. 12, No. 4, October 1965.

Parallelizing the Closure C o m p u t a t i o n in Automated Deduction John K. Slaney Automated Reasoning Project Australian National University [email protected] Ewing L. Lusk * Mathematics and Computer Science Division Argonne National Laboratory [email protected]

Abstract In this paper we present a parallel algorithm for computing the closure of a set under an operation. This particular type of computation appears in a variety of disguises, and has been used in automated theorem proving, abstract algebra, and formal logic. The algorithm we give here is particularly suited for shared-memory parallel computers, where it makes possible economies of space. Implementations of the algorithm in two application contexts are described and experimental results given.

1

Introduction

There are many contexts in which one wants to compute the closure of a set of objects under an operation. In resolution-based theorem proving, for example, the search for a proof of unsatisfiability for a set of clauses may be viewed as a computation of the closure of the original set of clauses under a resolution operation, where one terminates the computation once the closure has been found to contain the null clause. The Knuth-Bendix completion procedure is a closure computation in which the operation is a restricted form of paramodulation followed by demodulation, and one may not know in advance whether the computation will complete. The closure computation is also strongly related to the *This work was supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under contract W-31-109-Eng-38.

29 computation of least fixed points. Details of these and other occurrences of the closure computation paradigm are given in Section 2 below. Algorithms for carrying out this computation at first glance appear serial, because the results of earlier computations are used in later ones. A small amount of reflection reveals substantial parallelism in the computation of new elements, however, except in pathological cases. Further study reveals a serialization bottleneck in the subsumption phase of the algorithm. The main point of this paper is~the presentation of a parallel algorithm for the closure computation that avoids this bottleneck in a way different from other attempts to solve this problem. In Section 3 we describe the new algorithm, prove its correctness, and describe how it differs from other algorithms designed to attack the same problem. Finally, in Section 4 we describe the implementation of this algorithm in two different programs to carry out computations in formal logic. We give results demonstrating that significant speedups can be achieved. Finally, we describe directions for future exploitation of the algorithm in other contexts.

2

T h e Closure C o m p u t a t i o n and its Significance

The closure operation is a fundamental one. Suppose we are given a set T and an operation f : T x T . . . x T --~ T. Then if S is a subset of T, we define the closure CI(S, f) as:

CI(S,f)=('~{ R [ S C R a n d f ( R x R . . . x R ) c R } In other words, the closure of S is the smallest subset of T that contains S and everything in T that can be obtained from S by repeatedly applying the operation f. Depending on the choice of T, S, and f , computing Ct(S, f) is equivalent to a variety of computations which on the surface appear to be quite different. We give here several examples.

2.1

Unsatisfiability

of a Set of Clauses

One of the most familiar applications is that of proving a set of clauses unsatisfiable. In this case T is the set of all clauses, S is the set we wish to show unsatisfiable, and f is an inference rule such as binary resolution or paramodulation. (Hyperresolution gives an example in which the arity of f is greater than two.) In this case, CI(S, f) is quite likely to be infinite, and so one expects to terminate the computation as soon as the empty clause [] is found to be a member of CI(S, f). It is the potentially infinite size of CI(S, f) that makes resolution only a semi-decision procedure for first-order logic. Whether or not CI(S, f) is finite, it represents the set of all clauses deducible from S under the inference rules being used.

30

2.2

The K n u t h - B e n d i x C o m p l e t i o n P r o c e d u r e

The computation of a complete set of rewrite rules is similar, except in this case the computation will not terminate if the closure being computed does not turn out to be finite. One starts with an initial set S of rewrite rules, and tries to find a set P of rewrite rules containing S and having the unique termination property. Knuth and Bendix showed that P = CI(S, f ) , where f is defined as paramodulation between left sides of rewrite rules, followed by rewriting of the resulting paramodulant. (To compute a practical complete set, one also applies back subsumption and back demodulation to the set being constructed, so that the set being computed is not exactly a closure of S, since it does not contain S itself. This aspect of the "closure" computation will be treated in a later paper.)

2.3

C o m p u t i n g the Size of Certain Finite Free Semigroups

Algebraic objects are frequently defined in terms of generators, operations, and relations. It may be obvious that the resulting object is finite, but there may be no clue to its size, even in the case of a free object (no relations). In this case the object is exactly the closure of the set of generators under the operation, and so the closure computation can be used to compute the size of the free object. The fact that this is a closure computation means that a theorem prover can be used to carry it out. This is exactly what was done in [6] to discover the size of the semigroup F2B2. It has been used since then to discover the sizes of F3B2, F2B21, and F3B21. All of these were new results. The computation of F3B21 was done on a parallel machine because it had the required 120M of memory. Parallelism was not exploited; the run took more than seven hours on a Sequent Symmetry.

2.4

C o m p u t a t i o n of A c k e r m a n Constants

One case in which it was not obvious whether a particular freely generated algebra was finite or infinite was that of the free De Morgan monoid generated by the monoid identity. De Morgan monoids are the natural algebraic counterparts of the system R of relevant logic (see [3] for a definition and explanation). An important step towards understanding constant De Morgan monoids--i.e, those generated from the identity alone--was the computation of the subdirect products thus generated of certain sets of small constant algebras. As reported in [9] and [11], one of these was eventually discovered to be characteristic and to have 3088 elements. The closure computation used to discover this was painfully slow in its serial form but parallelizes well by our method as shown below.

2.5

Formulas of E__,

Another, related, closure problem arising in the theory of relevant logic is that of determining the structure of the one-variable fragment of the sentential logic E_~ of Anderson

3t and Belnap. It is known that with negation as well as implication infinitely many nonequivalent formulae can be defined in E, but very little is known about the pure implication fragment. A recent computational result is that the direct product of all 4-element E_~ algebras can distinguish 7516 such formulae. In Section 4 we present speedup results for the parallelization of this computation.

3 3.1

A l g o r i t h m s for the Closure C o m p u t a t i o n T h e Sequential A l g o r i t h m

Here we describe a straightforward, efficient algorithm for computing the closure. It has been used in countless theorem provers. Let S = { x l , . . . , x k } be a finite subset o f a s e t T. Let f : T x . . . × T ~ T b e a n n-ary operation on T. The algorithm shown in Figure 1 makes use of a list L and two indices into L, p and q. We say that an element x of T is new if it is not subsumed by an element of L. Initialize L[i] ~ xl, for i = 1 , . . . , k Initialize p ~-- 1, q ~-- k + 1 While p < q do Foreach ( i l , . . . , in) such that Vj, ij < p and 3j, ij = p (generate phase) Compute f(L[il],..., L[i,]) (subsumption phase) If f(L[ix],..., L[i~]) is new then (update phase) L[q] ~ f(L[il],..., L[i=])

q~---q+l end if end for

pe--p+l end while Figure 1: Sequential Closure Algorithm There are several observations to be made about this algorithm: The pointer p chases the pointer q; the computation completes when it catches up. There is no guarantee that it will do so. This is not a severe drawback in most situations, since either 1) the closure is known in advance to be finite, or 2) one is looking for a particular element of the closure, and so will abort the search when it is found. If the algorithm does terminate, then at completion L is an ordering of CI(S, f). By induction on the number of times through the "While" loop, the generate phase can only compute elements of CI(S, f), and as long as L is not all of CI(S, f ) , the

32 computation will continue, since all tuples of elements of L are eventually considered in the "Foreach" statement. Finally, the subsumption phase ensures that L contains no duplicates. The restriction in the "Foreach" condition ensures that each tuple will only be considered once. This is critical for efficiency, since it prevents redundant calculations. Each time through the main loop, we consider only those elements of L up to and including the pth one, not all of the ones we have produced. Anyone reading this as a theorem-proving algorithm would ask about back subsumption and back demodulation, which use new elements of L to modify or delete existing ones. Note that these operations are not admissible here by our definition of closure.

3.2

Variations on the Sequential Algorithm

We take this opportunity to make some observations about the closure algorithm as it stands. These observations will also be true of the parallel version.

The set-of-support strategy

In the context of theorem proving, it represents an implementation of the set-of-support strategy[12] used in various Argonne theorem provers over the years. In many cases it is possible to initialize with the pointer p set to an index greater than 1. This is typically done when one knows that S is an unsatisfiable set of clauses but that a subset A of S is satisfiable. Then if we assign the elements of A to L[1],..., L[n] and start with p ~ n + 1, under certain conditions on the inference rules being used we will still be computing that part of C I ( S , < i n f e r e n c e r u l e s >) that contMns the empty clause, although not the complete closure. The set A typically contains the axioms for a domain, together with parts of the hypotheses of the theorem being proved.

Associative operations Further optimizations are possible when the function f is a binary operation and is associative. In this case the "Foreach" condition can use the stronger restriction that il _< k. That is, in the generate step, the first element of the tuple being considered must belong to the original input set S. This greatly reduces the number of tuples (pairs, in this case) considered. This is illustrated in the case of the semigroup problem, where the operation is associative by the definition of semigroup. If we let x l , . . . , X k be the original set of generators, then a general product computed by the algorithm is of the form (yl " . . . " y,.)(yT+I • . . . " y,), where Vj, 3i with yj = x~. Since the operation is associative, this same product will also be computed as yl " (y2 " ... • y~). Hence we may safely restrict ourselves to the case in which the first element of the pair is one of the original generators. Another, more general, case arises when one is computing the closure of any relation under the "composition" operation, which is associative. An example many are familiar

33 with~ is the ancestor relation. There are two ways to axiomatize the ancestor relation generated from the parent relation: (1)

If parent(x,y) then ancestor(x,y) If ancestor(x,y) and ancestor(y,z) then ancestor(x,z)

(2)

If parent(x,y) then ancestor(x,y) If parent(x,y) and ancestor(y,z) then ancestor(x,z)

Axiomatization ('1) may compute a specific ancestor relationship in fewer steps, but (2) will compute all ancestors (the closure) much more efficiently. The optimization is possible precisely because this is the computation of the composition operation on ordered pairs, which is associative. An even further optimization is possible when f is a binary operation which is commutative. In that case we can impose the additional restriction in the "Foreach" condition that il < i2. T h e i n f i n i t e case The closure computation can be generalized even more than we have stated. W h a t it turns on is the very elementary fact of recursion theory that the closure of a recursively enumerable set under a recursive function is recursively enumerable. It is not necessary that the set of generators be finite; we might be given not a list of them but just an algorithm for generating them. Nor is it necessary that the closure computation should complete. A completely general form of the algorithm is given in Figure 2. Initialize L[1] ~ xi Initialize p ~ 1,q ~ 2, k ~ 2 While p < q do Foreach ( i l , . . . , i n ) such that Vj, ij < p and 3j, ij = p

Compute f(L[il],..., L[i=]) If f(L[ixl,..., L[i~]) is new then L[q] ~ f(L[il],..., L[i=]) q~---q+l end if end for If xk exists then L[q] ~ x~ k~--k+l,q~--q+l end if p~--p+l end while Figure 2: Generalized Sequential Closure Algorithm What we now claim is that (regardless of whether S is finite or not) L is an enumeration

34 of the closure of S under f. In the case that S is finite we can indeed simplify by putting all the xl in at the start, as in Figure 1, but this is not generally possible.

3.3

The Parallel Algorithm

The most obvious way to parallelize the algorithm is to parallelize one of the loops. The inner loop is relatively easy to parallelize but leads to a sequential bottleneck because processes must wait for each other to complete and synchronize for the advancement of the pointer p. A better technique is to parallelize the outer "while" loop; that is, to consider several values of p at once. The generate phase of the computation is not affected, since for l = p , p + 1 , . . . , p + r < q, t h e / t h iteration of the loop is exactly the same, whether the iterations are done sequentially or in parallel. The subsumption and update phases of the computation, however, must be changed, to protect against simultaneous updating of L and, more importantly, to ensure that a complete subsumption test is carried out before updating. A straightforward way to do this would be for each process to lock L while it performed the subsumption check and added newly generated unique elements to L. However, this would create too much of a serial bottleneck, since the subsumption phase of many closure computations is the most expensive. Our solution separates the tasks to be carried out in order to allow" for greater parallelism. To accomplish this, we make use of a separate list K indexed by a pointer r, which holds elements that have been generated and passed an "almost complete" subsumption test, but have not passed a final subsumption test. Carrying out the final check and moving such elements from list K to list L is done separately. More formally, we break the computation down into units of work as shown in Figure 3. It is possible to design the data structures that index L for fast partial subsumption testing so that the generate phase of Task A can go on concurrently with Task B. Finally, we dispatch processes that are available for work as follows: When a process requests work, we give it Task B if K is not empty and no other process is executing Task B, otherwise we assign it Task A. Thus we typically have many instances of A in progress, and (occasionally) at most one instance of Task B. There are several observations to be made about this algorithm: • It also computes the closure of S under f , by the same argument as in the sequential case.

• No duplicates are put in L, because updating of L is only done by Task B, of which there is only one instance at a time. • The algorithm retains most of the efficiency of the sequential algorithm, but not all. It remains true that no tuples are considered twice, since each instance of Task A uses a different value of s, so the total amount of work done in the generate phase is the same in both cases. The final subsumption test will duplicate work done in the partial subsumption test. Some of this duplication is reduced by the removal of

35

Initialize L[i] ~-- xi, for i = 1 , . . . , k Initialize p ~-- 1, q *-- k + 1 Initialize K *-- e m p t y , r *-- 1 Task A: Lock p, set s +- p, p +- p + 1, Unlock p Foreaeh (il,...,i,~) such that Vj, ij < s and 3j, ij = s Compute f(L[i~],..., L[i~]) (generate phase) If f(L[i~],..., L[in]) is new then (partial subsumption phase) Lock K K[r] *-- f ( L [ i l ] , . . . , L[i~]) (partial update phase) re-r+l Unlock K end if end for Task B: While r > 0 Lock K a ~ K[r],r ~ rUnlock K If a is new then L[q] ~ - a

1 (complete subsumption) (complete update)

q~q+l

end if end while

Figure 3: Parallel Closure Algorithm

$6

duplicates from K, but some of it is unavoidable. The reason this is not a severe problem is that most subsumed elements are removed by the partial subsumption check, and thus are not retested in Task B. • The parallelism is of large grain size, since Task A contains not only generation of new elements but also the bulk of the work of subsumption. The grain size can be increased slightly (synchronization reduced) by batching within each process the partial updates to K. We have not shown this in Figure 3 since it complicates the presentation of the algorithm. • Nearly all attempts to generate a new element fail. If the computation completes with q = Q + 1, then Q= tuples will be considered, but only Q - k new elements will be added. Assuming k negligibly small with respect to Q, we still have only approximately 1 in every Q computations resulting in updates to L. Therefore Q need only be on the order of 100 for the computation to be well worth parallelizing. By the computation above the proportion of trials which actually result in any updating of L is rather small. The proportion which result in updating K is usually larger. The question of how much larger is crucial to any account of the efficiency of the parallel algorithm. The serial bottleneck is avoided only if list K is at least close to being emptied for the last time when the computation completes. In the more general case of a closure computation which does not complete, or which is terminated for reasons other than exhaustion, K should grow slowly in comparison with L. Unfortunately, we have no firm theoretical results concerning the size of K, but our experimental results indicate that in typical cases K remains small. Most of the time, in fact, K is empty, and because elements from K do not have to be reconstructed before their second comparison with L it can be emptied again fairly quickly when it does become occupied. We present our speedup results as evidence of the degree to which the serialization problem has been overcome. Although precise results are hard to come by, we may at least note that in general the greater the final value of q the better the algorithm will parallelize, while the more processes there are adding to list K the greater will be the threat of a recurrence of serialization. • Other parallel algorithms for parallelizing this type of computation have been presented, both of them based on message-passing rather than shared-memory models of parallel computation. The difference is that synchronization among processes is done by the sending and receiving of messages rather than by locks on shared data structures, which are an inherently faster synchronization mechanism. One implementation of the semigroup computation was given in [1]. There speedups of close to 3 were obtained with 4 processes. The message-passing model limited the number of processes that were runnable because extra memory was required for duplicating most of the data structures. A more sophisticated message-passing theorem prover is presented in [4]. The technique used there provided speedups up to 23 with 29 processes on a very large problem, but requires complex load-balancing decisions to be made ahead of time, and seems to require a large problem to outweigh the overhead of message-passing. The results we present in Section 4 lead us to hope that when the shared-memory

37 algorithm of Figure 3 is applied to a theorem prover, speedups will be good even on small problems, and the load-balancing will be automatic, because of the sharedmemory model.

4

Experimental

Results

This algorithm has first been tested in the application areas described in Sections 2.4 and 2.5. The implementation was in C, using the Argonne monitor macro package described in [5] to provide a portable and relatively high-level paradigm for writing the program. The package provides a general dispatcher (the ASKFOR monitor) which was used to dispatch tasks A and (one instance at a time of) task B to however many processes were started. No particular process was dedicated to any particular task. The code was developed on a Sequent Symmetry at the Automated Reasoning Project at the Australian National University, and run on a larger Symmetry at Argonne National Laboratory. Results obtained are shown in Tables 1 and 2. processes time(seconds) 1 1964.43 5 408.31 10 222.74 15 163.65 20 129.85

speedup 1.00 4.81 8.82 12.00 15.13

Table 1: Computation of Ackerman Constants

processes time(seconds) speedup 1 13597.26 1.00 5 2913.37 4.67 10 1612.07 8.43 15 1185.83 11.47 20 972.39 13.98 Table 2: Computation of Formulas of E_.

In each of these cases, an order of magnitude reduction in computing time was achieved.

5

Future Work

The algorithm has so far been implemented and tested in special purpose programs for computing the closures of particular sets under particular operations. The next step

38

is to implement a general-purpose theorem prover using this algorithm, incorporating back demodulation and back subsumption. Not only will this provide a wider range of applicability but we will be able to compare the speed of the parallel closure computation using general methods with the special-purpose programs described here and with the message-based parMlel closure algorithms. We have begun to construct such a theorem prover, using OTTER[7] as a base, since it already contains many desirable features unrelated to parallelism. The goal is to produce a parallel version of OTTER which behaves identically with regard to input and output, but is capable of greatly increased performance on parallel machines.

References [1] Butler, R. M., and N. T. Karonis, "Exploitation of Parallelism in Prototypical Deduction Problems", Proceedings of the 9th International Conference on Automated Deduction, E. L. Lusk and R. A. Overbeek, (Eds.) Springer-Verlag Lecture Notes in Computer Science #310 (1987), pp. 333--343. [2] Dunn, J. M., The Algebra of Intensional Logics, doctoral dissertation (unpublished), University of Pittsburg, 1966. [3] Dunn, J. M., "Relevance Logic and Entailment", Gabbay, D, & Gfinthner, F (eds), Handbook of Philosophical Logic, Vol. 3, Dordrecht, Reidel, 1986. [4] Jindat, A., R. Overbeek, and W. Kabat, "Exploitation of Parallel Processing for Implementing High-Performance Deduction Systems", Journal of Automated Reasoning, to appear. [5] Boyle, J., Butler, R., Disz, T., Glickfeld, B., Lusk, E., Overbeek, R., Patterson, J., and Stevens, R., Portable Programs for Parallel Processors, New York, Holt, Rinehart & Winston, 1987. [6] Lusk, E. and McFadden, R., "Using Automated Reasoning Tools: A Study of the Semigroup F2B2", Semigroup Forum 36, no. 1 (1987), pp. 75-88. [7] McCune, W. W., "OTTER 1.0 Users' Guide", Report ANL-88-44, Argonne National Laboratory, Argonne, Illinois. [8] Meyer, R. K., "Sentential Constants in R and R'", Studia Logica 45 (1986), pp. 301327. [9] Slaney, J. K., "3088 Varieties: A Solution to the Ackermann Constant Problem", Journal of Symbolic Logic 50 (1984), pp. 487-501. [10] Slaney, J. K., "On the Structure of DeMorgan Monoids, With Corollaries on Relevant Logic and Theories", Notre Dame Journal of Formal Logic 30 (1989), pp. 117-129. [11] Slaney, J. K., "The Ackermann Constant Theorem: A Computer-Assisted Investigation", Journal of Automated Reasoning, forthcoming.

39 [12] Wos, L., D. Carson, and G. Robinson, "Efficiency and completeness of the set-ofsupport strategy in theorem proving," Journal of the ACM 14, (1965), pp. 536-541.

PARTHEO: A H i g h - P e r f o r m a n c e Parallel T h e o r e m Prover* J. Schumann

and R. Letz

Forschungsgruppe Kfinstliche Intelligenz Institut fiir Informatik, Technische Universit£t Mfinchen Germany

Abstract PARTHEO, a sound and complete or-parallel theorem prover for first-order logic is presented. The proof calculus is model elimination. PARTttEO consists of a uniform network of sequential theorem provers communicating via message passing. Each sequential prover is implemented as an extension of Warren's abstract machine. PARTHEO is written in parallel C and is running on a network of 16 transputers. The paper comprises a description of the system architecture, the theoretical background, details of the implementation, and results of performance measurements. Keywords. Theorem proving, first-order logic, connection method, model elimination, Warren Abstract Machine, or-parallelism, message passing, transputers.

1

Introduction

AI systems are in constant need of powerful and efficient inference mechanisms. Within many areas of application logic-based languages seem to be an appropriate choice. A popular and successful realization is Prolog, which is moderately efficient, but lacks in expressiveness, mainly because of its restriction to Horn clauses. Certainly, full first-order logic would be more powerful and comfortable, but at the price of a more difficult implementation. One promising approach is to use the model elimination calculus, which is complete for first-order logic. As this calculus is sequence-based and needs no factoring it seems even more machine-oriented than resolution, which is a set-based calculus. Model elimination can efficiently be implemented, e.g. using Prolog-like technology. This *This workwas supported by the European Communityand NixdorfComputer AG within the ESPRIT project 415F.

4] has been convincingly demonstrated with Stickel's PTTP [23] and, recently, with our SEquential THEOrem prover SETtIEO [16]. A further promising potential for gaining high efficiency is the use of parallelism. In the field of theorem proving, particularly, the huge search space poses a severe problem. Therefore it seems a good decision to distribute and explore the search space in parallel, a method known as or-parallelism. This type of parallelism involves that on each node there must reside an efficient inference machine. Since with SETHEO we already had developed a very efficient inference machine, it was natural to employ it as the kernel in the design of the PARallel THEOrem prover PARTHEO, with the additional advantage that almost all features of the sequential SETHEO carry over into our parallel system. Thus PARTHEO can be used both as a theorem prover and as an interpreter of LOP, a logic programming language under development. It offers, e.g. the use of (non-logical) global variables and destructive assigment, with a clear and simple declarative semantics [15]. From the hardware point of view we aim at a large number of processors. In contrast to most other approaches (see Section 7) we favour networks of processors communicating via message passing without common memory. Such systems also allow for a good scalability. Practical considerations led us to the decision to implement PARTHEO on a network of transputers. The paper is organized as follows. The next section sets out the modular architecture of the entire system. The third section describes the underlying proof calculus. The exploitation of parallelism is described in the fourth section. In the fifth section we present details of the implementation of the network and the parallel abstract machine APM. Some results of performance measurements are given in the sixth section. Related work is briefly summarized in the seventh section. Wc conclude with assessing the main features and perspectives of our approach.

2

System Architecture

Our system is strongly modularized. It consists of five independent modules: a transformation part, the preprocessor, the compiler, the main proof procedure, and the user interface. PARTHEO differs from the sequential SETHEO only in the main proof procedure: in PARTHEO it is implemented and executed on a parallel machine, a network of transputers. The modules of the system and the control flow are depicted in Figure 1. Since the core of the system can handle clausal form formulae only, a transformation module is added which converts formulae in ordinary logical notation (FOL), i.e. formulae containing quantifiers, logical operators, etc. into Skolemized clause normal form (CNF). We offer two transformations: one is the standard method, which is of exponential complexity in the worst case; the second one is the method described in [12], which is polynomial. The other modules work with formulae in clause normal form only. The preprocessing part aims at reducing the size of the input formula before initiating the main proof procedure. It combines features that just eliminate redundant parts of the

42

USER

INTERFACE I

:............ ~. . . . . . . . . . . . .

4--I

INTERRUPT

....,._.::

~

TRANSLATOR ~om FOL to CNF 1

SETHEO ABSTRACT MACHINE

L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1

l

J

Figure 1: System architecture input formula with others that anticipate inferences of the proof process itself. Currently our preprocessing module consists of five independent submodules: tautology reduction, restricted unit resolution, subsumption reduction, purity reduction, and isolated connection reduction. For a detailed description consult [16]. The inference machine, the sequential version as well as the parallel one, is realized as an abstract machine. Hence the formula must be compiled into abstract machine code. In the compilation phase the clauses of the input formula are translated into contrapositives. Syntactical pruning constraints are optionally inserted. For optimization purposes, the clauses and literals are reordered and a connection graph, expressing all unifiable connections between tile literals of the formula, is generated. The latter helps to avoid a lot of useless unification attempts. Afterwards the contrapositives are translated into extended Warren code, which is loaded onto the network. During the main proof procedure these abstract machine instructions are interpreted in parallel by a network of Abstract Partheo Machines.

A user interface gives information about the result of the proof proces. For instance, the proof tree can be displayed graphically. This interface can also be used during the proof process for visualizing the current state of the parallel system. A detailed description of the entire system and its modules can be found in [16] and [5].

3

The

Proof

Calculus

The proof calculus underlying the inference system is model elimination. Model elimination has first been introduced in the light of resolution (see, e.g. [17]), which is a formula-producing synthetic calculus. But by its very nature model elimination belongs to the family of analytic calculi based on semantic trees [7], like the tableau calculus [22]. More precisely, model elimination can be seen as a special variant of the connection method [9]. The connection method offers a general framework for the proof-theoretic tre-

43 a t m e n t of logical formulae. It is based on the idea of reducing the task of proving a formula to the task of checking all paths through the formula for tautology or contradiction) Model elimination can be seen as a very simple realization of this idea in a hnear format, which is easily described with labeled trees or tableaux. 2 D e f i n i t i o n 3.1 A connection tree or tableau T for a formula F is a pair ( t , # ), where t is a finite tree and # is a function from the non-root nodes of t onto literals such t h a t for any complete set of nodes N with the same immediate predecessor (parent) the range # N (called tableau clause) is an instance of a clause in F. D e f i n i t i o n 3.2 A tableau is called closed if every complete branch (path) contains nodes K and L such t h a t # ( K ) contradicts # ( L ) , i.e. K and L are complementary nodes. A formula is unsatisfiable if and only if there is a dosed tableau for the formula (for a proof see, e.g. [9]). Model elimination imposes further restrictions on connection trees which do not affect completeness. D e f i n i t i o n 3.3 A model elimination tableau is a tableau satisfying the condition t h a t every node, which is not the root or a leaf, has at least one complementary node among its immediate successors (children). In practice, a dosed tableau is constructed stepwise starting from the root by attaching new nodes to intermediate tableaux and by explicitly labelling branches as closed at their leaf nodes. In these steps substitutions are imposed onto the variables of the affected literals as induced by unifiers 3. It is useful to differentiate the single construction steps of such a tableau starting from the children of the root (the start clause) into extension steps and reduction steps. For convenience we often identify a node with its value, the literal.

Extension step: suppose there is a unifier a for a leaf L in a tableau and a literal -~ L in a (renamed) clause c of the underlying formula, then perform the unification, take the literals in c cr as children of L a, and label the branch at -1 L cr as closed. 4 Reduction step: suppose there is a unifier a for a leaf L and some ancestor -~ L in a tableau, then perform the unification and label the branch at L cr as closed, s A node (tableau) is considered to be open as long as it (all its nodes) is (are) not explicitly closed. Each model elimination tableau m a y be constructed by performing a sequence of extension and reduction steps (consult [17]). 1To follow common practice we are dealing with the refutation of formulae, which is in contrast to the affirmative approach in [9]. 2We prefer the framework of the connection method, because in the original setting (as, e.g. in [17]) model elimination is restricted to a fixed depth-first right-most execution model. 3For completeness it is sufficient to use most general,unifiers. 4This is the counterpart of binary input resolution within model elimination. SThis terminology must be distinguished from the one in [9] where the combination of both steps is called extension step.

44 Let us consider for illustration of these concepts a simple example of first-order logic. It asserts that if for any pair of objects in a domain either a binary relation P or the inverse relation holds, then for every individual in the domain there exists an object such that both relations hold:

VxVy(P(x, y) V P(y, x)) ~ Vv3z(P(v, z) A P(z, v)). Aiming at refuting the negation of the proposition, we shift to negated Skolemised conjunctive clause normal form, and get the following set of clauses.

{{P(x,y),P(y,x)}, {-~P(a,z),-~P(z,a)}}

E x a m p l e 3.1

A closed tableau for this formula is shown in Figure 2 below. The respective substitutions for the variables in the copies of the original clauses are given on the right, and closed branches are labeled with an asterisk for extension (*E) and reduction (*R) respectively.

Substitutions P(x,y)

x=y=a

P(y,x)

/\

/\

-~ P(a, z)

-t P(z, a)

-~ P(a, z')

-~ P(z', a)

*E

*R

*E

*R

Z ..~- ZP -.~. a

Figure 2: A closed model elimination tableau An crucial property of model elimination is its independence from the node selection function. Definition 3.4 A tableau node selection function S assigns to each open tableau one of its open leaves, at which the next inference step must be performed. Let T be a closed model elimination tableau constructed by the sequence I of extension and reduction steps using a node selection function S . Then it holds for each node selection function S' which yields a permutation of I and a tableau T ' , that T and T ~ are (renamable) variants of each other. In other words, it does not matter in which order extension or reduction steps are applied to open nodes of intermediate tableaux. (for a proof see, e.g. [6]). The model elimination calculus may be refined and extended in various ways. We are investigating on regular proofs, subsumption, factorization, lemmata, and proof schemata. For details see [16].

45

4

E x p l o i t a t i o n of Parallelism

PARTHEO has been designed with the emphasis on theorem proving. In this field the main problem is not the length of a proof s, but the large search space induced by the branching factor of the underlying calculus. To cope with this problem currently two main directions may be distinguished. One is to make the search algorithm more intelligent, i.e. to apply heuristics and pruning strategies in order to reduce the search space, the other is to do things in parallel. Although work is done in both directions, we here want to focus on parallelism. If a parallel algorithm has to be designed it is useful to keep in mind the parallel machine on which this algorithm is to be implemented and executed. We have decided to aim at hardware relying on message passing without common memory, in contrast to, e.g. Parthenon [8]. The target hardware is a network of transputers. This choice promises easily scalable implementations, in that the topology and the size of the hardware may be varied easily.

4.1

Or-parallelism

One obvious way to distribute the search space over different processors is to apply or-

parallelism. The basic idea of this notion is explained as follows. The search space induced by the model elimination calculus together with a given node selection function can be described as a tree of tableaux. D e f i n i t i o n 4.1 Let F be a formula consisting of n clauses, and let S be a tableau node selection function. The model elimination or-search tree for F and S is a tree, where all nodes are labeled with model elimination tableaux such that 1. the root is labeled with the empty tableau, 2. there are n children of the root, which are labeled with the n different tableaux constructable by just taking any clause in F as start clause, 3. if a leaf node N has an open tableau T as label, then the children of N are precisely the nodes with those tableaux for F as labels that may be constructed by applying exactly one inference step to the selected open leaf node S(T). An example of such a structure is displayed in Figure 3 below. The triangles encode open (o) and explicitly closed (*) tableaux respectively. For each selected node S(T) there exist as many succeeding nodes (and tableaux) as there are successful unifications with literals from F (extension) or with literals from the branch on which the node S(T) lies (reduction). As during their generation the tableaux get more and more instantiated we do not know in advance which of all possible unification attempts are successful. To take this into account we have added another sort of nodes (FAIL) to the or-tree, which represent the cases of unification failurer. 6Except for very artificial examples. Some of these may be tackled by extensions of the calculus mentioned above (see [16]). 7Note that in the compilation phase we apply pre-unification to construct a connection graph in order to reduce the number of these failure nodes.

46

/

~FAIL

A /\

/ ! I L ~

SUCCESS

/

\

Figure 3: Structure of a model elimination or-search tree including failure nodes Apparently, for a given formula each node selection function uniquely determines an or-search tree and its bran&ing behaviour. Therefore some selection functions may keep the branching rate smaller than others. In the current implementation we use a very simple node selection function, viz., depth-first left-most selection, as in Prolog s. During the proof process the or-sear& tree of a formula must be explored from the root to the leaves. Or-parallelism distributes the branches of the or-sear& tree between the processors.

4.2

The

basic

algorithm

We assume that each processor has as program precisely the same inference machine and the compiled formula. The variety comes in by giving different input to ca& processor by communicating with other processors. This input is given essentially in form of proof tasks, where each task corresponds to one node in the or-sear& tree including failure nodes of the formula. Ea& processor consists of three modules, the proof unit, the communication unit and the local task store. During the execution process each processor may behave differently according to the three possible situations occurring during the treatment of tasks. First of all, a task may be solvable, viz., if the encoded tableau is closed. In this case a proof has been found, whim is then reported to the user. Secondly, a task may fail, which is in case that for the encoded tableau no expansion is possible under the given constraints. This holds for instance if no unifiable partner may be found for the selected node, or if some completeness mode prohibits an expansion, as explained below. Finally, a task may ramify into finitely many subtasks, if there exist different inference possibilities for the selected open leaf of the encoded tableau. This last case makes up the potential for parallelism. The respective SNote that during compilation we also apply some static selection mechanism according to such branching criteria by reordering the literals inside each clause.

47

proof task gives rise to a number of new tasks, which encode just the children in the orsearch tree including failure nodes. They are put into the processor's local task memory, thus making them available to other processors 9.

4.3

The

task

stealing

model

Parallelism is achieved by propagating tasks over the network. We are striving for a good load balancing without too much communication overhead. To this end we subscribe to the philosophy that a processor should only send tasks to his neighbours on request. More precisely, PARTHEO employs a task-stealing model [8]. If a processor executes a task which fails, it tries to get a new one from its local task store. In case it is empty, the processor asks its direct neighbours for work. Since all processors must check from time to time for incoming task requests, the respective idle processor will get tasks from one of its neighbours which has tasks - - say half of them. Thus tasks are only transmitted over the network, if no work is available locally. The proof process is initialized by setting all processors into the state of task request, and by simply giving the root task, which encodes the empty tableau, to an arbitrarily chosen processor.

4.4

The

representation

of tasks

Since we are aiming at systems with distributed memory and message passing for communication, a crucial issue is the size of the transferred data. The main data to be communicated in our model are the proof tasks. As mentioned above, our inference machine is a variant of the Warren abstract machine. This means that the data corresponding to a logical proof task are not compactly represented but encoded in the stack, the heap, the trail, and the control registers of the abstract machine (see Section 5). For transferring a task this involves that a lot of data had to be copied to another processor, which is not feasible on a message passing system. We have solved the problem of generating the same processor state on another processor in analogy to the method how genetic information is stored in a living cell: the DNA contains all the information for reproducing the cell. More precisely, we are encoding a task as the sequence of choices that have to be made at each branching point in the search tree. This sequence can be given as a list of integers, one for each inference step. For a fixed node selection rule, this sequence uniquely determines the desired processor state. This representation is very compact and puts no transmission problems. The decoding of a task consists in deterministically recomputing the desired state, and hence the respective tableau. A lot of double work, one could say. But recalling that most proofs in theorem proving are rather short, this provision does keep the loss in efficiency smalP °. Actually, we employ an optimised version, viz., the partial restart, which involves that in 9Actually, the processor keeps one of the new tasks to execute it immediately. 1°Besides, this stays in concordance with our decision to use or-parallelism only.

48

many cases it is not necessary to reproof the whole tableau from scratch. This is the case if the old (failed) task and the new task from the task store have a non-trivial common initial segment. Then the recomputation starts at the first inference for which both tasks disagree. Obviously this method reduces the amount of time needed to switch to a new task in the search tree. Additionally, if the tasks are organised in a LIFO manner, for the sequential execution the partial restart works nearly as efficient as an ordinary fail. All in all, the parallel algorithm may be summarized in the following C-like program. on all nodes do in parallel do { proof: while true do { get_task T from local_task_store; do partial_restart; if unification succeeds then if T is closed then /* a proof has been found */ report_success_to_host; else { generate_new_tasks TI,...,Tn from T; put TI ..... Tn into local_task_store} else ; /* unification fails */

> request: if isempty(local_task_store) then request_tasks_from_neighbour; s end: if request_for_tasks_received then { n = cardinality of local_task_store; i f n <= I then send_back("no_tasks");

else send_back_tasks(n/2);

}}

Note that a detailed and formal specification of the informal description given in this section is available [13], formulated in the parallel and functional specification language FP2. During our measurements it turned out that the speed-up depends strongly on the amount of parallelism we induce, by making more or less tasks in the local task store accessible to other nodes. We have observed that in the case of a well-distributed branching over the whole search tree, we get the best behaviour if the generation of or-parallel tasks is restricted to the first levels of the search tree. Therefore we have run some examples with different restrictions concerning the maximal depth of the tasks to be put in the local task store. Interestingly, the optimal depths may be derived more or less precisely from the structures of the formulae, viz. from their ramification factors and depths, which enables an automatization. For details consult [5].

49

4.5

T h e search strategy

In general the or-search-tree of a formula is infinite. Hence a complete search strategy must be employed. The most natural approach for achieving completeness in a finitely branching search tree is to search breadth-first, but in terms of efficiency this contradicts the design decision of our parallel algorithm as well as the structure of the Warren machine. Therefore PARTHEO realizes depth-first iterative-deepening search, as in Stickel's PTTP [23]. The idea is to consider only a finite initial segment of the search tree. In case this segment is explored and does not contain a solution we take a greater segment, and so forth 11. The or-search tree is cut by imposing constraints onto the tableaux in the nodes of the tree. These constraints are monotonic, i.e. if a tableau T violates them then do all tableaux in the or-search tree dominated by T. We offer three different completeness modes, by bounding alternatively the number of inferences in a tableau, the depth of a tableau, or the number of admissible copies of every rule in a tableau, which are all monotonic conditions. If a task is executed and its tableau violates (one of) the given completeness condition(s), then this task just fails. In case a proof is not found within given bounds, these bounds are increased, and the proof process is resumed. Currently, this process is not fully automatic in PARTHEO for reasons described immediately. Performing the iterative-deepening step in a sequential system is unproblematic. Whenever a finite segment of the search space has been entirely explored the internal proof algorithm comes up with a total "fail". Then the bound(s) are increased and a new internal proof process is started. In the parallel case it gets more complicated. The problem is to determine exactly when the current finite segment of the search tree has been completely explored. In such a case, according to the parallel algorithm mentioned above, all processors must be in the state of requesting their neighbours for work. This can only be detected by stopping the whole system and by investigating the network node by node, which is very inefficient. We propose another solution to this problem. To avoid the inefficiency arising from stopping the network, we allow tasks from different iterative-deepening levels to be in the network at the same time. To assure completeness, tasks from different levels are labeled with different priority values. And, whenever a task is to be taken from the task store, higher priorities must be preferred. This involves that we are not obliged to wait until one finite segment is completely explored. We represent locally in (some of) the processors the approximate task load of the system, which is updated from time to time. If this value falls short of a certain threshold for these processors the next iterative-deepening level gets initialized. Currently this mechanism is not fully implemented, the iterative-deepening is controlled by hand. 11Actually, this can be viewed as a generalized version of breadth-first search.

50

5

Implementation

PARTHEO is designed to run on a network of transputers; both, the number of processors and the topology may be arbitrary. On each node of the network, an identical copy of the Abstract Partheo Machine (APM) is running. The APM consists of a communication unit to perform the communication with other processors, a local task store, and a sequential inference machine to execute the tasks. PARTHEO is implemented in 3L-parallel C [1]. As the basic communication mechanism, synchronous message passing is used. Inside one transputer the access to global data structures is controlled via semaphores.

5.1

The

network

Our hardware system consists of 16 + 1 T800's; the interconnection of processors may be changed by software so that experiments with several different topologies can be carried through. One of the transputers is the host processor, which is connected to the host system, in our case a sun 386i. A typical configuration scheme (similar to a torus) is shown in Figure 4.

E

Figure 4: Typical hardware configuration scheme

5.2

The

Abstract

Partheo

Machine

- APM

In contrast to all other processors running an APM, the host processor contains no inference machine. Its only task is to interpret the command line, to open and read files, and to send commands to the other processors. Returning messages are interpreted and a success is displayed. During the search for a proof, the host processor also sends statistics requests to the other processors in regular intervals. The returned data are used to make measurements. In the following, however, we only look at the APM in detail.

51

An APM may be subdivided into three major parts, each of them consisting of one ore more threads, running concurrently on the processor: S A M The kernel of an APM is the sequential inference machine of SETHEO, the SETIIEO Abstract Machine SAM, which will be described in detail below. Its main action is to execute tasks and to generate new ones. To do this the original sequential machine had to be augmented with some new instructions to be able to communicate with the other parts of the APM. T a s k S t o r e The task store can be accessed by two processes: If the SAM encounters an or-node, newly created tasks are encoded and put into the task store. If the current task fails, the SAM takes a new task from the task store. If another processor requests tasks or if tasks are received, the communication unit gains control over the task store. It also has to check in regular intervals how many tasks are available in the task store. If it is empty, the task requesting mechanism is activated. C o m m u n i c a t i o n U n i t The communication unit of one processor contains several processes, which communicate via shared variables controlled by semaphores. T h e communication unit forwards messages to the host, receives and executes commands and handles the task stealing mechanism. Within the system three types of messages are exchanged between the processors: • Commands are sent from the host processor to each processor or to a designated

processor. T h e y are used, e.g. to load the SAM-code into the code memory of the processors, to set parameters, and to start and stop the SAMs. A message from the host to a designated processor contains additional routing data. T h e communication unit reads this information and routes the message to one of its neighbouring processors. This allows to keep a global routing table on the host processor only. • Return messages are sent from a single processor to the host processor. Such a return message can be a success or failure result, statistical data, or error messages. They must be forwarded by the communication unit. • Task request and transmission. Processors with an empty task store are requesting tasks from their direct neighbours in regular intervals. A timer process sends a task request to all neighbours of the processor in sequence. If a processor receives such a message it sends back, e.g. half of its own tasks, provided it has enough. Otherwise it informs the requesting processor, which tries to get tasks from another direct neighbour.

5.2.1

The SETHEO

Abstract Machine (SAM)

The sequential inference machine SAM, which is both used in SETHEO [16] and as the kernel of the APM, is implemented as an abstract, register-oriented machine. The machine and its instructions are based on Warren's abstract machine (WAM) [25] and its RISC version [24]. The concepts introduced there had to be extended and enhanced for ending up in a complete and sound proof procedure based on the model elimination calculus, and

52 for facilitating the use of advanced control structures and heuristics. The layout of the abstract machine is shown in Figure 5.

CODE OON

I

ROL

1

...... HE

P

.........

I PROOF-TREE REGI

t COPY-BOUND LEMMATA

Figure 5: SETHEO Abstract Machine Similar to the WAM, the memory of the SAM is tagged (4 bit) and consists of several parts. Besides the code area, the heap, stack and trail, which can also be found in the WAM, some other data areas are used in the SAM. The pro@tree stores the current state of the generated tableau, which can be displayed graphically to illustrate the structure of the proof process. In the copy-bound it is stored how many copies of each clause are still admissible. Generated lemmata are hold in the Iemmata space. A detailed description of all the instructions and registers is available as a manual [21]. During the proof process full unification is rarely needed. Hence it is more efficient to have different instructions for the unification of one term according to its data type (variable, term, constant, etc. ). For full unification the (exponential) Robinson algorithm is used, because most terms in the tested examples are quite small. For more complex terms we offer the Corbin algorithm [11], which has quadratic complexity. To reduce the number of occur-checks a simple heuristic is employed: an occur-check is omitted in extension steps into clauses for each first occurrence of a variable inside the head (compare

also [20]). As the SAM had to be changed only very little to be integrated into the parallel PARTHEO system, all features available in the sequential ma&ine are also available in PARTHEO, e.g. global variables.

6

Performance

Measurements

To get representive speed-up results of the system., we made measurements with problems from the field of theorem proving and logic programming. As theorem proving examples we took problems of the Wilson and Minker study [27], which are also used in [23] as

53

a set of benchmarks 12. The non-obviousness example is a problem appearing in [18]. Lukasll is a formulation of a single axiom system for the propositional calculus [19]. The other problems are taken from the field of logic programming, because they could be easily modified to serve as good speed-up benchmarks. The Queens examples are just the standard Prolog programs for solving the queens problem. The Maximum program is a quadratic program for computing the maximum of a list of integers. PropSat consists of a program for finding models of a propositional formula plus one example formula. Finally, FairyTale is a plan generation problem, which consists in finding the happy end of a fairy tale. SETHEO [secI

P A R T H E O 13 [sec]

Wosl Wos4 Wos9 Wosl0 Wosl5 Wosl6 Wos25 Wos29 LS36 LS108 LS121 Non-obv. hflcasll

4.6 404.5 64,0 262.6 3870.0 903.9 575.3 254.5 1666.0 736.6 44.2 4.5 8.4

1.1 1.3 2.2 135.6 1826.5 1.9 114.2 48.1 352.0 75.1 10.3 1.8

4.11 317.30 29.70 1.94 2.12 476.50 5.03 5.29 4.73 9.80 4.32

.7

12,78

.26 19,83 1.86 .12 .13 29.78 .31 .33 ,29 .61 ,27 .15 .80

Queens8 Queens9 Queensl0 Maximum PropSat FMryTale

16.9 83.6 396.0 17.1 48.8 24.0

1.8 9.2 38.0 4.6 7.3 1.8

9.20 9.06 10.40 3.76 6.67 13.70

.58 .57 .65 .24 .42 .86

Problem

speed-up abs. I tel.

2.44

Figure 6: Run-time comparison of SETHEO (T 800) and PARTHEO (16 x T 800) As a matter of fact, speed-ups in or-parallelism may vary strongly depending on where the solution is located in the search tree. For getting more reliable results, the following three generate-and-test type problems are of great significance. Queens8, Queensg, and QueenslO have been modified in a way that only one chess-board position, which is exactly in the middle of the search tree, is exclusively accepted as the right solution. If then the search tree is distributed between the nodes, statistically, the correct speed-up (for this problem) can be computed. The same holds for PropSat, which contains a propositional formula with just one model. Due to time limitations we were not interested in finding fastest proofs with SETItEO and PARTItEO. So we used depth-bounded search as the only completeness mode. Since iterative-deepening is not yet fully supported all examples were tried with a fixed depthl~These examples have also been used to make performancemeasurementsfor SETHEO.For details see [16]. 13Average run-time of 5 runs.

54 bound sufficient to find a proof. In the table of results in Figure6 the last row displays the relative speed-up, which is defined as the ratio of the speed-up to the number of nodes. We have tested the PARTHEO theorem proving system on a network of 16 transputers T 800 arranged in a hypercube topology, as displayed in Figure 4.

7

Related Work

In the following we want to mention very shortly some parallel systems 14, theorem provers or parallel Prolog systems, which have some similarities with PARTtIEO. Most of these systems use or-parallelism or variants of the Warren Abstract Machine. In contrast to PARTHEO, however, all systems except the DelPhi system are using hardware with a common memory. One of the basic models for or-parallel execution of Prolog and also model elimination based systems is the SRI-model developed by D.H.D. Warren [26]. It uses shared memory and so-called cactus stacks to maintain multiple variable bindings which occur in orparallelism. An implementation on 8 Balanc 32020's yields 23 Klips. A further refinement, the Andorra model [26], comprises also stream-dependent and-parallelism. Parthenon [8, 3] is an or-parallel theorem prover for first-order logic based on model elimination. It uses a modification of the scheme proposed in the SRI-model. Parthenon is running on an Encore Multimax with 16 processors and shared memory. Like PARTHEO it uses a task-stealing model to distribute unexplored subtrees over the processors. Its peak performance is about 30 Klips with 15 processors (for detailed figures see [8, 3]). METEOR [2] is a model elimination theorem prover for full first-order logic which employs or-parallelism. It uses Warren's SRI model for or-parallel logic programming. It runs on a 32 node BBN Butterfly GP1000 under the Mach operating system. Another parallel theorem prover was developed by V. Kumar et.al. [14]. It is based on the WAM and the SRI-model on a parallel machine with shared memory and employs and-parallelism within a producer-consumer approach. The DelPhi inference machine [10] uses multiple communicating processors with a shared memory for executing logic programs (Prolog and TABLOG). Different nodes in the and-or-tree (encoded as oracles similar to the tasks in our model) are distributed over the processors. The oracles are generated by one control processor in the system. A prototype has been implemented on a network of VAX and #VAX stations. PEPSys is a parallel Prolog-system developed at the ECRC and comprises or-parallelism as well as independent and-parallelism [4]. The problem of maintaining multiple variable bindings (in or-parallelism) is solved using hash-tables. The architecture used is similar to the SRLmodel. PEPSys is implemented on a shared memory Siemens MX500 (equiv. 14Of course, this list is by far not complete.

55 to Sequent Balance 50) and simulations with a special multi-cluster architecture with up to 100 processing elements have been carried through.

8

Conclusions

PARTHEO is a system combining a number of promising features in the fields of theorem proving and logic programming. It integrates the model elimination calculus, abstract machine technology, and or-parallelism. PARTHEO offers the power and expressiveness of first-order logic while retaining the performance of Prolog. First, because of the high efficiency of SETHEO, which runs on each node of the network. And secondly, because the or-parallel distribution of the search space may decrease the proving time tremendously. Due to time limitations there was no possibility to change a number of interesting parameters, among which are the number of processors and the network topology. Notwithstanding that, we have identified a class of significant and reliable problems, for which a good speed-up has been achieved. It is at about 0.55 per processor for the representative examples. This seems to us a very satisfactory result for the current unoptimized state of the system. The fact that the used processor type, the transputer T 800, is already very fast, makes this relative speed-up also a success in terms of absolute efficiency. For a certain class of examples (see [16]) we achieved a performance of 17 Klips on one transputer node. Moreover, the design decision to rely on processor-processor message passing and local memory, makes the system easily scalable, so that it may be extended without difficulties to networks with a large number of processors.

References [1] Parallel C - User Guide. 3L Ltd., Livingston, Scotland, 1988. [2] Owen Astrachan. METEOR: Model elimination theorem prover for efficient OR-parallelism. In W.W. Bledsoe, M. Stickel, P. Lincoln, R. Overbeek, and D. Plaisted, editors, 1989 A A A I Spring Symposium on Representation and Compilation in High Performance Theorem Proving: Titles and Abstracts, Stanford, CA, 3 1989.

[3] P.E. Allen, S. Bose, E.M. Clarke, and S. Michaylov. PARTHENON: A Parallel Theorem Prover for Non-Horn Clauses. In CADE 9, pages 764-765, Argonne, Illinois, USA, Springer, 1988. [4] U. Baron, J. C. de Kergommeaux, M. Hailperin, M. Ratcliffe, M. Robert, J.-C1. Syre, and H. Westphal. The parallel ECRC Prolog System PEPSys: An Overview and Evaluation Results. In FGCS, ECRC Munich, 1988. [5] S. Bayerl, W. Ertel, M. v. d. Koelen, F. Kurfess, R. Letz, J. Schumann, Ch. Suttner, and N. Trapp. PARTHEO/6: PARallel Automated THEorem Prover based on the Connection Method for Full First Order Logic - Implementation and Performance. ESPRIT 415F Deliverable D15, 1989. [6] S. Bayerl, W. Ertel, F. Kurfess, R. Letz, and J. Schumann. D16 / Full First Order Logic PARallel Inference Machine - I~nguage and Design. ESPRIT 415, Deliverables, Brussels, 1989. [7] E.W. Beth. The Foundations of Mathematics. North-Holland, 1959.

56 [8] S. Bose, E.M. Clarke, D.E. Long, and S. Michaylov. Parthenon: A Parallel Theorem Prover for Non-Horn Clauses. In tICS, 1989. [9] W. Bibel. Automated Theorem Proving. Vieweg Verlag, Brannschweig, second edition, 1987. [10] W.F. Clocksin. Principle~ of the delPhi Parallel Inference Machine. Comp. Journal, 30(5):386-392, 5 1987. [11] J. Corbin and M. Bidoit. A Rehabilitation of Robinson's Unification Algorithm. In Information Processing, pages 909-914. North-Holland, 1983. [12] E. Eder. An Implementation of a Theorem Prover based on the Connection Method. In W. Bibel and B. Petkoff, editors, AIMSA: Artificial Intelligence Methodology Systems Applications, Varna, Bulgaria, 1985. North-Holland. [13] Ph. Jorrand and Ph. Schnoebelen. Parallel Implementation of Connection Method on an Abstract FP2 Machine. ESPRIT 415F Deliverable D17, 1989. [14] V. Kumar~ Y. Lin, and A. Gupta. Parallel Execution of Logic Programs. In W.W. Bledsoe, M. Stickel, P. Lincoln, R. Overbeek, and D. Plaisted, editors, 1989 AAAI Spring Symposium on Representation and Compilation in High Performance Theorem Proving: Titles and Abstracts, Stanford, CA, 3 1989. [15] R. Letz and J. Schumann. Global Variables in Logic Programming. Technical report, ATP-Report, Technische Universit~it Miinchen, 1988. [16] R. Letz, S. Bayerl, J. Schumann, and W. Bibel. SETHEO - A High-Performance Theorem Prover. (to appear in Journal of Automated Reasoning), 1990. [17] D.W. Loveland. Automated Theorem Proving: a Logical Basis. North-Holland, 1978. [18] J. Pelletier and P. Rudnicki. Non-obviousness. AAR Newsletter 6, pages 4-5, 1986. [19] Frank Pfenning. Single Axioms in the Implicational Propositional Calculus. In CADE 9, pages 710-713, Argonne, Illinois, USA, Springer, 1988. [20] D. A. Plaisted. The Occur-check Problem in Prolog. New Generation Computing, 2:309-322, 1984. [21] J. Schumann, N. Trapp, and M. van der Koelen. SETHEO: User's Manual. Technical report, ATPReport, Technische Universitgt Miinchen, 1989. [22] R.M. Smullyan. First Order Logic. Springer, 1968. [23] M.A. Stickel. A Prolog Technology Theorem Prover: Implementation by an Extended Prolog Compiler. Journal of Automated Reasoning, 4:353-380, 1988. [24] J. Vlahavas and C. Halatsis. A New Abstract Prolog Instruction Set. In 7th International Workshop of Expert Systems and Applicalions, pages 1025-1050, Avignon, 1987. [25] D.H.D Warren. An Abstract PROLOG Instruction Set. Technical report, SRI, Menlo Park, CA, USA, 1983. [26] D.H.D. Warren. Parallel Execution Models and Architectures for Prolog. Presented at Working Group Architecture, ESPRIT 415, 1 1988. [27] G.A. Wilson and J. Minker. Resolution, Refinements, and Search Strategies: a Comparative Study. IEEE Transactions on Computers, C-25:782-801, 8 1976.

Substitution-based Compilation of Extended Rules in D e d u c t i v e D a t a b a s e s 1

Sang Ho Lee ~ and Lawrence J. Henschen D e p a r t m e n t of Electrical Engineering and Computer Science Technological Institute Northwestern University Evanston, IL 60208 Abstract

Query compilation in a deductive database refers to the process of continually replacing defined literals in rule bodies by their definitions until rules with references only to stored relations are obtained. The compiled forms generate the same tuples for the head literal in a database as do the original sets of rules. Previously, the rules were assumed to be function free. However, the use of universal quantifiers (corresponding to the division operator in a database) adds a new degree of flexibility in defining views. We propose a new inference rule, the substitution rule, to replace resolution in the compilation process. The substitution rule handles the embedded universal quantifiers correctly so that the compiled forms again derive all proper instances of the head literals.

1

Introduction

One of the fundamental features of deductive database systems (or expert database sys~ tams) is the deductive capabilities which are implemented by the IDB (a set of rules) and an inference rule. As for IDB, most researches in the deductive d a t a b a s e community assume all variables occurring in an IDB rule in Prenex Normal Form to be universally quantified, thus excluding an occurrence of an existentially quantified variable in an IDB rule. Some uses of existential quantifiers have been generally proposed to represent the null value (exists but unknown). However, existential quantifiers can also be used in ways t h a t correspond to the division operator in database. Lloyd and Topor introduce an extended p r o g r a m which can have an arbitrary first-order formula as its body under a Prolog environment. Lee and Henschen [4] introduce two types of IDB, namely an acceptable rule and an extended rule, which can have existential quantifiers in the IDB in a restricted way such t h a t no null value is introduced. 1This work was supported in part by the National Science Foundation under Grant DCR-860-8311 2Current Address: Database Section, Computer Technology Division, Electronics & Telecommunications Research Institute (ETRI), Daejon, Republic of Korea.

58

When an extended program is present in a deductive database, Lloyd and Topor's approach is to transform an extended program into a general program which is to be executed under an ordinary Prolog system which has a sound implementation of Negation as Failure [2]. The major part of the transformation is based on the equivalence of (3x)c~ = -,(Vx)-,a. After transformation, there will be a negated predicate in the body, and consequently an evaluation of that requires Negation as Failure. For example, an extended clause (W) ( P ( x ) , (V~)A(x, y)) is transformed into

P(x)~ D~(x),-~NEW(x) and N E W ( x ) ( Dy(y),-~A(x,y). tt should be noted that their method relies heavily on the backtracking control strategy of Prolog and repeated applications of Negation as Failure in order to implement the universal quantifier in the body. On the other hand, the idea of compiling queries in the deductive database is widely spread [6, 3]. Compiled queries can be processed by well-developed relational query processing techniques in a traditional relational database system. The major portion of compilation is a process in which an IDB literal occurring in the body of a rule is accordingly replaced by EDB literals while the derivability of head instances remains unchanged. The compilation of queries is generally carried out by the use of resolution. However, the resolution-based compilation approach is not suitable for the extended rule because Skolem functions are introduced due to existential quantifiers. When Skotem functions are present in a resolvent, it is hard to convert a resolvent into an equivalent relational algebra expression. In this paper, we propose a new technique, a substitution rule, which takes over the role of the resolution in terms of the query compilation in the deductive databases and generates compiled forms which make direct use of division in the EDB. This paper is organized as follows: Section 2 summarizes the basic material found in [4] which is relevant with this paper. Section 3 describes the substitution rule and its relationship with the resolution principle. Justification of the substitution rule is found in section 4. Section 5 contains closing remarks.

2

Preliminaries

In order to extend the expressive power of deductive databases, a new type of rule, an extended rule, is introduced in Lee and Henschen [4]. Definition 2.1 An extended rule is of the form, (V~')((~y) [P(~) ( AI(~', ~ , . . . , A~(~, ~1, where Q~y denotes a list of quantified variables. The precise semantics of existential quantifiers of an IDB in Prenex Normal Form in a deductive database environment is viewed by its EF (expansion form). We assume that

59 the database has a domain closure axiom (DCA) for each domain. D e f i n i t i o n 2.2 Let R be an extended rule with existential quantifiers. An intermediate expansion form (IEF) of R is a clause in which all Skolem functions of R are eliminated due to repeated application of paramodulation from the appropriate DCA. A clause which is a subsuming factor of an IEF and does not have a subsuming factor for itself is called an expansion form (EF) of R. An EF is ready to resolve directly with facts because all Skolem functions are removed. The semantics of an IDB rule with existential quantifiers can be considered to be same as a corresponding EF for the purpose of deriving the head literal instances. When paramodulation is repeatedly applied to a Skolem function f in order to eliminate f , variables not occurring in f wind up being renamed. Renaming of variables causes m a n y distinct instances of the literals to occur, and as a result paramodulants become very large. We shall identify the condition under which multiple occurrences of literals can be merged into one occurrence by factoring and subsumption. D e f i n i t i o n 2.3 A universally quantified variable x is said to be a variable argument of a term t (resp. a literal l) if x occurs at t (resp. l). D e f i n i t i o n 2.4 A term tl is said to reside with a term t~ if a rule has a literal in which both tl and t2 occur. D e f i n i t i o n 2.5 Let R be an extended rule. Let f be a Skolem function occurring in R. Let x and y be universally quantified variables which are not variable arguments of f. x is defined to be expansionable under f when x resides with f . If x is expansionabte under f and x resides with y, then y is also expansionable under f . D e f i n i t i o n 2.6 A universally quantified variable y is defined to be non-ezpansionable under Skolem function f if y is not expansionable under f and y is not a variable argument

of f. D e f i n i t i o n 2.7 A literal which has expansionable (resp. non-expansionable) variables under Skolem function f as a variable argument is called an expansionable (resp. nonexpansionable) literal under f . Note that no literal is both expansionable and non-expansionable under f . Every universally quantified variable which is not a variable argument of f is either expansionable or non-expansionable under f . Both expansionable and non-expansionable variables under f are renamed each time paramodulation is applied to f . As a result, expansionable and non-expansionable literals expand to multiple occurrences due to renaming. We show that multiple occurrences of a non-expansionable literal can be merged (Lemma 2.1) into one occurrence without losing any derivable head instances, while the same does not hold for expansionable literals (Lemma 2.2).

60

L e m m a 2.1 Let F be a factor obtained from an I E F by factoring over instances of a non-expansionable literal. Then F subsumes its parent. L e m m a 2.2 Let F be a factor obtained from an I E F by factoring over instances of an expansionable literal. Then F does not subsume its parent. E x a m p l e 2.1 expansionable and non-expansionabte R : (Vx)(Vy)(3z)(Vu)(W)(Vw) [P(x, y ) , A(z, u), B(u, v), C(x, y, w)] After Skolemization, 1. P(x, y) -,A(f(x, y), u) -~B(u, v) -,C(x, y, w) Then, expansionable variables are non-expansionable variables are expansionable literals are non-expansionable literals are

: : : :

u, v w A, B C

Let DCA (Domain Closure Axiom) for z be z = cl V z = c2. After paramodulation from DCA into clause 1 twice, we get

2. [P(x, y) -,A(cl, u ~) -,B(u 1, v 1) -,C(x, y, w ~) -~A(c2, u ~) ~B(u ~, v 2) -,C(x, y, w2)] Clause 2 satisfies the first condition of Definition 2.2, so is an IEF. Let us consider a factor over the non-expansionable literal C (i.e. a = {w2/wl}). The factor is

3. [P(x, y) --,A(c,, ul) --,B(u 1, v 1) u

C(x, y, w

B(u

Clearly, clause 3 subsumes clause 2. However, no factor of clause 3 subsumes clause 3 because the unification wilt always be defined over an expansionabte literal. Therefore, clause 3 is an EF of R. [] When an IDB rule has multiple Skolem functions, these can be paramodulated away in different orders. Fortunately, we have the following lemma. L e m m a 2.3 Let R be an IDB rule with several Skolem functions. If two different sequences of paramodulation and factoring are applied to R, and if both sequences transform R into EF's successfully, then the two resulting EF's are identical up to variable renaming. Note that we use expansion forms as a theoreticM device only. In practice, it would not be feasible to actually generate such forms.

{}1

3

A

Substitution

Rule

Our proposal is based on the following substitution rule. D e f i n i t i o n 3.1 Suppose we have two clauses 1. (V~ [P(~, ~), .... (~)~) A(x, ~7,b)] 2. (V~ [R(ff, c-), (Qv) {B~(ff, g , ~ ) A . . . A Bn(u,v,d,~)}] such that P(ff, g) and B~(ff, ~, ~ ) are unifiable in Skolemized form. Assume no variables in common. Let A be a MGU such that {P(£, g)}A = {Bi(ff, 6, ~)}A in the unSkolemized clauses. The substitution rule generates clause 3 from clause 1 and clause 2

(~)

~(~, ¢, ~) A B~+~(~,v,d,+~) A . . . A B~(~, ~, Z~))]]~.

In this case we mean A to replace all occurrences of the variables both free and bound. When a variable in clause 3 is quantified more than once in the quantifier matrix, all quantifiers except the outermost one are removed. When a constant is quantified in the quantifier matrix, remove that quantifier. Clause 3 is called a conclusion. Here are several remarks on the substitution rule. . In above clause 3, a portion of the quantifier matrix, i.e. (Q~), is in the middle of the body. ( ( ~ ) can be pushed out to the front of the body so that clause 3 is of the form

3. [ ( V ~ ) [ R ( u", ~ ,

( Q v") ( Q y~) ( B l ( U~, v", dl) " A . . . A B~_l(~,v,d~_l)A d(~, y, b) A B~+I(u, v, di+,) A . . . A B~(ff, v, d~)}]]L

2. The important difference with the resolution principle is that the substitution rule does not Skolemize the given clauses. Universal quantifiers in the body are allowed to occur when the substitution rule is applied. 3. The substitution rule finds a MGU A between literals in the unSkolemized clauses. Hence, each component of A is of the form xl/x or a/x. Only variables and constants are involved in A. 4. It should be observed that the substitution rule is applicable only when the given clauses are resolvable in Skolemized form. 5. As a matter of fact, the substitution rule has the same effect as the resolution principle if all variables occurring in clause 1 and clause 2 are universally quantified in the Prenex Normal Form.

62 Throughout this paper we use the same notations appearing in the definition of the substitution rule. For example, a denotes a MGU associated with resolution and a B literal denotes a body literal in clause 2, etc. E x a m p l e 3.1 Consider the two clauses. 1. (Vxl)(Vx2) IF(x1, x2), (Vy,)A(xl,

2, (VUl)(VlZ2)[n(?~l, ?22),

x2, yl)]

(Vvl){P(Z~l,Vl) A B2(Vl, ul)}]

When clause 1 and clause 2 are Skolemized, we have 1'. P(Xl, x2) "-A(Xl, x2, f(x,, x2)) and

2;. R(~I, u2) -,P(Ul, g(ul, '~2)) -'*B2(.q(l/,1, t.f.2), Ul). g(ul, u2)/x2}. So, we can apply the substitu{Ul/Xl, vl/x2}. The conclusion is (VUl)(Vu2) [-R(Ul, u2) ' (Vvl)(Vyl){A(u,, Vl, Yl) A B2(v,, Ul)}]. []

The clauses are resolvable with cr = {ul/x~, tion rule. ), for the unSkolemized literals is

A affects the quantifier matrix in the substitution rule. As a result constants are possibly quantified. In such cases, the quantifier is dropped in clause 3. This phenomenon happens when P in clause 1 has a constant in its argument, and P in clause 2 has a variable at the corresponding position. An example is 1. (VXl) {P(x~,a), (Vyl)A(xl,yl)}

2. (Vul) { n ( u , ) ,

(~v,)P(ui,vl)}

Because clause 1 and clause 2 are resolvable, the substitution rule is applicable. With A = {ul/xl,a/vl} we get

(Vu,) {R(u,) ,

. (3a)(Vy,)A(ui, yi)}.

Constant a is quantified, so remove (3a) in the clause. The conclusion of clause 1 and clause 2 is

(V'al) (R(ul) (

(Vyl)A('al, Yl)}.

As it will be seen in the next section, constants in clauses can be eliminated in a proper way. For simplicity of presentation, we assume the formulae under consideration are free of constants in the rest of this section. Due to the fact that ,k affects the quantifier .matrix in the substitution rule, it is also possible for a variable to be quantified more than once when clause 1 is plugged into clause 2. This phenomenon happens when the literal P in clause 1 has a repeated variable pattern like P ( x l , x l , . . . ) . In such a case, all quantifiers except the outermost quantifier are removed in the conclusion. Suppose that literal P in clause 1 has a repeated variable xi as an argument and that W l , . . . , wn (a w variable is either a u variable or a v variable) are variables appearing in literal P in clause 2 at the corresponding positions. If clause 1 and clause 2 are resolvable in Skolemized form, a corresponding a will make w l , . . . , w,, and xl alike. If Wl = w2 . . . . . w~, then the general structure of the conclusion is the same as the case where the x variables in P in clause 1 are distinct. Suppose there are w~ and wj such that wi # wj. Due to the restriction that the substitution rule is applicable when the given clauses are resolvable in Skolemized form, w l , . . . , w~ falls into two cases. 1. w l , . . . , w~ are universally quantified in the Prenex Norma~ Form of clause 2. 2. if some of w l , . . . ,w,~, say w l , . . . , w l (1 _< i _< n), are existentially quantified in clause 2, then the following conditions should be satisfied.

63

(a)

the corresponding Skolem functions f l , . . . , fi of W l , . . . , Wi are the same function, i.e. fl = f2 . . . . . fi. T h a t is, w l , . . . , w i must be the same variable (i.e. wl = w2 = . . . . wl).

(b)

w i + l , . . . , wn do not belong to the arguments of fl. If one of w ~ + l , . . . , w~ belongs to the a r g u m e n t of fl, clause 1 is not resolvable with clause 2 in Skolemized form. This condition implies t h a t the quantifiers of w i + l , . . . , w,~ cannot precede the quantifier of wl in the quantifier matrix. Moreover w i + l , . . . ,w~ cannot be a m o n g the head variables ff in clause 2 because no quantifier precedes the quantifier of ft.

In either case, w l , . . . , wn will be m a d e identical, say wk. As a result, there are multiple quantifiers on wk in the quantifier matrix. T h e substitution rule says t h a t all quantifiers except the o u t e r m o s t one are removed. In the second case, the o u t e r m o s t quantifier is always an existential quantifier. Example

3.2 multiple quantifiers

(1) 1. (Vx,) [P(xl, Xl) l (Vy,)A(x,, y,)] ~. (V"d,1) [.R("dl) .¢ (VVl)(~v2){P(~l, v2) A/~(1/.t, Vl)}] In the resolution approach, the clauses are Skolemized into 1'. P(x~, x , ) -,A(x,, g(xl)) 2'. R(u,) --,P(ul, v2) - , B ( u , , f(u,)). T h e y are resolvable with a = {x~/u~, x~/v2}. So we can apply the substitution rule. A is {xl/ul, Xl/V2}. W h e n clause 1 is plugged into clause 2, we get

(Vxl) [R(Xl) '(

(V'u1)(~xl)(Vyl){A(Xl, yl) A B(Xl, Vl)}].

Variable xl is twice quantified in the above clause, so remove the second quantifier, i.e. (3xl). T h e n we get the conclusion of clause 1 and clause 2

(VXl) [R(Xl) (

(Vvl)(Vyl){A(xl, yl) A .B(Xl, Vl)}].

(2) 1. (Vx,) [P(x,, x,), ..........(Vy,)A(x,, y,)] 2. (vul) [R(u,),

va}].

v3) A

In the resolution approach, the clauses are Skolemized into 1'. P ( X l , Zl) "~A(x,, f(x,))

2'. R(u, ) -~P(g(u, ), v3) -~B(u,, h(u,), va)).

T h e y are resolvable with a = {g(ul)/xl,g(ul)/v3}. A = {vl/x~, v~/v3}. Then we get

(Vu,) [R(u~) ,

So apply the substitution rule with

(Vv,)(Vv2)(Bv,){(Vy,)A(v,, y,) A B(u,, v~, vs)}].

T h e variable vl is twice quantified in the above clause, so remove the last one. conclusion is

(w,)

yl) A B(u,,

va}].

The

D

W h e n the x variables in P in clause 1 are distinct and either P in clause 1 has no constants or they occur in the same positions as in P in clause 2, clause 1 is always

64

resolvable with clause 2 in Skolemized form. The corresponding a has components of the form t/x (t is a term), i.e. all x variables are replaced. Similarly, we can set up I in which each component is of the form v/x or u/x (i.e. x variables are replaced by u or v variables) so that the overall structure of the conclusion is (W)[R(ff) , (4~)(4~) {{A(~, ~)}~ A B(~, ~)}1. Note that ,~ affects only A literals and does not affect the quantifier matrix in this case. No variable will be quantified more t h a n once in the quantifier matrix. Therefore the quantifier matrix need not to be adjusted. The conditio~ that clause 1 and clause 2 are resolvable in Skolem Normal Form is important and should be observed even though the substitution rule performs the unification process on unSkolemized literals. The condition is required in order to avoid generating an invalid clause by the substitution rule. Suppose that we have the following two clauses.

1. (VXl){P(xl,Xl) , (3yl)C(Xl, yl)} 2. (Vul){R(ul) , (Wl)P(u , Vl)} Note that clause 1 and clause 2 in Skolem Normal Form are not resolvable. Let the domain of all variables be {1, 2}. The sets of possible derivable tuples for relation P in clause 1 are

(a) {< 1,1 >} (b) {< 1,1 >,< 2,e >) (e) O. In every case P(ul,vl) + D~1 = O. So, clause 1 cannot contribute to the derivation of tuples in R via clause 2. Therefore, no inference should be made from clause 1 and clause 2. The overall compilation procedure based on the substitution rule is simple and easy to implement. Given a set of extended IDB rules, the compilation is carried out as follows: For each occurrence of a non-base predicate P, substitute for P using its definitions. If the resulting IDB still contains non-base predicates, repeat. If there is no recursive predicate, this process must terminate, and at that point all IDB literats are defined by base predicates. Justification of the substitution rule is discussed in the next section.

4

Justification

of the Substitution

Rule

For the justification of the substitution rule, we are going to show that the substitution rule preserves the derivability of P where P is a head literal in the conclusion. T h a t is, for any P(d) clause 1 A clause 2 A base-relations ~- P ( 6 ) iff clause 3 A base-relations F P(ff). The "if" part states that the conclusion always generates correct answers while the "onlyif" part states that no correct answer is missing.

65 Let R be a resolvent between clause 1 and clause 2 and C be a conclusion of clause 1 and clause 2. The equivalence of the derivability is proved by showing that EF(C) = EF(R), where EF(A) is the expansion form of clause A. We prove EF(C) = EF(R) in Theorem 4.1 and Theorem 4.2. Before we present these two theorems we need some lemmas. L e m m a 4.1 Let C1 be a clause with Skolem function f, arg be all arguments of f , and arg'be a set of all variable arguments of f. Let C2 be a clause obtained by replacing arg by arg' in C1. Then EF(C~) = EF(C2). (For example f(x,g(y)) could be replaced by

f'(x,y)). Proof: The definition of expansionable and non-expansionable variable under a Skolem function f says that a variable is classified on the basis of a variable argument of f. Furthermore, substitution of the variable argument for the argument in f does not change the connectivity between variables. The lemma follows immediately. Q.E.D. By Lemma 4.1, we can freely replace arguments of a function f by variable arguments of f while the expansion form remains unchanged. In particular when there is a nested Skolem function f ' , we always transform the nested function into a flattened function whose arguments contain the variable arguments of f'. Moreover when a Skolem function g has a repeated variable in its argument, we collapse the repeated variable into one occurrence in the argument of g. E x a m p l e 4.1 (of Lemma 4.1) (a) C1: P(z) -~A(x, f(z),g(x, f(z)))

C~: P(z) -,A(x, f(z), g(x, z)) In clause 1, arg of g is 'x, f(z)', and arg I of g is 'x, z'. By Lemma 4.1 EF(CI) --- EF(C2). (b) 6'1: R(x) -~Q(x,g(x),f(x,x)) 62: R(x) -~Q(x, g(x), f(x)) In clause 1, arg of f is 'x, x', and arg' of f is 'x'. By Lemma 4.1 EF(C1) = EF(C2). L e m m a 4.2 Let C be a clause with two disjoint subclauses C1, C2 such that C1 tJC2 = C. Let £, ~7,5' be all the variables occurring in C such that z variables occur only in C1 and y variables occur only in C2. Let f l , . . . , f n be all the Skolem functions occurring in C1 whose variable arguments consist of all x variables and some of z variables. Let f" be a function resulting from fi by inserting all y variables into an argument of fi (for i = 1 , . . . , n). Let C' be a clause resulting from substituting f[ for f~ (for i = 1 , . . . , n) in C. Then, EF(C) = EF(C'). Proof: Consider whether variables inserted to f~ (i.e. all y variables) are expansionable or non-expansionable under fl. When we consider the subclause C1 only, variables that could be expansionable under f~ are some of the z variables, say zl, because all x variables always belong to the argument of fi. zi cannot reside with inserted variables because z~ does not occur in C2. zi could reside with some x variable in C1 and that x variable could reside

66

with inserted variables in C2. Because all x variables always belong to the argument of fi, x variables are in effect not renamed during paramodulation into fi. Therefore when fi is paramodulated, the y variables are renamed but will be factored out. Inserted variables are always non-expansionable under fi. Now, consider how the inserted variables behave when f~(or f') is eliminated. When fi is eliminated in C, no literal in C2 occurs multiple times due to the inserted variable because all y variables are non-expansionable under fi. On the other hand when f[ is eliminated in C', no literal in C2 occurs multiple times due to inserted variables because all y variables belong to the argument of f[. As for the literals in C1, insertion of all y variables to fi does not change the expansionability/non-expansionability of any literal in C1 because y variables are always inserted to fi. As a whole, a literal which will occur multiple times when fi is eliminated in C will occur multiple times when f[ is eliminated in C'. Similarly, a literal which will not occur multiple times when fl is eliminated in C will not occur multiple times when f" is eliminated in C'. Now recall that the order of Skolem functions to be eliminated does not make a difference to the expansion form. Suppose all f[ are eliminated first in C ~ and all fi are eliminated first in C. Then, the intermediate expansion forms of C and C ~ are identical and the effect of inserting y variables to fl is gone. Hence,

EF(C) = EF(C').

Q.E.D.

As a preliminary step of the proof to come, we consider constants in the formula. Constants in A literals, B literals and the R literal do not make a difference in ~ (MGU in resolution) and A (MGU in the substitution rule). We do not need to consider such constants. Suppose that P in clause 1 has constants a l , . . . ,a~ as some of its arguments and that w l , . . . ,w,~ (a w variable is either a u variable or a v variable) are variables at the corresponding positions in P in clause 2. Note that w l , . . . , w,~ should be universally quantified in the Prenex Normal Form due to the fact that the substitution rule is applicable when given clauses are resolvable. In resolution w l , . . . , w,~ are replaced by a l , . . . , a~. Similarly in the substitution rule w l , . . . , w~ are replaced by a l , . . . , a~ by A. One effect of c~ and A is to make w l , . . . ,w,~ to be a l , . . . ,a~. Let clause 2' be a clause obtained by making w l , . . . , w~ to be a h . . . , a~ in clause 2 and adjusting the quantifiers as necessary. Then we have C(1, 2) = C(1, 2') and EF(R(1,2)) = EF(R(1, 2')). a and A between clause 1 and clause 2' do not have a component like a/x. Similarly when both P ' s in clause 1 and clause 2 have constants, we can derive clause 1' and clause 2' in the above way such that C(1, 2) = C(1', 2') and EF(R(1, 2)) = EF(R(I', 2')). We may therefore use the primed formulas to compute C, so that we do not need to consider a substitution component like a/x in the following proof. In the rest of the material, we assume that the formula in question is free of constants. T h e o r e m 4.1 Let clause 1 and clause 2 be clauses of the form clause 1: (V~)[P(1) , (@)A(~,~] clause 2: ( V ~ ) [ R ( ~ ) , (Q~){P(~,,') A ~ ( a , ~)}].

67

Suppose that clause 1 is resolvable with clause 2 and all x's in P in clause 1 are distinct. Let C be the conclusion of clause 1 and clause 2, R be the resolvent of clause 1 and clause 2. Then EF(C) = EF(R). Proof: In the proof the following notations are used uniformly. S,

Sv S~ Sv S~

: the set of all head variables in clause 1 (i.e. xl, x 2 , . . . ) : the set of all universally quantified body variables in the Prenex Normal Form of clause 1 : the set of all head variables in clause 2 (i.e. ul,u~,...) : the set of all universally quantified body variables in the Prenex Normal Form of clause 2 : the set of universally quantified w's which precede wi in the quantifier matrix in the Prenex Normal Form of the clause containing w variables.

Observe that under the above setup clause 1 is always plugged into clause 2. Because all x's in P in clause 1 are distinct, we can assume that each component of a (or A) is of the form t/x, where t is a term (i.e. x is to be replaced). Then the general structure of R and C is R:

-~{A(x, -" " y*) }a ~B( ff, (/*),

C : (VtT) JR(if), (Qv)(Q~7){{m(x, yO}A A B(u, v)}], where y~ and v~ are Skolemized forms of yi and vl respectively. Note that a (resp. A) affects only A literals in R (resp. C). Compare R with C. The number of literals in R and C is same. The positions in which Skolem functions (or existential variables in the case of C) occur are same. The only difference between R and C is the arguments of the Skolem functions (or the set of preceding universal variables in C), and we will now compare these carefully. A Skolem function in R (or C) can be classified into one of three classes. 1. class 1: corresponds to

yi which is existentially quantified and always occurs in

A

literals. 2. class 2: corresponds to vi which is existentially quantified and occurs in B literals. 3. class 3: corresponds to vi which is existentially quantified and occurs in P in clause 2. In R and C, a function in class 3 occurs in A titerals. For each class of function we are going to examine the variable arguments. Case 1 When each component of cr is either u/x or v/x: In this case, there is no Skolem function in class 3. It should be observed that A = a. For a class 2 function, it is straightforward that the arguments in R are the same as in C. Consider an argument of a Skolem function in class 1. Let f be a Skolem function corresponding to yl which is existentially quantified. In the substitution approach, arguments of f in C = S~ U Sv U S~,. In the resolution approach, the arguments of f when Skolemizing clause 1 are S, U S~,.

68

Therefore, the arguments of f in n -- (S~ U Sg,)~r = S~. U S~* U $9~ where S~. (resp. S~.) denotes the set of u (resp. v) variables involved in a. The difference is that the argument of f in the conclusion has additional u and v variables which are not involved in ~r. Let S~+ (resp. Sv+ ) be t h e set of u (resp. v) variables which are not involved in a. Clearly, S~ = S~, U S~+ and S~ -- S~. U Sv+. Variables in S~+ and Sv+ do not occur in A relations and y variables do not occur in B relations. By L e m m a 4.2 (S~. O S,. corresponds to ~, S~+ U Sv+ corresponds to ~, Sv corresponds to ~7, the disjunction of A literals corresponds to C1, and the disjunction of B liter&ls and the R literal corresponds to C2), insertion of S~,+ and Sv+ to f does not make a difference in terms of constructing an EF. Hence, EF(R) = EF(C). Case 2 When at least one component of ~ is f(ff, ff)/x and the rest are either u/x or v/x: In this case, at least one v variable occurring in P in clause 2 is existentially quantified. The corresponding A is of the form {u/x, v/x} since the substitution rule does not do the Skolemization. Since all x variables are to be replaced by a and A, the general structure of R and C is the same as the previous case, i.e. R : R(g) ~ { / ( ~ , ~')}~ - B ( g , ~*)

c : (v,~) [a(~),

(~)(~){{.~(~,

~}.~ A #(,~,,7)}]

where y~ and v~ are Skolemized forms of yl and vi respectively. As for a function of class 2, the argument of the function in R is the same as that of C. Let us consider the argument of a function of class 3. Let f be a function due to an existentially quantified vi in P in clause 2. Let xi be a variable occurring in literal P in clause 1 at the corresponding position of vi. In the substitution approach, arguments of f in C = S~ U S~,. Note that y variables cannot be arguments of f since vi is substituted for xi by A. In C, f(S,, U S;,,) appears in the position of x; in A literals. In the resolution approach, when Skotemizing clause 2, vi is transformed into a Skolem function f(S,, U Sg~) in clause 2. a has a component f(S,, U S~,)/x~, so x, in A literals will be replaced by f(S,, U So,). So, the arguments of f in R are same as in C. EF(C) cannot be different than EF(R) due

to f. Now let us consider the class 1. Let yi be existentially quantified and g be a Skolem function of yi. In C, arguments of g = S~ U $9~ U Sv. In the resolution approach, y~ is Skolemized into g(S~, U S~) in clause 1. The arguments of g in R = (S~,

U S~)o- = S~, U {S~}o'.

cr has at least one component f(S~ U S¢,~)/x~, where v~ is existentially quantified in P of clause 2 and xl occurs in P of clause 1 at the corresponding position of vl. Therefore, all u variables belong to the variable argument of g. As for the v variables, those involved in a will belong to the variable argument of g. The difference in the variable argument of g in C and R is that the argument in the conclusion may have additional variables which are not involved in a. Let S,+ be a set of v variables which is not involved-in a. It is worthwhile to note that variables in S~+ do not occur in literal P in clause 2 and, for any vk occurring in P in clause 2, the quantifier of vk precedes the quantifier of variables of Sv+

69

in t~he quantifier matrix. In R, no y variables occur in B literats and variables in Sv+ do not occur in A literals. Let Sv. be the v variables involved in ~. By L e m m a 4.2 (S~ U S.. corresponds to £, S.+ corresponds to tT, Su corresponds to k', the disjunction of A literals corresponds to Ca, and the disjunction of B literals and the R literal corresponds to C~), insertion of Sv+ to g does not change the E F . Therefore, E F ( R ) = E F ( C ) . Q.E.D. T h e o r e m 4.2 Let clause 1 and clause 2 be clauses of the form clause 1: ( ~ ) [ P ( ~ ) , ~ " " c l a u s e 2:

A

Suppose that clause 1 is resolvable with clause 2 and P in clause 1 has a repeated variable pattern. Let C be the conclusion of clause 1 and clause 2, R be the resolvent of clause 1 and clause 2. Then E F ( C ) ----E F ( R ) . Proof: Notations in this proof are the same as in the proof of Theorem 4.1. Suppose that xi appears more than once in P in clause 1 and that w l , . . . , w~ are variables appearing in literal P in clause 2 at the corresponding position. If wl . . . . . w~, then the proof is trivial. Suppose there are wi and wj such that wl ~ wj. Consider the a. One of the effects of ~r is to make W l , . . . , wn and x¢ identical. If w l , . . . , w~ and xi are universally quantified, a will choose one of the variables arbitrarily and replace the rest by the chosen variable. T h e quantifiers of w a , . . . , w~ in the conclusion become the same. The substitution rule removes all multiple quantifiers except the outermost one in the quantifier matrix. The following example shows why we have to keep the outermost one.

1. (VXl)[n(xa,xl), ...... (3ya)A(xa,ya)] 2. (Vua)[n(ua) , .... (Vvl)(3v2){ P(ua, v~) A B(v,, v2)}] By the substitution rule, we have clause 3 with A = {ua/xa, ua/v2}. 3. (Vu,)[R(u,) ". (Vv,)(3u,)(3y,){A(u,,ya) A B(v,,u,)}]. If we remove the first occurrence of a ul quantifier in clause 3, the Skolem function of vl does not have Ul as an argument. On the other hand, in the resolution approach, clause 1 and clause 2 are Skolemized into P ( x , , x,) ",A(xa, f ( x l ) ) R(Ul) -~P(Ul, v2) - B ( g ( u l ) , v2). With a = {Ul/Xl, ul/v2} the resolvent is n(Ul) "-A(Ul, f ( ua ) ) ~ B (g( ul ), ua ). Observe that the function g has ua as an argument. ~r only makes ul, v2 and xl identical, but does not change the arguments of g in the conclusion. As it is shown, if we discard the outermost one in the quantifier matrix, the argument of a Skolem function in the conclusion can be different than that of the resolvent. Therefore, we have to keep the outermost quantifier. Now consider the case where some of w l , . . . , wn are existentially quantified. Without loss of generality, assume that wi is existentially quantified, cr tries to make w l , . . . , w~ and xl identical. The only way to do it is to change w a , . . . , w~-l, w i + a , . . . , w~ and xi to the Skolem function of wi. a cannot replace wa,. •., u,i-1, wi+l,. • •, w~, xl by an individual variable. Because W l , . . . , wi-a, w~+a,. • •, Wn are replaced by the Skolem function of wi, the quantifier of w~ cannot be eliminated. Recall that the quantifier of wl precedes the quantifier of w a , . . . , wi-l, w i + l , . . . , w~ in the quantifier matrix. Therefore, all quantifiers except the outermost one wilt be removed when a variable is quantifed more than once.

70 When literal P in clause 1 has a repeated variable pattern, it is not possible to assume that a always has a component like t/x (x variables are to be replaced). An example is 3. (Vxl)(Vx2)[P(xl, xl, x2)( (3y~)A(Xl, x2, Yl)] 4. ( V u , ) [ R ( u , ) < .......( 3 v , ) ( V v 2 ) { P ( u , , Vl, V2) A B(ttl, v2)}]. The Skolem Normal Forms of the above clauses are P(Xl, Xl, X2) -~A(x,, x~, y,) R(ttl) -~P(u,, Vl, f(ul, v,) ) -~B(Ul, v2). is {x~/u~,xl/v~,f(xl,x~)/x2}. However, note that the application of a to clause 4 makes ul and vl identical. Similarly, ~ makes Ul and Vl identical. Let clause 2' be a clause obtained by making w l , . . . , wn identical in clause 2 and adjusting the quantifier matrix if necessary. Let C(i, j) (resp. R(i, j)) be a conclusion (resp. resolvent) between clause i and clause j. It is not difficult to see that C(1, 2) = C(1, 2'). As for the resolvent, R(1,2) is the same as R(1,2 ~) except that a Skolem function f in R(1,2) has potentially a repeated variable as an argument of f while f ' in R(1, 2') does not. In fact, fl has fewer arguments than f because multiple occurrences of quantifiers on the same variable are dropped except the outermost one in clause 2'. However by Lemma 4.1, EF(R(1,2)) = EF(R(1,21)) because the sets of variable arguments of each Skolem function are the same. Let a t be a MGU between clause 1 and clause 2'. We can set up o' where each component is of the form t/x (x is to be replaced). Because we have proven the equivalence of expansion forms when each component of a MGU associated with the resolution is of the form t/x (in Theorem 4.1), BE(R(1, 21)) = EF(C(1, 2')). Now we have the following equivalence of expansion forms: BE(R(1, 2)) = BE(R(1, 2')) = BE(C(1,2')) = EF(C(1, 2)). Q.E.D.

5

Closing R e m a r k s

We proposed the substitution rule which will be used to compile extended rules efficiently in a query compilation phase. The substitution rule does not Skolemize clauses, so does not introduce Skolem functions into a compiled formula. We justified the substitution rule by showing that in a database environment the substitution rule preserves the derivability of the head literal in the conclusion. Compilation of non-recursive extended rules based on the substitution rule is simple and easy to implement, i The universal quantifier in the body of a rule corresponds to a division operator in relational algebra. Hence, in our approach the semantics of existential quantifiers in Prenex Normal Form is implemented by the division operator. Our approach contrasts with Lloyd and Topor's approach [5] in that they implement the semantics of existential quantifiers by repeated applications of backtracking and Negation as Failure. Our approach is more oriented toward conventional database query processing.

References [1] Chang, C.L. and Lee, R.C.T., Academic Press, 1973.

Symbolic Logic and Mechanical Theorem Proving,

71 [2] Clark, K. L., Negation as Failure, in: H. Gallaire and J. Minker (eds.), Logic and Databases, Plenum Press, 1978, pp. 235-260. [3] Henschen, L. and Naqvi, S., On Compiling Queries in Recursive First-Order Databases, J. Assoc. Comput. Mach., 31(1):45-85 (Jan.1984). [4] Lee, S.H. and Henschen, L., Semantics and Indefiniteness of Existential Quantifiers in the Deductive Databases, Proceedings of the Annual Conference of the International Association of Knowledge Engineers, June 1989, pp. 132-151. [5] Lloyd, J.W. and Topor, R.W., Making Prolog More Expressive, Journal of Logic Programming 1(3):225-240 (Oct. 1984). [6] Reiter, R., Deductive Question Answering on Relational Databases, in: H. Gallaire and J. Minker (eds.), Logic and Databases, Plenum Press, 1978, pp. 149-177. [7] Robinson, J., A Machine-Oriented Logic Based on the Resolution Principle, J. Assoc. Comput. Mach. 12(1):23-41 (January 1965). [8] Topor, R.W., Keddis, T., and Wright, D.W., Deductive Database Tools, Technical Report 84/7 (Revised August 23, 1985), Department of Computer Science, University of Melbourne, 1985.

Automatic Theorem Proving in Paraconsistent Logics: Theory and Implementation NEWTON C. A. DA COSTA University of Sao Paulo, Brazil

LAWRENCE J. HENSCHEN AND JAMES J. LU

Northwestern University, Evanston, IL. V . S .SUBRAHMANIAN

University of Maryland, College Park, MD. Abstract Databases and knowledge bases may be inconsistent in many ways. However, a database that is inconsistent may, nonetheless, contain a great deal of useful information. Classical logic, however, would deem such a database as useless. Paraconsistent logics are a family of logics introduced by da Costa. A family of paraconsistent logics called annotated logics were proposed by Subrahmanian in [17]. Subsequently, these logics found use in reasoning about logic programs that contained inconsistent and/or erroneous information, as well as in the study of inheritance hierarchies and object oriented databases. However, no full-fledged study of automatic theorem proving in these logics has been carried out to date. In this paper, we develop a linear resolution style proof procedure for mechanical reasoning in these paraconsistent logics.

1

Introduction

Databases and knowledge bases could be inconsistent in many ways. For example, if a programmer is constructing an expert system ES relating to a domain D, he does so by consulting several experts (say n in number) in the field D. From each expert di, 1 < i < n, he obtains some information, and this may be represented in logic as a collection of sentences, ESi, for 1 < i < n. The simplest way of combining the resulting knowledge is to set

ES = U ES~. i=t However, experts ESi and ESj may disagree on some proposition p. In that case, p may be a logical consequence of E , % while ~p is a logical consequence of ESj. As a consequence, in classical logic, our expert system ES would be inconsistent, and hence meaningless by virtue of its lack of models. Nevertheless, our point is that ES is not meaningless. Some arguments in favour of this point of view are: 1. A large subset of ES m~v well be consistent and convey meaningful information. This meaningful information must not be lost.

73 2. The very existence of a disagreement between experts ESI and ESj may be meaningful. For instance, if doctor D1 diagnoses patient X as being fatally afflicted with cancer, while doctor D2 also diagnoses X as being afflicted by cancer, but by a benign variety of cancer, then X, the patient would like to know about this disagreement. The very existence of this disagreement is meaningful because it may be cause for X to take appropriate action (seek a third medical opinion, etc.) The point being made in (2) above is that finding ad-hoc means of discarding formulas identified as the cause(s) of the inconsistency in ES is not always appropriate because it may often obliterate important information. In many cases, the existence of the inconsistency is itself important. In the late 1950's, a thorough systematic characterization of the logics of inconsistency was conducted by Newton da Costa [5, 6]. da Costa introduced a series of logics, known by the generic name, paraconsistent logics, which formalize schemes for mechanical reasoning in inconsistent formal systems. Annotated logics are a family of paraconsistent logics that were proposed initially by Subrahmanian [17]. Subsequently, they were studied, from the point of view of logic programming, by Blair and Subrahmanian [2], and from a foundational viewpoint by da Costa, Subrahmanian, and Vago [7]. Simultaneously, Kifer and Lozinskii [12] extended the annotated logic framework by the addition of new logical symbols. They have also been applied towards the development of a declarative semantics for inheritance networks [11] and object-oriented databases [13]. In view of the applicability of annotated logics to these differing formalisms in computer science, it seems necessary to study these logics more carefully. In this paper, we develop a linear resolution style proof procedure (cf. [14, 15]) that is proven to be sound and complete for theorem proving in finitely axiomatized paraconsistent theories. The logics we study are mnltivalued logics based on a complete lattice of truth values. In other words, given a complete lattice 7-, and any unary function -1 : 7- --~ 7-, we show how to define a paraconsistent logic, denoted QT-. As such, the theoretical framework is robust in that it applies to a large class of multi valued logics. Due to space constraint, we are unfortunately not able to provide the proofs to the resutts presented in the remaining sections of the paper. Complete details of all the proofs can be found in the long version of this paper.

2

M o d e l Theoretic A s p e c t s

Throughout this paper, we assume that T is some arbitrary, but fixed, complete lattice of objects called truth values. The least and greatest element of 7- are denoted, respectively, by the symbols I and 7-. We also assume that we have a language L consisting of finite sets of constant symbols, functions symbols (with associated arities), and predicate symbols (with associated arities). L also contains infinitely many variable symbols, together with the binary connectives &, V, ¢= and the unary connectives 7, ~, and two quantifiers, V and 3. Atoms are defined in the usual way (cf. Chang and Lee [4]). D e f i n i t i o n 1 An interpretation I for the language L consists of a non-empty domain, dom(I), and:

74 (1) a function ~/I that maps constants in L to dom(I) and (2) a function ( I that assigns, to each n - s t y function symbol p in L, a function from (dora(l)) ~ to dora(l) and (3) a function ax that assigns, to each n-ary predicate symbol in L, a map from (dora(I)) '~ to T. Suppose I is an interpretation for L. A variable assignment v for L w.r.t. I is a map from the set of variable symbols of L to dora(l). The denotation, dl.v(t), of a term t (w.r.t. interpretation I and variable assignment v) is defined as follows: (1) (2) (3) (4)

If If If If

t is a constant symbol, then dI,,(t) = ~lx(t). t is a variable symbol, then di,,(t) = v(t). t = f(tl,...,tn), then d1,,(t) = (~i(f))(di,,(tl),..., dL~(tn) ) ( t l , . . . , t=) is a tuple of terms, then d i , , ( t l , . . . , t=) = (dx,,(tl),..., di,~,(t~)).

D e f i n i t i o n 2 If A is an atom, and # E T, then (1) A : # is an annotated atom. (2) ~ 2 . . G ( A : #) is called a hyper-literal of order k and k times

(3) ~ 2 . . ~ A

: #) is called a mega-literal of order k.

k times

D e f i n i t i o n 3 Every hyper-literal is a formula. Suppose F, G are formulas and x is a variable symbol. Then: ~ ( F ) , ( F & G ) , ( F V G), ( F ¢: G), (Yx)F, and (3x)F are all formulas. We will often abuse notation and omit parentheses whenever possible. Note t h a t if A : # and B : #' are annotated atoms, then -,(A : # & B : #') is not a formula. D e f i n i t i o n 4 (Satisfaction) Suppose I is an interpretation for L, and v is a variable assignment w . r . t . I . In the sequel, A is any atom, # C T , and F, G, H are formulas. In addition, we assume that - is some arbitrary, but fixed, unary function from T to T.

1. I , v ~ ( A : #) iff A = p(tl,...,t=) and tcv(p)(dr,~(tl,...,t~)) > #. 2. I,v ~ -~k(A: #), k > 1 iff I, v ~ -~k-l(A:-~#). 3. I , v ~ ( F & G) iff I, v ~ F and I, v ~ G. 4. I , v ~ (F V e ) iff I, v ~ F or I, v ~ e . 5. I , v ~ ( F 6. I , v ~

~ e ) iffI, v ~ F o r I , v ~ G . F i f f I , v~: F.

7. I, v ~ (3x)H iff for some variable assignment v~ such that for all variable symbols y different from x, v(y) = v'(y), it is the case that I , v r ~ H. 8. I , v ~ (Vx)F ifffor all variable assignments v~ such that for all variable symbols y different from x, v(y) = v'(y), it is the case that I , v t ~ H.

75

We say I ~ H iff for all variable assignments v, I, v ~ H. The philosophical motivation behind the negation symbol -, can be found in [7]. However, as the next theorem shows (Normal Form Theorem), -~ is not necessary for the development of our theory. IIerbrand interpretations are defined in the usual way - the domain of any such interpretation is the set of all ground terms that can be expressed using the non-logical symbols of our language L. The assignments to constant and function symbols are identical to the classical logic case. However, predicate symbols of arity n are assigned functions from HU n to T where HU is the IIerbrand Universe of our language.

A mega-clause is a formula of the form: v . . . v L,,) where x l , . . . , x , ~ are all the variable symbols that occur in L1 V . . . v Ln and each Li is a mega-literal of order less than or equal to 1. T h e o r e m 1 (Normal Form Theorem) Suppose F is a closed formula. Then there is a finite set MCL(F) of mega-clauses containing no occurrence of the annotation _l_ such that F has a model iff MCL(F) has a model. [] A consequence of this theorem is that given any (finite) set S of formulas, there is a set of mega-clauses, denoted MCL(S) such that S is satisfiable iff MCL(S) is satisfiable. Moreover, if S is finite, then MCL(S) is finite. In addition, MCL(S) doesn't contain any occurrences of the annotation 1. We call sets of clauses that contain neither hyper-literMs of order greater than 0, nor occurrences of _l_, normal. T h e o r e m 2 (Kifer and Lozinskii, [12]) Suppose T is any set of mega-ctauses such that the set of annotations, # E T, occurring in T is finite. Then: T has a model iff every finite subset of the set of ground instances of T has a model. [] Two common situations under which T contains only finitely many annotations are: (a) when T contains finitely many truth values. There are many useful logics when T is finite. For example, the logic based on the set FOUR (eft Figure 1, [1, 2, 8, 9, 10]) of truth values is one such logic, while the logic based on the set SIX (cf. Figure 1) of truth values is another. (b) When T is any finite set of clauses, then it automatically contains only finitely many annotations. In general, this is the case that arises ordinarily in logic programming and in artificiM intelligence, where storage req~rements dictate that only finitely many sentences can be stored at any given point in time. A recursively enumerable axiomatization of the propositional logic fragment of Q T was proven sound and complete in [7]. However, this axiomatization is not amenable to a computer implementation because it contains sixteen rules of inference. Most theorem-proving researchers would agree that the more rules of inference an automated reasoning program is allowed to apply, the more "irrelevant" inferences it will generate, thus leading to the notorious combinatorial explosion problem. Thus, our aim in this paper is to develop a resolution-like proof procedure for paraconsistent logics which is amenable to a computer implementation. Moreover, this procedure will be applicable to first order Q T rather than just its propositional fragment.

76

L:O:f

T

T

_L

_L

Figure 1: The Complete Lattices FOUR and S I X

3

Linear Resolution

Procedure

for Q T

In this section, we develop the basic theory of resolution in paraconsistent theories. We recall that throughout this paper, T will denote some arbitrary, but fixed, complete lattice of truth values, and -~ will be some arbitrary, but fixed, unary function from T to 2r. As described in the previous section (cf. Definition 4), this will induce a definition of a particular paraconsistent logic. Suppose # E T is a truth value. Then we use the following notation:

up(p±) = {,x E T I), ~ p,} strictup(p,) = { A E ':rl ,X > p, and A -¢/1,} = up(#) - { i t }

in¢omz,(~) = {~ e 7-1 ~ ;~ p, and ~ ~ p,} down(p±) = {~ C T I~ <_ p,} strictdown(p,) = {A E T 1 A -< P±and A ¢ p,} = down(p±) - {p,}. Thus, in the case of FOUR, up(t) = {t,T}, down(t) = {t, _L}, strictdown(t) = {_L}.

strietup(t) = {T},

incomp(t) = {f},

Suppose p,p, E 7" are truth values. We use the notation, @(p,,p) to denote the set up(p±) M

(stri¢tdown(,) u i~comp(p)). Definition 5 Suppose C1 and C2 are the mega-clauses shown below:

C~ -

(L1

v...v

L~ v . . .

v

Ln)

!

c~-

(L~ v . . . v L~ v . . . v G )

and L{ = ( A : p,) and L~ =,-, ( A ' : p) and A, A' are unifiable (via mgu 8) and @(p,, p) = ~, then the binary mega-resolvent of C1 and C2 on mega-literals Li and L~ is defined to be: (L1 V . . . V

Li-1

V

Li+I

V

...L~

V

L~I V . . . V

L~_ 1 V L~+ 1 V . . . V L~)0.

The substitution ~ is called the unifier of the mega-resolution step. Li and L~ are the megaliterals resolved on. Note that one of the mega-literals resolved on must be of order 0, while the other mega-literal resolved on is of order 1. We say that either C1 resolves with C2, or C2 resolves with C1 with the understanding that the first argument to .~ is always the annotation of the mega-literal of order 0 that is resolved on, and the second argument the annotation of the mega-liter~l of order 1 that is resolved on.

77 E x a m p l e 1 Let S I X be the complete lattice shown in Figure 1. Let C1 = (p : t V q : L t ) and C2 ~ (,.~ (p : L t ) V r : L f ) be two mega-clauses. Then (q : L t V r : L f ) is a binary megaresolvent of C1, C2 on the mega-literals p : t and ..~ (p : L t ) . Note here t h a t : up(t) = {t, -l-}, strictdown(Lt) = {_1_}, incomp(Lt) = {Lf, f}, ~ ( t , L t ) = 0. L e m m a 1 Suppose p, # E 7". Then: (1) (2) (3) (4)

If If If If

p p p p

< #, then and # are = #, then > #, then

.~(#, p) = 0. incomparable, then .q(#, p) # 0. .~(#,p) = 0. ~ ( # , p) ~ 0.

T h e o r e m 3 Let #, p E T. Then: .~(#, p) = 0 iff p < #.

[] [3

Intuitively, the above result makes it a bit easier for us to check whether two clauses are megaresolvable because instead of naively checking whether the condition up(#) A (stric~down(p) (3 incomp(p)) = 0 holds, we only need to check if p _< #. First, observe that mega-resolution is not refutation complete even for propositional programs and finite sets of truth values. E x a m p l e 2 Consider the lattice FOUR and let T = {p : t , p : f, ~ (p : T)}. T has no model, but there is no mega-derivation I of the empty mega-clause, denoted D, from T. To see this, observe that neither p : f nor p : t can mega-resolve with ,.~ (p : 3-) because of the requirement that ~ ( f , T) and .~(t, 3-), respectively, be empty. Alternatively, observe that 3- ~ f and T ~ t and hence, ~ (p : 3-) cannot resolve with either p : t or p : f. The above example tells us that if we wish to obtain a completeness result for megaresolution, we must rectify this situation in some way. D e f i n i t i o n 6 Suppose # , # 1 , # 5 E T . The pair, (#1,#2) is called a decomposition of # if # = U{pl,#2}. (#1,#2) is said to be a strict decomposition of # if, in addition to being a decomposition of #, it is also the case that #1 # # # #5E x a m p l e 3 Consider the complete lattice FOUR of truth values. Then the only strict decompositions of the truth value T are the pairs (t, f) and (f, t). w e know that T is a complete lattice under the ordering <. The cartesian product, T × T may be (pointwise) partially ordered as follows:

(~1,~2) --< (Pl,P2) ¢¢" ~1 _~ Pl AND#2 < Ph-

Proposition 1 Suppose A is an atom, C and D are mega-clauses and # E T and (#1,#2) is a decomposition of #. Then: (2) ~ ( c v ~ (A: , ) v D) ~ (C v ~ (A: ~1) v ~ (A: ~5) v V).

n

1This expression will be defined shortly. For now, it may be loosely regarded to mean "successive application of mega-resolution using mega-clauses in T or derived from T using mega-resohtion.

78

D e f i n i t i o n 7 Suppose # E T and (#1,#2) is a strict decomposition of # and C, D are megaclauses. (1) Then the (singleton) set {(C V ,,, (A : #2) V ,~ (A : #2) V D)} is an immediate decomposition of the mega-clause (C V ,~ (A : #) V D). (2) The set of clauses {(C V A : #1 V D), (C V A : #2 V D)} is an immediate decomposition of the mega-clause (C V ( A : #) V D). D e f i n i t i o n 8 Suppose C is a set of mega-clauses and C is a mega-clause. (1) If C is an immediate decomposition of C, then d is a decomposition of C. (2) If Cl is a decomposition of C, and there is a mega-clause Co C CI such that C" is a decomposition of Co, then C = C~ U C" is a decomposition of C. P r o p o s i t i o n 2 Let d be a decomposition of C. Then, for all interpretations I , I ~ C ¢~ I ~ d. (As usual, I satisfies a set of formulas iff I satisfies each formula in that set). r7 D e f i n i t i o n 9 Suppose D = (D1 V Ai : #i V D2 V Aj : #j V D3) where D1, D2, D3 are mega-clauses. If Ai and Aj are unifiable (via mgu 8) and #i < #j, then D ' ~ (D1 V Ai : #i V D2 V D3)0 is called a factor of D. Likewise, if E - D1 V ~ (Ai : #~) V D2 V ~ (Aj : #j) V D3 is a mega-clause and AI,Aj are unifiable via mgu 0 and #i _< #j, then D" --- (Dr V D2 V ~ (Aj : # j ) V D3)O is called a factor of D. Note that the definition of factor is asymmetric depending on whether positive literals are being merged, or whether negative literals are being merged. If E1 is a factor of E2 and E2 is a factor of E3, then E1 is a factor of E3. P r o p o s i t i o n 3 Suppose C and D are mega-clauses such that D is a factor of C. Then C ~ D. []

D e f i n i t i o n 10 Suppose C 1 and C2 are mega-clauses of the form:

C1 =-

A I : # I V . . . V An:#,~V ~.,(Bx:p~) V . . . V ' ~ ( B m : p m )

C2 ~-

GI:~I

V...V

Gr :l/)r v ~ ( H 1 :¢1) V . . . V ~'~ (Hs :¢s)

Ca is said to subsume C2 iff there is a substitution 0 such that: 1. for all 1 < i < n, there is a 1 _< j _< r such t h a t Gj = AiO and #i _< Cj and 2. for all 1 < t < m, there is a 1 < w < s such that H~ = BtO and ¢~ _< pt. P r o p o s i t i o n 4 Suppose C1 and C2 are mega-dauses such that Ca subsumes C2. Then C1 ~ C2. [] D e f i n i t i o n 11 Suppose C1 and C2 are the following mega-clauses: C1 :

D1 V A1 :#1 V E1

(72:

D2 V A 2 : # 2 V B2

79 and A1 and A2 are unifiable via mgu 0 and #1 and p~ are incomparable. Then the mega-clanse

(D1 V D2 V AI :# V E1 V E2)0 where p = kl{pl, p~} is called a clone of C1 and C2. The set of all clones of a pair of mega-clauses C1,C2 together with C1 and C2 themselves is denoted by clone(C1, C2). Similarly, for a given set of mega-clause S, clone(S)is the set U{clone(C1, C2)ICI, C2 • S}.

Proposition 5 Suppose C is a clone of C1 and C2. Then {C1,C2} ~ C.

rn

Definition 12~Suppose C1 and C2 are mega-clauses. Then the mega-clause C is said to be a paraconsistent resolveut (p-resolvent, for short) iff C is a binary mega-resolvent of C~ and C~ where C~ (for i = 1,2) is either: (1) C~ or (2) a factor of Ci or (3) is a mega-clause in C~ where C~ is a decomposition of C~

Definition 13 A linear deduction sequencefrom a set S of mega-clauses is a sequence C1, C : , . . . , C~ such that: (1) C1 • S a n d (2) for i > 0, C/+1 is a p-resolvent of C' and C where C I is either Ci or is a clone(C~,Ck), and where C, Ck • clone(S U {C1,..., C/}) and there is no j _< i such that C~+1 is subsumed by Cj. The deduction sequence C1,..., Cn is a paraconsistent refutation (p-refutation for short) of S iff C,~ = D (where ~ denotes either the empty mega-clause or any mega-clause of the form (,~ ( A I : .L) V . . .

V

,,~

( A , : .L)).

A paraconsistent refutation C1,..., Cn is minimal iff whenever C/+1 is obtained from C/ (or a clone of Ci with some clause in S U {C1,...,C/}) and some mega-clause C' • clone(S U {C1,..., C/}), then C/+1 does not subsume any mega-clause in either S or in {C1, : . . , Ci}. Note that in definition 12 case (3), the set C~ may contain more than one clause. However, if in a deduction sequence C1,...,C,~, C~, i > 1 is obtained by p-resolving Cj and Cj,, 1 < j,j' < i using step (3) of definition 12, we simply discard those mega-clauses in C~ that do not participate in the p-resolution.

Theorem 4 ([12]) A set S of mega-clauses has a model iff S has an Herbrand model. We now present a soundness result for our proof procedure.

Theorem 5

(Soundness Theorem)

1. C1 has no models. 2. If C is a binary mega-resolvent of C1,C2, then {C1,C2} ~ C. 3. If C is a p-resolvent of C1,C2, then {C1,C2} ~ C.

D

80 4. Every p-refutation of S is minimal. 5. Suppose S is a set of mega-clauses. Then: if there is a p-refutation of S then S has no model.

Lemma 2 (Lifting Lemmas) 1. (Binary Lifting Lemma) Suppose C~ and C~ are instances of mega-clauses CI and C2 respectively. If C I is a binary mega-resolvent of C1 and C2, then there is a binary megaresolvent C of C1 and C2 such that C ~ is an instance of C. 2. (Decomposition Subsumption Lemma) Suppose C1 -= (D1 V A1 : #1) and C2 = (D2 V ,-~ (A2 : #~)) are normal mega-clauses and C~ and C2 are mega-resolvable on A1 : #1 and (A2 : #:). Suppose C~ and C~ are immediate decompositions, respectively, of C1 and C~, respectively. If C' is a mega-resolvent of C~ E C~ and C~ on A~ : #1 and ~ (A2 : #2), then C ~ is subsumed by a mega-resolvent of C1 and C2. 3. (Full Lifting Lemma) Suppose C~ and C~ are instances of mega-clauses C1 and C2 respectively. If C I is a mega-resolvent of C1 and C2, then there is a mega-resolvent C of C1 and C2 such that C I is an instance of C. [] T h e o r e m 6 ( G r o u n d C o m p l e t e n e s s ) Suppose S is a finite set of ground clauses that has no model. Then S has a p-refutation. []

Theorem 7 (Completeness) If a finite set S of mega-clauses has no model, then there is a p-refutation of S.

[]

The three lifting lemmas are needed to prove the above result. Thus far, we have not demonstrated an example where cloning is essential for completeness. We do so below: E x a m p l e 4 Consider the lattice F I V E below. T

Let S = {~0 (p : 1),p : 2,p : 3}. Clearly, S would have no p-refutation if cloning were not allowed. However, with cloning, the following is a p-refutation of S. C1: C2:

~,, (p : 1) o

Member of S By resolving with p : T which is a clone of p : 2, p : 3

Having presented the basic theoretical foundation for theorem proving in paraconsistent logical sysiems, we now present an illustrative example. This example has been run on an existing implementation of our procedure. All queries listed in the following example have been successfully executed by our theorem prover.

8]

4

Illustrative Example

Consider the construction of a medical expert system by consulting two doctors DOC1 and DOG½. The expert system is aimed primarily at diagnosing two diseases dl and d2. The intended usage of this expert system is as follows: • the %ore" part of the expert system is the knowledge (mainly in the form of non-unit clauses) provided by doctors DOC1 and DOC2 • when we intend to apply this knowledge to a specific patient, say Ann, then the pathologists, X-ray technicians, etc. who conduct medical tests on Ann add the results of these tests to the knowledge base. • In real life, such a system would work by keeping the main knowledge base described above in one or more files, while each patient's records are maintained in a separate file (or possibly as a record in a given file). Then the main knowledge base and this file (or record as the case may be) are merged together to form a "current" knowledge base and used to diagnose the patient's disease. We assume that our expert system is written in the form of a finite set of normal mega-cIauses over F O U R . Suppose now that DOC1 provides us the following three rules. (In the sequel, think of the si's as representing symptoms). C1 : C2: C3:

d l ( X ) : t V d2(X) : t V ,,~ ( s l ( X ) : t) V ,,~ ( s 2 ( X ) : f) d l ( X ) : f V ~ (d~(X) : t) d2(X) : f V ,~ (d1(X) : t)

Intuitively, this doctor has told us that if an individual tests positive for s y m p t o m sl and negative for s2, then he either has disease dl or disease d2. Furthermore, he goes on to say that no individual can have both disease dl and d2 at the same time. Now let us consider what doctor DOC2 has told us. He tells us that if test s~ is negative and test s3 is positive, then the patient: has disease dl for sure. He also tells us t h a t if test s3 is negative, then there is no way the patient could have disease d2. These two rules are captured by: C4: C5:

d l ( X ) : t V ,,~ ( s 2 ( X ) : f) V ,-~ ( s 3 ( X ) : t) d2(X) : f V ,,~ (s3(X) : f)

Now the pathologist who has examined the patients Ann and Lisa tells us the following test results: C6 : C7 : C8 : C9 : C10 :

sl(ann) Sl(lisa) s2(ann) s2(lisa) s3(ann)

:t :t :f :f :t

82 El: E2: E3: E4:

~ (dl(ann):t) ~ (s2(ann): f) V ~

t)

~ (s3(ann) : t c]

(Initial Query) (By E1 and C4) (By E2 and C8) (By E3 and C10)

Figure 2: p-Refutation of { C 1 , . . . , C10} U {,, (dl(ann): t)} FI:

~ (d2(ann) : f)

r2:

~

(Initial Query) (By F1 and C3)

The rest of the refutation is the same as in Figure 2. Figure 3: p-Refutation of { C 1 , . . . , C10} U {,-, (d2(ann): f)} The pathologist's report above tells us that Ann tested positive for symptoms Sl and s3, and negative for s2. Lisa tested positive for sl and negative for s2; however, the test results for s3 were inconclusive in Lisa's case (such phenomena are common in medicine and for that matter in many of the experimental sciences). Based on these test results, we are able to use the medical expertise provided by DOC1 and DOC2 to conclude that Ann has disease dl, but not d2. It is easy to verify that dl(ann) : t is in a logical consequence of P where P is the set of mega-clauses obtained by taking the union of the three sub-programs listed above. A p-refutation of the query ~ (dl(ann) : t) is shown in Figure 2. Similarly, d2(ann) : f is also a consequence of P. A p-refutation of ~ (d2(ann) : f) is shown in Figure 3. So far, everything has been consistent. Suppose now that a third doctor DOC3 had given us information that: Cl1: d~(X) : t V ~ (s3(X): t) Let us call the set of mega-clanses obtained by taking the rules provided by all three doctors and the pathologist's data O. In that case, we would be in the grips of an inconsistency because we could use DOC3's rule and the pathologist's data to conclude that Ann has disease d2. Likewise, we could use the rule provided by DOC2 and the pathologist's data to conclude that Ann has disease dt. Thus, Ann has both disease dl and d2. Thus, when we include rule ( C l l ) in our knowledge base, we can infer d,(ann) : T. A p-refutation of ~ (dl(ann: T)) is shown in Figure 4. Note however that the existence of this inconsistency does not allow us to draw arbitrary conclusions, e.g. we are not able to conclude that Lisa has disease dl.

5

Implementation Strategies

A straightforward implementation of paraconsistent resolution yields a very inefficient program. Many strategies that apply to classical resolution theorem proving can be adapted to paraconsistent resolution. These include most deletion strategies. A detailed discussion of the applications of these restriction strategies to para~:onsistent resolution is deferred to the long version of this paper. An important new notion, which is more or less unique to paraconsistent resolution, we introduce in this section is a generalization of paraconsistent resolution which combines factor-

83

al: G2:

,,, (dl(ann) : 3-) E 2 V ,~ (d,(ann): f)

G3: G4: a5: a6: GT:

E 3 V ~ (dl(ann):f) ,,~ (dl(ann): f) ,~ (d2(ann) : t) ~ ( s 3 ( a n n ) : t) c3

Figure 4: p-Refutation of { C 1 , . . . , C l l }

(Initial Query) (By C4 and the) (decomposition of G1) (By G2 and C8) (By G3 and C10) (By G4 and C2) (By G5 and C l l ) (By G6 and C10)

U {,~ (d2(ann): 3-}

ing, decomposition, and p-resolution into a single step. We call the generalization ep-resolution for extended p-resolution. Initial experiments with ep-resolution appear promising. The reduction in the number of mega-clauses generated is substantial. Moreover, ep-resotution appears to preserve completeness. A theoretical analysis of all the strategies implemented will be reported in the long version of this paper. Before defining ep-resolution, an extension to the syntax is necessary. D e f i n i t i o n 14 Given a finite S C T and an atom A, A : S and ~ (A : S) are extended mega-literaIs (em-literals, for short). Obviously, a mega-literal may be considered to be an em-literal whose annotation set is a singleton. An em - clause is a set of em-literals. Intuitively, an era-literal A with annotation set S means that A is a mega-titeral whose truth value is known to be greater than or eqaul to one of the values in S. But the exact one is unknown. D e f i n i t i o n 15 Suppose A is a ground atom, I is an interpretation, and v is a variable assignment, then I , v ~ (A : S) iff I , v ~ (A : #) for some # e S. Note it follows that for a negative em-literal ,~ (A : S), I ~,~ (A : S) i f f I ~ A : # for all # E S. As a special case, A : 0 is unsatisfiable while ,,~ (A : 0) is a tautology, for all atoms A. In the implementation, we do not allow input clauses to contain mega-literals with annotation of cardinality greater than 1. The purpose of allowing a set of truth values as an annotation is to improve the search for a refutation as we will discuss below. /,From the above definition, it can be seen that extended mega-literals do not have an effect on the expressive power of positive literals in clauses. In other words, an era-clause L1 V A : { s l , . . - , S n } V Lm is simply equivalent to L1 Y A : Sl V . . . V A : sn V Lm. However, they do increase the expressive power of negative literals that occur in clauses since a negative emliteral ,-~ ( A : { s l , . . . , s n } ) is by definition equivalent to ~ (A : sl) A . . . A ~ (A : sn). So a negative era-literal with an annotation set of cardinality greater than one occuring in a clause C "embeds" a conjunction of negative literals in C. Given a set D of truth values, we denote by D* the subset of D such that for every # E D*, there does not exist a ~ ~ D where/z > ~. Thus, D* is the set of minimal elements, if any, of D.

84 D e f i n i t i o n 16 Let S I , - . . , Sn be sets of truth values. We denote by I~1{$1,..., Sn} the set

{ U { s l , . . . , s n } lsi E Sifor 1 < i < n} The operation ~ allows us in definition 18 below to generalize factoring in the context of extended literals. D e f i n i t i o n 17 Given two truth values #, $ E T where # < $. M(~,~) = ( { P I P e 7", p # ~, and U {p,#} = ~})* D e f i n i t i o n 18 Suppose C1 and C2 are the era-clauses shown below:

C1 -~ =-

(B V L1 V . . . V Ln V D) ( B ' v Li v . . . . . .

v L " v D')

and Li = (Ai : #i), 1 < i < n, and L~ = ~ (A~ : Si) , 1 _< j < m, and A1,...,A,~, A~,...A~ are unifiable (via mgu 0), lq{#l,...,#,~} = #, and for some p E ~ { $ 1 , . . . , Sin}, either # > p or # < p. Then an ep-resolvent of 6'1 and C2 is: 1. if # > p, then an ep-resolvent of 6'1 and C2 is (B V D V B ~ V D')O. 2. i f # < p, then (B V D V B' V D ' V ~ (Ax : ]t,/(p,#)))0 is an ep-resolvent of C1 and 6'2. The em-literal ~ (A~ : Jk4(p,#)) is called the residue of the resolution. The substitution 0 is called the em-unifier of the mega-resolution step. Two strategies for reducing the search space are implicit in the definition of ep-resolution. We discuss each one informally. First of all, decomposition is performed only when a positive literal unifies with a negative literal, but their annotations do not satisfy the appropriate conditions for mega-resolution. In such a case, tile positive literal and one of the negative literals is resolved away immediately in the sazne step. The other negative literal generated as the result of decomposition is then annotated with the remainig set of possible truth values such that each may be used for ep-resolution in the future. From experiments, one of the places where a great deal of inefficiency occurs in a straightforward implementation of p-resolution is that the theorem prover generates decompositions blindly 2. On the other hand, ep-resolution directs its search process by decomposing only when necessary, again, avoiding the generation of many useless clauses. Secondly, a point related to the first point above is that in ep-resolution, no decomposition is ever necessary for positive literals. This eliminates a possibly enormous portion of the search space since two clauses are generated for each application of decomposition to a positive literal. Furthermore, since no input clause may contain literals with annotation of a set with more than one truth value, it follows that no clause generated in the course of a deduction will ever contain a positive literal with more than one possible annotation. This also trims the number of possible resolvents that one may generate. 2The number of decompositions can be quite large, depending both on the size of 7" and its asociated lattice ordering.

85

Issues relating to the completeness of ep-resolution with cloning are investigated in [16]. Experiments have already shown that in sets of clauses where a refutation is found, ep-resolution, by virtue of its embedding the above pruning strategies, generates fewer clauses. In the rest of this section, we briefly describe other strategies that are currently implemented. We define the complexity of a clause as the number of predicate symbols and the negation of predicate symbols occurring in the clause. For example, the clause p ( a ) : l V p(b):O V q(a,b):OY ~p(a): TV ~p(b):_l_ has complexity 3. The theorem prover attempts resolutions on clauses of smaller complexities first. This idea is nbt unlike the strategy of unit preference [21], or the fewest literal strategy, in classical theorem proving, where proofs are attempted first on "simpler" formulas. Our reason for defining complexity as above stems from the observation that often ep-resolution resolves away all or most of the literals with the same predicate symbol (or the negation of a predicate symbole) in one step. Subsumption, as defined in the previous section, is also incorporated into the implementation. This results in the discarding of many redundant clauses. Our current implementation is written in C-Prolog and runs on an Encore Multimax at Northwestern University. The real time for finding the proofs for the examples given in the previous section ranges up to 10 seconds during heavy system load. Much more extensive tests will be conducted. The results will be included in the long version.

6

Conclusions

Our principal aim in this paper was to develop a sound and complete linear proof procedure for annotated logic over an arbitrary complete lattice of truth values. As shown by the example in Section 4, these annotated logics provide a framework for formal reasoning about systems exhibiting inconsistency. Annotated logics were proposed by Subrahmanian [17] and subsequently extended by Blair and Subrahmanian [2, 3]. This work improves upon the work of Blair and Subrahmanian [2, 3] by developing proof procedures for full fledged annotated logic. The proof procedures developed earlier applied only to a fragment of annotated logics. To our knowledge, our experimental theorem prover is the first implementation of a theorem prover for full fledged annotated logics.

References [1] N.D. Belnap. (1977) A Useful I~bur- Valued Logic, in G. Epstein and J.M. Dunn, eds. Modern Uses of Many-valued Logic, (eds. G. Epstein and J.M. Dunn), D. Reidel, pps. 8-37. [2] It. A. Blair and V.S. Subrahmanian. (1989) Paraconsistent Logic Programming, Theoretical Computer Science, 68, 1, pp 135-153. [3] H. A. Blair and V. S. Subrahmanian. (1988) Paraconsistent Foundations for Logic Programming, Journal of Non-Classical Logic, 5,2, pp 45-73. [4] C. L. Chang and R.C.T. Lee. (1973) Symbolic Logic and Mechanical Theorem Proving, Academic Press.

86 [5] N.C.A. da Costa. (1974) On the Theory of Inconsistent Formal Systems, Notre Dame J. of Formal Logic, 15, pps 497-510. [6] N.C.A. da Costa and E.It. Alves. (1981) Relations between Paraconsistent logic and Manyvalued logic, Bulletin of the Section of Logic, 10, pps 185-191. [7] N.C.A. da Costa, V.S. Subrahmanian and C. Vago. (1989) The Paraconsistent Logics P T , to appear in: Zeitschrift fur Mathematische Logik und Grundlagen der Mathematik, Vol. 37, 1991. [8] M. C. Fitting. (1989) BiIattices and the Theory of Truth, to appear in: Journal of Philosopbical Logic. [9] M. C. Fitting. (1988) Logic Programming on a Topological Bilattice, Fundamenta Informatica, 11, pps 209-218. [10] M. C. Fitting. (1988) Bilattices and the Semantics of Logic Programming, to appear in: Journal of Logic Programming. [11] M. Kifer and T. Krishnaprasad. (1989) An Evidence Based Framework for a Theory of Inheritance, Proc. l l t h InternationM Joint Conf. on Artificial Intelligence, pp 1093-1098, Morgan-Kaufmann. [12] M. Kifer and E. Lozinskii. (1989) RI: A Logic for Reasoning with Inconsistency, LICS-89. [13] M. Kifer and J. Wu. (1989) A Logic for Object Oriented Logic Programming, Proc. 8th ACM Symp. on Principles of Database Systems, pp 379--393. [14] D. W. Loveland. (1970) A Linear Format for Resolution, Proc. IRIA Symp. on Automatic Demonstration, Lecture Notes in Mathematics, Springer, pps 147-162. [15] D. W. Loveland. (1972) A Unifying View of some Linear Herbrand Procedures, JACM, 19, pps 366-384. [16] J. Lu, V.S. Subrahmanian, and L. Henschen. (1990) An Improved Resolution Procedure for Paraconsistent Logics, submitted to AAAI-90. [17] V.S. Subrahmanian. (1987) On the Semantics of Quantitative Logic Programs, Proc. 4th IEEE Symposium on Logic Programming, Computer Society Press, Washington DC, pps 173-182. [18] V. S. Subrahmanian. (1988) Mechanical Proof Procedures for Many Valued Lattice Based Logic Programming, to appear in: JournM of Non-Classical Logic. [19] M.H. Van Emden. (1986) Quantitative Deduction and its Fixpoint Theory, Journal of Logic Programming, 4, 1, pps 37-53. [20] A. Visser. (1984) Four Valued Semantics and the Liar, J. of Philosophical Logic, 13, pps 181-212. [21] L. Wos, D. Carson, and G. Robinson, (1964) The Unit Preference Strategy in Theorem Proving, Proceedings of the AFIPS Conference 26, pp. 615-621.

C a s e - F r e e P r o g r a m s : A n A b s t r a c t i o n o f Definite H o r n P r o g r a m s Toshiro Wakayama Xerox Webster Research Center 800 Phillips Road, 128-29E Webster, New York, 14580 wakayama.wbst [email protected] T. H. Payne Department of Mathematics and Computer Science University of California, Riverside, CA 92521 [email protected]

A b s t r a c t . We consider a form of linear resolution (called SEI) that requires no factoring and no ancestor resolution. Thus, SEI behaves just like SLD, but it can tolerate certain non-Horn clauses and negative clauses. We prove that the class of case-free programs (a program here is a finite set of any clauses with the consistency requirement) is the largest class of programs for which SEI is sound and complete. Intuitively, a case-free program is a program in which no case analyses are required for computing correct query answers. The class of case-free programs is significantly larger than that of definite Horn programs. In particular, it is large enough to allow extensive manipulation of negative information, including non-allowed clauses: recall that negation-as-failure in SLDNF is essentially a test, and the allowedness is an essential requirement for the completeness of SLDNF[3]. We then prove a result that strongly indicates that SLDNF has some fundamental difficulties when and only when it deals with non-case-free programs. This result may open the possibility of obtaining better completeness results of SLDNF by restricting our attention to case-free programs.

§1. Introduction In studies of resolution-based theorem provers, there have been ambitious efforts to refine a full linear resolution and use it as a basis for programming languages while preserving its first-order completeness(e.g., [8, 12]). The major obstacle against these efforts has been the fact that a full linear resolution procedure generally requires two costly operations, namely factoring and ancestor resolution in addition to the basic SLD-like deduction. One of the interesting questions is then how powerful a theorem prover can be without factoring and ancestor resolution. Notice that such a theorem prover, which we call SEI in this paper(see section 2), is significantly more general than SLD: it does not have the definite Horn clause restrictions, i.e., it may take non-Horn clauses or clauses in which every literal is negative. On the other hand, since it lacks factoring and ancestor resolution, it behaves just like SLD, and hence we can expect its efficiency to be fairly comparable to that of SLD. Thus, our first task is to characterize the computational upper bound of SEI resolution: 1 We define the notion of case-free programs. Intuitively, a program, i.e., a finite set of any clauses with the consistency requirement, is case-free just in case it requires no case analyses for obtaining correct query answers. 2 We establish soundness/completeness results of SEI with respect to case-free programs. 3 We then show that the class of case-free programs is in fact the largest class of programs for which SEI is sound and complete.

88 Since SEI is an abstraction of the essential deductive features of SLD (dropping the syntactic requirements of definite Horn clauses), the class of case-free programs can be seen as a corresponding abstraction of definite Horn clauses, abstracting the program properties which are amenable to the SLD-like deduction defined as SEI. The most notable advantage of SEI over SLD is that it is now general enough to allow extensive manipulation of negative information, without adding extra inference mechanisms. See the example below. (1.1) E x a m p l e (1) (2) (3) (4)

math.maj(Mike) -~math.maj(Jon) take(x, Math200) take(x, MathlO0)

~-~~- math.maj(x) ~-- -~math.maj(x)

Apparently, this program violates the definite Horn clause restriction and contains some nonHorn(4) and negative(2) clauses. However, this program is still amenable to the SLD-like deduction: see the following proof of the query 3z take(x, MathlO0) constructed by SEI.

take(x, MathlO0) -,math.maj(y) empty goal

; ;

take(y, MathlO0) ,-- ~math.maj(y) -~math.maj(Jon)

; ;

{x/y} {y/Jon}

Note that the first side clause, take(x, MathlO0) ~ -~math.maj(x), in the above proof is an example of non-allowed clauses: a clause, written in the head-body notation, is allowed if every variable appearing in the clause appears at least once in some positive literal of the body([1], [3]). Recall that this allowedness condition is an essential requirement for the completeness of SLD extended through negation-as-failure. Note also that negation in SEI is the usual logical negation of first-order logic, and it is different from the negation interpreted through the negation-as-failure mechanism of SLDNF. These two types of negations have both advantages and disadvantages, and one is more appropriate than the other only in some applications. It is also possible to combine the two types, and they do not have to be mutually exclusive. In particular, it is interesting to see how SEI can be extended by adding negation-as-failure to it. However, it is important to have more comprehensive understandings of these two kinds of negation before attempting to naively combine the two. In particular, our second task in this paper is to characterize SLDNF in terms of its ability to perform case-analyses (i.e., to answer the circled question in the diagram below). In this regard, our findings are the followings: 1 SLDNF does perform sound case analyses, but only in peculiar situations. 2 We establish a proposition(5.8) that strongly indicates the fundamental difficulties of case analyses in SLDNF, i.e., we show, in the ground case, that whenever a query that requires case-analyses has an SLDNF refutation proof, it also has an SLDNF refutation proof such that the query is not a logical consequence of the clauses employed in this proof.

89 SEI

SLDNF

negation

logicM

NF

negative facts

explicit

via NF

case analyses

no

upper bound

case-free programs

some decidable classes

O ? strictness and allowedness

Notice that the latter finding is by no means intended to question the soundness of SLDNF, which is usually associated with much stronger semantics induced by completions of programs. However, this result may have an important implication to the completeness issue of SLDNF. The completeness issue of SLDNF is one of the central issues of logic programming, and there have been various attempts to identify satisfactory upper bounds of SLDNF query-answering procedure. Various concepts such as stratification ([1]), strictness, and allowedness have been proposed in this regard, but they are generally considered to be still too strong. Our formalization of case-free programs offers another conceptual dimension for understanding SLDNF. For instance, we may actually benefit from limiting our attention to case-free programs in characterizing upper bounds of SLDNF. This possibility, however, is beyond the scope of this paper. Related works include [21 and [71. [21 offers a logic programming scheme in which negation is treated through annotations attached to literals and not through negation-as-failure. [7] discusses a logic programming system called near Horn Prolog which interprets negation as the logical negation of first-order logic. Also, [12] and [9] present systems which treat negation as the logical negation. Compared with these studies, the contribution of this study is to show that the treatment of negation as the logical negation is quite possible within the framework of SLD-like deduction, without using any additional inference mechanisms, as long as we are dealing with case-free programs. §2. P r e l i m i n a r i e s Any definitions and notational conventions not specified in this section or other parts of this study follow [4] or [11]. We use upper case letters to denote literals, either positive or negative. If 2" is a formula, 3(~') and V(~') denote the existential and the universal closure of 2", respectively. I" ~ 2" means that the formula 2" is a logical consequence of the set of formulas F in the sense of classical first order logic [11]. By a model we mean a subset of the Iterbrand base of the language under consideration.

A substitution is a finite set of the form {zl/tl, z2/t2,..., z,~/tn} where each zl is a variable, each ti is a term distinct from zi, and zi's are distinct from each other. The set { z l , . . ' , z,} is called the domain of the substitution. A substitution is ground if no variables occur in the term t in any member z / t of the substitution. A clause is a formula of the form V(A1 V---VA. V-~B1 V.-. V-~Bm) where Ai's and Bj's are atomic formulas, n > 0, and m > 0. A clause in the above form is

90

a negative clause if n = 0, a positive clause if n >_ 1, a definite Horn clause, or simply a definite clause if n = 1, an indefinite clause if n > 2, a ground clause if no variables appear in it, and an A-clause if the literal A appears in it. Following the usual convention, we drop all quantifiers when we write a clause. An input representation of the clause A1 V . . - V An is a (logically equivalent) formula of the form

Ai ~ -~AI& . . . . Ai-x~-,Ai+l & . . . &'~An. The literal Ai is called the head of the input representation, and the conjunction to the right of the arrow is called the body of the input representation. An input representation is positive if its head is positive. A program is a consistent set of finitely many clauses, and we use P to denote a program. A program is positive if every clause in it is positive, and it is definite Horn if every clause in it is a definite Horn clause. A program is in an (positive) input representation if every clause in it is in an (positive) input representation. We allow a program in an input representation to have multiple input representations of a single clause. A set of clauses is ground if every clause in it is ground. If S is a set of clauses, we write ground(S) to denote the set of all ground instances of clauses in S over the (unspecified) language of S (S as a first-order theory). A goal or a query is the existential closure of a conjunction of literals. When we write a goal or a query, we usually omit all of its quantifiers. Literals of a goal are called subgoals.

(2.1) D e f i n i t i o n . An SEI-derivation from a goal g in a program P is a sequence of triples < g l , s l , 0 t >, < g2, s2,02 > , . . - such that, -

gl=g. si is an appropriate variant of a clause in P in an input representation such that its head is unifiable with the right-most subgoal of the goal gi via an mgu 0i. We call si's the side clauses of the derivation. if gi = A t & ' " &A,, and si = A0 (--- B I & . . . &Bin, then gi+l = ( A I & . . . ~ A , ~ _ I ~ B ~ & . . . ~=Bm)Oi. We say the ith triple derives the goal gi+l.

SEI, as defined above, may be seen as the most general form of the model elimination procedure of Loveland [5, 6] that requires no reduction and no re-entry resolution. Reduction is a form of ancestor resolution. Re-entry resolution refers to those derivation steps in which the second components of the triples are the negation of the top goal in an appropriate input representation. Thus, SEI stands for Single-Entry Input deduction, where single-entry means that the top goal can enter the derivation only once, namely as the top goal, and input deduction is the terminology used in automated theorem proving to mean linear resolution without ancestor resolution. (2.2) D e f i n i t i o n An SEI-proofof a query q in a program P is a finite SEI-derivation from q in P in which the last triple derives the empty goal. If A is an SEI-proof of q with its m g u ' s o h , . - - , an, then the composition al - - - a n restricted to the variables of q is called the answer

computed by A .

91

In logic p r o g r a m m i n g , a query answer is usually a single substitution. However, in the presence of non-Horn clauses, a query answer m a y be a set of substitutions. For instance, given the p r o g r a m {p(a) V p(b)}, we would like to say the query 3 z p(z) has an indefinite or

disjunctive =swer {{z/a}, {z/b}}. ( 2 . 3 ) D e f i n i t i o n . A n answer is a n o n e m p t y finite set of s u b s t i t u t i o n s having the s a m e d o m a i n . If an answer is a singleton {o.}, we m a y write it o. and t r e a t it s i m p l y as a substitution. A n answer is ground if every s u b s t i t u t i o n in it is ground. T h e domain of an answer ~ , w r i t t e n dome, is t h e d o m a i n of a s u b s t i t u t i o n in it. If ]C = {o-1,-.., o'n} is an answer and q a query t h e n q ~ denotes qo-1 V - - . V qo.,,. We say t h a t a query q has an answer ~ in a p r o g r a m P if t h e d o m a i n of ~ is the set of variables of q, and P ~ V(q]E). (2.4) o. is a in P . in P :

D e f i n i t i o n . Suppose t h a t a query q has an answer ~E in a p r o g r a m P . If a s u b s t i t u t i o n m e m b e r of an instance of ~ such t h a t P ~ V(qo.), then o. is called a unit instance of ~ is definite in P if it is a singleton, or every ground instance of it has a unit instance otherwise ~ is indefinite in P . If no p r o p e r subset of ~ is an answer of q in P , it is a minimal answer of q in P .

Note t h a t SEI only c o m p u t e s definite answers. Note also t h a t the notion of definite and indefinite answers depends on the underlying language of the p r o g r a m under consideration. See the e x a m p l e below. ( 2 . 5 ) E x a m p l e . Consider the p r o g r a m P = {p(a) V p(x)}, the query q = 3zp(z), and the answer E = {{z/a}, {z/z}}. If the u n d e r l y i n g language of P has only one constant and no other function symbols, the answer ]E is a definite answer of q in P . On the other hand, if the underlying language of P has a n o t h e r constant different from a, E is an indefinite answer of q in P . §3. P o i n t - w i s e D e t e r m i n a t i v e n e s s

and WeH-Informedness

T h i s section will identify the largest class of p r o g r a m s for which SEI is c o m p l e t e in

a strong sense (see the definition 3.12). We a d a p t the notation L + to denote the atomic c o m p o n e n t of t h e literal L. We also employ the n o t a t i o n atom{F} to denote the set of all a t o m i c f o r m u l a s a p p e a r i n g in the formula or the set of formulas F. ( 3 . 1 ) D e f i n i t i o n . Let S be a set of ground clauses in an i n p u t representation. T h e positive map based on S is the m a p , + s , + s ( L ) = L +, from the set of literals a p p e a r i n g in S to the set atom{S}. Define S+ = { A + ~-- B + & ' " & B + I A ~ B I & - . . & B , , E S}. W e refer to S + as the positive image of S. Note t h a t if P is a ground p r o g r a m in an i n p u t representation, P + is a definite Horn p r o g r a m . ( 3 . 2 ) L e m m a . Let P be a ground p r o g r a m in an i n p u t representation such t h a t the positive m a p based on P is a bijection. T h e n given a ground literal A, (1). A has an S E I - p r o o f in P i f f A + has an S L D - p r o o f in P + , (2). P ~ A i f f P +

~ A +.

92 P r o o f . (1) follows from the fact that the positive map based on P is a bijeetion. For (2), suppose P + ~ A +. Then A + has an SLD-proofin P+, by the completeness of SLD. By (1), we get an SEI-proof of A in P. Finally, by the soundness of SEI, we have P~A. Now suppose P~A. Let .M be a model of P+. We will show that A + is true in .h4. Let .,4+(.,4 - ) be the set of all atomic formulas that appear positively (negatively) in P. Since the positive map based on P is a bijection, A + n A - =0. We then define M ' = ( A - - M ) u (.a + n .M).

We will show .h4 ~ is a model of P. First note that (A- - M) n (A + n M) =

We claim that for each literal L appearing in P , (a). if L is positive, L E M ~ iff L E M , (b). if L is negative, L + E A4' iff L + ~ M . For (a), i r a positive literal L is in M , it is in (.4 + n M ) c_ M ' : conversely if L is in M ' , it is in (.4 + A M ) C_ M . To show (b), let L be a negative literal. I f L + is not in M , it is in (,4- - M ) C_ M~: on the other hand, if L + is in M ~, it is in .,4- - M , and hence it is not in M. Thus for every literal L appearing in P, we have L is true in M ~ iff L + is true in .h4. Since M is a model of P+, .h# is a model of P. Hence, by the supposition that P ~ A, A is true in 2v/~. This in turn implies the desired conclusion that A + is true in M . | The following diagram summarizes the l e m m a and related results. P t-SEX A

P+ ~SLD A +

I I i

P~A

P+ ~ A +

(3.3) Definition. If a ground clause has an input representation whose body is a logical consequence of a set S of clauses, then the clause is said to be determinative in S; otherwise it is nondeterminative in S. S is determinative if every clause in ground(S) is determinative in S. The following is immediate from the definition. (3.4) L e m m a . If two programs, with the same underlying language, are both determinative, their union is also determinative.

93

However, the converse does not follow. For instance, the ground program consisting of two clauses

AVB -,B is determinative, but its subset {A V B} is not. (3.5) L e m m a . Let S be a consistent set of ground clauses. Suppose that S is determinative and that every clause in S is in a determinative representation. Then the positive map based on S is a bijection. P r o o f . It suffices to show that no atomic formulas appear both positively and negatively in S. But this is clear because every clause in S is in a determinative representation and because S is consistent. II (3.6) L e m m a . Let P be a determinative program. Suppose for some P ' _ a ground literal A, P ' ~ A. Then A has an SEI-proof in P'.

ground(P) and

P r o o f . Let S = ground(P). Since S is determinative and consistent, by Lemma 3.5, the positive map + s is a bijection. Note that, since the positive map +p, based on P ' is a restriction of +s, it is also a bijection. Since P ' ~ A, A has an SEI-proof in P ' , as indicated in the diagram above. | In what follows, we adapt the notation S ~min ~" to mean that the formula ~- is a logical consequence of the set of clauses S but not a logical consequence of any proper subset of S. (3.7) Definition. Suppose that a query q has a ground minimal answer E in a program P. Then, P is (q, E)-determinative if a program P ' ___ground(P) is determinative whenever P ' ~ , m , qE. A program P is point-wise determinative if it is (q, E)-determinative whenever a query q has a ground minimal answer E in P. Intuitively, a point-wise determinative program is a program that locally looks like a definite Horn Program. However, this condition alone is not sufficient to assure an appropriate abstraction of definite Horn programs. This is because the notion of determinativeness is about what a program explicitly talks about and it says nothing about what is not mentioned in the program. If the underlying language is relatively large and contains constants not mentioned in the program, the program has a larger room for indefiniteness, which may in turn require non SLD-like deduction. Consider the example below. (3.8) E x a m p l e . Let V = {-,p(b), p(c)}. Then, clearly P is point-wise determinative. But, assume that the language of P has another constant a, and consider the query 3~3y~p(x)ap(y). Then we have

P ~ -~p(a)~p(c) V -~p(b)&p(a). Thus the query has an indefinite answer

y/a}},

which can not be computed by SEI. Thus, we need a condition that roughly states that a program contains sufficiently large information relative to its underlying language. (3.9) Definition. P is well-informed if atom(qE) C atom(P') whenever a query q has a minimal ground answer E in P, P ' C ground(P), and P ' ~ qE.

94 (3.10) Definition. P is case-free if it is well-informed and point-wise determinative. The reason we call point-wise determinative and well-informed programs case-free will become clear in next section. (3.11) L e m m a . If P is case-free, every minimal answer in P is definite. P r o o f . Suppose a query q has an indefinite minimal answer 22 in P. Then, by definition, some ground instance 22~ of 22 is an indefinite minimal answer of q in P . Let q22, = ql V . . . V qn, n >_ 2. Then for some pi C ground(P),

P' ~min ql V ... V qn. If AJ is a model of P ' , some q~ is true in A4. But then since P ' is determinative and atom({ql,..., qn}) C_ atom(P'), q~ is true in every model of P ' . Thus, we have

P' ~ qk, contradicting the minimality of 22'. 1 Now we will establish a completeness result of SEI analogous to that of SLD. Note that the completeness of SLD for definite Horn programs is actually a strong one in the following sense. (3.12) Definition. A program P is said to be strongly SEI-complete if for every query q and its minimal ground answer 22 in P, whenever P ' ~ q22 for a program P ' C ground(P), it has an SEI-proof in P ' that computes 22. If A is an SEI-derivation, we use side(A) to denote the set of all side clauses appearing in A. (3.13) L e m m a . If A is a ground SEI-proof, side(A) is determinative. P r o o f . A simple induction on the length of A. II (3.14) P r o p o s i t i o n . P is case-free iff it is strongly SEI-complete. P r o o f . Suppose P is case-free, and that a query q has a ground minimal answer 22 in P. By Lemma 3.11, 22 is definite. Since 22 is ground, it is a singleton by the minimality of 22. Let 22 = {0}, and

qO = At&...&A,,. Let P ' C ground(P) be a program such that

P' ~ At&.'. &A.. For each Ai, let Pi be a subset of P~ such that Since P is point-wise determinative, Pi is determinative. By Lemma 3.6, Ai has an SEIproof A~ in Pi. We then get an SEI-proof A' of qO = A I & " "&An in [3{Pi}l<~
to

< q,s,O >, we get an SEI-proof of q in P~ that computes 0. Thus, we have shown that P is strongly SEI-complete.

95 For the converse, suppose that P is strongly SEI-complete. We will first show that P is well-informed. Suppose that a query q has a ground minimal answer ~ in P, and that P ' is a subprogram of ground(P) such that P~ ~ qE. Since P is strongly SEI-complete, q has an SEI-proof in ps, computing a singleton answer possibly more general than ~. So E is also an singleton. Let q~ = A I ~ " .~An. Since P~ ~ Ai, P~ must have an Ai-clause, for each i. Thus, we conclude atom(q~) C_atom(P'). Now we will show P is point-wise determinative. We suppose that a query q has a ground minimal answer E in P , and that P~ is a subprogram of ground(P) such that P ' ~ m i , q~. We must show that P~ is determinative. Since P is strongly SEI-eomplete, q has an SEI-proof A in P'. By the minimality of P ' ,

side(A) = P'. By L e m m a 3.13, P~ is determinative. III §4. S o m e P r o p e r t i e s o f C a s e - F r e e P r o g r a m s In this section, we identify some properties of case-free programs. Intuitively, casefree programs are programs that do not require case analyses in the construction of query proofs. The following definitions capture our intuitive notion of case analyses in the context of clause-based languages. (4.1) Definition. Suppose that a query K has definite answers in P. Then K is said to be directly case-dependent in P if for every ground definite answer cr of K in P, every Kcr-clause in ground(P) is nondeterminative in P. A query K is a direct-case consequence (dc-consequence) of P if some ground instance of K is directly case-dependent in some subset of ground(P). Intuitively, a unit query is directly case-dependent if every proof of it performs some case analyses, whereas it is a de-consequence if some proof of it requires case analyses. The word directly is not included in this picture, but it refers to the distance between case analyses and their consequences. For instance, K is directly case-dependent in the ground program P = {K ,--- A, K ~ -~A}, but B is not in P O {B ,-- K}. More formally, (4.2) Definition. Suppose that a query K has definite answers in P. Then K is said to be case-dependent in P if whenever pt ~ K ' for a ground instance K ' of K and a program P' C ground(P), P ' has some dc-consequences. A query K is a ease-consequence of P if some ground instance of K is case-dependent in some subset of ground(P). One point that may help to clarify the definition is that the set of all proofs of a query distributes, in general, over two dimensions: a query may have multiple proofs because it has different answers (answer locality), or even if it has a unique answer, it still may have multiple proofs computing the same answer (program locality). The following examples illustrate these points. (4.3) E x a m p l e . (program locality) Consider the ground program P = {K ~- A, K (-- -~A}. K is directly case-dependent in P, but not in P U {K}: one of the proofs of K (the trivial one) obviously does not require case analyses. On the other hand, K is still a dc-consequence of P U { g } .

96

(4.4) E x a m p l e . (answer locality) Consider the program P = {p(a) ~- q(b), p(a) ~ -~q(b)}. The query 3xp(x) is directly case-dependent in P but not in P O {p(b)}. Note that 3xp(x) is still a dc-consequence of P U {p(b)}. The relationship between case-dependency and case-consequence is analogous to that between direct case-dependency and dc-consequence. We now give a characterization of case-free programs as programs not having dc-consequences or indefinite answers. Some lemmas follow first. (4.5) L e m m a . If P is determinative, it has no dc-consequences. P r o o f . Suppose that P has a dc-consequence 3(K). Then some ground instance K ~ of K is directly case-dependent in some program P ' C ground(P). But, by Lemma 3.6, K j has an SEI-proof A in P~. Note that the first side clause, which is an K~-clause, is determinative in side(A) C P'. Thus, we have found an Kt-clause determinative in pt, contradicting the supposition that K ~ is directly case-dependent in pt. | For the next two lemmas, we adapt the notation, A(P), to denote the set of all A-clauses in P. (4.6) L e m m a . Let P be a ground program such that P ~min A for some ground literal A. Suppose that a ground literal B is a logical consequence of P different from A. Then - P - A(P) has no -,A-clauses, and - P-A(P)~B.

P r o o f . Note first that P - --A(P) ~ A. Then, by the minimality of P with respect to A, P = P - -~A(P), i.e., P contains no --A-clauses. To see P - A(P) ~ B, let A/[ be a model of P - A(P) in which B is false. Obtain A& from .hi by making A true. Then 2PV is a model of P since P contains no -~A-clauses. Since B is different from A, B is still false in M ~, which is impossible since B is a logical consequence of P. | (4.7) L e m m a . Let P be a ground program such that P ~mln L for some ground literal L. Then for every ground literal A which is a logical consequence of P but not a dc-consequence of P, P contains exactly one A-clause. P r o o f . Let PA be a subset of P such that PA ~ m i . A. If A is not a dc-consequence of P, some A-clause, say A (-- B1 ~ ... ~ Bn, in PA is determinative in PA- By Lemma 4.6, PA -- A(PA) has no -~A-clauses. So, each Bi is different from A. Then, by the same lemma,

PA - A(PA) ~ BI&...&Bn. Let P'=P-A(PA) U{A~B1 & . - - & B , }. Then every model of P ' is a model of P. Thus, we have P'~L.

97 By the minimality of P with respect to L, p ' = P, i.e., P has exactly one A-clause. II (4.8) L e m m a . Let P be a ground program, and A a ground literal. Suppose that P has no dc-consequences and P ~mi,, A. Then P is determinative. P r o o f . The proof goes by induction on the cardinality of P. Basis: P has exactly one clause. Since P ~ A, the only clause in P must be an A-clause. Call it CA. Since A is not a dc-consequence of P, some A-clause is determinative in P. Thus, CA must be determinative. Induction: P has n clauses, and the lemma holds for programs having fewer than n clauses. Since A is not a dc-consequence of P, P must have a determinative A-clasue,

CA = A *-- B I & " .&Bin, where P ~ B I & . . - & B i n . By the minimality of P and Lemma 4.7, P has exactly one A-clause. Thus P - {cA} ~ B l t z . . . * z B , , . Let Pi be a minimal subset of the set P {CA} that entails Bi. Since Pi has no dcconsequences, by induction, Pi is determinative. By the minimality of P with respect to the literal A, we have -

P = P1 U ' - " O P,, U

{CA}.

By Lemma 3.4, P is determinative. It (4.9) P r o p o s i t i o n . The following are equivalent. (1). P is case-free. (2). P has no dc-consequences, and no query has indefinite minimal answers in P. (3). P has no case-consequences, and no query has indefinite minimal answers in P. P r o o f . Since P has dc-consequences iff it has case consequences, the equivalence of (2) and (3) is clear. We will show the equivalence of (1) and (2). (1) ~ (2): By Lemma 3.11, every minimal answer in P is definite. So it remains to show that P has no dc-consequences. Suppose that P has a dc-consequence 3(K). Then some ground instance K ' of K is directly case-dependent in some P ' C_ ground(P). Let P " be a subset of P ' such that P " ~,,~,~ K'. Since P is case-free, P " is determinative. But then, we get a K'-clause in P " which is determinative in P", and hence, it is also determinative in P ' , contradicting the supposition that K ' is directly case-dependent in P'. (2) ~ (1): Suppose a query q has a ground minimal answer E in P . Since ~ is definite, it must be a singleton. Suppose that P ' C_ground(P) is a program such that P ' ~ q2C. Let q~3 = A18z... ~A,~. Then P ' contains an Ai-clause for each i, i.e.,

atom(q~) C atom(P'). So, P ' is well-informed. To see P is point-wise determinative, let pt C ground(P) be a program such that P ' ~mi,, A I & " " &An,

98 where Ai's are the same as above, for each i, let P~ C P ' be a program such that Since P~ has no tic-consequences, by Lemma 4.8, P~ is determinative. By the minimality of p l we have P ' = P~ U - . . U P ~ . But then by Lemma 3.4, P~ is determinative. Hence we have shown that P is point-wise determinative. II §5. C a s e - D e p e n d e n c y a n d S L D N F In this section, we gather some evidence that indicates that SLDNF is essentially a form of case-free inference procedure. (5.1) P r o p o s i t i o n . Let P be a positive program, and P any positive input representation of P. Suppose that a query K has an answer in P (and hence in comp(P) as well) but has no SLDNF-proofs in P. Then K is case-dependent in P. P r o o f . Suppose that K is not case-dependent in P. Then for some ground instafice K I of K and a ground program pt C ground(P) having no dc-consequences, P ' ~ K'. Then we get a subset pr, of P~ such that p1, ~ , , ~ K ' . Note that P~ still has no tic-consequences. Thus, by Lemma 4.8, P~ is determinative. Since P " is positive, it is a definite Horn program. Thus, K ~ has an SLD-proof in P", i.e., K has an SLD-proof in P. II The converse, however, does not hold. (5.2) E x a m p l e . Consider the ground program P = {K ~-- A, K ~ B, A V B}. There are three distinct positive input representations of P: P1 = { g ~ A, K ~- B, A +-- -~B} P2 = { g *-- A, K ~ B, B ~ -~A}

P3 = P~ u P2 Consider the query derivation. But, in closer examination P1 or P2, SLDNF are necessary for a

K, which is case-dependent in P. In P3, K has a non-terminating SLDNF either P1 or P2, K does have a successful SLDNF derivation. However,'a shows that this inference is not a result of sound case analyses: in either employs only two of the three clauses in the proof, although all of them sound case inference of K.

Of course, this example is not intended to question the soundness of SLDNF. We are only interested in formally estimating how negation-as-failure affects the computational upper bounds of SEI established previously. In this regard, it is interesting to note that the observation made in the example above does not generalize in all cases, i.e., in some cases, SLDNF infers a case-dependent consequence by using all clauses necessary for sound case inference. See the next example. (5.3) E x a m p l e .

99 Consider the program P = {q(a) V q(b), p(a) ~ q(z)}. As in Example 5.2, P has two positive input representations in which the case-dependent query p(a) has an SLDNF-proof. But, in this case, each proof utilizes all clauses of P. However, this example seems rather accidental. In support of this view, we present our final result. Some lemmas follow first. (5.4) L e m m a . Let P be a ground program, and K a ground literal. Suppose that K is a dc-consequence of P. Then P has two or more distinct K-clauses, or it has a K-clause having two or more occurrences of K. P r o o f . Suppose that P has exactly one K-clause, CK = K *-- B I & ' " . & B n ,

and that this K-clause has exactly one occurrence of K. Let P ' be a subset of P in which K is directly case-dependent. Since CK is nondeterminative in P ' , there exists a model f14 of P ' in which B l g r . . - ~ B n is false. Obtain .h4 t from .h4 by making K false. Since -~K does not appear in the body of CK, CK is still true in A4'. Likewise, any other clause in P ' is still true in .£4' since it has no occurrences of K. Thus, we have constructed a model of P ' in which K is false, contradicting the supposition that P ' ~ K. | The following is the key lemma in this section. (5.5) L e m m a . Let P be a ground positive program in an input representation. Suppose that a ground literal K is directly case-dependent in P, and that K occurs as the head of exactly one clause, CK. Then P contains a chain of clauses of the following form K ~-- . . . & H I & - - . / / 1 * - - - . . &H2&. --

Hn-l.*- ---&H~&.-. Hn ~- . . . & - ~ K & . . . .

P r o o f . Since CK is nondeterminative in P, P has a model M that makes at least one member of the body of CK false. Modify M by making K false. If this makes any clause of P false, modify M to make its head (Hn in the chain above) true, thereby making the clause true. Do this iteratively until K becomes true, in which case a chain of the desired sort has been constructed, or M becomes a model for P, which is impossible since K is a logical consequence of P. | The following is a known result[10, Lemma8]: (5.6) L e m m a . Let P be a ground positive program, and A a ground literal. Then if A has a finitely-failed SLDNF-tree in P, A is not a logical consequence of P. In the following lemma, we say an SLDNF-derivation or an SLDNF-tree refers to another SLDNF-derivation or SLDNF-tree if the latter is constructed for a negative subgoal appearing in the former. (5.7) L e m m a . Let A be a ground literal, and P a ground positive program in a positive input representation. Suppose that A has an SLDNF-proof A in P such that it has no

100

SLDNF-proofs in any proper subset of P. Then no two distinct clauses in P has the same head. P r o o f , First note that if A has a (successful) subderivation from H, it has no failed subtree rooted at H and vice versa. Also note that for each literal H appearing as a right-most subgoal in A, there is an occurrence of H, as a right-most subgoal, in a successful derivation or a failed tree which refers to no other successful derivations or failed trees having occurrences of H as a right-most subgoal. We refer to the subderivation (or the subtree) starting with this occurrence of H as a minimal subderivation from H (or a minimal subtree of H). Then if P had two or more distinct clauses with the same head H, we could remove all but one by replacing all subderivations from H (subtrees of H) by a minimal subderivation from H (a minimal subtree of H) to obtain an SLDNF-proof of A in a proper subset of P. II (5.8) P r o p o s i t i o n . Let P be a ground positive program in a positive input representation. Suppose that a ground query A is case-dependent in P. Then whenever A has an SLDNFproof in P, it also has an SLDNF-proof such that A is not a logical consequence of clauses of P used in this proof. P r o o f , Let pt be a minimal subset of P in which A has an SLDNF-proof. By Lemma 5.7, no two distinct clauses of P~ have the same head. Suppose P'~A. Since A is case-dependent in P, P ' has a dc-consequence K. Since

P' ~ K , P~ has a clause whose head is K. Then by Lemma 5.5, P ' has a chain of clauses of the form K ~-- . . . & t I l & . . . H1 ~ " " & H 2 & ' "

H,,-I ~---" & H , & . . . Hn ~ - . . . & - , K • . . . .

Since K is a logical consequence of pt, by Lemma 5.6, CK occurs in a successful derivation, not in a finitely failed tree. Thus, once CK occurs, all subsequent subgoals succeed. Recall that for each I t i , P ' contains exactly one clause whose head is Hi. Thus, every clause in the chain appears in the same successful derivation in which cK appears. But then the negative subgoal -~K must succeed, i.e., K must have a finitely failed SLDNF-tree in P, which is impossible by Lemma 5.6. | -

Conclusion

The main contribution of this paper is to show that it is possible to give explicit representation of negative information and manipulate it within the framework of SLD-like deduction, as long as we are dealing with case-free programs. In particular, case-free programs allow us to answer negative queries including non-allowed ones in a natural way as for positive queries. In fact, in case-free programs, negative information and positive information have the equal status. We have also shown that SLDNF is essentially a form of case-free inference just as SEI is. Thus, the essential difference between SEI and SLDNF is in their treatment of negative

101

information. Both have advantages and disadvantages, and the choice between the two seems to be application-dependent. A number of questions still remain unanswered. Some main questions are: 1 No satisfactory computational upper bounds of SLDNF have yet been discovered. Since case analyses by SLDNF are rather accidental, can we benefit from restricting our attention to case-free programs when we try to obtain better completeness results of SLDNF? 2 Are there interesting decidable subclasses of case-free programs? 3 What are the appropriate constraints on the use of the two kinds of negation in terms of operational semantics? 4 What are the model-theoretic properties of case-free programs extended through negation as failure?

References [1] Apt,K.R., Blair,H.A., and Walker,A, Towards a Theory of Declarative Knowledge, in Foundations of Deductive Databases and Logic Programming, J. Minker (ed.), Morgan Kaufman, Los Altos, 1987. [2] Blair, H.A., and Subrahmanian,V.S., Paraconsistent Logic Programming, Lecture Notes in Computer Science, vol. 287, pp.340-360, Springer-Ver!ag, 1987. [3] Kunen, K., Signed Data Dependencies in Logic Programs. Computer Science Technical Report :~719, University of Wisconsin-Madison, 1987. [4] Lloyd,J.W., Foundations of Logic Programming, Springer-Verlag, 1984. [5] Loveland,D.W., Mechanical Theorem Proving by Model Elimination. J. ACM, 1968. [6] Loveland,D.W., Automated Theorem Proving: A Logical Basis, North-Holland, Amsterdam, 1978. [7] Loveland,D.W., Near Horn Prolog, 4th International Conference in Logic Programming, Melbourne, 1987. [8] Loveland, D.W., Near-Horn Prolog and Beyond, Technical Report CS-1988-25, Dept. of Computer Science, Duke University, 1988. [9] Plaisted,D., Non-Horn Clause Logic Programming without Contrapositives, Journal of Automated Reasoning, 1988, in press. [10] Shepherdson, J.C., Negation as Failure: A Comparison of Clark's Completed Data Base and Reiter's Closed World Assumption, J. Logic Programming, 1984, pp. 51-79. [11] Shoenfield,J., Mathematical Logic. Addison-Wesley, Reading, Mass. 1967. [12] Stickel,M.E., A Prolog Technology Theorem Prover: Implementation by an Extended Prolog Compiler. Lecture Notes in Computer Science, No 230, pp.573-587, SpringerVerlag, New York, 1986. [13] Wakayama,T., and Payne,T.H., Case Inference in Resolution-Based languages. Lecture Notes in Computer Science, No 310, Springer-Verlag, New York, 1988.

G e n e r a l i z e d W e l l - f o u n d e d S e m a n t i c s for Logic Programs (Extended Abstract) Chitta Baral0)

Jorge Lobo(1)

Jack Minker0,2)

Department of Computer Science(1) and Institute for Advanced Computer Studies(2) University of Maryland College Park, Maryland 20742 Abstract We extend the well-founded semantics of Van Gelder et al. [12] so that it is able to reason through clauses instead of single literals. This is necessary to infer p to be true in the program {p ~-- a; p ~-- b; a ~-- -~b; b ~-- -~a}. We call this generalized semantics, the generalized well-founded semantics. We present fixpoint and model theoretic definitions for generalized well-founded semantics and show their equivalence.

1

I n t r o d u c t i o n and M o t i v a t i o n

Various approaches have been taken to characterize the semantics of general Horn logic programs that are not locally stratified.

This is because such programs do not have

a unique perfect model. Przymusinska and Przymusinski [7], give semantics to weakly stratified programs; Van G e l d e r et al. [12] introduce well-founded semantics(WFS) to handle the general case; Przymusinski [8] presents WFS in terms of three-valued logic; and Gelfond and Lifschitz [3] develop stable model semantics. However, some programs with intuitive meaning might not have a stable model. In addition, as shown below, WFS is skeptical in its approach and does not give the intuitive meaning of the program. Consider the program, { p ~-- a; p *-- b; a ~- --b; b ~-- -~a}. The WFS assigns unknown to all atoms in the program. This program has two minimal models, {{p, a}, {p, b}}. These models are also stable models. In this case, regardless of the model we choose as the intended meaning of the program, p is always true. Although one can safely assume p to be true, it is assigned unknown by the WFS. We extend the WFS, so that it is able to capture the intuitive meaning for programs similar to the above program. We refer to our approach as Generalized Well-Founded Semantics(GWFS) as it sometimes captures more information than given by the WFS.

103

2

Definitions

A general logic program is a finite set of clauses of the form A1 V . . . V A , ~- L1 A . . . ALm where n >_ 1, m >_ 0, the As are atoms and the Ls are literals. A general Horn clause is a clause where n -- 1. A general Horn program or a normal program is a general logic p r o g r a m that consists of general Horn clauses. A general disjunctive clause is one where n >_ 2. A general logic program is called general disjunctive if it contains a general disjunctive clause. We use the t e r m program to refer to both logic programs and general logic programs. T h e Herbrand Universe Up of a program P , is the set of all ground terms that can be formed from the constants and function symbols in P (if there are no constants in P an arbitrary constant is placed in Up). The Herbrand Base of a logic program P, HB(P), is defined as the set of all ground atoms that can be formed by using predicate symbols from P with terms from the Herbrand Universe Up as arguments [4]. The Extended Herbrand

Base, E H B ( P ) [6] of a program P is the set of all positive clauses that can be formed from atoms in the Herbrand Base. An Herbrand interpretation I for P is a subset of the Herbrand Base of P , in which all atoms in I are assumed to be true while those not in I are assumed to be false. A state S for P is a subset of the E H B ( P ) . A partial interpretation is a pair < T, F > where T and F are disjoint subsets of the Herbrand Base. The union of partial interpretations < T1, F1 > and T2, F2 > is defined to be < T1 U T2, F1 U F2 >. An a t o m belongs to a partial interpretation < T, F > iff it belongs to T U F . If A, R and G are ground atoms from the Herbrand base of program P, then valx(-~R) = "~val1(R), where -~t = f , -~f = t, -~u = u; and valx(A) is t, f or u if A E T, F or H B ( P ) - (T U E) respectively. An Herbrand model of P is an Herbrand interpretation of P that makes all clauses in P true. A model M is a minimal model of a program P iff M is a model of P and no proper subset of M is a model of P. Given a program P, H E R B ( P ) denotes the (possibly infinite) set of clauses that are ground instances of program clauses in P. For a set S of ground clauses,

can(S) = { C I C ~ S and tiC' s.t. C' e S , C' ~ C andC' # C }.

104

3

Background

Below we review the WFS for general Horn programs given by Przymusinski [8], and the semantics for disjunctive logic programs given by Minker and Rajasekar [6, 9]. Later, we extend the WFS to disjunctive programs using the concepts given in this section.

3.1

Fixpoint for Well-Founded Models

Let P be a program and I be a partial interpretation.

Intuitively, I represents facts

currently known to be false or true. Przymusinski [8] introduces the operators ~ and 5rx, where :ri (respectively ~'I) assigns to every set T(respectively F) of ground atoms a new set ~ ( T ) (respectively 9rx(F)) of ground atoms. ~ ( T ) (respectively ~'x(F)) contains new facts not contained in I, whose truth (respectively falsity) can be derived in one step from the program P assuming all facts in I hold and all facts in T are true (respectively all facts in F are false). Definition 3.1 [8] Let I be a partial interpretation, T and F be sets of atoms, and P be a general Horn logic program. :Tx(T) = { A : valx(A) 7~ t, call(A) 7~ f and 3B *- L 1 , ' " , Lm in P, such that for all i, 1 < i < m, LiO is true in I or LiO E T, and A = BO for a ground substitution 0}. .~x(F) = { A : vail(A) 7~ f , valx(A) 7~ t and for all rules of type B ~-- L 1 , " . , Lm and ground substitutions 0 where A = BO, at least one of the following two cases hold: 1. 3i : i < m and LiO is false in L 2. 3i : i < m and LiO E F } .

[]

In the original definition of Przymusinski [8], the restriction valI(A) 7~ f in the definition of TI(T) and the restriction vaIi(A) 7~ t in the definition of ~'x(F) do not appear. We later show, while proving consistency in Theorem 3, why we need these restrictions. Definition 3.2 [8] For a program P and partial interpretation I, T] ° = O; F}°= HB(P);

T] ~+1 = ~ ( T } ~ ) ; F) T M = f I ( F } " ) ;

T, = U,<~ T] ~ Fx =A,<~,FI1'~

[]

Definition 3.3 [8] Let Z be the operator assigning to every partial interpretation I of P a new interpretation Z(I) defined by : Z(I) = I U < TI; FI > •

[]

105

3 . 4 [8] Let 2}I0 = < 0, 0 > ; M . + I = Z(M~) = M . U < TM~;FM~ >;

Definition

M~ = U MZ, f o r limit ordinal o~. B
[]

The sequence {M,} of interpretations is clearly monotonically increasing, therefore there is a smallest ordinal 5 such that M~ is a fixpoint of the operator 2-. We call this fixpoint Mp.

3.2

Semantics for Disjunctive Logic Programs

Minker and Rajasekar [6, 9] provide a fixpoint characterization for derivability from a disjunctive program using a closure operator that maps states to states of a program. Definition

3 . 5 [6] ( O p e r a t o r

Tpz)

Let S be a state of a disjunctive program P, then TIp(S) -- ( C E S H E ( P ) I C' 4-- E l , . . . , Bn E H E R B ( P ) , Vi, 1 < i < n, Bi V Ci C S where Ci can be null, and C is the smallest factor of C 1 V C1 V ... V C~ }.

[]

The smallest factor of a ground clause C' is defined as the clause C such that C contains only distinct atoms and C logically implies C' and C' logically implies C. T~ is continuous and the least fixpoint given by TprT~ characterizes derivability from a ~II'w • disjunctive program P; i.e. If C C ~p If[ we can derive C from P. The fixpoint semantics

based on the operator TpI gives the same result as that of the operator Tp of [11], when operating on Horn programs. That is, the least fixpoint reached by the operator Tpz is the same as the least fixpoint reached by Tp for a Horn program P. Minker [5] defined a theory of negation for disjunctive programs 1 called the Generalized Closed World Assumption (GCWA). We present two equivalent definitions for the GCWA: Minker's definition [5] for GCWA, and Minker and Rajasekar's definition [6] based on the least fixpoint of TpI. Definition

3.6 (Semantic [5])

Let P be a disjunctive logic program (function-free) and C a ground atom. Then "~C can be inferred from P iff C is not in any minimal model of P. G C W A ( P ) = { C : C is not in any minimal model of P }.

D

1The definition is for function-free programs, but the restriction is not needed; see Shepherdson [10]

106

T h e o r e m 1 [6] Given a disjunctive program P, G C W A ( P ) = H B ( P ) \ { atoms in can(TIT~}.

4

[]

Generalized W e l l - f o u n d e d S e m a n t i c s ( G W F S )

Before describing the GWFS of a general Horn logic program we first describe the example given in the introduction and show why WFS is not able to give the intuitive meaning. E x a m p l e 4.1 Consider the general Horn. logic program, {p ~- a; p ~- b; a ~-- -,b; b ~",a}. The W F S assigns the truth value unknown to a and b. Even though a V b can be safely assumed to be true, W F S is not able to capture it. This is because it only deals with atoms. The well-founded model reasons forward and assumes p to be unknown since both a and b are unknown, since it does not capture the truth of a V b.

[]

If we want to assign true or false to some atoms that are assigned unknown by the well-founded model, we have to reason at the level of disjuncts in the way Minker and Rajasekar reason with disjunctive logic programs [6]. A general Horn logic program P provides syntactic information not present in the disjunctive logic program P~ deri.ved from P by transferring all negative literals in the body of clauses in P to their heads. This is because we want to minimize the true information derived from the program and maximize the false information assuming that, negated atoms in the body of a clause might have higher priority than atoms in the head when we assign truth values. These priorities are used to sort and select the set of minimal models that will characterize the intended meaning of P. We will show that partial models can be described as intersections of minimal models. We use this observation to define the GWFS. Our objective will also be to minimize undefined information. TI and FI are as defined in the previous subsection aaad taken from [8]. We now introduce T f , F F and :rE, where the superscript E, means we are extending the operators TI, FI and :Z'.

4.1

Fixpoint Semantics

Definition 4.1 D I S ( P ) a n d D i s ( P , I ) Let P be a general Horn program and I be a partial interpretation. The disjunctive transformation of the program P, D I S ( P ) , is the disjunctive program obtained by transferring

107

all negative literals in the body of clauses of P to its head. Dis(P, I), the disjunctive transformation of the program with respect to I, is a disjunctive program obtained by reducing the transformed clauses of D I S ( P ) as follows: 1. Remove atoms from the body of a clause if they are true in I. 2. Remove a clause if an atom in its head is true in I. 3. Remove atoms in the head of a clause if they are false in I.

[]

Definition 4.2 Fixpoint characterization of TE and F E

Let P be a program, I be a partial interpretation and Dis(P,I) be the disjunctive transformation of P with respect to I. We define the operators T E and F E is as follows. TIE = {A : A is an atom and A e can(TXD~(p,o T w) and A ~ I.}, i.e. TIE represents new atomic facts that can be derived from Dis(P,I). FIE = {A : A • GCWA(Dis(P,I)) and A ¢ I.} i.e. FIE represents new atomic facts that can be assumed to be false about Dis(P,I), by the GCWA.

[]

Let P be a program, I be a partial interpretation and D I S ( P ) the disjunctive transformation of P. We say a model M agrees with I, a partial interpretation, if all atoms true in I are present in M, and M1 atoms false in I are absent from M. We call the set of minimal models of D I S ( P ) that agree with I , as M M ( D I S ( P ) , I).

T h e o r e m 2 Relation b e t w e e n Fixpoint and M o d e l characterization

Let P be a program, I be a partial interpretation and D I S ( P ) the disjunctive transformation of P. 1. T~ is a subset of at least one of the minimal models of D I S ( P ) that agree with I. 2. F1 is a subset of at least one of the complements of a minimal model of D I S ( P ) that agrees with I. 3. A G TIE iff A belongs to all the minimal models of D I S ( P ) that agree with I. ~. A • F E iff A is absent in all the minimal models of D I S ( P ) that agree with I. Proof.'(sketch) 1. We prove by induction that A C (J0<~
108

A E T] '~ =o 3 B ~-- L 1 , ' . . , L , ~ in P, such that for all i, 1 <_ i < m, LiO is true in I

and A = B 0, for a ground substitution 0. By induction hypotheses or LiO C ~rt~-I ~x rp ~[n - 1

L~0 E ~I

=~ L~0 E M, and I C M. Therefore, A is true in M, otherwise M will not be

a model of DIS(P). 2. Similar to the proof of statement 1. 3. From the equivalence of fixpoint and model theoretic semantics of disjunctive logic programs. 4. From the definition of GCWA(Generalized Closed World Assumption)

[]

Definition 4.3 Let :rE be the operator assigning to every interpretation I of P a new interpretation :rE(I) defined b y : :rE(I) = IU < TI, FI > U < TE, FIE >. The superscript E, in the operators Z E, T E and FIE, denote that they extend the model defined by the WFS for general Horn programs.

[]

E x a m p l e 4.2 Let P = { e ~ -~d; a ~- ~b,d; b ~ -~a; p ~- a; p ~ b, ~c } and the partial interpretation I be < {d}, {c} >.

TI = O, F1 = {e}, the atom e can be assumed to be false as the body of the only rule with e as the head is false with respect to L Dis(P,I) = {a V b,p e-- a,p *-- b}.

TE = {p} as p can be derived from Dis(P,I).

Ff=O So z

W = < {p, 4 , {c, e} >.

Corollary 4.1 Given a partial interpretation I, then I C :rE(I).

[] []

Definition 4.4 Let M0 = < 0, 0 >; Mr+l = I E (Mr), i.e. Mc~+l = Mr U < TMo;FM~ > U < T ~E , F. ~ uE ~ >; M s = U Mz, f o r limit ordinal a.

[]

/3
The sequence {Ms} of interpretations is monotonically increasing. Then, there exists a smallest ordinal 5 such that M~ is a fixpoint of the operator Z E. We call this fixpoint M E. We now give an example which describes the fixpoint computation.

109

E x a m p l e 4.3 Let the program be: r 1 : a ~-- ~b

r 5 : e +- ',f~-~p

r2: b¢---~a

r6:fe-Re

r3 : p * - a

rT : q e - a

r4

: p +" b,-~c

rs : q + - b, f

The well-founded approach assigns the value unknown to all atoms, except c to which it assigns the value false.. We now compute the fixpoint with respect to the GWFS.

Mo = < 0 ; 0 > Other M[s are defined as Mi+l = MIU < TM,; FM, > U < TE,; F E, > TMo = T~o = F E o = { } FMo = {c}

MI-U<0;{c}>U<0;0>

=<0;{c}>

Dis(P, M1) contains the clauses {a V b; p ~-- a; p +- b} and p can be derived from Dis(P, M1). = {p}.

TM1 = FM, = FME1= {}.

M2=U<0;O>U<{p};0> F~

=

=<{p};{c)>

{e}

M3 = < {p}; {c} > U < q ) ; { c } > U < O ; O >

= < {p};{c,e}>

TM3 = {f}

M4 = < {p}; {c,e} > U < {f};¢ > U < {f,q};O > = < { p , f , q } ; {c,e} > M5 = M4 is the fixpoint. The reasoning is as follows. There is no clause with c in its head so c can be assumed to be false. This is captured by WFS. The first two rules of the program mean a V b is true. Since c can be assumed to be false, r4 means p e- b (we will now refer to it by r~). From rl, r2, r3, r~ we can safely assume p is true. This reasoning extends WFS, where any fact depending solely on p is assumed to be unknown. Since p can safely be assumed to be true, e can safely be assumed to be false by rs, the only rule with e in its head. By assuming e to be false, f can be assumed to be true by r6. By assuming f to be true and

110

using rl,r2,rr and rs, q can be assumed to be true. So we can safely give a value true or false to all atoms except a and b. As shown above, we obtain this truth assignment from our GWFS. The WFS being skeptical in nature, assigns the value unknown to all atoms except that it assign false to c.

D

T h e o r e m 3 Mfi is consistent.

P r o o f (sketch): Let M E = < T, F >.

As defined, M~+I = M~, U < TM~; FM~ > U

< TM~; FME >. If M E = M~ then clearly, W = U~<sTM~ U U~<~TME and F = Uc~<~FM~U

We will show by induction that for every n the following statement W(n) holds, where W(n) is the statement W(n) A F(n) = 0, where T(n) and F(n) are defined as follows: T(n) = U~<~TM~ U U~<~TE and F(n) = U~<~FM~ U U~<~FE For n = 0, it is true as W(0) and F(0) are empty sets. Assume that it is true for all n, when n < k. (Induction assumption) We will now prove that it is true when n = k + t. When n is a limit ordinal W(n) holds. Consider the case when n is not a limit ordinal. To prove W(k + 1) holds in this case we have to prove three statements. 1.

u

2. (FM~ U YEk)

n

F(k)

=

9.

rl

T(k)

=

O.

Statement 1 can be proved without using the restriction of vali(A) ¢ f in the definition of ~ ( T ) and the restriction of valr(A) ~ t in the definition of ~'~(F), given in Definition 3.1. If we use this restriction, it is easy to see that both statement 1 and statement 2 are correct. We need to use this restriction for the correctness of statement 2, because of programs like P, where P has only the clause p ~-- -- p. In this program TE0 is {p}. Hence, M1 --- < {p},0 >. But when we compute FM~ without the restriction of val~(A) ~ t in the definition of ~'z(F) we obtain FM~ ---- {p}, thus losing consistency. Hence we need the above restrictions in the definition of TI(T) and Y~(F). Proof of statement 8 C a s e 3.1 :TMEkA FMEh= 9. (by definition) C a s e 3.2 :TMk N FMEk= 9. (by statement 1 of Theorem 2) Case a . a

n FMk ----0. (by statement 2 of Theorem 2)

111

[]

Case 3.4 :TMk f'l FMk = ~. (proved in [8]). This proves that M E is consistent.

4.2

Model

theoretic

semantics

This section describes the relation between the minimal model of program P and the partial model M E . This relation is given by the perfect model semantics describe by Przymusinski in [8]. The difference between these perfect models and the ones described in [8] resides in the priority relation between the atoms in the Herbrand base of the program. The definition of dynamic stratification is essentially from [8].

Definition 4.5 (ef. [8]) The dynamic stratification of the Herbrand base of P, H B ( P ) , is a partition of H B ( P ) defined as:

S~ = TM,~U FM, U TEM,~U F~t¢,, for a <_ S~+1 = H B ( P ) - U S,~. We note by ~

the set H B ( P ) - U SZ and 5~ the set U~<~ S~, for a < 6 + 1. ~<_~

D

D e f i n i t i o n 4.6 Let M and N be two distinct models of a program P and -4 be a (priority)

relation between the ground atoms in the Herbrand Base of P.

We say N << M (N is

preferable to M) if, VA (a ground atom) in N-M, 3 a ground atom in B in M-N, such that A-
[]

The relation defined by the dynamic stratification forms a partial order among the minimal models of P. We want to characterize the semantics of a program by the set of "perfect" models under this ordering. The following definition allows us to transform a set of models into a partial model. D e f i n i t i o n 4.7 THREE(S)

Let P be a program and S be a set of partial interpretations (models) for P. We define the partial interpretation (model) of P with respect to S, represented as THREE(S) as a pair < T, F >, where T

= AM~S

M and F = HB(P)

- UMES

M.

[]

Definition 4.8 MINSET(P,c~) Let P be a program. MINSET(P,a) is a set of minimal models (MM is the set of all

112

minimal models of P) of P defined by: t. VM(M E m m =4- 3N(N E M I N S E T ( P , a)/~ N << M). 2. VM, N(M, U E M I N S E T ( P , c~), M ¢ N =>M ~< N, N ~ M). where the relation between the atoms A, B E HB(P) is defined by: A ~ B iffA E St and B E S,~ and 1 > m and m <_ a; where So... S~+1 is the dynamic stratification of the program P. We denote THREE(MINSET(P,i)) by < T[,F[ > and MINSET(P,6 + 1 ) b y Minset(P) where M E ~- Ms.

[]

The main result of this section is that the models in Minset(P) can bet transformed to MRE using T H R E E . L e m m a 1 a < fl ~ M I N S E T ( P , 13) C M I N S E T ( P , a)

[]

T h e o r e m 4 Given a general Horn program P and the sequence {M~}~=~.~=°

M~ C T H R E E ( M I N S E T ( P , a)). P r o o f i By induction, assume there is an ordinal fl such that for all ordinals a, a < /3,

M~ C T H R E E ( M I N S E T ( P , a ) ) . Assume first that/~ is a successor ordinal a + 1. We have two cases: (1) A is true in M~+I = M~ U < TM~;F~o > U < TMEo;FEo >. Then, A E 7~a U TME or A is true in M~. (1.a) Assume A E TM~ = U,<~T~ . By induction on i, we prove that A is true in

T H R E E ( M I N S E T ( P , a + 1)). For i = 0, T~, = 0 and there is nothing to prove. Assume now as induction hypothesis that for L E T~o,for some i greater than 0, L is true in T H R E E ( M I N S E T ( P , a + 1)). Let A be in T~ +1. Therefore, there exists a clause B ~- L 1 , . . . , L m in P and a ground substitution 0 such that for all j, 1 < j < m, LjO is true in M~ or LjO E T ~ and A = B0. By the general induction hypothesis if LjO is true in M~ then LjO is true in T H R E E ( M I N S E T ( P , a)). Then, LjO is true in every model in M I N S E T ( P , a). Therefore, by Lemma 1, Lj0 is true in every model in

M I N S E T ( P , a + 1). By the induction hypothesis in this part, if LjO E T ~ then LjO is true in M I N S E T ( P , a + 1). Hence, A belongs to every model in M I N S E T ( P , a + 1). Moreover, A is true in T H R E E ( M I N S E T ( P , a + 1)). (1.b) Let A E T E . By Theorem 2, A is true in every minimal model of DIS(P) that agrees

113

with M~. Therefore, by the general induction hypothesis M,~ C_T H R E E ( M I N S E T ( P , a)). Hence, any minimal model in M I N S E T ( P , a) will contain A, since these models agree with M~. Then, A is true in every minimal model in M I N S E T ( P , a + 1) by Lemma 1 making A true in T H R E E ( M I N S E T ( P , a + 1)). (1.c) It follows directly from Lemma t that A is true in T H R E E ( M I N S E T ( P , a + 1)) when A is true in M~. E . E (2) A is false in M~+I = M~ U < TM,,;FM~ > U < T ~ , F~/~ >. Then, A E FM,~UFEM~,

or A is false in M~. (2.a) Assume A E FM,~= ('1FIM~• By the inductions hypothesis we know that M~ agrees i_<w

with every model in M I N S E T ( P , a). Then, by Lemma 1, M~ agrees with every model in M I N S E T ( P , a + 1). It is easy to prove that there exists a minimal model N of P that agrees with M~+I. We prove that for every minimal model M where A is true, N << M.

Therefore, M cannot belong to M I N S E T ( P , a + 1). Hence, A is false in

T H R E E ( M I N S E T ( P , a + 1)). Let M be a minimal model of P that agrees with M~ such that A is true in M. Note that if M belongs to M I N S E T ( P , a + 1) then M has to agree with M~ (by the induction hypothesis and Lemma 1). Therefore, N - M _C So since N agrees with M~+a. We also know that A E M - N and A belongs to S~. Therefore, by the order associated to the atoms in IIB(P) by M I N S E T ( P , a + 1), for all atoms D in N - M, D -< A. Then,

VD E N - M 3A E M - N(D-.< A). H e n c e N < < M . (2.b) Let A E FME. By Theorem 2 A is false in all minimal models of DIS(P) that agree with M~ and by the induction hypothesis M~ C_ T H R E E ( M I N S E T ( P , c~)), hence A is false in any minimal model in M I N S E T ( P , (~), as these models agree with M~. Then, A is false in all minimal models in M I N S E T ( P , ~ + 1) by Lemma 1 making A false in

T H R E E ( M I N S E T ( P , c~+ 1)). (2.c) It follows directly from Lemma 1 that A is false in T H R E E ( M I N S E T ( P , c~+ 1)) when A is false in M~. Consider the case when /3 is a limit ordinal. If A is true in M~ then A is true in U~
114

by Lemma 1.

[]

T h e o r e m 5 /~br any ordinal ~, THREE(MINSET(P, ~)) C_M~+~. Proofi Let M z be < T~, F z > for any ordinal/3 < ~ and recall that THREE(MINSET( P,fl)) = < 2r~,F~ >.

By Theorem 4, M~ C THREE(MINSET(P,a)).

Therefore,

T~ C T~ and Fs C_ F£. By the monotonicity of 2-E, we know that Ts C T~+I and Fa C Fs+l(1) Let A E T ' .

I r A E Ts t h e n A E T.+I. A s s u m e A ~ T ~ . A ~ F s

s i n c e / ~ C /~"

and then I s" N F~'i ¢ O. Then A ¢ T~ U Fs = S~. Hence A E So = S,+1 U Sa+l" If A E Ts+l there is nothing to prove. A ~ F,+I since F~ C_ F£' and T~' C_ Tat+l, then ! t A E rT~'+~ A F'+IIf A E S~+1, recall that Ms+l = Ms U < TM~,FM~ > U < Tiffs, FE~ >.

Therefore by the definitions of l ~ and F E, there is a positive clause C such that A V

C E can(TDi4p,M.) T w). Otherwise, either A E can(T~i4p,M.) T w) and A E T~+I or A E GCW A( Dis( P, M~)U Ma) and A E F,+I. Since A V C E can(TD~4p,M.) T w) we can find two minimal models for Dis(P, Ms), one where A is true and C is false, and other where A is false and there is an atom B in C that is true. Therefore, there are two minimM models M1, M2 for P such that TsUTM~ UTEM~C M1, 1142,i.e. T~+I C M1, 1142.

M2-M1 C S~+1. Hence, there is no atom D E M2-M1 such that A -< D with respect to the order defined by MINSET(P, a). Therefore M~ ~ M2. A E M1 -M2, A E S,+t and

Similarly, B E M2 - tl//1, B E Ss+l and M1 - M2 C_ S~+1. Therefore Me ¢: M1. Then, if there is a model M~ that contains A in THREE(MINSET(P, a)) then there is a different model M2 in THREE(MINSET(P, a)) that does not contain A. Hence, A ¢ T~ which contradicts our initial assumption that A E 2r~. Hence, A ¢ Ss+l. This proves that if A E 2r~ then A E Ts+l. (2) A E F~'. Similar to part (1).

[]

T h e o r e m 6 M E = THREE(Minset(P)) Proof: Follows directly from Theorems 4 and 5.

5

[]

Discussion

Well-founded semantics is conservative in specifying the semantics of some programs that are not stratified. Consider the following program: {c e-- ~d; d +-- ~c; p *- c; p e-

115

d}.

Well-founded semantics correctly characterizes c and d as unknown, but fails to

characterize the indefinite information that c V d is true and hence is unable to assume p to be true. Generalized well-founded semantics assumes that c and d are undefined but retains that c V d is true and hence infers p to be true. Consider the following program: {a e- -,b, c, d; b e- --a; c ~-- -~d; d *- -~c}. c A d is false in all minimal models of this program. Therefore, it is reasonable to assume that a is false and b is true. But the Generalized well-founded semantics presented in this paper is not able to infer a to be false and b to be true for the above program, although it is able to infer a to be false and b to be true for a simple variant of the above program, given to be: {a ~--15, e; e ~ c, d; b e - - - - a ; c * - ~d; d ~ - - c } .

In [1] we describe a

semantics based on positive disjunctive clauses and conjunctions of positive atoms general enough not only to characterize this semantics but to extend the well-founded semantics to general disjunctive programs. We also present in [1] a procedural semantics for the extended semantics and show how to restrict the procedure to compute the generalized well-founded semantics. Since the procedure handles not only atomic but also disjunctive information factoring and bookkeeping for ancestry resolution are needed. In addition, the deduction of negative information is obtained using the GCW\~ which was proved to be more complex than the Closed World Assumption [2].

Acknowledgements We wish to express our appreciation to the National Science Foundation for their support of our work under grant number IRI-86-09170 and the Army Research Office under grant number DAAG-29-85-K-0-177.

References [t] C. Baral, J. Lobo, and J. Minker. Generalized disjunctive well-founded semantics for logic programs : Declarative semantics. Submitted to ICLP 90. [2] J. Chomicki and V. S. Subrahmanian.

Generalized closed world assumption is lr°

complete. Technical Report T R 89-036, Department of Computer Science, University of North Carolina at Chapel Hill, October 1989.

116

[3] M. Gelfond and V. Lifschitz. The ~Stable Model Semantics for Logic Programming. In R.A. Kowalski and K.A. Bowen, editors, Proc. 5*h International Conference and Symposium on Logic Programming, pages 1070-1080, Seattle, Washington, August 15-19 1988. [4] J.W. Lloyd. Foundations of Logic Programming. Springer-Verlag, 1984. [5] J. Minker. On Indefinite Databases and the Closed World Assumption. In Lecture Notes in Computer Science 138, pages 292 308. Springer-Verlag, 1982. [6] J. Minker and A. Rajasekar. A Fixpoint Semantics for Disjunctive Logic Programs, 1990. To appear in Journal of Logic Programming. [7] H. Przymusinska and G. Przymusinski. Weakly Perfect Model semantics For Logic Programs, December 1986. Extended Abstract. [8] T.C. Przymusinski. Every Logic Program has a Natural Stratification and an Iterated Fixed Point Model. In "P,vceedings of the 8th ACM SIGACT-SIGMOD-SIGART Symposium on Principle of Database Systems", pages 11-21, 1989. [9] A. Rajasekar. Semantics for Disjunctive Logic Programs. PhD thesis, University of Maryland, Department of Computer Science, 1989. [10] J.C. Shepherdson. Negation in Logic Programming. In J. Minker, editor, Foundations of Deductive Databases and Logic Programming, pages 19-88. Morgan Kaufman Pub., 1988. [11] M.H. van Emden and R.A. Kowalski. The Semantics of Predicate Logic as a Programming Language. J.ACM, 23(4):733-742, 1976. [12] A. Van Ge]der, K. Ross, and J.S. Schlipf. Unfounded Sets and Well-founded Semantics for General Logic Programs. In Proc. 7*h Symposium on Principles of Database Systems, pages 221-230, 1988.

Tactical Theorem Proving in Program Verification M. Heisel W. Reif W. Stephan Universit~t Karlsruhe Institut fOx Logik, Komplexit~t und Deduktionssysteme Postfach 6980, D-7500 Karlsruhe

Abstract A "shell"for program verificationand developmentis presented whichis obtainedby using a variantof Dynamic Logic in combination with tactical theorem proving. This shell (.K_.arlsruheInteractive Verifier) allows easy implementationsof various strategies which are guaranteed to be correct with respect to the basic logic. It is shown how tactical theoremprovingis adapted for the abovepurposes.

1 Introduction In this paper we describe how the paradigm of tactical theorem proving is used in the Karlsruhe Interactive Verifier (KIV) to realize a "verification shell" which allows the informed user to implement various verification and program development strategies within a common logical framework. These strategies can then be used without any deep knowledge of the KIV metalanguage (_Proof_Programming Language) or the underlying logic. Starting with Edinburgh LCF, [GMW 79], a large number of systems have emerged in the last ten years that use tactical theorem proving. The common basic idea of all these systems is that they offer the user the possibility to program extensions of some basic formalism. They consist of a metalanguage that allows to represent and manipulate formulas, (proof-) rules, and whole proofs of the underlying logical system. Among other things, this metalanguage enables the user to write programs (tactics) which generate subgoals from a given goal. All the systems guarantee soundness by built-in mechanisms which make sure that all derivations obtained by using tactics can be transformed to proofs using only basic rules and axioms. Large proofs are typically generated in an interactive way. But since the user relies on a (possibly large) database of tactics and lemmata, these systems are far away from being simple proof-checkers. Among the systems based on the paradigm of tactical theorem proving are the Cambridge LCF system, [Pa 87], which like Edinburgh LCF can be used for proofs about complex functional programs, the Nuprl system, [Co 86], for proofs in constructive type theory, the ~Prolog system, [FM 88], which extends Prolog by )~-terms, and the Oyster system, [Bun 89], which is similar to the Nuprl system and uses Boyer-Moore-like heuristics, [BM 79], to synthesize functional programs. One major application of systems for tactical theorem proving has been the generation of completely formal versions of complex proofs. To perform this task the user is provided with a system, which as the authors of [Co 86] put it, "helps fill in the details and keeps track of the

118

proof obligations that must be met at the critical points of an argument." A good example of such a proof is given in [Mu 84]. In contrast to that, proofs about realistic programs rarely require deep mathematical results. Nearly the same holds for the derivation of special proof rules from a general axiomatization. We are trying to build an environment which makes proofs about individual programs as well as the development of entire proof strategies routine tasks. In a first step the KIV system uses tactical theorem proving to derive special calculi (for program verification and development) from a powerful general logical formalism. The reduction of the logical building blocks of a special method, like for example Burstall's strategy for proving total correctness assertions, [Bur 74], [HRS 87], to the basic formalism is carded out completely automatically. Our main interest is to guarantee the soundness of the newly added rules and tactics, since as anyone will agree, a flexible verification system where one experiments with numerous proof-rules makes no sense if there is not a rigorous proof for each of them. To people concerned with the verification or development of individual programs the KIV system offers a (growing) collection of strategies which leave to the user only the key decisions of a proof. Typically these strategies ask the user for invariants or inductive hypotheses. In most cases when the strategy has worked through a program some first-order verification conditions remain to be proven. In principle this can be done within the KIV system itself since we have implemented some versions of a theorem prover for first-order logic. However, it seems to be an interesting topic to combine our system with classical provers or simplifiers. We use Dynamic Logic (DL) as the object language. Since DL allows formulas of the form let]to, where ct is a (PASCAL-like) program, this language exhibits a much richer syntactical structure than do most of the other formalisms. The soundness of rules and tactics very often depends on syntactic restrictions for the programs involved. Although no deep mathematical insight is required, without long and tedious proofs these restrictions are subject to subtle errors. Most calctfli for DL or Hoare-like languages known from the literature are designed only for one special proof strategy. We have therefore developed a technique for axiomatizing programming languages, see for example [HRS 89], which is flexible enough to serve as a basis for a universal verification system. This technique incorporates the basic ideas of uninterpreted reasoning as described for example in the book of Goldblatt, [Go 82]. Although proofs in this system, if carded out on paper, are completely intractable, it has turned out that in combination with tactical theorem proving our axiomatization can be used as a basis for all sorts of verificaction and development strategies. The paper is organized as follows. In section two we outline the basic properties of our calculus and explain why this sort of axiomatization is needed for our purposes. In section three we introduce some technical details of our metalanguage PPL which are relevant for the rest of the paper. In section four and five we present two specific aspects of our system, the role of validations and the use of metavariables for the development of programs. We finish with a discussion of strategies, which are programs controlling the use of the basic logical building blocks of a method.

2 Dynamic Logic 2.1 Syntax, Semantics and Expressibility Dynamic logic extends ordinary predicate logic (PL) by formulas [ct]to ("box ct 9") and (o~)q0 ("diamond tz to"), where o~is a program, and to is again a DL-formula. The intuitive meaning of

119

[cx]q0is: "if cx terminates, q~holds after execution of ~ ". The formula (ct)q0 has to be read as: "o~ terminates and q~holds after execution of cx" The programs that may occur in such program formulas are taken from the following PASCAL-like programming language. We consider skip, abort, assignments, conditionals, while loops, local variables and mutually recursive procedures. For local variables, procedure declarations, and procedure calls we use the following syntax:

var Xl='C1 ; ... ; Xn='Cn in cz proe pl ~ ~.(xl:Yl).O~l ; ... ; pn ~ ~L(Xn:Yn).O~n in ¢z

p(x:z).

In the declaration of local variables x i is initialized to the value of x i. In the procedure declaration x i and Yi are the lists of the formal value and variable parameters respectively and o~i is the procedure body. The construct ~.(xi:Yi)Azi is called an abstraction. In the procedure

call, and z are the lists of the actual parameters. The occurrences of variables following the symbols "~L"and "var" are binding occurrences. The scope of these binding occurrences is defined in the usual way. An occurrence of a variable inside the scope of a binding occurrence of that variable is called bound. In D L many interesting properties of programs are expressible. For PL-formulas q~ and ~, the formula ¢p --~ [¢x]~ corresponds to the well known partial correctness assertion q~{ot}~. Total correctness assertions, q~ --->(o~)~, are obtained by using diamond formulas instead of box formulas, and the equivalence of two programs cx and 13with respect to a program variable x is expressed by an equivalence between two diamond formulas: (cz)x=x' 4-> (13)x=x'. More general relations between programs can be expressed by implications between diamond formulas: (o~)rp--> (13)~. Such formulas are used, for instance, to express the correctness of the implementation of abstract data types.

2.2 Interpreted versus Uninterpreted Reasoning For our aim, namely to provide a tool for implementing arbitrary verification and synthesis methods, the choice of the basic calculus plays a crucial role. It should be flexible enough to simulate many different "special purpose" calculi for specific verification methods. In the sequel we take a look at the calculi available from the literature and motivate our choice in the KIV system. The difference between the known axiomatizations is what David Harel [Ha 79] calls interpreted versus uninterpreted reasoning. In the case of interpreted reasoning we have in mind a fixed interpretation of the data structures the programs operate upon. There exists a surprisingly simple axiomatization for interpreted DL due to Harel. The central idea is to reduce statements about programs to statements about the data. Harel proves this calculus to be arithmetically complete, i.e. the formulas valid in an arithmetical structure are exactly those derivable in the calculus from the first-order theory of that s~ucture. Besides the axioms for propositional logic, in Harel's calculus there are the substitution axiom for assignments and the axioms for compounds and conditionals: [x:=zlq~ ~ q~xz

,

where q~is a PL-formula such that x does not occur free in the scope of a quantifier which binds variables from x. Cxx denotes the formula obtained from q~by the substitution of x for all free occurrences of x.

120

[~;13]q~ <--> [~][[~](P [ifetheno~else~fi]cp ~-~ (e--> [c~]q0)A (-~e---> [~]qO) The inference rules are modus ponens, modal quantification, existential quantification, the invariance rule and the convergence rule: cp(n+l) --->(e ^ (ot>q~(n)) I cp(0) --> -,e , where ¢pe FL with free n, n~ Var(¢x). cp(n) --~ (while e do c~) (p(0) The convergence rule relates the control structure to the data structure. The user has to supply a convergence formula q~(n). Roughly, cp(n) is a first-order description of what happens to the program variables if the loop continues for n further iterations. The convergence rule makes the calculus what it is, namely one for interpreted reasoning. It is the only rule which is sound only in arithmetical structures. Although the calculus is simple and has nice theoretical properties, it is not suitable as the basis of a verification system because of some severe practical drawbacks. These are illustrated by the following example. Consider the two programs prog 1 and prog2, which both operate on the integers: prog 1 : h:= x; prog 2 : h:=x; {while 3 } while h;~0 {while 1 } while h~0 do {bdY3} y:= y+h; z:= h,z; h:= h-1 od do {bdYl} y:= y+h; h:= h-1 od {end of while 1} {end of while3 } h:= x; {while2} while h~0 do {bdY2} z:= h,z; h:= h-1 od {end of while2} The first loop in prog 1 counts down h from x to 0, summing up the intermediate values of h in the variable y. Then the same is done in the second loop with multiplication and the variable z. Since the two loops do not interfere with each other we can merge them into one, which is slightly more efficient. At this point probably every programmer would agree that the two programs are equivalent despite the sparse explanations given so far. This is obviously due to a programmer's familiarity with control structures. Formally, the equivalence can be expressed by (progl)E ~ (prog2)E, where E = h=h 0 A X=X0 ^ Y=Y0 A Z=Z0. A formal proof in the above system requires several applications of the convergence rule. The user has to supply the corresponding convergence formulas cp(n). One of them is cp(n) .~ ( h0=0 ^ h=n A y0=y+(n*(n+l) )/2 ^ z0=z,n! A X=X0 ) . This application of the convergence rule leads to the following two verif'lcation conditions in the proof, which are both true in the integers: h=n+l ---> ( ( n + l ) * (n+2))/2 = h + ( n * (n+l))/2 ) h=n+l

--~ ( h , n ! = ( n + l ) ! )

.

So far everything seems to be completely fine, but there is something special with this proof. First we left the original signature and introduced the factorial function and the integer division

121

by 2 in order to express the convergence formula. Furthermore, the verification conditions are very misleading. They suggest that the "deeper" reason for the equivalence of prog 1 and prog 2 is somehow related to the above properties of the factorial function and the sum of the f'~rst n integers. This impression is definitely wrong. The equivalence does not rely on any arithmetical property and even holds in any data structure. This means, that during the proof, verification conditions (proof obligations) arise, which stem from the proof technique and not from the theorem. From a practical point of view, this situation is very unsatisfactory. The calculus is based on one hard-wired proof technique, using invariants and convergents, and ignores knowledge about control structures. To avoid this drawback, we have adopted a calculus for uninterpreted reasoning. In this case all the axioms and inference rules are sound in any data structure. The effects of programs are expressed in terms of other programs. The basic guideline for the following axiomatization is Goldblatt's system for uninterpreted reasoning [Go 82] and can be found in [Re 84], [St 85] and [HRS 89].

2.3 The Logic Underlying the KIV System In addition to the above substitution axiom for assignments and the decomposition axioms for compounds and conditionals which are the same as in Harel's axiomatization, we have algebraic computation rules for assignments, like [x:=x][x:=a]q) --> [x:=ffxX] q) and [x:=x][y:=G]q) --> [y:=axX][x:=x]q), where y not in x:=G. The first one, for instance, states that two assignments to x are the same as a single one with x replaced by "c in ff. In order to capture the while loop, we use an auxiliary counter structure which is not at the programmer's disposal. This counter structure with a constant zero and a successor function next is used to talk about the number of iterations of a while loop. The i-th approximation of a while loop, (while e do ~ od$i), is a program which simulates the loop iff the loop terminates after exactly i iterations. A statement about a loop then holds iff it holds for every such approximation. Consequently, statements about loops are proved by induction on the approximations. The axiom for the while-loop is: [while e do a od]q~ ~ Vi. [while e do 0~ od$i]q~ For the i-th approximation of a while loop we have the following schemes: [while ¢ do 0~ odSzero]q) <--->~c-->q)

[while ~ do o~ odSnext(i)]q~ <-> l i f e then o~ else a b o r t fi][while ¢ do c~ od$i]q~ For recursive procedures, we also add an auxiliary structure to the logic, namely environments, which are tree-like objects. The actual axiomatization captures higher-order procedures. Here we only consider the simpler case where there are only call-by-value and call-by-reference parameters. In this case environments are only used to store procedure definitions. Now, commands arc always considered together with an environment (e I c~) (e omitted if irrelevant). Environments arc needed to talk about the fixed-point environment e' with respect to some current environment e and a set of new mutually recursive declarations 8 . The n-th approximation of the fixed-point environment with respect to e and 8 is an environment term, able to simulate the behaviour of the new definitions iff during execution there are no more than n recursive calls of the procedures which arc declared in 5. The predicate Aps(e,e') is true if e' is an approximation of the fixed-point environment with respect to e and 8. A statement about a procedure declaration evaluated in some environment e holds iff it holds for the main program in every ap-

122

proximation of the fixed-point environment. Consequently, statements about declarations are proved by induction on environments. This is reflected by the following axioms for procedure declarations and calls : [(e I proc 8 in o~ )]qo 4-~ Ve'. ( Ap8 (e, e') --~ [(e'l a)]qo ) [(e[p/(ell )~(x:y).t~)] I p(x:z))Jcp <---> [Ul:=Z 1] ... [Un:=Xn][(e1 I a'xUyZ)]tP , where u - (u 1..... Un) is a vector of pairwise distinct fresh variables and t~' is obtained from 0~ by a suitable renaming of the bound variables in a in order to avoid a binding conflict when the elements of z are substituted for all free occurrences of the elements of y. Note that we use the inner environment e 1 for o¢. The expression e[p/(ell ~(x:y).o0] denotes an environment which is like e except that p is bound to (the closure) (ell ~(x:y).a). If there is no entry for p in the given environment a call of p leads to abortion.

2.4 The Example Revisited In the rest of the section we sketch the top level steps of a proof of the above example. We write a ={x 1.... Xn} [3 if 0t and 13 terminate on the same inputs and produce the same outputs with respect to the variables {x 1.... Xn}. The notation is an abbreviation for the DL formula (o~)E +-->(13)E, where E = (Xl=Xl') ^ .. ^ (Xn=Xn'). In this notation the claim takes the form progl ={x,y,h,z} prog2. Suppose we already knew the following lemmata: 1) while 1 ={x,y} while3 and 2) while 2 ={x~,z} while3. Then we may argue as follows: The first program does the same as its first half with respect to x and y. This yields prog 1 ={x,y} (h:=x ; whilel). We apply lemma 1 and replace while 1 by while 3 getting prog 1 ={x,y} (h:=x ; while3). The right-hand side is already prog2, giving prog 1 ={x,y} pr°g2- Analogously the first program does the same as its second half with respect to the variables x, h and z. This yields prog 1 ={x,h,z} (h:=x ; while2) We apply lemrna 2 and replace while 2 by while 3 getting prog 1 ={x,h,z} (h:=x ; while3). Again the right-hand side is already prog 2 and hence prog 1 ={x,h,z} prog2- Together we have prog 1 ={x,y,h,z} prog2. Finally, we prove the two lemmata by induction on the number of iterations. Of course, behind every proof step above, there is hidden a number of other proof steps. But neither the ones shown nor those that have been omitted involve any property of the integers.

2.5 Simulation of Other Logics Besides the possibility of reasoning on the level of control structures, like in our example above, the main advantage of a calculus for uninterpreted reasoning is its flexibility and its deductive strength. By adding nonlogical DL-axioms, many known calculi for specific verification methods can be simulated with our logic. Among these calculi are, for instance, Haters calculus for Deterministic Dynamic Logic mentioned above, Hoare's logic, Manna's system for total correctness and Burstalrs intermittent assertion method (see [HRS 89] for more details). This flexibility is an important premise for building a verification tool like the KIV system.

3 PPL The KIV system is based on a sequent calculus. The most important data structure of PPL are proof trees whose nodes consist of sequents. The proven sequent is the root of the tree and

123

the leaves are either axioms or premises. Thus, proof trees represent partialproofs. It is an important feature of PPL that we allow schematic objects: There are metavariables for each syntactic class. Metavariables will be denoted by names prefixed with "$", while we continue to use greek letters for arbitrary syntactical objects which may or may not contain metavariables. So, for example, we have the following axiom scheme for the sequential composition of programs [$C1 ; $C2]$F ~ [$C1] [$C2]$F . From the context, the system knows that $C1 and $C2 are metavariables for commands while $F is a metavariable for a formula. Apart from the axioms for the programming language, which are all of the form as the one given above, we have the usual rule schemes, like $G F- $ F I , $ D I $G ~- $ F 2 , $ D $G ~- $ F I ^ $ F 2 , $ D If a basic rule has an associated variable condition (quantifiers and modalities) this is checked by built-in programs. Rules are proof trees of height one. New proof trees can be generated by operations called infer (x, [i 1.... in], Ix I .... Xn]) and refine (ffl, i, ~2). The infer operation performs a forward proof step by using the conclusions of n proof trees x 1..... xn as premises of a proof tree x yielding a new conclusion. The refine operation performs a backward proof step by replacing one premise of a proof tree ~1 by a proof tree if2 yielding the premises of if2, as new subgoals. Both operations use matching: the proof trees x and ~2 can be considered as generalized inference rules and thus are instantiated by applying a matcher O to some of the metavariables. O satisfies the following conditions: the ik-th premise of O(x) is equal to the conclusion of xk for k=l ..... n (infer), or the conclusion of ®(~2) is equal to the i-th premise of ~1 (refine). We use matching instead of unification to avoid undesirable instantiations o f metavariables, for instance in equivalence preserving proof steps. PPL allows an arbitrary combination of forward and backward proof steps. In addition to the basic rules the user may define derived rules. Derived rules have to be supplied with a validation which is either a proof tree which fits the rule or a PPL-program. This program, when started by the command validate_rule, takes as arguments the premises and conclusion of the rule, which may have been instantiated in the meantime, and tries to generate a fitting proof tree. Usually, to prevent the validation from failing, it will be necessary to instantiate (by infer or refine) at least some of the metavariables occurring in the rule. Even if there are no open premises, a proof tree does not represent a proof as long as there are validations which have not yet been executed. The use of derived rules has turned out to be a good means to structure proofs. For our backtracking facilities see section 6.

4 Validations As mentioned above, derived (or user-defined) rules which are the basic building blocks of our tactics have to be supplied with a validation. In many cases, the rule schemes are not supposed to be valid for all instantiations. Validations are therefore used to check various

additional constraints.

124

Since programs are part of our formulas, we are faced with a much richer syntax than in most other formalisms. Especially in the case of rules for recursive procedures it has turned out that we have to handle very complex variable conditions which can be shown to be sufficient only by formal proofs. Indeed, many of our fh'st guesses about these conditions were wrong. The same holds for some rules we adopted from the literature. Recall also that we are talking about a system where the design (or redesign) of proof-rules is a frequent activity. Our solution is to abandon the explicit formulation of variable conditions (except for expositional purposes) and instead to write validations that establish these constraints a posteriori. If a validation terminates without failure it generates a proof for the instance in question. It has turned out that validations for these purposes can be implemented in a relatively short time and that they work with reasonable efficiency as compared to standard test programs, written for example in LISP, which however are subject to logical errors. What one needs to obtain well structured solutions is a whole hierarchy of derived rules together with their validations. A characteristic feature of uninterpreted reasoning is that we manipulate programs in the same way as we use algebraic laws to transform expressions. The implication

F

[x:=x][(x] q) ---) [%Xl[x:---x] ~0

is needed in many validations that check variable conditions. For commands ct without declarations,

(ZxX denotes the command which results from (x by substituting x for all

occurrences of x in expressions in c¢. In addition in c¢ there must be no assignments to variables from x:=x. In the following we describe the implementation of a function commute, that, given (concrete) x, x, c¢, and (p, generates a sound instance of this lemma (rule without premises) together with its validation. If the condition is not satisfied, commute fails. We outline the proof generated by the validation. This validation can be structured like a metalevel proof which uses induction on the structure of commands, as it is the case with many others. Instead of using the inductive hypothesis we apply the rule recursively to subcommands. Each layer in the proof tree generated by the validation then corresponds to the inductive step according to the shape of the given command. We start with the axiom

[x:---x][(x] ¢p F

[x:=x][ct] (p

In the case where c¢ - (130 ; 131) we transform the composition axiom into $G ~-

[$C1;$C2] $F

$G t-

[$C1][$C2] $F

by the function mk_srule. From [x:---~][[30;~l] ¢p F-

[x:--x][[30][131](p we get

[x:---~][130;131]q) ~-

[130xX][x:=x][131] q)

by using mk_srule(commute(x, x, 130,(p)) . The function prefix, given a list of commands (ix0 . . . . (xn) as a f'rrst argument, transforms an implication t--

(p --~ ~g

into

t--

[(x0] ... [0tn] (p ---) [(x0] ... [ctn] N/

An application of the rule mk_srule(prefix([~O xX], (commute(x, x, 131, (p))) yields [x:='T][I]o;131] (P J-

[~Ox'~;~1 x't'][x:--'l:] (P

125

In the case where ~ = while e do [~ od we have to use induction on counters. In the inductive step we have to derive the sequent [x:=x][while e do [5 od,].next(i)] cp, Hyp F-

[while £xx do 13xXod.l.next(i)][x:=x] cp ,

where for {Yl, -. ,Yn} = V a r ( [x:=x][while e do [5 od] ~p ) , Hyp is the formula V(Yl . . . . Yn). ( [x:=x][while £ do [5 od$i] ¢p --> [while exX do [sxx od$i][x:=x] q~ ) . Using the scheme for approximations (see section 2) we immediately get [x:=x][while e do [5 odSnext(i)] cp, Hyp J-

[x:=x][if E then [5 else abort~fi] [while e do I~ od$i][x:=x] ~p By the rules for the conditional and mk_srule(commute(x, x, [5,cp)) we get [x:=x][while e do [5 odSnext(i)] (p, Hyp J-

[if ExX then [sxx else abort fi][x:=x][while e do [~ od$i][x:=x] ~p By a rather special rule for applying the inductive hypothesis we then get the desired result. The condition that there must be no assignments to variables in x:=x is checked in the proof for the case where cx -= y:=c~. Here we use the second axiom given in section 2.3. Variable conditions for basic rules are implemented directly in LISP.

5 Metavariables A very special feature of the KIV system are the metavariables. Sequents may contain metavariables for any syntactic category like formulas, terms, programs and so forth. They act as placeholders which may become instantiated later. This feature allows to specify and to prove schematic statements. For instance, the basic rules schemes of our calculus are represented as schematic proof trees of height one, and, conversely, each schematic proof tree can be used as an inference rule. In the KIV system metavariables are used for several purposes: Statements can be generalized by inserting metavariables for subexpressions which are irrelevant for the proof. Thus the structure o f the statement becomes simpler and the search space of the proof is reduced. Metavariables are also used to postpone decisions. For example, an invariant required in Dijkstra's method for program construction (see below) need not be given as a whole beforehand. A part of it is given immediately when the corresponding rule is applied, but the yet unknown rest of it is postponed by inserting a metavariable instead (cf. the metavariable $rest below). Finally, metavariables are one of the important concepts in the KIV system that enable the integration Of program verification and program development without any changes to the logic or to the system itself. With the help of a metavariable we may express the specification of a program as a total correctness assertion F ~ ($C)~ with known preconditions F and postcondition ~ but a yet unknown program $C. In the rest of this section we will concentrate on this use of metavariables.

5.1 Developing Programs by Instantiating Metavariables Program development in the KIV system means to construct a particular proof tree: We start with a specification like the one above containing a metavariable for the yet unknown program. The application of proof refinements gradually leads to a series of new proof trees resulting in a

126

stepwise instantiation of the metavariables. We stop if there are no further uninstantiated metavariables in the proof. Then the conclusion of the proof tree is the total correctness assertion with the original pre- and postconditions but with the generated program instead of the metavariable. The premises of the proof tree are first-order verification conditions entailing the conclusion. There are two types of proof refinements applied to the specification and the intermediate proof trees: (i) operations to instantiate a metavariable with a new code fragment possibly containing other metavariables and (ii) operations which reduce a goal containing such a code fragment to sufficient subgoals (subspecifications for the remaining metavariables in it). The central operation of type (i) is the specialization of proofs which takes a proof tree, a metavariable and an expression of the same syntactic category and yields an instance of the given proof where the metavariable is replaced by the expression throughout the proof. The operations of type (ii) are refinements with verification rules for the various PASCAL-like instructions. 5.2 An Example Due to space limitations we will not display the applied rules. They are standard, and a rough understanding of what they do is enough for the purpose of this example. Suppose we wanted to develop a function computing the length of a list~ The initial specification is F- (proc lg ~ ~.(1 : n). $C in lg(l : n)) n = length(l) where the implementation of the procedure body is left open. We decide to develop a recursive version of lg and apply the induction rule (with respect to the input list 1) although we do not know all the details by now. Applying the rule yields a proof tree of height one with the above specification at the root and the following subgoal as the only premise Ind[$C] t- (proc lg ~ ~.(1 : n). $C in lg(1 : n)) n = length(l). Ind[$C] is the induction hypothesis and the notation displays the metavariables occurring in it. Ind[$C] -- ~'(1', n).(l'< 1 ~ (proc lg ~ ~.(1 : n). $C in lg(r : n)) n = length(l')) Now we apply the verification rule for procedure calls as a reduction rule and get a proof tree of height two with the original specification at the root and the following premise Ind[$C] b (proc lg ~ ~.(l : n). $C in $C) n = length(l). It is noteworthy that with most of the rules there is associated a variable check or a validation. However, these checks cannot be performed immediately, since the sequents still contain unspecified parts. Here we make use of the possibility to postpone the validations until the end of the proof. In our example we decide to specialize the current proof tree by inserting a conditional for $C. All the occurrences of $C in the current proof tree are replaced by if 1 = nil then $B else $G fi. This yields Ind[$B; $G] 1- (proe lg ~ ~.(1 : n). if I = nil then $B else $G fi in if 1 = nil then $B else SG fi) n = length(l). This goal can be reduced by the splitting rule for conditionals. The proof tree branches and we get two premises (the above procedure body is abbreviated by bdy) Ind[$B, $G], 1 = nil I- (proc lg ~ ~.(1 : n).bdy in SB) n = length(l) Ind[$B, SG], 1 ~ nil I- (proe lg ~ ~,(1 : n).bdy in SG) n = length(l). We now deal with the first one. We specialize the proof by inserting n:=0 for $B and apply the assignment reduction rule to the first premise. This results in the verification condition

127

1 = nil t- 0 = length(I). Note that replacing $B also affects the second subgoal since $B occurs on its left hand side and in bdy. For the second subgoal we specialize the proof by inserting (lg(cdr(1) : n); $D) for $G and apply the decomposition rule for compound statements. The result is Ind[$D], 1 ~ nil ~- (proc ... in lg(cdr(1) : n))(proe ... in SD) n = length(l). Applying the induction hypothesis yields Ind[$D], 1 ~ nil, n = length(cdr(1)) ~ (proc ... in SD) n = length(1). Finally we specialize the proof once more and insert n:= n+l for $D. Reducing the assignment yields 1 ~ nil, n = length(cdr(1)) ~- n+l = length(l). The two remaining subgoals are first-order verification conditions and do not contain any metavariables. Therefore we are done and the root of the tree contains the generated program F- (proe lg ~ ~(1 : n). if l=nil then n:=0 else lg(cdr(1) : n) ; n:=n+lfi in lg(1 : n)) n = length(l). Since every metavariable is instantiated now, we may execute the validations postponed so far. In our example the validations are successful. If they were not, we had to backtrack and revise our program decisions that led to the failure.

6 Strategies Strategies are top-level programs that provide the control structure of a proof method by calling substrategies and tactics in a certain order. They guide an uninformed user, i.e. a user without specific knowledge about the system and its logic, through proofs according to the special verification or development method. Strategies embody the interaction with the user and heuristics for the selection of rules and tactics as well as for backtracking. Typically the user is required to provide loop invariants, induction hypotheses, or convergence formulas. Depending on the strategy it may also happen that the system needs help to decide what to do next. Especially in the case of program development, where no (complete) program is available, this situation occurs frequently. Most verification strategies are syntax-directed in that they rely heavily on the form of the given program. Although the search space is typically much smaller than in other areas, conflicts arise. We have to decide what goal to tackle next and which rule or tactic to apply to it. In addition to methods for the selection of goals and tactics, strategies contain specific ways of doing backtracking and proof search. 6.1 I m p l e m e n t e d S t r a t e g i e s In the following, we give a list of the proof methods implemented in the KIV system, where we also mention the special heuristics involved, if there are any. • A (complete) proof procedure for propositional logic is implemented, which does not make use of any structural rules. • There are several versions of a prover for predicate logic, for instance with or without equality, complete or terminating. Heuristics are taken from [OS 88]. • There is a comfortable interactive implementation of Hoare's calculus: user guidance and backtracking facilities provided by the system enable the interactive development of proofs. For example, this has the advantage that the user does not need to know all the loop invariants in

128

advance, but can experiment with several possibilities. • We have implemented Bergstra's and Klop's method for proving program inclusion and equivalence, which is published in [BK 84]. Given a first-order axiomatization Ax of a data structure and two programs ~ und 13 the method proves that 0~ is equivalent to [3 in every model of Ax by showing: Ax' F- HOARE tp ---) [O~]~t ¢:~ Ax'~- HOARE (P - ~ [~]~/ for all conservative refinements Ax' of Ax and all formulas (p and ~. • An implementation of Burstall's method [Bur 74], [HRS 87] allows to verify programs that implement inherently recursive functions by loops. Given the goal 17"~ ((x;~}tp, the strategy eliminates ct and computes a new goal of the shape 17' ~- (~}(p. But in contrast to Hoaxe's calculus, loops are not eliminated by proving an invaxiance relation, but by structural induction on the data structure involved. Heuristics for this method have been developed in [Ha 87]. • As an example for a program development method we implemented Gries's method [GR 81], [He 89]. The program works like a smactural editor for programs: Given a precondition F and a postcondifion (p, a goal F [-- ($C)tp is created, where $C is a metavariable standing for the program to be developed. This metavaxiable gets more and more instanfiated until it is a concrete program. The heuristics involved in this strategy can also be found in [GR 81]. • Based on the implementation of Gries's method, there is the implementation of a strategy (introduced by an example by Dijkstra [Di 88]) which is capable of generating certain programs completely automatically. This strategy is treated below in more detail.

6.2 General Control Problems Although the strategies mentioned above are very different, we can state some control problems they have in common. How to Build up Proof Trees There axe two possibilities to build up proof trees: depth-first or breadth-first. Depth-first means that one branch of the proof tree has be be built up completely before another branch is worked on. This approach is useful for program development, since it corresponds to top-down program construction. In program verification, however, one might want to switch the branches to work on in order to be able to prove goals that are considered as critical first. In this case the proof tree is built up in layers. These two different approaches are also reflected in the backtracking structure of the respective strategy. Backtracking In all strategies that axe interactive or that involve heuristics, the possibility of backtracking should be included. In PPL, there axe two backtracking constructs, or and org (global or). e 1 or e2 is evaluated as follows: First evaluate e 1. If this was successful, then this is the value of e I or e 2. Otherwise the value of e I or e 2 is the value of e 2. The or-construct is equivalent to ? in ML [GMW 79]. It is sufficient if the strategy builds up proof trees in a depth-first manner. The advantage of this backtracking construct is that it can be implemented rather efficiently, because only the state before evaluation of e 1 has to be stored. Also, the use of o r leads to readable programs. However, the or-construct has one disadvantage: once the evaluation of e I was successful, there is no possibility to evaluate e 2 any more. This may be required when the proof tree is built

129

up breadth-first, giving the user the possibility to experiment, e.g. with different rules or different invariants or induction hypotheses. In such a situation the user might want to undo some steps and return to a former state by explicitly invoking a failure. Thus a backtracking construct having a "memory" is needed. This is the org-construct, which works as follows: first evaluate e 1. If this fails, the value o f e 1 o r g e 2 is the value o f e 2. Otherwise return the value of e l, but put the current environment together with e 2 onto a stack of open alternatives. If a failure occurs, then the dynamically last alternative is tried, as opposed to the syntactically last alternative, which is tried by or. There is no ML-equivalent to org.

Proofs as a Means for Resolving Conflicts In the implementation of every strategy one has to decide how to treat goals of predicate logic. One possibility is to leave them as verification conditions and prove them after the strategy has terminated. This approach has been taken e.g. in the implementation of Gries's method. However, if one wants to try several ways to proceed, it can be useful to apply a rule, try to prove some of the simpler goals created, and undo the rule application if the subgoals in question could not be proved. One example where this is the case is the verification of a loop in Hoare's logic. Before the invariance of a suggested formula is shown, it should be proven that the formula is not too weak, i.e. that the formula together with the negation of the loop condition implies the postcondition. 6.3 A Completely Automatic Strategy In the case of development strategies it is sometimes possible to fix the overall structure of the proof. In this situation, the program constructs are selected such that the subgoals yielded by that strategy become provable. As an example we present a strategy which completely automatically generates programs for specifications of the following shape: • (0) = b ~ ( k + l ) = O((I)(k), W(k)), where t5 is an elementary operation and W does not depend on ~ . The basic ideas of this strategy go back to an example presented by E. W. Dijkstra [Di 88]. The task was to develop a program that computes n 3 for a given n_>0 without using multiplication. The idea is to successively compute 13, 23 ..... n 3, such that (i+l) 3 is computed from i 3 using only addition (the preliminary loop invariant is 0~_<_n ^ x 0 = i3). Since (i+l) 3 - i 3 = 3i 2 + 3i +1 cannot be computed without multiplication, a new variable a is introduced with invariance property x 1 = 3i 2 + 3i +1: The invariant is augmented by this conjunct. The new variable has to be initialized with 1 (i--O). To keep the invariance property when i is increased, x 1 has to be increased by (3(i+1) 2 + 3(i+1) +1) - (3i 2 + 3i +1) = 6i + 6. This also cannot be done directly; thus, again a new variable is introduced with invariance property x 2 = 6i + 6; it has to be initialized with 6. To maintain the invariance property, x 2 has to be increased by (6(i+1) +6) - (6i +6) = 6, which can be done without a new variable. Thus, the developed program is: i:= O, Xo:= O; Xl:= 1; x2:= 6; while i#n t o xo:= xo+x I; xl:=Xl+X2; x2:= x2+6; i:= i+1 od

130

Abstracting from the example, when supplied with a specification of the shape n>0 [- ($C)x0=~(n), we generate the following schema for $C: i:-- 0, x0:= ~(0); {00 (bf is the bound function) (5) ~, Sb, Srest, bf=t ~- ($C)bf
131

$rest ^ Xj+l--Xj+l(i) ; and repeat steps 3-6, after suitable preparation of the goals. As already mentioned, the advantage of this method is that in those cases where it is applicable, it runs completely automatically.

References [BK 84]

Bergstra, J. A., Klop, J. W. Proving Program Inclusion Using HOARE's Logic, Theoretical Computer Science 30 (1984), pp. 1 - 48 [BM 79] Boyer, R.S./Moore, J.S. A Computational Logic. Academic Press, New York 1979 [Bur 74] Burstall, R.M. Program Proving as Hand Simulation with a little Induction. Informarion Processing 74, North-Holland Publishing Company (1974) [Bun 89] Bundy, A. Automatic Guidance of Program Synthesis Proofs. Proc. Workshop on Automating Software Design, UCAI 89. Kestrel Institute, Palo Alto (1989), pp. 57-59 [Co 86] Constable,R. et al. Implementing Mathematics with the Nuprl Proof Development System. Prentice Hall, Englewood Cliffs (1986) [Di88] E.W. Dijkstra. Lecture held on 8/4/1988, International Summer School "Constructive Methods in Computing Science", Marktoberdorf 1988. [FM 88] Felty,A./Miller, D. Specifying Theorem Provers in a Higher-Oder Logic Programruing Language. Proc. 9-th International Conference on Automated Deduction, E. Lusk, R. Overbeek (eds), Springer LNCS 310 (1988), pp. 61-80 [GMW 79] Gordon,M/Milner,R./Wadsworth,C. Edinburgh LCF. Springer LNCS 78 (1979) [Go 82] Goldblatt, R. Axiomatising the Logic of Computer Programming. Springer LNCS 130 (1982) [Gr 81] Gries, D. The Science of Programming, Springer-Verlag (1981) [Ha 79] Harel, D. First Order Dynamic Logic. Springer LNCS 68 (1979) [H~i 87] Hahnle, R. Programmverif'tkation durch symbolische Ausftihrung und Induktion. Diplomarbeit, Fakult~t f'tir Informatik, UniversiflitKarlsruhe (1987) [He 89] Heisel, M. A Formalization and Implementation of Gries's Program Development Method within the KIV Environment. Int. Bericht 3/89, Fak. ftir Informatik, Univ. Karlsruhe [HRS 87] Heisel,M./Reif, W./Stephan, W. Program Verification by Symbolic Execution and Induction. Proc. 11-th German Workshop on Artificial Intelligence, K. Morik (ed.), Informatik Fachberichte 152, Springer-Verlag (1987) [HRS 89] Heisel,M./Reif, W./Stephan, W. A Dynamic Logic for Program Verification. Proc. Logic at Botik 89, A. Meyer, M. Taitslin (eds), Springer LNCS 363 (1989), pp. 134-145 Mulmuly, K. Mechanization of existence proofs of recursive functions. Proc. 7-th [Mu 84] International Conference on Automated Deduction, Springer LNCS 170 (1984), pp. 460-475 Oppacher, F./Suen, E. HARP: A Tableau-Based Theorem Prover. Journal of [OS 88] Automated Reasoning, Vol. 4 (1988), pp. 69-100. Paulson, L. Logic and computation. Cambridge University Press, Cambridge [Pa 87] (1987) Reif, W. Vollst~digkeit einer modifizierten Goldblatt-Logik und Approximation [Re 84] der Omegaregel durch Induktion. Diplomarbeit, Fak. fiir Informatik, Univ. Karlsruhe (1984) [St 85] Stephan, W. A Logic for Recursive Programs. Interner Bericht 5/85, Fak. fiir Informatik, Universiflit Karlsruhe (1985)

Extensions to the Rippling-Out

T a c t i c for G u i d i n g

Inductive Proofs * Alan Bundy, Frank van Harmele~, Alan Smaill and Andrew Ireland Department of Artificial Intelligence University of E d i n b u r g h E d i n b u r g h , EH1 1HN, S c o t l a n d E m a i l : b u n d y @ e d i n b u r g h . a c . u k , Tel: 44-31-225-7774

Abstract In earlier papers we described a technique for automatically constructing inductive proofs, using a heuristic search control tactic called rippling-out. Further testing on harder examples has shown that the rippling-out tactic significantly reduces the search for a proof of a wide variety of theorems, with relatively few cases in which all proofs were pruned. However, it also proved necessary to generalise and extend rippling-out in various ways. Each of the various extensions are described with examples to illustrate why they are needed, but it is shown that the spirit of the original rippling-out tactic has been retained.

1

Introduction

In [Bundy 88] we introduced the concept of proof plans and gave a simple example proof plan for guiding inductive proofs. The central idea of this inductive proof plan was a tactic for manipulating the induction conclusion to enable the induction hypothesis to be used in its proofl Following Aubin, [Aubin 75], we called this tactic ripplingout. In [Bundy et al 88] we described an implementation of this inductive proof plan within the OYSTER-CLAM system for a higher-order, intuitionist, typed logic, and we reported its performance on various standard example inductive theorems. OYSTERis a reimpIementation in Prolog of the Nuprl interactive proof editor, [Constable et al 86]. *The research reported in this paper was supported by SERC grant GR/E/44598, and an SERC Senior Fellowshipto the first author. We wish to thank our colleagues in the Edinburgh Mathematical Reasoning Group and three anonymousreferees for feedbackon this paper.

133

Tactics are Prolog programs which drive OYSTER by applying its rules of inference. A proof plan is a tactic together with its meta-level specification. C[bM is a plan formation p r o g r a m which builds a special-purpose proof plan for each theorem from a set of general-purpose proof plans. We have tested our implementation extensively on a large n u m b e r inductive theorems, most of which are drawn from the Boyer-Moore corpus ([Boyer & Moore 79], appendix A), adapting the original proof plan as necessary. This p a p e r reports the result of t h a t study. T h e main finding is t h a t the spirit of the proof plan has survived the test. In particular, the rippling-out tactic remains the central idea of the proof plan. Our tests have suggested principled extensions to rippling-out, which preserve the essential intuition behind it while increasing its range of application. Since these extensions include rippling in other directions t h a n 'out', we have named the extended tactic, rippling. Below we report these extensions to rippling-out 1. T h e y are rippling with multi-wave rules, rippling with conditional wave rules, rippling-sideways and rippling on hypotheses. We illustrate each extension with simple examples of proofs which require them. We argue t h a t the extensions are natural improvements of the original idea. We end with examples of harder inductive theorems whose proof is now within the range of the proof plan. Before we can do this, however, we briefly recap the main idea of rippling-out and the role it plays within our inductive proof plan.

2

Rippling-Out

in Inductive

Proofs

To understand rippling-out imagine a loch 2 in which the induction conclusion appears as a reflection of the hypothesis. The reflection is not a perfect image of the original because wherever the induction variable appears in the induction hypothesis, the induction term appears in the induction conclusion. T h e expressions which appear in the induction conclusion, b u t not in the induction hypothesis, we call wave fronts. T h e y are like ripples on the surface of the loch, which spoil the reflection. Consider, for instance, a simple proof of the associativity o f + , VX, Y, Z. X q- ( Y q- Z) --- ( X q- Y) + Z by successor induction on X . T h e induction hypothesis is

=+(y+z)

= (=+y)+z

(1)

where x, y and z represent skolem constants 3. T h e induction conclusion is

(2) 1To improve readability we have translated the Martin Lhf style language used by OYSTER-CLAMinto a more conventional notation. 2The scottish word for 'lake'. 3We adopt the Prolog convention that identifiers starting with upper case letters indicate variables and those starting with lower case letters indicate constants.

134

T h e induction t e r m is s(x) and the s ( . . . ) constructor function is the wave front. More generally, a wave front is a t e r m from which a p r o p e r s u b t e r m is deleted. Alternatively, a wave front can be thought of as a collection of nested functions with the innermost a r g u m e n t removed. W h e n this argument is replaced b y a t e r m the wave front is said to dominate the term. We a d o p t the convention t h a t wave fronts are indicated b y boxes, as in the example above. Wave fronts are illustrated graphically in figure 1. Initially, the wave fronts are functions which immediately dominate the induction variable. T h e role of rippling-out is to move t h e m outwards - - j u s t like the ripples on a loch - - leaving behind t h e m an unspoilt reflection of the induction hypothesis. Rippling-out works b y backwards reasoning f r o m the induction conclusion to the induction hypothesis using wave rules. A wave rule is a rewrite rule of the form:

where F , S and T are t e r m s with one distinguished a r g u m e n t . T m a y be empty, b u t S and F m u s t not be. S and T are called the old and new wave fronts, respectively. Note t h a t the effect of applying such a rule is to move the old wave front S, in the induction conclusion, outwards past the F and to turn it into a new wave front T. This general form includes m a n y rewrite rules formed f r o m the step cases of recursive definitions. Restricted to such recursive rules, rippling-out is a constrained version of unfolding or symbolic evaluation. But, as we will see, m a n y wave rules are not formed f r o m recursive definitions, so rippling-out extends unfolding. A wave rule can be formed from the step case of the recursive definition of + , namely:

where U is u, S and T are s and F ( U ) is u + v. R e p e a t e d application of this rule to (2) ripples the two wave fronts to the outside of the left and right hand t e r m s of the induction conclusion.

DE]+

+ z) =

(3) A d i a g r a m m a t i c representation of rippling-out is given in figure 1. Our initial version of rippling-out applied only to induction conclusions t h a t were equations or equivalences. As in this example, wave fronts were rippled-out until they dominated the left- a n d right-hand sides of these induction conclusions. T h e m o v e m e n t of wave fronts can t e r m i n a t e in three ways. If a wave front is m o v e d to dominate the left- or right-hand t e r m of the induction conclusion then we say it is beached. No further rippling-out of this wave front is t h e n possible or necessary. T w o examples can be found in equation (3), above.

135

+

z

z

+

S

Z

x~

Before

by

x

During

After

The three trees show the term before, during and after rippling-out. Each tree represents the term as an expression tree. The nodes of each tree are labelled by a function or predicate symbol or a constant or variable. A function or predicate of arity n has n descendent subtrees: one for each of its arguments. Wave fronts are indicated by square nodes and all other nodes by dots. Note that the three trees differ from each other only in the position of the square nodes. These square nodes arc higher in each successive tree; the 'After' one being beached at the top. The ~s in the square nodes indicate the direction of rippling-out. Figure 1: Rippling-Out (s(x) + y) + z • If a wave rule is applied in which T is e m p t y then there is no new wave front. We say it peters out. T w o examples can be found in equation (4), below. • If a wave front is not beached, but no wave rule applies to it, then we say the wave front is stuck. If all wave fronts in a t e r m are beached or peter out then then we say it is fully rippled. Otherwise, we say the rippling-out is stuck. W h e n no further rippling-out is possible then the induction hypothesis can often be used as a rewrite rule to produce an equation between two identical terms. Following Boyer and Moore, we call this tactic fertilization. T h e induction hypothesis m a y be used either way round. In our example we can use it left to right on the left hand side of the induction conclusion, (3), to produce the equation:

+ y) +

--

+ y) +

136

which is readily proved, so completing the step case of the inductive proof. B o t h rippling-out and fertilization are subject to careful control by our overall inductive proof plan. Rippling-out is applied to the induction conclusion immediately after the application of induction. The precondition of applying a wave rule to rewrite a subexpression of the induction conclusion is t h a t a n y wave front in t h a t sub-expression must m a t c h the old wave front in the rule. This greatly restricts the search space of rippling-out, usually to zero or one wave rule for each wave front in the induction conclusion. It also permits equations which can be interpreted as wave rules in b o t h directions to be used either way round without the risk of looping, since wave fronts m u s t always move outwards and never inwards. Fertilization is applied to the induction conclusion when no further rippling-out is possible. It uses the induction hypothesis as a rewrite rule either left to right to the left-hand side of the induction conclusion or right to left to its right-hand side. If the wave fronts on b o t h sides of the induction conclusion are fully rippled then either one of these is sufficient. If only one side is fully rippled t h e n this side is rewritten. If neither side is fully rippled then fertilization is not possible.

3

Multi-Wave

Rules and Strong Fertilization

Our first extension is to allow wave rules which ripple out more t h a n one wave front at once. We call these multi-wave rules. T h e y are highly desirable if one side of the induction conclusion contains more t h a n one wave front. T h e y allow rippling to merge several wave fronts into one and, hence, continue rippling beyond the point at which the old version of rippling-out would have become stuck. T h e y also allow us to s t r e n g t h e n rippling-out and fertilization and, thereby, apply t h e m to induction conclusions t h a t are not equations or equivalences. While we are m a k i n g this extension we will also extend wave rules to cope with wave fronts containing more t h a n one induction variable, and to multiple induction hypotheses. T h u s , the new general f o r m of wave rules is:

where t _< q~,ri <_ m l for 1 < i < n. As before, F , the Sis and T are t e r m s with distinguished arguments. T m a y be empty, but the Sis and F m u s t not be. T h e S;s are the old wave fronts a n d T is the new wave front. N o t e t h a t the concept of wave front has now been generalised to a t e r m from which one or more proper s u b t e r m s have been deleted. T h e advantages of multi-wave rules are as follows.

137

• T h e r e p l a c e m e n t of S with the Sis enables the simultaneous rippling-out of multiple wave fronts. • T h e r e p l a c e m e n t of U with the U~s enables the rippling-out of wave fronts containing m o r e t h a n one induction variable. • T h e r e p l a c e m e n t of the single F a r g u m e n t of T by several F a r g u m e n t s allows the simultaneous fertilization of the induction conclusion with more t h a n one induction hypothesis. T h e s e last two extensions go together; multiple Us tend to create multiple Fs, each one m a k i n g a different selection of Us for its arguments. A multi-wave rule can be formed f r o m the s u b s t i t u t i v i t y a x i o m for s, namely:

Recall t h a t rippling-out reasons backwards. To a p p l y the implication p -+ q it uses the rewrite rule q =~ p4. T h u s the direction of implication in the rule a b o v e is right to left. Note t h a t this rule is an example of a wave rule which is not formed f r o m the step case of a recursive definition° I n s t e a d of applying fertilization to the induction conclusion (3), we can use this more general f o r m of wave rule to continue the rippling-out and infer: x+ (y+z)

=

(x+y)+z

(4)

which is identical to the induction hypothesis, (1), i.e. the wave fronts have petered out. T h e p r o o f thus t e r m i n a t e s by direct appeal to the induction hypothesis. This direct use of the induction hypothesis constitutes a new f o r m of fertilization which we will call strong fertilization. T h e f o r m of fertilization described a b o v e in §2 we will r e n a m e weak fertilization. Since strong fertilization applies to induction conclusions of a n y f o r m it is m o r e generally applicable, and its application will normally be the purpose of rippling-out. However, weak fertilization m u s t still be retained to cope with equational or equivalential induction conclusions t h a t get stuck on one side. To illustrate the use of multi-wave rules to prove non-equational t h e o r e m s with the aid of multiple induction variables a n d multiple induction hypotheses, consider the following example. Vt:tree.

rnax_ht(t) > min_ht(t)

where max_At(t) is the length of the longest p a t h in a binary tree, t, and min_ht(t) is the length of t h e shortest. N o t e t h a t this is an inequality. Trees will be built f r o m the c o n s t r u c t o r functions leaf(t) and tree(t1, t~). For the induction step we will assume the two induction hypotheses:

ma= ht(l) _> min_ht(l)

ma=_ht(r) > min_ht(r)

4We adopt the convention that --* stands for implication and =~ stands for rewriting.

138

and prove the induction conclusion:

max-ht(~,

rD >_m i n - h t ( ~ ,

rD

in which b o t h 1 a n d r are induction variables. We will need the following multi-wave rules:

==~ ~ a x _ h t ( u ~ ) , r n a x _ h t ( u ~ ) ~ ] :=~ ~ i n _ h t ( u ~ ) , r n i n _ h t ( u ~ ) ~ ) ] 1

2

Note t h a t all four of these rules have multiple Us, the first two and last have multiple Fs, and t h a t the last one also has multiple Ss. Recall t h a t the direction of implication in the last two rules is right to left. Rippling-out (5) then produces:

> ~in_ht(1),rnin.ht(r)~ ~ n a x _ h t ( l ) , raax_ht(r)~ > F~in---Onin_ht(1),min_ht(r)~ max_ht(l) > min_ht(l) [ ] >_minJ t( ) to which strong fertilization applies, finishing the proof of the step case. N o t e t h a t the first two wave fronts are c o m p o u n d and m u s t be rippled-out in two stages. Note also t h a t the last wave front is a logical connective. Rippling-out can proceed t h r o u g h predicates a n d connectives as well as functions.

4

Conditional

Wave Rules

Our second extension is to allow conditional wave rules, i.e. wave rules t h a t are only true under some condition. T h e y have the form:

< condition > --r LHS =¢, RHS where

LHS =ezRHS

is a wave rule.

If the condition of a rule is provable from the current hypotheses then, clearly, we can use the rule. But even if it is not currently provable we can still use the rule provided we divide the p r o o f into two cases using the condition a n d its negation. T h e condition is t h e n trivially provable in the first case. So a m a j o r p r o b l e m to be solved in the use of conditional rules is when to t r y to prove the condition within the current case (either i m m e d i a t e l y or later} a n d when to use the condition to split the current case into sub=cases.

139

As a partial solution to this problem, related conditional rules are stored, in CLAM , in c o m p l e m e n t a r y sets of the form:

where

RHSI is either of the form: . . . ,

), . . . , F(v;,,

. . . , v::

)E]

1 < q~, rjl _< m1 for 1 _<: j <_ n and 1 < i < k, or is an expression not containing F and where

P1V...VPk and

vl < i <

,3s ,vl <_j < k. s

bsumes(S.sl)

a n d the Sis are the wave fronts to be rippled-out in the induction conclusion. • N o t e t h a t it is not always possible to f o r m a c o m p l e m e n t a r y set f r o m conditional wave rules alone. Some conditional rules in a c o m p l e m e n t a r y set will be conditional wave rules and some will be conditional definitions of F . A wave front, S, subsumes a wave front S t if S consists of nested copies of S t. For instance, the wave front s(s(...)) subsumes the wave front s ( . . . ) . Note t h a t two consecutive ripples of s ( . . . ) will ripple s(s(...)) once. W h e n a p p l y i n g conditional wave rules CLAM proceeds as follows. • If the condition is one of the existing hypotheses of the current case then the rule can be applied with no further work. • Else if t h e rule is a m e m b e r of a c o m p l e m e n t a r y set t h e n the current case is split into sub-cases using the conditions of t h a t set. • Otherwise, the condition is set up as an additional sub-goal. In this way we avoid dividing into sub-cases unless each of the sub-cases is likely to succeed. Since, for each sub-cases, there is a a conditional rule whose condition is satisfied, t h e n one of the following two situations will obtain. • If the rule for a sub-case is a conditional wave rule, then rippling-out can continue. • If the rule for a sub-case does not contain F then the rule provides an explicit definition of F in this case and the proof proceeds b y symbolic evaluation (see [Bundy et al 88]) r a t h e r t h a n induction.

140

This gives s o m e assurance of success in each sub-case. This is only a partial solution to the problems of using conditional rules because we m i g h t not invest enough effort into proving the condition in the current case before giving u p and dividing into cases. T h u s we will create an unnecessary case split. An example of a c o m p l e m e n t a r y set of conditional rules can be t a k e n f r o m the definition of the intersection of two sets (represented as lists).

( -~h E s

z

--~

Ms

=~ t M s

where h :: t is the set formed b y adding element h to the set t. N o t e t h a t b o t h rules are conditional wave rules, and t h a t T is e m p t y in the second rule. Consider the theorem: VA, B , C . A E B A A E C

--~ A E B N C

T h e induction conclusion of this t h e o r e m is: a e ~ ^ a E e

~

ae(W~-~)nc

Consider t h e second wave front. T h e only m a t c h i n g wave rules are the two conditional rules above. Since these f o r m a c o m p l e m e n t a r y set we can use t h e m to suggest a division into two cases, each of which has some assurance of success. After dividing into these two cases and applying the conditional wave rules we get: eEc ~eEc

t- a E [ ~ b A a E c ~- a E ~ - ~ " ~ A a E c

--~ a E ~ b M c ) --* a E b M c

T h e remaining wave fronts can be rippled-out once each with the wave rule:

This gives:

~eEc

t-

( ~ E b )

AaEc

-*

aEbnc

and the wave fronts introduced by this rule can be beached with propositional wave rules. T h e second case, for example, becomes: --,eEc

F la=eAaEc--.aEbMcl

h

aEbAaEc

After strong fertilization this leaves the residue: ~eEc

[- a = e A a C c - + a E b M c

which can b e readily proved. T h e first case is similar.

-*aEbNc

141

5

Rippling-Sideways and Accumulators

Our third extension is to consider a third way in which rippling can successfully terminate. In our examples so far we have t r a n s f o r m e d universally quantified variables into skolem constants in b o t h induction hypothesis and induction conclusion. However, universally quantified non-induction variables can be transformed into free variables. Doing this significantly increases the options open to the t h e o r e m prover. Wave fronts can be rippled-sideways so t h a t they are absorbed b y these free variables during strong fertilization. In principle, this rippling-sideways can always be done using ordinary wave rules: first applied forwards then applied backwards. In practice, not all the required wave rules are likely to be available, and the central p a r t of the rippling m u s t be done b y a new kind of wave rule. We will call these new kinds of wave rule transverse wave rule, and we will r e n a m e the original wave rules as longitudinal wave rules. A simple t r a n s v e r s e wave rule is a rewrite rule of the form:

i.e. it moves a wave front from one a r g u m e n t of the function F to a n o t h e r one. F, S and T are each a n o n - e m p t y t e r m with a distinguished argument. If T were e m p t y then the rule would be a longitudinal wave rule. J u s t as for longitudinal rules, the simple transverse wave form can be generalised, to give the multi-wave form:

although, we cannot generalise this to multiple Us, Vs and Fs. Of course, we can also have c o m p l e m e n t a r y sets of conditional transverse wave rules, hybrid longitudin a l / t r a n s v e r s e wave rules, etc. To illustrate rippling-sideways, consider the following example. Let u n a r y rev be the naive list reversal function and binary qrev be the tail recursive list reversal function, so t h a t the following rewrite rules are available.

rev(nil) rev(~l) qrev(nil, l) qrev(~l,1)

~ =~ =~ =~

nit rev(tl)[<> (hd :: nil)] l qrev(tl,~)

(6) (7)

where < > is infix list a p p e n d and the second a r g u m e n t of qrev is an accumulator. Note t h a t 6 is a longitudinal wave rule and 7 is a transverse wave rule. Consider the following t h e o r e m connecting these two list reversal functions.

VL, M. rev(L) < > M

= qrev(L,M)

142

To prove this t h e o r e m let L be the induction variable then, by the discussion above, the induction hypothesis is:

rev(l)

<> M

=

qrev(l,M)

(8)

where M is a free variable, and the induction conclusion is:

rev(~h--~) < >

m

=

qrev(~,m)

To m a k e the induction conclusion m a t c h the induction hypothesis we will ripple the two wave fronts sideways so t h a t each is adjacent to an m. Applying rule (7) to the right hand side does this in one step.

rev(~h-~)

< > rn

=

qrev(l,~)

T h e rippling the left hand wave front is m o r e difficult. First, (6) is applied to ripple the wave front out.

(rev(1)l<> (h :: nil) p <> m = q r e v ( l , ~ n ) Second, the associativity of < > is used as a transverse wave rule to ripple the wave front sideways to the left h a n d m .

rev(l)

< > ([(h ::

nil)

< > ~n)

=

qrev(l,~rn)

Third, symbolic evaluation is applied to tidy up the wave fronts surrounding the sinks. This rewrite (h :: nil) < > m to h :: rn on the left hand side. Finally, strong fertilization applies, instantiating M to h :: m , and proving the step case. Universally quantified variables in the conjecture which are not chosen as induction variables (like M in rev/qrev proof above) become skolem constants in the induction conclusion ( m in the e x a m p l e above). We will call these constants accumulators5 An occurrence of a n a c c u m u l a t o r is called a sink. Rippling-sideways enables us to get rid of a wave front b y m o v i n g it to directly d o m i n a t e a sink. This is done in such a way t h a t every sink of each a c c u m u l a t o r is d o m i n a t e d either by the s a m e wave front or b y none. Rippling-sideways is controlled as follows. Sets of wave fronts and sets of sinks are paired up so t h a t for each a c c u m u l a t o r either none of its sinks are paired or all are. For each pair of wave fronts and sinks the wave fronts are first rippled-out using longitudinal rules, t h e n across with a transverse rule, t h e n down to the sinks using longitudinal rules backwards. A d i a g r a m m a t i c representation of a simple case of this process is given in figure 2. Note t h a t not all wave rules can be legally used b o t h forwards and backwards, if t h e y are formed f r o m implications t h e n they can only b e used forwards on subformulae of positive polarity a n d backwards on sub-formulae of negative polarity. T h e

e.g.

5We adopt this terminology because of the analogy with accumulators in computer programs. In fact, there is a direct relationship between them, which space does not permit us to explore.

143

U

U V

() Before

Stage-1

Stage-2

After

The four expression trees show the expression before, during and after rippling-sideways. Sinks are indicated by circle nodes and wave fronts by square nodes, as in figure 1. F is the least upper bound of the wave front and sink. U and V are the immediate daughters of F in the direction of the wave front and sink, respectively. In Stage-1 the wave front has been rippled up between the U and F nodes. In Stage-2 it has been rippled sideways to between the V and F nodes. In After it has been rippled down to the sink. Figure 2: Stages of Transverse Rippling polarity of a sub-expression is the parity of the number of implicit or explicit negations it is contained within, e.g. in ~p/x q ~ r, p and r are of positive polarity and q is of negative polarity. Especial attention must be paid to this during the last stage of rippling-sideways (and rippling on hypotheses, see §6). The strong direction imposed on rippling-sideways by this procedure prevents looping. A wave front must always move towards a sink, and cannot move backwards just because there is a rule available to so move it. This explains why the associativity of i~, does not cause a loop in the rev//qrev example above.

6

R i p p l i n g on H y p o t h e s e s

Our fourth extension is to adapt rippling to proofs by destructor induction. In all the proofs considered so far the induction rules have been in the constructor style, that is the induction hypotheses have been of the form P(x) and the induction conclusions of

144

the f o r m P(c(X)), for some constructor function, e. This neglects proofs in which the induction hypothesis has the f o r m P(d(x)) and the induction conclusion has the f o r m P(x), for some d e s t r u c t o r function, d. Rippling is readily a d a p t e d to destructor induction. Instead of rippling backwards on the induction conclusion we ripple forwards on the induction hypothesis. B o t h the forwards direction of the rewriting and the use of wave rules a b o u t d e s t r u c t o r functions means t h a t we m u s t make m u c h more use of conditional rules t h a n in the c o n s t r u c t o r case. This tends to make the proofs more messy. On the plus side m a n y inductions are more n a t u r a l l y expressed in destructor form. To illustrate the technique, here is a d e s t r u c t o r version of the associativity of + . The induction hypothesis is:

where p denotes the predecessor function on natural numbers. T h e induction conclusion is:

=+(y+z)

=

(=+y)+z

To ripple-out the wave fronts in the induction hypothesis we will need the two wave rules:

u#O^v#O

~

~

u=v

This p e r m i t s rippling similar to t h a t for the constructor p r o o f (see §2), but with additional work to prove the conditions.

7

A More Interesting E x a m p l e

The extensions to rippling-out described above were all illustrated on examples chosen for their simplicity. However, each of these extensions has significantly increased the power of our OYSTER-CLAM system. As an illustration of this increased power we discuss here a more interesting t h e o r e m t h a t our s y s t e m is now able to prove. Let binary count measure the n u m b e r of occurrences of a n element in a list and u n a r y sort be a function for sorting lists. OYSTER-CLAM can prove t h a t the n u m b e r of occurrences of each element of the list is invariant under sorting, i.e. VA, L. count(A, sort(L))

= count(A,L)

where sort is defined as a naive, insert sort algorithm f r o m which we can extract the rewrite rules:

sort(nil) =~ nil sort(h :: t) ~ insert(h, sort(t))

145

This t h e o r e m is from the Boyer-Moore corpus (theorem 118, p342 of [Boyer & Moore 79]). T h e proof divides into 7 cases. These case splits are determined by using comp l e m e n t a r y sets of wave rules. For instance, one split is determined by the following c o m p l e m e n t a r y set of conditional wave rules, which is derived from the recursive definition of c o u n t . ==

h

=# h

count(=, ) =Dount(=,t)r)-] count(=,

) = co,,ntC=,t)

It also requires some rippling with multi-wave rules. T h e proof plan of this t h e o r e m is one of the biggest generated by CLAM. It consists of 58 nodes with 3 inductions and 7 case splits and takes 41.5 cpu secs to find, b u t requires no search. T h e two nested inductions correspond to proving 'in-line' two complementary conditional wave rules which are required in the proofi OYSTER takes 1,535 cpu secs to unpack this plan into 4,204 object-level inference steps 6. An 'in-line' proof of a wave rule happens as follows. During the main induction rippling becomes stuck on one side of an equation or equivalence. Weak fertilization is used on one side, but this leaves a subgoal to be proved, usually by a nested induction. This subgoal is an instance of a wave rule t h a t would have unstuck the ripple had it been available in the first place.

8

Conclusion

In this p a p e r we have described four extensions to the rippling-out tactic: multi-wave rippling, conditional rippling, rippling-sideways and rippling on hypotheses. Our extensions have improved the power of rippling while preserving its spirit. Rippling plays the central role in our proof plan for inductive proofs. This proof plan and the rippling tactic have proved surprisingly successful. It has been tested on 68 of the examples from the Boyer-Moore corpus and proved all but 3 ~ of them. No search is required. Our proof plan is much less sensitive than the Boyer-Moore theorem prover to the order in which theorems are presented; if an essential lemma is not available for rippling when required, an appropriate instance of it is proved 'in-line'. It does, however, sometimes rely on a previously proved lemma to suggest the appropriate induction rule. However, our proof plan does not constitute a decision procedure for induction proofs, which is in any case an undecidable area. Nor does rippling always succeed in bridging the gap between induction hypothesis and induction conclusion. Rippling 63631 of these steps are concerned with proving the well-formedness of logical expressions, i.e. that expressions belong to types. The presence of large numbers of such steps is a property of the Martin Lhf logic. They are mostly trivial. Thus only the remaining 673 steps are significant. rThese recalcitrant 3 fail because of essentially trivial difficulties with the typing, and not because of limitations of the proof plan.

146

will stick if the right wave rule is not available. If it sticks on both sides of an equation, even weak fertilization will not apply. One way to proceed in such situations is shake the current goal into a form in which a wave rule will apply. For instance, a wave front might be moved sideways to a non-sin~ with a commutative law or transverse wave rule. We are currently investigating such possibilities. The OYSTER-CLAMsystem is written in Quintus Prolog. Multi-wave, conditional and sideways rippling and rippling on hypotheses have all been implemented in the system. Timings quoted above are for the system running on a Sun 3/60 computer.

References [Aubin 75]

R. Aubin. Some generalization heuristics in proofs by induction. In Acres du Colloque Construction: Amelioration et verification de Programmes, Institut de recherche d'informatique et d'automatique, 1975.

[Boyer & Moore 79] R.S. Boyer and J.S. Moore. A Computational Logic. Academic Press, 1979. ACM monograph series. [Bundy 88]

A. Bundy. The use of explicit plans to guide inductive proofs. In 9th Conference on Automated Deduction, pages 111-120, SpringerVerlag, 1988. Longer version available from Edinburgh as Research Paper No. 349.

[Bundy et al 88]

A. Bundy, F. van Harmelen, J. Hesketh, and A. Smaill. Experiments with Proof Plans for Induction. Research Paper 413, Dept. of Artificial Intelligence, Edinburgh, 1988. To appear in JAR.

[Constable et al 86] R.L. Constable, S.F. Allen, H.M. Bromley, et al. Implementing Mathematics with the Nuprl Proof Development System. Prentice Hall, 1986.

GUIDING INDUCTION PROOFS Dieter Hutter University of Karlsruhe 1 ABSTRACT: A crucial point in proving theorems by induction is to manipulate the induction conclusion to enable the use of the induction hypothesis. We propose a technique to control such a deduction in a goal directed way: Comparing conclusion and hypothesis we obtain a syntactical pattern which has to be satisfied by each int~ediate result of the deduction. To maintain this restriction we present a notion of terms and equations called C-termsresp. c-equations which we use as well to extend existing tactics for proof plans as to introduce new tactics. 1. I N T R O D U C T I O N A central problem in automating theorem proving is the treatment of the equality relation. Incorporated as a inference rule into a calculus it leads to an explosion of search space, since that rule can be used almost everywhere. Hence its application has to be controlled by strategies or heuristics. This paper presents an approach to solve equations guided by syntactical patterns; i.e. deduction steps are only allowed if their results fit a given syntactical form. This method is developed in the background of guiding induction proofs, since a crucial point in proving theorems by induction is to manipulate the induction conclusion to enable the use of the induction hypothesis. Buyer and Moore [Buyer & Moore, 1979] described tactics to guide induction proofs automatically and recently [Bundy, 1988] refined their tactics in terms o f proof plans. The main idea of this approach is to use equations which satisfy specified, syntactical forms (so-called wave rules) to manipulate the conclusion. W e present a general framework for solving equations guided by syntactical patterns and take the task of guiding induction proofs as an exemplary application of that approach. First we illustrate our method by an introductory example. Suppose, we want to prove that addition is distributive over multiplication on natural numbers. The data structure nat is defined in our notation by structure 0 s(p:nat):nat, where 0 and s are the constructors of nat, i.e. each number equals 0 or is constructed by applying s to an element of the sort nat, and p is a selector function denoting the predecessor.

The algorithms to add and multiply natural numbers, plus and times, are defined in our notation as a set o f conditional equations:

1Author's address: Institut fiir Logik, Komplexitiit und Deduktionssysteme, Universit~ttKarlsruhe, Postfach 6980, D 7500 Karlsruhe 1, Federal Republic of Germany, e-mail: [email protected]. This work was supported in part by the Sonderforschungsbereich 314 "Klinstliche Intelligenz und Wissensbasierte Systeme" of the Deutsche Forschungsgemeinschafl.

148 Defplus =

{ V x,y:nat x ----0 --> plus(x y) ----y ~" x,y:nat x -= s(p(x)) --) plus(x y) -- s(plus(p(x) y)) }

Deftimes =

{ V x,y:nat x -= 0 --> times(x y) -- 0 ~' x,y:nat x --- s(p(x)) ---> times(x y) -- plus(y times(p(x) y)) }

The distributivity of plus over times is formalized by the statement ~' x,y,z:nat plus(times(x y) times(x z)) -- times(x plus(y z)) and, in order to prove this claim by structural induction on x, we obtain as an induction step V x:nat x = s(p(x)) --~ (V y',z':nat plus(times(p(x) y') times(p(x) z')) - times(p(x) plus(y' z'))) ---> (V y,z:nat plus(times(x y) times(x z)) - times(x plus(y z)) )

(hypothesis) (conclusion).

Assume, we have already proven the associativity and the commutativity law of plus and times, Then, we obtain a proof of the induction step in the following way (terms underlined will be changed): = = = = = = = = =

plus(times(x y! times(x z)) plus(plus(y times(p(x) y)) times(x zll Dlus(DluS(y times(o(x) y~l Dlus(z times(D(x! z ~ plus(y plus(times(p(x) y) plus(z times(_o(x! z)!)) plus(y 121us(times(o(x~ y~ Dlu~(times(olx~ z~ z ~ plus(y plus(olus(times(D(x'J y! times(D(x! z)) z)! plus(y plus(z Dlus(times(o(x) y) times(o(x) z)!)) Dlus(v Dlus(z times(o(x~ Dlus(v z~')~ Dlus(olus(v z~ times(D(x~ Dlus(y ZI!~ times(x plus(y z))

(1) (2) (3) (4) (5) (6) (7) (8) (9) (10)

Def. of times: Def. of times: Associativity of plus: Commutativity of plus: Associativity of plus: Commutativity of plus: using Induction hypothesis: Associativity of plus: Def. of times:

The problem is, however, to find such a proof by machine, since in each step of the deduction a lot of other deductions are possible but rather useless. For instance, using the commutativity law of times causes the theorem prover to run into a blind alley in each of the deduction steps. Thus, how can we avoid such useless deduction steps ? The answer is based on the observation that the results of each of the deduction steps (1) - (7) (regarded as strings) share the same pattern : ...ptus(...times(...x ...... y...) ...... times(...x ...... z...)...)...

(*).

Hence, if we substitute the fill-ins ... by appropriated strings, we obtain each of the terms (1) - (7). By way of contrast, applying the commutativity law of times to (1) results in a term plus(times(y x) times(x z)) which violates the given pattern. Thus, knowing the pattern at the beginning of a proof, we restrict our search to those deduction steps which satisfy the pattern. Each term satisfying a pattern may be divided into parts which correspond to the fill-ins in the pattern and parts which do not, For example, the term (4) satisfies the pattern (*) and thus we split up (4) into different sections (sections not corresponding to fill-ins are bold):

plus(y plus(times( p( x ) y) plus(z times( p( x ) z) ) ) ) In the same way we divide (7) into different sections: plus(y plus(z plus(times(p(x) y) times(p(x) z)) ))

149 Suppose some terms satisfy a common pattern. Then, they only differ in sections corresponding to fill-ins while the others coincide. In our example sections of the terms (1) - (7) which do not correspond to fill-ins are equal. I.e. removing all sections from the terms (1) - (7) corresponding to fill-ins yields always the same: plus(times(x y) times(x z)). Since sections corresponding to fill-ins may change during deduction, we call them changeable and sections not corresponding to fill-ins unchangeable. In short we call a term partitioned into changeable and unchangeable sections a partitioned term (and print unchangeable sections bold). Furthermore, the induction hypothesis satisfies (*) and thus we denote it also as a partitioned term

plus(times(

p( x ) y) times( p( x ) z),

the unchangeable sections of which are equal to those of the terms (1) - (7). Hence we use (*) to guide our induction proof if we admit only those deduction steps the result of which satisfy the given pattern (*). This solution will be approached in three different steps: (i) The first step is to define a representation of partitioned terms, so-called C-terms, which also distinguish between changeable and unchangeable sections of a term. To manipulate C-terms by equations we propose a special representation of equations, called C-equations. A C-equation is a pair of C-terms denoting two terms with coincident unchangeable sections. (it) The second step is to generate the pattern guiding the induction proof. Based on a comparison of the given induction conclusion (the starting point of the deduction) and the induction hypothesis (the final point of the deduction) we compute C-terms of one side of conclusion and hypothesis such that the unchangeable sections of both C-terms coincide. (iii) The last step is to manipulate the computed C-term of the conclusion with the help of given Cequations to enable the use of the induction hypothesis. Comparing the changeable sections of the Cterms of conclusion and hypothesis we minimize the differences until we obtain a C-term representing a term which allows to use the hypothesis. 2. C - T E R M S A N D C - E Q U A T I O N S In this chapter we propose a representation of partitioned terms. In a first approach we might mark each function- and variablesymbol if it is unchangeable as we have done by printing unchangeable sections bold. Hence, we might represent the term (4) of our introductory example by

plus(y plus(tlmes(p(x)

y) plus(z times(p(x) z) ) ) )

(**) .

For our purposes, however, this representation is somewhat unwieldy. We obtain a more practical representation if we denote the changeable sections of a term in the usual representation of terms and the unchangeable sections by their structure trees. For a given partitioned term we construct a socalled C-term as follows: Given a term t, we first replace each maximal subterm ti of t with unchangeable top-level symbol by an asterisk *. The resulting term, in which some asterisks occur, is called a context (cf. def. 1). If the top-level symbol of the term is itself unchangeable, we obtain nothing but an asterisk, which we call an empty context. For instance, in the example (**) we obtain plus(y ") as context and plus(times(p(x) y) plus(z times(p(x) z) ) ) as the replaced subterm tl.

150 Next, the context c and the representations [plus(y *), plus] Sl...Sn of the replaced subterms tl...tn are denoted in a list enclosed in brackets [c, Sl ... Sn]. In doing so, the sequence Sl ... Sn c o r r e s p o n d s to the [*, times] [ptus(z *), times] appearances of the asterisks if we traverse the context c from left to right. Sl ... Sn is a sequence of trees. The (unchangeable) top-level symbol of ti forms the root o f the tree si and there are [p(*), x] [*, y] [p(*), x] [*, z] i m m e d i a t e l i n k s f r o m the r o o t to the representations of the arguments o f the top-level Fig. 2.1: C-termof the result of the deduction step (4) symbol in ti. If ti is a variable or a constant we obtain a trivial tree si which is the symbol itself. Figure 2.1 shows a C-term representing (**). So, roughly speaking, the unchangeable sections of a term form the construction of the underlying trees of the C-term while the changeable sections form the left-hand sides of the labels in each of their nodes. To ease readability, we shall use both representations of partitioned term and C-term for the rest of the paper.

[plus(* *), times, times]

[*,x]

[*,z]

[*,y]

Fig.2.2: C-term of plus(times(x z) times(y z))

[*,z]

Figure 2.2. shows a C-term of the partitioned term plus(times(x z) times(y z)) in which a context with more than one asterisk occurs. The left asterisk of the context corresponds to the left tree and the right one corresponds to the right tree.

Next, we define how to manipulate C-terms by equations without changing unchangeable sections of them. For this reason we define so-called C-equations as pairs of C-terms. Now, using a C-equation to manipulate a C-term means to match one side of the equation with a subterm of the C-term and replace it by the instantiated other side of the equation. Hence, to preserve unchangeable sections of the C-term the unchangeable sections of both instantiated sides of the C-equation have to coincide. Thus, we demand that already both sides of the C-equation coincide in their unchangeable sections. A C-substitution t~ (cf. def. 6) is a mapping of variables into C-terms which is identical almost everywhere on the set of variables. W e extend this mapping to C-terms in the usual way except that a variable x occurring in a context is mapped into the term denoting ~(x) without unchangeable sections. For instance, consider the associativity law of plus:

~/x,y,z:nat plus(plus(x y) z) = plus(x plus(y z)) Among others, there are two possible partitioned equations such that the unchangeable sections of both sides coincide:

~' x,y,z:nat plus(plus( x y) z) == plus(x plue(y z) ) or ~' x,y,z:nat plus(plus(x y) z) -- plus(x plus(y z) )

151 In both cases the unchangeable sections of both sides are equal. The C-equation shown in Figure 2.3 represents the first partitioned equation and Figure 2.4 shows the Cequation representing the second one.

[*, plus]

[plus(x *), plus]

,/'x [plus(x *), y]

: [*, z I

[*, y]

[*, z]

Fig. 2.3: C-equation of plus(plus(x y) z) E plus(x plus(y z)) Up to n o w we used the notion of coincidence in such a way that the unchangeable sections of terms coincide if [*, plus] [plus(* z), plus] the strings obtained by r e m o v i n g all changeable sections of these terms are equal. Let us extend this notion of coincidence. [*, x] [plus(* z), y] [*, x] [*, y] Consider the intended use of the C-term r e p r e s e n t a t i o n . I f we d e m a n d that Fig. 2.4: C-equation of plus(x plus('y' z)) E plus(plus(x y) z) unchangeable sections of both sides of a partitioned equation are equal, each occurrence of a symbol in an unchangeable section of the hypothesis exactly corresponds to one occurrence in the conclusion. Manipulating one side of the conclusion by C-equations, we finally obtain only one possibility for using the hypothesis. But, for instance, proving properties about trees often requires to use the hypothesis twice. Thus, we have to extend our notion of coincidence such that an occurrence of a symbol in an unchangeable section of the hypothesis may correspond to various occurrences in the conclusion. If we trace this condition back to the equations used for deduction, each occurrence of a symbol in an unchangeable section of one side may correspond to various occurrences on the other side. Precisely we define a mapping co (cf. def. 4) which relates a partitioned term t to a set of terms co(t) representing the unchangeable sections of t and define the coincidence of two partitioned term s, t by the equality of co(t) and c0(s): we obtain each member of co(t) if we gradually replace each subterm of t with a changeable top-level symbol by a subterm of it with an unchangeable symbol. The set c0(t) of a partitioned term t is called the skeleton of t. The skeleton of a C-term is the skeleton of its represented partitioned term. For instance, given the following partitioned distributivity law

~' x,y,z:nat plus(tlmes(x y) times(x z)) -= tlmes(x plus(y z)) [plus(* *), times, times]

[*, x]

[*, y]

[*, x]

[*, times]

[*, z]

[*, x]

Fig. 2.5: C-equation of the distributivity law.

[plus(* *), y, z]

we represent it by a C - e q u a t i o n s h o w n in F i g u r e 2.5. The unchangeable occurrence of times (resp. x) on the right-hand side corresponds to both (!) occurrences of times (resp. x) on the left-hand side. The skeletons of both sides are equal to {times(x y), times(x z)}.

152 Let us consider some more examples: Given the recursive case of the definition of plus: ~' x,y:nat x -= s(p(x)) ---) plus(x y) -= s(plus(p(x) y) ).

[*, plus]

[s(*), plus]

/%;/%

Both sides of the partitioned equation plus(x y) [*, x] [*, Y] [p(*), x] [*, y] = s ( p l u s ( p ( x ) y ) ) have the same skeleton, n a m e l y { plus(x y) }. Therefore we may Fig. 2.6: C-equation of plus(x y) ~ s(plus(p(x) y)) represent this partitioned equation (ignoring the condition x -= s(p(x)) ) by the C-equation shown [*, times] [plus(y *), times] in Figure 2.6. Consider now the recursive case of the definition of times: V x,y:nat x- s(p(x)) --) times(x y) - plus(y times(p(x) y)).

/",

[*, x]

" /'x

[*, Y]

[p(*), x]

[*, y]

Fig. 2.7: C-equation of times(x y)=- plus(y times(p(x) y))

Analogously a common skeleton of the partitioned equation times(x y) ~ plus(y times(p(x) y) ) is { times(x y) }. Ignoring the conditions we obtain the C-equation shown in Figure 2.7 In general there are several different C-equations or several partitioned equations denoting one equation. In case of the associativity law of plus, for instance, there are more than the C-equations represented in Figures 2.3 and 2.4, but on the other hand the skeletons of the C-equations not presented here are less specific than those of the C-equations presented above. We compute these Cequations if we just "weaken" each of the presented C-equations by "declaring" unchangeable sections as changeable. E.g. if we "declare" the symbol plus to be changeable, we may "weaken" the C-equation in Figure 2.3 to the C-equation: [plus(plus(x *) *) , y, z] - [plus(× plus(* *)), y, z] which represents the partitioned term ptus(plus(x y) Z) --= ptus(x plus(y Z)). 3. G E N E R A T I N G A P A R T I T I O N F O R T H E C O N C L U S I O N This chapter describes how to compute a suitable partition of one side of the initial induction conclusion such that manipulating only its changeable sections enables the use of the induction hypothesis. A promising partition of the conclusion is chosen by comparing conclusion and hypothesis. Based on this partition we construct both an initial C-term of the conclusion and a scheme of C-terms representing potential results of deduction, i.e. C-terms denoting terms which enable the use of the hypothesis. Starting at the initial C-term we manipulate it by repeated use of Cequations until we obtain a C-term satisfying the scheme noted above. But how can we compute such a partition to guide the proof by comparing hypothesis and conclusion. Since the unchangeable sections of the final conclusion remain the same as the unchangeable sections of the initial conclusion, both the initial conclusion and the resuk of deduction are built up on the same skeleton. On the other hand, the only thing we know about this result is that it is enabled for using the hypothesis. I.e. the hypothesis matches a subterm of the result. Hence it seems to be obvious to use a skeleton for guiding the induction proof on which both the conclusion and the (instantiated) hypothesis can be built up. The more specific this skeleton is, the more we

153

reduce the search space but also the more we run the risk to miss the proof. At present, however, we are interested in a most specific skeleton of the conclusion and the (instantiated) hypothesis. In order to compute such a skeleton, consider the generation of an induction formula for an arbitrary formula V x,y p(x y ) , cf. [Aubin, 1979, B o y e r and Moore, 1979; Stevens, 1988; Hutter, 1989]. Suppose, we carry out induction on x. Then we obtain as base case a formula like: V x,y q)(x) --* P(x y) and as an induction step a formula like: V x --,O(x) --> (V y P(~(x) y) -~ (V y P(x y)) ). Comparing the induction hypothesis V y p(~(x) y) with the induction conclusion V y P(x y), we observe two differences: 1. Each occurrence of the so-called i n d u c t i o n v a r i a b l e x in the conclusion corresponds to an occurrence of a term ~(x), which denotes a predecessor of x w.r.t, some well-founded ordering, in the hypothesis. 2. All free variables occurring in both hypothesis and conclusion are induction variables. Hence we proceed with the assumption that the sets of all non-induction variables of hypothesis and conclusion are pairwise disjoint. To get a most specific skeleton of conclusion and hypothesis we neglect the second point and identify each non-induction variable in the hypothesis with its corresponding variable in the conclusion. Thus, we are left with the differences from substituting the induction variables by their "predecessors". Examining many examples, we made the following important observation: an induction variable x occurs almost always in its corresponding term 8(x). For instance, in the introductory example the induction variable x occurs in p(x). Provided x occurs in a(x), we may represent ~(x) by a C-term like [tx, x], or [tx, x . . . . . x] if x occurs more than once in 8(x). For instance, [p(*), x] denotes the term p(x). Thus, if we add a proper context tx to each occurrence of an induction variable x in the conclusion, we obtain the (renamed) induction hypothesis. Hence, we interpret the entire conclusion as unchangeable and achieve a partition of the conclusion which has no changeable sections. Based on this partition we construct the initial C-term for an arbitrary side of the conclusion. Since both sides o f the partitioned conclusion have no changeable sections, all contexts of the corresponding C-terms are empty. In order to compute a scheme of C-terms representing potential goals of the deduction we make following considerations: (i) Since we are interested in using the hypothesis, a subterm of the modified conclusion needs to be matched by one side of the instantiated hypothesis. Hence it does not matter in which surroundings this subterm occurs, i.e. the root of the final C-term may possess an arbitrary context. (ii) In order to compute a common skeleton of one side of hypothesis and conclusion, we have identified the non-induction variables of both formula. But since we may instantiate the noninduction variables of the hypothesis arbitrarily, also the nodes of the final C-term labelled with noninduction variables may possess arbitrary contexts. Let us now return to the introductory example of proving the distributivity law of plus over times by induction:

154 Since the left-hand side of the conclusion plus(tlmes(x y) tlmes(x z)) has no changeable sections we obtain the initial C-term shown in Figure 3.1. Figure 3.2 shows the scheme of a final C-term which enables the use of the induction hypothesis. ? denotes the arbitrary contexts mentioned above.

[~, plus]

[*, plus]

[*, times]

,/',, [*, times]

[*, times]

/%/% [*,x]

[*,y]

[*,x]

[*,z]

Fig. 3.1: C-term of plus(times(x y) times(x z))

[p('), x]

[*, times]

t~, y] [P(*),x]

[~, z]

Fig. 3.2: scheme of a final C-term

4. P R O V I N G I N D U C T I O N S T E P S The last step is to manipulate the computed C-term of one side of the conclusion to enable the use of the hypothesis. Thus, we manipulate the C-term shown in Figure 3.1 until it satisfies the scheme of Figure 3.2. This aim is divided into two subgoals: Initially, only the contexts of the induction variables prevent the use of the induction hypothesis. They are all empty in the conclusion but (usually) non-empty in the hypothesis. Now, we generate these missing contexts by using appropriate C-equations. This is done with the help of so-called context-creating C-equations. We call a C-equation context-creating iff its left-hand C-term contains only the empty context *. Consider a recursive case in a definition of a function f: C -~ t(xl ...Xn) - g(...f(6(xl) ...6(Xn)-.). If each of the formal parameters xi occurs in the actual parameters 8(xi) of the recursive call, i.e. ~(xi) is equal to some hi(xi), then the C-equation corresponding to f(xl...Xn) - 9(...t(h(xl) ...h(xn) )..) is context-creating. This condition is, for instance, satisfied by almost every recursive case in the function definitions of the exemplary database in [Boyer & Moore, 1979]. Examples are the C-equations of recursive cases of plus and times as shown in Figures 2.6 and 2.7. Further examples of context-creating C-equations are structure definitions like [', x] - [p(s(')), x] denoting x - p(s(x)). In our example we use the C-equation of Figure 2.7 to generate the missing context p(*) at both occurrences of the induction variable x. Hence we use this C-equation at the positions designated by in Figure 3.1. Note, that this C-equation is governed by a condition and before application we have, of course, either to verify that condition or we have to divide the proof into several cases. The former may be done by the help of some depth-limited refutation procedure, while the use of the latter has to be restricted by some heuristics which prevent the prover to divide the proof into infinite many cases. But we do not go into details how do this.

155 Comparing the C-term shown in Figure 4.1 and the scheme shown in Fig. 3.2, the contexts of both occurrences of x are equal. But unfortunately, the use of the C-equation in Figure 2.7 has generated also unwanted contexts plus(y *) and plus(z *).

[*, plus]

[plus(y *), times]

[plus(z *), times]

After the first step of our approach we have generated all missing contexts in the occurrences [p(*), x] [*, y] [p(*), x] [*, z] of the induction variables. In doing that we also generated unwanted contexts in other nodes of the Fig. 4.1: C-term of plus(plus(y times(p(x) y)) plus(z times(p(x) z))) C-term. Hence, in a second step we have to "move" these contexts to positions in which arbitrary contexts are admissible, i.e. positions the contexts of which are labelled by ? in Figure 3.2. We do this by the help of so-called context-moving C-equations. A C-equation is called contextmoving iff on one side only the root and on the other side only leaves have non-empty contexts. A typical example of a context-moving C-equation is the associativity law, e.g. the associativity law of plus as shown in Figures 2.3 and 2.4. But also C-equations of other "classical" mathematical laws such as distributivity (Figure 2.5) or homomorphism - are context-moving. Almost half of the equations given in the exemplary database of [Boyer and Moore, 1979] are representable as contextmoving C-equations, which illustrates the importance of this form of equations for induction proofs. Wave rules [-Bundy, 1988] can be interpreted as another form of context-moving equations.

[plus(y *), plus]

[*, timesl

[plus(z *), times]

./'.,../-,, [p('), xl

[*, Yl

[p(*), xl

[*, z]

Fig. 4.2: C-term of plus(y plus(timos(p(x) y) plus(z times(p(x) z))))

[plus(y plus(z *)), plus]

[*, times]

[p(*), x]

[*, times]

[*, y]

[p(*), x]

[', z]

Fig. 4.3: C-term of plus(y plus(z plus(times(p(x) y) times(p(x) z))))

Let us now return to our example. We use the Cequation of the associativity law of plus (Figure 2.3)at the top-level of the C-term shown in Figure 4.1 to move the unwanted context plus(y *) to the root. Hence we obtain the C-term shown in Figure 4.2. Comparing the scheme in Figure 3.2 with the actual C-term in Figure 4.2 only one unwanted context, namely plus(z *), is left but neither one of the C-equations of the associativity law nor any Cequation of the definition of plus is applicable to move this context to the root. The C-equation shown in Figure 2.4, however, seems to be suitable (ignoring the not unifiable contexts plus(z *) and plus(" z) ), since it enables us to move a context from the right leaf to the root. Now, there are two possibilities: either we know that plus is commutative and we thus manipulate the context plus(z *) to plus(* z) or we generate a task to prove that both contexts are equal. In any case after that, the C-equation representing the associativity law of plus (Figure 2.4) is usable to move the manipulated context to the root. Applying again the commutativity law of plus we

156

change the context in the root to plus(y plus(z *)) and obtain the C-term shown in Figure 4.3, which already fits the scheme in Figure 3.2. Hence the induction hypothesis can be used to obtain the term plus(y plus(z times(p(x) plus(y z)))). Applying the same approach to the right-hand side of the conclusion yields the term plus(plus(y z) times(p(x) plus(y z))) and after using the associativity law of plus the theorem is proved. Let us now consider a more difficult example in which we have to use the induction hypothesis twice: Suppose,

we

have defined the binomial coefficient ( ~ ) by the following set of conditional

equations: Defbinom = { V x,y:nat y - 0 --~ binom(x y) --- s(0) ~" x,y:nat x - 0 ^ y - s(p(y)) ---) binom(x y) -- 0 'V' x,y:nat x - s(p(x)) ^ y - s(p(y)) --~ binom(x y) - plus(binom(p(x) y) binom(p(x) p(y))) } Analogously to the remarks in the [plus(* b*), inom, b ~ last example the equation of the recursive case of binom (ignoring its condition x - s(p(x)) A y ----s(p(y)) ) may also be represented as a [*, x] [*, y] [p(*), x] [*, y] [p(*), x] [p(*), y] context-creating C-equation as shown in Figure 4.4. The skeleton Fig. 4.4: C-term of binom(x y) .~ plus(binom(p(x) y) binom(p(x) p(y))) of both sides is {binom(x y) }. Suppose, we want to prove the theorem V x,y:nat y - s(p(y)) -~ binom(x ptus(x y)) =- 0 by structural induction on x. Hence, we obtain as induction step V x:nat x -- s(p(x)) ( (~' y:nat y - s(p(y)) ---) binom(p(x) plus(p(x) y)) - 0) --~ (V y:nat y - s(p(y)) --) binom(x plus(x y)) - 0 ) ). Choosing the left-hand side binom(x plus(x y)) of the conclusion we again try to make the induction hypothesis useable and again we compare both left-hand sides of conclusion and hypothesis to get a suitable partition. The resulting partitioned term binom(x plus(x y)) has [*, binom] [~, binom] no changeable sections such that its representing C-term (Figure 4.5) [*, x] [*, plus] [p(*), x] [*, plus] possesses only empty contexts. The scheme of the final C - t e r m is [p(*), x] [~, y] [*, x] [*, Y] shown in Figure 4.6. Fig. 4.5: C-term of binom(x plus(x y)) Fig. 4.6: scheme of the fmal C-term

,/-,,,

157 Again, the first step is to generate the missing contexts in the occurrences of the induction variables x. Searching for a suitable contextcreating C-equation we only find the [plus(**), binom, binom ] C-equation o f the definition of bloom (Figure 4.4). Using it yields the C-term shown in Figure 4.7. [p(*), x ] ~ [p(.), x] Since its unchangeable section on the left-hand side corresponds to two unchangeable sections on the right-hand side of the used C[*, x] [*, y] [*, x] [*, y] equation we obtain two possible Fig. 4.7: C-term of p o s i t i o n s to c o m p a r e with the plus(binom(p(x) plus(x y)) binom(p(x) p(plus(x y)))) scheme of a final C-term. In order to generate the missing contexts in the [plus(* *), binom, binom ] r e m a i n i n g occurrences of x, we a p p l y the C - e q u a t i o n o f the definition of plus (Figure 2,6) to these occurrences and fmatIy obtain the C-term shown in Figure 4.8.

/',,

/'x

Comparing the scheme of a final C-term with both candidates yields Fig. 4.8: C-term of unwanted contexts s(*) resp. p(s(*)) plus(binomIp(x) s(plus(p(x) y)) binom(p(x) p(s(plus(p(x) y))))) in each of them. The second one can be removed by applying the contextcreating C-equation [p(s(*)), *] - [*, x], stemming from the structure axioms of nat from right to left. W e obtain the C-term shown in Figure 4.9.

[p(*), x]

[*, y]

[p(*), x]

[*, y]

W e are left with the context s(*). Since one non-induction variable occurs in the hypothesis we have two possible sinks (marked by ?) for unwanted contexts. Moving binom ] [plus(*~ the context s(*) to the root seems to be impossible, since we would need a C - e q u a t i o n r e p r e s e n t i n g an [p(*), x] [*, plus] [p(*), x] 4~ equation like

/.,, /',,

[p(*), x]

[*, Y]

[p(*), x]

[7 y]

~' u,v:nat blnom(u s(v) ) --f(...blnom(u v)...).

On the other hand we may move this context to the leaf marked with a plus(binom(p(x) s(plus(p(x) y)) binom(p(x) plus(p(x) y))) non-induction variable y. Hence we search for a suitable context-moving equation. Assume, there is no appropriate C-equation in our database. Then, one solution is to generate an appropriate equation and prove it as a subgoat by induction. But how can we formulate such an equation? Comparing the scheme of the goal and the actual C-term we can formulate a scheme of the required C-equation as shown in Figure 4.10. Thus, we have to "guess" an appropriate context instead of ? at the leaf marked with v.

Fig. 4.9: C-term of

158 A solution is to use the context s(*) of the root of the left C-term. This yields the subgoal

[s(*), plus]

[*, plus]

V u,v:nat s(plus(u v)) - plus(u s(v)) which is easily proved by induction. Using the context-moving C-equation corresponding to

[*, u]

[*, v]

[*, u]

[?, v]

Fig. 4.10: s(plus(u v) ) -- plus(u s(v) ) we obtain the C- scheme of a C-equation of s(plus(u v)) ---plus(u ...v...) term shown in Figure 4.11, which satisfies the scheme of a final C-term in two ways.

[plus(* *

~

[p(*), x]

Since the condition y = s(p(y)) of the hypothesis is satisfied in both cases, i.e. both s(y) = s(p(s(y))) and y - s ( p ( y ) ) hold, we may apply the induction hypothesis twice in the term represented by the C-term

binom]

,/-,,,

[*, plus]

,/-,,, [p(*), x]

Fig. 4.11: C-term of

[p(*), x]

Is(*), y]

['plus]

above and obtain plus(O o) as the left [p(*), x]

plus(birlom(p(x) plus(p(x) s(y))) binorn(p(x) plu$(p(x) y)))

[*, y]

side of the conclusion, which now can be evaluated to 0. Thus, left and right side of the conclusion agree and the formula is proven.

5. RELATED W O R K S

The best known work on proving theorems by induction is that of Boyer and Moore [Boyer and Moore, 1979]. Recently, their heuristics for the guidance of induction proofs have been reconstructed in terms of proof plans as a specification of tactics in the LCF-system by Bundy [Bundy, 1988]. Based on these proof plans we will consider some differences between the heuristics of Boyer and Moore and our approach. In order to modify the conclusion for the application of the hypothesis, Bundy uses a method called "Rippling Out ". This method uses wave rules to move, in our notion, undesired contexts into the root. These rules are a special form of our context-moving equations. There are no methods corresponding to the context-creating equations. A main point is, that our approach makes a distinction between the maintenance of unchanging parts of terms during the deduction and heuristic guidance of the induction proof. The former is automatically achieved by the choice of representation of terms while the latter one is accomplished by a set of tactics each of which operates on C-terms resp. C-equations. Thus our tactics operate on a more abstract level, since they do not care about invariant parts of terms and occurrences which denote these parts, They just handle creating and moving contexts, like moving wagons on a track system. 6. C O N C L U S I O N We proposed a representation of terms that allows us to mark parts of them to be unchangeable during deduction. Based on this representation we developed a representation of equations. We used

159

this representation to guide induction proofs. It turns out that with the help of this representation we are able to think of the application of equations in a quite operational way: The modification of the conclusion is reduced to the problem to create or move contexts into the appropriate positions of the correspondent C-tenn. The equations can be thought as rules, how to create or move contexts inside a C-tenn. This operational view of equality reasoning make this approach of interest to other fields of equational reasoning. Our technique is integrated in the INKA-system, an induction theorem prover under development at the University of Karlsruhe [Biundo et al. 1986; SFB, 1990]. As a rule, our approach reduces the possible deductions during the reduction of the conclusion drastically such that the system obtains the intended deduction without backtracking. For example, given the definitions of plus and times the INKA-system successively proves the theorems associativity and commutativity Of plus and times, distributivity of plus over times, n

n

I1

Et

n

plus(~ i E i ) - times(n s(n)) and E i 3 - times(,~ i Y, i)

i=l i=l

i=l

i=1 i=l

by a Symbolics 3640 all together in less than 45 seconds. 7. A C K N O W L E D G E M E N T S I am indebted to my colleagues B. Hummel, M. Protzen, W. Reif, and Chr. Walther for their support and helpful discussions during the preparation on this work. I also want to thank one (anonymous) referee of this paper for his helpful suggestions and clarifying comments.

8. REFERENCES Aubin, R. Mechanizing Structural Induction, Theoretical Computer Science, voL 9, 1979 Biundo, S., Hummel, B., Hutter, D. and Walther, C. The Karlsruhe Induction Theorem Proving System, Proceedings 8th CADE, Springer Lecture Notes Comp. Sc. vol. 230, 1986 Boyer, R.S. and Moore, J S. A computational Logic. Academic Press, 1979 Bundy, A. The Use of Explicit Plans to Guide Inductive Proofs, Proceedings 9th CADE, Springer Lecture Notes Comp. Sc. vol. 310, 1988 Goguen, J.A., Thatcher, J.W. and Wagner, E.G. An Initial Algebra Approach to the Specification, Correctness, and Implementation of Abstract Data Types. In Current Trends in Programming Methodology, R.T. Yeh (Ed.), Prentice Hall, 1978. Huet, G. and Oppen, D.C. Equations and Rewrite Rules: A survey. In: Formal Language Theory: Perspectives and Open Problems, R. Book (Ed.), Academic Press, 1980. Hutter, D. Complete Induction. In: Deduction systems in artificial intelligence, Bl~isius, K.H. and B/lrckert, H.J. (Ed.), Ellis Horwood, 1989 Stevens, A. A Rational Reconstruction of Boyer and Moore's technique for constructing induction formulas. Proceedings of the 8th ECAI, 1988 Sonderforschungsbereich (SFB) 314 Arbeits- und Ergebnisbericht fiir die Jahre 1988-1990, Universit/it Karlsmhe, 1990

APPENDIX:

FORMAL DEFINITIONS OF C-TERMS AND C-EQUATIONS

The reader is assumed to be familiar with the usual notions of first-order logic and equality reasoning [Goguen et al., 1978; Huet and Oppen, 1980].

160

W e a s s u m e we are g i v e n a n o n - e m p t y set S of sort symbols, which are n a m e s for the various domains under consideration. Given any n o n - e m p t y set M, we let M * denote the set of all finite sequences of elements of M, including the empty sequence ~., and use M + as an abbreviation for M*-{~.}. For an S-indexed family of sets M=(Ms)sES and any W=Sl ... Sk e S*, Mw denotes the set of all finite sequences ml,..mk e M* with mi e Msi for l<'<~k, where M~. ={~,}. A n S-sorted signature Z = (Zw,s)weS*,seS is an S+-indexed family of pairwise disjoint sets. Let w¢~., then any f e Ew,s is a function s y m b o l of rank ws, arity w and sort s. The elements of Z~.,s are constant symbols of sort s. 'V= (Vs)ses and X = (Xs)sasare 5+-indexed families of n o n - e m p t y , pairwise disjoint, and infinite sets. Elements of Vs are called variables of sQrt s. Elements of Xs are called meta-variables of sort s. W e assume ~ n V = O, Z ¢~ X = O and X n V = O. q(Z, qbs denotes the set of all (well-formed) Z-terms over E and V o f sort s and q(Z, V, X)s denotes the set of all extended Z-terms over Z, V, and X of sort s. For an extended Z-term t, V(t) is the set of all variable symbols and X(t) the set of all meta-variable symbols in t. F(Z, ~ is the set of all Z-formulas (over Z and 't,), built with the junctors ^, v, --~, and 7 , and the quantifier symbol V from the atomar formulas TRUE, F A L S E and s ~ t (for all s,t ~ q(E, qb ). A Y.formula s - t is called an equation, i.e. -= denotes the syntactic equality. An occurrence is defined as a sequence of integers denoting an access path in a term and A denotes the empty sequence. For t ~ q(Z, 'V,,X) we denote O(t) the set of such occurrences of t, and for g O(t), we use t I ~ to denote the subterm of t at occurrence re. Finally we define t [rc(---s] as the term t, in which we have replaced the subterm at occurrence rc by s. Let ~0 and ~: be mappings and ~t'be a set. Then the restriction (p 1Mis defined as (p) M (x) = (p(x) if x~ M a n d undefined else; ((p- ~:) is defined as the usual composition of mappings, Let 9v/1 and M2 be the d o m a i n s of (p a n d K. If ff~(1 n M"2 = O, we define the merge of two m a p p i n g s (p + K as (~p+~¢) (x) = ~o(x) if x~ M1, (q~+ ~¢) (x) = ~(x) if x e M2 and undefined else.

Definition 1: A n extended term t e q(Z, ~ X)s is called a c o n t e x t of sort s, iff each meta-variable * e X occurs at most once in t. 'TCs is the set of all contexts of sort s.

Definition 2: The set of fixed C - t e r m s Cfs and the set of the c h a n g e a b l e C - t e r m s Ccs of sort s are the least sets such that: (i) % u ~ . , ~ ' - C~, (ii) if f e Ew,s and t + e CCwthen f(t +) is a fixed C-term of sort s. (iii) if t ~ 'TCs and (p : X(t) --~ Cfthen It, (p] 2is a changeable C-term of sort s. The u n i o n of fixed C-terms and changeable C-terms is called the set o f C-terms C~

Definition 3: Let t be a C-term then the r e p r e s e n t e d term ~(t) of t is def'med as follows: (i) ~(t) = t , if t ~ V, (ii) ~(f(tl ... tn)) = f(~(tl) ... ~(tn)) if f(tl ... tr0 is a f ~ e d C-term,

2Since the domain of cp is finite, we may denote ~ by a list of pairs {(*1 tt) ... (*n tn) }. For sake of readability we do not differ between the representation of (p, i. e. the list of pairs noted above, and the mapping (p itself.

161

(iii) (iv) (v)

{([*, ~p]) = {(¢p(*)) if [*, ~p] is a changeable C-term, ~([v, ¢p]) = v ff [v, q~] is a changeable C-term and v • qew Z)~ ~([f(tl ... trO, (p]) = f({([tl, (plX(tl)]) ... {([tn, (plX(tn)])) if [f(tl ... tn), ¢Pl is a changeable C-term.

Definition 4: Let t be a C-term, then the s k e l e t o n co(t) o f t is defined as follows: (i) co(t) = {t}, i f t • q / u ZX, (ii) co(t) = {f(t'l ... 1:'11)I t'i • co(ti) } i f t = f(tl ... tn) and l_
Definition 5: Let s, t • C¢ then s = t is called a C - e q u a t i o n iff c0(s) = o)(t) holds. ~(s) - ~(t) is called the equation c o r r e s p o n d i n g to s -- t.

Definition 6: A m a p p i n g ~ : Ct---> Ctis called a C - s u b s t i t u t i o n , iff it satisfies following conditions: (i) {x e q]l O(x) ¢ x} is finite, and (ii) the compatibility conditions: (1) c ( c ) = c i f c i s aconstant, (2) ~([c, 0 ] ) = [c, O] if c is a constant, (3) cr([v, ~D]) = [{(v), O ] if v is a variable, (4) o(f(t] ... tn)) = f(o(t]) ... O(tn)) if f(tl ... tn) is a fixed C-term, (5) ly([f(tl ... tn), q0]) = [f(sl ... Sn), (1(1 +...+ Kn)] with [si, ~i] = ~([ti, (plX(ti)]) for l_
Definition 7: Let ~ be a C-substitution and s,t two C-terms. Then ~ is called a m a t c h e r o r s and t i f f if(s) = t. L e m m a 1: Let (~ be a C-substitution and t a C-term. Then (~. er) (~(t)) = ~((~(t)). L e m m a 2: Let ~ be a C-substitution and q -= r a C-equation Then o~(c(q)) = co((~(r)).

Term R e w r i t i n g Induction Uday S. Reddy* Department of Computer Science University of Illinois at Urbana-Champaign Urbana, IL 61801 Net: [email protected]

Abstract

An induction method called term rewriting induction is proposed for proving properties of term rewriting systems. It is shown that the Knuth-Bendix completionbased inductive proof procedures construct term rewriting induction proofs. It has been widely held heretofore that these procedures construct proofs by consistency, and cannot be justified as induction methods. Our formulation shows otherwise. Technically, our result goes beyond the earlier ones in that it is independent of the confluence or ground confluence of the rewrite systems involved. This addresses one of the major criticisms of the method raised in recent times.

1

Introduction

We present a new induction method for proving properties of term rewriting systems called term rewriting induction. Term rewriting systems arise in programming as generalizations of (first-order as well as typed higher-order) functional programs. They also arise in implementations of algebraic specifications. Using the term rewriting induction method, we are able to validate the widely studied inductive proof procedures based on KnuthBendix completion. The first such procedure was proposed by Musser [26] and various improvements have since been made [1, 5, 10, 12, 15, 19, 20, 22, 24, 25]. Our formulation shows that these procedures indeed construct inductive proofs in terms of term rewriting induction. This is in contrast to the traditional justification of these procedures in terms of "proof by consistency". Moreover, our results generalize the conventional ones in that these procedures are shown to be valid even if the rewriting systems involved are not confluent or ground confluent. The essential idea of term rewriting induction can be described in rather simple terms: If we have a uniformly terminating rewrite system (i.e., without any infinite rewrite sequences), then the corresponding rewrite relation is a well-founded order over terms and so can be used as the basis for induction. Noetherian induction speciMized to the term rewriting order is what we call term rewriting induction. This form of induction was used by Huet [14] and others for proving confluence properties of rewrite systems, and we "This work was supported in part by a NSF grant: NSF-CCR-87-00988.

163

adapt it to proving inductive properties of the structures described by rewrite systems. (There are several technicalities in doing induction on terms rather than values. We deal with these in section 2). Stated in this form, term rewriting induction is not all that new in computer science. It is closely related to Hoare induction [13] for proving partial correctness properties, as well as to fixed point induction [30]. Based on these ideas, we show that an inductive proof procedure based on KnuthBendix completion constructs term rewriting induction proofs. (This procedure is equivalent to those proposed by Fribourg [10] and Kiichlin [24], and subsumes earlier procedures [5, 15, 19, 22, 26]). This formulation may be contrasted with Musser's formulation where it is shown that the procedure is complete in detecting inconsistencies. From the fact that a strongly complete proof system entails a formula iff it is consistent with the axioms, it follows that a formula that does not generate an inconsistency is an inductive theorem. See [20] for the theory of this argument. We were prompted to this study by some recent criticism of the completion-based induction procedures [11]. Such procedures are based on consistency arguments, the critique maintained, and so hard to understand. They are also severely hampered by confluence restrictions. And so, conventional methods, such as structural induction, are superior. In contrast, our experience with completion-based methods shows the opposite conclusions. The completion-based procedures of our Focus program transformation system were indeed justified by induction arguments [29, 28] and so were many other results on completion [3, 14]. In fact, the induction method implicit in these arguments is crystallized as term rewriting induction in the present paper. This shift of focus from proof procedures to the induction methods has produced rewarding results. It showed us, in particular, the role confluence plays (or does not play) in the inductive proof procedures. Confluence is not necessary to prove valid properties using the completion methods, but it is necessary to refute invalid properties. Given that our interest is mainly in proving properties rather than refuting them, the confluence requirement is quite unnecessary. Term rewriting induction is Noetherian induction specialized to a specific well-founded order (albeit a very general one). So, it cannot be complete (even in the relative sense). There would always be properties provable by some other induction method, but not provable by term rewriting induction. This does not necessarily decrease the value of the method. As we show, the advantage of term rewriting induction is the ease with which it can accommodate hierarchical inductive proofs. We can combine it with other methods whenever necessary. But, in our opinion, it is still an extremely convenient method both for mechanical and human use. The remainder of the paper is organized as follows. Section 2 presents the basic notions of inductive proofs and the generalization of Noetherian induction to terms. Section 3 discusses term rewriting induction, and section 4 presents an automatic proof procedure based on the method. Section 5 relates term rewriting induction to the proof procedures based on Knuth-Bendix completion. In section 6, we consider the question of completeness. We formulate a notion of relative completeness and show that term rewriting induction and completion-based methods are not relatively complete in this sense.

164

0 : nat, s : nat --+ nat, + : nat × nat --+ nat

NI: N2:

x+0 x+s(y)

= =

x s(x+y)

Figure 1: A set of axioms for natural numbers

2

Inductive Proofs

Definition 1 (inductive consequence) Let H be a sorted (typed) language of ground terms generated by a sorted alphabet of function symbols F . Let A be a set of axioms. A proposition P is an inductive consequence of A (in H), written A ~-i~d P iff every well-sorted ground instance of P (with instantiations from H ) is a consequence of A. The standard method of proving inductive consequences is the following: P r o p o s i t i o n 2 ( N o e t h e r i a n i n d u c t i o n principle) Let >- be a well-founded order on H, A be a set of axioms, and P[x] a proposition. A ~ind P[x] if A ~- (Vy -~ x. P[y]) P[x]. (Note: x and y range over over H ) . [] Now, let T be the set of ground as well as nonground terms, and ~- be a stable wellfounded order on T. ~ We can formulate the following variation of the Noetherian induction principle: P r o p o s i t i o n 3 ( N o e t h e r i a n i n d u c t i o n for t e r m s ) Let >- be a stable well-founded order on T, and P[x s] a proposition with a variable x of sort s. A F-i=dP[x ~] if I. {tl}i is a set of terms of sort s such that every ground term of sort s is an instance of some ti, and 2. for each case P[tl], A ~-(Vu -~ t,. P[u]) ~ P[ti]. (Note: ti and u range over T, and may have variables).

As an example of how nonground terms can be directly used in inductive proofs, consider the signature and axioms of Figure 1 and the proposition P[z] : 0 + z = z. Assume a stable well-founded order whereby s(t) ~- t for all t E T. Since s(y) >- y, we can assume P[y] in proving P[s(y)]. The first condition of Proposition 3 is stronger than necessary, and we weaken it using the notion of cover sets: Definition 4 (cover sets) Let A be a set of axioms and ~- a stable well-founded order. A set of terms {ti}i of sort s is a >--cover set for s (with respect to A ) if, for every ground term g of sort s, there is a ti and substitution cr such that g =A t~cr and g >_ t~a. 1A stable order is an order preserved by substitution.

165

We can easily generalize this notion for multiple variables of possibly different sorts, and talk about a cover set of substitutions {ai}~. Similarly, if e is a term or a proposition, a set of instances {ca~}i is a cover set of cases for e if {cr~}~ is a cover set of substitutions. Bachmair's notion of cover sets [1] and the complete test set notion of Kapur et. al. are obtained by restricting ~- to a rewrite relation -~+. The generalization incorporated in the above definition is significant. (See the discussion at the end of 5.1). Zhang et. al. [32] use a completely different notion of cover sets which incorporates additional information via so-called "cover functions". It seems that the additional information gives their method more power. However, it is not clear how to automate the detection of cover functions in nontrivial cases. The relation between term rewriting induction and thei~ cover set induction remains to b e investigated. E x a m p l e 5 We use here recursive path orders (rpo) [7] to formulate well-founded orders. Let ~1 be the rpo generated by the precedence order + > s > 0. Then N1 = {0, s(x)} is a >-l-cover set for nat. Let ~-2 be the rpo generated by the precedence order s > + > 0. Then N2 = {0, s(O), x + y} is a ~ - c o v e r set for nat. Add an axiom s(s(O)) = 0 to the axioms of Figure 1. Let ~-3 be the singleton {0 ~-3 s(s(0))}. Then N3 = {s(x)} is a >-3-cover set for nat. (Note that ~-3 is not an rpo, or even a reduction order). [] P r o p o s i t i o n 6 Let ~ be a stable well-founded order on T . A t-i~d P[x s] if 1. {ti}i is a :,--cover set of cases for s, and 2. for each case P[ti], we have A F (Vu ~ tl. P[u]) =~ P[tl]. The above generalization of induction to terms using the notion of stable well-founded orders, allows us to consider arbitrary subterms of propositions instead of just variables. Even more interestingly, we can consider several subterms of the proposition. This, of course, requires us to compare multisets of subterms and the natural candidate for such comparison is the multiset order [8]. If ~- is a well-founded order on T, the multiset order on multisets of T is defined by X U {y} ~- X U { z l , . . . , zk} whenever y ~- z~ for all i = 1 , . . . , k. If ~- is stable and well-founded, ~ is stable and well-founded. Now, we have: C o r o l l a r y 7 Let ~- be a stable well-founded order on T, and P [ e l , . . . ,el:] a proposition with subterms e l , . . . , ek. A ~-~d P[el, . . . , ek] if 1. {a~}i is a ~-cover set of substitutions, and 2. for each case P [ e l , . . . , ek]crl, we have A b (g0: { e l 0 , . . . , ck0} --4<{elc~i,..., ekcrl). P [ e l , . . . , ek]0) ~

P i e 1 , . . . , ek]~ri

We take Corollary 7 to be our operational principle of induction. A proof method based on it involves two tasks: (1) finding the cover set of cases e(r~, and (2) choosing a well-founded order. We address the second issue first.

166

3

Term rewriting induction

In this section, we specialize Corollary 7 for rewrite relations and show that it yields automatable proof methods for proving inductive consequences of equational axioms. If E is a set of equational axioms its one-step replacement relation (stable, symmetric and monotonic extension) is denoted +-*E. An equation t = u is considered symmetric, and so is equivalent to u = t. Suppose the equations of E can be oriented to form a uniformly terminating rewrite system, i.e., there is no infinite rewrite sequence in R. We denote the one-step rewrite relation (stable and monotonic extension) of R by --+R, its inverse by ~--n, and its symmetric closure by ~R. As usual, the transitive and reflexive-transitive closures of ---~Rare denoted by --~+ and -*~ respectively. First, note that the rewrite relation ---~+ is a stable well-founded order on T. This fact now allows us to "factor out" termination aspects from inductive proofs. Once we have proved a rewrite system to be terminating, we can reuse this termination proof in inductive proofs without having to choose a suitable well-founded order again and again. This "factoring out" aspect is at the heart of the term rewriting induction method, and so the assumption of a terminating rewrite system is central to it. (This does not, however, rule out the use of unorientabte axioms. See Remark 14). Even though the rewrite relation ~ + is suitable for induction, we find that it is not always suitable for specifying cover sets. So, we introduce the following orders: Definition 8 ( r e d u c t i o n order) A well-founded order > over a set of terms is called a reduction order if it is stable and monotonic. Note that -++ is a reduction order. Definition 9 (decreasing order) The decreasing order generated by a reduction order > x , denoted ~-x, is (>x U I>)+ where I> is the strict super term order. The decreasing order generated by --~+ is denoted ~-R. It is not hard to see that a decreasing order ~-x is equivalent to >x U I> U(>x I>). So, a decreasing order is well-founded.

Definition 10 ( c o m p a t i b l e orders) Two well-founded orders >-1 and ~-2 are compatible if (~'1 U ~-2)+ is well-founded, or, equivalently, if they are both included in a wellfounded order. The principle of term rewriting induction is nothing but Corollary 7 specialized by the use of ~-R for induction. C o r o l l a r y 11 (Term r e w r i t i n g i n d u c t i o n ) Let R be a uniformly terminating rewrite system, and e = e' an equational proposition. Let ~- be a stable well-founded order that is compatible with ~-n. Then, R kind e = e' if 1. {ecri}i is a N-cover set of cases for e, and £./or

each case

= e%

R F

{ee,

= e'#) =>

= e%.

167

E x a m p l e 12 Consider the axioms of Figure 1, but now treat the equations as rewrite rules oriented left to right. Let P[z] : 0 + z = z be the proposition to be proved. As noted before, {[z -+ 0], [z -+ s(y)]} is a --++-cover set of substitutions. 1. For 0 + 0 = 0, we have 0 + 0

-"~gl

0.

2. For 0 4- s(y) = s(y), we have 0 4- s(y) ---*N2 s(O + y) ~--*ps(y). Note that P is applied as inductive hypothesis for a smaller pair of terms: {0 4- y, y} "~n {0 + s(y), s(y)} (since 0 4- s ( Y ) --*N2 s(O 4- y) t> 0 4- y, and s(y) ~>y). [] The argument applied in this example can be generalized. All that is needed is to ensure that for each case of the proposition there exists a so-called "valley proof", i.e. a proof of the form ---~**--*, and it is then guaranteed that the inductive hypothesis is only applied to smaller terms. This observation leads to Proposition 13. We say that an equational proposition e = e r is orientable if R U {e --+ e ~} is uniformly terminating. P r o p o s i t i o n 13 ( T e r m r e w r i t i n g i n d u c t i o n f o r o r i e n t a b l e e q u a t i o n s ) Let R be a rewrite system and P : e --~ e' an oriented equation such that R U P is uniformly terminating. Let ~- be a stable well-founded order compatible with ~-RuP. Then~ R Fi=d P

if I. {eo-i}i is a >--cover set of cases of e, and 2. for each case e(ri ---* e~c% we have a and b such that eo'i --~n a

--+*RUBb +-~uP e'al.

Proof: Choose ~-nuP as the well-founded order. Suppose c -+v c' is an application of the inductive hypothesis in the segment a ---~uv b. Since eo'i ~- a __ c ~ d, we have {ec% e'o'~} ~- {c,c'}. So, every application of the hypothesis in this segment is for a smaller pair of terms. Suppose c ~ +-e c is a rewrite step in the segment b e-~u e er~ri. Since ecri ~- elo'i ~ c ~-

c', we have

e'¢d

{c, c'}.

Hence, by Corollary 11, P is an inductive consequence of R. [] The pragmatic advantage of this method is that we do not need to explicitly check that the inductive hypothesis is applied to smaller terms. The very form of the proof ec,i ~ n a --+~uP b +-.~uP e'ai guarantees that it is. The hypothesis P can be used in such a proof just like any other rewrite rule, as if it were a universal closure over all its variables. We exploit this in section 4 for constructing hierarchical induction proofs. However, note that the method also restricts the well-founded order to be used in inductive proofs to the decreasing order ~ n generated by the rewrite system. It is possible that there exists an inductive proof for a proposition using some well-founded order, but not using ~-R. In such cases, the method fails to find a proof. (Cf. section 6). There is also no guarantee that rewrite proofs of the above form exist for ecri = e'o-i. Proving lemmas (section 4) can help in such a situation. Having a confluent R also helps.

168

R e m a r k 14 For unorientable equational propositions (i.e., R U P not terminating), this result is not directly applicable. But, note that the only purpose of termination restriction is to determine the instances permitted to be rewritten by the inductive hypothesis. We can thus replace -~nup in the proof scheme of Proposition 13 by the so called rewriting modulo congruence relation: -+n/p=~-~*e-+ne-~*P. See [2, 18] for a discussion of this notion. The same solution can be used to handle unorientable axioms. If the axioms can be partitioned as A ~ R where A contains unorientable axioms such that R / A is uniformly terminating, ~n/A can be used as the well-founded order. This addresses one of the criticisms of [11].

4

Hierarchical inductive proofs

In this section, we present an automatable proof procedure based on Proposition 13. However, a direct application of the proposition is not adequate for most problems in practice. We can often "reduce" an inductive proposition P to another proposition P1. P1 is then a "lemma" and needs its own inductive proof. Moreover, P1 may not be an independent inductive theorem, but may need to use appropriately smaller instances of P in its inductive proof. We call such proofs hierarchical inductive proofs. E x a m p l e 15 Consider the commutativity proposition P[u, v] : u + v = v + u. Using the recursive path order generated by + > s :> 0, its proof proceeds as follows: 1. P[u,0] reduces to Pl[u] : u = 0 + u. (oriented as 0 + u + u). (a) Pl[0] reduces to 0 = 0. (b) Pl[s(y)] reduces to s(y) = s(0 + y). By Pl[y], it reduces to identity.

2. P[u, s(z)] reduces to P2[u, z]: s ( u + z) -- s ( z ) + u. (oriented as s(z)+u -:, s(u + z)). (a) P2[0, z] reduces to .~(0 + z) = s(z), and then to identity by Pl[z]. (b) P2[s(y), z] reduces to s(s(y) + z) = s(s(z) + y). Using P2[z, y] and P2[y, z] on the two sides respectively, it reduces to s(s(z + y)) = s(s(y + z)). Now we use P[y, z] to reduce it to identity. Note that P1 turns out to be an independent lemma. It has a proof independent of P.

P2, on the other hand, is a subsidiary lemma. Its proof uses smMler instances of P, in addition to smaller instances of P2 itself. The use of inductive hypotheses is valid since a reduction has been made by the order -~+. Constructing such hierarchical proofs using conventional induction is quite trickly because of the multiple inductive hypotheses that need to be maintained. Note that what is proved in step 2 is the proposition (Vu. Vv -~ s(z). Flu, v]) ~ P2[u, z]. An additional hypothesis is added in proving this by induction. [] The proof procedure for constructing hierarchical inductive proofs is called inductive completion, owing to its similarity with Knuth-Bendix completion. It is a parameterized by a reduction order >. The axioms are assumed to be expressed as a set of rewrite rules R included in >. The procedure then incrementally constructs and modifies two sets of equations:

169

1. E, containing the set of equations to be proved, and 2. H , containing the equations (oriented as rewrite rules) which have been reduced to other equations in E and so can be used as inductive hypotheses. --'-~H is always included in >. We express the procedure in terms of inference rules. Operationally, the rules are used backwards in a goal-reduction fashion. The inference system I contains the following inference rules:

Expand

( E U E', H U {e ~ e'}) ( E U {e = e'}, H)

Simplify

(E U {a' = b}, H) (E U {a = b}, H)

Delete

(E, H) (E U {a = a},H)

if e > e', {ai}i is a >-cover set of substitutions for e, and

E' = {b = e'ai I eai --*n b}~ if a --~RuH at

An I-derivation is a sequence of states (Eo, Ho) -tI (El,H1) AI ... AI (E~,H~) where Ho = O, E~ = O. As an example, consider an initial state ({0 + u = u}, 0). By Expand using the cover set {[u ~ 0], [u ~ s(y)]}, we reduce it to

({0 = 0, 4 0 + y) = s(y)), {0 + u

u))

The second equation simplifies to identity using H , and both the equations are then deleted to obtain the final state ((3, {0 + u --~ u}). This inductive proof procedure is similar in spirit to that of Fribourg [10] and Kfichlin [24]. However, its correctness proof below is more general in that it does not assume either a confluence or a ground confluence property of R. This is significant because confluence is often hard to achieve, and ground confluence is known to be undecidable [21]. L e m m a 16 The proof relation 6~r*l=tuHuE is invariant in an I-derivation. L e m m a 17 The following assertion is invariant in an I-derivation: For every ground rewrite step g ---~H h, there is a proof g ~-+*RuE h such that every ~+E step in the latter proof is for a multiset of terms smaller than {g} by the order >>.

Proof: Since H0 = 0, the assertion is vacuously true for the initial state. Suppose it holds for (E~, Hi). The next state (El+l, tt~+1) is generated by using one of the inference rules backwards. Consider each rule: E x p a n d Let g --*H~+~ h be an instance of e -~ e'. Since {c~i}i is a >-cover set of substitutions for e, there is a cri and substitution 0 such that g ~*n ec~iO,g > ecriO, h +-+) el(ri0 and h _> e'ai0. So, we have a proof

* g +-~R

ecyiO ~ n bO +-~Ei+ ~ e'~O

* e-+R

h

Note that g > ea~0 > bO and g > h >_ e'cr~0. So, clearly {g} >> {bO, e'~r~O}. I f g -~Hi+l h is not an instance of e ~ e ~ t h e n g ~H~ h. It has a proof using R U Ei = R U E U {e = e'} with smaller *-+E~ steps. By the above argument, it also has a proof using R U Ei+l with smaller +-+E~+~ steps.

170

S i m p l i f y First, we show, by induction on >>, that if t ~s~ u is a ground proof step, then there is a proof t (--~RtJEi-~lU such that every ~E,+I step in it is smaller than or equal to {t, u}. If t ~ u is an instance of a = b then t ~E,+I u. If it is an instance of a = b, let O be the instantiation to t = u. By the inference rule, for each ground proof a0 ~s~ bO, there is a proof a~ ""+RuHi a'O ~+E~+~bO

If the first step is a0 ~ R a'8 then the only ~E~+~ step is for {a'8, b8} << {a8, b8}. If the first step is a0 ~n~ a'0, then there is a proof aO ~nuE~ a'8 with each ~E~ step smaller than {a8}. By inductive hypothesis, every such ~E~ step has a proof using ~*nuE~+~ with smaller ~E~+~ steps. The conclusion is thus proved. Since Hi+l = Hi, g --+n~+l h implies g --*Hi h. The latter implies that there is a proof g ~*nuE~ h using smaller ~E~ steps. By the above argument, there is a proof g *-~* RtJEi+~ h using smaller 6+Ei+~ steps.

Delete Trivial. Hence, the assertion holds in (El+l, Hi+l). [] P r o p o s i t i o n 18 ( C o r r e c t n e s s of i n d u c t i v e c o m p l e t i o n ) If there is an I-derivation starting from (E, 0) and ending in (0, H) for some H, then all equations in E are inductive consequences of R.

Proof: If t (-~E u is a ground proof then, by lemma 16, t +-+RtgH U, and, by lemma 17, t~*Ru. D

4.1

Postulating lemmas

It is well-known that we need to postulate and prove subsidiary lemmas in proving inductive theorems. In the context of the inductive completion procedure, this is rather easy. We use the following (noneffective) inference rule:

Postulate

(E U E',H) (E,H)

This allows us to add any set of equations E' to the equations to be proved. Moreover, the inductive completion procedure allows E and E' to be proved in a "mutually recursive" fashion, using each set as inductive hypotheses in the other's proof. Example 21 illustrates such an intricately interrelated proof. Let I + be the inference system I together with the rule Postulate.

Lemma 19 The containment of proof relations t"+*RuHiuZ i C_ +--+RuHi+IuEi+1 holds in an I + derivation. P r o p o s i t i o n 20 ( C o r r e c t n e s s of I +) If there is an I + derivation starting from (E, 0) and ending in (O,H) for some H, then all the equations in E are inductive consequences of R.

171

F1

f(0)

-~

0

F2 F3 al G2

f(SO) f(SSn) g(O) g(Sn)

--* -~ -~ --~

SO f(Sn) + f(n) (SO, O) np(g(n))

a3

~p((x,y))

-~ ~

(x+y,x) x+y

G4 surn((x,y))

Figure 2: Rewrite rules for Fibonacci numbers Proof'. If t t'-~ E ?.t is a ground proof, by lemma 19, t ~ u H holds in an I + derivation as well. So, t *-*~ u. D

u. The invariant of lemma 17

E x a m p l e 21 Figure 2 shows a rewrite system defining the Fibonacci number function f, a related function g and two auxiliary functions s u m and np. We would like to verify the correctness of g by proving the property g(x) = ( f ( S x ) , f ( x ) )

Proving it, however, requires a lemma: sum(g(x)) = f(Sx) + f(x)

Figure 3 shows a proof of the two equations constructed by the inductive completion procedure. The reduction order is the recursive path order generated by the precedence

f

> g > np > s u m > pair > + > s > 0

The set {0, S n } is uniformly chosen as the >-cover set for nat (by the equations of Figure 1). The subterms shown in boxes are those used for the mandatory reduction step in each expansion. Notice how the theorem and the lemma use each other as inductive hypotheses. The lemma (rule 2) is used in the proof of both the theorem as well as the lemma in the first two simplification steps. The theorem (via rule 5) is used in both in the last simplification step. []

5

Relationship to K n u t h - B e n d i x C o m p l e t i o n

In this section, we relate the inductive completion procedure of the previous section to an inductive proof procedure based on Knuth-Bendix completion [10, 19, 24]. The correctness of the latter then follows immediately.

172

Ei

Rule

1.

Expand

Expand Simplify/ Delete Expand Simplify/ Delete

=g(x)

2. f(Sx) + f ( x ) = sum(g(x)) <S0, f(0)) = g(0) = g(Sn)

Simplify/ Delete

Hi+l, simplifications

so + f(o) = sum(g(O)) f ( S n ) + f(n) + f ( S n ) = sum(g(Sn)) 3. <sum(g(n) ), f ( S n ) ) = r~(g(n)) 4.sum(g(n) ~ + f ( S n ) = sum(np(g(n))) <sum((SO, 0)), f(SO)) = np(g(O)) (sum(np(g(n))), f ( S S n ) ) = np(g(Sn)) sum((SO, 0>) + f ( S n ) = sum(up(g(n))) sum(np(g(n))) + f ( S S n ) = sum(np(g(Sn))) 5. (sum(np(g(n))),sum(g(n))> = up(up(g(n) )) sum(np(g(n) ) ) + sum(g(n) ) = sum(np(np(g(n) ) ) )

up(up(<So, 0>)) = <sum(up(g(0))), sum(g(0))> up(np(np(g(n)))) = (sum(np(g(Sn))), sum(g(Sn)))

sum(np(g(n))) + sum(g(n)) = sum(np(np(g(n))))

using using using using

R; deleted R R; deleted R and 2

using using using using

R; deleted R and 2 R; deleted R and 2

using R; deleted using R and 5; deleted using R and 5; deleted

Figure 3: Proof of the specification of g

5.1

Cover sets

The inference rule Expand places an important constraint on the choice of cover sets, viz., for each case eai = e'ai, ea~ must be reducible by R. The completion method of inductive proofs attacks this problem by first trying to satisfy the requirement of reducible left hand sides. The set of cases is obtained by choosing ~ such that ea~ is the most general instance of e rewritable by a rule in R at some position. The cases generated in this way are then examined for the cover set property. L e m m a 22 Let e be a term, a a nonvariabIe position in e, and R : l --~ r a rewrite rule. The most general instance of e rewritable by R at a is e~ where a = mgu(e/a, 1) is the most general unifier substitution. This property is often exhibited as a narrowing relation e ~-zR.... ec~[a+-rcr] (Cf. [9, 17,

27, 31]). D e f i n i t i o n 23 (cover set of n a r r o w i n g s ) Let e be a term, R a rewrite system. A set of narrowings {e "-*n,~,,~, dl) is a >-cover set of narrowings if {czi}i is a >-cover set of substitutions for e. Just as we have used the rewrite relation --*+ as the well-founded order for induction, we can also use it as the well-founded order to show cover sets. A necessary and sumcient condition for the existence of --++-cover set of narrowings is inductive reducibility [5, 19].

173

D e f i n i t i o n 24 ( i n d u c t i v e r e d u c i b i l i t y ) A term e is inductively reducible by R (also called ground reducible and quasi-reducible) if every ground instance of e is reducible by

R. Methods for testing inductive reducibility when R is left-linear are given in [19]. Methods for the general case, which are however efficient only for the left-linear case may be found in [22]. More efficient tests are possible when a set of constructors is available [15, 19]. P r o p o s i t i o n 25 Let R be a terminating rewrite system, then e has a --*+ cover set of

narrowings if and only if e is inductively reducible by R. It is easily seen that the set of all narrowings of e is a cover set if e is inductively reducible. O p t i m i z a t i o n s Even though the set of all narrowings gives a cover set, it is often an over-kill. For instance, if e has an inductively reducible subterm e/a then the set of narrowings inside the subterm is adequate for a cover set. The optimizations presented in [10, 24] are based on such ideas. The methods for testing inductive reducibility [19, 22] can be adapted to finding an adequate cover set of narrowings. See [4] for recent results. L i m i t a t i o n s of i n d u c t i v e r e d u c i b i l i t y m e t h o d Even though Proposition 25 shows that inductive reducibility is a necessary condition for the existence of --~+ cover sets, it is not necessary for the existence of arbitrary cover sets of narrowings. For instance, as shown in Example 5, N2 = {0, s(0), x + y} is a ~2-cover set for nat. But, it is not a --*+-cover set. (E.g., s(s(O)) ~-2 s(O) + s(0), but it is not reducible). Such a cover set is, however, useful for proving properties of the following definition:

xxO

~

x s(O) x x (y + z)

5.2

0 x (x × y) +

x z)

C r i t i c a l p a i r s as l e m m a s

The inductive completion procedure I, with the use of cover sets of narrowings for generating cases, is very close to the Knuth-Bendix completion procedure [3, 6, 16, 23]. If e ~ n .... b is a narrowing, then the equational proof e~c~ ~-- ec~ --. b is a critical peak proof and the equation elcr = b is a critical pair. Thus the inference rule Expand is essentially constructing critical pairs. However, the set of critical pairs generated by Knuth-Bendix completion is a superset of those needed for a cover set. It is sometimes found that the additional critical pairs have a useful role as lemmas. For instance, the crucial lamina involved in example 21 can be constructed from the critical peak proof:

sum(g(x)) ~ p sum((f(Sx), f(x))) ~ R f ( S x ) + f(x) To relate the Knuth-Bendix completion procedure with the inductive completion procedure, we formulate a procedure I g as a specialization of I + (for inductive completion with lemmas). The inference rule Postulate is specialized to:

Postulate

(E (E, U EH) l, H)

E' C C P ( R U H, R U H)

174

where CP is the set of critical pairs. The relation between I K and the use of KnuthBendix completion for inductive proofs [5, 15, 19, 22] is the following. Every inductive Knuth-Bendix derivation (derivation generating only inductively reducible left hand sides of rules) can be transformed to an I K derivation using -~+ cover sets. Of the critical pairs generated by the Knuth-Bendix derivation, those belonging to the cover set are obtained by Expand and the others by Postulate. The fact that the Knuth-Bendix derivation is inductive guarantees that the critical pairs include --*+ cover sets. Thus, the following result immediately follows from Proposition 20. C o r o l l a r y 26 If there is an inductive Knuth-Bendix derivation starting from (E, R) and ending in (9, Rt), then R ~ind E. This generalizes the results of [1, 5, 10, 15, 19, 22, 24] in that it is independent of the ground confluence of the rewrite system R. Note that the purported confluence requirement is the main argument against the use of completion-based methods in [11, 32]. Not only does the inductive completion procedure I g simulate Knuth-Bendix completion, it is more powerful than the latter as it does not insist that all the critical pairs should have inductive proofs. This has been discussed elsewhere [1, 10, 24, 28].

6

Completeness

Inductive theories of equational systems are as hard as Peano arithmetic, and so, by GSdel's incompleteness theorem, are not semidecidable. There can be no procedure for inductive proofs which is complete in the real sense. The oft-cited completeness result for the completion-based procedures is the following. A completion derivation is said to be fair if the set of persisting equations E~ = Ui nj>i E~ is empty. P r o p o s i t i o n 27 If R is a ground confluent and terminating rewrite system, and there is a fair Knuth-Bendix derivation starting from (E, R), then R F-~d E if and only if the derivation is inductive. Note that there is no guarantee that the completion derivation is finite. So, this may be called completeness at w (or co-semi-completeness [22]). However, notice also the strong restriction that R must be ground confluent. Its only use is to refute false propositions, not to produce effective proofs. Given that we are mostly interested in proving propositions rather than refuting them, this requirement is of limited practicM significance. To talk about useful completeness properties, we need a notion of relative completeness which factors out the second-order aspects of inductive proofs and states that the firstorder aspects can be carried out by the proof procedure. The following definitions propose such a notion. Definition 28 (inductive p r o o f ) An inductive proof of R F-i~dE, using a stable wellfounded order ~-, consists of a finite cover set of cases for each equation in E, and an equational proof for each case equation of the form eai <--+*RUE.<et ~i where

E.< = {cO = e'O I (e = e') e E, {cO, e'O}

175

The proof thus constructed is "relative" to the lemmas provided in E. Definition 29 (relative c o m p l e t e n e s s ) An inductive proof procedure is relatively com-

plete if, whenever there is an inductive proof of R [-ind E using ~-, the procedure succeeds in proving it. E x a m p l e 30 Consider again the problem of Example 21, but without the function sum. The lemma used in that example is now inexpressible. However, an inductive proof exists for the proposition using the (decreasing order generated by the) given reduction order. Note: g(0) - ~ 1 (S0, 0) ~{FI,F2} + (f(SO), f(O))

g( Sn) --*a2 np(g(n) ) ~-p np( (f( Sn), f(n)) ) --*a3 (f( Sn)+ f(n), f( Sn)) +"F3 (f( SSn), f( Sn)) But, there is no finite I K derivation for the proposition. (This may be checked by the reader). The problem is that the smaller instance condition:

{g(Sn), (f(SSn), f(Sn))} ~ {g(n), (f(Sn), f(n))} holds for the decreasing order generated by the reduction order, but it does not hold for the decreasing order ~-n generated by the rewrite relation. [] Thus, we have that P r o p o s i t i o n 31 Both inductive completion and Knuth-Bendix completion are relatively incomplete for proving inductive propositions. In the light of the earlier discussion, this is not surprising because the inductive completion procedure uses the rewrite relation as the well-founded order and so cannot find proofs based on other well-founded orders. This shortcoming suggests ways to improve the completion method so as to use other well-founded orders, but we do not explore those in this paper.

7

Summary

To summarize the results of the paper, we have formulated Term rewriting induction as Noetherian induction specialized by the use of of a rewrite relation as the well-founded order. It is shown that the widely studied completion-based inductive proof procedures construct inductive proofs using this induction method. These procedures are shown to be correct independent of the ground confluence restriction of the axioms. A notion of relative completeness is proposed for inductive proof methods. Both the inductive completion procedure and the general Knuth-Bendix completion procedure are not relatively complete in this sense.

8

Acknowledgements

I am grateful to Francois Bronsard, Nachum Dershowitz, Deepak Kapur, Wolfgang Kfichlin and Hantao Zhang for several discussions which led to the observations made here. The idea of relative completeness in section 6 was suggested by Dershowitz.

176

References [1] L. Bachmair. Proof by consistency. In Syrup. on Logic in Computer Science, IEEE, 1988. [2] L. Bachmair and N. Dershowitz. Completion for rewriting module a congruence. In P. Lescanne, editor, Rewriting Techniques and Applications, pages 192-203, Springer-Verlag, 1987. (Lecture Notes in Comp. Science, Vol 256). [3] L. Bachmair, N. Dershowitz, and J. Hsiang. Orderings for equational proofs. In Syrup. on Logic in Computer Science, pages 346-357, IEEE, 1986. [4] R. Biindgen and W. Kiichlin. Computing ground reducibility and inductively complete positions. In N. Dershowitz, editor, Rewriting Techniques and Appl., pages 59-75, SpringerVerlag, Berlin, 1989. [5] N. Dershowitz. Applications of the Knuth-Bendix completion procedure. In Proc. of the Seminaire d 'Informatique Theorique, Paris, pages 95-111, December 1982. [6] N. Dershowitz. Completion and its applications. In Resolution of Equations in Algebraic Structures, Academic Press, New York, 1988. [7] N. Dershowitz. Orderings for term-rewriting systems. 17(3):279-301, 1982.

Theoretical Computer Science,

[8] N. Dershowitz and Z. Manna. Proving termination with multiset orderings. Communications of the ACM, 22(8):465-476, August 1979. [9] M. Fay. First-order unification in an equationM theory. In Fourth Workshop on Automated Deduction, pages 161-167, Austin, Texas, 1979. [10] L. Fribourg. A strong restriction of the inductive completion procedure. In Intern. Conf. Aut., Lang. and Program., pages 105-115, Rennes, France, July 1986. (Springer Lecture Notes in Computer Science, Vol. 226). [11] S. J. Garland and J. V Guttag. Inductive methods for reasoning about abstract data types. In ACM Symp. on Princ. of Program. Languages, pages 219-228, ACM, 1988. [12] J.A. Goguen. How to prove inductive hypotheses without induction. In Conf. on Automated Deduction, pages 356-372, Springer Verlag Lecture Notes in Computer Science, Vol 87, Jul 1980. [13] C.A. 1~. Hoare. Procedures and parameters: An axiomatic approach. In E. Engeler, editor, Symp. Semantics of Algorithmic Languages, pages 102-116, Springer-Verlag, 1971. (Lect. Notes in Math. Vo. 188). [14] G. Huet. Confluent reductions: abstract properties and applications to term rewriting systems. Journal of the ACM, 27(4):797-821, October 1980. (Previous version in Proc. Syrup. Foundations of Computer Science, Oct 1977). [15] G. Huet and J.-M. Hullot. Proofs by induction in equational theories with constructors. In Syrup. on Foundations of Computer Science, pages 96-107, IEEE, Lake Placid, NY, October 1980.

177

[16] G. Huet and D. C. Oppen. Equations and rewrite rules: A survey. In R. Book, editor, Formal Language Theory: Perspectives and Open Problems, pages 349-405, Academic Press, New York, 1980. [17] J-M. Hullot. Canonical forms and unification. In Conf. on Automated Deduction, pages 318334, 1980. [18] J.-P. Jouannaud and H. Kirchner. Completion of a set of rules modulo a set of equations. SIAM J. on Computing, Nov 1986. [19] J.-P. Jouaunaud and E. Kounalis. Automatic proofs by induction in equational theories without constructors. In Symp. on Logic in Computer Science, pages 358-366, IEEE, Cambridge, MA., June 1986. [20] D. Kapur and D. R. Musser. Proof by consistency. In Proc. of NSF Workshop on the Rewrite Rule Laboratory, Sep ~-6~ 1983, G.E. R&:D Center Report GEN 84008, Schenectady, April 1984. [21] D. Kapur, P. Narendran, and F. Otto. On Ground-Confluence of Term Rewriting Systems. Technical Report 87-6, General Electric R ~5 D Center, Schenectady, New York, 1987. [22] D. Kapur, P. Narendran, and H. Zhang. Proof by induction using test sets. In Conf. on Automated Deduction, Oxford, U.K., 1986. [23] D. Knuth and P. Bendix. Simple word problems in Universal algebras. In J. Leech, editor, Computational Problems in Abstract Algebra, pages 263-297, Pergamon Press, 1970. [24] W. Kiichlin. Inductive completion by ground proof transformation. In Proc. 1987 MCC Colloquium on Resolution of Equations in Algebraic Structures, MCC, Austin, Texas, 1988. [25] D. S. Lankford. A Simple Explanation of InductionIess Induction. Memo MTP-14, Dep. of Mathmatics, Louisiana Tech. Univ., Aug 1981. [26] D. R. Musser. On proving inductive properties of abstract data types. In ACM Syrup. on Princ. of Program. Languages, pages 154-162, ACM, Las Vegas, 1980. [27] U. S. Reddy. Narrowing as the operational semantics of functional languages. In Symp. on Logic Program., pages 138-151, IEEE, Boston, 1985. [28] U. S. Reddy. Rewriting techniques for program synthesis. In N. Dershowitz, editor, Rewriting Techniques and AppI., pages 388-403, Springer-Verlag, 1989. (LNCS Vol. 355). [29] U. S. Reddy. Transformational derivation of programs using the Focus system. In Syrup. Practical Software Development Environments, pages 163-172, ACM, December 1988. [30] D. Scott. Data types as lattices. SIAM Journal on Computing, 5(3):522-587, Sept. 1976. [31] J. R. Slagle. Automated theorem-proving for theories with simplifiers, commutativity and associativity. Journal of the ACM, 21(4):622-642, 1974.

[32] H. Zhang, D. Kaput, and M. S. Krishnamoorthy. A mechanizable induction principle for equational specifications. In E Lusk and R. Overbeek, editors, Conf. on Automated Deduction, pages 162 181, Springer-Verlag, Berlin, 1988. (LNCS Vol 310).

A Resolution Principle for Clauses with Constraints Hans-Jiirgen Biirckert DFKI, Project Group AKA-WINO PosOCach2080, D-6750 Kaiserslautern, FR Germany e-mail: [email protected] Abstract: We introduce a general scheme for handling clauses whose variables axe constrained by an

underlying constraint theory. In general, constraints can be seen as quantifier restrictions as they filter out the values that can be assigned to the variables of a clause (or an arbitrary formulae with restricted universal or existential quantifier) in any of the models of the constraint theory. We present a resolution principle for clauses with constraints, where unification is replaced by testing constraints for satisfiability over the constraint theory. We show that this constrained resolution is sound and complete in that a set of clauses with constraints is unsatisfiable over the constraint theory iff we can deduce a constrained empty clause for each model of the constraint theory, such that the empty clauses constraint is satisfiable in that model. We show also that we cannot require a better result in general, but we discuss certain tractable cases, where we need at most finitely many such empty clauses or even better only one of them as it is known in classical resolution, sorted resolution or resolution w!th theory unification.

1. Introduction A general observation of Artificial Intelligence (AI) research - although it often has not really been realized in many AI systems - is the fact that the knowledge of an AI system about some problem solving task could be separated into at least two parts: ~- A well acquainted part of the problem description: Here the system has procedures and facts to treat these problem constraints. In this background part reasoning might be done by calculation and simplification of subgoals, by looking up facts and results in its memory, in a database or anywhere else. A more inacquainted part of the problem description: Here the system does not dispose of many techniques and facilities of finding a solution. In this foreground part reasoning might be done often just by more or less "blind" searching, in order to find solutions to subgoals - perhaps only guided by certain general heuristics. Now, in the field of Automated Deduction many common automated theorem proving systems or logic programming languages do not support or still worse they completely ignore this separation. They apply standard resolution based deduction methods (with frequently very unsatisfying search procedures) to the whole problem: The description given in a first order predicate logic is transformed into clauses. Hence the structure of the given problem specification is destroyed completely also for those parts, where the system could use standard techniques like integer calculation, finear equation solving etc., if it would know them. First approaches to separating the knowledge this way are extensions of resolution with paramodulation (Wos & Robinson 1970) or other methods of equality handling, with sort unification (Walther 1983, 1987, Frisch 1989, Schmidt-Schaug 1989), with theory unification (Plotkin 1972, Siekmann 1989) and more general with theory resolution (Stickel 1985, Ohlbach 1986). Sort unification is a very simple way of separating by syntactical phrases rather than by problem oriented reasons; similar for theory unification and paramodulation at least in its use today. Theory resolution provides for a problem oriented separation and takes advantage in allowing special procedures to treat the background parts of the problem. However, it still

179

cuts down the background constraints to literals, and hence has to apply also search techniques to find the constraints that could be treated by the procedures of the background theories. In the logic programming area such approaches of replacing "blind" search by computation has also been developed or adapted. However, standard techniques such as theory unification (Gallier & Raatz t986, Jaffar et al. 1986) or sort unification (Goguen & Meseguer 1984, Smolka et al. 1989) are not exploited in most logic programming languages, especially not in commercial ones. Methods similar to Stickel's theory resolution are proposed for constraint logic programming languages (Jaffar & Lassez 1986, Dincbas et al. 1988, Hrhfeld & Smolka 1988, Smolka 1989). Origins of these ideas can already be found in (Colmerauer 1984). In these approaches parts of problem descriptions, where very fast solution algorithms are known, are taken as constraints to be solved by such special constraint solving algorithms over distinguished domains - for example, linear equations and inequations over the real numbers. We argue that this is the right direction: Considering parts of the problem as constraints and restricting their interpretation to a distinguished class of given models. However, the two approaches, theory resolution and constraint logic programming, are not general enough. 1 Before we describe how to generalize these approaches let us first recall Robinson's Resolution Principle and then develop that new view of considering the unification part as constraint solving. The Resolution Principle is based on the following inference rule: From (A v B) and ( - A v C) infer (B v C). For predicate logic the two complementary A's are atoms starting with the same predicate symbol, but with potentially different argument terms, say si and ti. Then one has to unify corresponding arguments of the literals A and - A before the conclusion can be drawn, and the resolvent has to be instantiated with the unifying substitution: P ( s l ..... Sn) v B --,P(tl ..... tn) v C if crsi = O'ti (1 ~-i -~n) c~(B v C)

Robinson showed that this rule (combined with factorization) provides a sound and complete calculus (Robinson 1965). An analysis of the proof, however, shows that it is not necessary to unify the terms. It would be enough to test whether they are unifiable, provided we add a constraint Fconsisting of term equations si = ti (saying "if the terms can be made equal") to the infered resolvent. Whenever such constrained resolvents are involved in a further resolution step the new resolvent inherits their constraints, and these collected constraints have to be tested for unifiability. Thus a resolution step in this modification takes two clauses with equational constraints and produces a resolvent with a new unifiable equational constraint: P ( S l ..... Sn) v B // [" ~ P ( t 1 ..... tn) v C // A if BvC

F / x A A si = ti is unifiable

// l ' A A A s i = t i

A more general view is that every clause might have some arbitrary, not necessarily equational constraint and a resolvent of two clauses gets a new constraint that is unsatisfiable 1 Stickel (1985) and Ohlbach (1986) consider theory resolution for arbitrary clauses, but with the (implicit) requirement that the background theory has a first order axiomatization- otherwise, their completeness proofs based on the Herbrand Theorem would not be correct. Hrhfeld & Smolka (1988) allow arbitrary classes of models as background theories - and thus generalize the approach of CLP (Jaffar & Lassez 1987) -, but as in CLP they only consider definite clauses over these constrainttheories.

180

whenever one of the constraints of the parents (or the equational constraint of the arguments of the complementary literals) is unsatisfiable: P ( s l ..... Sn) v B // R -~P(tl ..... tn) v C // S if R A S A Si = ti is satisfiable B v C // R A S A s i = t i It is quite easy to see that this constrained resolution principle is sound, but as in the classical case completeness of a constrained resolution calculus is not straight forward. The logical view o f foreground and background problem descriptions hence could be as follows: There is a set of formulae with a query to be answered or a theorem to be proved or the set itself has to be tested for unsatisfiability. Some of these formulae are axioms of a background theory and parts of the other formulae are taken as constraints that must be solved in the background theory. Here many consequences could be given as well-known or "easy" to verify: There may be lemmata and theorems proven in the past, or techniques to simplify complex constraints into constraints that are immediate consequences of known results or facts, and there could be a tool of standard proof techniques of the field that can be used to prove constraints, which cannot be reduced. 2 In order to state this a little more precisely, let us assume the problem description to be given by a class o f structures over a first order language and a set of formulae over a foreground language, such that each of these formulae is constrained by some formula of the background language. These constraints filter out the values from models of the background theory the variables of the foreground formulae can be assigned to. Thus, in this view our constraints are restrictions of the quantifiers (Hailperin 1957) - this is one way sorted logic has been viewed (Oberschelp 1962, Walther 1987, Frisch 1989, Schmidt-Schaul3 t989). Therefore we could also describe it in the following way: We are given a (foreground) language with the logical connectives and a signature of non-logical symbols, but with restricted quantifiers instead of common quantifiers. Their restrictions are given as certain formulae over a (background) language and these restriction formulae have to be interpreted in the background theory. E x a m p l e : The formula Vx,y:parent(x) A child-of(y,x) loves(x,y) might be a formalization of the sentence "All parents love their children", when we have a suitable background theory containing knowledge about parents and their children. The constraint parent(x) A child-of(y,x) restricts the possible values of the variables x and y to parents and their children.I We assume that our set of formulae describing the problem is transformed into a set of constrained clauses consisting of literals over the foreground language and constraints restricting the variables of the clause by formulae of the constraint language. Applying the constrained resolution rule to these constrained clauses we want to prove the unsatisfiability of the clause set - i.e., to prove that no model of the constraint theory will satisfy it. A closer look at this task shows that this cannot be done by deriving an empty clause as in the classical resolution calculus or its generalizations. The reason is.that such an empty clause might still have some constraints, which are only satisfied by some of the constraint models, but not by all of them. In classical resolution the derivation of the empty clause could be seen as a derivation o f false from the starting clause set, but here it is just a derivation o f false within those models that satisfy the constraints of the empty clause.

2 Of course this might not always work, as the constraints might state really hard problems of the background theory. However, solving these should no longer be part of the given task, but could open up a new problem perhaps with a new separation into background and foregroundknowledge.

181

But, how could we then get a refutation for an unsatisfiable set of constrained clauses? The notion of unsatisfiabitity means here: No model of the constraint theory satisfies the clause set. The argumentation for classical resolution was: Suppose we have a model of the clause set, then it is a model of every resolvent and hence of the empty clause, which is impossible. The analogous argument cannot work in our framework, as the supposed model could be one of those that do not satisfy the constraints of the empty clause. Hence, our solution is to construct for each constraint model a suitable empty clause whose restriction is satisfied by that model: A set of constrained clauses is unsatisfiable iff for each constraint model there is a refutation of an empty clause, whose constraint is satisfied by that constraint model. This result looks very unsatisfactory, and in fact it is in the general case, but we cannot require a better result in general (see section 5). Fortunately, there are tractable cases (as we already know from the past): for example the constraint theory of classical resolution, which is the set of all structures or equivalently (for clause sets) the set of all Herbrand structures. In case of a constraint theory with first order axiomatizafion we need at most finitely many empty clauses, such that the disjunction of their restriction is true in all constraint models. Such a refutation could be obtained by exhaustive search strategies (cf. Kowalski 1979). Still better, if the constraint theory is given by a set of definite clauses and the constraints are conjunctions of atoms only, then the derivation of a single empty clause provides a refutation. This follows from the least Herbrand model property of definite clauses. The paper is organized as follows. In section 2 we introduce our language consisting of a restricted quantifier or constraint system, a signature with restricted quantifiers and formulae over this signature. In section 3 we give the semantics of formulae with restricted quantifiers. Section 4 contains our main result, soundness and completeness for resolution with constrained clauses and in section 5 we discuss some special cases and consequences of our result.

2. Syntax Following our separation idea we first introduce the background theory and the restriction formulae as a system for restricted quantification. In logic programming applications this is known as a constraint system, i.e., a constraint theory together with a set of constraints, the restriction formulae (Hrhfeld & Smolka 1988). We require the reader to be familiar with the notions of mathematical logics, automated deduction, and logic programming (cf. Shoenfield 1967, Chang & Lee 1973, Loveland 1978, Kowalski 1979, Gallier 1986, Lloyd 1987, Bl~isius & Btirckert 1989). For the notations of unification theory, we refer the reader to (Kirchner 1989, Siekmann 1989). A restricted quantification system (RQS) 9t consists of a signature A with equality, a theory over A, the restriction theory, and a set of open A-formulae, the restriction formulae or restrictions, which must at least be closed under conjunction and under instantiation of variables. The restriction theory can be given as a distinguished class R o f A-structures. It provides not only the models for the restriction, but also "skeletons" for the models of the whole problem description. Observe, that we do not require R t o be a first order theory, as there might be no first order axiomatization with exactly the A-structures of Ras its models. If it is given by some A-axioms, they are called declarations of R For computational reasons it would be useful to have calculi, preferably decision procedures, in order to detect R-(un)satisfiability of the existential closures of the restriction formulae and P~zvalidity of sets of existentially closed restriction formulae. This might be done by a "simplification" calculus for P~ a distinguished set of simple restrictions together with a

182

procedure that can transform non-simple restrictions into simple restrictions for which !R:-satisfiability or Rvalidity is known or easy to check. 2.1 Examples: (1) An order-sorted signature is an RQS, when we define R t o be the class of all models of the sort declarations (given as a sort theory, cf. Frisch, 1989) and when the set of restrictions contains besides the well-sorted equations the open formulae S(x) for each sort symbol S, i.e., it consists of conjunctions of equations and sort restrictions S(x) for their variables. Consider the following sort hierarchy given by the declarations in the right box:

person

Vx parent(x) ~ person(x)

/\ parent q" mary

Vx child(x) ~ person(x) chiM I" john

parent(mary) child(john)

Here the restriction theory R i s the class of all models A, where the denotation S A of a given unary predicate - i.e. a sort symbol - is a subset of the carrier of A satisfying the intended subset and element relations (parentA and childA are subsets of personA; mary A is an element of parent A and john A is an element of childA). Obviously, the existential closures of sort restrictions are P~zvalid, as every sort contains a constant. Sort unification algorithms play the role of simplification calculi, if the equational forms of well-sorted substitutions together with the sort restrictions of their variables are simple restrictions, whose existential closures are trivially R-valid. Sort unifiability of restrictions (i.e., sorted unification problems) is equivalent to P~:validity of their existential closures. (2) An equational theory E can be seen as the restriction theory of an RQS, whose restrictions are conjunctions of equations (i.e. unification problems). Here either R i s the class of all models of the theory E or R i s just the initial algebra or the free algebra of E. An E-unification algorithm would be a suitable simplification calculus with substitutions as simple restrictions. Notice again, that E-unifiability of restrictions is equivalent to P~cvalidity of their existential closures and that idempotent substitutions are always P~zvalidrestrictions. (3) As a special case, remember the empty equational theory of syntactical equality, for which the well-known Robinson unification algorithm is a simplification algorithm. In this case R i s the class of all algebras over the given signature A or the corresponding free or the initial algebra, i.e., the usual term algebra or ground term algebra (i.e. the Herbrand universe).l A signature with restricted quantifiers or an RQ-signature Z, consists of an RQS 9f, together with an additional set of predicate symbols P~zand possibly a set of function symbols F s b o t h disjoint from the signature A. If the set F~: of Z-function symbols is not empty, we have to extend our set of restrictions, such that it contains in addition all equations built up by the new function symbols. Thus we can assume without loss of generality that the RQ-signature contains only new predicate symbols. Given such an RQ-signature ~Jwe want to have formulae with restricted quantifiers over this RQ-signature. Therefore we allow quantifiers to be indexed not only by variables, but by pairs of a variable set and a restriction formula (e.g. VX:R and 3X:R), and we call them restricted quantifiers. Thus we define RQ-formulae over ~ by

183

(1) all Z-atoms are RQ-formulae (2) VX:R F and 5~X:RF ~ e RQ-formulae, i f F is an RQ-formula, R is a restriction andX is the sequence or set of variables that are not bound in R, (3) Vx F, 3x F, F A G, F v G, F ~ G, F ¢~ G are RQ-formulae, if F and G are and X is the sequence or set of variables that are not bound in F. Notice, that in definition (2) also the formula F might contain free variables in X that are now bound by the restricted quantifiers Vx:I¢ or 3x:R; the formula R is called the restriction for those variables. We often drop the restricted variables and write VR F instead of VX:R F. As usual we will deal with clauses, called RQ.clauses or constrained clauses; they consist of any (possible empty) finite set C of Z-literals, i.e., a common Z-clause, and a restricted quantifier VX:R of their variables, frequently written C / / R instead of VR C. We call C the matrix or the kernel of the RQ-clause ~nd R its restriction or constraint. If C is empty we call it an empty RQ-clause, denoted t:///R or VR/2. 2.2 Examples: (1) Taking the sort signature from Example 2.1(1) and the binary predicate symbols loves and child-of, the RQ-formula

Vx:parent(x) Vy:child(y) child-of(y, x) ~ loves(x, y) is a formalization of the English sentence "All parents love their children." (2) In fact the formula intends a little more, namely, that the children are still "young persons" (i.e., have sort child). In order to be closer to the meaning of the sentence, we could replace the sort child in the RQS by the binary predicate symbol child-of now considered as a symbol of the RQS and perhaps have the declaration in the modified RQS

Vx,y child-of(y,x) ~ parent(x) A person(y) such that our RQ-formula looks like

Vx:parent(x) Vy:child_of(y,x) loves(x, y) which seems to be a more adequate formalization of"All parents love their children." (3) If the RQ-signature is given over an RQS defined by an equational theory as in Example 2.1 (2), we obtain the RQ-formulae corresponding to the formulae without restricted quantifiers by unfolding: We replace each term t in an atom by a new variable v and replace the quantifier governing the term by a restricted quantifier with the restriction v = r For example, a formula Vx,y P(g(f(x; y)), f(x, a)) becomes the RQ-formula Vx,y,v,w:v=g(f(x, y)) A w =f(x, a) P(v, w).ll

3. S e m a n t i c s The interpretation of the RQ-formulae and especially the restricted quantification causes no deep problems. The semantics of restricted quantifiers can be given by the usual relativization, that is, one could transform any RQ-formula into an equivalent formula without restricted quantifiers by replacing VX:R F by Vx R ~ F and by replacing 3x:R F by 3x R A F. However, as we already know the A-models given in the RQS, we have to say what our E-models should look like, i.e. we have to give the interpretation of the new predicates of the RQ-signature. An RQ-structure over Z i s a structure .~ such that its reduct N/zt to A is one of the A-models in ~.3 As we assumed Z to introduce only new predicate symbols, but no function symbols, we obtain the different RQ-structures by expanding every model of the restriction theory with all possible interpretations of these new predicate symbols. If the

3 A reduct of a structure to a subsignature is given by forgetting about the denotations of the symbols that are not in the subsignature. Conversely, an expansion of a structure to a supersignature is given by any interpretation of the additional symbols (cf. Shoenfield1967).

t84

restriction theory R i s given by a A-axiomatization, RQ-structures are exactly those structures that satisfy the axioms of Rconsidered as formulae over the extended signature. Obviously the class of all RQ-structures is a conservative extension of the restriction theory: A restriction is R--valid iff it is satisfied by every RQ-structure. Given an RQ-structure A, an RQ-formula F, and an assignment a: V --+ A of the set V of free variables of the formula F, we define satisfiability of F in A with o~ (written (A, t~) ~ F) as usual for atoms and formulae built up by the common junctors. The only cases that are new are formulae with restricted quantifiers and we give their semantics here explicitely: ~1~ (A, t~) t~ ~X:R F iff for every assignment fl: X ~ A with (.-~/A, a~fl) ~ R we have (A, c~fl) l= F • (A, ct) ~ 3X:R F iff there is an assignment fl: X --9 A with (A/A, tx~fl) ~ R such that (A, aufl) t= F A closed RQ-formula F is RQ-satisfiable, iff there is an RQ-structure A that satisfies F with the empty assignment; in this case A is called an RQ-model of F. If F has no RQ-models then F is called RQ-unsatisfiable. The formula F is RQ-valid or an RQ-tautology, iff it is satisfied by every RQ-structure. Notice that formulae with "~'cunsatisfiable restrictions can be viewed as quantified over the empty set, hence such formulae are true in every RQ-structure: they are RQ-tautologies. 3.1 Examples: (1) In case of an RQS given by the empty equational theory the RQ-structures are the usual structures considered as the expansions of algebras - the models of equational theories - with predicate symbols. We could also take the Herbrand universe as restriction theory; the RQ-structures are then just the Herbrand models. However, this semantics has to be used with caution, as Herbrand models can only play the rtle of semantics, when we only consider formulae that are in clause form. As long as we allow arbitrary RQ-formulae, the RQS for the empty theory given by all algebras cannot equivalently be replaced by the RQS of the Herbrand universe. (2) If the RQS is given by an arbitrary equational theory (cf. Example 2.1(2)) and the restriction theory consists of the initial algebra of this theory, the RQ-structures are the Herbrand models factored by the congruence, which is induced by the equational theory. (3) The models of order-sorted signatures are exactly the RQ-structures over the corresponding RQS. This is an immediate consequence of a relativization theorem in (Schmidt-Schaul3 1989). (4) Take the restriction theory of Example 2.2(2). Then the formula given there has the following semantics: An RQ-structure A is every structure with a set parentAand a relation child-ofA satisfying the declarations of the given restriction theory. Such a structure satisfies that formula, if for each pair a, b of an element a of the parent A set and an element b that is in the child-ofArelation to that parent a this pair is also in the relation loves A. That means each structure, where "all parents love their children", is a model of that formula.I One can see immediately that unrestricted quantifiers are special cases of restricted ones and that we can replace every sequence of restricted universal quantifiers (and analogously of restricted existential quantifiers) by a single one: Vx..R ~Y..sF is logically equivalent to VX~r..RASF. If the restriction is a complex A-formula, which contains quantifiers, we can sometimes move these quantifiers out of the restriction and lift it to RQ-formula, for example, Vx:R(x) A 3y S(Y) F is logically equivalent to Vx.Y:R(X),, s(Y) F. These, and many further logical equivalent transformations of RQ-formulae can easity be verified for instance via a relativization (cf. Btirckert 1990).

185

4. Resolution with Restricted Quantifiers From now on we assume every RQ-formula to be given in RQ-clanse form. Of course, it is not trivial to obtain clause form, as the restriction need not be satisfiable in every model of the restriction theory. The restriction theory might have to be expanded with Skolem functions and certain Skolem A-formulae; see (Biirckert 1990) for more details on these problems. Our calculus consists of the foUowing RQ-resolution rule for any pair of RQ-clauses, such that one of them contains at least one positive literal and the other one contains at least one negative literal each with the same predicate symbol: { P(s~l ..... sl,) ..... P(Skl ..... skn)) u C // R {~P(t11 ..... t~,) ..... ~P(tml ..... tmn)} u D // S if R A S/x F is _q~zsatisfiabIe C~D // R A S A F Here C and D are the remaining parts of the two clauses and F is the conjunction of the (multi)equations sli . . . . = Ski = tli = ... = tmi (1 -< i <_n). The derived clause is called an (RQOresolvent of the two parent clauses. An R Q - r e s o l u t i o n step C----~ C' transforms an RQ-clause set C into the set C ' by choosing two suitable clauses in C and adding their resolvent to C (after a renaming of all variables of the resolvent consistent with variables that have not been used so far). 4 An RQ-derivation is a possibly infinite sequence (Cn)n_>O of RQ-resolution steps Cn--~ Cn+l starting with an initial set CO of RQ-clauses. An RQ-refutation of a set Co of RQ-clauses is a (possibly infinite) RQ-derivation (Cn)n_>Ostarting with that clause set, such that for each model A of the restriction theory there is an RQ-clause set Cn in the derivation with an empty RQ-clause o / / R , whose restriction is satisfied by this model, i.e., .~ ~ 3 R . Notice, that an RQ-structure that satisfies the restriction formula of an empty RQ-clause cannot satisfy this empty RQ-clause. Notice further, that an empty RQ-clause with satisfiable, but non-valid restriction formula has RQ-models and hence its derivation cannot terminate a refutation. RQ-resolution is sound in the sense that every RQ-resolvent is a logical consequence of its RQ-parents: 4.1 L e m m a : Let C be a set of RQ-clauses, let C" be derived from C by an RQ-resolution step and let A b e an RQ-structure. Then: A ~ C irnplies A ~ U. As our restriction theory is not given by a set of first order axioms we cannot reduce completeness of RQ-resolution to completeness of classical resolution as in the approaches for resolution modulo the equality axioms (cf. Chang & Lee 1973), sort resolution (Walther 1987, Frisch 1989, Schmidt-SchauB 1989) or theory resolution (Stickel 1985, Ohlbach 1986). Instead we use a technique similar to that being used by Jaffar & Lassez (1986) and in a more general framework by Hrhfeld & Smolka (1988). The standard proofs for completeness of classical resolution rely on a proof technique that reduces completeness to ground completeness of ground resolution on a set of ground instances of the given clause set. Now, classical resolution could be considered as RQ-resolution with respect to the restriction theory given by the ground term algebra. Hence, if we have an arbitrary RQS, we just have to replace the Herbrand universe by any of the models distinguished by the restriction theory. 4.2 Definition: Let .,~ ~ R b e a model in the restriction theory. Let C be the kernel of an RQ-clause with variables in X, and let cc X --~ A be an assignment. We call the triple (A,o~,C) an A-clause, and we call it an M-instance of the RQ-clause C / / R iff (A,~) ~ R. 4 We assume that the set of clauses the RQ-resolutionstep is applied to consists of variable disjoint clauses.

186

Let C b e a set of RQ-clauses. A set {(A,o~i,Ci): i ~ I} of A-instances of RQ-clauses C i / / R i of C is called an A - i n s t a n t i a t i o n of C, iff ( A , t z i ) ~ Ri for each i e 1.5 T h e set {(A, tz, C): C / / R in C, (A, tz) ~ R} of all A-instances of all RQ-clauses in C is called the A-base of C. A set of A-clauses {(A, tzi,Ci): i ~ I} is satisfied by a Z-expansion A* of A iff (A*,tzi) ~ Ci for each i e I; it is unsatisfiable, if it is not satisfied by a Z-expansion of.,'zLII Ohlbach (1986) introduces abstract clauses as a scheme for sets of ground clauses (e.g., classical clauses are schemes for the sets of all their ground instances). Our RQ-clauses can be seen as schemes for sets of N-clauses. Hence our definition is the suitable generalization of the classical notion of a ground instance of a clause, which can be seen as a triple consisting of the Herbrand universe, a ground assignment, and the clause to be instantiated. 4.3 Theorem: (Herbrand Theorem for RQ-clauses)

A set C of RQ-clauses is RQ-unsatisfiable ifffor each model A in the restriction theory Rthere is a finite A-instantiation of C that is unsatisfiable. Proof: For the one direction let C be RQ-unsatisfiable. Suppose there is an A e R s u c h that each finite A-instantiation of C is satisfiable. By the Compactness Theorem for First Order Logics we have that the N-base for Cis satisfiable. 6 Hence there is an expansion A*, such that for each C / ! R in C and each assignment tz with (A,o:) ~ R we have (A*,tx) ~ C; a contradiction to the RQ-unsatisfiability of C. The other direction is obvious.I In order to prove unsatisfiability of an A-instantiation we introduce the following A-resolution rule for A-clauses (A, Or, {P(s11..... sl.) ..... P(Skl ..... Skn)} U C) (A, o~,{~P(tll ..... tl.) ..... ~P(tml ..... tmn)} U D) (A, o~, C ~ D ) if (A, oO ~ F ( F a s in the RQ-resolution rule) which can be used to deduce the empty A-clause from every unsatisfiable set of A-clauses. 4.4 Proposition: If a finite A-instantiation D of a set of RQ-clauses is unsatisfiable, then

there is a finite derivation of an empty A-clause via A-resolution. Proof: The proof is by induction on the number N of number of literal occurrences in D minus number of clauses in D and it is analogous to the usual case when we have ground instantiations instead of N-instantiations (cf. Loveland 1978 or Genesereth & Nilsson 1987). The only difference is that instead of syntactical equality of ground instances we have here semantical equality of arguments under the assignmentJ The following Lifting Lemma says that an A-resolvent of A-instances of two RQ-clauses is an A-instance of their RQ-resolvent. However, it is more trivial as we do not simplify the restrictions (this is computing the most general unifier of the arguments of the complementary literals in classical resolution), but keep them as constraints that are only tested for satisfiability. 4.5 Lifting L e m m a : Let C 1 / / R 1 and C 2 / / R 2 be two constrained clauses and let

(A,o~,C1), (N,~x, C2) be A-instances of the two RQ-clauses. Then an A-resolution step on the two instances can be lifted to an RQ-resolution step on the RQ-clauses, such that the A-resolvent (N,a,C) is an A-instance of the RQ-resolvent C / / R . 5 Observe that an A-instantiation might contain more than one A-instance of the same RQ-clause. 6 The satisfiability of sets of A-clauses is a first order problem, more precisely it is a propositional logic one: We can consider it as the problem of satisfiability of ground clauses over the Z-predicate symbols and the elements of the carrier of A considered as constants. Each A-clause (&tz,¢) corresponds then to the ground clause aC - the assignments are ground substitutions replacing the variables by the constants, i.e., the elements of the carrier of .~

187

Proof." By the definition of A-instances and A-resolvents (A,t~)/= R with R := R1 A R2 A F.1

Corollary: If a set C of RQ-clauses is RQ-unsatisfiable, then for each A ~ Rthere is a finite RQ-derivation of an empty RQ-clause whose restriction is satisfiable by .~ Proof: If C is RQ-unsatisfiable, then for each A ~ Rthere must be a finite A-instantiation which is unsatisfiable (Herbrand Theorem). Hence there is a finite derivation of the empty A-clause (Prop. 4.4), which can be lifted to C, such that A satisfies the restriction of the empty clause.It Now we are ready to formulate and prove correctness and completeness of our constrained resolution calculus. 4.6 Theorem: (Soundness and Completeness of RQ-resolution) A set C of RQ-clauses is RQ-unsatisfiable ifffor each A ~ R there exists an RQ-derivation from C containing an empty RQ-clause t7/! R, such that A ~ 3 R. Proof: Soundness (~): Assume Cwere RQ-satisfiable. Then there is an A ~Rsuch that A*/= Cfor some expansion of .~ By Lemma 4.1 A* ~ VR C for each RQ-clause VR C that can be derived by RQ-resolution from C. By the precondition an empty RQ-clause VR t2 with A ~ 3R is derivable from C. Hence there is an assignment g with ( A ,ix) ~ D. This is a contradiction. Completeness ( ~ ) : Let A be a model in R. As C is RQ-unsatisfiable, by the Herbrand Theorem 4.3 there is an unsatisfiable A-instantiation of C and we can deduce the empty A-clause by A-resolution collecting the restrictions in RA. By the Lifting Lemma this refutation can be lifted and hence the collected restriction RA of the empty clause is satisfied by ~ It Remark: It is enough to consider for each A just those clauses of C whose restrictions are satisfiable by this distinguished A; the same holds for the resolvents that are derived.

5. Consequences and Discussion Obviously the Completeness Theorem is not very satisfactory from the practical point of view, in particular not when we are interested in an actual implementation of a theorem proving system for constrained clauses. The question arises if and how we can guarantee that RQ-derivation terminates when only finitely many empty clauses are needed for an RQ-refutation. Remembering that for classic resolution there exist exhaustive refutation strategies, we observe that with such a strategy there is a finite RQ-refutation terminating with an RQ-clause set that contains finitely many empty RQ-clauses such that each restriction model satisfies the restriction of one of these empty clauses, whenever finitely many empty clauses provide an RQ-refutation. As a t-n'st immediate consequence of the Compactness Theorem of First Order Logics we have that if R i s a first order theory (that is, if there exists a first order axiomatization with exactly the models given in ~ , then for every RQ-unsatisfiable set of RQ-clauses Cthere are finitely many empty RQ-clauses derivable from Cby RQ-resolution such that the disjunction of their restrictions is a logical consequence of the restriction theory. Hence, in this case exhaustive refutation strategies provide correct and complete RQ-resolution calculi, if we have a calculus for proving R--validityof disjunctions of restrictions. 5.1 Theorem: Let ~ be an RQS with a first order restriction theory R. A set C of RQ-clauses is RQ-unsatisfiable iff there are finitely many empty RQ-clauses with constraints R1 ..... Rn RQ-derivable from C such that R ~ 3 R1 V... v 3 Rn.

Proof" Let T h ( ~ be a first order axiomatization of R Then the Completeness Theorem implies that RQ-unsatisfiability of Cis equivalent to: for each A with A ~ T h ( ~ there is some empty

188

RQ-clause 12//RA derivable from C, such that A ~ 3 RA. This in turn is equivalent to the unsatisfiability of the possibly infinite set of formulae Th(9~ t~ {--,3RA: A ~ Th(9~}. By the Compactness Theorem there is a finite subset that is unsatisfiable, hence there exist finitely many empty RQ-clauses derivable from Cwith R ~ 3R1 v... v3Rn.II Corollary: Let 9~ be as in the theorem above. If the set C of RQ-clauses is RQ-unsatisfiable then there are finitely many models A1 ..... ..'Inof the restriction theory and finitely many empty RQ-clauses 12//Rl ..... 12//Rn derivable from C via RQ-resoIution such that Ai ~ 3 Ri (1 _
Proof." Let C be RQ-unsatisfiable. By the Soundness and Completeness Theorem for each model A e Rand hence especially for the generic model G there is an empty RQ-clause with restriction R derivable from Csuch that the model satisfies 3R. Conversely, assume that there is an empty RQ-clause derivable from C, such that its restriction R is satisfied by the generic model: G ~ 3R. Then each model of the restriction theory satisfies this restriction, i.e. R ~ 3 R. Hence by the Completeness Theorem the RQ-clause set is RQ-unsatisfiable.II Corollary: If the RQS is given by a single model A, then: C is RQ-unsatisfiable iff there exists an empty RQ-clauses t2//R derivable from C such that A ¢ 3 R.

189

For such an RQS with a generic model a refutation will be obtained whenever an empty RQ-clause is derived whose restriction is satisfied by the generic model. Hence we can modify our resolution rule such that we only allow resolvents whose restrictions are satisfied in the generic model. By the genericity property this means that we allow only resolvents whose restrictions are R-valid, i.e., satisfiable in all models of the restriction theory instead of some model of the restriction theory. This modified resolution calculus is still complete for RQS with generic models. Of course any refutation of an RQ-unsatisfiable clause set needs only clauses whose restrictions are satisfiable by the generic model and hence R-valid. Corollary: Let 9~ be an RQS with generic model and let C be a set of RQ-clauses. Let C' be the subset of C, whose RQ-clauses are ~:-valid. Then: C is RQ-unsatisfiable iff C' is RQ-unsatisfiable iff there exists an empty RQ-clauses t3 // R derivable from C'via RQ-resolution steps with ~valid restrictions only, such that RI= _-3R. It is well-known that definite clause theories have a least Herbrand model, which is a generic model for queries that are conjunctions of atoms (cf. Lloyd 1987). Hence we can apply our result to constraint theories that have a definite clause axiomatization. 5.4 T h e o r e m : If the restriction theory R is given by a definite clause theory and the distinguished restrictions are conjunctions of atoms only, then: A set C of RQ-clauses is RQ-unsatisfiable iff there exists an empty RQ-clause derivable from C that has an R-valid restriction. This last result demonstrates why resolution with sorted clauses (for sort theories with least Herbrand models as e.g. sort hierarchies, Frisch 1989) or with E-unification works analogously to classical resolution: In the first case only initial clauses and resolvents have to be considered, whose sort restrictions are non-empty in all models of the sort hierarchy (or equivalently in the generic least Herbrand model of the sort declarations). This is for example guaranteed when the sort hierarchy satisfies the condition that for each sort there has to exist a constant of this sort. In the case of an RQS given by an equational theory Plotkin (1972) shows that resolution with E-unification is complete, when we have clauses with negativ equality literals only. This corresponds to positive equational restrictions in the RQS view. Our result demonstrates once more from a somewhat different perspective that it is enough to consider clauses whose negativ equality literals are E-unifiable: Plotkin's E-trivialization rule is resolution of negative equality literals with the reflexitivity clause or, equivalently, E-unification of the corresponding restriction viewed as unification problem. In fact, our completeness result shows a little more in the two cases above. We do not need a sort unification or an E-unification procedure. It is enough to have procedures that are able to decide unifiability. This is similar to lazy-unification as proposed by Ohlbach (1986) in order to avoid the problem that, with non-finitary unification, a resolution step need not terminate; see also (BiJrckert 1986). Lazy-unification for E-unification and sort unification was inspired by constrained resolution as proposed by Huet (1978). Nevertheless, unification algorithms provide satisfiability test procedures that have several advantages. The main one is their incrementality. For instance testing unifiability of the conjunction of two equational constraints fix) = f(f(a)) and g(h(x)) = g(h(f(y))) is equivalent to testing unifiability of the conjunction of the equational forms of the two unifiers x = f(a) and x = f(y) of these two problems. The latter one is obviously simpler and faster to check then the original one. Thus unificatioja algorithms provide a satisfiability test that works incrementally by reducing the original problems to often much simpler ones.

190

6. Related Work As already mentioned our approach is related to theory resolution of Stickel (1985) and to constraint logic programming approaches (Jaffar & Lassez 1986, Dincbas et al. 1988, HOhfeld & Smolka 1988). It follows a tradition of automated deduction research that is concerned with the question of how can we replace "blind" search with more directed search, or still better, with deterministic computation (sort unification, constraint solving). Or to phrase it differently: how can we integrate semantic information about the problem, in order to prune the search space (paramodulation, E-unification, theory resolution). In fact all of these improvements are special forms of constrained resolution. Here we only sketch how the two most general approache§, Stickel's theory resolution calculus and constraint logic programming of H0hfeld & Smolka fit into our framework. Stickel already demonstrated how other less general approaches are instances of his theory resolution, HOhfeld & Smolka do the same for constraint logic programming approaches. Stickel's total theory resolution extends resolution by a generalization of the notion of complementary literals. A total theory resolution step takes a couple of clauses and from each clause a subclause is chosen. If this set of subclauses is complementary in the sense that it is unsatisfiable with respect to the given theory T, then the remaining parts of the chosen clauses are joined together to form a total theory resolvent: C1 vD1 C'n"v D n if C1 A ... A Cn is T-unsatisfiable D1 v . . . v D n If the literals of these Ci are literals of the background theory, we could see their negation ---ZTi as constraints Ri .7 If we further modify constrained resolution by a second deduction rule, that takes any couple of constrained clauses and adds as a "theory resolvent" the clause obtained by the union of the literals of the parents and whose restriction is the union of the parent's constraints and is valid with respect to the constraint theory, then this is equivalent to a total theory resolution step: D1 // R1 . . °

Dn // Rn if 3 R1 v . . . v R n is T-valid D1 v ... v Dn However, as our result shows, such theory resolution steps could be delayed until the end, which means they have only to be applied to constrained empty clauses. H6hfeld & Smolka investigate constrained (SLD-)resolution for definite clauses with constraints as a goal reduction procedure. As their application in logic programming requires, they are only interested in answers to queries, but not in refutation proofs. In fact, their approach cannot serve as a theorem proving system since they will stop whenever an answer goal - a constrained empty clause - is returned. But in general this does not prove the query to be a theorem of the constrained logic program. This implies only that the query holds just in those models of the constraint theory that satisfy the answer constraints. Our result shows that, if we want to use their approach as a theorem proving procedure, we have to derive "enough" answers in order to have, for each model of the constraint theory, an answer constraint that is 7 Rememberthat C vD is equivalent to --,C ~ D , which in turn is equivalent to D//--C.

191

satisfied by this model. If the constraint theory is just one model as in other constraint logic programming approaches (Jaffar & Lassez 1986, Dincbas et al. 1988), then of course a single answer determines also a proof for the query.

7. Conclusion We have introduced a general method to handle clauses over constraints or equivalently clauses whose variables are bound by restricted quantifiers. Our approach generalizes well-known methods of restricted quantification like sorted resolution and highlights constraint logic programming languages in the theorem proving context. It provides a new view of E-unification and other more general ways of building in theories as for example in theory resolution. In fact, it generalizes theory resolution in that it allows the specification of theories not necessarily by a t-n-st order axiomatization but by any other form that describes a class of models. Hence our results can be applied to build in any kind of theory, especially, when we are not interested in general formulae but in a restricted class of formulae that can be seen as constraints or quantifier restrictions, i.e., that is at least closed under conjunction. However, it could also be used as a method to reason about theories on the meta-level of building strong theorem provers, as it might be possible to replace a restricted quantification system - restriction theory and restrictions - by an equivalent one. For example, in (Buntine & Btirckert 1989, Biirckert 1988) we argue that AC-unification is equivalent to ACl-disunification. This can be justified by considering the following two RQS that are equivalent in the sense that their constraints have the same solutions with respect to ,their constraint theory: one is the equational theory AC of associative and commutative function symbols (more exactly the corresponding free ACalgebra) together with equational constraints (the AC-unification problems), the other is the theory AC with additional unit i (more exactly the free ACl-algebra) together with equations and certain negated equations (ACl-disunification problems) as constraints. Our approach could also be used to combine knowledge representation languages of the KL-ONE family (Brachman & Schmolze 1985, Nebel 1989) with predicate logic. In (BiJrckert 1990) we sketch a logical framework for such a "concept logic". Here RQ-resolution, where the satisfiability test for restrictions is just the consistency check for concept descriptions, could be a suitable inference method for such a hybrid knowledge representation system. We like to emphasize that our approach is not only useful when algorithms that test satisfiability of the restrictions are available. But the method may also be used if there is some knowledge base for the background theory, that provides a couple of results like theorems etc. for this theory. We could then use RQ-resolution in order to reduce the given problem to restriction formulae - the restrictions of derived empty clauses - that could be found in the knowledge base. Obviously there remain many open problems: How should several constraint theories be combined? Do there exist (incremental) satisfiability tests for their constraints? And of course, a most pressing problem is to gain experience with some actual implementations of constraint theories. In (Biirckert 1990) we investigate some general properties of constraint reduction or simplification systems that can be used as incremental satisfiability test systems. Acknowledgements. I like to thank Norbert Eisinger, Werner Nutt, Hans Jtirgen Ohlbach, and Gert Smolka for their support and intensive discussions that helped me to understand what's going on in constrained resolution. This research was supported by the German Bundesministerium f'tir Forschung und Technologie under grant ITW 8903 0.

192

References K.H. Bl~sius, H.-J. Biirckert (eds.). Deduction Systems in Artificial Intelligence. Horwood, Chichester, 1989 R.J. Brachman, J.G. Schmolze. An Overview of the KL-ONE Knowledge Representation System. Cognitive Science 9(2), 171-216, 1985. W. Buntine, H.-J. Btirckert. On Solving Equations and Disequations. SEKI-Report SR-89-03, Universitfit Kaiserslautern, 1989 H.-J. Biircken. Lazy Theory Unification in Prolog: An Extension of the Warren Abstract Machine. Proc. of German Workshop on Artificial Intelligence, Springer Informatik-Fachberichte 124,277-288, 1986 H.-J. Biirckert. Solving Disequations in Equational Theories. Proc. of Conf. on Automated Deduction, Springer LNCS 310, 517-526, 1988 H.-J. Btirckert. A Resolution Principle for a Logic with Restricted Quantifiers. Dissertation, in prep., 1990 C.-L. Chang, R.C.-T. Lee. Symbolic Logic and Mechanical Theorem Proving. Academic Press, 1973 A. Colmerauer. Equations and Inequations on Finite and Infinite Trees. Proc. of Conf. on Fifth Generation Computer Systems, 85-99, 1984 M. Dincbas, P. van Hentenryck, H. Simonis, A. Aggoun, T. Graf, F. Berthin. The Constraint Logic Programming Language CHIP. Proc. of Conf. on Fifth Generation Computer Systems, 1988 A. Frisch. A General Framework for Sorted Deduction: Fundamenrtal Results on Hybrid Reasoning. Conf on Principles of Knowledge Representation and Reasoning, 126-136, 1989 J. Gallier, S. Raatz. SLD-Resolution Methods for Horn Clauses with Equality Based on E-Unification. Proc. of Symp. on Logic Programming, 1986 J. Gallier. Logic for Computer Science: Foundations of Automatic Theorem Proving. Harper and Row, 1986 M.R. Genesereth, N.J. Nilsson. Logical Foundations of Artificial Intelligence. Morgan Kaufmann, 1987 J.A. Goguen, J. Meseguer. Equalities, Types, Modules, and Generics for Logic Programming. J. of Logic Programming 1,179-210, 1984 M. HOhfeld, G. Smolka. Definite Relations over Constraint Languages. LILOG-Report 53, IBM Deutschland, 1988 G. Huet. Constrained Resolution - A Complete Method for Higher Order Logic. Ph.D. Thesis, Case Western University, 1972 J. Jaffar, J.-L. Lassez. Constrained Logic Programming. Proc. of ACM Symp. on Principles of Programming Languages, 111-119, 1987 J. Jaffar, J.-L. Lassez, M. Maher. Logic Programming Scheme. In: Logic Programming: Functions, Relations, Equations (e~. D. De Groot, G. Lindstrom), Prentice Hall, 1986 C. Kirchner (ed.). Special Issue on Unification. J. of Symbolic Computation, 1989 R. Kowalski. Logic for Problem Solving. North-Holland, 1979 J.W. Lloyd. Foundations of Logic Programming. Springer, 1987 D.W. Loveland. Automated Theorem Proving: A Logical Basis. North-Holland, 1978 B. Nebel. Reasoning and Revision in Hybrid Representation Systems. Dissertation, Universit~t Saarbriicken, 1989 A. Oberschelp. Untersuchungen zur mehrsortigen Quantorenlogik (in German). Mathematische Annalen 145, 297-333, 1962 H.J. Ohlbach. The Semantic Clause Graph Procedure - A First Overview. Proc. of German Workshop on Artificial Intelligence, Springer lnformatik-Fachberic hte 124, 218-229, 1986 G. Plotkin. Building in Equational Theories. Machine Intelligence 7, 1972 J.A. Robinson. A Machine Oriented Logic Based on the Resolution Principle. Journal of the ACM 12(1), 1965 M. Schmidt-Schaul3.Computational Aspects of an Order-Sorted Logic with Term Declarations. Springer LNAI 395, 1989 J.R. Shoenfield. Mathematical Logic. Addison Wesley, 1967 J.H. Siekmann. Unification Theory - A Survey. In: Special Issue on Unification (ed. C. Kirchner), J. of Symbolic Computation, 1989 G. Smolka. Logic Programming over Potymorphically Order-Sorted Types. Dissertation, Universitfit Kaiserslautern, 1989 G. Smolka, W. Nutt, J.A. Goguen, J. Meseguer. Order-Sorted Equational Computation. In: Resolution of Equations in Algebraic Structures (eds. H. Ait-Kaci, M. Nivat). Prentice Hall, 1989 M.E. Stickel. Automated Deduction by Theory Resolution. J. of Automated Reasoning 1(4), 1985 C. Walther. A Many-Sorted Calculus Based on Resolution and Paramodulation. Pitman & Morgan Kaufmann Publishers, Research Notes in Artificial Intelligence, 1987 L. Wos, G. Robinson. Paramodulation and the Set of Support. Proc. of Symp. on Automated Demonstration, Springer, 1970

Str4veC: T h e S t r 4 v e - b a s e d S u b s e t Prover* Larry Hines Department of Computer Science University of Texas Austin, Texas 78713 Abstract

STlt+VE [7], a prover for inequalities, employs a highly restrictive and successful strategy for implementing the transitivity property of < and the interpolation axiom of the reals. In STR+VB, transitivity is carried out by chaining and interpolation by variable elimination. Since the subset relation is also transitive, a slightly altered version of chaining can carry out that property for subset as well. But interpolation does not hold for the subset relation. Nonetheless, we can apply a version of variable elimination. In this way, we are designing a theorem prover, STR+VEC_, which incorporates the strategy behind STR+VE in order to handle formulas with set predicates. 1

Introduction

T h e STR+VE-base subset prover, STR-~VEC_, is designed to prove theorems involving the subset relation. This includes formulas with arbitrary quantifiers; with the logical connectives negation, conjunction, disjunction and implication; with the set theoretical predicates element, nonempty, C_, C, = (set equivalence); with the set theoretical function symbols set-difference, union, intersection and singleton (a one-place function indicating a singleton set with the argument as its only element); with the constant 0; and with no other interpreted function or predicate symbols. There are no power sets and no set constructor (i.e., { f ( x ) : x e y}). T h e motivation for building this special set theory prover is much the same as that for building STR+VE: to avoid the explicit use of the transitivity property. For C and C, the transitivity property is

AC_BABCC--~ACC, A c B A B C C --~ A c C, and ACBABcC-~ AcC. *This work supported by National Science Foundation Grant CCR-8613 706.

194

If we were to explicitly add the clauses corresponding to the transitivity property, then their literals would individually unify with every subset literal in the prover's clause set and, as a result, the prover's search space expands explosively. Moreover, the inclusion of intersection and union in the prover's formulas expands the search space even more by effectively requiring associative-commutative unification. However, the same problems arose with transitivity of _ and were effectively dealt with in the STR+VE implementation of chaining [7]. STR+VEC_ is an effort at transferring the lessons learned in the development of STR4VE for the _~ ordering to the C ordering. 2

O v e r v i e w of Strq-veC_

As with STR+VE, the main inference rules of STR#VEC_ are chaining, factoring, reduction and variable elimination. Chaining (Section 5) implements the transitivity property of C_ and is term oriented. That is, it is not applied as resolution is, to pairs of unifiable literals with opposite signs, but to pairs of unifiable terms with one on the left side of C and one the right. Also, neither term may be a variable. Factoring (Section 7) is likewise term oriented and reduction (Section 6) deletes literals of the form {x} c_ 0. This is not unlike deleting literals of the form 1 _< 0. The subset version of variable elimination (Section 10) is used just as the inequality version is used in STR+VE, to remove variables which do not occur within any shielding term. We analogously define a term ( f tl, t 2 , . . . , t~) to be a shielding term if f is neither union nor intersection and for some i _< n, ti is either a variable or contains a variable. (Note that (singleton x) 1 is a shielding term when x is a variable or contains a variable.) Therefore, in order to remove variables by variable elimination, their shielding terms must first be removed. This is much the same strategy as followed in STR~,VE [7]. Given that the unshielded variables will be removed by variable elimination, the prover begins searching for a series of chainings which will remove all the shielding terms of some chosen variable. If successful, that variable is then removed by variable elimination. In other words, the strategy of the prover is to remove shields to make variables eligible for elimination, to eliminate variables to make clauses ground and then find ground contradictions to finish the proof. However, there are obviously major differences between the _< ordering and the C_ ordering and, consequencely, between STR+VE and STR4VEC_. To begin with, _< is a total ordering while C_ is not. The totality of < is employed in STR4VE in the preprocessing conversion which translates :~ to > and ~ to _>. In STR+VE, we likewise employ a preprocessing procedure (Section 4) which translates formulas with the predicates element, nonempty, C_ and C to a conjunctive normal form containing only literals of the form (al CI a2 VI ... N ak C_ bl (-J b2 U ... U bt). where k > 0 and the empty set is indicated when l = 0. This conversion incorporate s the typical steps in converting predicate calculus formulas to conjunctive normal form as well 1For brevity, we typically write this term as {x}.

195

as steps that replace element, nonempty, etc. In this process, a literal such as a ~ b is replaced with 3 x ( x E a A x q[ b). 2 Another major difference in the two provers is that there are some shielding terms in STR4VEC_ that cannot be removed by chaining. In fact, the conversion process can

introduce such shielding terms into the formula. Steps 4 and 5 in the process insert into the formula singleton sets which appear only on the left-hand sides of literals. Since these sets never appear on the right-hand side, chaining will not remove them. Instead, these chainless sets should be removed by the {x} C ~} reduction. This reduction does not apply to literals such as {x} N {y} C_ 0 unless x and y can be factored. So, many literals with two or more chainless set can be immediately replaced with a factor that contains only one chainless set. Also, we may discard clauses containing literals with two unfactorable chainless sets since such sets cannot be removed by reduction or by chaining and, consequently, their clauses cannot be part of any refutation. But, the primary difference in the two provers involves the variable elimination inference rule. In STR+VE variable elimination builds in the interpolation property, W , y ( ( x < y) ~ 3z(x < z) A (z < y)). With interpolation and totality, any clause of the form b < x V x _< a where x is a variable that does not occur in a or b, can be refuted when 3 x ( a < x A x < b) which holds iff a < b. Since this method cannot be directly mimicked in STR4~VEC_, we employ a method based on the property that there is no universal set. From this, we have that

w , y((x g y)

3w((

# 0) A (z

u y))

or, more generally,

vx, y, z((x

y)

3w((w

z) A (x

w u y))).

Then we do not need totality to refute a clause such as b C_x V x C_a. Instead, we need only show 3x(b ~ x A x ~= a) which holds when b ~ 0. But, there are some variables in STR+VEC that cannot be eliminated (as their counterparts are in STR4VE). Therefore, we cannot entirely prohibit chaining a n d / o r factoring on variables even though that prohibition is fundamental to the strategy behind STR+VE. However, since many variables can be eliminated and since chaining and factoring on variables is very explosive to the prover's search space, the prohibition need not and should not be entirely abandoned. Instead, we have found that such chainings and factorings may be restricted as described in Sections 9 and 11. 3

Our Fragment of Set Theory

Let £: be a language whose non-logical symbols consists of 0 and finitely many other constant symbols; a one-place function symbol singleton and finitely many other function symbols of one or more places; and a relation symbol C. ~I.e., {x} C a A {x} n b c_ ¢.

196

Let 9r be any family of sets such that the empty set is in ~" and such that for any sets x and y in 5r , x U y, x n y and {x} are in .%'. Then an interpretation is any mapping I from terms in Z: to members in iT" where 1(0) is the empty set, I ( x U y) is I(x) U I(y),

I(x n ~) is I(~) n I(y), and 1((singleton x)) is {X(x)}. The relation C_ is interpreted so that for all sets xl through x,~ and yl through y,~ the literal Xl x2 . . . x~ C_ y~ Y2 -.. Y,~ holds in the interpretation if and only if for all x E I(x~) for every 0 < i < n there is j such that 0 < j < m with x C: I(yj). One importan¢ consequence in our theory is that for any set x there is a set y such that y ~ x (i.e., there is no universal set). 4

Converting to Clause Form

The preprocessing conversion process puts predicate calculus formulas in conjunctive normal form and removes the predicates C, =, E, and nonempty in favor of the predicate C. Also, the function set-difference is replaced as well as union on the left-hand side of _C_and intersection on the right-hand side. The process consists of the following steps: 1. Eliminate implication signs. 2. Distribute negation over other logical connectives and quantifiers. 3. Standardize apart variables. 4. Remove negations. (Note the introduction of the chainless set {x} in three of the replacements.)

A~B A~B Aq~B -~(nonempty A) A~=B

to to to to

(B C A) V 3x[(Ix} C A) A ({x} fl B C 0)] 3x[({=} C AU B) A ({x} fl AN B c 0)] {A} n B C_ 0 AC¢

to

3~[({x} c_ A) A ({x} n B =_ ¢)]

. Replace C, =, E and nonempty. (The C and nonempty replacements introduce the chainless set {x}.)

AcB A=B AEB (nonempty A)

to

(A c B) ^ ~=[({x} c A) ^ ({=} n B c 0)]

to to to

(A C B) A (B C A) {A} C B 3x({x} C_ A)

6. Replace existential quantifiers with Skolem functions or constants and drop universal quantifiers.

197 7. Replace set differences and split unions on the left-hand side as well as intersections on the right-hand side

AC_BU(C\D) A C B\ C A A ( B \ D ) C_C A\BCC AN(BUD) C C AU B C C

AC_BU(CND) A C_B N C

to to to to to to to to

(AC_BUC)A(ANDCB) (A C _ B ) A ( A N C C_ O) AABCCUD ACBUC (AABCC)A(ANDCC) (A c C) A (B C_C)))

(ACBUC) A(ACBUD) (A C_B) A (A C_C)

8. Place the formula in conjunctive normal form by distributing V's over A's. 9. Drop the explicit use of f3, U and 0 3 as well as V and A.

AC_BU(CUD) A O ( B O D ) C_C A C_BUO AC_~ A N 0 C_B 0C B

to to to to to to

AC_BCD ABDC_C. A CB AC_ true true

10. Mark as a chMnless set any singleton set which appear exclusively on the left side of the C.

5

Basic Subset Chaining

Chaining builds in the transitivity property of C. In its simplest form, chaining deduces a C_ c from a C_ b and b C c. But we also have that a N c C d U e follows from a C_ b U d and b n c c e.

A chain resolvent of clauses C1 and C2 with distinct variables is any clause of the form

(C, \ {L1}),:r U (C2 \ {n~})o- U { ( a l . . . a k cl...cj-1 cj+l..,c,~ C b l . . . bi-1 b~+l . . . bl d l . . . d,~)}cr

where L1 E C1 is of the form al a 2 . . . ak C_ bl b2... bl; L2 C C2 is of the form cl c 2 . . . c,~ C_ d~ d 2 . . . din; bi and cj are not variables; l
<j
a is the mgu of b~ and cj. 3In all the examples given in the following sections, intersection, union and the empty set are not dropped to make the examples more readable.

198

For example, we can derive clause 3 (below) by chaining on a , in clause 1 against a . of clause 2. Only x is a variable. (Note that b N b is reduced to b and c U c is reduced to

c.) 1. a = N b C c 2. b C a ~ U c 3. bC_c. In the following example, we can chain on b=,v in clause 1 against b~,,z of clause 2. x, y and z are variables. The substitution is {a/x, y/z}.

6

1. a C bx,v U dv 2. ba,zNCC_ez

{ x } C_ dv

3. a N c C d y U %

{a}C_du.

Singleton Reduction

A singleton reduction resolvent of a clause C is any clause (C \ {L})a where L e C is of the form {S(vl, ...,v,~)} C v, O ... U v,~, vl through v~ are variables, and a is the substitution {ely,, ..., O/v~}. For example, we derive R(O) C 0 from {S=} C x V R(x) C O. Note that when a is the empty substitution, the resolvent subsumes C and, thus, this rule acts as a rewrite rule, replacing C with (C \ {L}). That is, literals of the form {A} C_ 0 axe immediately dropped from any clause, derived or input. This is in the same spirit as reducing 1 < 0 to false. 7

Factoring

A factor of a clause C is any clause of the form C a where L1 E C is of the form al a 2 . . . ak C_ bl b2... bl; L2 E C 4 is of the form cl c 2 . . . c ~ C_ dl d2...dm; and is the mgu of either a~ and ci for 1 < i < k and 1 _< j _< n or bl and dj for 1
f(x) C b V f(v) C- c f(x) n f(v) C_ b

4L1 and L2 need not be distinct literals in C.

We derive by factoring

f(x) C_ b V f(x) C_ c f(x) C_ b.

199

Note that this is not the typical factoring rule of resolution. Instead, factoring is term-oriented just as chaining is. 8

Chainless Sets and Forced Factoring

If {A} and {B} are chainless sets then any clause of the form ({A} N {B} C 0) V C is discarded if A and B axe not unifiable and, otherwise, is replaced with Ca where a is the mgu of A and B. Given a clause C of the form {S~} N {S~} c 0 V P(x), we can by factoring derive {S~} C 0 V P(a) which is immediately reduced to P(a). However, if {S=} and {S~} are chainless sets then we may discard C and retain only the new resolvent P(a). This is justified since no non-vaxiable term appears on the right-hand side of C which unifies with {S~} or {S~} and, consequently, those terms can be removed by chaining only if matched against a variable. That is, from {S~} C 0 and another clause such as B u C y we can derive B{s,} C 0 by chaining as long as y is a variable. However, such chaining on variables is not permitted (even with the RVT-chain rule given below).

9

C h a i n i n g on Variables

Prohibiting chaining on variables is perhaps the most critical restriction built into STR4VE, but as the following theorem demonstrates we cannot entirely retain that prohibition in STR4VEC.

V A S x V S ( S E A ~ S E x). In clause form, we have {S=} N x C 0 and {S=} C_ A with the term {S=} shielding x. Since {S=} is a chainless set, it can only be removed by the singleton reduction rule which cannot be applied until x is removed. That is, we must chain on x. Nevertheless, allowing arbitrary chaining on variables is clearly a losing proposition. But we can take from the example some fairly strong restrictions on when such chainings must be allowed. First, the variable is shielded only by left singleton terms s since other shielding terms can be removed by basic chaining. Second, the term against which the variable is chained (in this case A) occurs in a literal with another left singleton term. And, finally, these two left singleton terms unify. This emphasis on left singleton terms forms the basis for the following variable chaining rules.

A L V chain resolvent of clauses C1 and C2 with distinct variables is any clause of the form (el \ {L1})Ar U (C~ \ {n2})Ar U {(al

... ak el-.-era-1

Cm+l . . .

Co C bl... bj_l bj+l.., bp dl... dp)})~v

where SAny term occurring to the left of C which has singleton as its topmost function symbol.

200

L1 E 6'1 is of the form al a 2 . . . a , C bl b2... bp; L2 E 6½ is of the form cl c 2 . . . co C dl d 2 . . . dq;

bj (1 < j < p) is not a variable; ak (1 < k < n) and ct (1 < l < o) are left singleton sets and r is the mgu of ak and ctA; cm (1 < m < o) is a variable shielded only by left singleton terms one of which is cl; and A is the substitution {(bj U v')/cm} where v' is~a new variable; For example,

1. {S~} C_ A

2. {S~}nzc_ 0 3. 4.

{SAul,} C ~ []

LV Chain 1 2 Reduction 3

The second rule is very similar to the first. A L V T chain resolvent of clauses C1 and 6'2 with distinct variables is any clause of the form

(C~ \ {L1})AaT U (C2 \ {L~})AaTU {( a l . . . an c l . . . CI--1 Ci+l . - . Cm--1 Cm-I-1... Co bl . . . bj-1 bj+l . . . bp dl . . . dq) },~crT where L1 E C1 is of the form al a 2 . . . a ~ C bl b2...bp; L2 E 6'2 is of the form cl c2...co C dl d2...dq;

bj (1 < j < p) and c~ (1 < i < o) are not variables and a is their mgu; a~ (1 < k < n) and ct (1 < l < o) are left singleton sets and r is the mgu of ak~r and ct~a; c,~ (1 < m < o) is a variable shielded only by left singleton terms one of which is ct and none of which is ci; and is the substitution {(cl U v')/cm} where v' is a new variable. For example, given that x is a variable we have:

1.

{S~} C_ A

2. { S ~ } n A n x c O 3. 4.

{SAt.J:v'}

[]

~ 0

LVT Chain 1 2 Reduction 3

A R V T chain resolvent of clauses C1 and C2 with distinct variables is any clause of the form (Ci \ {nl}),~rT U (C2 \ {L2})A~-U { ( a , . . . a , ~ c , . . . c j _ , cj+:t...co C_ b l . . . bi-1 bi+l.., bin-1 b,,~+l.., bp d l . . . dq)},Xar where

201

L1 E C1 is of the form al a2... an C bl b2... bp; L2 E C2 is of the form

C1 C 2 . . .

Co C

dl d 2 . . . dq;

b~ (1 < i < p) and cj (1 < j < o) are not variables and a is their mgu; ak (1 _< k < n) and c~ (1 < l < o) are left singleton sets and r is the mgu of ak~o" and cza; bm (1 < m < p) is a variable shielded only by left singleton terms one of which is ak and none of which is b~; and )~ is the substitution {(b~ C?v')/bm} where v' is a new variable. For example, given that x is a variable we have:

1. {S }nAC_ 0

10

2.

{S~}CAUx

3. 4.

{SAn=,} C O []

RVT Chain 1 2 Reduction 3

Variable Elimination

As noted previously, the variable elimination rule used here in STR+VEC is not based upon the interpolation property of dense ordered fields as is done in STR+VE. Instead, it is derived from the property Va, b, e((a g b) ~ 3x((a ~; x U b) A (x ~: c))) which holds since there is no universal set.

A variable elimination resolvent of a clause C is any clause

{ai

c_ bl : i = 1, ..., m } V C '

given that C can be written as a disjunction in the form

{a, C_ x U bi: i = 1,...,m} V {x C_ cj : j = 1,...,n} V C'

(*)

where x is a variable that does not occur in any ai, bl, cj or any literM in C'. Note that when ra is zero then the variaMe elimination resolvent is just C'. For example, given that x and y are variables and x does not occur in a, b, c, d and e: Given aCx x c b v f(y) C a a C x V c C x V xC__b V e C d

We derive by V E aCO

f ( y ) C_ a aCOVcC$VeCd.

We say that a variable is eligible when it does not occur within any shielding term in the clause. So, x is eligible while y is not since f ( y ) shields it. However, STR*VEC's

202

variable elimination rule differs significantly from STR4VE'S rule in that not all eligible variables can be eliminated. For example, in the following clause the variable x is eligible if it does not occur in a, b, c or d; yet, the intersection in the second literal prevents the clause from being written in the form of the disjunction * above and, thus, x cannot be eliminated.

aCxUb 11

(1)

V xNdCc.

Factoring on Variables

The theorem Va3x(a E x) gives us another example of an eligible variable which cannot be eliminated. Converting the theorem to clause form gives us the single clause {a} (3 x C_ 0. Without factoring on x we cannot refute this clause and prove the theorem; nonetheless, this does not necessitate factoring on all variables. Instead, such factorings are restricted to eligible, but uneliminated variables.

A v-factor of a clause C is any clause of the form (C \ {L})a U {(a, a:...ai-1 ai+i...ak

C_ bl b2...bl)}o

where L E C is of the form al a2...ak C bl b2...bl; ai (1 < i < k) is an eligible variable in C; aj (1 <_ j < k) is not al; and a is the substitution {(ai U v')/a,} where v' is a new variable. In the example, we may v-factor x with {a} to obtain {a} C 0. Also, in (1) above, we may v-factor x with d to obtain a C d U x' U b V d C c where x' is a new variable. (The variable x' can then be variable eliminated.) 12

Splitting and Flattening

In chaining and in factoring, the substitution used may instantiate a variable with a union o'r an intersection. If the variable occurs at the top level of the literal, then the union or intersection should be removed either by splitting or by flattening as described below.

A left split resolvent of a clause C is any clause of the form

( C \ C') U C" where C I is a subset of C and for some j _< m, C rl is the set of literals such that for every literal (al a 2 . . . ak C bl b2... bl) in C' there is a term al (i < k) of the form (dl U d2 U...U din) and (al as... ai-x dj ai+l.., ak C bl b2... bt) is in C".

A left flatten resolvent of a clause C is any clause of the form

(c\ c')uc"

203

where C' is a subset of C, C" is the set of literals such that for every literal (al a 2 . . . ak C bl b2...bl) in C' there is a term ai (i < k) of the form (dl fqd2 f q . . . f q d , ~ ) and (al a s . . . a i - 1 dl ...dm ai+l ...ak Cbl b2...bl) is in C".

Right split and right flatten resolvents are defined analogously. Flattening and splitting are mandatory. That is, if a clause can be flattened then no other inference rule may be applied to the clause. Likewise, if a clause can be split then no other inference rule (except flattening) can be applied to the clause. This effectively means that the parent clause of any flatten resolvent is deleted and the parent clause of any split resolvent is deleted once all of its split resolvents are produced.

13

Conclusion

This work has been motivated by the discovery that the principles and techniques used in the STR+VE prover for inequalities may be useful in dealing with the subset relation. For example, in [4] the Paracompactness Theorem [8] was proved by hand with this methodology combined with the Set-Variable Prover [2]. Likewise, in [6] the CompactHausdorff-Regular Theorem and the Attains Maximum Theorem of Analysis were proved. Also, in [3] a number of subgoals within the proof of the completeness of resolution were proved automatically by the first implementation of this set theory prover. STR+VEC is our first step in investigating this line of research. We have found that much of the strategy developed in STR4VE such as the emphasis on shielding terms does extend to the subset relation even though there is a significant divergence between the dense linear orders of STR+VE and the subset partial order of STRfVEC. Our main goal in improving the design of STR+VEC must be to improve the rules which allow chaining and factoring on variables. This includes possibly enhancing the variable elimination rule so that such chainings and factorings might not be necessary or, at least, can be more restricted. Also, presently there is no method for handling the substitution of equals for equals. Such a method is clearly necessary. Another enhancement that we intend to investigate is using pair as the only primitive set theoretic function instead of singleton. While we can represent with singleton any formula that can be represented with pair, the representations of such fundamental theorems as the ordered pair theorem is certainly more amendable with the pair notation. Additionally, we will examine completeness issues with respect to this prover.

204 14

Examples

E x a m p l e 1: Extensionality. VX, Y (Vz (z E X e~, z E Y) --+ X = Y).

1, {z} nxc_0 2. {z} n y c_ O

{z}C_Y {z} _cx

3. { S } c x u Y 4. {S}nXnYC_O 5. { s } n I z } C y

{z}C__Y

7. {S} AXC_0 8. {z} nYc_0 9. {S} n Y _ C 0

3, 1-Chain on X.

5-Factor { S} and {z}.

6. { S } C Y

{z} n {S}_c0 {S}c_0

10. {S} nYc_O 11. { S } c 0 12. []

6, 4-Chain on Y. 7, 2-Chain on X. 8-Factor {S} and {z}. 9-Mandatory Singleton Reduction 10, 6-Chain on Y. ll-Mandatory Singleton Reduction

E x a m p l e 2: (A E B A C fd B) ~ 3v(A E (v \ {C})). This example was distilled from the subgoals in [3] mentioned above. 1. { A } C B

2. {C}nBc_0 3. { A } A v C { C }

4. {A} n {C} c 0 1, 2-Chain on B. 5. { A } A v C 0 6. {A}C_0 7. []

3, 4-Chain on {C}. 5-V-Factor on {A} and v. 6-Manditory Singleton Reduction.

E x a m p l e 3: (Ve(((nonempty e) --* (A C B~ U e)) A (B~ C C))) --+ (A C C). The Skolem function S is introduced in preprocessing and {S} is noted as a chainless set. 1. A C B ~ U e 2. RoC_C

eC_O

3. {S}C_A 4. {s}nc_c0 5. A C _ C U e 6. A C C

7. { s } c c 8. {s}c_0 9.

[]

eC_O 2, 1-Chain on Be. 5-Var Elim e. 6, 3-Chain on A. 7, 4-Chain on C. 8-Manditory Singleton Reduction.

205

E x a m p l e 4: (Vx((A % x) --~ (B % x))) --+ (A C B). The Skolem function S and constant T are introduced in preprocessing. 1. 2. 3. 4.

AC_x ACx {T} C A {T}ABC_0

5. 6. 7. 8. 9. 10.

{S~} _C B {S~}Ax C_ 0

AC_BUx' ACBUx' ACB {T} C_ B {T}C_O E]

2, 1-LV Chain on x and B. 5-Manditory Singleton Reduction. 6-Var Elim x'. 7, 3-Chain on A. 8, 4-Chain on B. 9-Manditory Singleton Reduction.

E x a m p l e 5: VB, C 3x, y VA (A E B U C --~ A E x n y). 1. {A=,~} C_ B U C 2. { A x , ~ } n x n y C _ O 2, 1-LV Chain on x and B. 3, 1-LV Chain on y and B. {Asucu=,,,Buv} n (B U y) c 0 2, 4-LV Chain on x and C. 5-Split (B U y'). {Asucu=,,,suy,} CI B C_ D-Split (B U y'). {nsucu~,,,Bu~,} A y' C O 7, 4-LF Chain on y, and C. {Asucu=,,,suvuy,,} C_ O 7-Manditory Singleton Reduction. []

3. {Asu=,,~} N y C_ C 4. {ABu=,,suy,} C_ C

5. 6. 7. 8. 9.

References [1] Bledsoe, W. W., "The Sup-Inf Method in Presburger Arithmetic". The University of Texas at Austin, Math Department Memo ATP-18. December 1974. Essentially the same as: A new method for proving certain Presburger formulas. Fourth IJCAI, Tbilisi, USSR, September 3-8, 1975. [2] Bledsoe, W. W., "A Maximal Method for Set Variables in Automatic Theorem Proving", Machine Intelligence 9, (J. E. Hayes, D. Michie and L. I. Mikulich, eds.), Ellis Harwood Lim., Chichester, (1979) 53-100. [3] Bledsoe W. W., "Journal Ready Proofs: A New Standard for Interactive Proof Presentation", Univ of Texas CS Dept Memo, ATP 88, (August 1989). [4] Bledsoe, W. W., "The Paracompactness Theorem", Univ of Texas CS Dept Memo, ATP 96, (June 1989). [5] Bledsoe, W. W., and L. M. Hines, "Variable Elimination and Chaining in a Resolution-Base Prover for Inequalities", Proc. 5th Conference on Automated Deduction, Les Arcs, France, Springer-Verlag, (July 1980) 70-87.

206 [6] Feng, Guohui, "Hand Proofs of the Compact-Hausdorff-Regular Theorem and the Attains Maximum Theorem", Univ of Texas CS Dept Memo, ATP 98, (August 1989). [7] Hines, L. M., and W. W. Bledsoe, "The STR~-VEProver", Technical Report ATP-100, University of Texas, Austin, (August 1989). [8] Kelley, John L., General Topology, D. Van Nostrand Company, Inc., Princeton, New Jersey, (1955). [9] Rabinov, A., "A Restriction of Factoring in Binary Resolution." Proe. 9th International Conference of Automated Deduction, Argonne, Illinois, USA, Springer-Verlag, (May 1988) 582-591. [10] Slagle, James R., "Automatic Theorem Proving with Built-in Theories Including Equality, Partial Ordering, and Sets", Journal of ACM, Vol 19, No 1, (January 1972), 120-135.

Ritt-Wu~s D e c o m p o s i t i o n A l g o r i t h m and G e o m e t r y T h e o r e m Proving* Shang-Ching Chou and Xiao-Shan G a o t D e p a r t m e n t of C o m p u t e r Sciences T h e University of Texas at Austin, Austin, Texas 78712 USA A b s t r a c t An improved Ritt-Wu's decomposition (of an algebraic set into the union of irreducible varieties) algorithm is given. The algorithm has been used to prove geometric theorems that Wu's original method addresses. Unlike Wu's original approach, nondegenerate conditions are given explicitly at the beginning, not generated during the proof process. A program based on this improved version of the algorithm proved more than 500 theorems, including Morley's trisector theorem. K e y w o r d s Wu's method, mechanical theorem proving, prover, elementary geometry, degenerate conditions, Ritt-Wu's principle, algebraic variety, ideal, ascending chain, the dimension theorem, Morley's trisector theorem.

1. Introduction In 1977 Wu Wen-Tsiin introduced an algebraic m e t h o d which could be used to prove theorems not involving betweenness in Euclidean geometry [16]. Since then, hundreds of non-trivial theorems have been proved based on this method. Further work [17] showed t h a t the algebraic tools and algorithms of the m e t h o d were already begun in the work of J. F. Ritt [14]. The key to the m e t h o d is R i t t - W u ' s principle and R i t t - W u ' s Decomposition Algorithm [17], [18]. If one i m p l e m e n t s the algorithms literally according to the description of the work by Ritt and Wu, the size of polynomials produced in the process will b e c o m e larger and larger. In practice, some modifications of R i t t - W u ' s original algorithms are used. Especially, W'u himself uses the notion of an ascending chain in loose sense [17] to reduce the size of polynomials produced. However, ascending chains in W u ' s loose sense still cannot prevent the size growth of polynomials in m a n y cases. This p a p e r presents an improved version of R i t t - W u ' s decomposition algorithm using a new algorithm, W-prem, for computing pseudo remainders (Sections 2-4), and gives an efficient m e t h o d for proving geometry theorems according to Formlflation F2 (see below) based on our i m p r o v e d algorithms (Sections 5-8). Besides the improved algorithms, we also prove m a n y related theorems of theoretical as well as practical interest; we will like to draw particular a t t e n t i o n to T h e o r e m (4.4). In Section 5-8, we will address the same kinds of geometric s t a t e m e n t s as W u ' s original m e t h o d addresses. A geometric s t a t e m e n t is valid only under certain nondegenerate conditions. T h e r e are two approaches (formulations) to dealing with nondegenerate conditions:

* T h e work r e p o r t e d here was s u p p o r t e d in part by the NSF G r a n t CCR-8702108. t On leave f r o m I n s t i t u t e of Systems Science, A c a d e m i a Sinica, Beijing.

208

Formulation (Approach) F1. Introducing parameters and the notion of "generally t r u e " for a g e o m e t r y s t a t e m e n t . T h e p r e s e n t t e c h n i q u e s c a n p r o v e a s t a t e m e n t to b e g e n e r a l l y t r u e , a t t h e s a m e t i m e g i v i n g n o n d e g e n e r a t e c o n d i t i o n s ( u s u a l l y in a l g e b r a i c form) automatically. Formulation (Approach) F 2 . G i v i n g n o n d e g e n e r a t e c o n d i t i o n s in g e o m e t r i c f o r m m a n u a l l y (or m e c h a n i c a l l y ) a t t h e b e g i n n i n g as a p a r t o f t h e h y p o t h e s e s . T h e n t h e p r o v e r o n l y n e e d s t o a n s w e r w h e t h e r t h e c o n c l u s i o n follows t h e h y p o t h e s e s without adding any o t h e r c o n d i t i o n s . O u r p r o v e r [3] m a i n l y uses F o r n m l a t i o n F1. T h i s p a p e r a d d r e s s e s F2 u s i n g W u ' s m e t h o d . O u r i m p r o v e d a l g o r i t h m / p r o g r a m has p r o v e d m o r e t h a n 500 t h e o r e m s a c c o r d i n g to F o r m u l a t i o n F2. A m o n g t h e w o r k r e l a t e d to F o r m u l a t i o n F 2 , we m e n t i o n t h e w o r k o f D. K a p u r [9] a n d H. P. K o [13]. W e will discuss t h e i r w o r k in S e c t i o n 8.

2. Preliminary Definitions and Algorithms L e t K b e a c o m p u t a b l e field such as Q , t h e field o f r a t i o n a l n u m b e r s , a n d g = Yl, Y2,- • . , Ym b e i n d e t e r m i n a t e s . Unless s t a t e d o t h e r w i s e , all p o l y n o m i a l s m e n t i o n e d in t h i s s e c t i o n a r e in A = K [ y l , . . . , y,~] = K[y]. L e t f E K[y]. T h e class o f f , d e n o t e d b y class(f), is t h e l a r g e s t i such t h a t y~ o c c u r s in f . I f f E K , t h e n class(f) = 0. Let c = class(f) > 0. W e call Yc, d e n o t e d b y Iv(f), t h e leading variable o f f . C o n s i d e r i n g f as a p o l y n o m i a l in y~, we c a n w r i t e f as n

amy~ +

a

n-1

n-lY~

+"-+ao

w h e r e a . . . . . , a o a r e in K[yl,...,y~_I], n > O, a n d a . ~ O. W e call a , t h e initial or leading coeJ~ficient o f f a n d n t h e leading degree o f f , d e n o t i n g t h e m as lc(f) a n d Id(f), respectively. N o w we p r e s e n t t h e p s e u d o d i v i s i o n a l g o r i t h m , a b a s i c s t e p for m o s t a l g o r i t h m s , L e t f a n d g b e in K[y] a n d v b e one of t h e Yl,---, Y,~. S u p p o s e t h a t deg(f, v) > O. C o n s i d e r i n g f a n d g as p o l y n o m i a l s in v, we c a n w r i t e g a n d f as g = a,v" + ... + ao, f = bkv k + • .- + b0. F i r s t set r = g. T h e n r e p e a t t h e following p r o c e s s while m = deg(r,v) ) k: r : = bk r --c,~ v ~ - k f , w h e r e c,~ is t h e l e a d i n g coefficient o f r in t h e v a r i a b l e v. It is e a s y to see t h a t m s t r i c t l y d e c r e a s e s a f t e r e a c h i t e r a t i o n . T h u s t h e p r o c e s s t e r m i n a t e s . A t t h e e n d , we have t h e pseudo remainder prem(g, f , v) = r = r0 a n d t h e f o l l o w i n g f o r m u l a

big = qf + ro,

w h e r e s ~ n - k + 1 a n d deg(ro, v) < deg(f, v).

L e t c = class(f)

> 0. A p o l y n o m i a l g is reduced with respect to p o l y n o m i a l f if day(g, y~) < day(f, y~). N o t e t h a t prem(g, f, y¢) is r e d u c e d w i t h r e s p e c t t o f ; we d e n o t e prem(g, f, y¢) s i m p l y b y prem(g, f). D e f i n i t i o n ( 2 . 1 ) . L e t C = f l , f 2 , . . . , f~ b e a s e q u e n c e of p o l y n o m i a l s in K[y]. W e call i t a quasi ascending chain or a triangular form if e i t h e r r = 1 a n d f l ~ 0, or r > 1 a n d o < class(h) < cZa~(h) < ... < d~s~(f~). Let fl,...,

f~ b e a q u a s i a s c e n d i n g c h a i n w i t h class(f1) > 0. W e define prem(g; fl,

209

. . . . f r ) i n d u c t i v e l y t o b e prem((prern(g, f~); f l .... , f ~ - 1 ) . t h e f o l l o w i n g i m p o r t a n t Remainder Formula: (2.1.1)

L e t it b e R. T h e n we h a v e

I i . . . . I:"g = Q l f l + " " + Q~f~ + R

w h e r e t h e Ii a r e t h e i n i t i a l s o f t h e f~, s l , . • . , sr are n o n - n e g a t i v e i n t e g e r s , a n d Q 1 , . . . , Qr are p o l y n o m i a l s . F u r t h e r m o r e , deg(R,x~) < dcg(fl,x~), for i = 1 , . . . , r , w h e r e xl =

Iv(f,). (i) A q u a s i a s c e n d i n g c h a i n is c a l l e d a n ascending chain in Ritt's sense i f f i a r e r e d u c e d w i t h r e s p e c t t o fi for i < j . (ii) A q u a s i a s c e n d i n g c h a i n is c a l l e d a n ascending chain in Wu's sense ( a b b . w u - a s c c h a i n ) if t h e i n i t i a l s I i o f t h e f1 are r e d u c e d w i t h r e s p e c t to fi for i < j . E x t e n s i v e c o m p u t a t i o n a l e x p e r i e n c e s u g g e s t s t h a t for n o n t r i v i a l p r o b l e m s , a s c e n d i n g c h a i n s in R i t t ' s sense as well as in W u ' s sense a r e v e r y e x p e n s i v e to c o m p u t e b o t h f r o m s p a c e a n d t i m e c o n s i d e r a t i o n s . A s we d i s c u s s l a t e r in t h e p a p e r , on M o r l e y ' s t h e o r e m , h u g e i n t e r m e d i a t e p o l y n o m i a l s a r e g e n e r a t e d for c o m p u t i n g t h e s e a s c e n d i n g c h a i n s . In t h i s p a p e r , we i n t r o d u c e a s c e n d i n g c h a i n s in w e a k sense w h i c h a r e n o t t h a t e x p e n s i v e to compute. (iii) A q u a s i a s c e n d i n g c h a i n is c a l l e d an ascending chain in weak sense ( a b b . c h a i n ) i f p r e m ( I i ; f l , ...,f~) ~ O, for i = 1 ..... r.

w-asc

O b v i o u s l y , an a s c e n d i n g c h a i n in R i t t ' s sense is an a s c e n d i n g c h a i n in W u ' s sense; an a s c e n d i n g c h a i n in W u ' s sense is a n a s c e n d i n g c h a i n in w e a k sense. T h e k e y t o o u r i m p r o v e d v e r s i o n of t h e a l g o r i t h m is to use a s c e n d i n g c h a i n s in w e a k sense. W h e n e v e r we t a l k a b o u t a n a s c e n d i n g c h a i n , it c a n b e a n y o n e o f t h e a b o v e t h r e e . W e define a p a r t i a l o r d e r < in K [ y ] : f < g if class(f) < class(g) o r class(f) = class(g) > 0 a n d Id(f) < td(g). I f n e i t h e r f < g n o r g < f , t h e n we say f a n d g a r e o f t h e s a m e r a n k . O b v i o u s l y , e v e r y n o n e m p t y p o l y n o m i a l set S h a s a m i n i m a l e l e m e n t , i.e., t h e one w h i c h is n o t h i g h e r t h a n a n y o t h e r e l e m e n t in S. D e f i n i t i o n ( 2 . 2 ) . L e t C -- f l .... , f~ a n d C1 = g l , . . . , g , ~ b e two a s c e n d i n g chains. W e define C < C1 i f t h e r e is a n s s u c h t h a t s < m i n ( r , m ) a n d fi a n d gi a r e of t h e s a m e r a n k for i < s a n d t h a t f , < g~, or rn < r a n d fl a n d gi are of t h e s a m e r a n k for i ~ rn. Proposition ( 2 . 3 ) . T h e p a r t i a l o r d e r < a m o n g t h e set of all a s c e n d i n g c h a i n s is w e l l - f o u n d e d , i.e, t h e r e are no infinite~ s t r i c t l y d e c r e a s i n g s e q u e n c e s of a s c e n d i n g chains.

Proof. See L e m m a 1 o f [17].

|

D e f i n i t i o n ( 2 . 4 ) . L e t S b e a n o n e m p t y p o l y n o m i a l set. A m i n i m a l w-asc c h a i n in t h e set o f all w - a s c c h a i n s f o r m e d f r o m p o l y n o m i a l s in S is called a w-basic set of S. U n l e s s s t a t e d o t h e r w i s e , w h e n e v e r we t a l k a b o u t a finite p o l y n o m i a l set S , we a s s u m e S does n o t c o n t a i n zero. By (2.3), e v e r y n o n e r n p t y p o l y n o m i a l set S h a s a w - b a s i c set. Theorem ( 2 . 5 ) . L e t S b e a finite, n o n - e m p t y p o l y n o m i a l set. T h e r e is a n a l g o r i t h m to c o n s t r u c t a w - b a s i c set of S.

210

Proof. Let f l be a minimal polynomial of S (in the order <). If class(f1) = 0, then it forms a w-basic set of S. Now suppose class(f1) > 0. Let S1 be the set of all polynomials in S, whose classes are higher than class(f1) and whose initials I are such that prem(I; f l ) ~ 0. If S1 is empty, then f l forms a w-basic set of S. Now suppose $1 is nonempty. Continuing this way, at step k, we have a w-asc chain C = fl,...,f~ in S. Let Sk be the set of all polynomials in S, whose classes are higher than class(fk) and whose initials I are such that prem([; fl, :.., fk) ~ 0. If S~ is empty, then f l , .-., fk is a w-basic set of S. Otherwise, chose a minimal element fk+l in Sk. f l , ..., f~, f k + l form a w-asc chain again. Eventually, we arrive at a w-basic set of S in no more than m steps.

! In the original presentation of Ritt-Wu's principle (cf.

[14], [17]) the key operation

prem(f; ASC) (where ASC is an ascending chain) is repeatedly used. Since the main purpose of triangulation is to reduce the class or the leading degree of f , we need only to take fewer pseudo remainders than prem(f; ASC) takes. This can reduce the size growth of polynomials produced. The following W-prem is one of our key steps to control the size growth of polynomials. A l g o r i t h m W - p r e m (2.6). Given a polynomial g and an ascending chain A S C = f l , ..-, f~ with non-constant f l . We define W-prem(g; ASC) to be: Case Case Case Case

1. 2. 3. 4.

prem(g; fl, ..., fr ) if prem(le(g); f l , ..., f r ) = 0. g if class(fr) < class(g). W-prem(prem(g, f , ) ; f l , ..., f ~ - l ) if class(f~) = class(g). W-prem(g; fl, ..., f , - 1) if class(f,) > class(g).

The remainder formula is still valid for W-prem, except deg(R, xl) < deg(f~, xi) (where xi = tv(f~)) is not necessarily true.

Proposition ( 2 . 7 ) . For an ascending chain A S C = fl, ..., f, with class(f1) > 0 and a polynomial g, if W-prem(g; ASC) = 0, then prem(g; ASC) = O. Proof. The proposition is easy to prove using induction on r.

|

We introduce a new notation extremely useful for the rest of the paper:

P D ( A S C ) = {g t prem(g;ASC) = 0}. The following proposition insures the termination of the triangulation procedure of R i t t - W u ' s principle, when using W-prem.

Proposition

(2.8).

Let B = f l . . . . ,]~ be a w-basic set of polynomial set S with

0 < class(fl), and h be a polynomial. Suppose g = W - p r e m ( h ; f l , . . . ,f~) is not zero. Then the set S1 = S U {g} has a w-basic set lower than B.

Proof.

See [4].

|

3. A Modification of Ritt-Wu's Principle Now let us fix an extension E of the base field K .

We denote Zero(S) the c o m m o n

211

zeros o f p o l y n o m i a l s in S, i.e., t h e set { ( a l , ..., a n ) E E m I h ( a l , ..., am ) = 0, for all h e S } . Let G be a n o t h e r p o l y n o m i a l set. We denote Zero(S/G) to be Zero(S) - Zero(G). T h e following i m p r o v e m e n t o f R i t t - W u ' s Principle is used in our prover. Theorem ( 3 . 1 ) . ( R i t t - W u ' s Principle). Let S = { h l , . . . , h n } be a finite n o n e m p t y p o l y n o m i a l set. T h e r e is an a l g o r i t h m to c o n s t r u c t a w-asc chain A S C , called a characteristic set of S a n d d e n o t e d by C h a r - ~ e t ( S ) , such t h a t either (3.2). A S C consists o f a n o n - z e r o c o n s t a n t in K N Ideal(S); in this case Zero(S) is e m p t y , or (3.3). A S C = f l , . . . , f ~ with class(f1) > 0 a n d such t h a t f~ C Ideal(S) and W prem(hj; f l , .... f~) = 0 for all' i = 1 . . . . , r a n d j = 1 , . . . , n ; in this case we have: (3.3.1)

Zero(S) = Zero(ASC/{Ic(fl), ..., Ic(f,)}) U U~=lZero(S U {Ic(fi)}),

(3.3.2)

Zero(S) = Z e r o ( P D ( A S C ) ) U u[=lZero(S u {Ic(fi)}).

Proof. B y (2.5), we can c o n s t r u c t a w-basic set B t of S t = S. If B t consists o f only one n o n z e r o c o n s t a n t , t h e n we have (3.2). Otherwise, we can e x p a n d $1 to $2 b y a d d i n g n o n z e r o W-prem(g; B1) for all elements g in S1. If $2 = $1, t h e n we have (3.3). Otherwise, we can c o n s t r u c t a w-basic set B2 o f $2. By (2.8), B1 > B2. I f B2 does n o t consist o f one n o n z e r o c o n s t a n t , then we can e x p a n d $2 to $3 using t h e same procedure. T h u s we h a v e a strictly increasing sequence of p o l y n o m i a l sets: $1 C $2 C . . . , with a strictly decreasing sequence of w-asc chains B1 > B 2 >

..- •

B y (2.3), this decreasing sequence can be only finite. T h u s , there is an integer k > 1 such t h a t either Bk consists o f a n o n z e r o c o n s t a n t or Sk = Sk+l; t h e n we have either (3.2) o1" (3.3), respectively. F o r m u l a s (3.3.1) and (3.3.2) are direct consequences of the R e m a i n d e r F o r m u l a (2.1.1) a n d (2.7). | Example

( 3 . 4 ) . Let S = {hl, ..., h7} in E x a m p l e (6.2) (the Morley configuration).

S1 = S; B1 = h2, h3, h5, h7. $2 = S U { f l , f4, f6}; B2 = / 1 , h2, h3, f4, hs, f6, h7, where

f l -- W-prem(hl; B1) = prem(hl, h2), f4 = W-prem(h4; B1) = prem(h4, hs), f6 = W-prem(h6; B1) = prem(h6, h7). T h e w-asc c h a i n A S C = B2 is a characteristic set o f S. T h e n u m b e r s of terms of the p o l y n o m i a l s in B2 (abb. the ntps) are 14, 4, 2, 28, 4, 59, 13. It took a b o u t 15 sec to

212

complete the computation on a Symbolics 3600. If we use Wu-asc chain, it took about 30 minutes to reach the 5th iteration Bs. The ntps of B5 are 14, 14, 2, 301, 23, 1977, 47. The program stuck in a computation (for more than 2 hours) of a prern(p, q), where the numbers of terms in p and q are 2388 and 1977.

Remark. Algorithm (3.1) is a " b o t t o m - u p " triangular procedure. It has been observed that "top-down" triangular procedures ([1], [12], [10]) are much faster. However, topdown versions are not complete, i.e., triangular forms obtained by such kinds of procedures generally do not satisfy (3.3). It is a good strategy to incorporate a top-down triangular procedure into Algorithm (3.1). This can reduce the number of iterations in (3.1) and polynomial sizes in many cases. It was first done in [12]. For example, we can produce a triangular form TRi for Si by a top down procedure, then set Si to be Si U TRi and take a w-basic set B~ of Si, and so on. However, this approach should be combined with w-asc chain and W - p r e m , otherwise the size control generally cannot be insured. Example (3.4) is such an example, for which this approach does not help much without using W - p r e m .

4. A Modification of Ritt-Wu's Decomposition Algorithm T h e o r e m ( 4 . 1 ) . Ritt-Wu's Zero Decomposition Algorithm (the Refined Form). Let S and G be two non-empty polynomial sets. There is an algorithm either to detect the emptiness of Zero(S/G) or to decompose Zero(S/G) in the following form: (4.1.1)

Zero(S/G)=

U

Zero(ASCi/I~uG)

l
(4.1.2)

Zero(S/G)=

U

Zero(PD(ASCi)/G)

l
where each ASCi is an irreducible w-asc chain, 1 the Ii is the initial set of the ASC~, andprem(g;ASC~) ~ 0 for a U g E G and i = 1,...,k.

Proof. Let A S C s be a set of w-asc chains, initialized to be e m p t y at the beginning. Step 1. According to (3.1) we can construct a w-asc chain having the property of either (3.2) or (3.3). In the case of (3.2), Zero(S/G) is empty. In the case of (3.3), we have a w-asc chain A S C and a polynomial set S' (i.e., S, in the proof of (3.1)) having A S C as one of its w-basic sets. Zero(S) = Zero(S'). Step 2. Check whether the w-asc chain A S C = fl, ..., f~ is reducible. If it is, then there is an integer k > 0 such that f l , ..., fk- 1 is irreducible, but f l , ..., fk is reducible. By (9.4) in [4], we can find two polynomials g and h with class(fk) = class(g) = class(h) and gh E Ideal(f1, ..., f , ). We have a decomposition: Zero(S') = Zero(S'U {g}) U Zero(S'U {h}). Obviously, S' U {g} and S' U {h} have w-basic sets strictly lower than that of S'. We can take each of S' U {g} and S' U {h} as a new S, and go to step 1. Step 3. Let A S C = fl,...,f~ and I = {tc(fl),...,lc(f,)}. (4.1.3)

Zero(S/G) = Zero(S'/G) = Z e r o ( A S C / I

By (3.3.2) we have:

1.3G ) U

Ope,{Zero(S' U {p}/G)}.

For the definition and properties of irreducible ascending chains see [3].

213

Step 4. If p r e m ( g ; A S C ) = 0 for some g E G, then Z e r o ( A S C / I U G) is empty. Otherwise, we add this w-asc chain A S C to A S C s . Step 5. For each p in I , let p' = prem(p;ASC); since W - p r e m ( p ; A S C ) ¢ O, p' ¢ 0 by (2.7). For each Zero(S' U {p}/G) = Zero(S' U {p,p'}/G) in (4.1.3), take S' U {p,p'} as a new S, then go to step 1. R e p e a t this process recursively. Since S' U {p,p'} has a w-basic set strictly lower t h a n t h a t of S' by (2.8), this recursive process will finally terminate. For otherwise, we would have a strictly decreasing sequence of w-asc chains, contradicting (2.3). T h e t e r m i n a t i o n of each branch happens when I consists of constant polynomials. U p o n termination, we have two cases: (i) A S C s is empty. This means t h a t S does not have c o m m o n zeros. (ii) A S C s = {ASC1 ..... ASC~ } (1 < k), then we have the decomposition (4.1.1). Since Zero(ASC~/Ii) C Zero(PD(ASC~)) C Zero(S), (4.1.2) follows from (4.1.1). | T h e o r e m ( 4 . 2 ) . R i t t - W u ' s Zero Decomposition Algorithm (the Coarse Form). The same s t a t e m e n t as in (4.1), except we do not require t h a t each w-asc ASCi be irreducible.

Proof. T h e only thing needed to change in Algorithm (4.1) is to drop step 2 in the proof of (4.1).

|

T h e reader who is not interested in the details of the further i m p r o v e m e n t s of the above algorithms can skip the rest of this section.

Remark 1. Since multivariate factorization is available in m a n y algebraic systems, we suggest to keep step 2 and check the reducibility of p r e m ( f k ; f l , ..., f~_ 1)- Using factorization of multivariate polynomials over the integers is actually a good strategy to reduce polynomial sizes. I f we want to obtain the refined form, we can p u t off factorization over extension fields to the last step when we have the coarse form. This turns out to be very effective to obtain the refined form. A m o n g the 8 examples in [6], there are very few involving factorization over extensions after we get the coarse form, and only one w-asc chain is actually reducible over extension fields. Remark 2. T h e branches produced in the recursive step 5 can be as m a n y as thousands and most of t h e m are redundant. If G is not empty, we have the following two techniques (1) and (2) to control branching. (1) If some d E G is reduced to zero by S' (the set produced in Step 1) using some other reductions (e.g., the reduction used in the G r b b n e r basis m e t h o d ) , then Z e r o ( S / G ) is empty. This is one of the m o s t effective techniques to control branching in the algorithm, especially such situations h a p p e n at early stages. (2) Let A S C -- fl, ...,f~. If prem(d, A S C ) = 0 for some d C G, Z e r o ( P D ( A S C ) / G ) is empty. More i m p o r t a n t , we do not have to add initials of those f~ which are not used in computing prem(d, A S C ) to S'. (3) We still can use the above techniques (1) and (2) even G is empty. We only need to

214

write (3.3.2) (3.3.2')

(or

(3.3.1)) in a different form:

Zero(S) = Zero(PD(ASC)) ~.J Ul
Zero(S/G) = (J

Zero(PD(ASCi)/G U D,).

1
Zero(S)=

U

Zero(PD(ASC,))

l<_i<_k which is a decomposition of algebraic set Zero(S) into the union of the irreducible varieties Zero(PD(ASC~)). Here each PD(ASC~) is a prime ideal. Or alternatively, (4.3.2)

Radical(S)=

(-~ PD(ASC,). 1
T h e decompositions in (4.1)-(4.3) are generally redundant, i.e., some Zero((PD(ASCi)) m a y be contained in others. T h e following theorem, the p r o o f of which is rather long, removes some redundancy without any cost. T h e o r e m ( 4 . 4 ) . Let n = length(S) be the n u m b e r of polynomials in S. Suppose that the emptiness of Zero(S) is not detected in algorithm (4.1) or (4.3) and the set unions in (4.1.1) and (4.1.2) (either in the refined form or in the coarse form) are arranged in such a way t h a t length(ASC~) < n for i < l, and length(ASCi) > n for i > I for some integer 0 < I < k, then 0 < I, and we have the decomposition (4.4.1)

Zero(S/G)=

U

Zero(PD(ASCI)/G).

Proof. If it is the refined form (4.1), then the theorem is a consequence of the Affine Dimension T h e o r e m [8]. In general case, see [4]. I

2t5

Remark. Notice also t h a t the formula: Zero(S/G)=

U

Zero(ASCi/I~UG)

l_
is generally not true even for the refined form. Zero(PD(ASC,)) instead of Zero(ASC,/I~).

This is the key advantage to use

T h e o r e m ( 4 . 5 ) . T h e r e is an algorithm to remove the redundancy in the decomposition (4.3.1) completely, thus providing an irredundant decomposition of an algebraic set.

Proof. Let A S C = fl,..., f, be an irreducible asc chain. Let GBz be a GrSbner basis of { f l , . . . , f , , z . I c ( f l ) . ' . I c ( f , ) - 1} in a compatible ordering with y~'...y~m < z. T h e n GB, n K[y] is a Gr6bner basis of the p r i m e ideal P D ( A S C ) (for the p r o o f of this s t a t e m e n t , see p.85 of [3]). Once we have a Gr6bner basis of each PD(ASC~) in (4.4.1), we can get the i f r e d u n d a n t decomposition easily. See [6] for examples using this theorem. |

5. A M e t h o d for Formulation F2 Let E be the field associated with a given geometry. Suppose the hypothesis of a g e o m e t r y s t a t e m e n t can be algebraically expressed by a set of polynomial equations { h l ( y l , ..., ym ) = 0, ...,h, (Yl, ..., Y,~ ) = 0} together with a set of polynomial inequations {sl(Yl, ..., y,, ) ~ O, ..., sq(yl, ..., Ym ) ~ 0} expressing the non-degenerate conditions and the conclusion by a polynomial equation g(Yl, ..., Y,~ ) = O. T h e n the equivalent algebraic form of the g e o m e t r y s t a t e m e n t is (5.1)

Vyl"''ym E E[(hl--- 0A'..Ahn

= 0 A 8 1 # O A . . . A s q -~ 0) ::~g = 0].

Let S = {hl, ..., h , } and G = {sl, ..., sq }, then the above formula is equivalent to (5.2)

Zero(S/G) C Zero(g).

M e t h o d ( 5 . 3 ) . This m e t h o d is to confirm (5.1), or in the case when E is algebraically closed, to decide whether (5.1) is valid. Using Algorithms (4.1) or (4.2), and T h e o r e m (4.4) to decompose Zero(S/G) into

ZeTo(S/G)= U Zero(PD(aSC,)/C). l
216

I n case 2 a n d w h e n f o r m u l a (5.1) is d i s p r o v e d , we d o n ' t h a v e a n y i n f o r m a t i o n a b o u t t h e r e a s o n why (5.1) is false: it is false b e c a u s e t h e g e o m e t r y s t a t e m e n t is generally false or b e c a u s e s o m e n o n d e g e n e r a t e c o n d i t i o n s a r e m i s s i n g . T h i s is w h y t h e a u t h o r s a r e in favor of F o r m u l a t i o n F 1 in S e c t i o n 1 to i n t r o d u c e t h e n o t i o n "generally (generically) true", w h i c h is i n h e r e n t t o a given g e o m e t r y s t a t e m e n t r e g a r d l e s s o f h o w m u c h n o n d e g e n e r a t e conditions are added. Theorem ( 5 . 4 ) . L e t t h e n o t a t i o n s b e t h e s a m e as in S e c t i o n 4 a n d g b e arty p o l y n o m i a l . S u p p o s e we h a v e d e c o m p o s i t i o n (4.4.1) (in t h e c o a r s e or refined f o r m ) . I f p r e m ( g ; A S C ~ ) = 0 for all i = 1, ...,t, t h e n Z ( S / G ) C Zero(g).

Proof. Since prem(g; A S C i ) = O, g E P D ( A S C , ) . H e n c e Z e r o ( P D ( A S C ~ ) ) C Zero(g) for all i. B y (4.4.1), Z e r o ( S / G ) C Zero(g). I T h e o r e m ( 5 . 5 ) . L e t t h e n o t a t i o n s b e t h e s a m e as in S e c t i o n 4 a n d g b e a n y p o l y n o m i a l . S u p p o s e we h a v e d e c o m p o s i t i o n (4.4.1) in t h e refined f o r m (i.e., all A S C i are i r r e d u c i b l e ) a n d all zeros a r e t a k e n f r o m a n algebraically closed e x t e n s i o n E of K . T h e n (i) E a c h Z e r o ( P D ( A S C ~ ) / G ) is n o n - e m p t y . (ii) Z e r o ( S / G ) C Z e r o ( g ) i f a n d only i f p r e m ( g ; A S C I ) -- 0 for all i = 1, ...,t.

Proof. See T h e o r e m s (4.8) a n d (9.3) in [4].

6. E x a m p l e s E x a m p l e ( 6 . 1 ) ( P a s c a l ' s T h e o r e m ) . L e t A, B , C , D , F a n d E b e six p o i n t s o n a circle ( O ) . L e t P = A B N D F , Q = B C f-I F E a n d S = C D N E A. Show t h a t P , Q a n d S a r e c o l l i n e a r ( F i g u r e 1). T h e obvious n o n - d e g e n e r a t e c o n d i t i o n s in this p r o b l e m s e e m to b e " t h e t h r e e p a i r s of lines, A B a n d D F , B C a n d F E , a n d C D a n d E A , h a v e n o r m a l i n t e r s e c t i o n s " . L e t B -- ( u l , 0 ) , A = ( 0 , 0 ) , C = (u2, u3), O = (x2, x l ) , D -- (x3, u4), F = (x4, ub), E = (x5, u6), P = ( x 6 , 0 ) , Q = (x8, x7), a n d S = ( x l o , x9). T h e n t h e p r o b l e m c a n b e specified as foUows:

OA ~ OC. OA =_ OB. OA =_ OD. h3=x~--2x2x3--2u4xl+u~ = 0 OA ~ OF. h4 = x~--2x2x4--2ubxl +u~ =0 OA =~ OE. h5 = x ~ - 2 z 2 z ~ - 2 u 6 z t +u~= o P, D and F are collinear. h6=(us--u4)x6 + u4z4--ubx3=O Q, F and E are collinear. hT= (u6--ub)x~-- (x5 --x4)x7 + u~x~ --u~x4 = 0 Q, B and C are collinear. hs=uaxs--(u2--ul)xT--ulu3=O S, E and A are collinear. h9 = U 6 x l O - - X b X 9 ~-- 0 S, C and D are collinear. hlo = (u4 - - u 3 ) X l o - ( X 3 - u 2 ) x o + u 3 x 3 - u 2 u 4 = 0 Lines AE and CD have a normal intersection. sl =(u4--u3)xb--u6x3+u2u640 Lines BC and EF have a normal intersection. s2 = ~3x~ - ~ 3 x ~ - ( u 2 - ~ 1 ) u 8 + (u2 - ~ l ) u ~ : / o Lines AB and D F have a normal intersection. 83 = UlU 5 -- UlU 4 ~ 0 Conclusion: S, Q and P are collinear. g = xTxlo--(xs-z6)xo-z~z7 = 0 hi = 2~z~ +~u3xl - u ~ - u ~ h2 : 2UlX 2 - - u ~ : 0

= 0

217

Zero(S/G) = Zero(PD(ASC1)/G) (in 6.9s 2), where A S C 1 : p r e m ( g ; A S C 1 ) : 0 (in 0.4s), the t h e o r e m has been confirmed.

"'""" s

/ .'P

Q

Char-Set(S).

Since

C

J o B

A

A Figure 1

B Figure 2

E x a m p l e ( 6 . 2 ) (Morley's Trisector T h e o r e m . ) T h e points of intersection D, E and F o f the a d j a c e n t trisectors of the angles of any triangle A B C are the vertices of an equilateral triangle (Figure 2). Let B = (Yl,0), A = (0,0), D = (Y2, Y3), C = (Y5, Y4), F = (Y8, YT), a n d E = (YlO,Yg). T h e n t h e p r o b l e m can be specified as follows: t,1 = (~] + ( - 3 ~ I + 6y1~ - 3y~)ya)y~ + ( ( - 3 y ~ + 3~1)y] + y~ - 3~,y~ + 3~y~ - ~)~, --YlY] + (3ylYl -- 6~y2 + 3y~)y3 = 0 tan(f.CBA) -- tan(3/_DBA) = 0. h2 = (y] -- 3y~Y3)ys + (--3y2y~ + Y~)Y4 = 0 tan( / CAB) -- tan(3/ DAB) = O.

ha -- y~ -- 3 = 0

tan(:[:~r/3) = q-V/3.

2 2 ((YlYaY~+(Ya+Y2 h4 = (((ya+y2--YlY2)Ys--YlYaY4)Y6+YlYaYs+(Y~+Y~--YlY2)Y4)Ys+ 2 2 --YlY2)Y4)Y~ _

hs = (YlY3Y~ -- YlY2Yt)Ys + (YlY2Y~ + YlYayt)y7 = 0 h~ = ((2~y~ - y ~ ) ~

~)~

+~ - ~ ~ = (,w~

+~ + (-~,~

+ (-~

+ ~,~ + ~)~

tan(/ B A D + / D B A + / A C F ) = ±V/3. tan(DAB) = tan( CAF).

- ~,~ - ~)~o + ((-~

- ~,~I)~ + ( - ~ , ~ - ~ ) ~ + ( ~ - ~ + ~)~, - ~)~o

+~

+ ( ( ~ , ~ - ~ ) ~ + ~,~a~, - ~

+ ~

+ ~)~ + ( - ~

+

- ~)~ +~ +~ =o tan(ACF) = tan(ECB). + ~)~ - ~a~

+ (~

-

Y~)Y4 + Y~Ya = 0

tan(ABD) = tan(EBC). Sl = YlYt ~ 0 A, B, C are not collinear. s2 = y~ ~ 0 Line A B is non-isotropic. sa = (y~ _ ya)~ + y2 ¢ 0 Line B e is non-isotropic. s4 = y~ + y~ 4 0 Line A C is non-isotropic. g = (Y6YS--YT--Y2Y6+Ya)YlO+(Ys+Y6YT--Y3Y6--Y2)Yg+(--Y~Y6--Y3)Ys+(--Y3Y6+Y2)YT+(Y~+Y~)Y6= 0 Conclusion: tan(/ EDF) = 4-~f3.

Zero(S/G) Zero(PD(dSCl)/a) (in 756.7s), ,,'here A S C 1 = C h a r - S e t ( S ) (i.e., B 2 in E x a m p l e (3.4)). Since p r e m ( g ; A S C 1 ) -- 0 (in 6.4s), the t h e o r e m has been confirmed. =

2 M e a n i n g t h a t it t o o k 6.9 seconds to c o m p l e t e the c o m p u t a t i o n on a Symbolics 3600.

218

There are 18 triangles D E F thus formed. The proof by our prover applies to all 18 equilateral triangles. The idea of the above specification of the equation part comes from W u ' s work [17]. The specification of the non-degenerate conditions is due to us. An isotropic line is a line perpendicular to itself. It does not exist in Euclidean geometry. Thus we have proved Morley's theorem under the only non-degenerate condition that A, B, and C are not collinear. For more examples See [4].

7. Experimental Results Vv'e have implemented Method (5.3) in our prover [2]. More t h a n 500 theorems have been proved in this way. In particular, we have experimented with the same set of the 512 theorems in [3] (using the same coordinates and equations). For 413 of the 512 theorems, the prover can generate non-degenerate conditions all in geometric form by the method in [2]. For most of those 413 theorems, we use such machine generated non-degenerate conditions in geometric form as the inputs to our new method. We paid particular attention to a few problems among these 413 theorems, specifying nondegenerate conditions manually. For example, we proved Feuerbach's theorem under the only non-degenerate that "the vertices of the triangle are not collinear." For the remaining 91 theorems, some non-degenerate conditions in polynomial inequations were generated by our previous method. First we simply deleted these algebraic inequations, using the rest machine generated non-degenerate conditions in geometric form as inputs. A b o u t half of these 91 theorems were confirmed this way. We have to pay more attention to the remaining half, adding more non-degenerate conditions in geometric form manually. In this way, we have proved 493 of the 512 theorems. We had trouble with the remaining 19 theorems within the time or space limit of the computer. A m o n g the 493 theorems proved, 471 were proved within 300 seconds; 12 within one hour. The following table gives time statistics of 30 theorems for various methods. Wu(F1) is the method we mainly use for Formulation F1. The sign * means that some nondegenerate conditions are still in algebraic form. The sign ? means that it took more t h a n 4 hours without results. Wu(F2) is the m e t h o d in this paper; 0.4 + 0.3 means t h a t it took 0.4 sec to decompose and 0.3 sec to check prem(g; ASCI) -- 0. GB(F1) is our GrSbner basis m e t h o d for Formulation F1 [7]. Strictly speaking, non-degenerate conditions produced by this m e t h o d is in algebraic form. However, by a theorem due to us, if GB(F1) confirms a theorem in a class of constructive geometry statements, then it is valid under geometric non-degenerate conditions produced by the m e t h o d in [5]. GB(F2) is our GrSbner basis m e t h o d for Formulation F2 [7], [3].

8. Related Work T h o u g h people knew at the very beginning that Wu's m e t h o d could prove theorems with Formulation F2, no a t t e m p t was ever made at that time, because people (including the first author) thought it tended to be much slower than the m e t h o d based on Formulation F1. Wu, Chou, Gao and others proved hundreds of theorems based on Formulation F1.

219

Ex. No. Theorem Sources Wu(F1) Ex[1] Parallelogram Section 2 [7] 0.1 Ex[2] Theorem of Centroid Exl, [7] 0.35 Ex[3] Theorem on Altitudes Ex133, [3] 0.83 Ex[4] Ceva's Theorem Ex334, [3] 0.81 Ex[5] Simson's Theorem Ex2, [7] 1.2 Ex[6] Brahmagupta Section 4 [7] t.1 Ex[7] eappus' Theorem Ex6, [7] 1.3 Ex[8] Pappus Dual Exl7, [3] 1.7 Ex[9] Butterfly Theorem Ex5, [7] 1.5 Ex[10] Simson Dual Ex21, [3] 4.8 Ex[ll] Four Simson Lines Ex311, [3] 3.2 Ex[12] Ogitvy's Theorem Ex65, [3] 238.5 Ex[13] Secant Theorem Ex390, [3] 3.3 Ex[14] Pascal's Theorem This paper 3.9 Ex[15] Brianchon's Theorem Ex19, [3] 9.6 Ex[16] Pappus Point Ex7, [7] 5.6 Ex[17] Isosceles Midpoint Ex8, [7] 2.6 Ex[18] Gauss' Theorem Ex9, [7] 1.5 Ex[19] Gauss Point Exl0, [7] 3.7 Ex[20] Gauss Conic Exl7, [3] 1511.3 Ex[21] Feuerbach's Theorem Ex204,[3] 2.8 Ex[22] Miquel Point Ex308, [3] 40.2 Ex[23] Miquel Circle Ex309, [3] 412.3 Ex[24] Steiner's Theorem Exl3, [3] 10.2 Ex[25] Kirman's Theorem Exl4, [3] 8.2 Ex[26] Pascal Conic 1 Ex9, [3] 11.8 Ex[27] Pascal Conic 4 Exl2, [3] 210.3 Ex[28] Morley's Theorem This paper 20.2 * Ex[29] V. Pratt's Theorem Ex80, [3] 275.3 Ex[30] Coxeter's Theorem Ex40, [3] 218.2 *

Wu(F2) GB(F1) 0.23 + 0.02 0.45 0.33 + 0.02 0.83 0.5 + 0.1 2.5 0.4 + 0.3 1.1 0.6 + 0.1 1.6 5.1 + 0.1 2.4 2.5 + 0.2 6.4 0.8 + 0.3 15.8 6.1 + 0.1 24.5 20.9 + 1.2 ? 4.9 + 1.3 ~ 20.6 + 195.6 ? 0.7 + 2.1 11,975.2 8.9 + 0.3 1401.5 5.0 + 5.3 ? 8.8 + 1.9 54.6 3.7 + 0.1 1.5 0.15 + 0.05 1.3 5.7 + 0.6 18.8 101.3 + 1502.1 5,225.4 27.3 + 1.0 28.2 4.3 + 38.1 90.3 1.9 + 555.2 137.7 8.6 + 4.2 ? 6.7 + 6.0 ? 2.8 + 11.2 71.6 8.6 + 184.2 ? 756.7 + 6.4 308.1 * ? ~ ? ?

GB(F2) 0.71 0.38 75.7 48.3 144.1 1.48 44.6 293.9 ? ? ? ? 2950.4 ? ? 3.3 0.35 95.1 ? 197.9 ? ? ? ? ? ? ? ?

T h e first a u t h o r e x p e r i m e n t e d w i t h F o r m u l a t i o n F 2 d u r i n g 1 9 8 4 - 1 9 8 5 u s i n g t h e G r S b n e r b a s i c ( G B ) m e t h o d . He w a s a b l e to p r o v e a b o u t 10 t h e o r e m s a n d f o u n d it v e r y slow [7]. The hardest one proved by him was perhaps Simson's theorem. D. K a p u t , o n t h e o t h e r h a n d , was s u c c e s s f u l i n p r o v i n g m o r e a n d h a r d e r t h e o r e m s u s i n g t h e G B m e t h o d b a s e d o n a r e f u t a t i o n a l a p p r o a c h a c c o r d i n g t o F o r m u l a t i o n F 2 [9]. H. P. K o [13] was t h e first to u s e R i t t - W u ' s m e t h o d to p r o v e g e o m e t r y t h e o r e m s a c c o r d i n g t o F o r m u l a t i o n F 2 . O u r w o r k is i n t h e s a m e d i r e c t i o n as K o ' s w o r k a n d h a s s i m i l a r ities a n d differences w i t h h e r w o r k [13]. O u r m e t h o d is f a s t e r t h a n hers. E s p e c i a l l y , o u r T h e o r e m (4.4) m a k e s t h e p r o o f p r o c e d u r e f a s t e r a n d c l e a r e r . F o r e x a m p l e , i n E x a m p l e (6.1), K o p r o d u c e d f o u r c o m p o n e n t s w i t h a s c e n d i n g c h a i n s T1, T2, T3, a n d T4. Acc o r d i n g to T h e o r e m (4.4), Zero(T~/I~ U G) C Zero(PD(T1)/G) (for i = 2 , 3 , 4 ; here t h e I~ a r e t h e i n i t i a l sets o f t h e a s c e n d i n g c h a i n s T~) a n d Zero(S/G) = Zero(PD(T1)/G). So we o n l y n e e d to check w h e t h e r prem(g; T1) = 0; or i n t e r m s o f F o r m u l a t i o n F 1 , to check w h e t h e r g v a n i s h e s o n t h e g e n e r a l c o m p o n e n t s ( g e n e r a l l y t r u e ) . A f t e r t h i s p a p e r w a s s u b m i t t e d , we l e a r n e d t h a t D. K a p u r a n d H. K. W a n also u s e d t h e c h a r a c t e r i s t i c set m e t h o d to p r o v e g e o m e t r y t h e o r e m s a c c o r d i n g to F o r m u l a t i o n F 2 u s i n g a r e f u t a t i o n a l a p p r o a c h [15], [11].

220

The authors wish to thank D. Kapur for his suggestion and comments. References

[1] [2]

[3] [4]

[5]

[6] [7] [8] [9] [10] [11] [12] [13]

[14] [15] [16] [17]

[18]

S.C. Chou, "Proving Elementary Geometry Theorems Using Wu's Algorithm", in Automated Theorem Proving: After 25 years, Ed. By W.W. Bledsoe and D. Loveland, AMS Contemporary Mathematics Series 29 (1984), 243-286. S.C. Chou, "Proving and Discovering Theorems in Elementary Geometries Using Wu's Method", PhD Thesis, Department of Mathematics, University of Texas, Austin (1985). S.C. Chou, Mechanical Geometry Theorem Proving, D. Reidel Publishing Company, Dordrecht, Netherlands, 1988. S.C. Chou and X. S. Gao, "Ritt-Wu's Decomposition Algorithm and Geometry Theorem Proving", Technical Report 89-09, Department of Computer Sciences, University of Texas at Austin, 1989. S.C. Chou and X.S. Gao, "A Class of Geometry Statements of Constructive Type and Geometry Theorem Proving", TR-89-37, Computer Sciences Department, The University of Texas at Austin, November, 1989. S.C. Chou and X.S. Gao, "Techniques for Ritt-~Vu's Decomposition Algorithm", TR-90-2, Computer Sciences Department, The University of Texas at Austin, February, 1990. S.C. Chou and W.F. Schelter, "Proving Geometry Theorems with Rewrite Rules", Journal of Automated Reasoning, 2(4) (1986), 253-273. R. Hartshorne, Algebraic Geometry, Springer-Verlag, 1978. D. Kapur, "Geometry Theorem Proving Using Hilbert's Nullstellensatz", in Proceedings of the 1986 Symposium on Symbolic and Algebraic Computation, 202208. D. Kaput and J. Mundy, "Wu's Method and its Application to Perspective Viewing", Artificial Intelligence Journal, V. 37 (1988), pp.15-36. D. Kapur and Hoi K. Wan, "Refutational Proofs of Geometry Theorems via Characteristic Sets", to appear in ISSA C'90. H.P. Ko and S.C. Chou, "Polynomial Triangulation for Pseudo Common Divisors", Technical Report, 85CRD242, General Electric Company, 1985. H.P. Ko, "Geometry Theorem Proving by Decomposition of Quasi-Algebraic Sets: An Application of the Ritt-Wu Principle", Artificial Intelligence, Vol. 37, pp95122 (1988). J . F . Ritt, Differential Algebra, AMS Colloquium Publications, New York, 1950. Hoi Wan, "On proving Geometry Theorems via Characteristic Set Computation", MS Project Report, Department of Computer Science, RPI, Troy, Dec., 1987. Wu Wen-tsfin, "On the Decision Problem and the Mechanization of Theorem Proving in Elementary Geometry", Scientia Sinica 21 (1978), 157-179. Wu Wen-tsiin, "Basic Principles of Mechanical Theorem Proving in Geometries'~ J. of Sys. Sci. and Math. Sci. 4(3), 1984, 207-235, republished in Journal of Automated Reasoning 2(4) (1986), 221-252. Wu Wen-ts[m, "On Zeros of Algebraic Equations -An Application of Ritt's Principle", Kexue Tongbao 31(1) (1986), 1-5.

E n c o d i n g a D e p e n d e n t - T y p e A-Calculus in a Logic P r o g r a m m i n g Language Amy Felty INRIA Sophia-Antipolis 2004, R o u t e des Lucioles 06565 V a l b o n n e C e d e x , F r a n c e

Dale Miller C o m p u t e r a n d I n f o r m a t i o n Science U n i v e r s i t y of P e n n s y l v a n i a P h i l a d e l p h i a , P A 19104-6389 USA

Abstract Various forms of typed A-calculi have been proposed as specification languages for representing wide varieties of object logics. The logical f r a m e w o r k , LF, is an example of such a dependent-type A-calculus. A small subset of intuitionistic logic with quantification over simply typed A-calculus has also been proposed as a framework for specifying general logics. The logic of heredilary Harrop formulas with quantification at all non-predicate types, denoted here as h h ~, is such a meta-logic that has been implemented in both the Isabelle theorem prover and the AProlog logic programming language. Both frameworks provide for specifications of logics in which details involved with free and bound variable occurrences, substitutions, eigenvariables, and the scope of assumptions within object logics are handled correctly and elegantly at the "meta" level. In this paper, we show how LF can be encoded into hh ~ in a direct and natural way by mapping the typing judgments in LF into propositions in the logic of hh ~. This translation establishes a very strong connection between these two languages: the order of quantification in an LF signature is exactly the order of a set of hh ~ clauses, and the proofs in one system correspond directly to proofs in the other system. Relating these two languages makes it possible to provide implementations of proof checkers and theorem provers for logics specified in LF by using standard logic programming techniques which can be used to implement h h ~°.

1

Introduction

The design and construction of computer systems that can be used to specify and implement large collections of logics has been the goal of several different research projects. In this paper we shall focus on two approaches to designing such systems. One approach is based on the use of dependent-type A-calculi as a meta-language while another approach is based on the use of a very simple intuitionistic logic as a meta-language. The Logical Framework (LF) [HHP87] and the Calculus of Constructions (CC) [CH88] are two examples of dependent-type calculi that have been proposed as recta-logics. The Isabelle

222

theorem prover [Pau89] and the AProlog logic programming language [NM88] provide implementations of a common subset of intuitionistic logic, called h h W here, that can be used to specify a wide range of logics. Both Isabelle and AProlog can turn specifications of logics into proof checkers and theorem provers by making use of the unification of simply typed A-terms and goal-directed, tactic-style search. In this paper, we shall show that these two meta-languages are essentially of the same expressive power. This is done by showing how to translate LF specifications and judgments into a collection of hh ~ formulas such that correct typing in LF corresponds to intuitionistic provability in h h ~. Besides answering the theoretical question about the precise relationship between these meta-languages, this translation also describes how LF specifications of an object logic can be implemented using unification and goal-directed search since these techniques provide implementations of h h °~. In Section 2 we present the meta-logic hh ~ and in Section 3 we present LF. Section 4 presents a translation of LF into h h ~ and Section 5 contains a proof of its correctness. Section 6 provides examples of this translation and Section 7 concludes.

2

The

Meta-Logic

Let S be a fixed, finite set of p r i m i t i v e types (also called sorts). We assume that the symbol o is always a member of S. Following Church [Chu40], o is the type for propositions. The set of types is the smallest set of expressions that contains the primitive types and is closed under the construction of function types, denoted by the binary, infix symbol --+. The Greek letters r and ~r are used as syntactic variables ranging over types. The type constructor --* associates to the right. If 7"0 is a primitive type then the type rl --* ... --* ~-,, ~ 7"o has ri,...,7",~ as argument types and ro as target type. The order of a primitive type is 0 while the order or a non-primitive type is one greater than the maximum order of its argument types. For each type r, we assume that there are denumerably many constants and variables of that type. Constants and variables do not overlap and if two constants (or variables) have different types, they are different constants (or variables). A signature is a finite set ~ of constants and variables whose types are such that their argument types do not contain o. A constant with target type o is a predicate constan$. We often enumerate signatures by listing their members as pairs, written a: 7-, where a is a constant of type 7". Although attaching a type in this way is redundant, it makes reading signatures easier. Simply typed A-terms are built in the usual way. The logical constants are given the following types: A (conjunction) and D (implication) are both of type o --* o --* o; T (true) is of type o; and Vr (universal quantification) is of type ( r -* o) --~ o, for all types r not containing o. A formula is a term of type o. The logical constants A and D are written in the familiar infix form. T h e expression Vr(Az t) is written simply as Vrz t. If x and t are terms of the same type then It~x] denotes the operation of substituting t for all free occurrences of x, systematically changing bound variables in order to avoid variable capture. The expression [ t l / x l , . . . , t n / x , ~ ] will denote the simultaneous substitution of the terms tl, .. • ,tn for the variables x l , . . . , xn, respectively.

223

We shall assume t h a t the reader is familiar with the usual notions and properties of ~,/3, and 7/conversion for the simply typed A-calculus. The relation of convertibility up to ~ and t3 is written as =~, and if y is added, is written as = ~ . We say t h a t a A-term is in/3-normal form if it contains no b e t a redexes, t h a t is, subformulas of the form (Ax t)s. A A-term is in/3y-long form if it is of the form

Axl... Ax,(htl...tm)

(n, m > 0)

where h, called the head of the term, is either a constant or a variable, where the expression htl . . . t m is of primitive type, and where each t e r m t l , . . . , t m a r e also in/37long form. All A-terms/3r/-convert to a term in 13y-long form, unique up to s-conversion. See [HS86] for a fuller discussion of these basic properties of the simply typed A-calculus. Let 5] be a signature. A t e r m is a 5j-term if all of its free variables and nonlogical constants are m e m b e r s of E. Similarly, a formula is a 5j-formula if all of its free variables and nonlogical constants are members of E. A formula is either atomic or non-atomic. An atomic 5j-formula is of the form (Ptl ...tn), where n > 0, P is given type 7"1 ~ . . . --+ 7". --* o by 53, and tl, . . . , t , are terms of the types 7"1, .. -, 7"n, respectively. The predicate constant P is the head of this atomic formula. Non-atomic formulas are of the f o r m T , B 1 A B2, B1 D B2, or Vrz B, where B, B1, and B2 are formulas and 7" is a type not containing o. T h e logic we have just presented is very closely related to two logic p r o g r a m m i n g extensions t h a t have been studied elsewhere [MNPS]. First-order hereditary Harrop formulas (fohh) have been studied as an extension to first-order Horn clauses as a basis for logic programming. Similarly higher-order hereditary Harrop formulas (hohh) are a generalization of fohh t h a t permits some forms of predicate quantification. Because our meta-language is neither higher-order, since it lacks predicate quantification, nor firstorder, since it contains quantification at all function types, we shall simply call it hh ~. The set of hh ~ formulas in which quantification only up to order n is used will be labeled as hh". Provability for hh ~ can be given in terms of sequent calculus proofs. A sequent is a triple 5] ; 79 ~ B, where 5] is a signature, B is a 5j-formula, and 79 is a finite (possibly e m p t y ) sets of 53-formulas. T h e set 79 is this sequent's antecedent and B is its succedent. The expression B,79 denotes the set 79 U {B}; this notation is used even if B E 79. T h e inference rules for sequents are presented in Figure 1. T h e following provisos are also attached to the two inference rules for quantifier introduction: in V-R the constant c is not in E, and in V-L t is a 53-term of type 7".

A proof of the sequent 53 ; 79 .....*. B is a finite tree constructed using these inference rules such t h a t the root is labeled with E ; 79 ~ B and the leaves are labeled with initial sequents, t h a t is, sequents EE~ ; 79t ~ B ~ such that either B ~ is T or B ~ E 79q T h e non-terminals in such a tree are instances of the inference figures in Figure 1. Since we do not have an inference figure for /3r/-conversion, we shall assume that in building a proof, two formulas are equal if they are/3y-convertible. If the sequent 5] ; 79 ~ B has a sequent proof then we write 5]; 79 Ft B and say that B is provable from 53 and 79. We shall need only one proof-theoretic result concerning the meta-logic hh ~. To s t a t e it, we require the following definition.

224

E;

B,C,P

---~ C

E; BAC,'P E ; T~

--~

"* B

E;VTxB,P

C

'

-~ B

E;'P

---~ C

A-R

E ; T ~ ----+ B A C

E; C,P

E; BDC, E ; [t/xlB,

E;P

A-L

7~

, C

----* A

E; B,T~

D-L

E;P

~ A

E; P

D-R

BDC

[c/x]B

V-L

, C

~

...~. C

V-R

.......... V, x B

Figure 1: Left and right introduction rules for hh ~ D e f i n i t i o n 2.1 Let E be a signature and let P be a finite set of E-formulas. The expression 17~lr~ denotes the smallest set of pairs (G, D) of finite sets of E-formulas G and E-formula D, such that • If D (E P then (0, D) E 17~lr~. • If (G,D, AD2) E IPI~ then (G,D,) E I~'l~ and (G,D2) E I~'l~. • If
B1 A B~ is provable from E and P if and only if both B1 and B2 are provable from E and 7~.

G E N E R I C : V r x B is provable from E and P if and only if [ c / z ] B is provable from E U {c : r} and 7~ for any constant c : v not in E. A U G M E N T : B1 D B2 is provable from E and 7~ if and only if B2 is provable from E and P U {B1 }. B A C K C H A I N : The atomic formula A is provable from E and P if and only if there is a pair (~, A) E [P[~ so that for every G E ~, G is provable from E and ~ . These formal results are closely related to the notion of expanded n o r m a l forvn for natural deduction proofs [Pra71] which was used by Paulson in [Pau89] to establish the correctness of a specification of first-order logic in hh ~°. This theorem will similarly play a central role in proving the correctness of our representation of LF in hh ~.

225

3

The Logical Framework

There are three levels of terms in the LF type theory: objects (often called just terms), types and families of types, and kinds. We assume two given denumerable sets of variables, one for object-level variables and the other for type family-level variables. The syntax of LF is given by the following classes of objects. Type [ I I x : A . K

K

:=

A

:---- x I I I x : A . B I ) ~ x : A . B I A M

M

:=

x[Ax:A.MIMN

r

:=

01r,x:KIr,

x:A

Here M and N range over expressions for objects, A and B over types and families of types, K over kinds, x over variables, and F over contexts. The e m p t y context is denoted by 0. We will use P and Q to range over arbitrary objects, types, type families, or kinds. We write A ---, P for I I x : A . P when x does not occur in type or kind P. We will say that a type or type family of the form xN1 . .. Nn where n > 0 and z is a type family-level variable is a fiat type. Terms t h a t differ only in the names of variables bound by A or II are identified. If x is an object-level variable and N is an object then [N/x] denotes the operation of substituting N for all free occurrences of x, systematically changing bound variables in order to avoid variable capture. T h e expression [ N 1 / x l , . . . , N,,/x,] will denote the simultaneous substitution of the terms N1, . . . , N , for distinct variables x l , . . . , am, respectively. T h e notion of/?-conversion at the level of objects, types, type families, and kinds can be defined in the obvious way using the usual rule for/?-reduction at the level of both objects and type families: (,~z: A . P ) N ---~ [N/x]P where P is either an object or t y p e / t y p e family. The relation of convertibility up t o / 3 is written as =8, just as it is at the meta-level. All well-typed LF terms are strongly normalizing [HHP87]. We write P # to denote the normal form of t e r m P. We present a version of the LF proof system t h a t constructs only terms in canonical form, a notion which corresponds to/?0-long forms in the simply typed )~-calculus. Several definitions from [HHP89] are required to establish this notion. We define the arity of a type or kind to be the number of Hs in the prefix of its normal form. The arity of a variable with respect to a context is the arity of its type in t h a t context. T h e arity of a bound variable occurrence in a t e r m is the arity of the type label attached to its binding occurrence. An occurrence of a variable z in a t e r m is fully applied with respect to a context if it occurs in a s u b t e r m of the form z M 1 . . . Mn, where n is the arity of z. A t e r m P is canonical with respect to a context F if P is in /?-normal form and every variable occurrence in P is fully applied with respect to F. We say t h a t a context F is in canonical form if for every item x : P in F, P is in canonical form with respect to F. Flat types of the form xN1 ... Nn such that x is fully applied will be called base types. The following three kinds of assertions are derivable in the LF type theory. P t - K kind F l- A : K F t- M : A

( K is a kind in F) (A has kind K in P) ( M has type A in F)

226

We write F {- ~ for an a r b i t r a r y assertion, where c~ is called an L F judgment. For the special f o r m F l- A : Type of the second type of assertion, we also say A is a t y p e in F. A context x l : P 1 . . . , x n :Pn is said to be valid if x l , . . . , x , are distinct variables a n d for i -- 1 , . . . , n, Pi is either a t y p e or kind in context xl : P 1 , - . . , xi-1 : P i - i . In deriving one of the above assertions, we always assume t h a t we s t a r t with a valid context F. We sometimes refer to the context in such an assertion as a signature. 1 Generally, a signature is a set of variables paired with types or kinds t h a t specify an object logic and its inference rules. T h e inference rules of LF are given in Figure 2. In (APP-OBJ) B m u s t be a base type,

F I- Type kind

(TYPE-KIND)

F F A : Type

F , x : A ~- K kind F }- IIx : A . K kind (PI-KIND)

F t- A : Type F, x : A F B : Type (PI-FAM) F ~- IIx : A . B : Type FFA:Type F , x : A I- B : K F F Xx:A.B : IIx:A.K (ABS-FAM) Ft-A :Type F , x : A ~- M : B F F Ax : A . M : IIx : A . B (ABS-OBJ) X : [ I x 1 :A1 . . . I I x n :An.Type E F FF- N1 : A1 F F N2 : ([N1/xl]A2) ~

F~-N. : ( [ N l l X I , . . . , N n _ l t x , ~ _ l ] A , ) ~ F I- xN1 . . . N,-, : T y p e x : IIxl:A1...IIx,:A,.B F F N 1 :A1 F F N2: ([N1/xl]A2) ~

(APP-FAM)

E F

F F N,~ : ( [ g i / x l , . . . , N,~-I/Xn-1]A,)/3 F F x g l . . . Nn : ( [ g l / x l , . . . , N n / x n ] B ) ~ (APP-OBJ)

Figure 2: T h e Logical Framework and in (APP-OBJ) and (APP-FAM) n is the arity of z. In (PI-KIND), (PI-FAM), (ABS-FAM), and (ABS-OBJ), we assume t h a t the variable x does not occur i,~ F, and in (APP-FAM) 1Ot~er presentations of LF such as [HHP87] separate the notions of context and signature. We unify them here for simplicity of presentation.

227

and (APP-OBJ) we assume t h a t the variables z i , . . . , zn do not occur free in N i , . . . , Nn. Note t h a t bound variables can always be renamed to meet these restrictions. T h e main difference between this presentation and the usual presentation of the LF p r o o f s y s t e m are the (APP-FAM) and (APP-OBJ) rules. The rules in the form presented here are those needed to preserve the invariant that all objects, types, type families, kinds, and contexts in derivable judgments are in canonical form. To see why, first note t h a t no new fl-redexes are introduced in the conclusion of these rules. T h e application introduced in the left t e r m of the j u d g m e n t in the conclusion is always a variable applied to zero or more terms, while the right t e r m is always ~-normal. Second, note t h a t the signature i t e m z of arity n is applied in the conclusion to n terms and thus this occurrence of z is fully applied. IIence, as long as N i , . . . , N,~ are canonical, so is z N i . . . N,~. In the (APP-OB3) rule, the fact t h a t the type ( [ N 1 / z i , . . . , N n / Z , ~ ] B ) ~ is canonical follows from the fact t h a t for any object, type, type family, or kind P and any object M, if P and M are canonical, then so is ( [ M / z ] P ) ~. Based on these observations, derivable assertions can be characterized more formally as follows: if F is a valid context, then F is canonical, and if r ~- a is derivable with respect to valid context r , then the terms in a are canonical with respect to r , and a has one of the following forms. 1. I I x i : Ai . . . IIzn :An.Type kind where n ~ 0. 2. ()~:ci : A i . . . )~Cn : A n . I I z i : B1 . . . IIzm : B I n . C ) : ( I I z i : A i . . . IIZn :An.Type) where n, m _> 0 and C is a base type.

3. ()~zi : A i . . . A z n : A n . N ) : ( I I z i : A i . . . I I z n abstraction, and B is a base type.

: A n . B ) where n > 0, N is not an

Note t h a t proving an assertion of the form given by (2) or (3), respectively, in valid context r , is equivalent to proving F, zi :A1, . . . , zn : An F IIzi : B i • .. IIzm : B m . C : Type or r , z i : Ai, . . . , z,, :An ~- N : B, respectively, in valid context r , zi : A1, . . . , Zn : A n . In the first version of the translation given in the next section, we will assume t h a t assertions have the latter form, i.e., t h a t there are no leading abstractions in the t e r m on the left in a judgment.

4

Translating

LF

Assertions

to hh ~ Formulas

In this section we present the translation of LF assertions to formulas in h h '~. This translation will require an encoding of LF terms as simply t y p e d A-terms. We begin by presenting this encoding. We then present the translation, which given an LF assertion, r ~- a where r is a valid context, translates 1~ to a set of hh '~ formulas and a to a formula to be proved from this set of formulas. We then illustrate how to extend the translation to obtain a formula whose proof (from no assumptions) verifies t h a t r is a valid context before proving t h a t c~ holds within the context F. Since b o t h LF and the meta-language have types and terms, to avoid confusion we will refer to types and t e r m s of the meta-language as recta-types and m e t a - t e r m s . We only define the encoding of LF terms as simply typed A-terms for LF objects and flat

228

t y p e s / t y p e families since this is all that is required by the translation. We introduce two base types, t m and ty, at the meta-level for these two classes of LF terms. First, to encode object-level variables, we define the function (I) that maps LF types and kinds to meta-types containing only occurrences of t m and ty. O(IIx:A.P) ¢(Type) ¢(A)

:= := :=

(P(A) --~ O(P) tm

when A is a flat type

Using this function, an LF variable of kind or type P is mapped to a meta-variable of type (I)(P). These recta-types encode the "syntactic structure" of the corresponding LF dependent type or kind. Information about dependencies is lost in this mapping, but as we will see later, this information is retained in a different form in performing the general translation. We will assume a fixed mapping from LF variables to meta-variables of the corresponding type. For readability in our presentation, this mapping will be implicit. A variable x will represent both an LF variable with kind or type P and a meta~variable of the corresponding syntactic type O(P). It will always be clear from context which is meant. Note that for type or kind P and object N, ~ ( P ) = ~ ( ( [ N / x ] P ) ~ ) . We denote the encoding of term or flat type P as ((P)). The full encoding is defined below. ((Ax:A.M)) ((MN)) ((AM))

:= := :=

~x:C2(A).((M)) ((M)) ((N)) ((A)) ((M))

Note that the encoding maps abstraction in LF objects directly to abstraction at the meta-level, and that both application of objects to objects and application of type families to objects are mapped directly to application at the recta-level. The difference at the meta-level is that the former application will be a recta-term with target type t m while the latter application will be a meta~term with target type ty. It is easy to see that for object or type family P having, respectively, type or kind Q, ((P)) is a meta-term of recta-type (I)(Q). The following two properties also hold for this encoding. L e m m a 4.1 Let P be an LF object or flat type, and N an LF object. Then [((N))/x]((P)) -- (([Nix]P)). L e m m a 4.2 Let P and Q be two LF objects or fiat types. If P --8 Q, then ((P)) --8 ((Q))" We are now ready to define the translation. Two predicates will appear in the atomic hh ~ formulas resulting from the translation: hastype of type t m ---, ty -~ o and istype of type ty --~ o. We will name the signature containing these two predicates ~LF. We denote the translation of the context item or judgment ~ as ~ ] . The full translation is defined in Figure 3. It is a partial function since it is defined by cases and undefined when no case applies. It will in fact always be defined on contexts and judgments in provable LF assertions. In proving properties of the translation, we will only consider canonical judgments and context items. Note that in a canonical context item x : P , the variable

229 ~M : IIx :A.B]

::

vo(A: (lIx:4 D IIMx: "l)

~M : All

:=

hastype ((M)) ((A}

[B : IIx : A . K ]

:=

vo(A: (rrx:A]] D Bx:

[A:

Type]]

:---- istype ((A))

where A is a base type.

where A is a base type.

[IIx:A.B : Type]

:=

~A: Type] AVa(A)X ([[x:A]] D [B: Type]])

~FI-yp e kind]]

:=

Z

[[IIx :A.K kind]]

:=

[ A : Type]] AV.(A)X (~x:A] D [K kind])

Figure 3: Translation of LF Judgments to hh ~ Formulas x is not necessarily canonical since it may not be fully applied. Such judgments with non-canonical terms on the left are handled by the first and third rules in Figure 3. This translation maps occurrences of If-abstraction in LF types and kinds directly to instances of universal quantification and implication in hh ~ formulas. In all of the clauses in the definition that contain a pattern with a If-type or kind, the variable bound by II is mapped to a variable at the metaAevet bound by universal quantification. Then, in the resulting implication, the left hand side asserts the fact that the bound variable has a certain type, while the right hand side contains the translation of the body of the type or kind which may contain occurrences of this bound variable. The base cases occur when there is no leading H in the type or kind, resulting in atomic formulas for the hastype and istype predicates, or simply T in the case when the judgment is Type kind. To illustrate this translation, we consider an example from an LF signature specifying natural deduction for first-order logic. The following declaration introduces the constant for universal quantification and gives it a type: V* : (i ~ form) ~ form. (We write V* for universal quantification at the object level to distinguish it from universal quantification in hh~.) To make all bound variables explicit, we expand the above type to its unabbreviated form: IIA:(IIy:i.form).form. Note that by applying • to the above type, we get (tin --~ tin) --+ t m as the type of V* at the meta-level. The translation of this signature item is as follows.

Iv*

: IIA: (IIy:i.form).form] --

Vtrn__trnA (VtrnY ((hastype y i) D (hastype (Ay) form)) D (hastype (V'A) form)) This formula provides the following description of the information contained in the above dependent type: for any A, if for arbitrary y of type i, Ay is a formula, then V*A is a formula. We will show in the next section that if F is a valid canonical context and ~ a canonical judgment where the term on the left in a is not an abstraction, then F F ~ is provable in

230 LF iff I4~ is provable from the set of formulas IF]. (Here IF] denotes the set of formulas obtained by translating separately each item in F.) We now illustrate how to extend the translation to obtain a formula whose proof verifies that r is a valid context before proving that 4 holds within the context F. Proving that a context xl : P 1 , - - - , x ~ : P,, is valid in LF corresponds in hh '~ to proving, for i = 1 , . . . , n, either ~Pi : Type]] or [Pi kind~ from Ix1 : P 1 , . . . , xi-1 : Pi-t~. The translation in Figure 4, for an arbitrary assertion F t- 4, maps the pair (F; a ) to a single formula containing subformulas whose proofs will in fact insure that each context item is valid with respect to the context items before it. We also remove the restriction that the term on the left in 4 cannot be an abstraction. Variables bound by abstraction at the top level are treated as additional context items. The translation of such a pair is denoted IF; 4]]*. The first two clauses of this translation map each context item to a

I x : A , F;4]*

:=

[A: Vype] ^ Vo(A)*

~x:K, r; a~*

:=

II£ kind] AV¢(g)X (~x:K]] D I r ; 4 ~ * )

[[O;,kx:A.M : II=:A.B~*

:=

[ A : Type] AV¢(A)X (~x:A~ D I 0 ; M : B ] ' )

~0; Ax : A . B : Hx : / . K ~ *

:=

IA: Type] AV¢(A)x (~x:A]] D ~0;B : K]]*)

:=

I4]

[[O;Q*

D Ir;4 *)

where the left term in 4 is not an abstraction.

Figure 4: Translation of LF Assertions conjunctive formula where the first conjunct verifies that the type or kind is valid (using the previous translation), and the second conjunct is a universally quantified implication where the left hand side asserts the fact that the context item has the corresponding type (again using the previous translation), and the right side contains the translation of the pair consisting of the remaining context items and judgment. The third and fourth clauses handle the cases when the term on the left in a judgment is an abstraction. The last clause in the translation is for the base case: when the context is empty and no further abstractions remain at the head of the judgment. Then the previously defined translation is used. T h u s , a proof of a formula obtained from translating an arbitrary assertion F b 4 with respect to an initially empty set of assumptions verifies that each context item in F, and each variable bound by A-abstraction in 4 is valid with respect to those items that appear before it, and then proves that the judgment holds within the entire context. The correctness of this translation will follow easily from the correctness of the previous translation.

5

Correctness

of Translation

We consider the correctness of the translation with respect to a slightly modified LF. Our modified system replaces the (ABS-FAM)and (ABS-OBJ) rules with the following two

231

rules.

F,x:A1- B : K (ABS-FAM') F 1- A x : A . B : I I x : A . K

F , x : A 1- M : B r 1- , ~ x : A . M : I I x : A . B (ABS-OBJ')

These rules are the same as presented earlier except t h a t the left premise is omitted. We call this s y s t e m LFq It can be shown that for valid context F, an LF assertion F 1- c~ is provable in LF ~if and only if it is provable in LF, provided t h a t there is no leading abstraction in the t e r m on the left in c~. This result relies on the fact t h a t in a proof in the modified system, if an application of (ABS-FAMt) whose conclusion is F F .~x : A . B : IIx : A . K or an application of (ABS-OBJ ~) whose conclusion is F 1- ) ~ x : A . M : I I x : A . B occurs above an application of (APP-FAM) or (APP-OBJ), it is always the case that F 1- A : Type is provable, and thus the left premise is redundant. T h e proof of this fact relies on a transitivity result for LF t similar to the one stated in [HHP87]. To prove the correctness of the translation, we prove a stronger s t a t e m e n t from which the correctness of ~ ]] and [ ~* will follow as corollaries. This stronger s t a t e m e n t will talk a b o u t the provability of LF assertions of the form F 1- a in LF ~ even in the case when F is not a valid context. We also relax the requirement on a. T h e left t e r m in a can be any object, type, type family, or kind, including one with a leading abstraction. To handle these cases in proving the correctness of [ ]], we must add the following two rules to the translation.

[$x:A.M

: IIx:A.B~

~)~x : A . B : Hx : A . K ~ We m u s t then also add the restriction that the first and third rules in Figure 3 are only applicable when M and B, respectively, are not abstractions. One final l e m m a is needed to prove the correctness of the translation. This l e m m a applies to the translation extended with the above two rules. In Section 4, we stated that substitution c o m m u t e s with the encoding operation ( L e m m a 4.1). We extend this result to the translation operation on judgments which translate to provable hh ~ formulas. In particular, the l e m m a below states that substitution and fl-normalization commute with the translation operation on provable h h " sequents. We will write 0) be a canonical context (whose variables are distinct). Let N 1 , . . . , N,~,N be canonical objects with respect to F, and let E be the signature Y]LF U (I)(r). Then E; IF] 1-I ~ g : ( [ N 1 / x l , . . . , N n / x n ] A ) # ~ if and only if Z; IF] t-i [((Yl)) / x l , . . . , ((Yn)) /x,~, ((g)) /x][x : All. T h e o r e m 5.2 (Correctness of ~lYanslation) Let F be an arbitrary context (such t h a t the variables in F are distinct), and let c~ be an arbitrary canonical judgment with respect to F. Let E be ELF t3 ~(F). Then F 1- a is provable in LF' if and only if E; IF] 1-1 ~(~ holds.

232

P r o o f S k e t c h : The proof of this theorem is constructive, i.e., it provides a m e t h o d for constructing an h h '° proof from an LF f proof, and vice versa. The forward direction is proved by induction on the height of an LF ~ proof of the assertion F ~- a. For the PI and ABS rules, we can apply the induction hypothesis directly to the premises to obtain provable sequents to which we apply D-R, V-R, and A-R for the PI rules, and just D-R and V-R for the ABS rules to obtain the desired result. For the APP rules, we know the context item in the application of these rules corresponds to a formula in IF]. To this formula, we can apply V-L followed by D-L n times in a backward direction. Each of the left premises of D-L can be shown to be provable since they are the result of applying the induction hypothesis followed by L e m m a 5.1 to each of the latter n premises of the APP rule. Using L e m m a s 4.1 and 4.2, the formula introduced on the left in the right premise of the topmost application of D-L can be shown to be ~-convertible to the formula in the succedent (the translation of the j u d g m e n t in the conclusion of the APP rule). Thus this premise is an axiom. The proof of the backward direction is by induction on the structure of the t e r m on the left in a, and is similar to the proof of the forward direction. The regularity of the proofs in h h '° described in T h e o r e m 2.2 is required here. For example, the proof of the case when the t e r m on the left is an application uses the backchain search operation. • C o r o l l a r y 5.3 (Correctness of ~ ~) Let r be a valid context and a a canonical j u d g m e n t such that the t e r m on the left is not an abstraction. Let E be ~LF U (I)(r). T h e n F ~- a is provable in LF' if and only if E; [r~ ~-I [c~] holds. C o r o l l a r y 5.4 (Correctness of [ ]]*) Let F be a canonical context (such that the variables in F are distinct), and a a canonical judgment. Then F is a valid context and F k- a is provable in LF' if and only if ELF; 0 [-x [IF; a~* holds.

6

Examples

In this section, we provide some further examples to illustrate the correspondence between LF signature items and judgments and the h h ~° formulas that they map to. Note t h a t in general, formulas obtained by translating signature items have the form on the left below, but can be rewritten to have the form on the right: V T I X I . . . V T , X , (G1 ^ . . - ^

G , D D)

where n > 0, r l , . . . , v n are types, X 1 , . . . , X , ~ are variables, G 1 , . . . , G n , D are h h ~° formulas. (Here we assume that for i = 1 , . . . , n , X i + l , . . . , X n do not appear free in Gi). For readability, we will write h h ~° formulas in the examples in this section simply as G1 A ... A G , D D (or just D when n = 0), and assume implicit universal quantification over all free variables written as capital letters. T y p e subscripts for these universal quantifiers can always be inferred from context. We begin by demonstrating the translation of signature items specifying natural deduction inference rules for tile A*, V*, and D* object-level connectives. The fragment of an LF signature specifying natural deduction for the first-order logic t h a t we are concerned

233

with is the following. i :Type b r m : Type true : form ~ Type A* : form -+ form ---* form D* : form --+ form ---*form V* : (i ~ form) --~ form A*-I: IIA :form.IIB :form.true(A) ---* true(B) ~ true( A A ' B ) D*-I : IIA :form.IIB :form.( true(A) --+ true(B)) -+ true(A D ' B ) V*-I : IIA:i--~ form.(IIy:i.true(Ay))---* true(V'A) The signature item true is a function that maps formulas to types. LF objects of type true(A) represent proofs of formula A. First, consider the/',*-introduction rule specified by A*-I and its type. Its translation is the following formula.

(hastype A form) A (haslype B form) A (hastype P (true A)) A

(hastype Q (true B))

(hastype (^*-I A B P Q) (true A n'B))

This formula simply reads that if A and B have type form, P is a proof of A, and Q is a proof of B, then the term (A*-I A B P Q) is a proof of the conjunction A A*B. The correspondence between this formula and the LF signature item is straightforward. We next consider a slightly more complex example; the translation of the V*-I rule results in the following formula.

vy((hastype y i)

(h stype Ay fo m)) ^

Vy((hastype y i) D (hastype P y (true Ay))) D (hastype (V*-I A P ) (true V'A)) This clause provides the following description of the information contained in the dependent type: if for arbitrary y of type i, A y is a formula and P y is a proof of Ay, then the term (V*-I A P ) is a proof of V*A. Note that A and P at the metaAevel are both functions having syntactic type t m --~ tin. Here, A maps first-order terms to formulas just as it does at the object level, while P maps first-order terms to proofs. As a final inference rule example, consider the declaration for D*-I, which translates to the following formula. (hastype A form) A (hastype B form) A Vq((hastype q (true A)) D (hastype Pq (true B))) D (hastype (D*-I A B P) (true A D ' B ) ) This formula reads: if A and B are formulas and P is a function which maps an arbitrary proof q of A to the proof Pq of B, then the term (D*-I A B P ) is a proof of A D*B. Note that P in this formula is a function which maps proofs to proofs. An example of a canonical judgment that is provable in the LF signature for naturM deduction is

,kA :forrn. D*-I( A )( A )( ,~x : true( A ).x ) : HA :form.true( A D'A). Using the extended translation of Figure 4, we obtain the following formula:

(istype form) A VA((hastype A form) D (hastype (D*-I A A ~x.x) (true A D'A)))

234

which is provable from the set of formulas obtained by translating the LF signature specifying natural deduction for first-order logic. An LF signature specifying the reductions needed for proof normalization in natural deduction is given in [Pfe89]. As a final example, we illustrate the translation of the reduction rule for the case when an application of the introduction rule for D* is followed by the elimination rule for the same connective. The following signature items define the D*-E rule, the reduce constant used to relate two proofs of the same formula, and the reduction rule for D*. D*-E: HA:form.HB :form.true(A) --* true(A D ' B ) ---* true(B) reduce: HA :form.true(A) --* true(A) ~ Type D* -red : HA :form.II B :form.IIP : (true(A) --* true( B ) ).n O :true(A). reduce(B)(D*-E m B (D*-I d B P) Q)(PQ) The signature item for D*-red translates to the following formula.

(hastype A form) A (hastype B form) A Vq ((hastype q (true A)) D (hastype (Pq) (true B))) A (hastype Q (true A)) D (hastype (D*-red A B P Q) (reduce B (D*-E A B (D*-I A B P) Q) (PQ))) This formula reads: if A and B are formulas and P is a function which maps an arbitrary proof q of A to the proof Pq of B, and Q is a proof of A, then (D*-red A B P Q) is a meta~proof of the fact that the natural deduction proof (D*-E A B (D*-I A B P ) Q) of B reduces to the proof PQ.

7

Conclusion

We have not yet considered the possibility of translating hh '° formulas into LF. This translation is particularly simple. Let ~ be a signature for hh '~ and let 7~ be a set of E-formulas. For each primitive type r other than o in S, the corresponding LF judgment is r : Type. For each non-predicate constant c : r E E, the corresponding LF judgment is c : v. For each predicate constant p : rl ~ --- ---* rn --+ o E E, the corresponding LF judgment is p : 1"1 --* ... ~ rn ~ Type. Finally, let D E ~ and let k be a new constant not used in the translation to this point. Then the corresponding LF judgment is k : D ~ where D ~ is essentially D where B1 D B2 is written as IIx :B1.B~ and VTx B is written as IIx : r.B. In the first author's dissertation [Fe189] an encoding of LF into just hh 2 was presented. Order 2 is all that is necessary if object-level applications are represented by metaAevel constants. The proofs of the correctness of that encoding are very similar to those presented here. Notice that the translation presented here works via recursion over the structure of types. Thus, this kind of translation will not work for the polymorphic A-calculus or the Calculus of Constructions since they both contain quantification over types. Other techniques can be used, however, to encode provability of such h-calculi into hh ~. These involve coding the provability relation of those calculi directly into the metaAanguage [FM89].

235

A c k n o w l e d g e m e n t s The authors would like to thank Robert Harper and Frank Pfenning for valuable discussions on the subject of this paper. We are also grateful to the reviewers of an earlier draft of this paper for their comments and corrections. Both authors have been supported in part by grants ONR N00014-88-K-0633, NSF CCR-8705596, and DARPA N00014-85-K-0018. The first author is currently supported in part by ESPRIT Basic Research Action 3245.

References [CH88]

Thierry Coquand and G~rard Huet. The calculus of constructions. Information and Computation, 76(2/3):95-120, February/March 1988.

[Chu40]

Alonzo Church. A formulation of the simple theory of types. Journal of Symbolic Logic, 5:56-68, 1940.

[Fe189]

Amy Felty. Specifying and Implementing Theorem Provers in a Higher-Order Logic Programming Language. PhD thesis, University of Pennsylvania, August 1989.

[FM89]

Amy Felty and Dale Miller. A meta language for type checking and inference: an extended abstract. 1989. Presented at the 1989 Workshop on Programming Logic, BMstad, Sweden.

[HHP87] Robert Harper, Furio Honsell, and Gordon Plotkin. A framework for defining logics. In Second Annual Symposium on Logic in Computer Science, pages 194204, Ithaca, NY, June 1987.

[HHP89] Robert

Harper, Furio Honsell, and Gordon Plotkin. A framework for defining logics. 1989. Technical Report CMU-CS-89-173, to appear.

[HS86]

J. Roger Hindley and Jonathan P. Seldin. Introduction to Combinatory Logic and Lambda Calculus. Cambridge University Press, 1986.

[MNPS]

Dale Miller, Gopalan Nadathur, Frank Pfenning, and Andre Scedrov. Uniform proofs as a foundation for logic programming. To appear in the Annals of Pure and Applied Logic.

[NM88]

Gopalan Nadathur and Dale Miller. An overview of AProlog. In K. Bowen and R. Kowalski, editors, Fifth International Conference and Symposium on Logic Programming, MIT Press, 1988.

[Pau89]

Lawrence C. Paulson. The foundation of a generic theorem prover. Journal of Automated Reasoning, 5(3):363-397, September 1989.

[Pfe89]

Frank Pfenning. Elf: a language for logic definition and verified metaprogramming. In Fourth Annual Symposium on Logic in Computer Science, pages 313321, Monterey, CA, June 1989.

[Pra71]

Dag Prawitz. Ideas and results in proof theory. In J.E. Fenstad, editor, Proceedings of the Second Scandinavian Logic Symposium, pages 235-307, NorthHolland, Amsterdam, 1971.

INVESTIGATIONS INTO PROOF-SEARCH IN A SYSTEM OF FIRST-ORDER DEPENDENT FUNCTION TYPES David Pym University of Edinburgh Scotland, U.K. [email protected]

Lincoln Wallen University of Oxford England, U.K. [email protected]

Abstract

We present a series of proof systems for )dI-calculus: a theory of first-order dependent function types. The systems are complete for the judgement of interest but differ substantially as bases for algorithmic proof-search. Each calculus in the series induces a search space that is properly contained within that of its predecessor. The MI-calculus is a candidate general logic in that it provides a metalanguage suitable for the encoding of logical systems and mathematics. Proof procedures formulated for the metalanguage extend to suitably encoded object logics, thus removing the need to develop procedures for each logic independently. This work is also an exploration of a systematic approach to the design of proof procedures, It is our contention that the task of designing a computationally efficient proof procedure for a given logic can be approached by formulating a series of calculi that possess specific prooftheoretic properties. These properties indicate that standard computational techniques such as unification are applicable, sometimes in novel ways. The study below is an application of this design method to an intuitionistic type theory. Our methods exploit certain forms of subformula property and reduction ordering - - a notion introduced by Bibel for classical logic, and extended by Wallen to various non-classical logics - - to obtain a search calculus for which we are able to define notions of compatibility and intrinsic well-typing between a derivation ¢ and a substitution er calculated by unification which closes ¢ (a derivation is closed when all of its leaves are axioms). Compatibility is an acyclicity test, a generalization of the occurs-check which, subject to intrinsic well-typing, determines whether the derivation ¢ and substitution a together constitute a proof. Our work yields the (operational) foundations for a study of logic programming in this general setting. This potential is not explored here. 1

Introduction

We present a series of proof systems for AII-calculus: a theory of first-order dependent function types [vDa80,MR86,HHP87]. The systems are complete for the judgement of interest but differ substantially as bases for algorithmic proof-search. Each calculus in the series induces a search space that is properly contained within that of its predecessor. Our interest in proof-search in All-calculus stems from two sources. Firstly, the theory is a candidate general logic in that it provides a metatanguage suitable for the encoding of logical systems [AHM87] and mathematics [vDa80]. Proof procedures formulated for the metalanguage extend to suitably encoded object logics, thus removing the need to develop procedures for each logic independently.1 The second reason for our interest arises out from a desire (expressed in [Wa189]) for a systematic approach to the design of proof procedures. It is our contention that the task of designing a cornputationatly efficient proof procedure for a given logic can be approached by formulating a series of calculi that possess specific proof-theoretic properties. These properties are the indicators that standard computational techniques such as unification are applicable, sometimes in novel ways. The study below is an application of this design method to an intuitionistic type theory. 1This should be compared with the use of proof procedures for classical logic to effect proof-search within a modal logic, say, by means of an encoding of the latter in the former; see [Oh188] for example.

237

The first system of the series, called N, is a natural deduction formulation of ,\if-calculus. 2 The main judgement of N is the typing assertion: F ~- M:A, meaning that the term M has type A, given the type assignments for free variables and constants recorded in F. This relation is decidable [ililP87]. A typical rule of N is the elimination rule for the dependent function type constructor (if): 3 F~- N : A IlE FF M:(IIx:A.B) F F MN: B[N/z] where B[N/z] denotes capture-avoiding substitution of N for free occurrences of x in B. The second system, called L, is sound and complete (relative to N) for the semi-decidable relation of inhabitation: F ~ A, with the meaning ( 3 M ) ( £ F M:A). The judgements of L assert the existence of proofs of the judgements of N , as in the case of first-order logic [Pra65]. L is the starting point for our investigation into proof-search. A typical rule of L is the H-left rule, the counterpart of the If-elimination rule of N:

IIl

r,z:B[N/x] ~ C F=~C

(a) w : (IIx:A.B) E F

(b) z ¢ Dom(r) (c) F F N:A.

L is almost a logicistic system, in the sense of Gentzen, meaning that there is only one localized appeal to an external notion, that notion being an appeal to the system N in side condition (c) of the rule above. . Indeed, with respect to the If-type structure of terms in the language, L has a subformula property [Gen34]. As a consequence, if the inference rules are used as reduction operators from conclusion to premisses then L induces a search space of derivations of a given sequent. 4 Notice that if the Ill rule is used as a reduction, the choice of term N to use in the premiss is unconstrained by the conclusion of the rule. The subformula property of the H-types does not extend to a full subterm property (cf. the quantifier rules of the predicate calculus). The axiom sequent (or closure condition for the reduction system) is:

F, z:A, F~ ~ A i.e., the conclusion occurs as the type of a declaration in the context. The third and fourth systems are also systems of sequents. The system U is formed from L by removing the appeal to N in the H1 rule. The Ill rule of U is thus: Hl

r,z:B[a/x] ~ C F =~ C

(a) w : (Hx:A.B) e F

(b) z ¢ Dom(V). This rule introduces a free, or universal variable into the proof, denoted here by a. Universal variables are distinct from the usual eigenvariables that are bound by the derivation (and explicitly declared in contexts). The axiom sequent of U is used to compensate for the omission of term information in the Ill rule as follows: F,z:B,F' ~ A

(a) (3a) Ba - Aa

where cr is an instantiation of the universal variables of the sequent, and Ba denotes the term resulting from the application of a (as a substitution) to B. The calculation of instantiations 2This system is also known as the type system of the (Edinburgh) Logical Framework or LF [HHP87]. 3Readers that are unfamiliar with dependent types should read the construction IIx:A.B as a (typed) universal quantifier such as Yx:A.B; x is the bound variable, ranging over the type A, which may occur free in the term B. 4Kteene [Kle68] explains this in the case of the predicate calculus. Sequent systems used in this way are systems of block tableaux [Smu68].

238

can be performed by a unification algorithm for the language. A suitable algorithm has been developed by the first author [Pym90] based on a standard algorithm for simple type theory

[Hu75]. A U-proof is a pair <¢,a) consisting of a U-derivation ¢ and an instantiation a such that Ca (the application of a as a substitution to ¢ ) is an L-proof. Not every instantiation that closes the leaves of a given U-derivation will yield an L-proof when applied. It is sufficient to check t h a t the instantiation can be welbtyped in the derivation to ensure that the result is an L-proof. If F is the context and A the type of the universal variable a when introduced into the U-derivation, the well-typing condition for a amounts to:

Fcr b an: A a ensuring that side condition (c) of the II1 rule of L - - the condition omitted from the lrll rule of U - - is nevertheless satisfied in Ca. The unconstrained choice of term in the IIl rule of L is replaced by a highly constrained choice in U. s This wholesale reduction in the search space is analogous, of course, to that. obtained by Robinson in the context of the predicate calculus [Rob65]. The well-typing of an instantiation depends on the structure of the derivation from which it is calculated. However, even if it fails to be well-typed in that derivation it may be well-typed in some permutation of the derivation, since rule applications (or reductions) can sometimes be permuted whilst leaving the endsequent (i.e., root) of the derivation and its leaves unchanged. The degree to which this can be done is summarized in the form of a Permutation Theorem, in the sense of Kleene [Kle52] and Curry [Cur52], and underlies the fourth and final system of the paper called I t . The rules of R are just the rules of U (so the derivations axe the same) but the condition for instantiations to yield a proof is weakened. An It-proof is again a pair consisting of a derivation ~b and an instantiation a under which @ is closed, but now we require only that there exist perhaps another (closed) derivation •* in which the instantiation is well-typed; i.e., ¢ * a is an L-proof. Of course the crucial computational question is whether the existence of at least one suitable ¢*, given ¢ and a, can be determined as the search progresses. We show that this is indeed the case using a reduction ordering: a notion which was introduced by Bibel [Bib81] for classical connectives and extended by the second author in [Wal89] to various non-classical connectives. 6 An It-proof therefore corresponds to an equivalence class of U-proofs of the same endsequent consisting of all permutation variants of the original derivation in which the calculated instantiation is well-typed. The reader may find it helpful to refer back to the overview given above to identify the motivation for various technicalities below. 5The inference system that corresponds to the calculation of instantiations by unification does indeed have a

subterm property. The soundness and completeness result for U is a form of Herbrand Theorem for the theory. The unification algorithm searches amongst the terms of a "Iterbrand universe" defined by each leaf sequent. This aspect is not explored in detail in this paper, see [Pymg0]. SThe condition is equivalent to an enhanced "occurs-check" in the unification algorithm if a suitable notion of Skolem function were introduced. The suitable notion is not the obvious one that the rcader might suppose from experience of classical quantifiers, not least because the logic under investigation here is intuitionistic. In general, the theoretical diversion via Skolemization is unnecessary and can be difficult to justify semantically, even in simple type theory (cf. [MilS3]). Our approach follows Iterbrand's Theorem (which is finitary) rather than the Skolem-Herbrand-GSdel Theorem (which is not).

239

.~YI-calculus: a t h e o r y o f d e p e n d e n t f u n c t i o n types

2

The syntax of )~ii-calculus is given by the following grammar:

Signatures Contexts Kinds TypeFamilies Objects

N r

::= ::= ::= ::= ::=

K A M

0 I N,e:K ] Z , e : A 0 I F,x:A Type ] IIx:A.K

c I IIx:A.A I )~x:A'A I A M c l x I )~x:A.M I M M

where c ranges over type and object constants. The proof system defined in [IIHP87] for deriving assertions of the following forms: 1-- E sig I-~ P context F I-:~ K kind

r t-~ A : K Ft- z M : A

is a valid signature F is a valid context K is a valid kind A has kind K M has type A

may be found in Appendix 1. We shall refer to this system as N to emphasize that it is a system of natural deduction. We stress that N is a system of first-order types in the following sense: the If-type formation rule has the form: FbEA:Type F , x : A F~ B:Type . r I-~: IIx: A. B : Type both A and B must be of kind Type (see also Rule 11 of Appendix 1). There are no variables of kind Type and consequently there are no higher-order types (of kind Type). A summary of the major metatheorems pertaining to N and its reduction properties may be found in the Appendix. We note here only that all five relations are decidable. 3

A m e t a c a l c u l u s for N.

DEFINITION 3.1 (Sequent) A sequent is a triple (E,F,A), written F =~:c A, where ~ is a signature, F a context and A a type (family). The intended interpretation of the sequent is the (met a-)assertion: (3M) N proves F~-2 M:A. D We define a semi-logicistic calculus, L, for deriving sequents. The system is comprised of two axiom schemata and two operational rules (one left and one right) for the If-types. DEFINITION 3.2 (L)

Axl

F, x:A, F~ ~

A

Ax2

P ~,c'A,~' A

IIr

F,x:A ~ B P ~ IIx:A.B

fll

F,z:B[M/x] ~ P =~z C

(a) x t / D o m ( r )

C

(a) @: IIx:A.B E E U r

(b) z ¢ Dora(r) (c) N proves F I-~: M:A

240

Here B[M/x] denotes capture avoiding substitution of M for x, and the conditions x, z !i~ Dora(F) mean t h a t x and z do not label any declaration in the context F. For simplicity and efficiency, we work exclusively with fly-normal forms, and for such terms syntactic identity (=-) is taken up to a-congruence (change of bound variable). As usual we refer to the variable x of the IIr rule as the eigenvariable of the inference. We can ensure that in any derivation eigenvariables occur only in sequents above the inference at which they are introduced. IIx:A.B is said to be the principal formula of the operational rules. A and B are the side formulae of the IIr rule, and A and B[M/x] are the side formulae of the Ill rule. L-derivations are trees of sequents regulated by the operational rules, and L-proofs are derivations whose leaves are axioms. [:] When x is not a free variable of B in IIx:A.B we have B[M/x] - B and we write A -* B for IIx:A.B : the third side condition on the IIl rule may be weakened to the inhabitation condition: (c') ( 3 M )

N proves F Fz M:A.

This in turn may be expressed within the system by the sequent F = ~ A yielding a modified Ill rule which we call -* l: -* 1

F ~z A

F,z:B ~

F =v~ C

C

(a) @:A-*B C E U F

(b) z ¢ Dora(r). Consequently, we extend the syntax conservatively to include non-dependent function types, A --~ B, corresponding to IIx:A.B whenever x is not free in B, and include the --~ I rule above and the -~ r rule below as derived rules.

F,x:A ~ r

B

F o 2 A-* B

(a) x ~ Oom(F).

DEFINITION 3.3 (Well-formed sequent) A sequent F ~ F F~ A: Type. [3 PROPOSITION 3.4 ( H H P 8 7 )

A is said to be well-formed just in case

The wetI-formedness problem for sequents is decidable.

[3

In practice, derivations are constructed from the root, or endsequent, toward the leaves, in the spirit of Kleene [Kle68] and systems of tableaux [Smu68]. In support of this usage we have the following result: PROPOSITION 3.5 (PYM90) For well-formed sequents F ~ L proves F ~:~ A

iff

(3M)

A,

N proves F t-z M:A.

[3 We revert to the appropriate fragment of N to decide if the endsequent is well-formed. If so, L may be utilized to prove inhabitation of A with respect to the context F. Moreover an inhabiting term can be extracted from the L-proof. Details may be found in [Pym90]. L is not fully logicistic since an appeal is still made to N for each application of the IIl rule (third side condition). W i t h the introduction of L we have made two conceptual steps. Firstly, we have shifted our attention from a decidable judgement (type assignment) to a semi-decidable judgement (inhabitation) since the former is uninteresting from th e point of view of general theorem proving. (Terms code the proofs of their types, hence the decidability of the judgements of N.) The second step concerns proof-search. We moved directly to a sequent system with a limited subformula property. An alternative choice would have been to formulate a natural deduction system for inhabitation assertions which would have given us a H-elimination rule of the form:

Il$

F ~ IIx:A.B P ::v~. B[M/x]

(a) N proves P F z M : A

241

similar to the usual natural deduction rule for quantifiers. The fact that the type A in the premiss is not a subformula of the conclusion means that a proof procedure based on such a calculus would have to invent the type. The limited subformula property of L restricts the non-determinism to the choice of term M in the Ill rule. 4

A m e t a c a l c u l u s for L

We introduce a new syntactic class of universal variables denoted by lowercase Greek letters a,/~, etc., and extend the syntactic category of objects to include them thus:

Objects

M

::=

c I c~ I x I ) t x : A . M t M M .

Notice t h a t universal variables cannot appear h-bound. By virtue of this extension, entities of all syntactic classes may now contain universal variables as subterms. When we wish to emphasize that a syntactic entity does not contain universal variables we shall refer to it as being ground. We define a calculus for sequents by dropping the axiom schemata of L and modifying the IIt rule as follows: DEFINITION 4.1 (U-derivation) The rules of U consist of the ~ r, ~ l and IIr rules of L, together with Itl r,z:B[a/x] ~r, C F ~ C (a) @ : flx:A.B E E U F

(b) z ¢ Dom(r). U-derivations are trees regulated by the above rules such that the sequent at the root of the tree is well-formed. In applications of the Ill rule we call F the typing context of (~ and A the type of ~. (Note that we have not yet defined U-proofs; there are no axiom schemata.) [] U thus consists of four operational rules. Notice that the Ill rule no longer contains an external appeal to N or a choice of term, but is otherwise identical to the Ill rule of L. DEFINITION 4.2 (Instantiation) An instantiation is a mapping from universal variables to objects. The capture-avoiding application of instantiations to all of the constructs of the language is defined in the obvious way. O The following notion compensates for the absence of axiom schemata in U. DEFINITION 4.3 (Closure) A sequent P ~p. A is said to be closed under an instantiation a just in case B a =_ Act for some declaration @:B C ~ U F. A U-derivation is said to be closed under a just in case all of its leaf sequents are closed under a. (Again, we work exclusively with/~rl-normal forms.) [] We are interested in instantiations that are well-typed in the following sense. DEFINITION 4.4 (Well-typing) An instantiation a is said to be well-typed in a given U-derivation just in case for every universal variable ~ of the derivation, with typing context F and type A,

we have: N proves F a F2 a n : A n

73

We are now in a position to define a notion of proof for U. DEFINITION 4.5 (U-proof) A U-proof is a pair ( ¢ , a ) , where ¢ is a U-derivation and a an instantiation, such that (1) ¢ is closed under a, and (2) a is well-typed in ~. [] THEOREM 4.6 If (¢, a} is a U-prvof, Ca is an L-proof.

242

PROOF. By induction on the structure of U-derivations. The closure condition (1) ensures that the leaves of C a axe L-axioms. The well-typing condition (2) ensures that the image under a of each instance of a IIl rule (of U) in ~b satisfies the side conditions on the IIl rule of L. The remaining operational rules are common to the two systems. O We remark that it is immediate that any L-proof arises as a U-proof: this is the converse of Theorem 4.6. We shall postpone discussion of proof-seaxch in U until we have introduced our fourth and final refinement. One could stop here, however, using the unification algorithm developed in [Pym90] (based on that of [Hu75]) to calculate instantiations when a putative leaf has been reached, then checking the well-typing condition using N (recall that N is a decidable system for well-typing). The search space induced by U is a proper subspace of that induced by L since the choice of term at Ill reductions in the former is constrained by the syntactic content of the leaf sequents (cf. [Rob65]). The main reason for considering a further refinement is that U distinguishes between derivations that are intrinsically identical in a sense made precise below. Consequently, the search space induced by U still contains a major source of redundancy. 5

A metacalculus for U

The content of the typing contexts of universal variables in a U-derivation depends on the structure of the derivation. For example, the two U-derivations below differ in the order in which the IIl and IIr rule have been applied (the figures should be read from endsequent to premisses and we assume that there is some @ : (IIy:A.B(y)) E ~ U F):

r,z:B(a),x:A ~ B(x) ~ IIx:A.B(x) F ~ IIx:A.B(x)

r,z:B(a)

I',x:n,z:B(a) =~ B(x) F,x:A =,.~ B(x) F ~ IIx:A.B(x)

The principal formula of the I I / r e d u c t i o n in each derivation is the declaration @ : (IIy:A.B(y)) assumed to be an element of the context F. We also assume that x ~ Dom(F). The insta~ltiation a that maps a to x closes both derivations. The typing context of a in the first derivation is F, while in the second it is F,x:A. Since aa = x, in order to check the well-typing condition for a we must show F FE x:A for the first derivation and F , x : A FE x:A for the second. Consequently a is well-typed in the second derivation but not in the first (since x ~ Dom(F)). Our final refinement is to introduce a calculus, R , in which the existence of the U-derivation on the left, together with the closing instantiation, is sufficient to infer the existence of the U-proof on the right. T h a t is, we investigate conditions under which rule instances may be permuted whilst leaving the endsequent and leaves of the derivation essentially unchanged. DEFINITION 5.1 (R-derivation) The rules of R are exactly the rules of U; consequently the derivations of R are exactly those of U. (The notion of R - p r o o f however differs from that of U-proof; see below.) o Let ¢ be an R-derivation of a given endsequent and let 9v¢ denote the collection of inferences that comprise ¢. We use bYe(E) C_ ~'4 to denote the inferences of a given type E, for -2 one of the following: --~ l, ~ r, IIl or Hr. Let a be an instantiation for ¢. DEFINITION 5.2 The following binary relations are defined on ~'¢: (i) R < ¢ R ~ iff a side formula of R is the principal formula of R~r; 7More accurately: iff a side formula of R is a "descendent" of the principal formula of R; we distinguish the "occurrences" of a formula in a derivation [Kle68].

243 (ii) R <<~, R' iff R occurs below R' in ¢; (iii) R [-o R ~ iff the universal variable or eigenvaxiable introduced by R is a free variable of aa, where (~ is the universal variable introduced by R ~. D Notice that <:<¢ decomposes into sixteen subrelations: <<~'fl C 5rq,(~) x 9~¢(~2) for E, ~ amongst --+ l, ~ r, IIl and Ilr. <(¢ and its subrelations are called the skeletal orderings of the derivation ¢. Notice also that < ¢ is a subrelation of <<4,DEFINITION 5.3 (Reduction ordering) The reduction ordering <~¢,~ induced by an R-derivation and a instantiation a is defined by: <3¢,a ~-def (<¢ U"~¢U l-a) + where + indicates transitive closure and the relation -<¢ is defined by: =de,

-~ ranges over the operational rules of R.

\

=

U

[]

The presence of a relation in <3¢,o indicates that relationship between specific inferences may not be altered by permutation. Consequently, the definition of -<¢ fixes the relative positions of all rule applications in ¢ except Ill rule applications (since they are removed from <<¢ to form -<¢). DEFINITION 5.4 (i) (Compatibility) A derivation is said to be compatible with an instantiation just in case the reduction ordering induced is irreflexive. (ii) (Degree) The degree of a compatible derivation is the number of pairs of inferences in the derivation whose skeletal order is inconsistent with the reduction ordering. That is, (R, R ~) for which both R <<¢ R ~ (R is below R ~ in ¢) and R ~ <1¢,~ R. If a derivation is compatible with an instantiation with degree n, we say it is n-compatible. {3 THEOREM 5.5 (PERMUTATION TttEOREM) If ~ is compatible with a, then there is a O-compatible R-derivation ¢* of the same endsequent. Moreover, if ~ is closed under a, so is ¢*. We say that ¢* is a permutation of ¢. PROOF. By induction to reduce the degree. over Ilr). The others derivation contain the

on the degree of ¢. We interchange IIl inferences with other inferences One such case was given as an example at the start of this section (IIl are left to the reader. One must check that the leaves of the permuted same declaxations (though in a different order). {3

We have as a corollary to the construction performed in the proof of the Permutation Theorem: COROLLARY 5.6 <]¢*,a : <]¢,aPROOF. The only relationships changed in the permutation axe those excluded from
{3

The following lemma shows that the 0-compatibility of a derivation and instantiation is a necessary condition for the well-typing of the latter in the former.

244

LEMMA 5.7 If o" iS well-typed in ¢, ¢ is O-compatible with a. PROOF. An inconsistency between the skeletal ordering of ¢ and the reduction ordering arises from an inconsistency between U~ and the skeletal ordering. Since r-~_C ~ ¢ ( E ) x )re(HI), it must arise from a IIl inference, introducing ~ say, being nearer the root of the derivation than a IIl or Hr inference that gives rise to a variable, v say, free in a a . But then v cannot be declared in the typing context of (~ since it is introduced above c~, and therefore a is not well-typed, contra~licting our hypothesis. Therefore there can be no inconsistencies and ~ is 0-compatible with a. D We give a simple example of an R-derivation and a closure instantiation which fails to be well-typed in the given derivation, but which is well-typed in a reordering of that derivation. Let ~ =---dCfA : Type, B : A --* Type, C : Type,p : A --* Type, a : A , f : B(a) ---* B(a), and let F =def Xl : IIx2:A .IIx3:B(x2).px3. We search for a proof of the (well-formed) endsequent F :¢-~ Hx4 : B ( a ) . C --* p ( f x 4 ) . Consider the following R-derivation, ¢ : F, x6 : Hx3:B((~).px3, xr : pfl, x 4 : B ( a ) , x s : C = ~ p(fx4) F, x6 : IIx3: B(c~). px3, x7 : pfl, x4 "-B(a) ~ C -~ p(fx4) r , x ~ : I I x 3 : B ( ~ ) . p x 3 , x r : pfl = ~ IIz4:B(a).C -~ p(fx4) r, x 6 : H x 3 : B ( a ) . p x 3 ::v.r. H x 4 : B ( a ) . C --~ p(fx4) I? =v~ IIx4 : B ( a ) . C ---, p ( f z 4 )

(--* r) (II r) (IIl) (HI).

The leaf sequent is closed by the instantiation a ~ ((a,a), ( f x , , f l ) ) , but f x 4 is not well-typed in F, x6 : Hx3 : B(a). Px 3 . However, if we reorder the rules in the derivation so that the H Is are used after the ~ r and H r we obtain the derivation:

r , z 4 : B ( a ) , z s : C , z6 : nza:B(a).pxa, zT : pZ ~ p(fx4) r, x4:B(a),xs:C,x~ : llzz:B(c~).px3 ~ r p(fx4) F,x4:B(a),xs:C ~p, p(fx4) r,x, :B(a) ~ C - - p ( / x , ) ==~1~IIx4: B(a). C --+ p(fx4)

(1If)

(II/) (---~ r)

(n,-).

This sequent also is closed by the instantiation a and fx4 is well-typed in the context F, z4 : B ( a ) , x s : C , x6 : I I x 3 : B ( a ) . p x 3 . From a computational point of view testing for compatibility is a simple matter given a derivation and an instantiation: it is an acyclicity check in a directed graph. Compatibility is not, however, a sufficient test for well-typing. The Permutation Theorem gives us the existence of 0-compatible derivations in which we might test for well-typing of the instantiation incrementally (i.e., as it is found) but this involves repeatedly constructing permutations using the constructive proof of the theorem. This is inelegant and computationally expensive. Another alternative would be to ignore well-typing until a closed, compatible derivation and instantiation have been found, and then utilize the Permutation Theorem once and check welltyping. We reject this option on the grounds that typing constraints reduce the search space of the unification algorithm drastically. We develop instead a computationaily tractable test on a derivation and instantiation that, if passed, guarantees the well-typing of the instantiation in all 0-compatible permutations of the derivation. Our ability to define such a notion is a corollary of the normalization (cutelimination) result for AH-calculus [HHP87] with its attendant subformula property, just as the results obtained in [BibS1] and [Wal89] for other logics rely on metatheorems of this sort.

245

Henceforth we treat contexts as ordered structures or DAGs rather than sequences since the dependencies between declarations form such an order. Consequently the implicit union, denoted above by a comma, such as in "r, x:A', should be understood as an order preserving union of the order (DAG) r and the singleton order x:A. The latter will be higher in the resulting order than the declarations of the free variables in A, and incomparable with the other maximal elements of I'. This assumption simplifies our discussion. The following notions are introduced for an R-derivation ¢ of a welt-formed endsequent. We use u, v, w possibly subscripted to denote universal and eigenvariables of ¢. Let T(v) denote the typing expression for the variable v in ¢. DEFINITION 5.8 (Intrinsic typing context) The intrinsic typing context I(v) for each (eigen- or universal) variable v of ~b is defined inductively on the structure of the endsequent as follows:

I(v)

U

=def

(I(w), w:T(w)).

weFV(T(v)) ~1 denotes order-preserving union of orders; FV(M) denotes the set of free variables of the term M. [3

I(v) is well-defined since the endsequent is well-formed. Indeed, we have: LEMMA 5.9 I(V) t-~ T(v): Type. PROOF. By construction and the well-formedness of the endsequent (see Appendix 1 for the notion of a well-formed context). Let ¢ be compatible with the instantiation a. We give an inductive definition of the intrinsic typing context and type of a variable of ¢ under a compatible instantiation a. The induction is on the (well-founded) reduction ordering (<1 ~,~) over the domain of a.

DEFINITION 5.10 (X.(V) and T.(v)) Base. For all ~ C FV(~), define I~(v) = Z(v) ~ d T~(v) =

T(v). (~ is the empty instantiation.) Step. Given v E Dora(a), we assume that we have defined I~(w) and 7~(w) for all w e Dora(a) such that w <1¢,~ v (Inductive Hypothesis). Let Wl,W2,...,w~ be an enumeration of those variables declared in I~(v). By definition of <1~,~ and I(v), we have wi <1~,~ v for 0
Do(v) = l~(v) ~-~ T((v):Type Dk+l(v) = CUT( I,,(wj:)t- z wka:T~,(wk)

,

Dk(v)

),

0 <_ k < n.

If Dn(v) is the assertion: A f-Z C:Type, then define In(V)

:def

T~(~)

=dof C.

A

The "CUT" operation in the above definition is the admissible rule of transitivity (see Appendix 1). That is, Dk+l(v) is defined in terms of Dk(v) by the following inference figure:

z~(~k) ~ ~ko:T~(~k)

Dk+l(v)

Ok(.) CUT.

The cut rule is being used to effect substitution of the values (under a) of universal variables throughout the judgement starting from the "uninstantiated" intrinsic typing context and type.

246

The definition is well-formed since the context of the left premiss of each cut is a subcontext of the right premiss. (This follows from the construction of I(v).) The cut ~bove then serves to eliminate the declaration wk:T¢(wk) from the context of Dk(V), replacing wk by wka throughout the rest of the assertion. The enumeration taken is irrelevant since independent cuts commute. Consider Ia(u2) ]-E u2a:Ta(~2)

/a(ltl) I'2 Ula:Ta(Ul)

Dk(V)

Dk+l (v) Dk+2(v) and

I~(~) v~ ~:T~(~,~)

I~(~) v~ ~:T~(~)

D~(~)

In the first derivation wk = ul and wk+l = u~. In the second, wk = u~ and u,k+l = ul. If Ul and u 2 are assumed independent (i.e., unrelated via <1¢,o), we have ui • Dom(Io(uj)), i ~ j. Hence substitution of the value ula for u 1 does not interfere with substitution of the value u2a for u~, and Dk+2 = D~,+2. We can now state the desired well-typing condition for a in ~b. DEFINITION 5.11 (Intrinsic well-typing) a is said to be intrinsically well-typed in ~bjust in case for all universal variables a of ~, we have: Io(a) t-~ aa:T~(a). 0 The importance of the definition is summarized by: PROPOSITION 5.12 Ira is intrinsically well-typed in ~b, then it is intrinsically well-typed in all compatible permutations of ¢. In particular it is well-typed in O-compatible permutations. PROOF. Reference to the definition will show that the intrinsic well-typing of a in ¢ does not depend on the Ill structure of ~b. (In fact we deliberately forbade such dependence by our definition of <1¢,o-) Hence the conditions are unaffected by permutations allowed by the reduction ordering <1¢,~, which is itself unaltered by permutation (Corollary 5.6). For a 0-compatible permutation ¢* of ¢, the intrinsic typing context for a variable is a subcontext of the typing context in ¢*a. Since "Thinning" is admissible (Appendix 1), a is well-typed in ~b*. D In a similar vein, we state without proof the following: PROPOSITION 5.13 Ira is well-typed in a O-compatible derivation ~b, it is intrinsically well-typed

inC.

D

We can now define a computationally acceptable notion of R-proof. DBFINITION 5.14 (R-proof) An R-proof is a pair ( ¢ , a ) such that (1) ¢ is closed under a; (2) ¢ is compatible with a, and (3) a is intrinsically well-typed in ~b. D THBOltEM 5.15 For well-formed sequents F ~ R proves F=a s A

A, iff

U proves F ~ : A .

PROOF. (Only if.) Suppose (~b,a) is an R-proof of F ~:~ A. The Permutability Theorem gives us a permutation ¢* of ¢, closed under (hypothesis 1), and compatible with (hypothesis 2), the instantiation a. Hypothesis (3), via Proposition 5.12, ensures that a is well-typed in ¢*. Hence (¢*,a) is an U-proof. (If.) Let ( ¢ , a ) be an U-proof of F =~E A. By definition ~b is closed under a and a is welltyped in ~. Compatibility follows from Lemma 5.7, and intrinsic well-typing from Proposition 5.13. D

247

6

Some r e m a r k s

Instantiations are generated by a unification algorithm acting on putative axiom sequents. They are first checked for compatibility (occurs-check) and then for intrinsic well-typing. The incremental nature of intrinsic typing means that the unification algorithm can use the typing information to constrain its search. New values for previously uninstantiated variables may be used to eliminate those variables from the typing contexts of the remaining ones. No permutations need be calculated. We have been somewhat cautious in this development and allowed only H1 rules to migrate. As a consequence the basic structure of a derivation is largely fixed. The next step is to remove the ordering constraints induced by the propositional structure of the logic, perhap~ using unification here as was done in [Wal89] for first-order intuitionistic logic. The final result would be a matrix method in the style of Bibel [BibS1] or Andrews land81]. Closure instantiations are calculated by unification. In general, the substitutions calculated by the unification algorithm introduce new variables (i.e., variables that are not present in the original context) s. However, we require only those substitutions which are well-typed instantiations (under some reordering), and so for a a given R-derivation ¢ we accept (for further analysis) just those substitutions a which do not introduce new variables. The unification algorithm of [Pyre90] is both sound and complete for the calculation of such instantiations. 7

N o n - g r o u n d endsequents and logic p r o g r a m m i n g

We have considered ground endsequents and ground instantiations explicitly. The extension of R to non-ground endsequents is straightforward. A non-ground sequent together with a typing constraint 7- for its universal variables is considered to stand for the set of its well-formed ground instances. (The typing constraint consists of intrinsic typing contexts and types for each universal variable occuring in the endsequent, ensuring that the mutual dependencies do not render any extension of the initial reduction ordering cyclic.) This determines a set 8(7-) of ground answer instantiations. Any non-ground instantiation calculated from an R-proof (~p,or) of the sequent determines a set of ground well:typed extensions S¢,(7-). We consider non-ground endsequents because they have an interesting logic programming interpretation. A sequent F ~ z A may be interpreted ms a logic program in the following sense: • E determines a language, F a list of program clauses and A a query written in the language E. universal variables correspond to program variables or logic variables; these correspond to the logical variables of the programming language PaOLOG [CM84]. The whole sequent represents a request to compute a instantiation a for the universal variables of the sequent such that any ground extension a ~ of a renders the sequent Fa ~ ~ Aa r L-provable. We are exploiting the fact that the underlying lambda calculus of the ),g-calculus encodes a computation of type A; i.e., a terra M for which F ~-~ M:A. A full discussion of this notion of logic programming, including both operational (as presented here) and model-theoretic semantics, may be found in [Pym90] and in a forthcoming paper by the authors, where we also discuss the application of our techniques to a form of resolution rule which generalizes Paulson's higher-order resolution [Pau86] to the/~H-calculus.

Acknowledgements. The authors are grateful to Anne Salvesen, James Harland~ Robert Harper, Furio Honsell, Gordon Plotkin, Randy Pollack and two anonymous referees for helpful suggestions and comments. SIndeed, this is true of the basic algorithm for the simply-typed A-calculusof [Hu75]

248

References [And81] Andrews, P.B. Theorem-proving via general matings. J. Assoc. Comp. Mach. 28(2):193214, 1981. [AHM87] Avron, A., Honsell, F., Mason, I. Using Typed Lambda Calculus to Implement Formal Systems on a Machine. University of Edinburgh, 1987, ECS-LFCS-87-31. [Bib81] Bibel, W. Computationally Improved Versions of Herbrand's Theorem. In J. Stern, editor, Proc. of the Herbrand Symposium, Logic Colloquium '81, pp. 11-28, North-Holland, 1982. [CM84] Clocksin, W.F., Mellish, C.S. Programming in Prolog, Springer-Verlag, 1984. [Cur52] Curry, H.B. The perrnutability of rules in the classical inferential calculus. J. Symbolic Logic 17, pp. 245-248, 1952. [vDa80] van Da~len, D.T., The language theory of A U T O M A T H . PhD thesis, Technical University of Eindhoven, The Netherlands, 1980. [Gen34] Gentzen, G. Untersuchungen fiber das logische Schliessen, Mathematische Zeitschrift 39 (1934) 176-210, 405-431. [HHP87] Harper, R., Honsell, F., Plotkin, G. A Framework for Defining Logics. Proc. LICS '87. [HHP89] Harper, R., Honsell, F., Plotkin, G. A Framework for Defining Logics. Submitted to the J. Assoc. Comp. Mach., 1989. [Hu75] Huet, G. A Unification Algorithm for Typed A-calculus. Theor. Comp. Sci., 1975. [Kle52] Kleene, S.C. Permutability of inferences in Gentzen's calculi LK and LJ. Memoirs of the American Mathematical Society 10, pp. 1-26, 1952. [Kle68] Kleene, S.C. Mathematical logic. Wiley and Sons, 1968. [MR86] Meyer, A. and Reinhold, M. 'Type' is not a type: preliminary report, in Proc. 13th ACM Syrup. on the Principles of Programming Languages, 1986. [MilS3] Miller, D. Proofs in higher-order logic. PhD thesis, Carnegie-Mellon University, Pittsburgh, USA, 1983. [0h188] Ohlbach, H-J. A resolution calculus for modal logics. Proc. 9th Conf. on Automated Deduction, LNCS 310, 1988. [Pau86] Paulson, L. Natural Deduction Proof as Higher-order Resolution. J. Logic Programming 3, pp. 237-258, 1986. [Pra65] Prawitz, D. Natural Deduction: A Proof-theoretical Study. Almqvist &: Wiksell, Stockholm, 1965. [Pyre90] Pym, D.J. Proofs, Search and Computation in General Logic. PhD thesis. University of Edinburgh, forthcoming. [Rob65] Robinson, J. A machine-oriented logic based on the resolution principle. J. Assoc. Comp. Mach. 12, pp. 23-41, 1965. [Sa89] Salvesen, A. In preparation. University of Edinburgh, 1989. [Smu68] Smullyan, R.M. First-order logic, Ergebnisse der Mathematik, Volume 43, Springer Verlag, 1968. [Wal89] Wallen, L.A. Automated deduction in non-classical logics, MIT Press, 1989. Appendix 1 The AII-caleulus is closely related to the H-fragment of AUT-PI, a language belonging to the so-called AUTOMATHfamily. The ~II-calculus is a language with entities of three levels: objects, types and families of types, and kinds. Objects are classified by types, types and families of types by kinds. The kind Type classifies the types; the other kinds classify functions f which yield a type f ( x l ) . . . (xn) when applied to objects xl, ... ,xn of certain types determined by the kind of f. Any function definable in the system has a type as domain, while its range can either

249

be a type, if it is a,n object, or a kind, if it is a family of types. The MI-calculus is therefore predicative. The theory we shall deal with is a formal system for deriving assertions of one of the following shapes: F ~3 sig I-r. 12' context r t-~ K kind I' I-~ A: K r t-~ M: A

P. is a signature I' is a context K is a kind A has kind K M has type A

where the syntax is specified by the ~following grammar: ::=

0 J N,e:K

r

::=

0 I r,x:A

J P~,e:A

K A M

::= ::= ::=

c I t]x:A.B J Ax:A.B j AM c I x ] Ax:A.M J MN

Type J I I x : A . K

We let M and N range over expressions for objects, A and B for types and families of types, K for kinds, x and y over variables, and e over constants. We write A -* B for fix : A . B when x does not occur free in B. We refer to the collection of variables declared in a context r as Dom(r). We assume a-conversion throughout. The inference rules of the AII-calculus appear in Table 1. A term is said to be well-typed in a signature and context if it can be shown to either be a kind, have a kind, or have a type in t h a t signature and context. A term is well-typed if it is well-typed in some signature and context. The notion of ~r/-reduction, written ~Zn, can be defined both at the level of objects and at the level of types and families of types in the obvious way', for details [ttHP89]. M =an N iff M --*0n P and N --*0n P for some term P , where denotes transitive closure. For simplicity we shall write -'*0n for ~ } n " Since fl~-conversion over K U A U M is not Church-Rosser, so the order of technical priority in which the basic metatheoretical results are proved is crucial. The theorem below summarizes these results in a convenient order (here a ranges over the basic assertions of the type theory). The reader is referred to [HHP87], [HHP89] and [Sa89] for details of its proof. THEOREM (THE BASIC METATHEORY OF THE ~I]-cALCULUS)

1. Thinning is an admissible rule: if F F E c~ and t-~,~, [', F ~ context, then F, F' ~-~,~, a. 2. Transitivity is an admissible rule: if F ~-~ M: A and F, x : A, A I-z c~, then F, A[M/x] ~-~ c~[M/x]. 3. Uniqueness of types and kinds: if F F z M: A and F F z M: A I, then A =Zn At, and similarly for kinds. 4. Subject reduction: ifF ~-~ M : A and M ---**~M r, then F ~-~ M~:A, and similarly for types. 5. All well-typed terms are strongly normalizing. 6. All well-typed terms are Church-Rosser. Z Each of the five relations defined by the inference system of table 1 is decidable, as is the property of being well-typed.

250

8. Predicativity: if F P~ M : A then the type-free A-term obtained by erasing all type information from M can be typed in the Curry type assignment system. 9. Strengthening is an admissible rule: if P,z :A,F' f-~ a and if z q~ FV(F')U FV(a) then

F,F t bE c~. [] Valid Signature

(1)

k" 0 sig ~-E sig

f-~z K kind c C D o m ( E ) b E,c : K sig

(2)

~-E sig

~-~A: Type c•Dom(E) ~- E, c : A sig

(3)

F- E sig ~-E 0 context

(~)

t-E F context F t-~ A: Type x ¢ Dom(r) ~-~z F, x : A context

(5)

b~ F context F t--~ Type kind

(6)

Valid Context

Valid Kinds

F~-EA:Type F , x : A ~ - ~ K F F-~ [Ix : A . K kind Valid Elements of a Kind

kind

~-~F context c : K E E F ~-~ c: K F~-~:A: Type F , x : A ~ - ~ B : Type F ~-~ [Ix : A.B: Type F~-~A: Type F , x : A F ~ B : K F F-~ Ax : A.B: [Ix : A . K FI-~B:[Ix:A.K F~N:A F ~-~ B N : K[N/x]

F~-~A:K Valid Elements of a T y p e

F~-~K' kind F ~-~ A: K'

K=~,K'

(7) (s) (9) (10)

(11) (12)

f-~ F context c : A E E F ~-~ c: A

(13)

~-r~F context x : A E F F ~-~ x: A

(14)

F P ~ A : Type F , x : A b ~ M : B r ~-~ Ax : A.M: IIx : A . B F~-~ M : [ I x : A . B FPEN:A r ~-~ M N : B[N/x]

P~-~ M:A

F~-~X: Type F F-~ M: A' Table 1.

A=~nA'

(15) (16)

(17)

Equality of Terms Containing Associative-Commutative Functions and C o m m u t a t i v e Binding Operators is Isomorphism Complete* David A. Basin D e p a r t m e n t of A r t i f i c i a l I n t e l l i g e n c e University of E d i n b u r g h Edinburgh Scotland basin~aipna.ed.ac.uk.

Abstract We demonstrate that deciding if two terms containing otherwise uninterpreted associative, commutative, and associative-commutative function symbols and commutative variable-binding operators are equal is polynomially equivalent to determining if two graphs are isomorphic. The reductions we use provide insight into this result and suggest polynomial time special cases.

1

Introduction

Decision procedures for equality play an important role in automated theorem proving. We examine the complexity of a specific problem in reasoning about equality: determining if two terms, which possibly contain associative, commutative, and associativecommutative (AC) functions and commutative variable-binding operators, are equal. We prove that this problem is polynomially equivalent to deciding if two graphs are isomorphic. The exact complexity of graph isomorphism, and hence our problem, is still open. While graph isomorphism is clearly in NP, it has neither been proven NPcomplete nor has a deterministic polynomial time algorithm been found[9,14]. If one removes variable-binding operators, then polynomial AC-equatity decision procedures are trivial. For example, if A is an (infix) AC-function then we can normalize *Written at Cornell Universityunder the support of an IBM Fellowship.

252

the term sIA#2A...AZn by left associating and sorting the s~. More complex terms (e.g., the s~ themselves contain various associative and commutative functions) may be normalized by a bottom up traversal that left associates and sorts subterms as permitted by associativity and commutativity. Two terms are equal if and only if their normalized counterparts are identical. The presence of binding operators, such as 3 and V in predicate calculus, complicates equality reasoning. Equality of terms with bound variables must be considered modulo renaming of bound variables (a-conversion). However, a-convertible terms may normalize differently. Consider the following example, where, as before, A is associative and commutative, ~ is commutative, and ]'1 and f2 are distinct uninterpreted function symbols that are neither associative nor commutative. s

=

3u.3v.(fl(u,v)

A fl(v,u))

A f2(u,v)

t

=

3w.3x.fx(w,x)

A (f2(x,w) A fl(x,w))

These two terms are equal. If w and x in the second equation are renamed to v and u, the renamed term is normalized by sorting quantifiers lexicographically and left associating and sorting the conjuncts, then the equality becomes apparent. The critical point is that if we simply normalized s and t (s, as written, is already in the above described normal form) without renaming w and x, then the normal form of t, 3w.3x.(fl(w,x) A fl(X,w)) A f~(x,w), would not be a-convertible to s. Less trivial examples can be found in [3]. However even this simple example suggests, perhaps contrary to one's intuition, that our slightly extended equality problem is not likely to be as easy as the binding operator free problem. Of course, in the above example, simply comparing the two f2 terms tells us what the proper bound variable renaming should be. In general, the problem is not so simple. T h e difficulty arises because both subterms and binding operators may be reordered and this obscures what, if any, bound variable renamings would allow the terms to normalize to a-variants. If the binding operators do not commute 1, then equality again is decidable in polynomial time. For example, if A is a non-commutative variablebinding operator, then we can decide the equality of two terms tl = AXl.AX2 .... , Axe.s1 and t2 = ),Yl.AY2 .... , ~y~.s2 where the s~ contain associative and commutative function symbols by renaming each bound Yi by x i and normalizing tl and the renamed t2. Another polynomial case is when the binding variables commute, but all occurrences of function symbols are distinct. Here we can normalize terms by sorting based on function names. The sorted bodies would then suggest a renaming of bound variables such that sorting the (renamed) quantifiers would result in a-convertible terms. 1For example, in the lambda calculus, Ax.Ay.x is not equal to Ay.Ax.x. On the other hand, in predicate calculus, 3 does commute. That is 3x.3y.t(x, y} is equivalent to 3y.3x.t(x, y}.

253

These complications, caused by the addition of commutative binding operators to theories containing associative and commutative functions, do not arise in theorem provers designed around binding-variable free logics or equational theories; they occur in theories t h a t contain variable-binding constructs. Our theorem proving work has been in the Nuprl proof development system and Nuprl's logic, a constructive type theory, contains such constructs[6]. T h e context in which this problem arose is interesting in its own right. We have written a rewrite package for Nuprl and have recently extended it to allow rewrites driven by higher-order matching as described by Huet and Lang[12]. However, instantiating variables with functions necessitates naming new binding variables. Thus, even if a user a t t e m p t s to maintain the identity of binding variable names across different terms (in the hope that they will then normalize to a-convertible terms), rewriting itself may introduce incongruously named bound variables. It is surprising, to begin with, that the names of bound variables should cause so much concern. It is equally surprising that the combination of two established theorem proving techniques (rewriting and higher-order matching) should be so troublesome. Our work is similar to that of [4,15] in that they analyze the complexity of matching problems in the presence of associative and commutative function symbols. Indeed~ their result t h a t AC-Matching is NP-complete might suggest that our problem is also. However, their problem has much more latitude then ours. For example, the substitutions t h a t they consider need not be variable bijections which is required in our problem. Moreover, it would be very surprising if their NP-complete problems are reducible to our problem which we show to be isomorphism complete. Other work relevant to ours is t h a t of Bachmair and Plaisted on associative commutative term rewriting systems[2] and t h a t of Hultot[13] and Gramlich and Denzinger[10] on associative-commutative matching. However, none of these authors consider complications introduced by variable binding operators. Our paper is organized as follows. Section 2 contains preliminaries. Section 3 provides problem statements. Section 4 contains the proof that our problem is isomorphism complete. T h e final section considers special cases and draws conclusions.

2

Preliminaries

Terms Let T(V, 0 ) 2 be a collection of terms constructed from denumerable sets of variables V and operators O. We also admit the formation of terms called bound-id terms of the form Xl, x2, ..., x , . t (abbreviated ~.t) where t is a a non-bound-id t e r m and the x~ are binding variables that become bound in the body of t. We generalize the notion of functional arity to account for binding variables: T h e arity of an operator f in O is a 2We will usually omit V or O when the specific set can be determined from context.

254 list [/1, ...,/,], where l~. is the number of binding variables preceding the ith argument to f . An operator f whose arguments include bound-id terms is called a binding operator. As examples, if O is a denumerable set of function symbols, predicates, and propositional connectives, then T(O) contains the terms and formulas of a propositional calculus. If we add the binding operators 3 and V, which each take a single bound-id t e r m (e.g., 3x.t%~3(x.t)), then T(O) contains the terms and formulas of a predicate calculus. In our own work, O has been the set of Nuprl t e r m constructors, and T(O) has been the terms of Nuprl's type theory[6].

Substitution

A substitution a is a function from V --~ T that is the identity almost everywhere. Substitutions are extended to T in the obvious way aCf(~.tl .... , ~ . t , ) ) = f(~.aCtl),...,~,,.a(t,)) where f E O and the binding variables in ~ and their bound occurrences have been, when necessary, renamed to avoid capture. We represent the substitution t h a t maps the variables xi to the terms t, by [tx, t2, ..., t,,/zx, z~, ..., x,,]. For notational simplicity, in the remainder of the paper we shall assume that all bound-id terms bind a single variable.

Associative-Commutative

Equality

A binary operator f is associative when it satisfies

f(x, f(y, z)) = f ( f ( x , y), z)

(A)

for all x and y, and f is commutative when

f(x,y) = f(y,x).

(C)

We call a unary binding operator 8 3 commutative when 0(x.0(y.t)) : 0(y.0Cx.t)).

(C')

T h e predicate calculus operators 3 and V are commutative in the above sense. We call operators t h a t obey b o t h (A) and (C) At-functions and operators t h a t obey (C')

C-binding operators. 3We shall, as a matter of convention, name operators by Greek letters when they are known to bind variables, and use lower case Roman letters otherwise.

255

We assume t h a t equality is a reflexive, transitive, symmetric, and congruent relation. T h a t is: s = s

(1)

s = t

t = s

s =

=

tat

w ~

(2) s =

w

(3)

s = t =~ f ( s l , .... s,-1,a, Si+l, ...,sn) = f ( s l , . . . , S i - l , t , si+l,...,sn) s = t =~ x.s = x.t

(4) (5)

The fourth property, functional congruence, holds for all f of arity [ll, ..., l~,] and for every i < n. The final property, bound-id term congruence, permits congruence reasoning about bound-id terms. We also identify as equal a-convertible terms, that are those terms differing only in the names of their bound variables. x.s = y.s[y/x]

where y is not free or bound in s

(6)

We shall usually make use of these properties without mention. We call two terms s and t associative-commutative equivalent (denoted by s ~ t ) when s = t can be proven by using (A), (C), (C') and Equations 1 through 6 as axiom schemas and rules of inference (along with modus ponens). Equivalently, s ~ t if the above equations can be used to rewrite s and t to some identical term w.

3

Problem

Statements

Our proof t h a t deciding AC-term equality is polynomially equivalent (written as -:P) to Graph Isomorphism uses the following problems. 1. ( D i r e c t e d ) G r a p h I s o m o r p h i s m (referred to as DGI in the directed case and GI in the undirected case) I n s t a n c e : Two (directed) graphs G1 = (t71, El) and G2 = (V2, E2). Q u e s t i o n : Is G1 ~, G~? T h a t is, is there a bijection ¢ : 171 ~ (vi, vi) E E1 iff (¢(v,), ¢(vi)) E E27

V2 such that

2. L a b e l e d D i r e c t e d G r a p h I s o m o r p h i s m (referred to as LDGI) I n s t a n c e : Two directed graphs G1 = (171,E1) and G~ = (V2,E2) t h a t may have labels associated with their vertices and edges. Q u e s t i o n : Is G1 --, G2? T h a t is, is there a bijection ¢ : V1 --+ V2 such that (v,, vj) E E1 iff (¢(vi), ¢(vj)) e E2 and ¢ preserves edge and vertex labelings? 3. A C - E q u a l i t y o f T e r m s C o n t a i n i n g C o m m u t a t i v e (referred to as ACE)

Binding Operators.

I n s t a n c e : Two terms s,t E T ( O ) where O possibly contains associative and commutative functions and commutative binding operators. Q u e s t i o n : Is s ~ t ?

256

4

Equivalence P r o o f

Our proof proceeds in two parts. First we demonstrate t h a t GI polynomially reduces to ACE. Lemma 1 GI
Proof: Let Gx = (V1, El) and G~ = (V2, E2) be a given instance of CI. Let O, f , and g be distinct o p e r a t o r symbols, where 8 is a C-binding operator, f is an AC-function, and g is a commutative function. We now show how to construct terms S, t E T(V1 U V2, {8, f , g}), such that s ~ t if and only if G~ is isomorphic to G2. Let m = ]171[ and n = IE1]. Construct s by outermost binding the variables in 111 with m nested applications of 8. These binding applications are followed by nested right-associated applications of f to the n occurrences of g, which are in turn applied to the endpoint vertices of the edges in E~. T h a t is, if the kth edge in E1 is (V~k,Vjk) (ordered arbitrarily*), then the kth application of g in s will be g(vi~,vj,) Hence, s is O(V 1.... O(vE~.f(g(v,l , Vjl ) , f ( g ( v i 2 ' Vj2),''', f(g(V'n-- 1 , Vjn--1), g(v'n, Vjn)).o*). We construct t analogously using G2. polynomial time (in fact in log space).

/ v)

Both constructions may be accomplished in

Correctness is easy to establish. If ¢ is an isomorphism from G1 to G2, then s contains a subterm g(v,~,vj~ ) if and only if t contains either the s u b t e r m g(¢(v,k) ,¢(vj~)) or g(¢(vj~),¢(vi~) ) It follows that s ~ t . Conversely, if s ~ t , then there must be a renaming of binding variables in s, such that the resulting t e r m m a y be rewritten to t using (A), (C), (C') and Equations 1 through 6. This renaming is an isomorphism from G1 to G2. [] To prove the converse, we first define a function frontierf(t) which returns a list of subterms of t.

frontiery(t)

[

frontierf(al) @ ... @ frontierI(a,~ ) It]

if t = f(al, ..., an) otherwise

The operator @ appends its operand lists. We use the following well-known facts (e.g., [2,10]) about frontier in our proof. F a c t 1 If f is associative, frontierf(s) = [C1, ..., Ck], frontierf(t) = [D1, ..., Dk], and for 1 < i < k, Ci~-~Di, then s ~ t . F a c t 2 If f is an hC-function, and s and t are terms such t h a t frontierl(s ) is (pointwise) AC-equivalent to a permutation of frontierf(t), then s ~ t . 4Edges in G1 and G2 are unordered; this corresponds to g being commutative.

257

We m a y now prove: Lemma

2 A C E

Proof: We actually reduce A C E to L D G I . Proofs t h a t L D G I polynomially reduces to D G I m a y be found in [5,8]. A reduction of D G I to G I m a y be found in [5]. We provide a procedure p t h a t for any t E T(O) returns a rooted labeled directed acyclic g r a p h (LDAG) Gt which roughly corresponds to its parse tree. T h e reduction consists of applying this procedure to the two t e r m s t h a t comprise the instance of ACE. We define p by recursion on the s t r u c t u r e of t e r m s t E T(O). C a s e 1: t - c, where c is a constant Gt is a v e r t e x labeled by c. C a s e 2: t -- x, where x is a variable Gt is a v e r t e x labeled by x. C a s e 3: t -~ f ( t i , ..., t,) C a s e 3a: f is neither associative nor c o m m u t a t i v e Let Gt be rooted by a new vertex labeled by f with edges pointing to the roots of the Gt:. Label the edge to Gt~ with the integer i. C a s e 3b: f is c o m m u t a t i v e and is not associative (n = 2) Gt consists of a new vertex labeled by f , with unlabeled edges pointing to the roots of Gt~ and Gt2. C a s e 3c: f is associative and is not c o m m u t a t i v e (n = 2) Let Gt b e rooted by a new vertex v labeled by f . If [C1,.., C~] = frontiery(t), then for each i f r o m 1 to k, a t t a c h a directed edge f r o m v to the root of Gc~ and label this edge by i. C a s e 3 d : f is b o t h associative and c o m m u t a t i v e (n = 2) S a m e as Case 3c, except do not label the edges leaving v. C a s e 4: t =__ 8(x1.0(x~ .... 8(xn.t')...)) where the o u t e r m o s t t e r m constructor of t' is not 0 C a s e 4a: 8 is not c o m m u t a t i v e Let Gt be rooted by a new vertex v labeled by 0. Add an edge f r o m v to Gt,. In addition, add edges f r o m v to n new vertices wl, w2, ...,w, and label t h e / t h edge b y the integer i. For each w~, add edges from wl to the vertices in G~, labeled b y xi, and erase the "x~"-labels on these vertices. C a s e 4 b : 0 is c o m m u t a t i v e Same as Case 4a, except do not label the edges f r o m v to the wi. If s ~ t then some finite application of (A),(C),(C'), and bound variable renaming will rewrite s and t to some t e r m w. It is easy to check t h a t each such rewrite does not, up to isomorphism, alter the image of a t e r m under p. Conclude t h a t G~ ,.~ Gt. T h e converse is more complicated. Formally, we prove by induction on k t h a t for all t e r m s s and t where height(G,) < k and G, --~ Gt, then s ~ t . T h e function height

258

computes the height of its L D A G a r g u m e n t (i.e., the length of the longest path). We proceed by cases on the o u t e r m o s t o p e r a t o r of 8 (which m u s t be identical to the outermost o p e r a t o r of t since their images under p are isomorphic). C a s e 1: s =_ c, where c is a constant As G8 --. Gt, t m u s t also be c. C a s e 2: s ~ x, where x is a variable As Gs "~ Gt, t m u s t also be x. C a s e 3: s =_ f ( s l , ..., s,,) and t ~ f(tl,..., t,~) C a s e 3a: jr is neither associative nor c o m m u t a t i v e T h e n G8 ~ G~ establishes an isomorphism between G~, and Gt,. By the induction hypothesis, we have t h a t si'--~t~, and it follows (by congruence) that s~t. C a s e 3 b : f is c o m m u t a t i v e and is not associative T h e n G~ ~ Gt implies either G~ 1 .-- G~ and G , 2 --- G ~ , or alternatively, G81 --~ G~2 and G~2 ~ Gtl. Either case is possible as, unlike Case 3a, the edges leaving the roots f are unlabeled. In the first case, we have by the induction hypothesis t h a t slY:t1 and s2~t2 f r o m which s ~ t follows by congruence. In the second case s l ~ t 2 and s2~-tt and our result follows b y congruence and the c o m m u t a t i v i t y of f . C a s e 3c: f is associative and is not c o m m u t a t i v e G~ is a g r a p h rooted by f with children Go,,..., Gck and [C1,...,Ck] = Jrontierf(s ) Similarly Gt is a g r a p h rooted b y f with children GD,,..., GD~ where [D1, ..., Dk] = frontierf(t). Hence, G~ ~ G~ implies t h a t Gc~ ": GD, and, by the induction hypothesis, it follows t h a t Cig:Di. By Fact 1, s ~ t . C a s e 3d: f is b o t h associative and c o m m u t a t i v e S a m e as Case 3c, except t h a t the isomorphism f r o m G, to Gt only establishes t h a t some p e r m u t a t i o n of the G c , , . . . , G c k is isomorphic to the GD1, ..-, GD~. It follows by the induction hypothesis and Fact 2 t h a t s ~ t . C a s e 4: s = O(Xl.O(x2 .... O(x,.s')...)) and t =- O(y,.O(y~ .... O(y,~.t')...)) C a s e 4a: 0 is not c o m m u t a t i v e T h e n G, --. G¢ implies t h a t G~(,,) .-~ Gt, where a is the substitution [Yl, .-., y , / x l , ..., x,]. By the induction hypothesis, a(s')~t', and it follows t h a t O(y 1.... O(y,~.a(s'))...)~'--'O(y, .... O(y,.t')...). By renaming bound variables we conclude s ~ t . C a s e 4b: 0 is c o m m u t a t i v e S a m e as Case 4a, except t h a t a is a bijection from {x~, ..., x , } to {y~, ..., y,~}. P e r m u t i n g the names of binding variables does not effect AC-equality as 0 is c o m m u t a t i v e . [] P u t t i n g the previous two lemmas together, we conclude:

259

Theorem

5

1 A C E =_PGI

Discussion

We have given fairly direct reductions between graph isomorphism and AC-equality. In both directions, the reductions are efficient enough that a previously coded solution for either problem could be used as a decision procedure for the other. The reduction from ACE to GI also provides insight into the complexity of ACterm equality and the possibility of polynomial decision procedures for special cases. Observe that if we eliminate binding operators (and hence bound variables), then the labeled DAGs associated with terms would be labeled trees and we could decide equality by extending polynomial-time tree isomorphism algorithms[l] to handle vertex and edge labelings. This confirms our observation in the first section: AC-term equality is tractable in theories without binding variables. Even when binding variables are present, there are cases where deciding AC-equality is still tractable. For example, as planar graph isomorphism is decidable in polynomial time[ill, so is AC-equality when the corresponding term graphs contain no subgraphs contractible to K~ or K3,3. Non-planarity arises when terms share multiple bound variables across multiple subterms. For example, three independent subterms containing the same three bound variables will correspond to a graph containing a subgraph contractable to K3,s. We have recently been working in hardware verification[3]. Here, the terms we encounter are relations that represent devices and the only binding variables are existential quantifiers which represent internal wires and are shared by relations that are "wired together". In this domain, many gate-level devices have small fan-in and fan-out and, as a result, share few bound variables; their corresponding graphs are often planar.

Acknowledgements This work benefited from discussions with Doug Howe, Dexter Kozen, and Michael Slifker, and comments from the CADE referees.

References [1] Alfred Aho, John Hopcroft, and Jeffrey Ullman. The design and analysis of computer algorithms. Addison-Wesley, 1974. [2] Leo Bachmair and David A. Plaisted. Associative path orderings. In First International Conference on Rewriting Techniques and Applications, pages 241-254, Dijon, France, 1985.

260

[3] David A. Basin. Implementing Problem Solving Environments In Constructive Type Theory. PhD thesis, Cornell University, 1990. [4] Dan Benanav, Deepak Kapur, and Paliath Narendran. Complexity of matching problems. In First International Conference on Rewriting Techniques and Applications, pages 417-429, Dijon, France, 1985. [5] Kellogg S. Booth and Charles J. Colbourn. Problems Polynomially Equivalent to Graph Isomorphism. Technical Report CS-77-04, University of Waterloo, 1979. [6] Robert L. Constable et al. Implementing Mathematics with the Nuprl Proof Development System. Prentice Hall, 1986. [7] Nachum Dershowitz et al. Associative-commutative rewriting. In Eighty International Joint Conference on Artificial Intelligence, pages 940-944, Karlsruhe, West Germany, 1983. [8] M. Fontet. Automorphismes de graphes et planarite. Asterisque, 73-90, 1976. [9] Michael R. Garey and David S. Johnson. Computers and Intractability, A Guide to the Theory of NP-Completeness. W.H. Freeman and Company, 1979. [10] Bernhard Gramlich and JSrg Denzinger. Efficient A C-Matching Using Constraint Propagation. Technical Report SEKI Report SR-88-15, FB Informatik, Universit~t Kaiserslautern, 1988. [11] John Hopcroft and J.K. Wong. A linear time algorithm for isomorphism of planar graphs. In Proe. 6th Annual A CM Symposium on Theory of Computing, pages 172184, 1974. [12] G~rard Huet and Bernard Lang. Proving and applying program transformations expressed with second-order patterns. Acts Informatiea, 31-55, 1978. [13] J.M. Hullot. Associative-commutative pattern matching. In Proceedings of the IJCAI-79, pages 406-412, Tokyo, Japan, 1979. [14] David S. Johnson. The NP-completeness column: an ongoing guide. Journal of Algorithms, 9:426-444, 1988. [15] Deepak Kapur and Paliath Narendran. NP-completeness of the set unification and matching problems. In 8th International Conference On Automated Deduction, pages 489--495, Oxford, UK, 1986.

An Improved General E-Unification Method Daniel J. Dougherty and Patricia Johann Wesleyan University Middletown, CT 06457 ddoughe try@eagle, wesleyan, edu pjohann@eagle, wesleyan, edu

Abstract A m e t h o d for E-unification in arbitrary equational theories E is presented which directly generalizes the standard technique of Narrowing. The method is defined in terms of transformations on systems, building upon and refining results of Gallier and Snyder.

1

Introduction

We consider the problem of E-unification for arbitrary equational theories E, and present a refinement of a method due to Gallier and Snyder [GS89] which more closely approximates Narrowing [Fay79], and hopefully sheds some light on the boundary between arbitrary E-unification situations and E-unification under canonical E. We embrace the point of view that transformations on systems [MM82], [MMR86] provide a "proof theory" for E-unification, and can provide a framework for the development of unification algorithms (see, e.g., [Kir86]) and a setting for proving completeness results. The main argument in Section 3 leads to a short proof of the completeness of a transformation version of Narrowing and a particularly simple indication of the completeness of an improvement, Basic Narrowing, due to Hullot [Hul80]. The most convenient way to describe our main result is to compare our procedure with Narrowing and with the method presented by Gallier and Snyder. Let E be a set of equations. An E-unifier of terms A a n d / 3 is a substitution 0 such that OA =E OB. If E is empty, we speak of a unifier of (A, B). Given equations E whose left-to-right orientation gives a canonical rewrite system, Narrowing is a complete method for generating E-unifiers for a pair (A, B) which

262

proceeds as follows: select from E the left-hand side of an equation L --- R and from (A, B) a non=variable sub term, say, A / u , and treat the pair ( A / u , L) as a unification problem. If A/u and L have a most general unifier (mgu), apply that substitution to A, perform the rewrite step using L = R and continue, composing substitutions at each step, until a unifiable pair is found. Gallier and Snyder's main result in [GS89] is that for an arbitrary set of equations E, a complete set of E=unifiers can be found if this method is generalized by allowing L to be either side of an equation, putting no constraints on the relationship between A/u and L, and considering the pair (A/u, L) as an E-unification problem to be solved, i.e., added to the system. Now suppose we say that two terms top-unify if at least one is a variable or if they have the same function symbol at the head and the arguments pairwise top-unify (or equivalently, if term decomposition applies recursively until all pairs are variableterm pairs). Our main result is that for any E , a complete set of E-unifiers can be generated by a procedure that requires, in the notation above, that A/u and L top-unify and that the corresponding term decompositions be done immediately. The restriction to top-unifying pairs limits the non-determinism in the m e t h o d considerably. Perhaps more significantly, the difference between E-unification for canonical E and for arbitrary E can now be attributed to the distinction between unification and top-unification. At this theoretical level, our procedure looks more like Narrowing than like Gallier and Snyder's method. However, it is not suggested here that our method could directly lead to a practical general E-unification algorithm. The hope is rather that our results provide some insight into the nature of general E-unification and thus help contribute to future algorithms. E-unification was introduced by Plotkin in [Plo72]. The explicit use of transformations on systems as an approach to unification is due to Martelli and Montanari [MM82], b u t as Gallier and Snyder point out, it was implicit in Herbrand's 1930 thesis [Her30]. Kirchner was apparently the first to investigate the use of transformations in E-unification [Kir84], [Kir85], [Kir86]. We always assume that E is consistent. Our notation concerning equational logic is consistent with that of Huet and Oppen [HO82]. If .~ is a binary relation, we use * for its symmetric closure, , for its reflexive transitive closure, and ~'~" "; for the reflexive transitive closure of ~ i. The smallest symmetric and monotonic relation containing E and stable under substitutions is denoted by ~"~ .~. A dicrivation is a sequence of derivation steps, each of which looks like A[u ~- OL] , ~ A[u ~-- OR] for some substitution 0 and equation L = R from E. Terms A and B are convicrtiblic under E if A -" E B. Composition of substitutions is denoted by juxtaposition. The domain of a substitution a is denoted by Da. A substitution a is idicmpoticnt if Da is disjoint from the set of variables introduced by a. We write a < T if there is a substitution such that ~ a -= r, and a _<E r if there is a r I such that a _< r ~ and for every x,

263

r'(x) :: s r(x). To indicate that two substitutions a and r agree on a set X, we write a - r [X].

2

Systems and E-unification methods

D e f i n i t i o n 2.1 A system is a multiset of unordered pairs of terms. write S, (A, B) instead of $ U {(A, B)}.

We usually

An E-unifier of a system $ is a simultaneous unifier of each pair in $; the set of E-unifiers of $ is denoted UE($). A variable x is solved in S if there is a pair (x, A) E S with no occurrence of x in $ other than the one indicated; a pair is solved in $ if it is of the form (x, A) with x solved in S; a system $ is solved if each pair of $ is solved in $. A solved system $ =- {(x,, Ai)]i E I} naturally determines a substitution a, and we often write [a] to indicate the system determining a. Note that in case some pair consists of two solved variables we need to fix a convention a b o u t which of these is in the domain of a - assume that this is done once and for all. We identify various methods of transforming systems: D e f i n i t i o n 2.2

1. The set S T is

(a) T r i v i a l : $, (A, A) ::=~t~i~ $ (b) T e r m D e c o m p o s i t i o n :

$, (f(A1, ..., A,,), f(B1, ..., B,~)) :==~td$, (At, B1}, ..., (A,,, B,,) (c) V a r i a b l e E l i m i n a t i o n :

If (x,B) is not a solved pair, x ~ Vars(B),

$, (x, B) ==~,, $ [x := B], (x, B) where $ [x := B] is obtained by substituting B for x in every term in $. We write $ = ~ S' if S' is obtained from $ by one application of a transformation from S T . 2. The set T is obtained by adding the following transformation to S T : Lazy Paramodulation

$, (A,B) --->,p S, (A/u,L), (A[u +- R],B)

264

where u is a non-variable occurrence in A and L = R is a variant of an equation in E whose variables do not occur in S,
(A/u, L) the witness pair, and
A P a r a m o d u l a t i o n step is a Lazy Paramodulation step in which the witness pair actually unifies. We write

S, . The definition of Lazy Paramodulation in [GS89] requires that if L is not a variable, then A/u and L have the same head symbol, and that Term Decomposition be immediately applied. Unfortunately, the construction in that paper will not justify this constraint (see in particular the proof of Lemma 6.7 there). The intuition there was correct, however: the condition of top-unification is stronger and will be shown here to preserve completeness. We have the following strong form of completeness for S T , essentially due to Martelli and Montanari [MM82]. For every system S, each transformation in S T preserves the set of unifiers of S, and every sequence of such transformations out of S terminates. Moreover, if S is unifiable, then every S T sequence out of S terminates in a solved system determining an mgu for $. Sets of transformations naturally yield non-deterministic algorithms. We can try to constrain the non-determinism inherent in algorithms based on T along two parameters, either by restricting the places where an individual step can take place (as, for example, Paramodulation restricts Lazy Paramodulation) or by imposing a discipline limiting the choice of transformation to be applied. These are conceptually distinct ideas, and we find it convenient to analyze t h e m separately. Of course, Narrowing does both: D e f i n i t i o n 2.3 Narrowing is the non-deterministic algorithm determined by S T and Paramodulation, together with the constraint that each Paramodulation step as in Definition 2.2 is followed immediately by transformations in S T computing a n m g u o f
265

Narrowing is sound and complete for canonical E [Fay79], [HulS0], and the nondeterministic algorithm determined by S T together with Lazy Paramodulation is complete for arbitrary E [GS89]. To define Relaxed Narrowing we require some preliminary notions. D e f i n i t i o n 2.5 The decomposition of (A, B), denoted dee(A, B), is the system obtained by applying to (A, B) as many term decomposition transformations as possible. L e m m a 2.6 For any terms A and B, the following are equivalent: 1. A and B have the same symbol at each u which is a non-variable occurrence in both terms. 2. Each element in the set of pairs dee(A, B) has a variable as one of its elements. D e f i n i t i o n 2.7 A and B top-unify, written A - B, if either of the two conditions in the previous definition holds. D e f i n i t i o n 2.8 1. A R e l a x e d P a r a m o d u l a t i o n step is a Lazy Paramodulation step in which the witness pair top-unifies. We write S, (A, B I :==¢'rp $, ( A / u , LI, (A[u ~ R], B). 2. Relaxed Narrowing is the non-deterministic algorithm determined by S T and Relaxed Paramodulation, together with the constraint that each Relaxed Paramodulation step is followed immediately by all of the term decompositions that apply out of the witness pair. We write $ R ~ $~ if $~ is obtained from $ by one step of Relaxed Narrowing. We prove the completeness of Relaxed Narrowing below.

3

Completeness

in a s p e c i a l c a s e

In this section we give a quick proof of the completeness of our transformation version of Relaxed Narrowing when the given set of equations satisfies a certain closure property. Since every set of equations can be completed to be a closed set, this will provide a foundation for the proof of the general completeness of Relaxed Narrowing in the next section. A by-product of our treatment is a an easy proof of the completeness of Basic Narrowing.

266

This two-step strategy, of assuming a certain kind of completeness for the underlying equations first and then lifting that restriction, is the key idea in [GS89]. The first step there makes use of the notion of "unfailing completion", due to Bachmair, Dershowitz, Hsiang, and Plaisted [Bac87], [BDH86], [BDP87]. Our treatment is based on the observation that the stability of equational deduction under substitution turns out to be irrelevant when pursuing unification completeness, so we may as well treat variables as though they were constants. Gallier and Snyder introduce a novel representation of equational proofs (as certain sets of trees). We use ordinary equational derivations. D e f i n i t i o n 3.1 Let C be a set of equations. A binary relation > directs C if > is monotone, noetherian, confluent, and has symmetric closure ~ v ~. A set C of equations is closed if there exists a relation directing C. A term M is minimal if there does not exist an N such that M > N ; a substitution 0 is minimal if for all x in DS, 0(x) is minimal. We will see in the next section that whenever C contains all of its critical pairs, then C is closed. A relation directing a set of equations behaves in many ways like a rewrite relation, although it is not assumed to be stable. We will pursue this analogy in the next few paragraphs. If C can be oriented so that the resulting rewrite system R is canonical, we may take => to be R . C

The fact that => and ~ * generate the same equivalence relation means that if T => S then this fact is witnessed by an equational step T[u *- 5L] , c , T[u ~-- 5R] -~ S for some L = R from C. We also note that if L = R is an equation in C and ~L => tSR, then L is not a variable. If it were, that variable would be a proper s u b t e r m of R (recall that we are assuming consistency of our equations), so that 5L would be a proper s u b t e r m of ~R. But monotonicity of => would contradict the fact that => is noetherian. It follows that variables are minimal. In contrast to rewrite systems, if T[u *-- ~L] => T[u ~ 5R] then there may be variables of R not occurring in L. Say that such a :> step is proper if for each such y, ~(y) is minimal. As part of L e m m a 3.2 below, we will show that if there is any > step out of A, then there is a proper one. Observe that there are only finitely many proper > reducts of any term. Since => is confluent, whenever T ~ v S there is a P such that T >=> P and S =>> P . It follows that every term T is convertible under C with a unique minimal term, which we will denote T $ , and indeed that T >> T~. The key fact for us is that terms can be =>-reduced to their minimal forms by equational steps analogous to innermost rewrite steps:

267

L e m m a 3.2 Let C be closed by virtue of >, let W be a eoinfinte set of variables, and let T be a non-minimal term. Then there is a proper derivation step

T -- T[u +- 6L] > T[u +-- 6R] in which 6 is minimal and D6 A W = O. P r o o f . Choose u so that T / u is not minimal b u t every proper s u b t e r m of T / u is minimal. It follows that there is an equation L -- R from C and a substitution 6 w such t h a t T / u is of the form 6'L and 6tL > 6rR. Without loss of generality we may choose a variant of L = R whose variables miss W and restrict the domain of 6 t to these variables, so that D6 t A W -- 0 holds. Now, ~ is minimal on the variables of L, since L is not itself a variable, and so for each x e Y a r s ( L ) , 6'(x) is a proper s u b t e r m of T / u . Finally, we construct 6 by replacing 6'(y) by 6'(y) $ for each y occurring in R b u t not in L. The above arguments still apply to 6, so it remains to see that T[u *- 6L] > T[u *--- 6R]. If not, then (since T[u *--- 6L] =_ T[u ~ 6'L]) we would have the infinite chain

T[u ~ 6'L] > T[u ~-- 6'R] > T[u *- 6R] > T[u +- 6'L] > . . . contradicting the fact that > is noetherian.

[]

The next definition is the main technical tool in all of our completeness proofs. Note that since each term T has finitely many proper > reducts, Konig's Lemma yields an u p p e r b o u n d on the length of proper > sequences out of T. D e f i n i t i o n 3.3 Let C be closed by virtue of >. The degree of a term T is the length of the longest sequence of proper :> steps from T to T J,. For a substitution 0, the 0-degree of T is the degree of O(T). The 0-degree of a pair (A, B) is 0 if 0 unifies CA, B), otherwise it is the sum of the 0-degrees of A and of B. The 0-degree of a system is the sum of the 0-degrees of the pair-occurrences in the system. Although the degree of a term is only defined relative to a fixed C and directing relation >, this will cause no ambiguity below. Note t h a t if the 0-degree of a system is 0, then 0 unifies the system (by the uniqueness of minimal forms). The next lemma is the heart of the argument that Narrowing is complete for closed C.

268

L e m m a 3.4 Let C be closed. If # is a minimal C-unifier of S and the O-degree of $ is positive, then there is a C-unifier 01 of $ and a Paramodulation step $ >v $1 such that

• 01 iS minimal and 01

O[Vars($)].

* (Ox-degree of S1) < (O-degree of $). P r o o f . Without loss of generality, DO C Vars($). Choose (A,B) from $ so that A has positive 0-degree (note that A cannot be a variable since 8 is minimal). By Lemma 3.2 there is a > reduction

OA[u +-- 6L] > OA[u ~ 6 R] in which $ is minimal and D6 n Vars(S) = ~. Take 01 to be 0 U 6. The first assertion is clearly satisfied. Since 01 unifies A / u and L, the following is a Paramodulation step:

S -~ $', (A, B) ==~v $', (A/u, L), =- Sx. The second assertion follows from the observations that 01 agrees with 8 on S t, 8x unifies (A/u, L>, and the 01-degree of A[u +- R] is less than the 01-degree of A. [] P r o p o s i t i o n 3.5 Let C be closed, and let 0 E Uc($). Then there is a sequence of transformations S ==~v g and a substitution 0 such that the O-degree of g is 0 and

,, % 0 [ V a t s ( s ) ] P r o o f . Without loss of generality, 0 is minimal. The proof is by induction on the 0-degree of S. If the degree is greater than 0, the previous lemma applies, yielding minimal 01 and St. By induction, we have S and 0 such that $1 ==~v S, the 0degree of S is 0, and 0 , c Ot [Vars(S)]. But since Vars(Sl) 2 Vars(S), S and/7 are as desired. [] Since a canonical rewrite system is a presentation of a closed set of equations, we can now show the unification completeness of Narrowing. C o r o l l a r y 3.6 Let C be closed and suppose 0 E Uc($). Then there is a Narrowing sequence yielding a [a] with a
269

need to argue that we may rearrange the computation so that S T steps can be performed as soon as they present themselves. But this is easy to see by an argument based on the 0-degree. Each witness pair (M, N ) is generated in the proof above has 0-degree 0. Applications of Trivial and of Term Decompesition out of this pair yield pairs with 0-degree 0. As for a Variable Elimination (using, for example, (x, A)), it is easy to see that Ox ~- OA implies that for any t e r m M , OM ~ O(M[x := A]). Therefore, no S T step disturbs the 0-degree of the system, and the induction can proceed just as above. [] The reader familiar with Basic Narrowing will observe that when the original system consists of a single pair (A, B ) , the sequence constructed in the proof of the Corollary is automatically based on the set of non-variable occurrences in (A, B). We conclude that Basic Narrowing is a complete refinement of Narrowing. Finally, we observe that in closed theories we can solve systems by a sequence of Relaxed Narrowings (as opposed to Narrowings) - this is the basis for the proof of general completeness of Relaxed Narrowing in the next section. C o r o l l a r y 3.7 Let C be closed and suppose 0 E U c ( $ ) . sequence S ~ = ~ [°1 ,,,ith ° < ° 0 [Vars(S)].

T h e n there is a a and a

P r o o f . J u s t as in the proof of the previous Corollary, we may immediately do all of the Term Decompositions which arise after a Paramodulation, and so construct a Relaxed Narrowing sequence. We complete the computation by S T steps, if necessary. [] The question naturally arises whether S T steps can be safely applied at any time during an arbitrary computation. It is not hard to see that the answer is, in general, no. For example, application of Term Decomposition in the presence of a c o m m u t a t i v i t y axiom is likely to lose some unifiers. Less straightforward is the issue of applying the partial substitutions (via Variable Elimination) which arise during a computation. This is the "Eager Variable Elimination" problem. The advantage of applying a partial answer substitution during the c o m p u t a t i o n of an entire answer is that filling out the term pair to be C-unified can block some future Paramodulation guesses by preventing the (potential) witness pair from unifying - this prunes the search space. On the other hand, the induced replication of terms substituted throughout the system seems to provide more occurrences at which to a t t e m p t a Paramodulation step. Basic Narrowing arises from the insight that one can resist Narrowing at any of the occurrences created by the substitution being computed. It is not hard to see that Variable Elimination does not change the set of C-unifiers of a system, b u t the strategy of Eager Variable Elimination for the transformations appropriate to arbitrary sets of equations is not known to be complete (for a discussion, see [GS89]). In the absence of a constraint analogous to that of Basic

270

Narrowing, though, Eager Variable Elimination may be a red herring. It is not clear t h a t the potential elimination of some current occurrences as Lazy P a r a m o d u l a t i o n candidates is worth the proliferation of new subterm occurrences in the system.

4

Completeness of Relaxed Narrowing

The previous section showed how to compute E-unifiers using S T steps and Paramodulation relative to a closed set of equations. In this section we give a naive completion procedure to yield a closed set C*(E) from an arbitrary set E, and (almost) lift the original construction from C*(E) to E, but the price we pay is t h a t we cannot restrict ourselves to Paramodulation. Rather t h a n insisting t h a t the witness pair unify we can only require t h a t the pair top-unify. D e f i n i t i o n 4.1 For any set E of equations, a critical equation of E is an equation a R = aL[v +- aT], where L --- R and S = T are equations in E , v is a nonvariable address of L, and L / v and S are unifiable with most general unifier a. Let C(E) be E together with its critical equations. Ck+I(E) = c ( C k ( E ) ) , and C*(E) = U Ck(E) •

Then define C°(E) = E,

L e m m a 4.2 For any E, C*(E) is closed. P r o o f . Let us write C for C*(E). Define any total noetherian relation >- on the function symbols together with the variables. Extend ~ to terms by comparing the size of terms, breaking ties by comparing head symbols, and if necessary, comparing immediate subterms from left to right. Let > be ( c ~ A >-. It is easy to check t h a t > is monotone and noetherian, and t h a t > has symmetric closure ~ c ~. In order to show confluence of > , it suffices to show local confluence. Suppose M > N and M > P. If the redexes of the derivation steps witnessing the > reductions are either disjoint or overlap below a variable address of the larger, the monotonicity of ~ ensures the existence of a common > r e d u c t Q. Otherwise, the facts t h a t C contains all of its critical equations and t h a t >- is total ensure t h a t eitherN>PorP>N. [] The key result is the Simulation L e m m a below, to the effect t h a t any critical equations added for the sake of the arguments in the previous section can be removed in favor of applications of Relaxed Paramodulation. It is not possible, in general, to compute critical pairs by Paramodulations - it is precisely here t h a t general E-unification parts company with the canonical case. The Simulation L e m m a is indebted to L e m m a 6.7 of [GS89], but we do a more delicate simulation which allows us to preserve at least some of the "unifiability" of the witness pair in question.

271

L e m m a 4.3 ( S i m u l a t i o n L e m m a ) Suppose $o ~ $1 using an equation from C(E), and let W be a coinfinite set of variables disjoint from those in the step So R ~ $1. Then there exists an idempotent a such that D a N W = 0 and $o ~ > $1, [0"] using equations from E. P r o o f . The proof is given in Section 5.

[]

L e m m a 4.4 Suppose D a n (Vars(S)) = O. Then $ ~ > - T implies $, [a] = ~ > T , [a t] for some substitution a t such that D a t c_ Dcr. Furthermore, a' is idempotent if cr is, and no variables appear in the sequence $, [a] R~>_ T , [a] which are not present in the sequence $ R~>_ T . P r o o f . It suffices to consider the cases in which S goes to T by a single S T step or a single Relaxed Paramodulation step. If $ ;-tri~ T, $ ~ t d T , or $ :-rp T , we can take a' to be a. If $ - $o,(x,N) ==~e (S0)[x := N ] , ( x , N ) , take a' to be a[x := N] restricted to the domain of a. Recall that we only do variable elimination on x if x is not solved in $. T h e n since D a N Vars($) = 0, no Yi is identically x. So $,[a]

--~, ~

$ ' , ( x , N ) , { ( y , , M i ) [ i e I} ($')[x :----g ] , ( x , g ) , { ( y , , ( M ~ ) [ x := N])[i C I} - T,[o']

T h e n a' is idempotent since x ~ N, and Da' n Vars(T) c_ Da A Vars(T) = Da n Vars($) = 0. [] T h e o r e m 4.5 Suppose S R ~ . ~ using equations in C(E) and suppose 0 unifies $. Then there exists a sequence of transformations $ R~,_ ~, using equations in E and a substitution ~ such that 05 =- 0 on Vats(S) and 85 unifies $'. Proof.

By induction on the length of the sequence $ R ~

~. Suppose S R ~

Let P and r / b e obtained by the induction hypothesis on the sequence $1 R~,~ ~, so t h a t $1 R ~ /5 using equations in E and 0r/unifies/5, O r / - O[Yars(S1)]. Using the Simulation L e m m a on the step $ ~ . - $1 with the protected set W including all the variables of $ together with the variables appearing in the derivation $1 =~>- /5, we get an idempotent a such that D a fq W = 0 and $ R~>_ $1, [a] using equations in E . Now Vars($1) fq D a = O, so Lemma 4.4 yields an idempotent a' such that Da' C Da and $1, [a] R % /5, [a'] for some a', using equations in E. Let 5 - rla' and let S' -- 15, [a']. It remains to verify the claims about 05. First, 05 unifies/5, [a']: Orla' unifies [a'] by idempotence of a', and it unifies/5 since Da' fq Vars(/5) = 0 by our choice of protected set W, so that O~a' - Orl on Vats(~5).

272 Next, 08 = O[Vars($)]: Orl = 0 on Vars($1) by the induction hypothesis. But a' is the identity on the variables of $, since D a I C_ D a and D a N V a r s ( $ ) = O. So Otla' =- 0 on Vars( $ ). [] T h e o r e m 4.6 Relaxed Narrowing is complete for any E . P r o o f . Let S be a system and let 0 C UE(S). Expand E to the closed set C*(E). Corollary 3.7 applies, and we find a sequence of C* (E) transformations $ R~_ [a], with a <_E O[Vars($)]. Any such sequence of C*(E) transformations uses only C k ( E ) transformations for some k, so iterate the above theorem to get a sequence of E transformations $ R ~ >- $' and a 6 such that a6 unifies $' and a6 z- a[Vars($)]. Finally, apply S T steps to arrive at a [r], with r < a6[Yars($)] =_ a[Vars($)] <_F.O[Vars(S)]. []

5

Proof of the Simulation

Lemma

Write O(A) for the set of occurrences in A, and use the convention that if v is not an occurrence in a term X, X[v *--- Y] _~ X . Lemma

5.1

1. a A "~ 5B implies A ~ B .

2. When v e O(A) D O ( B ) , A ~- B implies A / v "~ B / v . 3. If A ~ B then A[v ~ X] "" B[v ~-- Z]. 4. If v ~ O(A) then A ~ a(L[v *-- T]) implies A " n. 5. If v e O ( A ) , then A ~ a(n[v ~ T]) and a = m g u ( L / v , S ) and A[v ~-- S] "~ L.

imply A / v ~ T

P r o o f . The first three assertions are clear from part (i) of Lemma 2.6. Similarly, (iv) is clear once we observe that by (i), A ~ L[v ~ T]. The first part of (v) follows from (i) and (!i). For the second part, note that A[v *- S] ~- a(L[v ~ S]) ~ a(n)[v ~-- aS] = aL; then apply (i). [] It will be helpful to have some notation concerning decompositions: D e f i n i t i o n 5.2 Let v be an occurrence in A. Then _L~ (A) is the set of addresses in A of minimal length among those incomparable with v.

273

It is easy to check that if A -~ B and v is an address of b o t h A and B, then _1_~ (A)=2_,, (B), and (A,B)----~.~t,~ < A / v , S / v ) , { ( A / w , B / w ) t w E.l.~ (A)}. We can now give the proof of the Simulation Lemma. [ S i m u l a t i o n L e m m a ] Suppose So R~ $1 using an equation from C(E),

Lemma.

and let W be a eoinfinite set of variables disjoint from those in the step So ~ St. Then there exists an idempotent a such that Da N W = 0 and S0 ~ $1, [a] using equations from E. P r o o f . Suppose $0 R ~ $i involving the critical equation aR = aL[v +-- aT] from E , with L = R and S = T variants of equations in E such that every variable occuring in either variant is outside the set W, and suppose a -~ m g u ( L / v , S ) . Then a is, without loss of generality, idempotent, and D a n W = 0. We arrange that such a a has the desired properties. There are two possible forms for the transformation So R ~ $1:

I. $o = $',,(A[u +-- aL[v ~ aT]],B> -~ $1 and II. $o =- $', (A,B) ~

$',dec(A/u,a(L[v ~ T])), (A[u +-- aR],B) =_ $1.

In case the transformation is as in I, we mimic the derivation dependent on critical equations by the following derivation, which uses equations only from E:

$o =n~

$', (A,B) $',dee(A/u,R>, (A[u ~- L],B>

R~ ST.. .,.~ ST,~,.

$',dec(A/u,R),dec(L/v,S>,(A[u +- L[v ~ T]],B) $',a(dec(A/u,R)),[a], (A[u ~- an[v ~ aT]],B> $',dee(a/u,aR>, [a], (A[u ~- aL[v +-- aT]],B>

-

Sl, [o].

Notice that in passing from the third to the fourth line above we use S T to compute a. We also use the fact that dec(a -= (A/uv',a(L/v'[t ~T])), {dec(A/uw,an/w)[w E'±~, (L)}, so that

$x --

$', (A[u ~-- aR],B>, (A/uv',a(L/v'[t ~ T])), {dee(A/uw,aL/w}lw E,l,o, (n)}.

274

We mimic this derivation in E by

So =--=

=~>-

S', (A,B> $',dec(A/u,L}, (A[u ~-- R],B} S', $',dec(L/v't,S), ((L/v')[t ~- Ti,A/uv'), {dec(A/uw,L/w)tw C_I_~,(L)}, (A[u +-- R],B) $', [a], (a (L/v')[t ~-- aT], A/uv'), {dec(A/uw, an~w)Iw E_Lo, (n)}, (A[u ~ aR], B) &, [o],

For v an address of A/u, we write dec(A/u,a(L[v *- T])) from S1 as dec(A/uv, aT), {dee(A/uw,aL/w)lw eJ_~ (L)}, so that

$o =-:~ -~>-= _=

S',{(A,B)} $',dee(A/uv, T), {A[uv +-- S],B) $',dec(A/uv, T},dec(A[uv +- S]/u,L), ((A[uv +- S])[u *-- R],B} S',dee(A/uv, T),dee(A/u[v *-- S],L), (A[u +-- R],B) $',dee(A/uv,T),dee(S,L/v), {dec(A/u[v ~-- S]/w,n/w)Iw e_L~ (n)},(A[u e- R],B) S',dec(A/uv, T),dee(S,n/v), (A[u *-- R],B), {dee(A/u[v +- S]/w,L/w)lw e_L~ (L)} S',dee(A/uv,aT), [a], (A[u *---aR],B), {deetw E_L~ (L)} S',dec(Aluv,aT>, [a], , {deetw E_L~ (n)} &, [o]

using E. Notice that all Relaxed Paramodulation steps in the simulations are justified by Lemma 5.1. [] A c k n o w l e d g e m e n t s . The authors are indebted to Wayne Snyder for several instructive discussions. Thanks also to Jim Gibson.

References [Bac87] L. Bachmair Proof Methods for Equational Theories. Dissertation, University of Illinois, Urbana Champaign, 1987.

275

[BDH86] L. Bachmair, N. Dershowitz, and J.Hsiang. Orderings for Equational Proofs. In Proc. Syrup. Logic in Computer Science, pp. 346-357, 1986. [BDP87] L. Bachmair, N. Dershowitz and D. Plaisted. Completion without Failure. In Proceedings of CREAS, May 1987. [Fay79] M. Fay. First-order Unification in an Equational Theory. In Proceedings of the Fourth Workshop on Automated Deduction, Austin, Texas 1979.

[GS89]

J. H. Gallier and W. Snyder. Complete Sets of Transformations for General E-Unification. In TCS 67:2,8, pp. 203-260, 1989. Also presented at RTA, 1987.

[Her30] J. Herbrand. Sur la Theorie de la Demonstration (Dissertation, 1930). In Logical Writings, W. Goldfarb, ed., Cambridge, 1971.

[HO821 G.

Huet and D. C. Oppen. Equations and Rewrite Rules: A Survey. In Formal Languages: Perspectives and Open Problems, R. V. Book, ed., Academic Press, NY, 1982.

[HulS0] J-M. Hullot. Canonical Forms and Unification. In Proceedings of the Fifth International Conference on Automated Deduction 1980. [Kir84] C. Kirchner. A New Equational Unification Method: A Generalization of Martelli-Montanari's Algorithm. In Proceedings of the Seventh International Conference on Automated Deduction, 1984. [Kir85] C. Kirchner. M~thodes et Outils de Conception Systematique d'Algorithmes d'Unification dans les Theories Equationnelles. Th~se d'Etat, Universit~ de Nancy I, 1985. [Kir86] C. Kirchner. Computing Unification Algorithms. Presented at LICS, 1986. [MM82] A. Martelli and U. Montanari. An Efficient Unificaton Algorithm. In A CM Transactions on Programming Languages and Systems 4:P, pp. 258-282, 1982. [MMR86] A. Martelli, C. Moiso, and G. F. Rossi. An Algorithm for Unification in Equational Theories. Presented at the Third Conference on Logic Programming, 1986. [Plo72] G. Plotkin. Building in Equational Theories. In Machine Intelligence 7, pp. 73-90, 1972.

Some Results on Equational Unification PMiath Narendran*

Friedrich Otto

Department of Computer Science

Department of Mathematics

State University of NY at Albany

University of Kassel

Albany

3500 Kassel

NY 12222

West Germany

Abstract

A clear distinction is made between the (elementary) unification problem where there is only one pair of terms to be unified, and the problem where many such pairs have to be simultaneously unified - it is shown that there exists a finite, depthreducing, and confluent term-rewriting system R such that the (single) E-unification problem rood R is decidable, while the simultaneous E-unification problem is undecidable. It is also shown that E-unification is undecidable for variable-permuting theories, thus settling an open problem. The corresponding E-matching problem is shown to be PSPACE-complete.

1

Introduction and Basic Definitions

Equational unification (or 'E-unification' for short) is an important problem in automated reasoning. It is of special interest in provers using Knuth-Bendix-style completion methods, since certain equations such as commutativity of a function have to be "built into" our proof steps. An important equational unification problem that has been extensively researched is associative-commutative unification, in order to handle functions that are both associative and commutative [1, 5, 6, 14]. The reader is referred to [13] for an extensive survey of the area. The theory of equational unification is however less well understood than that of standard unification (or 0-unification). For instance, even the definition of equational unification allows several (meaningful) variations; e.g., *This work was supported by the Natural Sciences and Engineering Research Council of Canada. It was done while this author was visiting the Dept. of Computer Science, University of Calgary, Alberta, Canada T2N 1N4.

277

(1) Do we allow the input terms to have function symbols that are not present in E? (2) Are we unifying one pair of input terms or many pairs simultaneously? Clearly, if we go by (1), then (2) is meaningless to ask since the simultaneous case can be transformed into the single case. Note that this is the situation in standard unification, since E = 0 there. Hence the distinction is important only for elementary E-unification, i.e., E-unification where extra uninterpreted function symbols are not allowed. It was known that the two problems are not quite the same, since they have different unification types [4]. We show in this paper that single unification and simultaneous unification problems are different from one another for elementary equational unification by exhibiting a theory E (in fact, a canonical term-rewriting system) for which the former is decidable but the latter is not (Theorem 3.20). Thus the distinction between the two is made sharper. An open problem (raised by Schmidt-Schauss [11]) in this area has been the following question: if an equational theory consists only of variable-permuting equations, then is its E-unification problem decidable? Here an equation el = e2 is said to be variablepermuting if e2 can be obtained from el by a permutation of variables. We give a negative answer to the question (Theorem 4). The corresponding E-matching problem is shown to be PSPACE-complete. The proofs of these results make heavy use of the theory of string-rewriting systems or Thue systems [2]. Our proof techniques also gave us a new result in this area, on a problem related to cancellativity of semigroups. We present this result (Theorem 2.4) first, in Section 2. Section 3 outlines the construction of the equational theory E, referred to before, for which single unification problem is decidable, but the simultaneous case is undecidable. The undecidability of the unification problem for variable-permuting theories is presented in Section 4.

Equational Theories Definitions of some of the basic terminology of rewrite rule theory that we later use are given below. For a more extensive list of definitions and survey of basic results the reader is referred to [8]. A term rewriting system 7~ is a finite set of oriented equations {ll ~ rill E N} where li and ri are terms, and Var(ri) C Var(l~). These oriented equations are commonly called rewrite rules or simply rules. The set of function symbols occurring in T~ is referred to as its signature. A term t is reducible modulo 7£ if and only if there is a rule I --* r in 7£, a subterm t' at occurrence p of t, and a substitution a such that a(l) = t'. The term tip *- a(r)] is

278 the result of reducing t by l --+ r at p. The reduction relation --~ associated with a term rewriting system R is defined as follows: s - - ~ t if and only if there exist an occurrence p in s and a rule l -+ r in R such that t is the result of reducing s by l ~ r at p. A term t is said to be in normal form or irreducible modulo a term rewriting system R if and only if no reduction can be applied to t. Two terms s and t are said to be joinable modulo a term rewriting system R if and only if there exists u such that s -+~ u and t ---~ u. The equational theory E associated with a term rewriting system R (sometimes written $ ( ~ ) for clarity) is the set of equations obtained from 7"~ by treating every rule as a (bidirectional) equation. The equational congruence =~ is the congruence (--*TzU +--7~)*. A term rewriting system 7E is said to be noetherian if and only if there are no infinite sequences of reductions, i.e., for each t e r m t, the sequence t -+Tz tl --~Tz "-" is finite. A term rewriting system 7E is confluent if and only if for all terms t, u, and v * u A t -'+7~ *v) (t --+~

3w(u -~7~ *wAy

-~R

It can be shown that a noetherian term rewriting system 7~ is confluent if and only if it is locally confluent. A term rewriting system is said to be canonical (or complete) if and only if it is noetherian and confluent. Two terms s and t are said to be unifiable modulo an equational theory E if and only if there exists a substitution 0 such that O(s) =E O(t). If E has a canonical term rewriting system R, i.e., there exists a canonical system R whose associated equational theory is E, then this is equivalent to having 0 such that 0(s) and O(t) are joinable modulo R. In this case we sometimes say "s and t are unifiable modulo R." An equation el = e2 is said to be variable-permuting if and only if there is a permutation 7r of variables in el such that e2 = 7r(el). An equational theory is said to be variable-permuting if and only if every equation in it is variable-permuting. An example of a variable-permuting theory is C = {f(x, y) = f(y, x)} (commutativity).

Thue

systems

A Thue system T on an alphabet Z is a finite set of pairs of strings from E*. A pair (l, r) is often referred to as a rule. For a rule (l, r), l is said to be its left-hand side and r its right-hand side. The set of all left-hand sides of a Thue system T is denoted by domain(T) and the set of its right-hand sides is denoted by range(T). The congruence generated by T, denoted by ( ~,, is the reflexive, symmetric, and transitive closure of the relation --*T defined as follows:

"-~T = {(xty, xry) I (I,r) E T , x, y E E * } If x ~ ~ y, then x and y are said to be congruent modulo T. The reflexive, transitive closure of the relation ~ T , denoted by ~ , is often referred to as the reduction relation

279

induced by T on E*. If x ~ y then we say 'x reduces to y modulo T'; here x is said to be the a n c e s t o r of y modulo T and y is said to be x's descendant modulo T. (The phrase 'modulo T' is often abbreviated as 'mod T'; it is usually omitted if the Thue system under consideration is obvious from the context.) We often refer to the relation "-~T as a r e d u c t i o n step. Two strings axe said to be joinable if and only if they have a common descendant. A string is said to be irreducible if and only if it has no descendants other than itself. The set of all irreducible strings is denoted by I R R ( T ) . The relation ~ T is said to be: - length-reducing if and only if x ~ T Y

implies ]x{ > tYt for all x, y.

- l e n g t h - p r e s e r v i n g if and only if x OT Y implies Ixl = lY[ for all x, y. - n o e t h e r i a n if and only if for no x is there an infinite chain of the form X ~ XO --~T Xl --+T X2 " ' ' "

- c o n f l u e n t if and only if the following holds: for all x, y, z, x - ~ y and x --+~ z

implies there exists a u such that y - ~ u and z ~

u.

Note that if "-'~T is length-reducing, then it is clearly noetherian. If --*T is both noetherian and confluent, then every string in E* has a unique irreducible descendant modulo T. A Thue system T is said to be m o n a d i c if and only if Ill > jr I and Iv] < 1 for every rule (l, r) in T. It is said to be length-reducing (length-preserving, noetherian, confluent) if and only if the corresponding relation --*T is length-reducing (resp. noetherian, confluent). For a string x, < x > denotes the set of its ancestors; i.e.,

<x> = {y I y-%x}. Its congruence class is denoted by [x]; i.e., [x] = {y ] x , ,*y}. For a set of strings L, [L] denotes the union of the congruence classes of strings in L, namely, the set {Y I 2x E L : x , ,*y}.

2

E-Unification

and

Thue

systems

This section is mostly on Thue systems. It is shown (Theorem 2.4) that there exists a length-reducing and confluent Thue system T such that the problem of determining, given

280

strings u and v, whether there exists a "right-multiplier" string w such that uw ~ ~. vw is undecidable. From ([7], Proof of Theorem 8.8, pp. 196 if) we see the following: If M = (Q, z, 6, qo, F ) is a single-tape Turing machine (TM), then there exists a set of pairs of non-empty words SM = {(x~,yi) [ i = 2 , . . . , k } , C F + × F +, where Y = Q o E U {#}, such that the following two statements are equivalent for each word w E E*: (1) M accepts on input w, i.e., w E L(M), and (2) the modified Post Correspondence Problem SM,~, = { ( # , # q o w # ) } U SM has a solution, i.e., there exists a sequence of integers i l , . . . , i = E {2,..., k} such that # x 6 . . . xl. = #qow#yil... Yl.. N o t a t i o n : "SM,~, has a solution" is expressed as "MPCP(SM,~,) holds." Let a : F* H {a, b}* be an encoding such that c~(F) C {a, b}l for some integer l _> 1. Define S ~ = {(a(xl), a(yl)) I i = 2,..., k} C {a, b}+ x {a, b}+. Then the following two statements are equivalent for each word w E E*: (1) w E L(M), and (2) MPCP(S~,~,) holds, where S~,~ = { ( ~ ( # ) , a ( # q o w # ) ) } U S~. Let M be a TM such that the language L(M) is non-recursive. Then the following problem is undecidable in general: I N S T A N C E : Two non-empty words xl,yl E {a, b} +. Q U E S T I O N : Does MPCP({(Xl, y~)} U S ~ ) hold? In what follows let S = S ~ C {a, b}+ × {a, b}+. For simplicity we write S = {(xi, Yi) l i = 2,...,k}. L e t A = {a,b, al, bl, cl,c2, c, dl,d~,d, e2,...,ek, f2,...,fk,g2,...,gk, h, hl, h2,$, f(,§}. Define 6: {e2,... ,ek}" v--r {f2,... ,fk,g2,...,gk}* through e, ~ f,g, (i = 2 , . . . ,k), and let p denote reversal.

281

We define three Thue systems on A as follows:

T1 = TI(S) = {(c,cp(x,),c) I i = 2 , . . . , k } U {(e,dp(y,),d) 1 i = 2 , . . . , k } , = {(clf~g~, ~cl), (dl/,g,, ~d,) I i = 2,..., k} U {(c~h, c), (d,h, d), ($c, c2), ($d, d~), (a,c2a, c2), (b, c2b, c2), (ald2a, d2), (bld2b, d2)}

nl

u {(t,~¢, 9, T2

=

T2(S)= T~

(t,,d~¢, u

§)},

RI.

L e m m a 2.1. (a) T1 is finite, monadic and confluent. (b) R1 is finite, length-reducing and confluent. (c) :/~ is finite, length-reducing and confluent. P r o o f : The left-hand sides do not have any overlaps in these Thue systems. [] For a pair ( x , , y , ) e {a,b} + x {a,b} + let S(x,,y,) = {(xl,yl)} U S. L e m m a 2.2. Let x~, yl E {a, b}+. If M P C P ( S ( x l , Yl)) has a solution, then there exists a word w E A* such that hl~(Xl)$ClW ~ ~* T~ h2T(y~)$dlw, where ~ : {a, b}* -+ {al, bl}* is defined through a ~ al and b ~-* bl. L e m m a 2.3. Let x~, Yl E {a, b}+. If there exists a word w E A* such that h~T(Xl)$ClW ( )* T2 h2T(y~)$d~w, then M P C P ( S ( x l , yl)) has a solution. T h e o r e m 2.4. ( M a i n R e s u l t ) For T2 the following problem is undecidable: I N S T A N C E : Two words, u,v E A*.

QUESTION: Does there exist a word w E A* such that uw ~ ~* T2 vw? P r o o f . By Lemmas 2.2 and 2.3 and the choice of S. [] Theorem 2.4 is an improvement of ([10], Thm. 3.2, p. 342) where the following uniform problem was shown to be undecidable:

INSTANCE: A finite, length-reducing, and confluent Thue system T on alphabet E, and two words u, v E E*.

282

QUESTION:

Does there exist a word w E E* such that u w ~

~vw?

From Theorem 2.4 we can now derive the following undecidability results. T h e o r e m 2.5. There exists a length-preserving, noetherian, and confluent Thue system iT over E such that the following problem is undecidable: INSTANCE:

Two distinct symbols a and b from E.

QUESTION:

Does there exist a string x such that ax and bx are congruent modulo 2-?

T h e o r e m 2.6. There exists a finite, depth-reducing and confluent term rewriting system E such that the E-unification problem is undecidable. P r o o f . Let F = A U {¢}, where all the letters from A are interpreted as unary function symbols and ¢ is a binary function symbol, and let E be the term-rewriting system resulting from the Thue system T2. Then E is finite, depth-reducing, and confluent by Lemma 2.1 (c). The following claim can now be proved: C l a i m . Let u, v C A*. Then the following statements are equivalent: (1) g w E A * : u w ,

)*r2 v w , and

(2) the terms ¢(u(x), v ( x ) ) and ¢(y, y) are E-unifiable. Theorem 2.4 and the above claim now yield the intended result. [] Theorem 2.6 by itself is not a new result, since it follows from the results in [9] where the right-divisibility problem is shown to be undecidable for Thue systems that are lengthreducing and confluent. Undecidability of the E-unification problem for noetherian and confluent term rewriting systems has been known for some time; for instance, it is not hard to show that the following set of equations has an undecidable E-unification problem: (x+y)+z x*l x*(l+y)

=

x+(y+z)

=

x

=

x+(x*y)

Note that turning the above equations into rewrite rules results in a noetherian and confluent system.

283

3

S i m u l t a n e o u s E - m a t c h i n g and simultaneous Unification

E-

Let E be a finite term-rewriting system on T(F, V). The s i m u l t a n e o u s E - m a t c h i n g p r o b l e m is the following decision problem: I N S T A N C E : Two pairs (tl,t2) and (t3, t4) of terms from T(F, V).

QUESTION: Does there exist a substitution a such that a(tt) =E t2 and a(ts) =E t47 The s i m u l t a n e o u s E - u n i f i c a t i o n p r o b l e m is the following decision problem: I N S T A N C E : Two pairs (h, t2) and (t3, t4) of terms from T(F, V).

QUESTION: Does there exist a substitution a such that a(h) = s a(t2) and a(t3) =E

The goal of this section is to prove that there exists a finite, depth-reducing, and confluent term-rewriting system E such that • the E-matching and E-unification problems are decidable, while • the simultaneous E-matching and simultaneous E-unification problems are undecidable. Clearly, if the single unification problem for a theory E is decidable and finitary then the simultaneous unification problem is also decidable and finitaxy. Thus our construction yields an equational theory E whose single unification problem is decidable but the number of minimal unifiers may not always be finite. For the following construction let S be the set S = {(xi, y~) I i = 2 , . . . , k } C {a, b} + × {a, b} + constructed at the beginning of Section 2; i.e., S = S~z, where M is a Turing machine with an undecidable halting problem, and a is an encoding of the tape alphabet of M. Define T1 = TSI(S) = {(xicei, c) I i = 2,..., k} W {(y, de~, d) I i = 2,..., k}, where c, d, e2, • .., ek are additional symbols.

Define Rl={(clala2, acl), (clbxb2, bcl), (clc2, c), (d~a~a~,adl), (dlc2, d) }, where al, as, bl, b2, Cl, c2, dl axe additional symbols, A = {a, b, c, d, e2,..., ek, al, a2, bl, b2, cl, c2, dl}, and

(dlb~b2, bd~),

284

T~ = T S ~ ( S ) = T~ 0 R , .

L e m m a 3.1. a) T1 is finite, monadic, and confluent. b) R1 is finite, length-reducing, and confluent. c) T2 is finite, length-reducing, and confluent. P r o o f : It is easy to see that the left-hand sides in these systems have no overlaps. Q

For zl, y, e {~, b}+ let S(x~, y~) = { ( ~ , ~ ) } U S L e m m a 3.2. Let Xl, y~ E {a, b}+. If M P C P ( S ( x l , y~)) has a solution, then there exists a word x e A* such that c~(Xl)X~---~2x~c and dl~(xl)x~---~2y~d. Here ~o: {a, b}* {al, a2, bl, b~}* denotes the mapping induced by a ~ ala: and b ~-~ bib2. L e m m a 3.3. Let xl, yl E {a, b}+. If there exists a word x e A* such that Cl~(X~)X ~ xlc and d ~ ( x ~ ) x e - - - - ~ x l d , then M P C P ( S ( x l , y l ) has a solution.

~* T2

From the choice of S, Lemmas 3.2 and 3.3 imply the following. C o r o l l a r y 3.4. The following problem is undecidable: I N S T A N C E : Four words u, v, w, z E A*. QUESTION:

Does there exist a word x E A* such that ux~

~.2v, and wx~

~z?

To contrast this undecidability result we now want to show that E-matching and Eunification rood T2 are decidable. L e m m a 3.5. Let $1 -- {(x~,y~) [ i -- 2 , . . . , k } C_ {a,b} + × {a,b} + be a set of pairs of non-empty words, and let T1 = TSI(S1), R1, and T2 = TS2(SI) be defined as above. Then one can effectively construct a deterministic pushdown automaton (dpda) B(SI) that, on input a word u E A*, halts with the irreducible descendant of u mod T2 on its pushdown stack. C o r o l l a r y 3.6. Let $1 = {(x,,y~) I / = 2 , . . . ,k}, and let w E A*. Then [W]T2 is a deterministic context-free language, and given the set $1 and the word w, a dpda for [wit2 can be constructed effectively.

285 P r o o f . Let w0 be the irreducible descendant of w mod T2. Then [w]T2 = < Wo >T2, i.e.,

u E [w]T2 iff on input u, B(S~) halts with w0 on its pushdown stack. Incorporating w0 in the finite control of B(S~) yields a dpda for [W]T2. [] R e m a r k . If R C IRR(T2) is a regular set, then [R]T2 is a deterministic context free language (DCFL), and a dpda can be constructed (cf. [2], Proof of Thin. 3.3). C o r o l l a r y 3.7. The following problem is decidable: I N S T A N C E : A finite set $1 = {(x,, y;) I i = 2, ..., k} c {a, b}+ × {a, b}+, and two words u~ v E A*. QUESTION:

Does there exist a word w E A* such that uw~

~&(s~)v?

P r o o f i There exists a word w E A* such that uw~..... ~2v, where T2 = TS2(S1), iff u - A* A [V]T~ # O. Given $1 and v, a dpda for [V]T2 can be constructed effectively, and hence we can obtain a dpda for the set u. A* A [V]T2. Thus, it is decidable whether there exists a word w E A* such that uw~ ~2v. [] Next we want to show that the Thue system T2 = TS2(S1) is always r i g h t - c a n c e l l a t i v e no matter which set $1 is chosen, i.e., for all u , v , x E A*, ux~ ....... ~r2vx implies u~ ....~2v. To prove this result (Theorem 3.11) we introduce the following technical notion and results. D e f i n i t i o n 3.8. Let A be the alphabet {a, b, c, d, e 2 , . . . , ek, al, a2, hi, be, cl, c2, dl} for some k ~ 2. Then II : A* ~-~ {c, d}* denotes the homomorphism induced by the following mapping: C

~

C

C1

~+

C

d dl f

~ d ~-~ d ~ A forallfEA\{c,

cl, d, dl)

L e m m a 3.9. Let u, v, w E A*. a) If u---~2v , then II(u) = II(v). b) If uw,, ,~2vw, then II(u) = II(v). Proof. a) From the form of the rules of T2 we see that u----~T2V implies II(u) = II(v). Thus induction yields that u ~ v implies II(u) = II(v).

286

b) Let u, v, w E A* such that uw~ ~ v w . Since T2 is confluent, there exists a word z E A* such that u w ~ 2 z ~-*T2 vw. Hence by a) II(uw) = H(z) = II(vw), a~d so =

[]

L e m m a 3.10. Let u , v , w E A* be irreducible rood T~ such that uw* ,~2vw. If u w is reducible rood T2, then so is v w , and the same rule of T2 applies to both u w and vw. T h e o r e m 3.11. Let S1 = { ( x , , y l ) l i = 2 , . . . , k}. Then the Thue system T2 = TS2(S~) is right-canceUative.

C o r o l l a r y 3.12. The following problem is decidable: INSTANCE: words u, v E A*.

A finite set $1 = {(x,, y,)l i --- 2 , . . . k} C_ {a, b} + × {a, b}+, and two

Q U E S T I O N : Does there exist a word w E A* such that uw<

~*-'rs2(s~)vw'?

P r o o f . By Theorem 3.11 there exists a word w E A* such that uw< ~s2(sl)VW if and only if u~ ~s~(s~)V. Since the uniform word problem for finite, length-reducing, and confluent Thue systems is decidable, our result follows. [] L e m m a 3.13. The following problem is decidable: INSTANCE:

A set $1 = { ( x , , y , ) t i = 2 , . . . k } C {a,b} + × {a,b} +, and two words

u, v E I R R ( T 2 ) .

QUESTION:

Do there exist words x , y E A* such that ux~ ~ 2 v y ,

and vy E

IRR(T2)?

P r o o f . 3x, y E A* : u x , , ~ vy, and vy e I R R ( T 2 ) iff [v. A* N IRR(T2)]T~ M u . A* ~ 0. Let RI = v • A* M I R R ( T 2 ) . Then R1 is a regular set of irreducible words. Thus, by the remark following Corollary 3.6, [R1]T2 is a DCFL, and so [R1]T2 Mu. A* is a DCFL. Given $1, u, and v, a dpda for this language can be constructed. Thus, the above problem is decidable. D For u E IRR(T2) w e define the standard factorization of u as follows: Let u2 be the longest suffix of u such that u2 e {a, b}*U({a, b}*. {c, d, cl, dl})U ({a, b}*. {el, dl}. {az, b~}) and let Ul E A* such that u = ulu2. Then the pair (ul,u2) is called the s t a n d a r d fac-

t o r i z a t i o n of u.

287

L e m m a 3.14. Let u • I R R ( T 2 ) with standard factorization (Ul,U2), and let w e A*, z • I R R ( T 2 ) such that uw--**T2 z. Then z can be factored as z = UlZl such that u2w--~2Zl , i.e., the prefix ul of u will not be touched in the reduction from uw to z.

L e m m a 3.15. Let u , v • I R R ( T 2 ) such that there do not exist words x , y E A* such that ux, ,~2vy, and ux • I R R ( T 2 ) or vy • IRR(T2). Further, let (u~, u2) and (Vl, v2) be the standard factorizations of u and v, }espectively. Then the following two statements are equivalent:

(1) (2)

3x, y • A* : uz~

~ vy.

(i) By • A* 3va E {a,b}* ~r • range(T2) : v2y--*~2v3r , and ViVa is a prefix of ~1, or

(ii) 3x e A* 3u3 • {a, b}* ?r e range(T2) : u2x--*}2u3r, and UlU3 is a prefix of Vl, or

(iii) 3x, y • A* Bu3 • {a, b}* 3r E range(T2): u~x--~2u3r, v2y--~u3r, and ul = vl. By Lemma 3.13 the assumptions about u and v in Lemma 3.15 are decidable. Since v3 and r in (i) and u3 and r in (ii) can actually be determined from ul and Vl, conditions (2)(i) and (2)(ii) are decidable by Corollary 3.7. Thus, it remains to show that condition (2)(iii) is decidable as well. L e m m a 3.16. The following problem is decidable. I N S T A N C E : Two words u, v • {a, b}*U({a, b}*-{c, d, cl, dl}) U({a, b}*.{cl, dl}'{al, bl}), and a word r • range(T2). i'

QUESTION: Do there exist words u3 • {a, b}* and x, y • A* such that ux --~*T2 U3r and vy-'~2 u3r?

Combining Lemmas 3.13, 3.15 and 3.16 we now obtain the following result.

Corollary 3.17. The following problem is decidable: INSTANCE: A set $1 = {(xl, yi) [i = 2 , . . . , k} C {a, b}+ × {a, b}+, and two words u,

• 1RR(T2).

QUESTION: Do there exist words x , y • A* such that ux~

~.2vy?

288

Let F = A U {$}, i.e., each letter from A is interpreted as a unary function symbol, and $ is a constant. For S~ = {(x~,y,)]i = 2 , . . . , k } let R~ = TS2(SI) denote the Whue system constructed as before, and let E1 denote the resulting term-rewriting system on T(F, V). Then E1 is finite, depth-reducing, and confluent. T h e o r e m 3.18. Let 5'1 : {(x,,yl)li = 2 , . . . , k} C {a,b} + x {a,b} +. Then the problems of El-matching and El-unification are decidable. Proof. Let tl(x), t2(y) • T(F, V). Then tl(x) can be El-matched with t2(y) iff there exists a term t3(z) • T(F,V) such that tl(t3(z)) =E~ t2(y) iff 3t3 • A* : tlt3~ ~ t2. This is decidable by Corollary 3.7. The terms

tl(x) and t2(y) are El-unifiable iff

x = y and there exists a term t3(z) such that x # y and there exist a term

tl(t3(z)) :El t2(t3(z)) or

t3(z), t4(z) such that tl(t3(z)) =El t2(t4(z)) iff

x ----y and there exists a word t3 C A* such that x ~ y and there are

tlta~ ~ 2t2t3 or

t3, t4 E A* such that tlt3~ ~t2t4.

This is decidable by Corollary 3.12 and Corollary 3.17. [] Let S C_ {a, b} + x {a, b}+ be the set S ~ constructed at the beginning of Section 2, and let E denote the term-rewriting system on T(F, V) resulting from T2 = TS2(S). T h e o r e m 3.19. a) The problems of E-matching and E-unification are decidable. b) The problems of simultaneous E-matching and simultaneous E-unification are undecidable. Proof. a) Theorem 3.18. b) Let tl = Cl(~O(Xl(X))), t2 = Xl(C($)), t3(x) -~- dl(~(Xl(X))), and t 4 = yl(d($)). T h e n

there exists a substitution a such that a(t~) =E t2 and a(t3) =E t4 iff 3w E A* : cl~(xl)w*---~2x~c and d~(xl)w~---*~2yld iff MPCP(S(xl, yl)) has a solution. D Since ~2 and t4 are ground terms, (tl, t2) and (t3, t4) are simultaneously E-unifiable iff they are simultaneously E-matchable. Thus

289

T h e o r e m 3.20. (Main Result) There exists a finite, depth-reducing, and confluent term-rewriting system E such that the problems of E-matching and E-unification are decidable, while the problems of simultaneous E-matching and simultaneous E-unification are undecidable.

4

Variable-Permuting Theories

Recall that a variable-permuting theory is one consisting of equations where the righthand sides can be obtained by permuting (rearranging) the variables on the left-hand side. An example is

f(x, y) = f(y, x) f(x, f(y, z)) = f(z, f(x, y)) which is equivalent to the theory of associativity and commutativity (AC). T h e o r e m 4. Unification is undecidable for variable-permuting theories. Proof." Our reduction is as follows: given a length-preserving, noetherian and confluent Thue system T on an alphabet E, and two distinct symbols a, b • E, we construct a set of equations E, and two terms tl and t2 such that tl and t2 are unifiable rood E if and only if there exists a string w • E* such that aw ~ ~- bw. Along with Theorem 2.5, this yields the desired result. The basic idea is to code up the alphabet E. Let f be an n-ary function where n = IEI. The coding is done positionally using O's and l's; the codes are of the form f(0, 0, . . . , 1, 0, - . . , 0), i.e., ground terms of size n + 1 and depth 1, where the symbol 1 occurs only once. Two codes differ only in the position of the symbol 1 occurring in them. Let h be the homomorphism that maps letters in the alphabet E to their respective codes. We also define another mapping g from E to T({f}, {x, y}) where for any symbol a, g(a) is h(a) with the O's replaced by x's and the 1 replaced by y. Let t be the substitution {O/x, 1/y}. Thus g(a) = t-l(h(a)) for all a. Let r be a binary function. We can now extend g to a homomorphism g' from E* to T ( { f , d , {x,y,z}) as fonows: g'(a) = r(g(a),z) for a • E, and g'(aw) = r(g(a),g'(w)). The mapping g' can now be used to get a variable-permuting equational theory from any length-preserving Thue system in the obvious way. Define

E(:r) =

I (l,d •

Let h' be a.n extension of h, defined in the same spirit as for g': h'(a) = r(h(a), z) for a • E, and h'(aw) = r(h(a), h'(w)). Define H C T ( { f , r } , {z}) as the set of terms

290

obtained from non-empty strings by the homomorphism h r. That is, H = {tit = h'(w),w e

The following can now be shown: Claim 1: For all nonempty strings wl and w2 over ~, wl and w2 are congruent modulo T i f f h'(wl) and h'(w2) are congruent modulo E(T). Claim 2: For all nonempty strings wl and w2 over ~, there exists a string y such that wly and w2y are congruent modulo 7- iff h'(wl) and h'(w2) are unifiable modulo E(7"). Proof: The 'only if' part follows from Claim 1. To show the 'if' part all one has to show is that the term substituted for the variable z in h'(wl) and h'(w2) need only be of the form hi(x) for some string x. Thus, Claim 3: There exists a string w such that aw and bw are congruent modulo 7" iff r(h(a), u) and r(h(b), u) are unifiable modulo E(7"). This complete the proof. [] The above construction also enables us to show that the matching problem for variablepermuting theories is PSPACE-complete, since the word problem for length-preserving Thue systems is PSPACE-complete [3]. (Membership in NPSPACE, and hence in PSPACE, is straightforward.)

References [1] Benanav, D., D. Kapur, and P. Narendran, "Complexity of Matching Problems," In: Proceedings of RTA-85, Dijon, France. A revised version appears in Journal of Symbolic Computation 3 (1987) 203-216. [2] Book, R.V., "Confluent and other types of Thue systems," Journal of the ACM 29 (1982), 171-182. [3] Book, R.V., M. Jantzen, B. Monien, C. O'Dfinlaing, and C. Wrathall, "On the Complexity of Word Problems in certain Thue systems," Mathematical Foundations of Computer Science, LNCS 118 (1981) 216-223.

291

[4] B/irckert, H.-J., A. Herold, and M. Schmidt-Schauss, "On Equational Theories, Unification, and (Un)Decidability," J. of Symbolic Computation 8 (1989) 3-49, [5] Fages, F., "Associative-Commutative Unification," In: Proceedings of 7th Conference on Automated Deduction (CADE-84), Napa Valley, California. [6] Fortenbacher, A., "An Algebraic Approach to Unification under Associativity and Commutativity," In: Proceedings of RTA-85, Dijon, France. [7] Hopcroft, J.E., and J.D. Ullman, Introduction to Automata Theory, Languages and Computation, Addison-Wesley, 1979. [8] Huet, G., and D. Oppen, "Equations and Rewrite Rules: a survey," in Formal Languages: Perspectives and Open Problems (R. Book, ed.), Academic Press, New York, 1980. [9] Otto, F., "Some Undecidability Results for Non-Monadic Church-Rosser Thue systems," Theoretical Computer Science 33 (1984) 261-278. [10] Otto, F., "On Two Problems Related to Cancellativity," Semigroup Forum 33 (1986), 331-356. [11] Schmidt-Schauss, M.J., "Two Problems in Unification Theory," Bulletin of the EATCS 34 (Feb '88) p. 273. [12] Siekmann, J.H., "Universal Unification," In: Proceedings of CADE-7, Napa Valley, CA, LNCS 170 (1984) 1-42. [13] Siekmann, J.H., "Unification Theory," Journal of Symbolic Computation 7 (1989) 207-274. [14] Stickel, M.E., "A Unification Algorithm for Associative-Commutative Functions," Journal of the ACM 28, 423-434.

Unification in a Combination of Equational Theories: an Efficient Algorithm Alexandre Boudet L R I , U n i v e r s i t ~ P a r i s - S u d , B £ t 490 91405 O R S A ¥

Cedex, France

Abstract An algorithm is presented for solving equations in a combination of arbitrary theories with disjoint sets of function symbols. It is an extension of [3] in which the problem was treated for the combination of an arbitrary and a simple theory. The algorithm consists in a set of transformation rules that simplify a unification problem until a solved form is obtained. Each rule is shown to preserve solutions, and solved problems are unification problems in normal form. The rules terminate for any control that delays replacement until the end. The algorithm is more efficient than [13] because nondeterministic branching is performed only when necessary, that is when theory clashes or compound cycles are encountered.

1

Introduction

Given two equational theories E1 on T(F1, X) and E2 on T(F2, X), one is naturally lead to investigate the possibility of combining them, that is to consider heterogeneous terms in T(F1U F~,X), and see what properties of E1 and E2 extend to E1U E2. For example, the word problem is decidable for E1 U Ez if it is decidable for E1 and E2 [14]. Another important combination problem is unification. This problem has been addressed by many people during the last years. Claude Kirchner [9] requires E1 and E~ to be simple theories (i.e., theories E in which equations s & C[s1where C is a proper context, have no E-solution). Kathy Yelick [17] gives a solution for the combination of collapse-free, regular theories, and Erik Tid6n [16] extends Yelick's result to collapse-free theories. An algorithm is given in [3] for combining an arbitrary and a simple theory, while Schmit-Schaut] [13] gives a solution for the general case. This paper extends [3] to the general case. While in [13], nondeterministic guesses are made at the beginning, which leads to a complexity independent from how pathological a unification problem is (for instance, how many theory clashes will occur), the algorithm given here performs nondeterminism only if necessary. In case a unification problem contains few potential clashes, the efficiency is much improved. We assume the reader is familiar with the notions of term, context, substitution, equational theory, equational and rewrite proof. V(t) denotes the set of variables in a

293

t e r m t, Dora(t) is the set of positions in t. t[s]p denotes a t e r m t in which the s u b t e r m at position p is replaced by the t e r m s. Position p m a y be omitted when clear from the context or irrelevant, hence t[x] denotes a t e r m t in which the variable x occurs. T h e application of a substitution a to a t e r m t is denoted by ta. T h e domain of a is D o m ( a ) = {x e X I x a ¢ z}, and V R ( a ) = {y C X I 3x e D o m ( a ) , y e V ( x o ) } is its variable range. T h e composition 0 o a of two substitutions is denoted, using postfix notation, by o0. The top function symbol of a non-variable t e r m t is denoted by t(A). Our notations are consistent with [7]. Here are a few definitions t h a t will be used in the paper: D e f i n i t i o n 1 A n equation is an unoriented pair < s , t > of terms denoted s ? t. A

unification problem is a set P = {sl ~ t l , . . . , s , ~ t , } of equations. A term t is pure in Ei if t E T(F~, X ) . A non-pure term is said to be heterogeneous. ? A n equation s = t is said to be pure in a theory Ei if both s and t are pure in Ei. Non-pure equations are called heterogeneous. A n equation s ~ t is a proper equation if s or t is not a variable. A unification problem P will be written P = Pv U P1U P2 U PH where Pv is the set of non-proper equations x ~ y in P, PI is the set of proper equations, in P that are pure in El, P2 is the set of proper equations, in P that are pure in Ez, PH is the set of heterogeneous equations in P. Splitting P in such subsets is natural since the goal is to use the unification algorithms known for E1 and E2. Three more items will be added to a unification problem: two sets U1 and U2 of variables and a set S C of oriented pairs of variables. Their use will be detailed later. D e f i n i t i o n 2 A v a r i a b l e x is Ei-instantiated if it occurs in an equation x ~ s in Pi with s C T(E,, X ) \ X . We assume t h a t if s =E, Y for some variable y, the equation x ~- s E P~ is replaced

b y x - ~ y E Pv. In some cases, a unification problem is in such a form that a solution can immediately be deduced: D e f i n i t i o n 3 A unification problem P is in a solved form if P = {Xl ~ t t , . . , x , -~ t , } where every xi occurs nowhere else in P. A most general solution of such a solved unification problem is a = (xl

~

tl,.., z. ~ t.}

294

2

Basic A s s u m p t i o n s

This section defines which assumptions are made on E1 and E2. These properties are the same as in [13] and they seem to be the minimal assumptions for the combination problem to be solvable. First of all, E1 and E2 are supposed to be consistent theories, i.e., T(F~, X)/=E~ is not a singleton, otherwise the unification problem becomes trivial. We now introduce the type of unification algorithm we need for each theory El. D e f i n i t i o n 4 A restricted E-unifier of two terms s and t with respect to a set U c X of variables is a substitution a such that

• forallxEU,

xaEX

A complete set of restricted E-unifiers of s and t with respect to U (denoted E c s U U ( s , t ) ) is a set E of substitutions such that • for all a E E, a is a restricted E-unifier of s and t with respect to U • for all restricted E-unifier a of s and t with respect to U, there exists some a r E E such that a' _<~ a, where V = V(s) U V(t)

In other words, restricted E-unifiers with respect to U are unifiers that do not E instanciate the variables in U. Note that our definition is slightly different than Biirckert's where the variables in U are treated like free constants. It is possible to compute E i - c s u U ( s , t) if the following assumption is satisfied: A s s u m p t i o n 1 E~ has a complete unification algorithm for terms in T ( FiUC, X ) where C is an arbitrary set of free constants. Assumption 1 is satisfied for many theories such as Boolean Rings ( B R ) [11,5] Abelian Groups (AG) [6], or the free theory [10,12]. Actually, it is satisfied for all theories of interest that we know. This is not true, however, in general; but counter examples are quite hard to construct [4]. To compute an E i - C S U U ( s , t) for Ei satisfying assumption 1, remember that we are not interested in solutions t h a t Ei-instanciate the variables in U. An obvious approach would be to treat those variables like free constants while solving the equation, but this restriction is too strong because solutions may be lost which identify two variables in U. For instance, a restricted BR-unifier of x + y and z + u with respect to U -- {x, y, z, u} is a = {x ~ x~,y ~-* y~,z ~-* x~,u ~-~ y'}. Completeness is restored by first guessing which variables will be identified by a restricted E-unifier, and then treat them as constants. D e f i n i t i o n 5 Given a partition {U1 . . . . . U,} of a set U of variables, the corresponding variable identification is the substitution a defined (up to a renaming) by a(x) = xi if x E U~, a(x) = x otherwise, where x l , . . . , x n are fresh variables.

295

P r o p o s i t i o n 1 Let P be a unification problem in a theory E satisfying assumption 1. Let U c X be a set of variables. A complete set of restricted E-unifiers of P with respect to U is composed f r o m the substitutions a sno, , where a~ is a variable identification over U and a~, is a most general E-unifier of P a I computed while variables in V R ( a I) are treated like free constants. BSrckert [4] shows that restricted E-unification is not solvable in general (and may even be undecidable), even if a complete E-unification algorithm is known. However, as already said, no natural counter example is known. Note that if U is empty, restricted E-unification reduces to standard E-unification. The number of calls to E-unification for computing complete sets of restricted E-unifiers of a problem P grows like the number of partitions of V ( P ) N U, hence it is necessary to restrict as much as possible the number of variables in V ( P ) N U. The second assumption will be needed in section 4 in order to break compound cycles down. D e f i n i t i o n 6 A variable x is Ei-eliminated in a term t E T(F~, X ) by a substitution a, (or a is an Ei-eliminator of x in t), i[ • xaEX • there exists a term u s.t. u =E, ta and x a ~ V ( u )

D e f i n i t i o n 7 A constant E~-elimination problem is a set {(cl, tl), . . . . (c,,t,)} where c~ E C and tk E T(F~ U C, X ) /or k C [1..n]. A variable E~-elimination problem is a set {(xl, tl) . . . . . (x,~,t,~)} where xk E X and t~ E T(F~, X) for k e [1..n]. D e f i n i t i o n 8 A complete set of variable Ei-eliminators for the variable Ei-elimination problem {(xl, tx) . . . . , (x~, t,)} is a set E of substitutions such that 1. for all a E E Vk E [1..n I, a Ei-eliminates xk in tk, 2. for all a satisfying 1, there exists some a ~ E E such that a ~ --El
Such a set can be computed if a complete set of solutions of a constant Ei-elimination problem can be computed: D e f i n i t i o n 9 A complete set of constant Ei-eliminators for the constant Ei-elimination problem {(ct, tt) . . . . . (e., t,~)} is a set E of substitutions such that 1. for all a E E Vk E [1..n], 3u =E~ tka such that ck does not occur in u, 2. for all a satisfying 1, there exists some a ~ E E such that a t < v a where Y = V ( t , ) u . . . u V(t )

296

In the same way as for restricted Ei-unification, a complete set of variable eliminators for {(xl, tl) . . . . . ( x , , t , ) } is :E = {a'a~,} where a ' is a variable identification over {xl, . . . . x,} and a~, belongs to a complete set of solutions of the constant Ei-elimination problem {(xla', tl) . . . . , (x~a', t~)} where xla' . . . . , x,a' are treated like free constants. A complete constant elimination algorithm is given in [131 for Boolean Rings and Abelian Groups. It is also possible to c o m p u t e complete sets of constant eliminators for theories for which basic narrowing terminates. Note also that constant elimination is impossible in regular theories, thus, a complete set is nothing but the e m p t y set in t h a t case. The problem is not solved in general, hence: Assumption

2 A complete constant Ei-elimination algorithm is known for i=i,2.

Note that an instance of a restricted E-unifier (resp. of a variable E-eliminator) need not be one. This is i m p o r t a n t because termination wilt be g u a r a n t e e d only with a special control described below.

3

Separated Systems

A set of inference rules is given in this section for transforming a unification problem into an equivalent one which is the union of two pure problems in solved form. D e f i n i t i o n 10 A unification problem P is separated if P = Pv U P1 U P2 where

* Pi and P2 are solved, • ~x 6 X , s , E T(F1, X ) \ X , s2 C T(F2, X ) \ X such that x J= sl E PI a n d x • s2 E P2, . if x i_ y C Pv, then one of x and y occurs nowhere else in P.

3.1

Variable

Abstraction

T h e first inference rule is classical and corresponds to the m e c h a n i s m of variable abstraction. It consists in replacing, in a t e r m s, the maximal s u b t e r m s whose top function symbol is not constrained by the same theory as the root by new variables, while m e m orizing with new equations which s u b t e r m each new variable represents. The rule is: VA ? ? ? s ± t ~- c [ x l , . . . , x , ] ± t , x l - sl . . . . , z , ± s , if ~ is an heterogeneous term, and c[xI,... ,x,] is a m a x i m a l pure t e r m such t h a t s = c [ x l , . . . , x , ] { x l ~-* s l , . . . , x,~ ~-~ s,}. ?

Variable abstraction yields equations between pure terms. The rule is known to preserve solutions since [17]. Actually, the mechanism was already used in [15].

297

3.2

U-Homogeneity

Before introducing the other rules, here are a few definitions that make the completeness proofs of several inference rules very easy: D e f i n i t i o n 11 /8] Let > be a simplification ordering total on T ( F ) and E a set of equations. We say that s rewrites to t and we write s - - ~ E t if there exist an equation l = r in E , a substitution a and a position p in Dora(s) such that the subterrn of s at position p is equal to la, and t = s[ra]p, and s > t. I = r is said to be a rule if I > r. We denote by s J, the normal-form of s for ----~E. E is said to be convergent on ground terms if for arbitrary ground terms s~ = t$ iff s and t are equal under the equational theory =E. A proof s --+ . . . --~ . . . ~- • • • +-- t is called a rewrite proof. Applying unfailing completion [2,8], to E1 U E2 yields a (possibly infinite) convergent set R of equations for semi-deciding =EIuE: on ground terms. Since F1 ~ F2 = 0, no overlap is possible between equations of E1 and E2, hence R = R1 U R2 where the equations in R1 (resp. in R2) are pure in E1 (resp. in E~). By extending the ordering > to T(F1 U F2,X), variables being now treated as constants, we get a semi-decision procedure for =EIL~E: on terms in T(F1 U F 2 , X ) . The R-normal form of a term t will be denoted by t $. The R-normal form of a substitution a is a ~= {x ~-~ (xa) ~ I x E Dora(a)}. D e f i n i t i o n 12 Let U C X be a set of variables such that there is a one-to-one mapping h f r o m T ( F 1 U F2,X)/=E~uE~ to U. By convention, h(t) denotes the image by h of the class of t in T(F~ U F2,X)/=E,uE2. Let t E T(F1 U F2, X ) and t = F~ or F2. The U-homogeneous part ~ 7 of t with respect to 7 is defined by: if t J.E X t h e n ~7 = t J~ else if t J.= f ( t l , . . . , t . ) and f E ~r t h e n ~ ; = f ( ~ 7 , . . . , ~ 7 ) else ~ 7 = h(t) The U-homogeneous part ~ ~ of a substitution o with respect to a set ~r of function symbols is ~ 7 = {x -+ ~ i}zeDom(a ). The universal preserving substitution is Pu defined by p~(h(t)) = t j.. U-homogeneity is used only in the completeness proofs. It has the advantage that equal subterms are replaced by the same variable. When a normalized substitution a is applied to a pure t e r m t, the normalization can be performed as well on t~ ~" as on ta. Moreover, since p~ is normalized, the proof is pure in the theory of t. 3.3

Ei-Resolution

Once variable abstraction has given some pure equations in a theory, it is possible to solve t h e m independently with the rule:

E~-Res ~- {x~ ? Sk}keK if P~ is a pure subproblem in E~ not in solved form and {x~ ~-~ Sk}keK E CSUV'(P~).

P~

298

At the beginning, U~ is empty, and the rule uses standard Ei-unification. The use of Ui is explained in the next section. As long as U~ is empty, E~-Resolution is known to preserve solutions [17,13,I]. 3.4

Variable

Replacement

For the m o m e n t , no explicit replacement rule is needed, replacements being performed by Ei-resolution in P1 and P2- Nevertheless, variable replacement, a weak form of replacement is necessary to make potential merges appear. Var-Rep ({x~y}UP, g,) F- ( { x ~ y } U P { x ~ - + y } , if b o t h x and y occur in P.

U,{x~-+y})

The completeness of Variable Replacement is a straightforward. 3.5

Theory

Clashes

It m a y happen t h a t a unification problem contains an equation Sl ~ s2 or two equations q ? x - sl and x - s2 with sl E T(F~, X ) and s2 E T(F2, X ) . If the theories are collapse-free, then such theory clashes have no solution, otherwise, restricted Ei-unification allows to solve t h e m thanks to Lemma

1 Let Sl E T(F1, X) \ X and s2 E T(F2, X ) \ X . Let ~ be an El U E2-solution

of {Sl ~ s2}, then there exist two substitutions a' and a" such that •

Cf ~ ' E I u E 2 Ul~Ytr

• sia' =E, x for some x E X (i E {1,2}) •

xo" =

proof : Assume without loss of generality that a is in R-normM form. Let (Sla) J.= (s2a) ~= u. Assume first that u E X or u(A) E F~, and normalize sla. Since all rules are pure in E1 or E2, and a is normalized, all rewrite steps use equations in R1 and are performed in the homogeneous part of sla, hence, the proof is of the form S l 6 r - ~ R l . , . --+RI u

If u E X, then we are done, else u(A) E F2. The proof lifts to a proof on U-homogeneous parts with respect to F1 because E1 u E2-equal subterms with top function symbol in F2 are replaced by the same variable: 8 1 ~ FI--+ RI • . . ---+RI ~ FI

But u is a normalized term with top function symbol in F2, hence ~F~ = h(u) E X. Taking x = h(u), a' = ~F~ and a" = p,, we have sla' E X, a = E I u E 2 a'a", and xa" = (sla) ~. Assuming now that u(h) E F1, the symmetric result is obtained by normalizing s2. [] L e m m a 1 shows t h a t all the solutions of a unification problem containing x = sl and x -- s2 with S l e T(F1, X ) \ X and s2 E T(F2, X ) \ X , are E1 U E2-instances of an E l - m a t c h from sl to x or an E2-match from s2 to x.

299

A complete set of Ei-matches from si to a variable x is a complete set of restricted E~-unifiers of s~ and x with respect to U = {x} [4]. At this point, the algorithm becomes nondeterninistic: it is necessary to guess in which theory the variable x will not be instanciated. Furthermore, to guarantee termination, the choices t h a t have been m a d e must be memorized, and the search for solutions must be restricted to substitutions t h a t are compatible with previous choices. For this purpose, we add two "global variables": U1 and U2 are the sets of variables t h a t must not be instanciated in E1 and E2 respectively. Theory clashes are then handled by the following rule: Ei-Match i- ({xk ~- s~}keg U P~a ,"V, U {x})

(P,, V,)

if x £ s • P~ and x £ t • Pi+l and a : {xk ~-~ sk}keK • CSU~(s~,x) and V a r - R e p does not apply. T h e rule preserves solutions, as well as Ei-resolution, even when U~ is not empty: Lemma

2 E~-Res and E ~ - M a t c h preserve solutions.

p r o o f : It is known [17,13,1] shows that Ei-resolution is complete as long as Ui is empty. The third statement of lemma 1 shows that Ei-unification can be replaced by restricted Eiunification, because no further Ei equality step is needed in the proof from variable x to (sin) ~, hence it is not necessary to consider the substitutions that Ei-instanciate variable x after the term si has been matched onto x. The completeness of Ei- m a t c h is given by lemma 1 with the same remark. [] Nondeterminism is in the choice of theory Ei in which the variable x will not be instanciated anymore. Once U~ ~ 0, Ei-resolution must be applied using restricted Eiunification with respect to Ui instead of s t a n d a r d Ei-unification. This avoids creating new clashes on a variable on which a clash has already been solved by applying Ei-match. ?

If-the original unification problem contains an impure equation sl - s2 E PH with Sl • T(F1, X) \ X and sz • T(F2, X) \ X, or if such an equation is yielded by variable abstraction, the following straightforward rule reduces this problem to the previous one:

IE

? S 1 = S2

if

? 2: = S l , X

~-

? = 82

• T(FI, X) \ X and

• T(F , X) \ X,

w h e r e x is a fresh variable.

At this point, we have all the necessary mechanisms to compute a separated problem: Proposition

2

If the set of inference rules S = { V A , E i - R e s , E ~ - M a t c h , I E , V a r - R e p } terminates for some unification problem P, then it computes an equivalent separated problem. proof : apply. []

All rules preserve solutions, and if the problem is not separated, some rule must

If a separated problem contains no cycle for the occur-cheek relation x < y if x ~ s[y] • P with s[y] ~ X then we are almost done, else assumption 2 will give us the solution.

300

4

Breaking Cycles

Since $ yields a separated problem, all cycles in the graph of the occur-check relation must be compound cycles of the form xl ~ tl[x2],x2 ~ t2[xd],... ,x2n ~ t2,[Xl] where Vi E [1..n], t2,-1 e T(F1, X ) \ X and t2, E T(F2, X ) \ X . Such cycles can be broken using variable elimination: E x a m p l e 1 Let P = PBRU PO where PBte = {Y ? x + z} and Po = {x L f ( y , z ) } in the combination of a Boolean Ring theory and the free theory. There is a cycle x < y < x in the occur-check graph. The substitution a = {x ~ x I, z ~-+ x r + z r} makes x + z BR-equal to zt: it is a variable B R - e l i m i n a t o r of x in x + z. A naive transformation for solving P would be PBR ~- PBRa U {X L X', Z ? x' + Z'} this transformation yields the problem P' = P~ U P~R UP$ with Pb = {y L z',x L x'}, P~ = {x L f ( y , z ) } and PBR = {z g X' + Z'}. Now, the problem is not separated anymore, and after applying twice Variable replacement (z t is replaced by y and x t by x), we get the problem: P " = P~ U P~R UP$' with P~. = {y L z ' , x L x'}, P~ = {x -~ f ( y , z)} and PBR = {z L_ X + y}. Indeed, the edge y < x has disappeared, but a new edge z < x has been introduced, and there is a cycle x < z < x. If the same rule is applied with the BR-eliminator {x ~-+ x", y ~-+ x" + y"} of x in x + y, after variable replacement, the unification problem obtained will contain exactly the original cycle.

A solution to this non-termination problem will be given after exposing the second mechanism for breaking cycles: in case both theories have collapse axioms, a cycle can be broken by matching a term onto a variable. E x a m p l e 2 Let E1 be a Boolean Ring theory with F1 ? {+,*,0, 1} and E2 an Abelian Group with F2 = {', - , e}. Let P = {x ~- y + z, y L x. u}. The substitution a = {x ~-* y , u ~-* e} is an A G - match from x . u to y. By applying a to PAG and adding to P the corresponding equations, we get the problem P ' = {x ~- y + z , x

L- y , u ? e}

301

At this point variable replacement applies and yields P" = {x & x + z , x L y , u Z~ e} in which P~R = {x ~ x + z} is not solved anymore. An equivalent solved problem is {z ~ 0}. Finally, a separated problem with no cycle is

{ z £ O , x L y , u ? e} Note that this problem has been obtained without BR-eliminating y from y + z nor AG-eliminating x from x . u. T h e following technical l e m m a will be used in the completeness proof: 3 Let t E T(Fi, X) \ X and x E X . Let a be a substitution such that ~ f , E X and x is not Ei-eliminated by ~ f , in t and (xa) I (A) E Fi+l. Then (xa) I is a subterm

Lemma

o/(to) 1. proof : Assume without loss of generality that a is in R-normal form and normalize ta. Again, the proof is of the form Since t is pure in Ei, the proof lifts to a proof on U-homogeneous parts: t ~ F,__,R, • • • ~ n , ( t ~ )

1 ~'

Since t is pure in Ei, ~-~e~ ----E~t~e~. By hypothesis, x is not Ei-eliminated in t by a F~, hence z~ F~ = h(xa) E V((t~ e') 1). Now (ta) 1= ((t~ F') i P~, and h(za)p~, = (za) ~ is a subterm of ( t . ) i. []

Note t h a t if in addition t is not m a d e Ei-equal to a variable by ~F~ then (xa) ~ is a proper s u b t e r m of (ta) ~. T h e following l e m m a shows t h a t E~-elimination and matching are the basic mechanisms for solving cycles: 4 Let C = (xl ? tl[x2], x2 ~ t2[xa],..., X2n ? t2n[Xl]} where t2i-1 E T(F1, X ) \ X and tz, E T(Fz, X ) \ X for i E [1..n]. If a is a solution of C, then either

Lemma

• ~F~ El-eliminates some xzi from tzi-1, or • ~F~ E2-eliminates some x2i+l from t~, or • ~e~ makes some t2i-t El-equal to a variable, or • ~F~ makes some t2i E2-equal to a variable. p r o o f : Assume first that x2i~ e~ ~ X for some i in [1..n]. Then by lemma 1, tzi~ F2 E X. The symmetric result is obtained if x2i_l~/~ ~ X. We can now assume without loss of generality that Vi E [1..n], xzi~ F~ E X and x2i_l~ e2 E X. Then by the lemma 3, if cr satisfies none of the conditions above, then Yi E [1..2n], (xi+~(r~oaz,,)a) ~ is a proper subterm of (tia) 1- This implies that (xla) ~= (tta) ~ is a proper subterm of itself: a contradiction. [] W h e n a c o m p o u n d cycle involving the equation x ~ t[y] E Pi is encountered in a separated problem, it will be solved if possible by either:

302

• removing y from t using variable Ei-elimination, or * matching t on the variable x using restricted Ei-unification. Note that the substitutions that remove y from t[y] by Ei-instanciating y are not computed. For instance, the substitution {y ~-+ 0} which removes y from y * z in Boolean Rings does not correspond to the definition of a variable BR-eliminator of y in y * z. Nevertheless, such possible solutions will be computed by the algorithm: if ~ F i E~-instanciates y, then there will be a clash on y because there is an equation

y ? t~[z] E P,+~ in the cycle. Then ° is an instance of an E~+~-match from tv[z ] to y. To have termination, it is again necessary to memorize what has been done, so as not to undo it. When a variable y is Ei-eliminated from a term t[y], in order to break a cycle containing x ~ t[y] C Pi, the pair < y, x > is added to a set of constraints. D e f i n i t i o n 13 A set of constraints is a set S C = {< x l , y 1

> .... , < xn, y,~ >} of oriented pairs of variables. The corresponding variable Ei-elimination problem is

{< xi,t > I < xi,y~ >E S C andyi £ t E Pi o r t E V(Pi) a n d y i =-By t}

where x =-ev Y if there exists a sequence of equations x ? vl,

Vl ~ V2 . . . . .

Vn

~ y in Pv.

If a separated problem P admits a cycle containing x ~ t[y] E Pi, then one of the two following rules must be applied nondeterministically: Cyclel

U,, Sc)

({x Ls b

uP,

where a = {xj ~-~ s i } j c j belongs to a complete set of variable E/eliminators for the Ei-elimination problem associated with S C U {< y, x >}.

Cycle2

( P , , U,, SC) ~- ({xk L sk}~eg U P~a, U,U { x } , S C ) if a = {xk ~ sk}keK is a most general restricted Ei-unifier of s and x with respect to

u {x}. Our last rule, C y c l e consists in the nondeterministic application of C y c l e l or C y c l e 2 . L e m m a 5 C y c l e preserves solutions. p r o o f : Lemma 3 shows that every solution of a cycle containing equations z -~ t[y] must be an instance of a variable Ei-eliminator of some y in t[y] or an E~-match from some t[y] to x. Let a be a solution of P, and assume without loss of generality that a is in R-normal form. Assume first that t[y]~ y' =~, x for some x E X. Then (t[y]a) ~= xpu and (xpu) ~ (A) has its top function symbol in F~+I. No further El-equality step is necessary in the proof t[y]~F~Pu =E,uE2 (xa) ~. Hence x will not be Ei-instanciated anymore, and it can be added to the set U~. Assume now that a solution a is such that ~f~ Ei-eliminates y in t[y]. Then, by definition, y~F~ E X and ya F~ ~ V(u) for some u =E, tY F~. If after applying Cycle2 for eliminating y

303 from t[y], and making the problem separated again, the problem contains another cycle, then, it is not necessary to consider the substitutions 0 such that y~F~ ~ X, or y~F~ E V(uO) because such solutions are obtained by applying C y c l e l or by applying Cycle2 to some other equation of the cycle. Hence, the pair < y, x > can be added to SC, and possible further cycles will be broken without reintroducing y in the value of x. [] At this point, we almost have a problem in solved form: P r o p o s i t i o n 3 If $ U ( C y c l e } terminates for a unification problem P, then it computes a separated problem equivalent to P that admits no cycle for the occur-check relation.

5

Term Replacement

T h e Replacement rule is classical, and it is well known to preserve solutions: Rep

{x ? s } U P

t- {x ? s} U P { x ~ s}

if x occurs in P The problem with replacement is that it makes terms grow. If the use of R e p is not drastically restricted, termination proofs become difficult. Actually, if there is no restriction at all, then Variable Abstraction followed by the corresponding replacement may go into an infinite loop. Another problem is that replacement makes heterogeneous equations. The basic idea is to delay the use of term replacement until the end, and to prove termination of S U ( C y c l e } on one hand, and of R e p alone on the other hand, which is relatively easy. P r o p o s i t i o n 4 If a separated problem admits no cycle in the graph of the occur-check relation, then R e p applies finitely many times and yields a problem in a solved form. We are left to show that S U ( C y c l e } terminates.

6

Termination

The crucial notion for proving termination is the notion of shared variable. Intuitively, a variable x E V(P~) is shared in PI if there exists a variable y E V(P~) such that x and y will possibly be identified by an application of V a r - R e p . More formally: D e f i n i t i o n 14 x Hi y if x and y occur in Pi. =v is the equivalence on variables generated by the equations in Pv. x and y are identifiable outside Pi if (x, y) is in the transitive closure of the relation

u =v) A variable x is shared in P, if x C V(P~) and 3y E V(P,) such that x and y are identifiable outside Pi. A variable x is weakly shared in P~ if x E V(P~) and 3y E V(P~+I) such that x =v y.

304

The key of the proof is in the two following lemmas: L e m m a 6 No rules except VA and I E increase S V ( P ) . L e m m a 7 ff an application of V a r - R e p makes Pi unsolved, it removes a shared vari-

able. The complexity measure uses the following items: D e f i n i t i o n 15

THm~t(P) denotes the multiset of theory heights of heterogeneous terms in P, where the theory height of a term t is the maximal number of times the theory constraining the function symbols changes in a path of t. I E ( P ) denotes the number of impure equations in PH of the form s ~ t where s E T ( ~ , X) \ X and t E T(F/+x, X) \ X. S V ( P ) is the multiset {nl,n2} where ni is the number o/variables shared in Pi.

Vi(P) denotes the

number of equivalence classes for =v of weakly shared variables that contain no variables of Ui. Um~(P) is the multiset {N (P),N (P)}.

SC (P) denotes the number of classes for =~ of oriented pairs of shared variables that contain no pair in SC. U S P ( P ) is the number of unsolved subproblems in {P1, Pz}P V R ( P ) i s the number of potential applications of variable replacement, that is the number of equations x ?=:y E Pv where both x and y occur somewhere else in P. The weight of P is W(P) = (THm~,( P), IE( P), SV( P), ~

(P),-S'-C ( P), U S P ( P ) , P V R(P) )

The ordering <w is obtained by comparing lexieographieally the components of W ( P ) from left to right, it is well founded as a lexicographic extention of well founded orderings. T h e o r e m 1 $ U {Cycle} terminates. We do not include the complete termination proof for lack of space. Clearly, VA decreases THmul(P), and since no rules create an heterogeneous term, THm~z(P) is never increased. I E removes an impure equation, hence decreases I E ( P ) . No rules except V A create an impure equation. It can be shown that E i - M a t c h , C y c l e and Ei-Res do not increase S V ( P ) : if a new shared variable x is created, then a previously shared variable associated with x must have disappeared. E i - M a t c h and C y c l e 2 add a weakly shared variable to U1 or [72, hence decrease

(P).

305

TH,~uI(P) IE(P)

SV(P)

Um~,~(P) SC(P)

USP(P)

PVR(P)

= T

$

VA IE

=

El-Match Cycle2 Cyclel Ei-Res Var'ReP(!) Var-Rep(2)

= : = --,, : :

: = : -: :

J.= .~= j.= 1-: .L

J. = = ~.= J-:

~. = J,= J.=

Figure 1: T e r m i n a t i o n T h e o r e m W h e n C y c l e 2 applies, a pair of shared variables is added to SC, hence SC (P) decreases. Finally if V a r - R e p does not increase USP(P), then it decreases W(P) by decreasing PVR(P)(case 1). I f V a r - R e p increases USP(P), then, by ]emma 7, it decreases SV(P)

(case 2). T h e termination proof is s u m m a r i z e d in figure 1. A complete proof is given in [1]. We can now state: Theorem

2 Let E1 and E2 be two consistent equational theories on T(F1,X) and

T(F2, X) with F1 n F2 = 0, satisfying assumptions 1 and 2. The following procedure: 1. Apply the rules in $ U { C y c l e } as long as possible, 2. Apply R e p as long as possible. implements a complete unification algorithm for terms in T( FI u F~, X) modulo E1 u E2.

7

Efficiency

T h e algorithm given in this p a p e r is more efficient t h a n [13] because n o n d e t e r m i n i s m is involved only if theory clashes or c o m p o u n d cycles are encountered. Nondeterminism comes in at two levels: • T h e choice of which rule to apply for C y c l e ( C y c l e 1 or C y c l e 2 ) , and the choice of the equation on which to apply the rule for E ~ - M a t c h and C y c l e . • T h e choice of a variable identification for solving restricted Ei-unification problems or variable El elimination problems. For example, if x ~ s E P~ and x ~ t E Pi+l occur in P , then, two possible choices m u s t b e considered: s or t must be m a t c h e d on x. This nondeterministic branching corresponds to labelling step in [13]. If no clash occurs on x, then n o n d e t e r m i n i s m is avoided here while b o t h cases will be considered in [13]. W h e n E i - m a t c h i n g a t e r m onto a variable using restricted E~-unification with respect to U, or when c o m p u t i n g complete sets of variable Ei-eliminators, the n u m b e r of calls to plain E~-unification or constant Ei-elimination grows like the n u m b e r of possible

306

variable identifications. There are as many variable identifications over a set U as the number of partitions of U. Applying a variable identification corresponds to the identification step in [13], where some multiequations are merged nondeterministically. While identifications are applied nondeterministically at the beginning in Schmit-Schaut3' algorithm, here variable identifications are applied only if cycles or clashes occur, and only to the concerned variables which is a relevant optimization. In the same way as for E~-resolution, one can restrict the search for variable E~eliminators to the substitutions that do not Ei-instanciate the variables in Ui, that is the variables that must not be E~-instanciated. This avoids creating new theory clashes.

8

Conclusion

The algorithm presented here gives a new solution to unification in combination of equational theories. It can be seen as an extension of [3] because some inference rules have just been modified in order to deal with arbitrary theories. This shows that using transformation rules is a more modular approach than giving a recursive procedure. Another advantage is that completeness proofs are easier because one can prove separately that each rule preserves solutions, then that normal forms are solved unification problems, and finally that the set of rules terminate for a given control. Moreover, it is easier to separate the logic from the control when designing a unification algorithm, because it is easier to see which rules cause non termination, and to modify them, or to modify the control. It appears here that term replacement is the crucial rule for termination and that it is sufficient to delay its use until the end, while the mechanism is hidden in the recursive calls in [17] or [16]. Acknowledgement:

I thank Jean-Pierre Jouannaud for his advice on this work.

References [1] A.Boudet. Unification dans les Mdlanges de Thdories Equationnelles. P h . D . Thesis, Univ. Paris XI, Orsay, 1990.

[2] L.

Bachmair, N. Dershowitz, and J. Hsiang. Orderings for equational proofs. In Proe. 1st IEEE Symp. Logic in Computer Science, Cambridge, Mass., pages 346357, June 1986.

[3] A. Boudet, J.-P. Jouannaud, and M. Schmidt-Schau6. Unification in boolean rings and abelian groups. J. Symbolic Computation, 8:449-477, 1989. [4] H.-J. B•rckert. Matching, a special case of unification? J. Symbolic Computation, 8:523-536, 1989.

307

[5] W. B/ittner and H. Simonis. Preprint, Siemens AG, Mfinchen, 1986. Embedding Boolean Expressions into Logic programming. [6] B. Brady D. S. Lankford, G. Butler. Abelian groups unification algorithms for elementary terms. In General Electric Workshop on the Rewrite Rule Laboratory, may 1984. [7] Nachum Dershowitz and Jean-Pierre Jouannaud. Handbook of Theoretical Computer Science, chapter Rewrite Systems. Volume B, North-Holland, 1990. [8] J. Hsiang and M. Rusinowitch. On word problems in equational theories. In Proc. 14th ICALP, Karlsruhe, LNCS 267, Springer-Verlag, July 1987. [9] C. Kirchner. Mgthodes et Outils de Conception Systdmatique d'Algorithmes d'Unification dans les Thdories equationnelles. Th~se d'Etat, Univ. Nancy, 1985. [10] A. Martelli and U. Montanari. An efficient unification algorithm. ACM Transactions on Programming Languages and Systems, 4(2):258-282, 1982. [11] U. Martin and T. Nipkow. Unification in boolean rings. In Proc. 8th Conf. on Automated Deduction, Oxford, LNCS 230, Springer-Verlag, July 1986. [12] J. A. Robinson. A machine-oriented logic based on the resolution principle. Journal of the ACM, 12(1):23-41, 1965. [13] M. Schmidt-Schaufl. Unification in a combination of arbitrary disjoint equational theories. In Proc. 9th Conf. on Automated Deduction, Argonne, LNCS 310, Springer-Verlag, May 1988. [14] R. E. Shostack. Deciding combinations of theories. Journal of the ACM, 31, 1984. [15] M. Stickel. A unification algorithm for associative-commutative functions. Journal of the ACM, 28(3):423-434, 1981. [16] E. Tid6n. Unification in combinations of collapse-free theories with disjoint sets of function symbols. In Proc. 8th Conf. on Automated Deduction, Oxford, LNCS 230, Springer-Verlag, July 1986. [17] C. Yelick. Combining unification algorithms for confined equational theories. J. Symbolic Computation, 3(1), February 1987.

SLIM: An Automated Reasoner For Equivalences, Applied To Set Theory Alan F. McMichael

AT&T Bell Laboratories 480 Red Hill Rd., 1A214 Middletown, New Jersey 07748, U.S.A.

Abstract Human reasoners often use logical equivalences ("if and only if" statements) in a directed fashion, employing them as definitions or in a manner similar to definitions. They use them, almost always, to reason "analytically" from complex, "defined" terms to simpler, "defining" terms. One approach to the problem of automating first-order logical inference is to incorporate this directed mode of reasoning in a modification of linear resolution. SLIM (Simple Logical Inference Machine) is a program that implements this approach. SLIM has been applied to basic problems in set theory, and its performance compares favorably with that reported for other reasoning programs. This result is noteworthy because SLIM exploits only general logical features of the set theory axioms and does not contain any specialized domain knowledge. It is hoped that SLIM's basic reasoning method can be enhanced to yield a powerful inference tool for many domains.

1 Introduction First-order logic, considered as a knowledge representation language, suffers from the continued unavailability of a powerful, generalized inference engine. Comparison with Horn clause logic, which is adequately served by the PROLOG inference engine, suggests that first-order logic's intractability is due to the essential presence of logical negation. A rule for negation can be added to the PROLOG engine; the result is a logically complete scheme of linear resolution. However, in the transition, the directedness of Horn clause inference is lost. Specifically, in Horn clause inference, one must always unify with the positive head of a Horn

309

clause in the database, but no comparable restriction seems possible in the linear resolution context. In human reasoning, guidance is often provided by logical equivalences ("if and only if" statements) employed as definitions or in a manner similar to definitions. Reasoning proceeds, almost always, "analytically" from complex, "defined" terms to simpler, "defining" terms and almost never in the opposite, "synthetic" direction. Thus, one way to attack the problem of automating first-order logical inference is to incorporate this directed mode o f reasoning in a modification of the linear resolution scheme. SLIM (for "Simple Logical Inference Machine") is a program implements this idea. Set theory was chosen as a test domain for SLIM because of its: 1.

Well-Constructed Axioms - On account of its role as a foundation for mathematics, set theory has received intense logical scrutiny. Its axioms meet the highest standards of rigor and utility.

2.

Avoidance of Special Problems of Equality - Special difficulties involving the equality relation (the general "=" relation of identity, not the "if and only i£' relation between truth-values) are ameliorated in set theory, since many of the properties of equality in set theory are deducible from the basic axioms without the use of a substitution rule.

3.

Acknowledged Difficulty - Set theory is known to be a source of difficult problems for automated reasoners, problems whose solution would be of "singular significance" [1].

4.

Power - Since set theory is an adequate foundation for all normal mathematics, it provides an ultimate standard of deductive difficulty.

As we shall see, SLIM's performance in the set theory domain is markedly superior to that of linear resolution. And, although there exist other, special purpose programs that display comparable proficiency ([2], [3], [4], [5]), SLIM is an achievement of a different nature. Unlike the special purpose reasoners, which employ a multiplicity of inference rules and are reminiscent of expert systems, SLIM is based on the single inference rule of resolution. To deal with logical equivalences, it applies a sophisticated control scheme, but one that exploits only general logical features of set theory, not its peculiarities. It is conjectured that this generality will allow SLIM's reasoning scheme to be usefully transported to other domains. SLIM is by no means complete. It lacks a rule for equality and lacks a scheme for utilizing previously proved theorems as "lemmas". Also, the methods that it does have should be improved. However, the implementation of its guiding idea, namely directed reasoning from logical equivalences, is of the highest significance and may already make SLIM worthy of its name.

2 The Problem In the early days of automated reasoning, resolution procedures were employed as theorem provers for mathematical domains. They succeeded in proving some hard basic theorems, particularly in abstract algebra. However, even very simple theorems of set theory were out

310

of their reach. Thus, in a long list of mostly positive results in McCharen, Overbeek, and Wos [6], there occurs a report of a disappointing foray into set theory, An attempt to prove the commutivity of intersection with a hyperresolution theorem prover ended when the program ran "OUT OF 240K OF CORE IN 43.51 SEC." An attempt to prove the commutivity of set union ended similarly. The program ran "OUT OF 240K OF CORE IN 41 SEC." The authors conclude, "These problems are interesting because, although they are simple problems for a mathematician, they ffrove to be difficult for the program." (Incidentally, the difficulty is not solved by the larger "CORE" storage now available. As will be made apparent in the comparisons of section 6, resource needs increase too rapidly with increasing problem complexity.) The problem posed by these simple theorems of set theory can be illustrated using the commmutivity of intersection theorem. The method we shall use is OLRA, Ordered Linear Resolution augmented by resolution with Ancestor clauses. (This is the same as what Nilsson and Genesereth call "linear resolution" [7], but supplemented by the restriction of always resolving against the leftmost tip of the proof tree.) Here are the set theory axioms we need, accompanied by their clausal representation: x -- y if and only if x ~ y and y ~; x --1. x = y =2. x ~ y --3. x ~ y

v x~.y v x~y v y~;x

v yafx

x ~ y if and only if for all z, i f z e

x, t h e n z ~

y

~;1. x ~ y v ss(x,y)~ x ~2, x ~ y v ss(x,y) ~' y ~;3. x ~ : y v z ~ x v z~ y xe y~zifandonlyifx~ c~1. x ~ y c ~ z ~2. x ~ y c ~ z c~3. x ~ ' y c ~ z

yandx~

z

v x~'y v x~z v xe y v x~ z

In the subset axioms, SS(X,y) is a skolem term, that is, a term that is introduced to replace an implicit existential quantifier. Specifically, it follows from the initial "if and only if" subset axiom that either x is a subset of y, or there exists something that is a member of x and is not a member of y. The skolem term is a device that provides, given each pair of sets x and y, a unique tag for this "something" that can be used in inference. An OLRA derivation begins with the negation of the theorem and attempts to reduce all alternatives to contradiction:

311 1. anb ~ b n a

(negated theorem) v

2. a n b g; b n a

3. b n a ~ a r i a

(1,=1) 4. ss(anb,bna) • a n b

(2,c_1) 5. ss(anb,bna) • a

(4,n2)

At this point, the OLRA prover enters a trial-and-error phase. Literal 5 must be matched against an axiom literal of the form "[variable1] g [variable2]". There are three such titerals in the axioms for this problem. In a more complex problem, requiring more set theory axioms, there might be many more. Since OLRA's selection of a match is unguided and since other choice points will inevitably occur in the derivation, there are many ways for OLRA to go wrong and it will do a large amount of backtracking. A competent human reasoner, in contrast, would do no backtracking at all for this problem. The OLRA proof procedure is complete and will eventually find a derivation. The total derivation contains four troublesome choice points.

3 Diagnosis There are but two primitive predicates in the language of formal set theory, namely "=" and "• ". All other items in the vocabulary of set theory, such as "~" and "n" are definable in terms of these. Indeed, the axiom x ~; y if and only if for all z, if z • x, then z • y

is really just a definition of the predicate "~". The situation with the axiom x•

y n z if and only if x • y a n d x •

z

is only slightly different. This axiom defines the symbol "n" and, at the same time, implicitly asserts the existence of an intersection for any given pair of sets. Even the third axiom, x = y if and only if x _c y and y ~; x

resembles a definition of "=" for sets, predicate of set theory. A warning is symbol, then we must have extra set equality substitution rule is not lost.

so that it might be said that " • " is the sole primitive in order, however. If we are to treat "=" as a defined theory axioms to insure that the logical power of the The above axiom does not tell the whole story about

312

equality, even in set theory. Because many set theory axioms have the form of definitions - - logical equivalences in which one side contains "more primitive" vocabulary than the other - - simple problems can often be solved by a routine reduction strategy: Use the axioms in one direction only to reduce all literals in the statement of the problem to a representation in terms of the primitive vocabulary; then apply some brute-force method, such as OLRA or one of the other basic resolution procedures, to derive a contradiction. Sophisticated variants of this strategy may include short cuts, sometimes selecting inferences involving nonprimitive vocabulary in preference to continued reduction. The utility of this strategy is well-known to human reasoners, who employ it both in set theory and other formal theories. Of course, it is not an all-purpose deduction strategy. Some problems cannot be solved merely by tracking down the consequences of definitions. Some problems involve the synthesis of an answer - - a more difficult and creative process. Yet the reduction strategy is a useful basic method, and it is unlikely that we can safely ignore it while pursuing the goal of effective automation of reasoning. (Concerning the theoretical basis of the strategy, see the "Appendix".) In the example above, the reduction strategy would bar the unification of literal 5 with the second literal of axiom n l , because, according to the reduction strategy, only the leftmost literals o f the axioms are available for unification (just as in PROLOG). However, if we are allowed to violate linearity and reach back into the proof tree, then a reductive inference is possible using literal 4 and axiom n3. The result is literal 6:

6. ss(anb,bna)

e

b

(4,r-.3)

In fact, the use of a nonlinear inference at this stage, if permitted, secures two advantages. First, an "obvious" inference is performed rather than an unguided choice that might later have to be undone. Second, by means of this second reductive inference involving literal 4, the entire logical content of literal 4 is exhausted. Literal 4 is replaced by a pair of literals that are simpler in form but collectively equal in content. This has the advantage that literal 4 can be ignored in the remainder of the derivation. How do we know that 5 and 6 are equal in content to 4? We know this because 5 and 6 come from 4 by applying the two clauses that represent the reductive half of the "if and only if" axiom for n . Because the axiom is an equivalence, we know that literal 4 has been transformed into an equivalent form. It is one thing to finger linearity as the culprit, quite another to find an effective substitute for linearity. Observe that once linearity is rejected, many literals in the current branch of a deduction tree may be available for inference. (In the partial derivation above, 2, 5, and 6, are unexhausted and so available.) Some scheme must be developed to select particular inferences from the multitude of possibilities.

313

4 A New Rule For Equivalences And A Priority Scheme SLIM can be viewed as an enhancement of OLRA that incorporates a new control rule for equivalences:

Extension By Conjunct: If an active literal in the current branch of the proof tree matches two or more clauses resulting from the clause translation of an equivalence, then an extension of the tree by means of one of the clauses may be followed by an extension using another. With the new rule, SLIM produces an easy proof of the commutivity of intersection. SLIM follows the reduction strategy, reducing literals to primitive form, and never needs to backtrack for this simple problem:

1. anb ~ bna (negated theorem) 2. a n b ~ b n a

3. b n a ~ anb

v

(1,=1) 4. ss(anb,bcha) E anb (2,~1)

S. ss(ac~,bc-~a) ~' bna (2,c2) 6. s s ( " ) ~ ' b

1 t. ss(bna,anb) E bna (3,~1) t2. ss(bna,anb) ~' ac~b (3,~2)

7. ss(")~Ca

13. s s ( " ) ~ a (12,nl)

8. S S ( " ) E a

10. SS(")E a

(4,n2)

(4,n2)

15. SS(")E b (11,n2)

9. SS( " ) ~ b (4,c~3)

XXX (10,7 ancestorrsl.)

16. SS(")E a (11,n3)

v

(5,c~1)

XXX

XXX

(9,6 ancestor rsl.)

(16,13 ancestor rsl.)

v

14. s s ( " ) ~ ' b 17. s s ( " ) E

b

(11,n2) XXX (17,14 ancestor rsl.)

When the symbol 'SS(")' occurs in a branch, it abbreviates the more lengthy skolem term introduced above it. The X's symbolize contradictions. To reason efficiently with multiple active literals, SLIM applies its resolution steps according to a priority scheme: o Using the literal at the tip of the current branch, check for: - - ancestor resolution (which closes the branch) - - match with a one-literal axiom (which also closes the branch) - - extension by conjunct (the next best thing to closing the branch)

314 • For active literals of the current branch, check for: - - extension of the tree by a multi-literal axiom, one that does not introduce a new free variable into the proof tree - - extension that introduces a new free variable, e. g.:

x~a

acb v xs

b

As explained below, SLIM prefers "fresh" extensions of this sort to "copies". A literal is considered to be active in a branch until its content is exhausted by a match or conjunction of matches using clauses derived from an equivalence. In the proof of the commutivity of intersection above, for example, the content of literal 1 is exhausted in the first step and the content of literal 2 is exhausted by the production of Iiterals 4 and 5. Matches that produce new free variables are responsible for an additional complication. They exhaust the content of a matched literal only temporarily. For instance, "x e( a v x ~ b" exhausts the content of "a ~ b", since it has the meaning, "Everything is either not a member of a or it is a member of b." However, when "x e( a v x E b" occurs in a proof tree, its free variable "x" may become bound to a particular term, such as "c". The resulting clause "c ~( a v c ~ b" is not equivalent to "a ~ b" and does not exhaust its content. Thus, when such a binding occurs, the parent literal "a ~ b" is reactivated, so that an additional clause, such as "y e( a v y ~ b", can be generated in the current branch when needed. Such an additional extension is called a "copy". When SLIM is forced to consider extensions of the proof tree that generate new free variables, it looks for "fresh" extensions before it tries "copies". A final noteworthy difference between SLIM and OLRA concerns the initial setup of proof trees. In the example of the commutivity of intersection, the theorem to be proved consists of a single literal, but this is not generally the case. Consider, for instance, the theorem of the transitivity of subset: If a ~ b and b c c, then a ~ c. Negating this theorem results in three one-literal clauses, "a ~ b", "b ~ c", and "a ~ c", which a resolution reasoner must show are incompatible with the axioms of set theory. These clauses, which come from the theorem, constitute its "set-of-support" [8]. OLRA would begin its derivation by arbitrarily selecting one member of the set-of-support to be the root of its proof tree and relegating the others to the role of axioms. Since SLIM can handle multiple active literals, it can do better. It can begin its proof tree with the conjunction of all three members of the set-of-support: 1. a ~ ; b 2. b c _ c 3. a ~ c

315

SLIM transcends the usual distinction between forward and backward chaining reasoners. It can reason "backward" from "a ~ c" or "forward" from the other two literals, according to its priority scheme. This flexibility has proved highly advantageous.

5 Refinements of SLIM's Inference Mechanism SLIM's basic inference strategy, with its new rule for equivalences and its priority scheme, is augmented by several refinements. They are not as important as the basic strategy, but they do merit a brief description: • Ordering Heuristic: When selecting an active literal for application of an extension rule or when ordering the literals from a match with a clause of 3+ literals, SLIM considers literals according to their "specificity". Literals with no free variables are considered first. Of literals with the same number of free variables, those that are "deeper" in function terms are regarded as more specific. • Repetitions: branch.

SLIM has a rule to prevent the expansion of identical literals in the same

• Irrelevancies: If a literal can be deduced from the axioms of set theory without using any of the special hypotheses of the current problem, then it is marked "irrelevant" to prevent further consideration. (This is an extension of the "set-of-support" idea.) • Cut: When SLIM reaches a point at which no more inferences are possible, it backtracks not merely to the last choice point but to a point that unbinds some variable in the failure branch. (This is named "cut" because it is an automated version of the PROLOG "cut" device. Another possible name is "intelligent backtracking".) • Skip: When a proof tree splits into several branches and the first branch is closed without using its initial literal, then SLIM may skip the other branches. In such a situation, the branches represent an unused case analysis. ° Search Heuristics: The simple set theory problems do not require special heuristics. For more difficult problems, various search bounds have been tried, such as depth bounds and bounds on the number of copies permitted in a branch. More work is needed in this area.

6 SLIM's Performance On Some Problems To provide a baseline for relative performance judgements, an equally sophisticated version of OLRA was developed in parallel with SLIM. As the following graphs show, SLIM handily outperformed it on problems in the domain of interest:

316 OLRA vs. SLIM

Commutivity of Intersection

Transitivity of Subset 10-

100 inferences

-

20 -

100-

10-

seconds

5-

50

200 -

"Schubert's Steamroller"

Associativity of Intersection 20k-

1--I

10k-

lk

5k

.Sk

'Z 10k

'Z

1

// f/ //

Z // // //

"/ // // // // // // // // //

_ _

(82)

(10)

SLIM's slightly poorer performance in the "Schubert's Steamroller" problem is explained by the fact that the reduction strategy is not available in the context of this problem's artificial axiom set [91. The version of SLIM used in the comparison did not have a full set of refinements. The ordering heuristic and simplified repetition and cut rules were implemented, but not the irrelevancy and skip rules. The version of OLRA used in the test shared the same capabilities. The inference times for both programs are large because they are symbolic interpreters and because the comparison was done on a PC. SLIM also solves more difficult problems in set theory. Some examples: infs in total solution infs BLEDSOE PROBLEM P(a) c~ P(b) = P(ar~b) 39 202 PASTRE PROBLEM If a ~ b, a ~ b, b c_ c, then a ;e c 16 22 POWER SET OF SINGLETON Find x and y in P({a}) such that x ~ y 21 72 DOUBLETON SETS {a,b} = {a,c} if and only if b = c 246 1872 ORDERED PAIRS { { a } , { a , b } } = { { c } , { c , d } } if 4580 385328 and only if a = c and b = d

317

The first of these problems is cited in "Non-resolution Theorem Proving" [2] for its resistance to resolution proof techniques. SLIM succeeds in solving the problem and SLIM is a resolution reasoner - - although one of a sort Bledsoe did not have in mind. The second problem is one that a non-resolution theorem prover of D. Pastre failed to solve [3]. It illustrates one of the dangers of departure from resolution techniques. Resolution is the basis of simple, logically complete proof methods. If we move away from it and towards complex sets of rules tailored to specific problems, then completeness may be lost and "blind spots" may appear. Pastre's problem is an example. It is logically simple and SLIM solves it easily. In the set theory problems discussed so far, SLIM is able to construct proofs directly without backtracking. However, for the last three problems shown in the table, SLIM's reduction strategy remains adequate and useful, but it does not preclude the need for trial-and-error search. Also, these problems exercise the complete set of inference refinements. Problem three shows that SLIM can solve a problem that requires the return of an answer. Problem four, the doubleton sets problem, is described as "difficult" in Suppes [10]. I would not call it difficult, but certainly it is tedious, requiring many inference steps. The ordered pairs problem is so tedious that it truly is difficult. F. Brown cites it as a challenging problem solved by his automated reasoner. SLIM appears to solve it, although the proof is so long that I have not attempted to verify it by hand. One reason the proof is so long is that SLIM has no substitution rule for equality. Thus, one half of the theorem, the "if' half, which is elementary given a substitution rule, must instead be proved from the basic set theory axioms. This is possible, but SLIM required 300,000 inference steps to do it! The other half of the theorem, which also has a lengthy proof, required "only" 85,000 inferences.

7 Conclusion SLIM achieves its basic objective in the selected domain of set theory. It is able to handle routine inference problems using the reduction strategy. Unlike linear resolution, it makes good use of "if and only if" axioms. However, there remain areas for improvement both in relation to its basic objective and in relation to its suitability for more ambitious automated reasoning projects. First, experience has shown the need for additional refinements of SLIM's basic inference mechanism. Although existing refinements significantly prune SLIM's search space, SLIM still searches many paths that human reasoners know to avoid. Codifying this human knowhow is a difficult task requiring careful examination of lengthy proof trees. It is very easy to misstate the rule that a human would use at a particular stage in a proof, hence much experimentation and testing is needed. The existing refinements for repetition and irrelevancy exemplify the difficulty. Much effort was expended in correcting initially plausible but faulty versions of these rules. Second, as stated above, SLIM lacks a substitution rule for equality. This simplified the development of SLIM, but certainly a substitution rule must ultimately be incorporated. Otherwise, many problems, particularly in mathematical domains, will remain beyond SLIM's reach.

318

Third, SLIM is currently able to reason only in terms of primitive axioms of set theory. It makes no use of previously proved theorems as "lemmas" in the construction of new proofs. Obviously this approach must be modified if SLIM is to tackle new problems in an efficient manner. There is no sense in constantly reproving known facts. A particularly blatant example of such inefficiency is SLIM's check for irrelevancy. The irrelevancy check eliminates from proof trees such literals as "a ~ {a}", "b ~ {b}", "a ~ a", and "b = b". SLIM returns to the basic axioms of set theory to prove these, but it would be far more efficient to store the constantly recurring forms that are already known to be provable. Finally, SLIM always proceeds analytically using the reduction strategy. This is acceptable in view of its basic goal of competent, routine reasoning. However, this does mean that SLIM is forever barred from the construction of "synthetic" proofs, proofs that require the creative discovery of some special object. An example is the proof of Cantor's Theorem, the theorem that the power set of a set cannot be mapped one-to-one into the set. The proof of this theorem begins with the assumption of its negation. That is, suppose that there is a one-toone function i from P(a) into a:

{x: x

f-l(x)}

Cantor produced a contradiction by considering a special subset of a, namely, the set of all members x of a such that x is not a member of the set that f maps to a. Certainly SLIM could not discover such a set and produce the contradiction merely by pursuing the reduction strategy. Of course, this is not a shortcoming peculiar to SLIM. It is not clear how to automate Cantor's discovery using any existing approach. (But see Andrews [11].) This is definitely an area for further research. Another area for future work concerns the applicability of SLIM to other domains. SLIM's inference mechanism is designed for general use. A guiding conjecture is that more effective knowledge representations can be developed for many domains if there exists a capability for reasoning efficiently with definitional hierarchies and their associated logical equivalences. This conjecture needs verification. Some studies should be done for less abstract domains than set theory.

319

Acknowledgments I am grateful to Paul H. Callahan, David E. Leasure, and John Roach for their help in reviewing this paper.

Appendix: Theoretical Basis of the Reduction Strategy The essential idea of the reduction strategy is to use logical equivalences in one direction only to eliminate certain symbols from the formulas Qccurring in a proof and to complete the proof using the reduced formulas. What we want to know from logical theory is whether working with the reduced formulas is in fact equivalent to working with the originals. This question can be investigated in the context of a fairly rich system of first-order logic, one in which logical equivalences can be represented in single statements using the biconditional symbol, ~--~. It is assumed that this system is one for which proofs and derivations are simple sequences of statements (as opposed to one that involves trees, tableaus, or assumption boxes). The results proved under these assumptions will hold for any adequate system of first-order logic. Many set theory axioms, such as the union and intersection axioms, have a typical form:

(v)(gl)...(tJ, n) (v ~ 5(p, 1

....

,gn) ~

~V'#l ..... #n

)

The result to be proved will pertain to axioms of this form, but a similar result holds for axioms of slightly different form, such as the subset axiom (that axiom "defines" a relation, as opposed to a function). Let A be an axiom of the above form and let T be a collection of set theory axioms that do n o t contain the fimction symbol & Corresponding to A is a transformation rule that replaces formulas matching the left side of A with formulas matching the right side. Let F be a set of formulas that can be transformed by means of this rule into another set of formulas, F', none of which contains the function symbol 5. Let 13 be an individual formula that can be similarly transformed. (In all of our "analytic" set theory problems, the premises and conclusions of the problems can be transformed in this manner.) It can be proved that: B is derivable from F in theory T+A if and only if B' is derivable from F' in T. Proof: ---~. Let D be a derivation of B from F in "I-+A. Observe that the transform of every logical inference rule used remains a valid logical inference rule. Observe also that the transform of axiom A is a logically provable formula so is clearly provable in the theory T. Thus, corresponding to derivation D is a derivation D' of B' from F' in T. Simply replace each formula in D by its transform. Then, replace each occurrence of the transform of A with the sequence of formulas that constitutes a proof of the transform in T. The final result is the desired D'.

320

~---. By the theorems of completeness and consistency for the underlying system of first-order logic, it suffices to show that if B' is a semantic consequence of F' in theory T, then B is a semantic consequence of F in theory T+A. Suppose, for a proof by contraposition, that 13 is not a semantic consequence of F in theory T+A. Then there exists a T+A-model M of F and -13. But since the underlying logic is complete, the formulas in F' can be derived, using A, from the formulas in F. Similarly, -13' can be derived from - B . Because the logic is consistent, relations of semantic consequence also hold. Therefore, by the transitivity of semantic consequence, M must also be a model for F' and - B ' . It follows that 13' is not a semantic consequence of F'. (End of Proof) Under the assumptions of the theorem, axiom A can be applied solely as a reduction rule without affecting the existence of a derivation, which is the result desired. All that remains is to determine, by inspection, that the assumptions of the theorem in fact hold for the problems attacked by SLIM. Of course, the theoretical result does not guarantee that the algorithm used by SLIM is logically adequate or computationally efficient! What it does show is that certain problems can be solved by the method SLIM is intended to implement.

References [1]

Wos, Larry, Automated Reasoning: Thirty Three Basic Research Problems, PrenticeHall, Englewood Cliffs, New Jersey, 1987.

[2]

Bledsoe, W. W., "Non-resolution Theorem Proving," Artificial Intelligence Journal 9 (1977), 1-35.

[3]

Pastre, D., "Automated Theorem Proving in Set Theory," Artificial Intelligence Journal 10 (1978), 1-27.

[4]

Brown, F. M., "Towards the Automation of Set Theory and Its Logic," Artificial Intelligence Journal 10 (1978), 281-316.

[5]

Pastre, D., "MUSCADET: An Automated Theorem Proving System using Knowledge and Metaknowledge in Mathematics," Artificial Intelligence Journal 38 (1989), 257318.

[6]

McCharen, J., Overbeek, R., and Wos, L., "Problems and Experiments for and with Automated Theorem-Proving Programs," IEEE Transactions on Computers C-25 (1976), 773-782.

[7]

Genesereth, M., and Nilsson, N., Logical Foundations of Artificial Intelligence, Morgan Kaufman, Los Altos, Califomia, 1987.

[8]

Wos, L., Robinson, G., and Carson, D. "Efficiency and Completeness of the Set of Support Strategy in Theorem Proving," Journal of the Association for Computing Machinery 12 (1965), 536-541.

321

[9]

[10]

Cohn, A. G., "On the Solution of Schubert's Steamroller in Many Sorted Logic," Proceedings of the Ninth International Joint Conference on Artificial Intelligence 1988 (Los Angeles, California), 1169-1174. Suppes, P., Axiomatic Set Theory, Van Nostrand, Princeton, New Jersey, 1960.

[11] Andrews, P. B., "Theorem Proving via General Matings," Journal of the Association for Computing Machinery 28 (1981), 193-214.

An Examination of the Prolog Technology Theorem-Prover Mark Tarver m a r k ~ u k , a c . l e e d s , des Division of Artificial Intelligence University of Leeds

Abstract The Prolog Technology Theorem Prover (PTTP) is one of the fastest theoremprovers built. Howevcr its speed does not compensate for its lack of control. By embedding the P T T P in an environment which allows the use of meta-level inferencing it is possible to grcatly improve performance. The TPL theorem-prover is a refinement based ATP system which incorporates a version of the PTTP. Keywords: P T T P , refinement, metalevel reasoning, Prolog Normal Form. The

Limitations

of the

PTTP

In 1984 Mark Stickel proposed that the technology used to develop fast implementations of Prolog, could be applied to production of a near-Prolog theorem-prover, the Prolog Technology Theorem Prover ( P T T P ) . Using Prolog compilation techniques in conjunction with model elimination resolution, Stickel (1986) built a version of the P T T P in Lisp that ran at 5000 LIPS on a Symbolics 3600 Lisp Machine. In 1986 an NLP project was begun at the University of Leeds involving a large amount of first-order reasoning in a first-order knowledge base of over 90 axioms on speech-act theory. Experience with the theorem-provers described in such introductions as Chang & Lee (1973) and Nilsson(1980) 1 showed that they were incapable of deriving solutions to speech-act problems in any reasonable time. A version of the P T T P was built to meet this problem and the result, T H O R N (Theorem Prover Based on HORN Clause Logic), successfully met the requirements of the project. Subsequent to this early success, T H O R N was tested on a portion of naive set theory (Fig 1). Surprisingly T H O R N often struggled with problems that were mathematically trivial to solve, despite the fact that the axiom base was much smaller than that of the NLP project. Further analysis showed why this was. *This research was supported by SERC grant GR/F/07866 under the heading Computer Assisted Formal Reasoning, title "Proof Development For Formal Systems" led by Professors R. Burstall and R. Milner. 1Specifically, set of support, unit preference and unrestricted linear resolution.

323

Fig. 1. A P o r t i o n of Set T h e o r y

1) (v x) (4 (x e 0)) 2) 3) 4) 5) 6) 7) 8)

(v x,y) ((x C. y) ~-* (V z) ((z e x) --~ (z e y))) (V x,y)(((x C y) ~ (y C__x)) ~ (x = y)) (V x,y,z) (z = (x U y) +=+ (V w) ((w e z) ~ ((we x) v (we y)))) (V x,y) ((x = P y) ~-~ (V z) ((z e x) ~-~ (z C y)))))) (v x,y,z) (~ = (x n y)) +-+ (v w) ((w ~ z) ~ ((we x) ~ (w~ y))) (V x,y) (x = y') ~ (V z) ((z e x) ~ (-1 (z c y))) (V x,y,z) x = ( y - z) ~-~ (V w) ((w e x) ~-~ ((w e y) ~ (-1 (w~ z))))

Structure

n o t S i z e is I m p o r t a n t

Conventional expert systems written in Prolog generally take the form of a collection of rules and a collection of facts. A typical query to such an expert system will mediate its reply through backward chaining from the problem via the rules to the facts provided. Such systems can be very large, but nevertheless efficient. The reason for this efficiency is the structure of the call g r a p h associated with the expert system. A call graph is a directed graph that shows the call-relations between the procedures of the system so that if two nodes A an B of the graph are connected as so:A

~B

then there is a Horn-clause in the system of the form (A tl,...ti) +- ...,(B tl,...,tj),.... The call-graphs of Prolog expert systems tend to approximate to trees. The leaves of the tree correspond to the procedures that are associated with facts, since these procedures do not invoke any others. Prolog programs with this structure are bound to terminate. If a Prolog procedure can invoke itself, then in all probability the procedure is a recursive procedure and the recursion bottoms out when the base condition is reached. Some simple first-order theories (like the speech-act knowledge base of our introduction) have call-graphs which approximate pretty well to those of Prolog expert systems. Not surprisingly the PTTP scores well on problems with this sort of axiom base. However axiom systems from mathematics, though much smaller, have a very different structure. Their call-graphs are extremely cyclic and the cyclicity is not bounded by any wellfounded relation terminating in a base case. For this reason, mathematical theories, unlike expert systems, have no explicit control Structure. For example, the eight axioms of fig t. generated 99 contrapositive rules of inference. The associated call-graph of these contrapositives is:-

324

Fig. 2. T h e Call G r a p h for some Basic C o n c e p t s o f Set T h e o r y

DIFFERENCE

INTERSECTION

~ ~ . . . ~

~

y

~ MEMBER

COMPLEMENT

~

POWERSET

*

SUBSET

EQUAL

The graph is highly cyclic, with MEMBER being the focus of the cyclicity. The typical behaviour of THORN confronted with a simple problem (eg that UNION distributes over INTERSECTION) was to cycle through this graph until the MEMBER node was reached; after that THORN wasted a lot of time with bizarre configurations involving POWERSET, INTERSECTION and SUBSET etc. Amongst this set of contrapositives there are no less than 14 contrapositives headed (MEMBER x y) *-- .... leading off to various destinations. Significant theorem-proving became impossible. 2 The PTTP

has no idea of Relevance

The PTTP shows a steady depreciation in performance as irrelevant axioms are added to its knowledge base. The table below shows the decay in performance for a current implementation of the PTTP as new and irrelevant axioms are added to the axiom base when trying to prove a theorem. The theorem proved is that if V = 0' and V N a = V then V = a. This has a 14 step proof in the PTTP and is provable from axioms 1,2,3,4 and 6. These timings were gained on a SUN3/80 running Kyoto Common Lisp using incremental depth first search. Fig. 3. Axioms A d d e d

Time

Inferences

1,2,3,4,6. + 5. + 7. + 8.

97.900s 186.200s 233.067s 287.733s

8,459 15,223 19,345 23,836

2It is likely t h a t a n i n v o c a t i o n of R o b i n s o n ' s P u r i t y P r i n c i p l e w o u l d h e l p t h e P T T P to s o m e extent: allowing it to reject s o m e a x i o m s w h i c h c a n n e v e r figure in a d e r i v a t i o n . How effective it w o u l d b e in c u r b i n g t h e p r o b l e m of r e l e v a n c y m e n t i o n e d in t h e n e x t s e c t i o n w o u l d h a v e to be d e t e r m i n e d experimentally.

325

Mathematics

is n o t

Chess

The machine on which these figures where gained was a SUN 3/80 - a conventional workstation with a Von Neumann architecture. The best speed for FOL problems (search to depth 10) on a SUN 3/80 was only 200 LIPS. The P T T P was conceived to be an engine that would run far faster than this; and it might be thought that with much greater speeds produced by better hardware the problems facing the P T T P could be defeated. A beguiling comparison offered by Stickel(1984) was that the P T T P could be conceived of as an analogue to the powerful chess machines which are hardware-designed to search game trees at high speed. This is an attractive thought because the current speeds of the best Prolog compilers on our best machines do compare to the speeds of the latest chess machines. For example Deep Thought, a chess machine from M.I.T., runs through about 750,000 board positions per second. A Prolog compiler in Komatsu et a1.(1986) runs at 1 M E G A L I P on an IBM 3090. Deep Thought plays grandmaster chess by brute force, so couldn't the P T T P do mathematics by brute search? Unfortunately promise does not match performance; as a thought experiment we can imagine a 'super' P T T P running on a 1,000 processors each 10 times faster than the Motorola 680030 of the SUN3/80. With a branching rate of about 3 for our axiom set, all 1,000 processors would be engaged in search after reaching depth 10. Thereafter each processor would work 10 times faster than the 680030, but the search would no longer be parallel to the same extent. In short, this super P T T P would experience difficulties about 10 depths beyond the depth at which the 3/80 P T T P begins to falter. In that case the super P T T P would start to lag between depths 20-30. But the significant theorems of set theory lie far beyond this bound, and use far more axioms than our eight axiom set. 3 The flaw in Stickel's analogy is that in chess the computer can simply refuse to search beyond a certain number of plys. In mathematics all proofs have to played down to a final Q.E.D. Without some means of controlling search and abstraction, the P T T P is effectively limited in the problems it can tackle. If Deep Thought had to reason to a conclusive winning position in order to make a move, then it would be in a similar position to the P T T P . It would be able to win a game provided it was half a dozen moves from mate. These considerations suggest that efforts to improve the performance of the P T T P by running it in parallel, (Bose et al. (1989)), though interesting, are not in themselves going to solve the combinatorial problems posed to the P T T P . Parallelism is less likely to make a profound contribution to automated deduction than it is to machine chess. Programming

the

PTTP?

One way of challenging these vast search spaces is to allow the user to program the P T T P . But it is difficult to interact with the P T T P at an object level because object-level resolution proofs are often difficult to follow and users' intuitions are often confounded. The solution adopted in the T P L 4 was to conduct proofs at a metalevel, and so send subproblems down to the P T T P at an object level, when these problems were sufficiently simple to be solved by the P T T P . Instead of compiling a mass of largely irrelevant axioms 3For example, see the challenge problem in chapter 6 of Wos[1989] concerning homomorphlsms, which completely defies our PTTP. 4Theorem Proving Laboratory

326 into code, the axioms needed to solve the problem are decided at the metalevel and sent to the P T T P at run-time for compilation into efficient code. Mediating between the metalevel and the object level in T P L is a third, intermediary level represented by a piece of software called the preprover. The preprover's task is to interpret problems handed down from the metalevel into a form which the P T T P can solve. Occasionally the preprover can solve problems itself without calling upon the P T T P and in those cases it does so. The

Metalevel

Proofs conducted in the TPL metalevel are refinement proofs in the manner of NuPrl (Constable et al. (1985)) and related systems. A refinement problem in T e L has the form < < m e t h o d > >. The <method> is the method that the user wished to be invoked on the problem, the is the immediate problem to be solved and the is the set of assumptions from which to solve it. After a method is invoked the theorem-prover backward chains in search of a solution. The user has the ability to make the theorem-prover display its reasoning and halt after each step. In order to conduct proofs in this manner, the user simply types ( i n t e r a c t <procedure1> . . . < p r o c e d u r e , , > ) . Thereafter the theorem-prover will display its reasoning whenever any of the listed procedures is called. A break package is supplied to enable the trace to be disabled and inferences can be skipped by an auto command that tells the theorem-prover to return after having made a specified number of inferences. Traced procedures also leave behind a proof record which can be consulted at the end of a successful search and proofs can be dumped to text files and laser-printed. A facility exists for inserting natural language comments into meta-level control programs. After the conclusion of a successful proof attempt, these comments will be used in the production of a proof. Untraced procedures leave no proof record. Metalevel

Languages

of TPL

T P L currently runs on Kyoto Common Lisp, and at the outset of the project it was intended that Lisp be the control language of the TPL metalevel. However Lisp proved to be too low-level for the purposes of directing the P T T P and two control languages emerged. Both these languages came from differing operational interpretations of the virtual machine SLAM 5 used to define the PTTP. The first, Backlog, supports backtracking like Prolog, but unlike Prolog, patternmatching functional expressions within Backlog clauses are evaluated and this process replaces unification as the means by which lists are composed and dissected. A further reinterpretation of the operational semantics of SLAM issued in a second language - a pattern-matching functional variant of Lisp called R a t i o n a l Lisp designed to facilitate rewriting in first-order logic. In consequence of this design, the same virtual machine that drives the P T T P also drives the control languages that enable it to be used effectively. The compactness of Rational Lisp and the code sharing induced by running the implementation from 5An acronym for Sorted Logic A b s t r a c t Machine. It is intended that the P T T P in TPL will run on many-sorted logic.

327

one virtual machine means that the implementation is very compact (< 3000 lines of machine-generated code). Rewriting

in TPL

Mathematicians make extensive use of rewrite rules in performing proofs. Typically rewrite rules can be used to reduce an expression given either an equality or an equivalence. In T P L , concepts that are to be subjected to rewriting are declared as abstractions at a metalevel by the directive ( a b s t r a c t i o n s f u n c l , . . ~ func,~). Once a concept is entered as an abstraction, the rewrite rules associated with it are entered in the form of a Rational Lisp function that defines how uses of the concept are to be treated. T h e abstraction facility is coupled to a set of higher-order rewrite functions 6 that are part of the T P L system. These are ( r e w r i t e < e x p r > ) , which takes an < e x p r > and replaces each abstraction in it according to the associated rewrite rules, ( r e w r i t e b y < a b s t r > < e x p r > ) which replaces all occurrences of < : a b s t r > in < e x p r > by their rewrite equivalents, and ( f i x r e w r i t e < e x p r > ) which rewrites all abstractions to their fixpoint. The function r e w r i t a b l e ? is a recogniser for an expression which can be reduced by a rewrite rule. The

Preprover

The preprover is a preprocessor for translating metalevel problems into a form suitable for the P T T P to solve. The preprover can also be thought of as a weak theorem-prover since it can occasionally solve problems without appeal to the P T T P . The task of the preprover is to put refinement problems in first-order logic into P r o l o g N o r m a l F o r m . The idea of the reduction to Prolog Normal Form is that we want a goal to consist of a conjunction that will form the basis of the goal stack of the P T T P . When a goal is in PNF, the" corresponding goalstack can be elicited by removing the conjunction signs and forming the remainder into a list of literals. These literals can then be signed, thus eliminating any use of the negation sign and the context compiled into Lisp. From that point the mode of execution is that of the P T T P . The recursive definition of Prolog Normal Form is as follows:1. Any literal is in Prolog Normal Form. 2. If A is in PNF and B is in PNF then A & B is in PNF. 3. (Closure) If a wff A is not in PNF by 1-3 then A is not in PNF. Reduction

to PNF

in the

Propositional

Calculus

In the course of reducing a refinement problem to Prolog Normal Form, the preprover often divides the original problem into subproblems. This strategy of division helps to make problems more tractable. The process of reduction is similar to Bledsoe's (1971) S P L I T subroutine in his P R O V E R ATP, with the addition of an important non-deterministic rule regarding implication. 6Compare Paulson(1985).

328

The refinement rules which drive the reduction to PNF in the preprover are as follows:R u l e s f o r R e d u c t i o n to P N F in t h e P r o p o s i t i o n a l Calculus A, A k A

At- (A~B) AU{A}FB

AF,,,,(A--,,B) AU{~B} F-~A

A b (A V B) A k (--, A --. B)

A k --, -~ A At-A A k -~ (A V B) Ak-~A&-~B

Ak(A&B) AkA, A kB

A b(A ~ B) A k (A --+ B), A t- (B --* A)

A k -1 ,,,,(A --. B) AF (A&-~B)

A k -, (A & B),,, Ak (-~AV-~B)

(, ,A, B) Ak (A&-~B) V(B&-A)

These rules are all deterministic save the two which deal with a goal of the form (A B). In one case the strategy is to assume A and prove for B; in the other to assume -~ B and prove for -~ A. The preprover is written in Backlog so that if the first strategy fails the second is attempted. The reason for this pair of non-deterministic rules is that the P T T P is incomplete. Given a goal and an inconsistent set of axioms the P T T P may fail to derive a solution. 7 The simplest case is the problem P & -~P k Q. If P and -~P are compiled into code and Q is attempted the search will fail. Not infrequently, the P T T P is passed refinement problems which have this form (i.e. the context is inconsistent) and in such cases by adopting the alternative treatment of (A ~ B) the problem can be solved. A simple example is the problem P ~ (P V Q). A search tree of the problem shows how the nondeterministic treatment of --* plays an essential part in deriving a solution.

rlrt accounts of the P T T P written by Stickel(1988) and by Warren & Maier(1988), no mention is made of this incompleteness and b o t h authors state t h a t the P T T P is complete. They were presumably thinking of cases where the axiom base was consistent.

329

Derivation

o f P --* ( P V Q ) b y t h e P r e p r o v e r F P ~ (P V Q)

PFPvQ

P F "~P --* Q

P -~P F- Q

II

P -~Q f- -~-~p

L

P, --,Q b- P

[]

It is easy to see t h a t the r e d u c t i o n rules g i v e n a b o v e 8 are t e r m i n a t i n g , since they reduce the size of the goal. A p r o o f t h a t they t e r m i n a t e in a f o r m u l a in Prolog N o r m a l F o r m is essentially s t r a i g h t f o r w a r d b u t r a t h e r long. 9 Sin the actual implementation I also use the rule (A v B) ---* C there]ore (A -* C) & (B ~ C) as a means of splitting up problems 9Essentially a reduetio. We assume that the process terminates in a formula not in PNF and show that it must fall into one of a finite number of cases. We then show that for each case there must be an applicable reduction.

330

Reduction

to PNF

in the

Predicate

Calculus

In THORN, arbitrary first-order formulae that could not be immediately expressed as a series of Prolog goals were dealt with by what was called the "Fido" method. The method was to dicharge a proof obligation to prove P from a set of assumptions A, by proving that A,p --+ FIDO }- FIDO, where FIDO is an arbitrary proposition. The idea is that since the only information that the P T T P possesses about FIDO is that FIDO is provable from P, a proof of FIDO is ipso facto a proof of P. Since FIDO is a simple literal, it can be directly expressed as a Prolog goal. Though the "Fido" method is quite sound it is also highly unnatural. Certain formulae require the "Fido" treatment, but many first-order goals can be treated more naturally by decomposing them according to an effective procedure which we outline below. To simplify the account of the reduction of a predicate calculus formula to Prolog Normal Form, we will assume the formula has been placed in prenex form.

1. P = QlVl, ...,Q,~v,~O and P is in prenex form. 2. Working from left to right until either 0 or an existential quantifier is encountered, transform P by eliminating each P1 = Vvi, Qi+lVi+l, ..., Q,~vnO in favour of P2 = Qi+lvi+l,..., QnvnOv,/t where t is an unused name and vdt indicates that t replaces vi in all occurrences. This step reflects the well-known rule that one proves a universally quantified formula by proving for an arbitrary case. 3. Let R be the resulting formula. Either R is in Prolog Normal Form or it is not. If it is then it may be transformed into a Prolog goalstack by eliminating the conjunction signs. Suppose then it is not in Prolog Normal Form. In this case it falls into one of 3 cases. 4. It contains no quantifiers. In that case it can be dealt with by the rules for reduction to Prolog Normal Form in the Propositional Calculus. 5. The matrix of R is not in PNF and all quantifiers are existential, then we convert the matrix into disjunctive normal form so that R becomes R' = (3v), ..., QnvnAvB and distribute the existential quantifiers over the disjunction. This process is repeated on A and B if necessary until all matrices are in Prolog Normal Form. 6. The matrix of R is in Prolog Normal Form, but there are intervening quantifiers. Here the technique is to skolemise the formula, but with the rules for the skolemisation of bound variables reversed. The rationale for this approach is based on the standard approach for proof by resolution. Given a formula to prove, negate it and prove a contradiction. Negating R and driving the negation sign inwards reverses the quantifiers and leaves the negation sign dominating a matrix which is in Prolog Normal Form. If the result is then skolemised, the negated matrix -~ 0 is left. Expressed as a Prolog-style goal this becomes ~ 0. Reversing the rules for the skolemisation of bound variables is a convenient ellipsis of this procedure. 7. The matrix is not in Prolog Normal Form and there are universal quantifiers in the scope of existential ones. Then the formula is a "Fido" formula which is dealt with by the Fido method. 1° 1°Use of the Fido method is relatively rare. One possible alternative to the Fido method would be

331

In the actual implementation, the conversion to prenex form is demand-driven (i.e. the preprover does not convert to prenex form unless it seems required, as with multiple mixed quantification). In m a n y cases it proves unnecessary to convert to prenex form since working in and replacing V signs by skolem constants is often sufficient to reduce the goal to a set of goals in Prolog Normal Form. Conversion

to Prolog

Normal

Form

Loses

Completeness

T h e preprover + P T T P is not complete for two reasons. 1. If the initial context is inconsistent, then the preprover m a y return a ao for the same reasons as the P T T P itself. 2. Typically the preprover m a y call the P T T P several times in the course of a single proof. Calling the P T T P with a problem t h a t is insoluble and sends it into an endless search m a y forstall a solution t h a t would have been gained if the preprover had chosen another node in the search space. The

PTTP

in TPL

T h e P T T P in T P L is substantially that of Stickel with certain design and implementation changes. The goal stack is maintained destructively as a side-effect of successful unifications of the heads of clauses, backtracking, ancestor resolution and loop detection. Unlike Stickel's P T T P there is no incrementally bounded search; but the user can specify in advance the depth to which he wishes the search to go. Facility exists for interactively tracing the P T T P and giving yes-no directives to it. When the P T T P is called by the preprover, the context of the problem is compiled into code and the goal becomes the basis of the stack. Clauses are compiled to favour unit-preference resolution. A Theorem

Prover

for Basic

Set Theory

in TPL

Since it was some basic problems in set theory that first showed the weaknesses of the P T T P , a natural first test for the system was to specify a theorem-prover in T P L which could solve those same problems from the same axiom base. Z e f f was a simple T P L p r o g r a m of only 30 lines in which these axioms formed a knowledge base.

to strip the existential quantifier away from a Fido formula creating a free variable, and decompose the matrix by the preprover procedure, trying to solve whenever possible, by metalevel techniques. When a goal is solved, any binding for any free variables would have to be transmitted into the remaining goals. This would be a sort of "meta-Prolog" way of dealing with Fido formulae that would probably be much more effective than the Fido method.

332

Code for Zeff ; ZEFF: A THEOREM PROVER FOR BASIC SET THEORY (abstractions == mem subset) (deflog Zeff x y <-- (Zeffl (rewrite x) (rewrite [(emptysetaxiom)

: y])))

(deflog Zeffl goal? hyps? (not (rewritable? goal?)) (not (rewritable? hyps?)) <-- (preprover goal? hyps?) [x <=> y] hyps? <-- (Zeffl [x => y] hyps?) (Zeffl [y => x] hyps?) [x & y] hyps? <-- (Zeffl x hyps?) (Zeffl y hyps?) goal? hyps? <- (preprover goal? hyps?) goal? hyps? <- (Zeffl (rewrite goal?) (rewrite (split-conj hyps?)))) (defrl emptysetaxiom -> [[all "x] [" [mem "x 0]]]) (defrl == x y -> [[subset x y] ~ [subset y x]]) (defrl subset x y -> (subst (newvar) "x [[all "x] [[mem "x x] => [mem "x y]]])) (defrl mem X [union y Z] -> [[mem x y] v [mem x z]] x [inter y z] -> [[mem x y] & [mem x z]] x [dill y z] -> [[mem x y] & [" [mem x z]]] x [compl y] -> [" [mem x y]] x [powerset y] -> [subset x y] x y -> [mem x y] )

T h e procedure Zeff follows is to receive a refinement problem and add the definition of the e m p t y set as an axiom; the problem is then handed to Zeffl for solution. Zeffl checks to see if there are any abstractions in the problem t h a t can be rewritten. If not, then the problem is treated as a first-order problem and the preprover procedure is invoked. T h e < - - is the Backlog cut so Zeffl is committed to this choice. If the goal is conjunctive, Zeffl splits the problem into its parts. Again the < - - is used as a cut to c o m m i t Zeffl to this choice. If there are abstractions to be rewritten, then the expansions are made and the results sent to the preprover to solve. If the preprover fails then Zeffl is reinvoked over the rewritten forms. The process continues until either a solution is found, or all abstractions are fully rewritten, in which case the proof a t t e m p t fails. Unlike T H O R N , the concepts of union, intersection and so on, are not entered as formulae in first-order logic. Instead they are entered as abstractions, and their meaning is explained in RationM Lisp. This t r e a t m e n t gives Zeff the ability to pull in just the

333 i n f o r m a t i o n r e q u i r e d to solve t h e p r o b l e m w i t h o u t g e t t i n g b o g g e d d o w n in u n n e c e s s a r y search. Since we are free to define o u r own n o t a t i o n , union, i n t e r s e c t i o n a n d o t h e r o p e r a t i o n s h a v e been defined as f u n c t i o n s r a t h e r t h a n as p r e d i c a t e s , following t h e u s u a l m a t h e m a t i c a l p r a c t i c e . T h e a b s t r a c t i o n s are l i n k e d to the t o p - l e v e l B a c k l o g clause Zeff b y t h e r e w r i t e f u n c t i o n which tells t h e T P L i n t e r p r e t e r t h a t all t h e a b s t r a c t i o n s in t h e c o n t e x t a n d t h e goal a r e to be r e w r i t t e n i n t o t h e i r i m m e d i a t e c o n s t i t u e n t s . D e s p i t e i t s v e r y s m a l l size, Zeff can p r o v e t h e o r e m s o f a s t a n d a r d a s s o c i a t e d w i t h d i s c r e t e m a t h e m a t i c s courses for first y e a r s t u d e n t s in c o m p u t e r science a t a s p e e d which is c o m p e t i t i v e w i t h results g a i n e d b y P o t t e r & P a i s t r e (1988) using t h e i r r e w r i t e s y s t e m 11 T h e t a b l e o f results b e l o w gives Zeff's t i m i n g s on s o m e s t a n d a r d i n t r o d u c t o r y p r o b l e m s a g a i n s t r u n n i n g those s a m e p r o b l e m s b y raw o b j e c t - l e v e l search on t h e P T T P using t h e " F i d o " m e t h o d in c o n j u n c t i o n with i n c r e m e n t a l d e p t h - f i r s t search. I t a l i c i s e d figures are Zeff's t i m i n g s , while R o m a n figures are those of t h e r a w P T T P . All figures were g a i n e d on a S U N 3 / 8 0 r u n n i n g K y o t o C o m m o n Lisp. Comparative Performance of Zeff and THORN on some problems from set theory. Key: Th Time Mlnfs Oinfs TLP LMP LOP Speedup

Theorem. T i m e t a k e n to solve t h e p r o b l e m (sees). 12 N u m b e r of m e t a l e v e l inferences t a k e n to o b t a i n an answer. N u m b e r of o b j e c t level inferences t a k e n to o b t a i n an answer. T o t a l L e n g t h of Proof. L e n g t h of M e t a l e v e l Proof. 13 T o t a l L e n g t h o f O b j e c t Level Proofs. 14 P T T P t i m e d i v i d e d b y Zeff t i m e .

Problems

1. pow rs t(a, b)

(0 a)

2. a U a = a

3.

,- (a = o)

4. c-(aUb) C ( c - a ) n ( c - b ) 5. c -

(a u b) = (c - a) n (c - b)

6. c-(ar'lb) C ( c - a ) U ( c - b ) 11This is certainly true if flxrewrite is used in place of r e w r i t e in Zeff. This produces a factor of 4 speedup over the results given in the table below. Accurate comparison with Potter & Paistre is impossible because these authors do not state on what machine their timings were obtained on. I suspect it may have been a Symbolics 3600. 12Cases marked with with > are ones where the PTTP was aborted out of boredom! In assessing these timings it is also important to know that the code from the PTTP was compiled and that this process takes about 8 minutes. The resulting code is roughly twice as fast as uncompiled code. 13This includes steps taken by Zeff and Zeffl, as well as those taken by the preprover. 14This includes only those steps performed by the PTTP

334

7.

c

-

(a n b) = (c - a) U (c - b)

8. a U ( b U c ) : ( a U b ) U c ) 9. V = O I , ( a D V ) = V t - a = V

lO. an(bu~) c (~nb)u(anc) Th

1

2

3

Time

Minis

Oinfs

TLP

LMP

6 16

12

9

5

4.483s

26

0.167s

-

2.517s 10.967s

52

2.617s

17

0.2s

4

9.75s

51

> 29m 6s

5

18.867s

99

> 16h 9m 40s

6

9.85s

51

> 35m 50s

7

18.75s

106

> 31m 29s

8

7.933s

18.617s

139

4.433s > 35m 43s

2 16

6

3 > 156,819

> 13

4 > 4,345,830

98

50

21

18

Speedup

3

0. 05

5

22

0

4

9

17

4

0.08

6

14

4 > 13

> 102

36 > 18

32

4 > 18

> 103

14

4 > 13

> 102

38

4 > 15

> 102

> 102

3

18

> 165,847

> 13

6

42 > 15

-

56 > 14

55

0

-

> 14

17

6 14

15

4 > 13

> 102

0 > 140,502

4m 47.3s 10

22 9

> 158,224

> 26m 13s

9

0 983.

LOP

23,836

36

23 14

3 > 169,730

19

15

> 13

-

The figures show that Zeff is only slower than the raw P T T P on resolution proofs of less than 8 steps and parity is obtained around 8 steps. Thereafter the advantage lies more and more with Zeff until with proofs of 18+ steps, the speedup is in excess of three orders of magnitude. These timings corroborate our previous thought experiment. Conclusion T h e P T T P compares favourably with m a n y A T P s of the resolution family. However the P~b'TP is not an adequate tool for solving certain m a t h e m a t i c a l problems where

335

the control structure of the theory is inappropriate to the manner in which it works. Parallelism is unlikely to solve the problems of the PTTP and the analogy between highspeed ATPs and high-speed chess machines is misleading because game searches can arbitrarily limit the depth of the search. On the other hand, by combining the PTTP with heuristic techniques it is possible to gain substantial increases in effective performance. The techniques used within the TPL show that the virtual machine that defines the PTTP can also be adapted to provide languages that control its use. We have shown a way of adapting the PTTP to help in the construction of refinement proofs. References Bose S., Clarke E.M., Long D.E., & Michaylov S. Bundy A. BledsoeW. W. Campbell J. A. Chang C. L. & Lee R.C.T. Constable R. et al. Komatsu H. Tamura N. & Avakawa Y. Mater D. & Warren D. S. Nilsson N. J. Paulson L. C. Potter R. C. & Plaisted D. A. Stickel M. E. Stickel M.E. Wos L., Overbeek R. Lusk E. & Boyle J. Wos L.

PARTHENON: a Parallel Theorem Prover for Non-Horn Clauses, Proceedings of the 4th Annual Symposium on Logic in Computer Science, 1989. T h e C o m p u t e r Modelling Of M a t h e m a t i c a l Reasoning, Academic Press (1983). Splitting and Reduction Heuristics in Automatic Theorem Proving, Artificial Intelligence (1971) I m p l e m e n t a t l o n s O f Prolog, Ellis Horwood (1984) S y m b o l i c Logic A n d M e c h a n i c a l T h e o r e m - P r o v i n g Pergamon Press, (1973). I n t e r a c t i v e P r o o f in t h e N u P r l P r o o f D e v e l o p m e n t S y s t e m , Academic Press, (1986). An Optimising Prolog Compiler Proceedings of the 5th Conference on Logic Programming, Springer-Verlag,(1986). C o m p u t i n g w i t h Logic, MIT Press, (1988). Principles Of Artificial Intelligence Tioga Publishing Company, Palo Alto, California, (1980). A Higher-order Implementation of Rewriting, Science of Computer Programming 3. Term Rewriting: Some Experimental Results CADE 9, (1988), Springer-Verlag, LNCS. A PROLOG Technology Theorem-Prover New Generation Computing 2 (1984). A Prolog Technology Theorem Prover Implementation by an Extended Prolog Compiler CADE 8, (1986), (1986), Springer-Verlag, LNCS. A u t o m a t e d Reasoning: i n t r o d u c t i o n a n d applications Argonne National Laboratory, Argonne, Illinois, Prentice-Hall, (1984). A u t o m a t e d Reasoning: 33 Basic R e s e a r c h P r o b l e m s Prentice-Hall, (1988).

Presenting Intuitive Deductions via Symmetric Simplification Frank Pfenning School of C o m p u t e r Science [email protected]

Dan Nesmith D e p a r t m e n t of Mathematics [email protected]

Carnegie Mellon University Pittsburgh, PA 15213, USA Abstract

In automated deduction systems that are intended for human use, the presentation of a proof is no less important than its discovery. For most of today's automated theorem proving systems, this requires a non-trivial translation procedure to extract human-oriented deductions from machine-oriented proofs. Previously known translation procedures, though complete, tend to produce unintuitive deductions. One of the major flaws in such procedures is that too often the rule of indirect proof is used where the introduction of a lemma would result in a shorter and more intuitive proof. We present an algorithm, symmetric simplification,for discovering useful lemmas in deductions of theorems in first- and higher-order logic. This algorithm, which has been implemented in the TPS system, has the feature that resulting deductions may no longer have the weak subformula property. It is currently limited, however, in that it only generates lemmas of the form C V ~C ~, where C and C ~ have the same negation normal form.

1

Introduction

In this p a p e r we deal with the problem of proof presentation, a problem t h a t is often overlooked in a u t o m a t e d reasoning: m a n y of t o d a y ' s a u t o m a t i c systems focus exclusively on the search for the proof of a theorem. A presentation of the proof t h a t is discovered is often no more t h a n a literal tracing of the search process. Such a proof presentation serves more as a verification of the a u t o m a t i c procedure t h a n as an intelligible argument for the theorem's veracity. For some applications (such as program verification) the answer Yes! m a y be all that is desired, but in m a n y other applications we would like more information. For example, in decision support systems such as (E)MYCIN [25, 27] the inability to provide a convincing argument that the machine has correctly diagnosed a problem, deduced a consequence, or constructed a plan renders the p r o g r a m much less This work was supported in part by NSF grant CCR-8702699 and in part by the Defense Advanced Research Projects Agency (DOD), ARPA Order No. 5404, monitored by the Office of Naval Research under contract N00014-84-K-0415.

337

trustworthy and thus much less effective. In systems designed to support the teaching of logic a flexible facility for giving advice should know how to construct good proofs in the deductive system underlying the course. In systems where proofs are the data to be manipulated to fit other tasks such as explanation-based generalization [10] or the extraction of programs [5], the structure of proofs becomes of primary importance which, unfortunately, in practice prohibits the use of state-of-the-art theorem proving technology in such applications. Further evidence that proof presentation is a hard and important problem is that mathematicians spend a large percentage of their time analyzing and reformulating proofs. In the literature one finds two basic approaches to the proof presentation problem. One is to conduct the search for a proof in such a way that, when it is found, it can be displayed intelligibly in a very straightforward manner. This requires the theorem prover to be based on natural deduction [7, 6, 9], or at least to be very close to the natural deduction format. The disadvantage of this approach is that, to date, other theorem proving procedures are superior in that they can prove more theorems, and can prove them faster. Moreover, even natural deduction proofs are not always "natural" and many would profit tremendously from some transformations (Example 5 provides a case in point). The second approach is to decouple the search process from the proof presentation process, in which case proof presentation is reduced to translation from one proof format, say, resolution, to another, typically natural deduction. This approach has been taken by Lingenfelder [16, 17] for the connection graph method, Andrews [1] for mating refutations, and Miller [18, 19], Felty [11], and Pfenning [21, 22] for the closely related expansion proofs. There are many subproblems one faces when trying to present a proof. What deductive system should be used? How much detail should be presented? How do we measure how "good" a presentation is? How do we interact with the user when presenting a deduction? In this paper, we assume that we have chosen the natural deduction formalism as a target for translation, since it appears to be intuitive to (most) humans and can also be used as a basis for further transformation, for example into natural language (see Chester [8] and Huang [14]) or into other, related deductive systems. We will ignore questions of detail of presentation and user interaction and concentrate on improving "structural" qualities of natural deductions. In our experience with ETPS [23] (used as a teaching toot in logic classes) and TPS [3, 2] (used as a research tool in theorem proving for higher-order logic) and in the literature, it seems that the problem of translating analytic proofs (normal proofs in natural deduction terminology, cut-free proofs in sequent calculi) between different deductive systems is relatively well understood for a number of systems, in particular for expansion proofs and resolution refutations. The crucial property characterizing the deductions representing the proofs is that they have the weak subformula property: only subformulas of the theorem and instances thereof (possibly with an added negation, hence "weak") will appear in the final deduction. Though analytic deductions are often "right," especially for many small problems, they are also often "wrong" in the sense that a non-analytic deduction with a judicious use of a lemma might have drastically reduced the size and complexity of the deduction) A word on terminology: we will use "lemma" to refer to a non-subformula in 1A theoretical analysis of this phenomenon with precise bounds is given by Statman [26].

338

a non-analytic deduction. Thus we believe that in order to make further progress, we must study ways to introduce lemmas into the presentation of a proof. In this paper, we present just one method for introducing lemmas into deductions, but one which we have found to be of great practical value. Even though our deductions do not have the weak subformula property, the lemmas are not very far-fetched, and we believe that this is but a small step towards the overall goal of presenting intuitive deductions. Other, complementary approaches come to mind, such as applying methods from the field of inductive inference [4] to achieve a more global restructuring of deductions. As our deductive systems we have chosen expansion proofs [2, 18, 19, 20, 21, 22] (on the analytic side) to be translated into natural deductions. Expansion proofs simplify a number of translation issues over, say, resolution. First and foremost, the structure of the original formula is preserved rather than translated into clausal form. Secondly, certain properties that our algorithm is required to check can be read off fairly directly. Thirdly, TPS [3] is a theorem prover for first- and higher-order logic which generates expansion proofs and thus allows for immediate experimentation with many examples in its library of theorems. We emphasize, however, that, while details certainly would differ widely, we believe that the basic idea of our translation procedure can be adapted to apply to the problem of translating other forms of automatically generated proofs into natural deduction. Moreover, other forms of analytic proofs such as resolution refutations, can be translated into expansion proof format, though the value of such translations is unclear.

2

A S u m m a r y of t h e M e t h o d

We have been using a succession of translation algorithms from expansion proofs into natural deductions in the TPS and ETPS systems for several years. ETPS is used in logic classes in first-order and higher-order logic, TPS is a theorem proving system for first-order and higher-order logic. The scale of the examples TPS typically deals with is relatively small (5-50 line proofs), though the proofs, especially in higher-order logic, are sometimes quite intricate (such as proofs of Cantor's theorem). This gives us the luxury of neglecting certain aspects of global proof restructuring, such as determining whether a certain subproof could be done more directly with the use of some 1emma stored in a database. Level of detail of the proof can be controlled by the user to some extent, though more work is certainly required on this aspect of the translation. From our experience with the system it became obvious that the least intelligible deductions arose from the use of the rule of indirect proof. But how can the application of this rule be avoided? There are some answers to this question in the literature, since it is exactly the rule of indirect proof which separates classical logic from intuitionistic logic. But very general methods 2 do not seem reasonable for our application. It is also wellknown that instead of a rule of indirect proof, we can include the axiom schema A V -~A of excluded middle in the deductive system. Many of our examples can be proven very 2For a discussion and further references see Kreisel & Maclntyre [15]

339

intuitively with a judicious use of the law of excluded middle, but the "right" formula is not always a subformula of the theorem. This basic observation led us to ask when and how we should use the law of excluded middle in the construction of natural deductions from expansion proofs. We believe we have found a good answer and it generates intuitive deductions in all of our motivating examples and others. T h e first step is to analyze when and why the translation procedure would have to use a classical rule. A little analysis shows that there are exactly three types of situations in which we need a classical rule of inference, and where the previous translation algorithm would, as a last resort, fall back on the rule of indirect proof. Imagine that we have some assumptions S and a conclusion C and our goal is to derive C from S. There are two types of steps one can apply: one is to work forward from the assumptions; the other is to work backward from the conclusion. Informally, the cases in which we will have to apply a classical rule of inference are . C = A V B and neither A nor B alone follow from the assumptions, and no progress can be made by applying an intuitionistic rule to an assumption; . C = 3x A and there is no single term t such that [t/x]A follows from the assumptions, nor can progress be made by applying an intuitionistic rule to an assumption; . C is atomic and no progress can be made by applying an intuitionistic rule to an assumption. In this case, for any assumption of the form A --* B or -~A, the formula A does not follow from the remaining assumptions. Moreover, there must be at least one such assumption. T h e examples in Section 4 illustrate these impasses. We will see that the second type of impasse actually encompasses two quite different situations. Section 5 deals with the details of how we can sometimes employ the law of excluded middle to our advantage in these situations. Let us illustrate here the general idea of the procedure in the simplest of these cases where the conclusion is a disjunction. Since this case is the simplest and our example is propositional, it may appear that the problem is in general trivial, and that easier methods than symmetric simplification should apply. Though we cannot rule out such a possibility, we have arrived at symmetric simplification only after considering and discarding many more specialized and apparently simpler methods. The list of "difficult" (in the sense that it is difficult to find an intuitive deduction) theorems at the end of this paper give a range for the kinds of problems which may arise. As an example, assume we are trying to prove [A A B] V [A A -~B] from the assumption A. Clearly neither disjunct follows from A and the assumption A does not lend itself to any useful forward reasoning, and thus we are at a disjunctive impasse. W h a t is an intuitive way of proving this theorem? Proof by contradiction is certainly possible, but clearly not very intuitive. The following argument seems natural: (1) either B is true or false. (2) If B is true, we can conclude A A B. (3) If B is false, we can conclude A A - B . (4) So the disjunction holds in either case.

340

In outline, here is how our translation algorithm arrives at the lemma (1). First we observe that we can always pick either disjunct when trying to break a disjunctive impasse and continue by distinguishing two cases: the disjunct might be true or it might be false. If we picked the left disjunct, this would construct the lemma [A A B] V -~[A A B] which we add to our assumptions and now proceed by cases and two V-introductions, yielding the obligations (1) to prove A A B from A and A A B in the first case (which is immediate), and (2) to prove A A ~ B from the assumptions A and ~[AAB]. Even though this is clearly possible, this is also circuitous and not the desired proof. The general idea underlying our translation procedure is to examine the subproof obligations arising from this first attempt at a useful lemma, namely 1. to prove A A B from A and C = A A B in the first case, and 2. to prove A A -~B from the assumptions A and -~C = -~[A A B]. We have highlighted C and -~C, since these two formed our lemma (application of excluded middle). Note that we have the freedom to change and particularly simplify C as long as both subproof obligations can still be fulfilled. This is a balancing act, since strengthening C will weaken -~C and vice versa. Here one can easily see that after erasing the left conjunct A from both C and --C both remaining proof obligations can still be fulfilled, and also that the proofs are much simpler now. In fact, we have arrived at the desired intuitive deduction shown before. The essence of symmetric simplification 3 is to simplify C (and consequently --C) such that both subgoals remain provable. This implies simultaneous changes to the proofs that C implies one conclusion and --C implies the other conclusion, where C may be varied. Our procedure does not require a general theorem prover (and it is hard to see how to take advantage of one) but uses the original expansion proof as a strong guide. To show the limitations of this method, let us reconsider the goal of deriving [A A B] V[A A --B] from A. This time we proceed with an application of the distributivity of conjunction over disjunction to change the goal to A A [B V -~B] and then proceed in the obvious fashion. This is a deduction beyond our current method, and we know of no other general method which could produce this deduction. However, we believe that the general problem of using previously proved lemmas both in theorem proving and in proof presentation and the problem of finding useful "local" lemmas in a deduction are orthogonat--it is only the latter we are addressing here.

3

Natural Deductions

The formulation of natural deduction system we use is basically Gentzen's NK [12], but our implementation uses a variant with higher-order rules (as in Prawitz [24]) and rules z "Symmetric" since both C and --C remain identical. One could imagine "asymmetric simplification" which simplifies the lemma C V -~C to C I V C" or even C ~--. C" as long the lemma remains provable. Currently we have no algorithm or heuristics for the asymmetric simplification problem.

341

for equality. The additional complexity introduced into the proof presentation process does not invalidate the analysis made here, but requires some separate considerations (see [22, Chapters 4-6]). The logical language contains the propositional constants and connectives A, V, -~, --% and 222along with the quantifiers V and 3. The inference rules of the system include the usual introduction and elimination rules for each connective and quantifier. There are also two rules involving _k. The first is -LI, the intuitionistic absurdity rule (from falsehood we can conclude anything), the second is ± c , or classical proof by contradiction. Below we also show the rule of proof by cases (the V-elimination rule VE), since proof by cases is one of the more frequent inferences generated by our proof presentation procedure which uses symmetric simplification.

_l_ 222i A

~-~A]1 : 222 -1-cl

~AI1 [B] 1 : : AVB

C

C

C

VE1

As shown above in -l-c and VE, cancelled assumptions are written as [A]. A numbered assumption is cancelled in the inference with the same superscript. An inference may cancel 0 or more assumptions with the same formula, so the inference remains correct if the assumption does not occur in the deduction.

4

T r a n s l a t i o n f r o m E x p a n s i o n P r o o f s to N a t u r a l D e d u c t i o n

Our general approach to the proof presentation problem is goal-oriented: at any stage during the translation from an analytic prooP we have a number of assumptions S (a list of formulas, though their order is irrelevant) and a conclusion A. The goal is to fill in the gap in the deduction which shows that A follows from S, given an expansion proof which shows that the gap can indeed be filled. The implementation of the translation is centered around tactics [13] which may consult the expansion proof to check if certain conditions are satisfied. In return for this benefit of expansion proofs, the tactics also have t.he obligation to construct expansion proofs for any subgoals they may produce. A complete set of tactics for the translation process is described in [22, Chapter 6]. The tactics decompose into five different categories: bookkeeping tactics (which do not apply any inference rules), minimal conclusion tactics (whiCh suggest introduction rules to be applied to the conclusion), minimal assumption tactics (which suggest elimination rules to be applied to assumptions), non-minimal tactics (which suggest use of the absurdity rule or indirect proof), and ±emma tactics (which suggest the use of a lemma). The set of all tactics in the first four categories are sound and complete when tied together properly using tacticals: they are guaranteed to produce a natural deduction of the original goal 4IIenceforth we will say expansion proof, since this is what our implementation actually uses.

342

without the use of any derived rules of inference. In this paper we concentrate on the description of the lemma tactics, which, in their simplest form, generate lemmas of the form A V -~A. In order to understand when and why lemma tactics are invoked, we give a brief description of a few crucial minimal tactics in this section. Tactic 1 (V Introduction Left) Assume our goal is to prove A V B from $. If the expansion proof for this goal provides a proof of A from S, infer A V B by VIL, leading to the subgoal of proving A from S. This tactic and its obvious symmetric variant require that one of the disjuncts of the conclusion by itself follows from the assumptions. What if neither disjunct follows? If no assumption tactic applied, we would be forced to apply the rule of indirect proof J-e, unless we can find a good way of introducing a lemma. Such a situation occurs, for example, when trying to prove [A A B] V [A A -~B] from A (see the example in Section 2). Tactic 2 (3 Introduction) Assume our goal is to prove 3xA from S. If the expansion proof for this goal contains a single instantiation term t for this occurrence of x, and the instantiation term contains no parameter which has yet to be introduced into the deduction, then infer 3xA by 3I from [t/x]A, leaving the subgoal to deduce [t/x]A from S. This tactic may fail to apply for two different reasons (assuming no tactics can be applied to the assumptions). The proofs of the formula 3xVy[Px ~ Py] and the example in Section 7 illustrate one reason for failure, namely that there is more than one instantiation term required for x, but at least one of them is free of parameters yet to be introduced into the deduction. The other, more insiduous failure is when there are one or more instantiation terms, but all of them still contain a parameter which has yet to be introduced. An example of this is the goal to deduce 3x'~Px from ",VxPx. In either case we have to apply indirect proof or find a good lemma, though finding a reasonable lemma with our symmetric simplification algorithm is much more likely in the first situation. As an example of an assumption tactic which may fail to be applicable, consider --* Elimination. Tactic 3 (--, Elimination) Assume our goal is to prove some conclusion C from S and A --* B. If the expansion proof for this goal provides a proof of A from S apply --*E and set up two new subgoals: one to deduce A from $ and one to deduce C from S, A --* B, and B. Tactic 3 may fail to apply if the negation of the conclusion is necessary to prove the antecedent A, for example when trying to deduce C from the assumption -~C --~ C. In such a case we have to apply proof by contradiction before --+E. In the next section, we will analyze more thoroughly the cases in which these tactics do not apply, and will discuss how we try to generate useful and intuitive lemmas in these situations.

343

5

Setting up a Symmetric Simplification Problem

As outlined in Sections 2 and 4 and there are three situations in which symmetric simplification is of potential interest: they are exactly the situations in which one can no longer make progress by applying intuitionistic rules of inference. We refer to this as a translation impasse. In this section we a t t e m p t to illustrate how the symmetric simplification problem which is treated by our algorithm is set up, given that we have reached a translation impasse. It should be noted that these impasses are not mutually exclusive--we will return to this point at the end of this section. Imagine again that we have some assumptions S and a conclusion A and our goal is to derive A from S. Different types of impasses can arise. It is a non-trivial theorem which shows that these impasses are exhaustive, and thus at least one of these cases and possibly more must be applicable. D i s j u n c t i v e I m p a s s e . A = A' V A" and neither A' nor A" alone follow from the assumptions, and no progress can be made by applying an intuitionistic rule to an assumption. In this case, we have two symmetric opportunities for setting up a symmetric simplification problem. An obvious lemma is A' V -~At with the intent to build the deduction

S, [A']1 591 A I V -~A'

A~ A' V A" A I V A"

S, [~A'] 1 59~ A" VIL~ VIR V A"

VE 1

Since A t V A" follows from S it is easy to see that now A" must follow from S and -~A'. Also, the corresponding guiding expansion proof is easily constructed. It is much more difficult, though not impossible, to construct a normal natural deduction for this subproof, given an original deduction which proceeded using the rule of indirect proof. In either case, we end up with two subproofs, one (591) showing that S and C = A' implies A', the other (59~) showing that S and -~C = ~A' implies A". This problem is now passed to the symmetric simplification algorithm with the goal of simplifying C and

"~C. The symmetric case is where we pick C = A" V - A " . Currently, our heuristic for choosing which disjunct to begin with is to choose the one which contains more negative literMs which are used in the expansion proof. This heuristic is aimed at minimizing the number of negations in the lemma, and thereby reducing the number of negation elimination steps in the subsequent subproofs. E x i s t e n t i a l I m p a s s e . A = 3x A' and there is no single term t such that [t/x]A follows from the assumptions, and no progress can be made by applying an intuitionistic rule to an assumption. Moreover, there must be at least one instantiation term to for x in the proof of A from S which does not contain any parameter not yet introduced.

344

In this case we again use the lemma [to/x]A' V -,[to/x]A' with the intent to build the deduction

S, [[to/x]A'] 1 231 [to/x]A' S, [-~[to/x]A'] 1 - 31 3z A'

[to/x]A' V -~[to/x]A' 3x A ~

~2 3x A' VE ~

Again, it is easy to construct an expansion proof showing that from S and ",[to/x]A' we can prove 3x A' with one fewer instantiation term for x. Clearly, this can also be done for natural deductions, though it is much more complicated. In either case, we end up with two subproofs, one (D1) showing that S and C = [to/x]A' implies 3z A', and one (~D2) showing that S and --C = -.[to/x]A' implies 3z A'. This problem is now passed to symmetric simplification algorithm with the goal of simplifying C and ~C. As in the disjunctive impasse, our heuristic for choosing which term to use for the lemma (if more than one may be used) is to chose the one which contains the most negative literals which are used in the expansion proof. This leaves two kinds of impasses to which we will return in Section 8. Assuming that no tactic can be applied to an assumption, they are: (1) The conclusion is atomic and (2) the conclusion is existential and all of its substitution terms contain a parameter yet to be introduced. An example of (1) is the goal to derive A from -~A --+ A, and an example of (2) is to derive 3x-.Px from -.VxPx.

6

A n A b s t r a c t D e s c r i p t i o n of S y m m e t r i c S i m p l i f i c a t i o n

The technical details of symmetric simplification and our implementation are very closely tied to expansion proofs and their properties. In this section we will attempt to provide an intuition about the basic ideas behind symmetric simplification independently of expansion proofs. Assume, as discussed in Section 5, that we have reached a point where we have set up the following problem: Given two sets of assumptions 81 and 82, two conclusions A1 and A2, an initial formula C, and two proofs 2)1 and ~D2 such that T~I shows that A1 follows from $1 and C, and ~D2 shows that A2 follows from 82 and -~C. While keeping $i and A~ fixed, vary C and Di so as to "simplify" C and ~Di as much as possible. In the absence of a formal measure of the degree of "intuitiveness" of the modified deductions, we will just try to shorten them as outlined below. Our symmetric simplification procedure combines three steps, each of which is complex, but can be described in isolation. These steps are called single instantiation, single

345

deletion, and propositional restructure. In the exposition below, we call an occurrence of a subformula in C and the corresponding occurrence in ",C dual occurrences. S i n g l e I n s t a n t i a t i o n . Let us assume that we have a positive occurrence of VxC' somewhere in C which is instantiated to t in the deduction T)I. This inference could be avoided, if we could replace the occurrence of Vx C' by [t/x]Cq In the dual formula --C, the dual occurrence is equivalent to 3x-~C ~ which at some point in T)~ might have been instantiated with a parameter a. This would be transformed into -~[t/x]Cq The deduction T)2 then would also have to be changed: we may have to permute inferences, and also substitute t for the parameter a in the deduction :D2. The conditions on t guarantee that this is possible. There are a number of other conditions which must be satisfied for the transformation outlined above to be valid. 1. the assumption Vx C ~ and none of its instances can be used elsewhere in :D1, since it is replaced by [t/x]Cq Similarly for the dual occurrence in T)2. 2. the substitution t e r m t must not contain any parameter b which is introduced somewhere in :D1 or :D2, since this would invalidate the occurrence condition on the inference rule which introduced b (either an 3-elimination or a V-introduction). As one might imagine, it is difficult but not impossible to check these conditions on natural deductions. It requires that we can trace occurrences as they multiply and propagate through the deductions. In expansion proofs, it is trivial to check them. We currently only apply single instantiation if Vx C' does not tie below any other quantifier, though it would be easy to generalize our algorithm to search for cases where such a replacement would be legal. S i n g l e D e l e t i o n . This is the most useful of the three steps. Let us assume we have a positive subformula occurrence C ~A C" in C. If none of the instances of C t is used in the derivation 2Pl of Ax, we can erase it from C and -~C. Note that this weakens C and thus strengthens --C, and thus no applicability checks need to be made in T~2. However, T)2 often simplifies. For example, if the dual assumption -,C I V -~C" is strengthened to -~C', a proof by cases is simplified to one of its subproofs. Another case where essentially the same m e t h o d applies is a negative subformula occurrence C ~V C" in C. P r o p o s i t i o n a l R e s t r u c t u r e . s This is the most complex of the steps, and also perhaps the least intuitive. It was not part of the original algorithm we implemented, but we found it necessary for many examples. Because of redundancies introduced when creating the lemma C V -~C it is often the case that an assumption C' (as in the scenario for single deletion) is used in :D1, even though its use could be avoided if we changed :D1. A general theorem prover is not very good at changing :D1, since the goal is to avoid using any assumption in C as much as possible (which is hard to communicate to a theorem prover), and simply enumerating all subformulas and checking (with a theorem prover) whether 5In [22] in the context of expansion proofs this is called single mating change.

346 A1 still follows is completely impractical. This is not a completely accurate transcription of what our single mating change procedure does, but roughly our solution is to look through the places where forward reasoning and backward reasoning meet, t h a t is, where gaps in the proofs are completely filled. If an instance of a subformula D of C is the only way the gap can be filled, we m a r k it as necessary, otherwise we locally restructure the proof (with propositional inferences only) so that D is not used. This is iterated until no more propositional restructure is possible, unless perhaps after a single deletion.

Propositional restructure m a y enable further single deletions and also single instantiations, since all instances of some subformula C ~ of C m a y now be unnecessary and could thus be deleted. In general, applying any of the above three steps m a y enable other steps to further simplify the deduction. We impose the following control structure: . Repeatedly apply single instantiation in a top-down fashion (top-level quantifiers first) until it is no longer applicable. Go to Step 2. . Repeatedly apply single deletion in a b o t t o m - u p fashion (leaves first) until it is no longer applicable. Go to Step 3. . A t t e m p t to apply propositional restructure. If this fails and Step 2 did not perform any deletions, terminate: no further simplification is possible. Otherwise, go to Step 1.

7

An Example of Symmetric

Simplification

In this section, we explain by means of an example how a l e m m a is generated when we have reached a translational impasse. Suppose we have three blocks, a mb, and c, such that b is on a and c is on b. Moreover, assume that we know that a is red, while c is known not to be red. From these assumptions, prove that there are some blocks x and y such t h a t x is red, y is on x, and y is not red. Symbolically: From On c b, On ha, Red a, and -~Red c conclude 3x3y [On y x A -~Red y A Red x] T h e following intuitive deduction which makes use of the law of excluded middle is the one our algorithm eventuMly generates. Deduction

4

1. Either b is red or it is not red.

2. I f b is red, then b and c satisfy the criterion for x and y, respectively, since c is on b and c is not red, while b is red. 3. If b is not red, then a and b satisfy the criterion for x and y, respectively, since b is on a and b is not red, while a is red. A deduction which uses indirect proof will be much less intuitive. Here is one possible version 6. 6A formal counterpart of this version would have been generated by an earlier version of the translation procedure.

347

D e d u c t i o n 5 We proceed by contradiction, thus (after some rules commuting negations with quantifiers and connectives) it remains to derive a contradiction from the assumptions

Oncb, Onba, R e d a , -~Redc, and Y x V y [ - , O n y x V R e d y V -,Redx] The final of these assumptions must be true for x = b and y = c and also for x = a and y = c, leading to a contradictory propositional formula. From examining either of these two deductions, we can see ttiat the original goal is at an existential impasse as described in Section 5; we cannot directly prove an instantiation of the conclusion, nor can we apply an intuitionistic elimination rule to an assumption and make progress. The reason is that x must somehow be instantiated to two different terms (b and c) to complete the deduction. Instead of using indirect proof, we set up a symmetric simplification problem and apply our earlier algorithm. Examining the expansion proof, we find that b is an instantiation term for x such that b contains no parameters selected in the proof. It also satisfies our heuristic of containing more negative literals used in the expansion proof than does the tree for the other instantiation term a. Thus we begin with Co = 3y [Onyb A -~Redy A Redb], and the starting point for the l e m m a is Co V -~C0. . T h e existentially quantified subformula of -,Co is negative, so the quantifier (on y) is essentially existential in the new subproof. In addition, it is instantiated with a single t e r m c. Hence we can use Single instantiation to instantiate y with c. C1 then becomes On c b A -~Red c A Red b; the lemma has now been simplified to C1 V -~C1. Single instantiation cannot be applied again, so we go to step 2 of the algorithm. . Single deletion cannot be applied, since every literal of C1 and --5'1 is being used in the current subproofs. Thus we go to step 3 of the algorithm, propositional restructure. .

.

Note that C1 contains as conjuncts two literals, On c b and -,Red c, which also appear as assumptions. Hence we can restructure the proof so that instead of using the literal occurrences in 6'1, we use the corresponding assumptions. Once we have done that we go back to step 1 of the algorithm. Single instantiation is not applicable (6'1 contains no quantified subformulas).

5. Single deletion can now be applied to the two literals of C1 that were made unnecessary by the propositional restructure step above; we delete them and their dual occurrences in --C1. C2 becomes Red b. The lemma now has been simplified to Red b V --Red b. . Propositional restructure is no longer applicable; every literal in the lemma is necessary. Seeing that single instantiation and single deletion are also not applicable, we terminate.

348

Our lemma is 6'2 V -,C2, that is, Red bV -,Red b; this is exactly the lemma our intuition told us we should use. The resulting deduction is Deduction 4. We chose this example because it illustrates each of the steps of the symmetric simplification algorithm. The result of the algorithm is a propositional lemma, which could leave the impression that lemmas could somehow be generated by looking at contradictory propositional formulas only. However, this is not always the case. As a case in point, consider the theorem 3xVy[Px --+ Py]. In the translation of this proof into a natural deduction, we immediately run into an existential impasse. If symmetric simplification is used rather than a proof by contradiction (which does not generate a nice proof) the lemma which results is Yy[Py] V ",VyPy.

8

Conclusion

For many theorems, symmetric simplification will provide a lemma that makes the natural deduction more intuitive. While we are guaranteed to make progress in the cases of existential and disjunctive impasse, that is not the case for other impasses; sometimes using indirect proof is "better" than using the lemma that our algorithm could create. This is true specifically for the situations mentioned at the end of Section 5. More work must be done in determining where symmetric simplification is useful in these cases, and criteria must be developed for evaluating the intuitiveness of proofs and for deciding whether using a given lemma yields an improvement or not. We have found one particular tactic that is often useful, though we do not yet have a good heuristic on when to use it. This tactic, which can be used when there is an implication in the assumptions, but the ~ elimination tactic (Tactic 3) does not apply, involves setting up a symmetric simplification problem from the left-hand side of the implication. The last two lemmas in the table below were generated by using this tactic. Another problem that has not been addressed is that of choosing the "best" lemma. Instead of using a lemma of the form C V -~C, we could use any formula D V E such that D = C and E - -~C. This may make the resulting subproofs easier, at the expense of more difficulty in proving the lemma. Thus this only appears reasonable when a certain amount of sophistication has been achieved, that is, certain lemmas in a deduction can be assumed without proof. In addition, the lemmas that our algorithm constructs are all themselves theorems. Improvements may result if our lemmas are merely provable from the current assumptions. Given all tactics and heuristics we have developed and implemented, there are still some remaining unintuitive deductions. They arise primarily due to negated, non-atomic assumptions combined with existential conclusions. The prototypical example of such situation is to derive 3x-~Px from ",VxPx. The best way we could find to deal with this problem is to assume that there are previously proven theorems or derived rules of inference which allow the permutation of negations with other connectives and quantifiers. Finally, we end with some "benchmarks," simple theorems for which one of the impasses described in Section 5 arises, along with the lemma (or lemmas, when several are needed) which our algorithm generates.

349

Theorem 3yVx[Py --* Px] Pa A -~P[f[f a]] ~ 3x[Px A -,P[f x]] Pa A -.P[f[f[f[f a]]]] --~ 3x[Px A -,P[f x]]

3x[Px ~ P[fx]] A --* [A A B] V [A A -~B] [A --~ [B V C]] ~ [[A --+ B] V [A ~ C]] [A --~ B] --~ [--A V B] , 3PP [A --+ 3xBx] ~ 3x[A ~ Bx] [YxPx --~ B] ~ 3z[Px --~ B]

Lemma derived VxPx V -~VxPx -~P[f a] V P [ f a] ....... -.P[fa] V P[fa] -.P[f[fa]] V P[f[fa]] '~P[f[f[f a]]] V P [ f [ f [ f a]]] --,P[fa] V P[fa] -~B V B C V --C A V --A po V _~po A V -~A VxPx V -.VxPx

References

[1] Peter B. Andrews. Transforming matings into natural deduction proofs. In Proceedings of the 5th Conference on Automated Deduction, Les Arcs, France, pages 281-292. Springer-Verlag, 1980. [2] Peter B. Andrews. On connections and higher-order logic. Journal of Automated Reasoning, 5:257-291, 1989. [3] Peter B. Andrews, Sunil Issar, Daniel Nesmith, and Frank Pfenning. The TPS theorem proving system. In Ewing Lusk and Russ Overbeek, editors, 9th International Conference on Automated Deduction, Argonne, Illinois, pages 760-761, Berlin, May 1988. Spring-Verlag LNCS 310. System abstract. [4] Dana Angluin and Carl H. Smith. Inductive inference: Theory and methods. Computing Surveys, 15(3):237-269, September 1983. [5] Joseph Bates and Robert Constable. Proofs as programs. A C M Transactions on Programming Languages and Systems, 7(1):113-136, January 1985. [6] Michael Beeson. Some applications of Gentzen's proof theory in automated deduction. To appear, 1988. [7] W. W. Btedsoe. The UT prover. Technical Report ATP-17B, Departments of Mathematics and Computer Science, University of Texas at Austin, 1983. [8] Daniel Chester. The translation of formal proofs into English. Artificial Intelligence, 7:261-278, 1976. [9] Robert L. Constable et al. Implementing Mathematics with the Nuprt Proof DeveIopment System. Prentice-Hall, Englewood Cliffs, New Jersey, 1986. [10] Thomas Ellman. Explanation-based learning: A survey of programs and perspectives. A C M Computing Surveys, 21(2):163-221, June 1989.

350

[11] Amy P. Felty. Using extended tactics to do proof transformations. Technical Report MS-CIS-86-89, Department of Computer and Information Science, University of Pennsylvania, 1986. [12] Gerhard Gentzen. Untersuchungen fiber das logische Schlie~en. Mathematische Zeitschrifl, 39:176-210, 405-431, 1935. [13] Michael J. Gordon, Arthur J. Milner, and Christopher P. Wadsworth. Edinburgh LCF. Springer-Verlag LNCS 78, 1979. [14] Xiaorong Huang. A human oriented proof presentation model. Technical Report SR-89-11, SEKI, 1989. [15] Georg Kreisel and Angus MacIntyre. Constructive logic versus algebraization I. In A. S. Troelstra and D. van Dalen, editors, The L.E.J. Brouwer Centenary Symposium, pages 217-260. North-Holland Publishing Co., 1982. [16] Christoph Lingenfelder. Transformation of refutation graphs into natural deduction proofs. Technical Report SR-86-10, SEKI, 1986. [17] Christoph Lingenfelder. Structuring computer generated proofs. In N. S. Sridharan, editor, Proceedings of the Eleventh IJCAL pages 378-383. Morgan Kaufmann, 1989. [18] Dale Miller. Proofs in Higher-Order Logic. PhD thesis, Carnegie-Mellon University, October 1983. [19] Dale Miller. Expansion tree proofs and their conversion to natural deduction proofs. In R. E. Shostak, editor, Proceedings of the 7th Conference on Automated Deduction, pages 375-393, Heidelberg, May 1984. Springer Verlag. [20] Dale A. Miller. A compact representation of proofs. Studia Logica, 46(4):347-370, 1987. [21] Frank Pfenning. Analytic and non-analytic proofs. In R.E. Shostak, editor, 7th Conference on Automated Deduction, pages 394-413. Springer-Verlag, May 1984. [22] Frank Pfenning. Proof Transformations in Higher-Order Logic. PhD thesis, Carnegie Mellon University, January 1987. [23] Frank Pfenning, Sunil Issar, Dan Nesmith, and Peter B. Andrews. ETPS User's Manual, fifth edition, 1984. 44+ii pp. [24] Dag Prawitz. Natural Deduction. Almquist ~ Wiksell, Stockholm, 1965. [25] Edward H. Shortliffe. MYCIN: a Rule-Based Computer Program for Advising Physicians Regarding Antimicrobial Therapy Selection. PhD thesis, Stanford University, 1974. [26] Richard Statman. Bounds for proof-search and speed-up in the predicate calculus. Annals of Mathematical Logic, (15):225-287, 1978. [27] William van Melle. A Domain-Independent System that Aids in Constructing Knowledge-Based Consultation Programs. PhD thesis, Stanford University, 1980.

Toward Mechanical M e t h o d s for Streamlining Proofs* William Pierce

Department of Computer Sciences The University of Texas at Austin Austin, TX 78712

Abstract

We present preliminary work on the problem of mechanical proof simplification. Our approach is to take advantage of the correspondence between proofs and programs. Techniques from the field of program transformation may be used to transform the computational content of a proof. Using examples from elementary number theory, we illustrate how such transformations can lead to simpler proofs.

1

Introduction

It is often the case that a theorem can be proved in multiple ways, and that some of the proofs are simpler, more straightforward, or in some sense more elegant than others. In such cases, there can be good reasons for trying to find the best proof. If one wants to teach or explain a difficult theorem, one will do well to find the most economical path from the basic principles to the theorem. If one wants to use a proof as a source of knowledge, say for explanation or for discovering new proofs by analogy, one will do well to consider the proof which omits extraneous details. Naturally we would like to develop methods for discovering good proofs. Since the problem of finding any kind of' proof is such a dimcult one, we are investigating methods for taking proofs which are already provided and transforming them into proofs which are by some metric improved. We see two potential benefits of such an investigation. First, it should lead us to a better understanding of what constitutes a good proof. Formulating reasonable metrics for ewluating proofs may well be one of the hardest parts of this research. Second, the actual methods developed for simplifying proofs can be useful. Automated reasoning systems often produce proofs which are difficult to follow; these methods may allow such systems to present proofs more clearly. Our approach to proof trazlsformation takes advantage of the correspondence between proofs and programs. Drawing from the literature on program transformation, we can employ transformations which preserve the computational content of a proof. As we shall see, such transformations can lead to programs which can no longer be interpreted as proofs. This approach thus necessitates the following choice: we must ensure that all *This work supported by National Science Foundation Grant CCR-8613 706.

352

transformations preserve proofhood, or we may allow intermediate steps which are not proofs and simply check that the final result is. Examples we shall see later provide some evidence that the latter is preferable. In order to develop mechanical methods for streamlining proofs, we need efficient strategies for applying transformations so that a proof is improved if it is changed at all. Developing such strategies is still future work; for the present, we use the following heuristic: a transformation is desirable if it eliminates computational redundancy. As we shall see, an efficient program does not always correspond to a desirable proof. However, this is a starting point. The primary goal of this paper is to identify potentially useful transformations. To limit the scope of this investigation, we have restricted our consideration to firstorder proofs in elementary number theory involving rewriting and induction. The metric we use to measure a proof is a count of the rewrite steps involved (where each rewrite step is justified by an axiom, lemma, or inductive hypothesis) plus the sum of the measures for the lemmas used in the proof. In the next section, we introduce the class of proofs we will be considering and show how such proofs may be interpreted as programs. In the following sections, we describe methods for transforming these programs and illustrate with examples. We then discuss the status of our current investigations and problems for future research. We conclude with a discussion of related work.

2

Proofs and Programs in Elementary N u m b e r Theory

For reasons of space, the following presentation must be somewhat informal. We are currently investigating proofs in elementary number theory involving rewriting and induction. Lemmas and axioms are equations whose terms may involve the constant 0 and the function s u c c (meaning successor and often abbreviated with a postfix '). Axioms and theorems are given names; for example, the following axioms, named P0 and Pt, characterize the function plus: plus

0 x

=

plus

n' x

= (plus n x)'

x

PO Pl.

We will assume the above axioms for the examples that follow. Proofs are built up from applications of axioms and lemmas using the two rules of concatenation and induction. An application of an axiom or lemma is characterized by three items: the list of terms to which it is applied, an orientation specifying the direction in which the axiom or lemma is applied, and an address specifying the subterm being rewritten. For example, the proof of f 0 (g 0)

= f 0 (g (plus 0 0))

involves the axiom P0 instantiated with 0 for x. It is applied in the reverse direction to the first subterm of the second subterm of ( f 0 (g 0)). We might render this proof by reverse (po o) at (2 1). Here (2 1) is an address specifying that the proof is applied to the first subterm of the second subterm.

353 If, for 1 < i < n, A ( i ) is an application of an axiom or a lemma proving %( i - l ) = %( i ) , then A(1) through A(n) may be concatenated to form a proof of %(0) = %(n). We may render this by ...

A(1) A(2)

A(n).

For example, the equation p l u s 0' 0 = 0' is proved in two steps by (pl o o )

((PO o )

at

(1)).

Note that we do not display null addresses. This representation for a proof is useful for the manipulations we will be performing, but it is difficult to read. Therefore, we will also use a proof presentation which makes explicit the terms being rewritten by the proof. Thus the above proof may be presented: plus O' 0 = (plus 0 0)'

(Pl 0 O)

= 0,

(p0 0) at ( 1 ) .

Finally, a theorem of the form %1(n) = %2(n) may be proved by induction. To represent such a proof, we give the theorem a name, say T. If P s i is a noninductive proof of %1(0) = t 2 ( 0 ) and Phi is a noninductive proof of % l ( n ' ) = %2(n') which uses an application of T instantiated with n, then the complete proof of T may be rendered T 0

=

T n'

=

Psi Phi.

In general, t l ( n ) and t 2 ( n ) may contain other variables. Here is an example proof of the theorem p l u s n 0 = p l u s 0 n to which we give the name L. LO L n'

= =

I (Pln

O) ((i n) at (I)) ((PO n) a% (l)) (reverse (PO n')).

Here, I represents the concatenation of zero proofs. (I is thus a proof of any equation of

the form % -- t . ) To facilitate presentation of more complex proofs, we will henceforth adopt a more succinct notation. Thus, we will represent L by LO L n'

=

I

=

(Pln

O) (L n;(1))

(PO n;(1)) r(PO n').

We have replaced a t with ; and reverse with r. Again, this program does not show clearly what is being proved. We may present the proof L more explicitly by plus n 0 = plus 0 n O. plus 0 0 = plus 0 0 n

~ .

plus n' 0 = (plus n 0)' = (plus 0 n)' =

n

~

= plus 0 n'

L I

(P1 n O) (L n;(1)) (PO n;(1)) r(PO n').

354

Before presenting techniques for transforming proofs, it is appropriate to justify our interpretation of proofs as programs. These remarks are made with the above logic in mind; as we consider other logics, we will have to reevaluate the utility of this interpretation. First, there is an intuitive sense in which proofs of this logic correspond to programs. A proof of t l ( x ) = t 2 ( x ) , when applied to a number n, reduces to a sequence of axiom applications which specifies how t l (n) may be rewritten to t 2 ( n ) . For example, using the equations for L, (L 0' ' ) may be expanded in the obvious way: L 0" ; =

(Pl O' 0) (L 0 ' ; ( 1 ) ) (P0 0 ' ; ( 1 ) ) r(PO 0 " ) (Pl 0' 0) (PI 0 0;(I)) (L 0;(I i)) (PO 0; (i I)) r(P0 0';(i))

(p0 0,;(i)) r(P0 0") =

(Pl 0' 0) (P1 0 0;(I)) (P0 0; (I I)) r(P0 0';(i)) (P0 0';(I)) r(P0 0'')

which indeed specifies h o w plus 0' ' 0 m a y be rewritten to plus 0 0' ' Second, we have found the interpretation of proofs as programs to be strongly suggestive of useful transformations. W h e n one understands the computational effect of a proof one can sometimes see immediately whether there is a simpler means of accomplishing the same effect. In fact, it is the elimination of computational redundancy that motivates most of the transformations we are currently investigating. Third, as we shall see, the class of proofs generalizes in a straightforward way to a class of programs not all of which are proofs. Currently, it seems simpler to investigate transformations over this class of programs than to ensure that all transformations preserve proofhood.

3

Program Transformations

We have already defined our proof metric as a count of the rewrite steps used plus the measures for the needed lemmas. For our equational representations of proofs this measure is simply the number of terms appearing on the right hand sides of the rules involved in the proof. Thus, for exampIe, our measure for the proof L is four. This is a very simple metric, and more sophisticated ones may be required in the future. The motivation for the metric is simple: it is meant to correlate directly with the amount of work involved in checking the correctness of a given proof. Thus it is meant to approximate the difficulty with which a human understands a proof. We do not currently have transformational strategies which are guaranteed to decrease the measure of a suboptimal proof. Instead, as a starting point, we have been investigating the heuristic that the elimination of computational redundancies can lead to shorter proofs. As an example, consider the following proof (call it M) that p l u s n 0 = n: M n

=

(L n) (PO n).

Here, L is the proof of the previous section that plus n 0 = plus 0 n. Now M to O' and expand, we obtain the following proof that plus I 0 = I: M 0'

=

if we apply

(Pl 0 O) (P0 0;(I)) r(P0 0') (P0 0').

This program instance is redundant because it contains the adjacent inverses r(P0 0') and (P0 0'). The second term undoes what is accomplished by the first. This example motivates the following somewhat narrow definition of computational redundancy: a

355

program is computationally redundant if some instance reduces to a program containing adjacent inverses. We desire means for transforming programs so that such redundancies are eliminated. Clearly, we could delete the adjacent inverses in the previous equation to obtain M 0'

=

(Pl o 0) ( p 0 0 ; ( 1 ) ) .

But we desire a way to transform the definition of M so that the redundancies in all instances are removed. To find such transformations, we draw from the work of Burstall and Darlington on program transformation~[2]. Using their approach, we begin with a set of equations defining a function. We then extend this set using a fixed collection of rules. From the final set of equations we obtain a new definition for the original function. The rules explored in [2] include the following: instantiation of an equation, unfolding, in which the left side of an instance of an equation is replaced by its right, folding in which the opposite occurs, definition of a new function, redefinition, in which two functions similarly defined may be equated, and application of laws in which metarules about the terms of the equations are used to derive new equations. We will use all of these rules. The laws we use are for deleting and inserting adjacent inverses and permuting subproofs. We will discuss these rules as they are motivated by examples. To see how folding and unfolding can be used with the deletion of inverses to simplify a proof, consider again the proof M. Note that (M O) unfolds to (PO 0), and thus admits no deletion of inverses. On the other hand, unfolding (M n ' ), we have M n'

= =

(L n') ( P O n ' )

(P1 n 0) (L n ; ( 1 ) )

(P0 n ; ( 1 ) ) r(P0 n')

(P0 n ' ) .

Here the pair of inverses r (P0 n ' ) and (P0 n ' ) may be deleted to yield the equation M n'

=

(el n O) (L n;(1)) (eo n;(1)).

By a folding step, we obtain M n'

=

(Pln

O) (M n;(1)).

We can now take the equations M 0 M n'

= =

(PO O) ( P I n O) (M n;(1))

to be the new definition of Min which the redundancy has been eliminated. We thus have a simpler program for rewriting p l u s n 0 to n. We must now determine whether this is a proof. In fact, it is. Note that M Ois a proof that p l u s 0 0 = 0. M n ' rewrites p l u s n ' 0 to ( p l u s n O) ' and then uses the inductive hypothesis by applying M to the subterm ( p l u s n 0). This proof may be presented more explicitly by: plus n 0 = n O.

n'.

M

plus 0 0

= 0

(PO O)

plus n' 0 = (plus n 0)' = n'

( P I n O) (M n;(1)).

356

Note that this proof has measure 3 while the previous proof has measure 6 (2 for M and 4 for L). This example illustrates our basic approach to transforming programs. Definitions are unfolded so that inverses may be eliminated; then folding steps are performed to produce a concise proof. This is the ideal situation of course. In general, more complicated manipulations are required to allow the deletion of inverses. We illustrate such transformations by presenting more complicated examples in the next section.

4 4.1

Examples The Commutativity

of Plus

Consider the following proof which uses the axioms for p l u s and our earlier lemma M to prove that p l u s is commutative. plus m n = plus n m O. plus m 0

C

= m

(M m)

= plus 0 m

r(PO m)

n ~.

= = = =

plus m n' plus m' n (plus m n)' (plus n m ) ' plus n' m

(LL m n) (Pl m n) (C m n;(1)) r(Pl n m)

plus m n' = plus m' n O. plus 0 n'

m'.

LL

= n'

(PO n')

= (plus 0 n)' = plus O' n

r(PO n;(1)) r(Pl 0 n)

plus m' n' = (plus m n')' = (plus m' n)' = plus m'' n

(Pl m n') (LL m n;(1)) r(Pl m' n)

Using our equational representation~this proofis rendered: C m 0 C m n'

= =

(M m) r(PO m) (LL m n) (Pl m n) (C m n;(1))

r(Pl n m)

M 0

=

(PO O)

M n'

=

(PI n O)

LL 0 n LL m' n

= =

(PO n') r(PO n;(1)) r(Pl 0 n) (PI m n ' ) (LL m n;(1)) r(Pl m' n).

(M n ; ( 1 ) )

By our definition, this proof is redundant. Note that

357

CO0'

= =

(LL 0 0) (Pl 0 0) (C 0 0 ; ( 1 ) ) r(P1 0 0) (P0 0 ' ) r(P0 0 ; ( 1 ) ) r(P1 0 0) (P1 0 0) (C 0 0 ; ( 1 ) )

r(Pl 0 0).

The final right hand side contains the inverse pair r ( P l 0 0) (Pl 0 0). adjacent inverses will occur in any application of (LL m n)

In general,

(Pl m n).

to a natural number. We will eliminate these inverse pairs by defining a new function W m n

=

(LL m n)

(Pl m n)

and simplifying the definition of W. We consider the ways that W m a y be applied, first to 0, then to m'. Now WOn

= = =

(LL 0 n) (P1 0 n) (PO n ' ) r(P0 n ; ( 1 ) ) r ( P l 0 n) (PO n ' ) r(P0 n ; ( 1 ) ) ,

(Pl 0 n)

by unfolding and the deletion of adjacentinverses. Similarly, W m' n

= = =

(LL m' n)

(Pl m' n)

(Pl m n') (P1 m n')

(LL m n;(1)) r(P1 m' n) (P1 m' n) (LL m n;(1)).

We would like to obtain a simple recursive definition for W, yet there is no way to fold the definition of W in the last equation. However, there will be if we insert the inverse pair (Pl m n; ( 1 ) ) r ( P l m n; ( 1 ) ) . Thus we derive W m' n

= =

(PI m n') (Pl m n')

(LL m n;(1)) (LL m n;(1))

=

(Pl m n')

(W m n;(1))

(Pl m n;(1)) r(Pl m n;(1)) r(Pl m n;(1)).

The equations for (W 0 n) and (W m' n) now give a new definition for W. By folding W m n in for (LL m n) ( P l m n) in the equation for (C m n ' ) , we obtain the new definitionfor C: C m 0 C m n'

= =

(M m) r(PO m) (W m n) (C m n;(1)) r(Pl n m)

M 0 M n'

= =

(P1 n O) (M n;(1))

W 0 n

=

(PO n') r(PO n;(1))

W m' n

=

(PI m n')

(PO O)

(W m n;(1))

r(Pl m n;(1)).

This p r o g r a m is in fact a proof, and can be represented by plus m n = plus n m O. plus m 0

= m = plus 0 m

C

(M m) r(PO m)

358

plus m n' = (plus m n)' = (plus n m)' = plus n' m plus m n' = (plus m n)' O. plus 0 n'

m

(W m n) (C m n;(1)) r(Pl n m) W

= n'

(PO n')

= (plus 0 n)'

r(PO n;(1))

plus

~ .

m' n'

= (plus m n ' ) ' = (plus m n ) ' ' = (plus m' n)'

(P1 m n ' ) (W m n ; ( 1 ) ) r(Pl m n;(1)).

The measure for this proof is 13, 2 less than the measure for the original proof. 4.2

A Program

W h i c h is N o t a P r o o f

We said earlier that some programs are not proofs. In fact, we will exhibit a program which is computationally equivalent to the current proof for C which is nevertheless not a proof. Note that the proof for C is still computationally redundant. For example, COO'

=

=

(W 0 0) (C 0 0 ; ( I ) ) r(P1 0 0) (P0 0 ' ) r(P0 0 ; ( 1 ) ) (M 0 ; ( 1 ) ) r(P0 0 ; ( 1 ) ) r(P1 0 0) (P0 0 ' ) r(P0 0 ; ( 1 ) ) (P0 0 ; ( 1 ) ) r(P0 0 ; ( 1 ) ) r(P1 0 0)

thus admitting a deletion. We can apply further transformations to obtain the following simple definition for C: Cmn

=

(U m n) (V m n)

u 0 n U m' n

= =

(p0 n) (pl m n) ( u m n ; ( 1 ) )

Vm0 V m n'

= =

r(P0 m) (V m n ; ( 1 ) ) r(P1 n m).

T h e derivation of this new program is not trivial; we have done it on p a p e r in 56 steps. Now if one examines carefully our current definition for C, one will see that indeed it does define a program for rewriting ( p l u s m n) to ( p l u s n m). Yet this program is not a proof, since U and V are not proofs. We will demonstrate this for the program V. Suppose (V m n) was a proof of t l ( m , n ) = t 2 ( m , n ) , where t l ( m , n ) and t 2 ( m , n ) are terms possibly containing occurrences of m and n. Since (V m 0) equals r ( P 0 m) and is therefore a proof of m = ( p l u s 0 m), it follows in particular that the t e r m t l ( m , n ) , with 0 replacing all occurrences of n, is the t e r m m. This is only possible if, regardless of n, t 1 (m, n) is the t e r m m. Now, (V r a n ' ) is a proof of t l ( m , n ' ) = t 2 ( m , n ' ) in which (V m n) is applied inductively to the first subterm. Since (V m n) is a proof of t l ( m , n ) = t 2 ( m , n ) , the first subterm of t l ( m , n ' ) must be the t e r m t l ( m , n ) . But this is a contradiction since b o t h t l ( m , n ' ) and t l ( m , n ) equal the t e r m m.

359

4.3

Generalizing Programs

to Obtain Proofs

Now it m a y seem useless to derive an efficient program which is not a proof. But in fact such programs can be useful for deriving proofs of other theorems. Suppose we desire a proof of ( p l u s n n ' ) = ( p l u s n ' n). T h e rewriting of ( p l u s n n ' ) to ( p l u s n ' n) can certainly be accomplished by applying our efficient program for C to n and n ' . We m a y thus define a function D by =

D n

Cnn'

and a t t e m p t to transform it into a proof. Let us try to manipulate this program so that it calls itself recursivety. We can reduce (D n) and (D n ' ) as follows: Dn

=

Cnn' (U n n') (V n n') (U n n') (V n n;(1)) r(P1 n n)

D n ' --

(U n ' n ' ' )

(V n ' n ' ; ( 1 ) )

r(P1 n ' n ' )

=

(P1 n n ' ' )

(U n n ' ' ; ( 1 ) )

(V n' n ; ( 1 1)) r ( P l n n ' ; ( 1 ) )

r ( P l n' n ' ) ,

Here, (D n) cannot be folded into the equation for (D n ' ) ; however, we can obtain a recursive program if we generalize. Let us introduce a new function E with (D n) = (E n n). This gives us the following equations. E n n

= (U n n') (V n n;(1)) r(P1 n n)

E n' n' = ( P I n

n'')

(U n n'';(1))

(V n' n;(l 1)) r(Pl n n';(1)) r(Pl n' n')

E is currently underspecified. We desire a recursive definition of E; by symmetry, we may choose the first argument as the variable of recursion. We thus want a definition of E in which (E 1 ' m) makes a recursive call to (E 1 m). In particular, we want (E n ' n ' ) to make a recursive call to (E n n ' ) . Thus we would iiketo fold (E n n ' ) i n for (U n n ' ' ) (V n ' n; ( 1 ) ) r ( P l n n ' ) in the last equation above. To summarize, we want a definition of E satisfying the following. (E 1 m)[n/l,n/m]

=

(U n n') (V n n;(1)) r(Pl n n)

(E 1 m)[n/l,n'/m]

--

(U n n'')

(V n' n;(1)) r(P1 n n').

From these constraints, it is clear that E must be defined by (E 1 m)

=

(U 1 m')

(V m i;(I)) r(P1 1 m).

Thus, by unfolding and folding, (E i' m) = = =

(U i' m') (V m 1';(1)) r(Pl I' m) (Pl 1 m') (U 1 m';(1)) (V m 1;(1 i)) r(Pl 1 m;(1)) r(PI I' m) (Pl 1 m') (E 1 m;(1)) r(Pl I' m).

Reducing (E 0 n), we obtain (E 0 m)

= --

(U 0 m') (V m 0;(I)) r(Pl 0 m) (PO m') r(PO m;(1)) r(Pl 0 m)

We now have the p r o g r a m for E: (E 0 m) = (E l' m) =

(PO m') r(PO m;(1)) r(Pl 0 m) (P1 1 m') (E 1 m;(1)) r(P1 i' m).

This p r o g r a m is a proof, and is in fact (with renaming) the same proof as LL in section 4.1.

360

4.4

Simplification

Requiring

Subproof

Permutation

The next example introduces a new transformation in which terms must be p e r m u t e d to allow deletion and folding steps. Consider the following axiomatization for minus: pred 0 pred k'

= =

0 k

minus m 0 minus m k'

= =

m pred

PrO Prl MO MI.

(minus m k)

Using these axioms and the previous ones for plus, w e m a y prove minus

(plus n a) (plus n b) = minus a b

R

by proving and using the l e m m a

RR.

minus n' k' = minus n k

Now using l e m m a R and l e m m a M which we introduced earlier, we m a y prove the theorem which we call T: minus n n minus = minus = minus = minus

= 0 n n (plus n O) n (plus n O) (plus n O) 0 0

T r(M n;(1)) r(M n;(2)) (R n 0 O)

= o

(Mo o).

Equationally, this proof, with lemmas, is given by T n

-- r(M n;(1)) r(M n;(2))

M0 M n'

-=

(P0 0) ( P l n 0)

R 0 a b

=

(P0 a ; ( 1 ) )

(R n 0 O) (MO O)

(M n ; ( 1 ) ) . (P0 b ; ( 2 ) )

R n' a b =

(P1 n a ; ( 1 ) )

RR n 0 RR n k '

(MI n ' 0) (M0 n ' ; ( 1 ) ) ( P r l n) r(M0 n) (M1 n ' k ' ) (RR n k ; ( 1 ) ) r(M1 n k ) .

= =

(Pi n b ; ( 2 ) )

(RR (plus n a) (plus n b ) ) (R n a b)

By our metric, this proof has measure 20. We will transform this to a much simpler proof in which T is defined recursively. Applying T to 0, we obtain TO

: =

r(M 0;(i)) r(M 0;(2)) (R 0 0 O) (MO O) r(PO 0;(I)) r(PO 0;(2)) (PO 0;(I)) (PO 0;(2)) (MO 0).

Now note that r ( P 0 0 ; ( 2 ) ) and (P0 0 ; ( 1 ) ) are applied to non-overlapping subterms. Thus, their computational effect is independent of the order in which they are applied. We are therefore justified in transforming the above equation by permuting these two terms. This allows the following steps.

361

T 0

= = =

r(P0 0;(I)) r(PO 0;(2)) (P0 0;(I)) (PO 0;(2)) (MO 0) " (P0 0;(I)) r(P0 0;(2)) . . . . r(P0 0;(2)) (PO 0;(2)) (M0 O)

=

(M0 0).

T h e transformation for (T n') is s o m e w h a t m o r e complex. A ~ e r expanding (T n'), T n' = r(M n';(1)) r(M n';(2)) (R n' 0 O) (M0 0) = r(M n;(l 19) r(Pl n 0;(I)) r(M n;(2 1)) r(Pl n 0;(2)) ( P l n 0;(I)) ( P l n 0;(2)) (RR (plus n O) (plus n 0)) (R n 0 0) (M0 O)

we can again permute subproofs which affect non-overlapping subterms, and delete inverses. This yields the following equation. T n' = r(M n;(l I)) r(M n;.(2 i)) (RR (plus n 0) (plus n 0)) (R n 0 0) (M0 O)

In order to fold (T n) into this last equation, we need to bring the term (I~ (plus n 0) (plus n 0)) to the outside. In fact, such a permutation can be justified by a syntactic analysis of the equations corresponding to the two subproofs. The proof r(M n;(1 1)) r(M n;(2 1)) (RR (plus n 0) (plus n 0)) produces the same effect as the proof (RR n n) r(M n;(1)) r(M n;(2)). Both rewrite (minus n' n') to (minus

(plus n 0) (plus n 0)). B y m a k i n g this per-

mutation, we mayfold (T n) as follows: T n'

=

(RR n n) r(M n;(1)) r(M n;(2))

=

(RR n n )

(R n 0 0) (M0 0)

(T n ) .

We thus have a new program for T given by T 0

=

(M0 0)

T n'

=

(RR n n) (T n).

In fact this is a proof, which m a y be presented m o r e explicitly by minus n n = 0 O. minus 0 0 = 0 n'.

minus n' n' = minus n n = 0

minus m' n' = minus m n O. minus m' O' = pred (minus m' O) = pred m' = m = minus m 0 n'.

minus m' n'' = pred (minus m' n') = pred (minus m n) = minus m n'

T (S0 0)

(RR n n) (T n) KR (M1 m' 0) (M0 m';(1)) (Prl m) r(M0 m)

(MI m' n') (RR m n;(1)) r(Ml m n).

362

This proof has measure 10, half the measure for the original proof. This example illustrates an intriguing prospect for the type of systems we would like to develop. One may first prove a theorem in a straightforward manner (e.g., without induction) by applying powerful lemmas. One may then mechanically derive a less roundabout proof for the same theorem which does not rely on those lemmas.

5

Discussion

We have shown how proofs in a logic of equality and induction can be manipulated to obtain shorter proofs. The approach involves applying transformations to a larger class of programs. The fact that some programs are not proofs does not make the approach unfeasible; we must simply check that a finM program is a proof. The method for doing this was illustrated in section 4.2. We assume the program rewrites t l to t2. We then determine whether t l and t2 can be consistently assigned values by analyzing the rewriting behavior of the program and the way it applies recursive calls. While we have shown the potential of program transformations for simplifying proofs, we do not yet have an effective procedure for improving suboptimal proofs. One might remark that the approach of applying program transformations is not so different from determining in advance what the optimized proof has to be and then proving that it is computationally equivalent to the original proof. The transformationM space is so large, it seems one needs to know the final result before applying transformations to produce it. This remark is well taken: to develop an effective procedure, one needs appropriate strategies for applying transformations. We have already begun to address this problem by investigating the strategy of eliminating computational redundancy, as defined in section 3. The utility of this strategy is supported by the examples presented earlier. As evidence that this strategy can be feasibly applied, an algorithm exists for detecting computational redundancy in a wide class of programs. For a program in this class, the program instances admitting a deletion can be summarized with a finite list of substitutions for the variables of the program. For example, the program Mof section 3, admits deletions whenever applied to m'. The algorithm computes such instances by first determining, for each subprogram, which variable instances correspond to which outermost terms of the subprogram expansion. As an example, consider the program defined by XO

=

B

X n'

=

(A n)

(X n ) .

The first few expansions of (X n) are given by n=O

B

n = 1

n = 2

(A O) B

(A t )

(A O) B.

Now both the rightmost and leftmost terms of the expansion of (X 0) are B. The leftmost term of the expansion of (X k' ) is (A k). The rightmost term of the expansion of (X k ' ) is again B. Thus, specifying the leftmost terms of the expansions of (X n) requires only the mention of two instances: n = 0, and n = k ' . All the rightmost terms are summarized by a single instance. For a wide class of programs, the outermost terms associated with the program can be characterized with a finite list of instances.

363 Using these characterizations of the outermost terms of subprograms, our algorithm can determine recursively whether a program expands to produce adjacent inverses for any instance. To illustrate, if the body of a program is (X n) (Y n), then our Mgorithm will consider the rightmost terms of instances of (X n) and the leftmost terms of instances of (Y n) to see (via unification) if any instance yields adjacent inverses. It will then recursively determine whether (X n) or (Y n) admits a deletion. This algorithm terminates if the outermost terms of each subprogram can be characterized with a finite set of instances. Since appropriately instantiating equations is a crucial step in many of our transformations, this algorithm aids greatly in the application of our heuristic to eliminate computational redur~dancy.

6

Future Work

A primary emphasis of future work will be on the identification of better heuristics for applying transformations. Our current heuristic of eliminating computational redundancy has limitations. There are redundant proofs which are shorter than any proof of the same equation in which the redundancy is eliminated. For a contrived example, consider the axiom fn'

=

fn

F

and the proof P that f n = f 0 ' : P

fn=fO' o.

f o

= f o'

r(F O)

n'.

f n'

= f n

(F n)

= f

(P n ) .

0'

The proof is redundant: (P 0 ' ) = (F 0) r ( F 0). Yet eliminating this redundancy produces the longer proof Q: fn=fO'

Q

0.

f 0

n'.

f

f n'

n'

= f 0' = f

0'

= f O'

r(F 0) (G n) G

O.

f O'

= f O'

I

n'.

f n"

= f n' = f O'

(F n ' ) (G n).

Another area for future work involves the investigation of other types of suboptimality. A complication which has not arisen in any examples we have considered, but which may be worth analyzing, is the occurrence of more complex sequences of deletable operations. A subproof of the form t l = Z2

P1

t3

P2

= tl

P3

=

364

may be deleted from a program even though it contains no adjacent inverses. More examples must be considered before it is clear whether developing a method for handling such subproofs would be worthwhile. Another optimization we plan to investigate is common subexpression elimination. If the same sequence of at least two subproofs occurs several times in a proof, by our metric it will be worthwhile to replace the occurrences of the sequence with a call to a lemma. Of course, it will be necessary to ensure that the sequence, taken in isolation, is a proof of some equation. It may also be possible to simplify a proof by the permutation of subproofs. Consider, for example, that the proof max (plus 0 n) (plus 0 n) = max n (plus 0 n) = max n n

(P0 n ; ( 1 ) ) (P0 n ; ( 2 ) )

= n

(Lemmal n)

proves the same

theorem

as the shorter

max (plus 0 n) (plus 0 n) = plus 0 n -- n

(Lemmal (plus 0 n)) (PO n)

in which subproofs have been permuted. In a related optimization, permuting the order of subproofs may make one of the proofs superfluous. For example, the proof minus 0 (plus 0 n) -- minus 0 n = 0

(PO n ; ( 2 ) ) (Lemma2 n)

m a y be replaced by the simpler minus 0 (plus 0 n)

(Lemma2 (plus 0 n))

-- O.

Finally, we desire to make program simplification techniques practical. We wish to consider a more general logic so that we can attempt to streamline proofs of the complexity produced by program verification systems.

7

Related Work

A primary motivation for our work is the desire for economy in the communication of mathematical arguments. Thus, we must allude to the delightful work of A. J. M. van Gasteren [6]. Her emphasis is on effective "human" theorem proving, where we emphasize the use of formal metrics and mechanical procedures for evaluating and developing proofs. Research on transforming proofs has been reported in [1], [7], [8], and [9]. The emphasis of this work is on transformations between different proof systems (e.g., proof systems involving matings, expansion trees, resolution, and natural deduction). This work and ours share the following motivation: to present mechanically derived proofs in a format appropriate for human comprehension. Our domains of investigation are different, however. We are investigating induction and equality rather than first and higher-order logic.

365

Given a proof, our approach to finding a shorter proof involves transforming a program which captures the computational content of that proof. Thus our work is related to research on both program transformation and constructive mathematics. Reference [5] provides an extensive bibliography for research on program transformation. The work in this area which is most closely related to ours is that of Burstall and Darlington [2, 4]. We use many of the transformations they introduce. The major difference, of course, is that our goal is to simplify proofs rather than to transform programs into more efficient ones. This means we have the additional responsibility of verifying that the results of our transformations are indeed proofs. This also means we have a simpler means of evaluating the efficacy of our transformations: our measure of proof desirability is a simple syntactic one. Current research in constructive mathematics is represented well by the work being done with the Nuprl system. Reference [3] describes this project and includes an extensive bibliography of related work. The NuprI project is exploring several applications of the "proofs as programs" paradigm. Our explorations are similar to some of these but our motivation is different. Our primary reason for using the "proofs as programs" correspondence is not an interest in constructivity or correct programs, but rather a desire to explore the use of a larger space in which to transform proofs. As far as we know, this is a new approach.

References [1] Andrews, Peter B., "Transforming Matings into Natural Deduction Proofs," in Fifth Confer. ence on Automated Deduction, W. Bibel, R. Kowalski (eds.), LNCS, no. 87, Springer-Verlag, 1980, pp. 281-292. [2] Burstall, R. M., John Darlington, "A Transformation System for Developing Recursive Programs," JACM, vol. 24, no. 1, January 1977, pp. 44-67. [3] Constable, Robert L., et. al. Implementing Mathematics with the Nuprl Proof Development System, Prentice-Hall, Englewood Cliffs, 1986. [4] Darlington, John, "An Experimental Program Transformation and Synthesis System," Artificial Intelligence, vol. 16, no. 1, March 1981, pp. 1-46. [5] Feather, Martin S., "A Survey and Classification of Some Program Transformation Approaches and Techniques," in Program Specification and Transformation, L. G. L. T. Meertens (ed.), North-Holland, Amsterdam, 1987. [6] Gasteren, A. J. M. van, On the Shape of Mathematical Arguments, Ph.D. thesis, Eindhoven University of Technology, 1988. [7] Lingenfelder, Christoph, "Structuring Computer Generated Proofs," Proc. of the l l t h IJCAI, Detroit, 1989. [8] Miller, Dale A., "Expansion Tree Proofs and their Conversion to Natural Deduction Proofs," in Seventh International Conference on Automated Deduction, R. E. Shostak (ed.), LNCS, no. 170, Springer-Verlag, 1984, pp. 375-393. [9] Pfenning, Frank, "Analytic and Non-analytic Proofs," in Seventh International Conference on Automated Deduction, R. E. Shostak (ed.), LNCS, no. 170, Springer-Verlag, 1984, pp. 394-413.

Ordered Rewriting and Confluence Ursula Martin* and Tobias Nipkow t

Department of Computer Science, I~HBNC, University of London Egham, Surrey TW20 0EX, UK and

University of Cambridge, Computer Laboratory Pembroke Street, Cambridge CB2 3QG, UK

Abstract One of the major problems in term rewriting theory is what to do with an equation which cannot be ordered into a rule. Many solutions have been proposed, including the use of special unification algorithms or of unfailing completion procedures. If an equation cannot be ordered we can still use any instances of it which can be ordered for rewriting. Thus for example z * y = y . x cannot be ordered, but if a, b are constants with b * a > a * b we may rewrite b * a ~ a * b. This idea is used in unfailing completion, and also appears in the Boyer-Moore system. In this paper we define and investigate completeness with respect to this notion of rewriting and show that many familiar systems are complete rewriting systems in this sense. This allows us to decide equality without the use of special unification algorithms. We prove completeness by proving termination and local confluence. We describe a confluence test based on recursive properties of the ordering.

1

Introduction

One of the m a j o r problems in t e r m rewriting t h e o r y is w h a t to do w i t h an e q u a t i o n which cannot be ordered into a rule. M a n y solutions h a v e been proposed, including t h e use of special unification a l g o r i t h m s [7] or of unfailing c o m p l e t i o n procedures [1,6]. If an e q u a t i o n cannot be ordered we can still use any instances of it which can be ordered for rewriting. T h u s for e x a m p l e

x.y=y.x cannot be ordered, but if a, b are constants w i t h b * a > a • b we m a y rewrite

b,a--.*a.b. This idea is used in unfailing completion, and also appears in B o y e r - M o o r e [2]. In this paper we define and investigate completeness w i t h respect to this n o t i o n of rewriting and show t h a t m a n y familiar systems are c o m p l e t e rewriting systems in this sense. This allows us to decide equality w i t h o u t the use of special unification algorithms. We prove completeness by proving t e r m i n a t i o n and local confluence. W e describe a confluence test based on recursive properties of the ordering. *The author acknowledges support of the UK SERC under grant GR/E 83634. tThis research was supported in part by NYNEX, NSF grant CCR-8706652, and by the Advanced Research Projects Agency of the DoD, monitored by the ONR under contract N00014-83-K-0125.

367

1.1

Summary

In this section we summarize our results. Precise definitions are given below. An ordered rewriting system consists of a set of equations E and a monotonic ordering on terms > which is total on ground terms. We say a term s rewrites to a term t, denoted by s - - ~ t, if there is an equation r = l or I = r in E, a substitution a and a subterm al of s such that al > a r and t is s with that subterm replaced by a r . Thus for example if x • y = y • x is in E and a * b > b • a then a * b ~ b* a. We observe that the usual notion of a rewriting system c~n be regarded as a special case of our concepts in the case when the ordering allows all the equations to be ordered into rules. A ground complete ordered rewriting system is one which is terminating and confluent on ground terms. This means that any ground term can he rewritten to a unique canonical form, and we can decide equality between ground terms, and hence between variable terms by regarding the variables as generalised constants. This process uses only unification in the empty theory. In section 4 we give examples of ground complete ordered rewriting systems including AC, ACI, Boolean tings, Distributivity and Abelian Groups. E x a m p l e 1.1 As an example let E be

(x,y),z

=

x*y

• ,(y,z)

x,(y,z)

(1)

=

y*x

(2)

=

y,(=,z)

(3)

and let > be any monotonic ordering on terms which is total on ground terms and satisfies for all ground terms x, y, z

(=,y),z

>

x*y x*(y*z)

(4)

>

y*x

ifx>y

(5)

>

y*(x*z)

ifx>y.

(6)

Then (E, >) is an ground complete ordered rewriting system. For example suppose that > is the lexicographic path ordering (see section 3) and a, b, c are constants with c > b > a. Then b,(c,(b,a))~b,(c,(a,b))--~b,(a,(c,b))

) a*(b,(c,b))--~a,(b,(b,c)).

To prove completeness we need as usual to prove termination and confluence. Termination is generally proved by showing that the ordering is well-founded1, and the orderings we need to do this for our examples are discussed in section 3. To prove confluence we need to prove local confluence, and in section 2.1 we prove the necessary version of the critical pairs lemma. The usual notion of rewriting and confluence allows confluence to be checked automatically by computation of normal forms. Ground confluence, however, is already undecidable for ordinary rewriting systems [8], and thus even more so for ordered rewriting. However we shall explain in section 2.2 how a ground confluence test may indeed be automated in many cases by axSomatising the properties of the orderings and rewritings that we need. This automation works for most of the examples of section 4. Consider the example above. Computing critical pairs between (x,y),z

x*y

=

x,(y,z)

=

y*x

1In fact, it is sufficientto show well-foundednesswithin equivalenceclasses, tf Ml equivalence classes are finite, this follows because any ordering on a finite set is well-founded.

368

we obtain

z , ( x , y) ~ - ( x , y ) , z ---, x , ( y , z), so we have to prove that z , ( x , y) and x * (y * z) are joinable for all ground terms x, y, z. Now since x, y, z are ground terms we may consider the possible relationships between them under >. For example if x > z > y then x,(y,z)

........~ y , ( x , z ) - - - * y , ( z , x ) ~ - - z * ( y , x ) ~ - - z , ( x , y )

While our technique allows the computation of canonical forms without a special matching algorithm we note that it is not always as powerful as rewriting with an equational matching algorithm. E x a m p l e 1.2 Consider the example above together with the equation f ( x * x) = 1. Rewriting with an AC matching algorithm shows that f(a*(a*(b*b))) = 1. However, there is no equivalent ground complete ordered rewriting system as any such system would have to contain infinitely many equations to deal with

f(a,a),

f(a*(a*(b*b))),

f(a,(a,(a,(a,(b,b)))))

and so on. On the other hand the advantages of our method are that • Ground rewriting is possible without E-matching algorithms. • Ground rewriting is sufficient for theorem proving. • Completion is possible without E-completion. It shares these features with unfailing completion, as described for example in [6]. Indeed, it is very similar to unfailing completion in two technical aspects: both sides of an equation may give rise to critical pairs, and complete systems need only be confluent for ground terms. In contrast to [6], our method is specially designed to detect critical pairs all of whose ground instances can be joined. Thus we are able to discard many critical pairs, and to obtain complete systems which their approach fails to verify as complete.

2

Critical

Pairs, Confluence,

and Completion

We assume that all concepts and definitions are as in [5] or [3]. Let E be a set of function symbols and V a set of variables. The set of all terms in E U V is denoted by T = T ( Z t3 V), and the set of all ground terms is the subalgebra Ta = T ( E ) . The function V returns the set of variables in a term. A term can be represented as subterms in a context by writing C[sl,..., sn]. The context C is a A-term A x l , . . . , x,~.t, and C[sl,..., sn] denotes application, i.e. the simultaneous the replacement of all xl by si. In particular we assume that every xl occurs exactly once in t. An ordering > on a set S is a relation which is irreflexive and transitive, so that it is false that x > x, and i f x > y and y > z then x > z. An ordering.on T is monotonic if for all function symbols f and terms s ~ , . . . , s ~ , s , t we have f ( s l , . . . , s , . . . s , ~ ) > f ( s l , . . . , t , . . . s ~ ) if s > t. An ordered rewriting system is a pair (E, >) where E is a set of equations in T and > is a monotonic ordering on 7" which is total on ground terms. The notation s - t E E is short for s=t E E V t = s E E. If for some l - r E E we have al > ar for all substitutions a we write I - - + r and call it a rule.

369 The ordered rewriting system ( E , >) induces a relation - - * defined as

C[as] --~ C[at]

if s - t E E

A as>at

Since > is monotonic, p ~ q implies p > q. The restriction of - - - , to ground terms is denoted by =:=~. We use ----** to denote the reflexive transitive closure of - - + . Two terms s and t are called joinable, written s .[ t, iff there is a term u such t h a t s ---~* u and t --~* u. They axe called groundjoinable, written s ~ t, iff for any ground substitution a, a s and at are joinable. An ordered rewriting system is called ground terminating if there is no sequence of ground terms {aili E N } such t h a t ai ~ ai+l for M1 i. An ordered rewriting system is cMled ground confluent if whenever r, s, t are ground terms with r ===~* s and r ==~* t then s ~ t. If the t e r m i n a t i n g or confluence conditions hold for all terms rather than just ground terms we call ( E , > ) terminating or confluent respectively. An ordered rewriting system which is terminating and confluent is called complete; one which is ground terminating and ground confluent is called ground complete. It follows from Newman's lemma that if ( E , >) is complete then each term s has a unique normal form, and if ( E , >) is ground complete this is true for ground terms. Thus if s, t are terms (ground terms) and ( E , > ) is complete (ground complete) then s =E t if and only if their normal forms are identical. If s and t are a r b i t r a r y terms we may still use a ground complete system to decide equality if we regard the variables occurring in s and t as new constants. In the sequel let ( E , > ) denote an ordered rewriting system and let ---% ~ etc. be the rewrite relations it generates. If there is a second ordering, say ~-, we write - - + ~ , ~ etc. to denote the relations induced by ( E , ~). 2.1

T h e Critical P a i r L e m m a

This section deals with the extension of the critical pair lemma to ordered rewriting. D e f i n i t i o n 2.1 Given two equations C[u] = t, u ~ V, and v = w with no variables in common and a most general unifier a o f u and v such that a(C[u]) ~ at and av ~ aw, then (crt,a(C[w])) is a critical pair. The set of all critical pairs of E is the set of all critical pairs between any two equations

p-~q, s-~t E E. Critical pairs in our sense are the extended criticalpairs of Bachmair et al. [1]. Note that because of the s y m m e t r y of --" both sides of an equation can give rise to critical pairs. If > orders every equation in E into a rule our definition of critical pairs reduces to the usuM one. 2.1 If > is total within equivalence classes of ground terms, both sides of an equation s - t E E are ground joinable.

Lemma

The following l e m m a extends the ordinary critical pair lemma [4] to ground confluence of ordered rewriting systems. It is a corollary to the critical pair lemma in [1]. L e m m a 2.2 An ordered rewriting system (E, > ) is locally ground confluent iff all critical pairs

are ground joinable. The proof of this l e m m a relies o n the totality of > within equivalence classes of ground terms. The following example shows that this requirement cannot be dropped: E x a m p l e 2.1 Let E = {*} U C, where C is a set of constants, E = { x , y = y , x}, and s > t iff the leftmost constant in s is > the leftmost constant in t. Clearly > is not total because a

370

and a * b are incomparable. Assume t h a t a < b. Then the term r = (b * a) * a can be rewritten to s = a * (b * a) and t = (a * b) * a. However, s and t are not joinable because s rewrites only to a • (a * b), which is in normal form, and t is in normal form already. On the other hand there is only a single critical pair (y • x, y * x) in E which is trivially ground joinable. This shows t h a t for non-total > the consideration of critical pairs does not suffice to determine local ground confluence. Finally we have: C o r o l l a r y 2.1 A terminating ordered rewriting system is ground confluent i.ff all critical pairs

are ground joinable.

2.2

A u t o m a t i n g It

In contrast to ordinary rewriting systems, where critical pairs are required to be joinable, we need the weaker criterion of ground joinability. It is not at all clear how a test of the latter property can be automated since it talks about an infinite set of ground instances. In fact we believe t h a t ground joinability is in general undecidable. The purpose of this section is to give some sufficient criteria which are easily implementable and powerful enough to solve some non-obvious examples. On the other hand they are far fl'om complete. Section 4.9 contains an example which is easily proved to be ground joinable but which is not covered by our method. The principle idea underlying the automation has Mready been sketched in the introduction: given two terms s and t, we consider all possible relationships between the variables in s and t under > and = and try to join s and t for each of them. Since there are only finitely many relationships, namely M1 linear orderings, we only have to consider a finite, albeit possibly very large, number of cases. It remains to be explained how rewriting of terms with variables is to proceed if we do not know what the variables stand for, only how they are related to each other with respect to >. As an example take the term y • z with the constraint x < y. It requires some intimate knowledge of > to determine whether this implies t h a t y , x > x • y, i.e. whether commutativity is applicable. Instead of working with a particular ordering and inferring some of its properties, we assume a small set of properties of the ordering which allow us to order enough terms for proving ground confluence. For the AC case we have seen in the introduction t h a t the implications (4)-(6) are sufficient for joining one of the critical pairs under a particular set of constraints. In section 4.2 we show t h a t the equations (1)-(3) together with any ordering satisfying (4)-(6) are ground confluent. The advantage of this approach is its generality: ground confluence is proved for any ordering satisfying the properties we have assumed. However, it means t h a t one has to be careful in the choice of properties. For example they must not violate well-foundedness. We will now describe a test for ground joinabitity based on the above ideas. Formally, the "properties" of the ordering are given as a closure operator C on 7" x T subject to the restriction

(s,t) e c(>)

e

(7)

where a ( > ) = {(au, av) I u > v}. The intuition is that C takes a relation on terms and returns the set of consequences implied by the properties we assumed of the ordering. The above restriction ensures that C is well behaved with respect to substitutions. This enforces for example t h a t if x * y > y • x follows from x > y, then x r > yt must imply x ~ • y~ > y t , x~. We say that an ordering > is compatible with C if C(>) = >. As a consequence of restriction (7) we obtain:

371

L e m m a 2.3 Let E be a set of equations, let > and ~- be two relations on T , and let a be a substitution such that a(~-) C >. Then u ---+c(~-) v implies cru ----*c(>) av for all terms u , v . P r o o f From u ----*c(~-) v it follows t h a t u = C[Sl], v = C[Sr] and (8I, 8r) E C(~-) for some l - r E E . From (~l, 0r) e C(~-) it follows by (7) that (ct~l, a S r ) E C(a(~-)). Since C is a closure operator and a(~-) C > we also have (aOI, nor) e C(>). Thus eta = a(C)[crSl] -'-~c(>) a(C)[aOr] = av. [] Ordering the variables in a term with respect to = and > is equivalent to providing a total order on equivalence classes of variables. If p is an equivalence on a set of variables, ~ denotes a substitution which maps each variable to some fixed representative of its equivalence class. Testing for ground joinability of two terms s and t by considering all total orders o~n equivalence classes of variables in s and t leads to the following definition. If ~s ~c(~-) /~t holds for all equivalences p on the variables in s and t and all t o t a l orders ~- on the range of t~, then we write s ~ e t. Restriction (7) ensures that this definition is independent of the particular choice of representatives of p-equivalence classes. The next l e m m a shows t h a t s Jjv t does imply ground joinability: L e m m a 2.4 I f s J~c t then s ~> t holds for all orderings > compatible with C. P r o o f Let > be compatible with C and let a be some ground substitution with dora(a) = 1)(s) U •(t). We have to show that as 1> at. Let p = k e r ( a ) and define x ~- y iff ctx > a y for x , y in the range of ~. Theft ~- is a total order and s ~c t implies/~s ~c(~-)/~t. Since >, ~-, and a satisfy the assumptions of lemma 2.3 it follows t h a t as = ads lc(>) apt = at. Since > is compatible with C we have as 1> at. [] From this l e m m a and the definition of ~c it follows directly that C o r o l l a r y 2.2 I f C(~-) is recursiv¢ and well-founded for all recursive and well-founded ~-, then ~c is a sufficient recursive criterion for ground joinability with respect to all orderings compatible with C. This is the first step towards automating the test for ground joinability. The second ingredient is l e m m a 2.1. Combining all these criteria we obtain the following set of rules: s~t

~

s=t

s~t

~

s#et

s~t

~

31-rEE,

f ( S l , . . . , 8n) ~L f ( t l , . . . , t n )

~

Vi. si ~ ti

a. a l = s

A ar=t

The first clause is obvious, the second and third ones are consequences of lemmas 2.4 and 2.1 respectively, and the last one follows from compatibility of rewriting. The p r o t o t y p e implementation of this test is written in Prolog and follows exactly the above four Horn clauses. C is just another predicate. In all our examples C consists of the implications (4)-(6) and further clauses specific to the example.

2.3

Completion

T h e critical pair l e m m a in the preceding section leads to a completion algorithm in the usual way: critical pairs which are not ground joinable are added as new equations. Formally this can be expressed as an inference rule between sets of equations:

372

E E u {s = t}

if (s, t) is a critical pair of E and not s ~ t.

If this process terminates because all critical pairs are ground joinable, we have obtained a ground complete ordered rewriting system. In addition one may want to obtain a reduced rewriting system by simplifying the right or left hand sides of equations by other equations. This can be achieved by the following rule:

E v {s-t}

EU{s=u}

ift----~EU A s - t ~ _ E

Since we are only interested in ground confluence, ground joinable equations can be removed:

EU{s-t}

ifs~t E The applications of these three rules may be interleaved arbitrarily. A prototype implementation of this completion procedure has been written in Prolog and was used for all the examples in section 4.

3

Orderings

Our notations and concepts are taken from Dershowitz [3]. An ordering is called well-founded if there is no set {aili E N} with al > ai+l for each i. We have L e m m a 3.1 Let (E, >) be an ordered rewriting system. If > is well-founded then (E, >) is

terminating. P r o o f The monotonicity condition ensures that if s ----, t then s > t, so if > is terminating there can be no infinite chain of rewrites.

[]

The following orderings will be used in the sequel.

Lexieographie P a t h O r d e r i n g Let s = f ( s l , . . . , s m ) , t = g ( t l , . . . , t n ) . Let > be an ordering on function symbols. Then s > t if and only if • si >_ t for some i = 1 , . . . , m , or • f > g and s > tj for all j = 1 , . . . , n, or • f = g (so n = m) and ( S l , . . . , s~) is greater than ( t l , . . . , t~) in the lexicographic ordering from the left on sequences induced by >, and s > tl for i = 1 , . . . , n. Then we have

L e m m a 3.2

1. The lexicographic path ordering is well-founded, and is total on ground terms if the operator precedence is total. 2. If f, g are binary function symbols with f > g and x , y , u , v are any terms and f ( x , y ) >

u, f(x, y) > v then f(x, Y) > g(u, v).

373

Knuth-Bendix Orderlngs The essence of the Knuth-Bendix orderings is to compare terms first by weight and then lexicographieally by an operator precedence. For details see [9] or [11], where proofs will be found of L e m m a 3.3 The Knuth-Bendix ordering is monotonic and well-founded, and is total on ground terms if the operator precedence is total.

Lexieographie Orderings Let E = { f , al . . . . ,ak} where f is binary and a l , . . . a n are constants. Assume al < a 2 . . . < ak. Define >, for t = 1,2 by

ai f(x,y) f(al,x) aj f(al, x)

>t aj >t f ( z , u ) >1 aj >1 f(a~, x) >2 aj

if and only if if and only if if and only if if and only if for all i , j = 1 , . . . , k

i > j x>zorx=zandy>u i>j j > i

where x, y, z, u are arbitrary ground terms. Then L e m m a 3.4 For each of the orderings >1, >2

1. >t is a monotonic ordering and total on ground terms 2. f ( f ( x , y ) , z ) x,y,z.

>t f ( x , f ( y , z ) )

and if x >t Y then f ( x , y ) > f ( y , x ) for all ground terms

3. >~ is not well-founded. Proof

The proof is straightforward. For (3) notice that we have

f(a2, al) >t f ( a l , f(a2, al)) >t f ( a l , f ( a l , f(a2, al))) >t . . . . [] Notice that >1 is described by Boyer and Moore [2], where it is expressed in terms of projecting onto strings by s(al) = al, s(f(x, y)) -- f s ( x ) s ( y ) where f denotes function application, and ordering the strings lexicographically. To enable us to use the automatic confluence test described in section 2.2 we need to identify orderings with certain properties.

Definition 3.1 An ordering is called A C compatible for the binary operator f if it is monotonic, well-founded and total on ground terms, and satisfies for all ground terms x, y, z

f(f(z, y),z) > f(z, f(y,z)) f(x,y) f(x,f(y,z))

> f(y,x) > f(y,f(x,z))

ifx>y ifx>y

L e m m a 3.5 Let > be the Knuth-Bendix ordering or the lexicographie path ordering and f any binary function symbol. Then > is A C-compatible for f .

374

4

Examples

We present here examples of ground complete ordered rewriting systems. 4.1-4.9 are standard algebraic systems. In 4.10 we investigate combination of rewriting systems. In 4.11 we investigate an alternative ordering for which AC has a ground complete system containing two rules only, and in we give a ground complete ordered rewriting system for abelian groups. Examples 4.~-4.9 are all ground complete for any ordering > which 1. is AC-compatible for all AC operators in the system, and 2. satisfies s > t for all rules s - - + t. For examples 4.1-4.6 the Knuth-Bendix orderings and the lexicographic path orderings have the required properties. These examples were all proved ground complete using the method of section 2.2. The closure operator C was induced by 1 and 2 above. Intuitively one reason why all the examples involving AC work is that we are doing is using a sorting algorithm. Any ground term is equal to a product of irreducibles and the AC rules (1)(3) are sorting these irreducibles into increasing order using bubble sort. The two rule version is merely using a different sorting algorithm.

4.1

Commutativity

Let E be { x , y = y , x } and > any monotonic ordering total within equivalence classes of ground terms. Then (E, >) is a ground complete ordered rewriting system. It is confluent because there are no (non-triviai) critical pairs. It is terminating since each equivalence class is finite, and so any infinite chain of rewrites would contain a loop, whictl would imply that > was not irrefiexive.

4.2

A s s o c i a t i v i t y and C o m m u t a t i v i t y

This example has been discussed in the introduction. Let E be

(x,y),z

, x,(y,z)

x*y

=

y*x

x*(y*z)

=

y*(x*z)

(E, >) is also ground complete if > is either of the lexicographic orderings >i.

4.3

A s s o c i a t i v i t y and C o m m u t a t i v i t y - - A n o t h e r Version

In the introduction we observed that one of the criLical pairs generated by 4.2 was (z * (x • y), x * (y * z)). We may use this to obtain another three rule ground complete ordered rewriting system for AC. Let E be (x,y),z

~

x,(y,z)

x,y

=

y,x

z,(x,y)

=

x,(y,z)

and > any ordering which satisfies (5) and z • ( x , y) > x • (y • z) if z > x. The lexicographic path ordering and the Knuth-Bendix ordering have this property.

375

4.4

Associativlty, Commutatlvlty,

and Idempotence

Let E be --'-*

(x,y),z x*y x * (y * z)

x*(y*z)

=

y*x

=

y*(X*Z) X

X,*X

---.+

x * ( x * y)

x * y.

,2,

4.5

Groups of Exponent

Two

Let E be (x,y),z

~

x,y

=

x,(y,z)

=

X*X

x*(x*y)

x,(y,z) y,x

y,(x,z) )

1

----*

y

x*l

~

x

l*x

~

x

Then (E, >) is a ground complete ordered rewriting system for groups of exponent two. 4.6

Groups of Exponent

T w o in D i s g u i s e

We want to prove that the two laws (x,x),y

=

y

(=,y),z

=

(y,z),z

(s)

axiomatize groups of exponent two. Starting from this system, the completion procedure generated the following list of critical pairs, ordering some of them into rules: (x*y)*x

~

(x*y)*y

---*

x,x

y

=

x y*y

x *x

-.--+

1

1 *x

~

x

x*l x*(x*y) x*y

(9) (lo)

~ x ~ =

y y*x

(x*y)*z

---~

x*(y*z)

x*(~*z)

=

y*(~*z)

Notice that (10) is the result of "dividing" (9), i.e. introducing the new constant t. The final set of equations (all the ones below and including (10)) is the same as in section 4.5. All the other equations are now joinable.

376

In [10] the same problem is attacked with the help of the term rewriting system Reve. Because (8) cannot be oriented into a rule, Reve cannot deal with it directly. Martin obtained the result by working with consequences of (8) that can be ordered.

4.7

Distributivity

Let E be (x,y),z

----* x , ( y , z )

x*y

=

• ,(y,z)

y*x

=

x*(y+z)

~

x*y+x*z

(x+y)*z

~

x*z+y*z

and let > be any ordering which is AC-compatible for both + and ,. For example the lexicographic path ordering fits the bill. Then (E, >) is a ground complete ordered rewriting system. 4.8

Boolean

Rings

The following is a ground complete set of ordered rewrite rules for Boolean rings. x+y

x+(y+z) x+x O-b x 1,x x,O

(x,y),z x,(y+z)

=

y+x

=

y+(x+z)

~ -----* ~ ~

x*y

=

x,(y,z)

0 x x 0

x+O x , x x,1 O,x

y,x

=

y*(x*z)

~ ~ ---.+ ~

x x x 0

---~

x,(y,z)

(x+y)+z

--~

x+(y+z)

~

x,y+x,z

(x+y),z

---~

x*z+y,z

The ordering must be AC-compatible for both + and ,. The lexicographic path ordering has these properties. Ground confluence can be checked by the technique of section 2.2. 4.9

Another

System

Herewe present two similar small examples; for one our method works and for the other it does not. Consider the equation (x,y),

z = z,(x

,y),

(11)

and any ordering > in which x , y > z implies (x * y) * z > z * (x * y). The criteria of section 2.2 fail to prove ground confluence, although there is a very simple proof. The two critical pairs are (z*(x*y)),u

=

u,((x,y)*z)

((~,y),z),~

=

~,(z,(~,y)).

(12)

Let us just consider the first one. If (x * y) = z, (12) is an instance of (11). If (x • y) > z or ( x , y ) < z, (12)can be rewritten to ( z , ( x , y ) ) , u

= u,(z,(x,y))or

((x,y),z),u

= u,((x,y),z),

both of which are instances of (11). Again lemma 2.1 implies ground joinability. The proof for the second critical pair is practically identical.

377

The tests in section 2.2 cannot cope with these critical pairs because the proof of ground joinability is based on a case distinction which compares not just variables but whole subterms, namely x • y and z. On the other hand the equation (~,~),y=y,(~,x)

(13)

is an example of a system that our method proves ground confluent for any ordering total and well-founded on ground terms. The reason is that the only nontrivial critical pair y • ((x • x) • (x • x)) = ((~ • x ) , (x • ~)) • y is an instance of (13). By lemma 2.1 this implies ground joinability. 4.10

Combination

of Systems

In this section we discuss how a ground complete ordered rewriting system may be combined with a ground complete rewriting system in the usual sense. L e m m a 4.1 Suppose that 1. R is a ground complete rewriting system in the usual sense over a set of function symbols E andR I= {l=rlI~rE R},

2. (E, >) is a ground complete ordered rewriting system over a set of function symbols F, 3. there is a well-founded monotonic total ordering ~- on T ( E U F) such that ~- D_ > and al ~- a r f o r each rule l ---* r E R and ground substitution a, and 4. there are no critical pairs in the sense of definition 2.1 between E and R ~ w.r.t. ~-. Then ( E U R ~, ~-) is a ground complete ordered rewriting system.

P r o o f Condition 3 ensure that (E U R', >-) is terminating. Due to condition 4 the only critical pairs of ( E U R', ~-) are those of E or of R and hence are ground joinable. Thus (E U R t, ~-) is ground complete. [] As a corollary we see immediately that the combination of any of the theories we have considered above with new free function symbols (so R is empty) gives a ground complete ordered rewriting system. If R and E are both proved terminating using the lexicographic path ordering or KnuthBendix ordering, and assuming that the operator precedences are consistent on E N F, we may obtain a total ordering ~- by constructing a total operator precedence on E U F which subsumes the two partial precedences. Thus we may combine any of the examples above with any such R. 4.11

AC with Two Rules

In this section we show how with a suitable choice of ordering two rules suffice for a ground complete AC rewriting system. Let E be (x*y)*z x*y

--~ =

x*(y*z) y*x

378

and > any m o n o t o n i c ordering which is total on ground terms and satisfies for all ground terms x, y, z and all c o n s t a n t s a, b

(x,y),z

> x,(y,z)

x,y a

> >

ifx>y ifa>b.

y*x b,x

We show t h a t ( E , > ) is ground complete. Notice that the ordering >2 of the previous section has the required properties. (In fact it is not hard to see t h a t a n y ordering with these properties is not well-founded). We m u s t first prove t e r m i n a t i o n . Suppose t h a t 81 ===~ 8 2 ===~ is a n infinite chain of rewrites. Since each equivalence class is finite it must c o n t a i n a loop si ~ si+l ~ "" Si+k ~ 8i. But since s ~ t implies s > t we have si > Si+l > " " > si, which contradicts the definition of >. T h u s ( E , > ) is t e r m i n a t i n g . To prove g r o u n d confluence we first observe - - "

L e m m a 4.2 Let g and h be ground terms and let S~ be the multiset of all constants occurring in the term w. I f g =E h then Sg = Sh. Proof

Sg is i n v a r i a n t when a p p l y i n g the equations of E .

D

T h e n we can prove Theorem

4.1 Let ( E , > ) be as above. Then

1. I f w E TG then W =:=~* al * (a2 * ' " *

(an-1 * a n ) . . . )

where S~ = { a l , . . . , an} and al <_ as <_ " - <_ an, and this expression is irreducible.

2. ( E , > ) is a ground complete ordered rewriting system. Proof 1. T h e proof is by i n d u c t i o n on n = IS~I. If n < 2 the result is clear. Now by applying associativity we m a y assume w ==~* a * v where Sv = Sw - {a}. By i n d u c t i o n we m a y assume that v has the required form, so t h a t in particular v = b * u, where b _< c for each e E Su = Sv - {b}. Now if a < b we are done, so assume t h a t a > b. T h e n w~*

a,(b,u)

~*

(b*n),a~*b,(u,a).

Now by i n d u c t i o n u * a rewrites to the required form, as * ( a n " • * a,~), and since b < a andb
al,(a2*(...,an))

w ~*

al * (a2* ( " ' *

and an))

where S~ = { a l , . . . , a ~ } a n d a~ < . . . a ~ . T h u s v and w are joinable. Hence ( E , > ) i s g r o u n d confluent, a n d as it is t e r m i n a t i n g it is g r o u n d complete.

379

4.12

Abellan

Groups

Let E be

x*y

=

y*x

x*(y*z)

=

y*(x*z)

(x*y)*z

=

x*(y*z)

=

1

x * i(x) 1,x

=

x

X*I

~

X

x,(i(x),y)

=

y

i(x • y)

=

i ( x ) , i(y)

i(i(x))

=

x

=

1

i(1)

and > any AC compatible ordering which orders the last seven equations from left to right for all ground terms x, y, and has a l < i ( a l ) < a2 < i(a2) < . . .

<

an

<

i(an)

where the constants are a l , . . . , an. The lexicographic path ordering with precedence • < i < al < .. • < a~ will do this. We shall show that (E, >) is ground complete. Unfortunately our automated ground confluence checking procedure fails in this case as it has to reduce arbitrary terms of the form x , (Yl * (Y2 * ( " " (y,~ * ( i ( x ) , z ) . . . ) . But we may prove ground completeness using the technique of the previous example. If a is a constant and t is a term we define the polarity of a in t as p(a,-) : TG - - ~ Z inductively as

p(a,a)

=

1

p(~,b)

=

0

p(a,i(x))

=

-p(~,x))

p(a,s.t)

=

p(a,s)+p(a,t)

where s and t are terms and b is any constant distinct from a. Thus for example p(a, i ( i ( a ) , ( t , a))) = - p ( a , t ) . L e m m a 4.3 I f g and h are ground terms with g =E h then for each i p(al,g) = p(ai, h). Now we have T h e o r e m 4.2 Let (E, >) be as above. Then

1. I f w E Tc and w ~ E t then W ~ *

e p l * e p2 . . . * e Pn n ,

(assumed associated to the right) where for each i we have Pi = ]p(ai, w)l, and el = ai if p(al, w) > O, ei = i(al) if p(al, w) < O. Furthermore each such expression is irreducible. 2. ( E , > ) is a ground complete ordered rewriting system. Proof 1. If w E TG then by applications of the last seven equations it is easy to see that

w ~*

el • (e~ * . - . *

e~)...)

380

where each ei e { a j , i ( a j ) I J -- 1 , . . . , n } . Now as al < i(al) < a2 < i ( a ~ ) . . . < an < i(an) an argument similar to the previous theorem shows that we may assume e~ _< e2 < - - • < en. Now applying (7) we see that each expression of the form u * (ai * (i(al) * z)) reduces to u * v, and thus W :=~* e pt * e2P2 * " " " * enP n , where each aj is aj or i(aj). Now by the lemma each p/ = [p(ai, w)[. It is clear that this expression is irreducible. 2. Since the ordering is well-founded, (E, >) is terminating. To prove confluence suppose that u =E v with u, v ground. We have by the lemma that p(aj, u) = p(aj, v) for each j. But then by the first part u and v are joinable. Thus (E, >) is ground confluent. [] Acknowledgements This paper was written while the second author was at the Laboratory for Computer Science at MIT and the first author was visiting there. We would both like to acknowledge the generous hospitality of John Guttag.

References [1] L. Bachmair, N. Dershowitz, D. Ptaisted: Completion Without Failure, Proc. Coll. on Resolution of Equations in Algebraic Structures (1987). [2] R.S. Boyer, J.S. Moore: A Computational Logic Handbook, Academic Press (1988). [3] N. Dershowitz: Termination of Rewriting, Journal of Symbolic Computation (1987) 3, 69116. [4] G. Huet: Confluent Reductions: Abstract properties and Applications to Term Rewriting Systems, Journal ACM 27, 4 (1980), 797-821. [5] G. Huet, D.C. Oppen: Equations and Rewrite Rules - A Survey, in: Formal Languages: Perspectives and Open Problems, R. Book (ed.), Academic Press (1982). [6] J. Hsiang, M. Rusinowitch: On Word Problems in Equational Theories, Proc. ICALP'87, LNCS 267 (1987), 54-71. [7] J.-P. Jouannaud, H. Kirchner: Completion of a Set of Rules Modulo a Set of Equations, SIAM Journal of Computing 15 (1986), 1155-1194. [8] D. Kaput, P. Narendran, F. Otto: On Ground-Confluence of Term Rewriting Systems, to appear in Information and Computation. [9] D.E. Knuth, P.B. Bendix: Simple Word Problems in Universal Algebras, in: Computational Problems in Abstract Algebra, ed J. Leech, Pergamon 1970, 263-297 [10] U. Martin: Doing Algebra with Reve, Report UMCS~86-10-4, Dept. of Comp. Sci., University of Manchester (1986). [11] U. Martin: How to Choose the Weights in the Knuth Bendix Ordering, in: Rewriting Techniques and Applications, LNCS 256, 1987, 42-53.

Complete Sets of Reductions with Constraints Gerald E Peterson McDonne/I Douglas Corporation, 1065165 P. O. Box 516, St. Louis, Missouri 63166 (314) 232-1208 NSFNET: [email protected]

Abstract: We show that by constraining the substitutions allowed in some of the rules, it is possible to find complete sets of reductions for equational theories which include non-orientable equations such as commutativity without requiring a special unification algorithm. We develop the theory for such constrained reductions and we exhibit complete sets for semilattices, boolean algebras, and ternary boolean algebras.

1

Introduction

In a l a n d m a r k paper, K n u t h and Bendix [KB70] described a technique for a t t e m p t ing to generate a complete set of reductions from the axioms of an equational theory. If a complete set of reductions could be found, then it embodied a decision procedure for equations provable from the axioms. In particular they generated a complete set of reductions for groups. In their theory a t e r m ordering was introduced and it was necessary for every equation to be orientable in the sense t h a t one side be larger t h a n the other in the ordering. Equations such as c o m m u t a t i v i t y which could not be oriented would cause the process to fail. K n u t h and Bendix were well aware of this limitation of their m e t h o d . In fact, on page 295 they proposed using an approach in which a non-orientable equation would be m a d e into two reductions, one which rewrites the left-hand side to the righth a n d side a n d another which rewrites the right-hand side to the left-hand side and in which a m e t h o d is available to "make sure t h a t no infinite looping occurs when reducing words to a new kind of irreducible form." This proposed approach is effected in the work presented here. In this paper, in order to handle equations such as c o m m u t a t i v i t y which cannot be oriented, w e introduce a constraint which is a t t a c h e d to each reduction. For example, we represent c o m m u t a t i v i t y as (x.y --~ y - x if x > y). A reduction is applied to a ground t e r m only if the constraint is satisfied. If a > b in some ordering, then this constrained c o m m u t a t i v e law will rewrite a • b to b • a, but it will not rewrite b • a to a • b. By using constraints such as these we are able to generalize the entire K n u t h - B e n d i x process. In fact, complete sets of constrained reductions are now known for m a n y c o m m o n equational theories including Abelian groups, rings, and Boolean algebras, and there is an analogue of the K n u t h - B e n d i x procedure which begins with the axioms of an equational theory and a t t e m p t s to generate a complete set of reductions. This

382

constrained version of the Knuth-Bendix process will never fail because a non-orientable equation shows u p - - e v e r y equation can be oriented. It may, of course, fail because it runs forever trying to find a complete set. The process reduces to that of K n u t h and Bendix when presented with equations which are orientable without the use of constraints. Because of space limitations, we do not describe the entire process in this paper. Here we present the underlying theory that forms the basis for a mechanical test of the completeness of a given set of constrained reductions. T h e n we exhibit complete sets for various theories. Follow-on papers will be devoted to the completion process. In these sequels it will be necessary to specialize to a specific term ordering; here we are able to get by with a list of properties which the ordering must satisfy. The entire process has been implemented in C o m m o n Lisp running on a Symbolics 3650. The run-time characteristics are similar to implementations of the Knuth-Bendix process except that when constraints come into play, the process slows. This program has found complete sets of reductions for algebraic systems other than those mentioned in Section 6, including Abelian groups, but some of the theory necessary to actually automatically prove the completeness is not present in this paper, so the presentation of these results will await the sequel. As an example, the following three reductions taken collectively is a complete set equivalent to associativity and commutativity.

1. (=-u).z

=.

(u-z)

2. x . y - - - * y . x i f x > y 3. x . ( y . z ) ~ y . ( x . z )

1.1

if x > y.

Related Work

The approach of this paper is an alternate to the use of special unification algorithms such as associative-commutative unification [PS81] [JK86]. The advantage of constrained reductions is that constraints allow every equation to be oriented. The advantage of special unification algorithms is that they may be more efficient in situations where they are applicable. While studying the associative-commutative-identity version of the Knuth-Bendix algorithm [BP89] we found that constraints similar to, but simpler than, those of this paper were necessary. The present work came about because the author reasoned that if constraints were necessary when using certain special unification algorithms, why not back up to the beginning and find out what happens if the use of constraints, but not special unification, is added to Knuth-Bendix. A substantial b o d y of work (see [DO88] and [ZR85]) is available for "conditional" or "contextual" rewrite systems. These are only superficially similar to the constrained systems of this paper. For one thing, our constraints never affect the t r u t h of the constrained equation, only its applicability--all the equations we consider are universally true. For another, the constraints we use are reduced to conjunctions of atoms whose predicate symbol is >. This is an entirely different kind of expression t h a n those allowed in conditions or contexts.

383

T h e r e are other approaches to dealing with non-orientabte equations. For example, the "unfailing completion" of [BD87] carries the non-orientable equations along with the reductions and has special rules for handling them. C o m o n [Co90] has shown t h a t the existence of solutions of a constraint is decidable w h e n > is the lexicographic p a t h ordering.

2

Definitions We work in first-order logic with equality.

T h e reader should be familiar with

terms, substitutions, instances, ground terms, etc., as in [CL73]. T h e reader should also be familiar with ideas and terminology related to locations in a term, such as the t e r m formed by replacing the s u b t e r m at location ~ of a t e r m t by s: t[g +- s], and ancestors of a location, etc., as in [PS81]. We use 0 to represent the location of the root of a term, (1) for the leftmost s u b t e r m , etc. As usual we use --*+ as the transitive closure of the relation --% and -+* as its reflexive, transitive closure. We assume given a total simplification ordering > on the set of ground terms. T h a t is, > is a total ordering on ground terms which satisfies 1. if s is a strict s u b t e r m of t, then t > s (subterm property), and 2. if s > t, then u[~ ~- s] > u[~ +- t] for every t e r m u and location ~ (monotonicity). It is known IDES7] t h a t such an ordering is a well-ordering. The K n u t h - B e n d i x ordering and the lexicographie p a t h ordering are two examples of total simplification orderings ([De87]).

A constraint is a well-formed logical formula built from terms, the constants t and f, the predicates > and --, and the logical operators -~, A and V. The following are examples of constraints: x>y, = f(b))

f ( x , fCy, z)) > f ( y , f ( z , x ) )

v

>

/X (~(x > y) ',/ f ( x , g ( a , z ) ) ~- fCg(a,b),gCz, a))).

A constrained equation e is an expression of the form ~=p

if c

where )~ and p are t e r m s and c is a constraint. All variables are implicitly universally quantified and every variable in p or in c is also in ,k. In e the variables are interpreted as ranging over ground terms. Thus, in c, = and > have the meaning they acquire on ground terms. T h a t is, = means identical and > is the ordering on ground t e r m s which we assume exists. We assume t h a t > is a c o m p u t a b l e function so for every ground instance cO of c, there is a c o m p u t a b l e process which determines whether cO is I or f. In a constrained equation, if the constraint is t, then the constraint m a y be o m i t t e d and we will refer the equation as being unconstrained. In order to avoid wordiness, we will usually s p e a k simply of equations rather t h a n constrained equations.

384

We say t h a t constraints cl a n d e2 are logically equivalent, cl =- c2 if w h e n e v e r c10 and e20 are g r o u n d instances of cl a n d e2, respectively, it follows t h a t c10 is logically equivalent to e20. We define cl :=~ e2 similarly.

A true ground instance of a constrained e q u a t i o n e = (~ = p if e) is an equality of the f o r m (~0 = p0) where 0 is such t h a t e0 is g r o u n d a n d cO is true. A constrained reduction or rewrite rule is a c o n s t r a i n e d e q u a t i o n r = (~ = p if c) such t h a t for every true g r o u n d instance r0 of r, ~0 > pO. R e d u c t i o n s are n o r m a l l y w r i t t e n as ( A ~ p i f c). A n e x a m p l e is ( x . y - - + y . x i f x > y). Note. W h e n we say t h a t r = ( x - y -+ y . x if x > y) is a c o n s t r a i n e d r e d u c t i o n we are also implicitly saying s o m e t h i n g a b o u t the ordering > , for r will n o t be a r e d u c t i o n for all total simplification orderings. In fact, we are saying t h a t > satisfies: if s a n d t are g r o u n d t e r m s a n d s > t, t h e n s • t > t • s. This s t a t e m e n t is t r u e for the K n u t h - B e n d i x ordering and for the lexicographic p a t h ordering, t h e two orderings of m o s t interest to US.

Let R be a set of c o n s t r a i n e d reductions and t , s g r o u n d terms. We write t = ~ s w h e n e v e r there is a location £ of t and a reduction (~ -+ p if c) of R such t h a t either t/£ = ),0 and s = tie ~ pO] or t / l = pO and s = tie +- )@. We define =• as the reflexive, transitive closure of = ~ . We write t -~ s w h e n e v e r there is a c o n s t r a i n e d reduction (~ -+ p if e), a location e of t and a s u b s t i t u t i o n 0 such t h a t

c0 ~- t,

t/£ = ~0, and s = tie +

po].

It follows f r o m our definitions t h a t --.C_>. Therefore, since > is well-founded on g r o u n d terms, so is -~. If t is a g r o u n d term, tl is a -+ n o r m a l f o r m for t. A set R of c o n s t r a i n e d r e d u c t i o n s is a complete set of reductions if t = R s is equivalent to t ~ = s~. Let s ++ t m e a n s --+ t or t --+ s. Note t h a t when R contains c o n s t r a i n e d reductions, ,~* is n o t the s a m e as = R . We say g r o u n d terms s and t are joinable if there is a g r o u n d t e r m u such t h a t s --+* u and t --~* u. T h e relation --+ is ground confluent if w h e n e v e r s and t are g r o u n d t e r m s such t h a t s ++* t, it follows t h a t s a n d t are joinable. It is well-known t h a t if --~ is g r o u n d confluent and well-founded, t h e n each g r o u n d t e r m has a unique n o r m a l form, and w h e n e v e r s ++* t it follows t h a t s J,= tj,. If R is u n c o n s t r a i n e d , t h e n we m a y remove the w o r d "ground" f r o m t h e previous p a r a g r a p h a n d o b t a i n well-known definitions a n d results.

3

Ground Confluence versus Confluence

W h e n dealing with c o n s t r a i n e d reductions, one of necessity m u s t consider their applicability e x t e n d i n g only over g r o u n d terms. For, if we t r y to apply a c o n s t r a i n e d r e d u c t i o n to a t e r m c o n t a i n i n g variables, t h e n it m a y be impossible to d e t e r m i n e if t h e constraint is true or false. For example, (x • y --+ y • x if x > y) c a n n o t be applied to h(z) .w b e c a u s e h(z) > w c a n n o t be evaluated t o t or f since z and w are n o t g r o u n d .

385

This creates a small p r o b l e m because we want our work to have the same power as the work of K n u t h and Bendix, but they applied equations and reductions to general t e r m s and we are restricted to ground terms. This p r o b l e m would be solved if we could show t h a t in the unconstrained case, working over the ground level and working over the general level are equivalent. Therefore, let's consider the difference between ground confluence and confluence in the unconstrained case. According to the N e w m a n L e m m a [Ne42] an unconstrained s y s t e m of reductions is confluent if for every t e r m s, the following confluence test holds: W h e n e v e r s --+ tl a n d s --* t2, there is t3 such t h a t tl --** t3 and t2 --** t3. T h e test for ground confluence is the s a m e except t h a t it must hold only for every ground term. Our h o p e t h a t working over the ground and general levels would be equivalent seems to be dashed because we have the following example of a set of reductions which is ground confluent b u t not confluent [KN 87]. 1. f ( g ( f ( z ) ) ) -* 9 ( f ( g ( z ) ) ) 2. f(c) c 3. 9(c) --, c

This is not confluent because f ( g ( f ( g ( f ( Y ) ) ) ) ) rewrites to g ( f ( g ( g ( f ( y ) ) ) ) ) and to f ( g ( g ( f ( g ( Y ) ) ) ) ) and neither of these can be further rewritten. However, it is ground confluent because the only ground constant is c and since f(c) and g(c) b o t h rewrite to c, every ground t e r m will rewrite to c. This example seems to work because there is only one ground constant. If there were additional ground constants besides c, it would not work. P e r h a p s if there were enough ground constants, this kind of thing could not h a p p e n and our hope would be substantially restored. Indeed, this is the case. T h e o r e m 3.1. Let R be a set of unconstrained reductions and suppose there are infinitely m a n y constant symbols. Then R is confluent if and only if R is g r o u n d confluent.

Proof. We only need to show t h a t ground confluence implies confluence. So suppose R is ground confluent and suppose t is a t e r m which rewrites to b o t h tl and t2. Let 0 be a substitution which replaces the variables of t with constants which do not occur in R; each different variable with a different constant. In essence, applying 0 to a t e r m fixes the variables, turning t h e m into constants. Then t0 --, t10 and tO ~ t20. By ground confluence there is a t e r m t3 such t h a t t10 ~ * t3 and t20 --+* t3. It follows from the definition of --, t h a t if s is a t e r m whose variables occur in t and if s0 --* s', then s --, s'0 -1 where 0 -1 is the "antisubstitution" which is inverse to 0. T h a t is, in the unconstrained case, if you can reduce a term when variables are thought of as constants, you can also reduce it when they are thought of as themselves. (This s t a t e m e n t follows f r o m the fact t h a t if I --, r E R then la > r a for every substitution 0.) Going back to the original proof, we apply this to obtain tl --'* t30 -1 and t2 --,* t30 - 1 . I Reviewing this proof we see t h a t in fact it is not necessary to have infinitely m a n y constant symbols, b u t there must be enough so t h a t for every t e r m which occurs while checking confluence, the distinct variables can be fixed to represent distinct constants. Therefore, we m a k e the blanket a s s u m p t i o n t h a t enough constant symbols for this p u r p o s e are available in the language. Because of this we are justified in regarding our

386

work as a generalization of the work of K n u t h and Bendix even though our reductions will only be applicable to ground terms. We do not feel this is a serious restriction because in most situations, it is permissible for the logician to invent new constant symbols whenever they are deemed useful. Ground confluence is also considered in [KN87], [G587], and [ZR85].

4

A Completeness Test

In this section we develop a completeness test for a set of constrained reductions which is equivalent, when restricted to unconstrained reductions, to the Knuth-Bendix critical pairs completeness test. Critical constrained equations are formed as follows. For each pair of reductions (),1 --~ p l if el) and (A2 ~ P2 if c2) of R, including a reduction paired with itself, and for each non-variable location t of A1 such that A1/£ is unifiable with ),2 with most general unifier a, the constrained equation

(p,a

= )q[£ * - p2]cr if

(ClO A c2a))

is a critical equation of the hard type; and for each reduction (A --+ p if c) of R, the constrained equation

(~ =

p if ~ c )

is a critical equation of the easy type. We prefer to use the terminology "critical equation" rather t h a n the "critical pair" of other authors because we then have fewer different kinds of things. Both reductions and critical equations are a special kind of constrained equation and a new kind of entity, i.e. pair, is not necessary. Example. The critical equations of the complete set of reductions and commutativity which was given in the introduction are shown in first 3 equations in the figure are the easy ones and the remainder are 1. (x . y) . z = x . (y . z) if ~t from 1 from 2 2. x . y = y . x if -~(x > y) 3. x - ( y . z) = y - ( x . z) if ~(x > y) from 3 from 1 4. (x. (y. z)). zl = (x- y)- (z- zl) if t/X t from 2 5. (y.x).z = z. (y.z) if t/~ (x > y) from 2 6. z . ( x - y ) = x . CY.z) i f t A ( x . y > z ) 7. y l . ( ( x . y ) . z l ) = x - (y- ( y l - zl)) if t/X ( x - y > yl) from 3 from 3 8. x l . ((yl. z l ) - z ) --- ( y l . ( x l . z l ) ) . z if t A (xl > yl) from 1 9. ( x . y ) - ( x l . z) = x l - ( x - ( y . z ) ) if l A (xl > x. y) 10. y . ( x - z ) = ( y - z ) - x i f (x>y) A(x>y-z) from 2 from 2 11. y-C x . z ) = x . ( z . y ) if ( x > y ) A ( y > z ) 12. x. ( x l . (y. z)) = x l . (y. (x. z)) if (xl > x) A (x > y) from 3

for associativity Figure 4.1. The the hard ones.

into 1 into 1 into 1 into 1 into 1 into 3 in?~o 3 into 3 into 3

at at at at at at at at at

(1) (1) 0 0 (1) (2) 0 (2) (2)

Figure 4.1 Critical equations for associativity and commutativity A constrained equation e = (s = t if c) is joinable if for every true ground instance (sO = tO) of e, sO and tO are joinable. Given ground terms s, t, and u, we say t h a t (s = t)

387

is connected below u if there exist terms t 0 , Q , . . . ,t,~ such t h a t s = to, t = t,~, u > t~ for 0 < i < n, a n d t ~ _ x ~ t~ for 0 < i < n. A constrained equation e : (s = t i f e) is subconnected if for every true ground instance (sO : tO) of e and for every ground u such t h a t u -++ s0 and u --~+ tO, (sO : tO) is connected below u. 4.1. (Critical equations completeness test) The following statements are equivalent. i R is a complete set of reductions, ii every critical equation is jolnable, iii every critical equation is subconnected.

Theorem

T h e implication ii=~i is the analogue of the ordinary critical pairs completeness test. S t a t e m e n t iii is included because the implication iii=~i will p r o b a b l y be useful if results pertaining to the elimination of critical pairs ([ZK89]) are generalized to the case of constrained reductions.

Proof. i=~ii: Suppose R is a complete set of reductions and let e = (s = t if c) be a critical equation. Let (s0 = tO) be a true ground instance of e. By the m a n n e r in which the critical equation was formed, sO :z~ tO. Since R is complete, sO~: tg~. Thus e is joinable. ii=¢,iii: This follows because joinable implies subconnected. iii=~i: Suppose every critical equation is subconnected. We wish to show t h a t R is complete. Note first t h a t : R is the same relation as +-** because easy critical pairs are subconnected. Therefore, it will suffice to show t h a t --~ is ground confluent and for this it will suffice to show t h a t -+ satisfies the hypotheses of the generalized N e w m a n l e m m a [WB83]: The relation ~ is confluent if and only if for all ground t, Q, t2: if t -~ tl and t --~ t2, then tt and t2 are connected below t. Suppose t, t l , t 2 are ground terms such t h a t t ~ tl and t --+ t2. It follows t h a t there are r l : (At --+ pl if el) and r2 = (A2 --~ P2 if e2) in R, locations £I, £2 of t, and a s u b s t i t u t i o n 0 such t h a t

c10 = t

t/el

c20 : t

: AIO

t/£2 : ~zO

tl = t[et *-- p10]

(1)

t2 = t[£2 <-- pzO].

If £1 and £2 are independent, then it is easily seen t h a t tl and t2 b o t h reduce to t[£1 ~ pl#; £2 +-- p20] and are, therefore, connected below t. Otherwise, one of £1 and £2 is an ancestor of the other and we m a y assume t h a t £1 is an ancestor of £2. T h e n £2 = £i£ for some location L Substituting in (1) for £2 gives t/£~£ = A20 and t2 = t[£1£ +-- p20]. Since t/£~ = A10 we obtain =

(2)

t2 = t[£1 ~-- ~10[£ +-- p20]]. Since t l , t2, and t differ only in the s u b t e r m at £1, and since > is monotone, it is clear t h a t tl and t2 are connected below t if and only if p10 and A10[£ <-- p20] are connected below A10. We prove this latter s t a t e m e n t by cases depending on the location of £ in AlO.

388

Case 1. Suppose l is =buried in 0." T h a t is, £ = nip where n l is a location of A1 and )`z/nl is a variable, say vl. Let n l , n 2 , . . . , n k be the locations in A1 at which vl occurs. Let 0 = {vl +- Q , . . . , v j ~- ti}. It follows from (2) that t l / p = )`20. Let t~ = tz[p +- p20] and 0' = {Vl *- t'l,v2 <-- t 2 , " ' , v i +- ti}. Since tz --+ t~ it follows that p l 0 --** pzO+

and )`lOll ~ p20] : (AI{v2 ~ t 2 , " ~ , v j +- tj})[nl ~ tl][n2 +-- t l ] ' " [nk *-- tl] + * (A~{v2 , - t 2 , . . . , v j

+- tj})[n~ + t'l][n2 + t'l]... [nk ~ t~] = Az{vl +-t'l,v2 ~ t 2 , ' " , v j +-- tj} = AzO'.

If Cl Ot ~-- t, then ),101 ~ plO' and we have plO and )`10[£ +-- p20] joinable and therefore connected below ),10. On the other hand, if c10' = f, then since the critical equation ()`1 = Pl if --cl) is subconnected by our hypotheses, it follows that A10' and plO' are connected below )`10 and it follows that plO and )`10[£ +-- p20] are also connected below )`10.

Case 2. Suppose £ is a location in )`1 and )`1/£ is not a variable. Then (2) becomes (~,1/£)0 = A20, i.e., )`1/£ and )`2 are unifiable. Let a be their mgu. By our hypotheses, the critical equation (pla = )qa[~ +-- p2a] if (cla a n d c2a)) is subconnected. Let ¢ be such that 0 --- a¢. By (1) (c~O A c20) = t so by the definition of subconnected, plO and AzO[~ ~- p20] are connected below )`10 as required. II Note. This proof shows that in (3) we could relax the requirement for each hard critical equation e = (pier = )`in[! ~-- p2a] if claAc2a)) to say that e is connected below )`la, where for a general constrained equation e' --- (s = t if c) and a general t e r m u, for e' to be connected below u means that whenever (sO = tO) is a ground instance of e' and uO is a ground instance of u, it follows that sO = tO is connected below uO.

5 Proving Joinability We will prove completeness by proving that every critical equation is joinable. To do this we must show that every true ground instance of each critical equation is joinable. We cannot actually check the joinability of the true ground instances one at a time because, in general, there are infinitely many of them. Thus, we must develop other methods for performing the test. In overview, the process of showing that the equation e is joinable, which is described in detail in the remainder of this section, is to first put the constraint of e into a normal form, then fully reduce the equality of e, probably going down several paths depending on the constraint of e and the constraints of the elements of R, and finally check for identical sides in the resulting fully reduced equations. We first state two simple but fundamental results t h a t follow easily from the definition of joinability.

389

Theorem joinable.

5.1. If c =_ c', then (s = t if c) is joinable if and only if (s = t if c') is

Theorem

5.2. E v e r y equation (s = t if c) in which s = t, or c - f is joinable.

T h e o r e m 5.2 is t h e basis for all proofs of joinability. We t r y to r e d u c e each critical e q u a t i o n to one of t h e forms m e n t i o n e d in the s t a t e m e n t of the t h e o r e m .

5.1

A Normal Form for Constraints

W h e n p r o v i n g t h e joinability of a critical e q u a t i o n e -=- (s = t if e), we first p r o c e e d t h r o u g h t h e following steps in order to p u t e into a n o r m a l form. If along the w a y e takes one of t h e f o r m s of T h e o r e m 5.2, it is i m m e d i a t e l y discarded, joinability h a v i n g b e e n proved. Step 1 - - E l i m i n a t e not. A p p l y t h e r e d u c t i o n s of Figure 5.1 to e until they are no longer applicable. This will eliminate all occurrecnes of --. This step is justified by T h e o r e m 5.1. 1. ~ t - ~ f 2. -~f - ~ t

3. -~(x > y) ~ x : y V y > x 4. - , ( x : y ) ~ x > yV y > x

6.

v y) +

A

(= v y) ^ z

F i g u r e 5.1 N o t - e l i m i n a t i o n rules

^ z) v (y ^ z)

Figure 5.2 A n d over or rules

Step 2 - - D i s t r i b u t e and over or. A p p l y the reductions of Figure 5.2 to c until t h e y are no longer applicable. After this is done, c will be a disjunct of conjuncts. Step 3 - - M a k e n e w equations f r o m each disjunct. At this point, e has the f o r m (s : t if cl V c2 V . . . V c,,). Replace e by the n new critical equations

(s = t if cl),

(s = t if ce) " " (s = t if c.).

This is justified by T h e o r e m 5.3. T h e equation (s = t if cl Vc2) is joinable i[ and only if both (s = t if cl) a n d (s = t if c2) are joinabIe. Proof. If e = (s = t if cl v c2) is joinable a n d (s0 = tO) is a t r u e g r o u n d i n s t a n c e of e l = (s = t if c t ) , t h e n (sO = tO) is also a true g r o u n d instance of e, so (sO = tO) is j o i n a b l e a n d it follows t h a t e l is joinable. Similarly ee = (s = t if c2) is joinable. If el a n d e2 are b o t h j o i n a b l e a n d (sO = tO) is a t r u e g r o u n d instance of e, t h e n (sO = tO) is a t r u e g r o u n d instance of either el or e2 so (sO = tO) is joinable and it follows t h a t e is joinable. II A f t e r this s t e p we are left w i t h A as the only logical o p e r a t o r in t h e c o n s t r a i n t s of o u r critical equations. Step 4 - - R e m o v e t and f. Use the rules of Figure 5.3 until t h e y are no longer applicable. A f t e r this step, either c = f or c = t or neither t nor f occur in c.

390

tAx--~ x xAf--~ f fAx~f Figure 5.3 Rules for r e m o v i n g t a n d f

Step 5--Remove equalities. Suppose c = (tl = t2)Ac'. If tl and t2 are n o t unifiable, t h e n replace c by I; if tl a n d t2 are unifiable w i t h m g u a, t h e n replace e by (s : t if d ) a . This is justified by T h e o r e m 5.4. The equation (s : t if (tl : t2) A c) is joinable if and only if Q and t2 are not unifiable, or (s = t if c)a is joinable where a is the mgu of tl and t2.

Proof. Suppose e = (s = t if (tl = t : ) A c) is joinable a n d t~ and t2 are unifiable w i t h m g u a. Let ( s a c = t o e ) be a t r u e g r o u n d instance of e' = (s = t if c)a. T h e n c a ¢ = | and t l a ¢ = t 2 a ¢ . Since e is joinable, ( s a c = the) is joinable and it follows t h a t e * is joinable. O n the o t h e r h a n d , s u p p o s e either tl and t2 are not unifiable, or e ~ is joinable. If tl a n d t2 are not unifiable, t h e n for every g r o u n d instance e0 of e, t10 ¢ t20 and it follows t h a t t h e r e are no true g r o u n d instances of e. So s u p p o s e e ~ is joinable and let (sO = tO) be a true g r o u n d instance of e. It follows t h a t tlO = t~O and c0 -- i. T h u s , there is ¢ such t h a t 8 = h e . Since e ~ is joinable, (tO = sO) is joinable a n d it follows t h a t e is joinable. | After this step c is either i or an only > 's constraint, i.e., a c o n j u n c t of a t o m s each with predicate s y m b o l > . Let a greater-than atom be one whose predicate s y m b o l is > .

Step 6--Eliminate contexts, redundancies, tautologies and inconsistencies; add transitive implications. It seems best to phrase these final steps in t e r m s of t h e a l g o r i t h m s h o w n in Figure 5.4. T h e function N F ( N o r m a l Form) takes two only > ' s c o n s t r a i n t s cl and c2 as a r g u m e n t s , the first of which is already in n o r m a l form. It r e t u r n s a n o r m a l f o r m for cl A c2. For p u r p o s e s of this algorithm, a c o n j u n c t of a t o m s is considered as a set of atoms. If it is desired to p u t c into n o r m a l form, t h e n NF(O, c) would be called, where 0 is the e m p t y set. T h e idea is to take the g r e a t e r - t h a n a t o m s f r o m c2 one at a !NFCc,,c2) : ire2 is e m p t y , then return el;

(s > t) ~-- first(c2); c2 ~ rest(c2); i f ( s > t) = u[£ +- s'] > u[£ ~-- t'] for some terms u , s ' , t ' a n d location £ ¢ 0 , then replace s > t w i t h s ~ > t ' and r e p e a t this step if possible. if s is a s u b t e r m of t, then return f; f i t is a s u b t e r m of s, then return N F ( c l , c 2 ) ; f i t is a s u b t e r m of u for some (s > u) E cl, then return g r ( c l , c 2 ) ; f l u is a s u b t e r m of s for some (u > t) E Cl, then return g F ( c t , c 2 ) ; for every (s > u) E ct such t h a t u is a s u b t e r m of t, do cl *- Cl - (s > u); for every (u > t) E cl such t h a t s is a s u b t e r m of u, do cl ¢- cl - (u > t); for every (u > v) • ct such t h a t s = v / l , do c2 ~ e2 + (u > v[£ +- t]); for every (u > v) • cl such t h a t u = t/g, do c2 ~-- c2 + (s > t[£ ~-- v]); return W E ( c , A (s > t), c2). Figure 5.4 A l g o r i t h m for p u t t i n g only > ' s constraints into n o r m a l f o r m

1

2 3 4 5 6

7 8 9 10 11 12 13 14

391

time and add t h e m to Cl, in the process keeping cl in normal form and adding new consequences to c2. We now briefly describe the algorithm. At line 3 we take the first element s > t of c2. We will process it and possibly add it to cl at line 14. Lines 4 and 5 remove contexts, i.e. if s and t are the same except for some subterm, then s and t may be replaced by this subterm, respectively. This is justified by monotonicity. For example, x. ( y . z ) > x . y may be replaced by y . z > y. Line 6 removes inconsistencies; no term can be less t h a n a subterm of itself. Line 7 removes tautologies; every term is greater than a strict s u b t e r m of itself, so this does not need to be explicitly stated in the constraint. Lines 8, 9, 10, and 11 remove redundancies. For example, if x > y • z and x > y both occur in a constraint, then the second is redundant because it easily follows from the first. Lines 12 and 13 add transitive implications. For example, if x > y • z and y > u b o t h occur in a constraint, then we also add x > u. It is important to do this in order to reveal hidden inconsistencies. For example, if x > y and y > x b o t h occur in a constraint, then this step will add x > x which will be found to be inconsistent when it is received by line 6. We have no proof t h a t this algorithm always terminates, but it has terminated on many examples and we believe it always terminates. The soundness of the algorithm can easily be proved, however. This is left to the reader. Unfortunately, there are constraints equivalent to t which this algorithm will not reduce to I. For example, it is possible to set up the Knuth-Bendix ordering so that a and f(a) are adjacent for some constant a and function symbol f . In this situation, (x > a) A (f(a) > x) is inconsistent, but this will not be discovered by the algorithm. However we have found this algorithm quite adequate in practice.

Examples. Since redundancies are discarded, N F ( x . Consider N F ( x . x > z, z > x). During the processing of z > x - x > x is added to c2 but it is later discarded because it is is ( x . x > z) A (z > x). Finally, N F ( x > y, ( - y ) > ( - x ) . y ) is added to c2 at line 13 and then at line 6, I is returned.

5.2

x > z, x > z) = x > z. x, the transitive implication a tautology, thus the answer = f because ( - y ) > ( - y ) .y

Joinability by Cases

Once we have the constraint into normal form, the real work of testing joinability begins. The job is to reduce the equational part of the contrained equation to normal form and check to see if the sides are identical. Since the reductions in R are applicable only under certain circumstances, this leads to splitting the reduction process into cases depending on whether or not the conditions for some reduction are satisfied. The equation e = (s = t if c) is partially reducible by (,~ --~ p if cl) to el with remainder e2 if there is a substitution a and a location e of (s = t) such that (s = t)/e =

~o, (c A c~o) ~ f, et = ((s = t)[e ~-- pal if (c A cla)) e2 = (s = t if (c A -~Cla)).

and

392

In the same situation, e is reducible to el if (c/x -~cla) = f, i.e. c =~ Cla. In particular, if ci = t, then e is reducible to el. Note that if e reduces to e l , then the constraint of el is simply c. In order to use this definition in practice, we must have a way to test (c/~ cla) ~ f and e =~ cia. T h e first is checked by executing N F ( c , cla) and testing to see if the result is f. As mentioned, there might be cases in which (c/x cia) - f but this test shows otherwise. However, the consequence is that e is replaced by el and e 2 and it is still true t h a t e is joinable if e l and e2 are. (See Theorem 5.5 below.) T h e consequence of this error is that some equations that ~ i g h t have been proved joinable if the error were caught will not be proved joinable. To check c :=~ cia we first put cia into normal form, then try to show t h a t every greater-than atom of cla is redundant in c A cla as in lines 8-11 of Figure 5.4. If this is the case, then c ==~cla, otherwise it doesn't. For example,

(= > y. z)

(x > y).

T h e o r e m 5.5. If the equation e reduces to el, then e is joinable if el is joinable. If e partially reduces to el with remainder e2, then e is joinable if ei and e2 are joinable. This is the primary result used in proving that an equation is joinable. Given an equation e, we try to find a reduction that will reduce it. If we can find such, then e is replaced by the equation to which it reduces. Otherwise we try to find a constrained reduction t h a t will partially reduce it. If this is found, then e is replaced by el and e2. Proof. We prove the second statement, the first then follows. Suppose

e=(s=tifc), el = ((s = t)[e ~ pa] if (c/~ ¢ia)),

e~ = (s = t if (c/x -~cio)), and e l and e2 are both joinable. Let e0 be a true ground instance of e. If cio8 = f, then (s9 = t0) is joinable since e2 is joinable. On the other hand, if cla8 = t, then sl9 and t18 are joinable, where (si = Q) = (s = t)[~ ~-- pa]. But either s --~ si or t ~ ti and it follows that s8 and t0 are joinable. II Example. Consider the proof of joinability of equation 6 of Figure 4.1. We show part of this proof in Figure 5.5. In Figure 5.5, the first line of each box is the left-hand side of the equation, the second line is the right-hand side, and the additional lines are joined by A's to make the constraint. T h e original equation can be partially reduced by ( x . (y- z) ~ y . (x. z) if x > y) to ( x . ( z - y ) = x - ( y . z) if (x. y > z) A (z > x)) with remainder (z. (x.y) = x. (y. z) if ( x . y > z) A-~(z > x)). T h e first of these is shown in the left box of the second row in Figure 5.5 and the joinability of the remainder is implied by the joinability of the equations shown in the last two boxes on the second row. The '5.5b' listed on the arcs indicates that it is primarily the second part of T h e o r e m 5.5 that is used to show t h a t the joinability of the top box follows from the joinabili'ty of its children. The remainder of the figure is interpreted similarly. At this point the reader could profit by using these ideas to prove the joinablilty of the critical equations for associativity and commutativity shown in Figure 4.1.

393

x (y. ~) x y>z l

li.tz.~)/ `[5.5b

(y.

y>z z>x

~5.5b ~. (x.y) Ix.(y.~)

`[5.5[

I~

y>z >z ....

tx.y>z IZ=X

1

15.4

,[5.5b

15-5b i

15.5b

(y. x)

(~. z) • . (y. z) x.

x.y>z z>x z>y

~)

. (x. y) (y.

y>x

l::>x

>x >z

:Z

,~5.4

x. (y. y) x. (y. y)

I

x.y>y y>x

t5.5a !"• (~. (~• y) y) .y>z >x >z

x• (y. x) x.y>x x>y

`[5.5b

5.5b

I x. (y.~5.5b x)

(y.x)

ti"(x.y) y>x

=X

,[5.4

" (x. y) • '(y. x)

If

.y>x >x

,L5.ga

(x.y)

(x. x) x>x

y>x >x

li• (x.y)

Figure 5•5 Proving joinability by cases

6 Examples Consider the reductions in Figure 6.1. As we have seen, the first three of these constitute a complete set for associativity and commutativity. Reductions 1 through 5 constitute a complete set for a semilattice--a set with one binary operator which is associative, commutative and idempotent, see [MB67], page 487. Reductions 1 through 18 constitute a complete set for a boolean algebra with • denoting and, + exclusive or, 1 true, and 0 false• Finally, it follows from Theorem III in [Gr47] that reductions 1 through 20 constitute a complete set for a ternary boolean algebra. 1. ( x - y ) - z--* x - ( y . z) 11. x - 1 --* x 2. x . y - - ~ y . x i f x>y 12. 1 . x - ~ z 3. x . ( y . z ) - ~ y . ( x . z ) if x > y 13. x + O - - - * x 4. x * x - + x 14. O + x - - - ~ x 5. x . ( x . y ) - - ~ x . y 15. x . 0 - * 0 6. ( x + y ) + ~ - - , x + ( y + ~ ) 16. 0 . x - ~ 0 7. x + y - - - ~ y - ~ x | f x > y 17. x . ( y + z) --* x . y + x . z 8. x + ( y + z ) ---* y + ( x + z ) if x > y 18• ( x + y ) . z - - - * x . z + y . z 9. x T x - - ~ O 19. f ( x , y , z ) - - ~ x . y + y . z + z . x 10. x + (x + y) --~ y 20. - x - - * l + x Figure 6.1 Reductions in complete sets

394

References [BD87] L. Bachmair, N. Dershowitz, and D. Plaisted, "Completion Without Failure," Preliminary Proceedings of the Colloquium on the Resolution of Equations in Algebraic Structures, Lakeway Texas, May 4-6, 1987, sponsored by Microelectronics and Computer Technology Corporation, M. Nivat and H Ait-Kaci, organizers. [BP89] T. Baird, G. Peterson, and R. Wilkerson, "Complete Sets of Reductions Modulo Associativity, Commutativity and Identity," Lecture Notes in Computer Science 355 Rewriting Techniques and Applications, RTA-89, N. Dershowitz, ed., SpringerVerlag, 1989, 29-44. [CL73] C. Chang and R. Lee, Symbolic Logic and Mechanical Theorem Proving, Academic Press, New York, 1973. [Co90] H. Comon, "Solving Inequations in Term Algebras," Fifth Syrup. on Logic in Computer Science, LICS 90, 1990. [DES7] N. Dershowitz, "Termination of rewriting," J. Symbolic Computation, 3 (1987), 69-116. [DO88] N. Dershowitz, M. Okaba, and G. Sivakumar, "Canonical Conditional Rewrite Systems," Lecture Notes in Computer Science 310, 9th International Conference on Automated Deduction E. Lusk and R. Overbeek editors, 1988, 538-549. [G 86] R. GSbel, "Completion of Globally Finite Term Rewriting Systems for Inductive Proofs," UniversitSt Kaiserslautern SEKI-REPORT SR-86-06, June 1986. [G 871 R. GSbel, "Ground Confluence," Lecture Notes in Computer Science 256 Rewriting Techniques and Applications, RTA-87, P. Lescanne, ed., Springer-Verlag, 1987, 156167. [Gr47] A. A. Grau, "Ternary boolean algebra," Bulletin of the American Mathematical Society, 53 (1947), 567-572. [JK861 J.-P. Jouannaud and H. Kirchner, "Completion of a set of rules modulo a set of equations," SIAM Journal of Computing, 15 (1986), 1155-1194. [KB70] D. Knuth and P. Bendix, "Simple word problems in universal algebras," Computational Problems in Abstract Algebras, J. Leech, ed., Pergamon Press, Oxford, England, 1970, 263-297. [KN871 D. Kapur, P. Narendran, and F. Otto, "On Ground-Confluence of Term Rewriting Systems," Technical Report 87-6, Department of Computer Science, State University of New York, Albany, N.Y. 12222. [MB67] S. MacLane and G. Birkhoff, Algebra, The Macmillan Company, New York, 1967. [Ne421 M. H. A. Newman, "On theories with a combinatorial definition of 'equivalence'," Annals of Mathematics 43/2 (1942), 223-243. [PS81] G. Peterson and M. Stickel, "Complete sets of reductions for some equational theories," Journal of the Association for Computing Machinery, 28 (1981), 233-264. [StSXl M. Stickel, "A unification algorithm for associative-commutative functions," Journal of the Association for Computing Machinery, 28 (1981), 423-434. [WB831 F. Winkler and B. Buchberger, "A Criterion for Eliminating Unnecessary Reductions in the Knuth-Bendix Algorithm," Colloquia Mathematiea Soeietatis Jdnos

395

Bolyai 42, Algebra, Combinatorics and Logic in Computer Science, GySr, Hungary, 1983. [ZK89] H. Zhang and D. Kaput, "Consider Only General Superpositions in Completion Procedures," Lecture Notes in Computer Science 355, Rewriting Techniques and Applications, RTA-89, Springer-Verlag, 1989, 511-527. [ZR85] H. Zhang and J.-L. Remy, "Contextual Rewriting," Lecture Notes in Computer Science 202 Rewriting Techniques and Applications, edited by Jean-Pierre Jouannaud, 1985, 46-62.

Rewrite Systems for Varieties of Semigroups* Franz Baader G e r m a n Research Center for Artificial Intelligence DFKI, Projektgrup~pe W I N O , Postfach 2080 D-6750 Kaiserslautem, West G e r m a n y

Abstract We consider term and word rewriting systems for semigroup theories and study the connection between these two concepts. As an application, the lattice of all varieties of idempotent semigroups is investigated with the following point of view: Can we decide the word problem of the varieties in question by using finite canonical term or word rewriting systems ? In spite of the fact that there are infinitely many varieties of idempotent semigroups, this question can be solved completely. We thus obtain infinitely many examples of equational theories which satisfy the following property: The theory has decidable word problem, but it cannot be decided by using a finite canonical term or word rewriting system.

1 Introduction A finite canonical term rewriting system can be used to decide the word problem for the corresponding equational theory. The fact that there exist equational theories with undecidable word problem thus implies that there are equational theories which do not have a finite canonical term rewriting system. However, we can ask whether all decidable word problems can be decided with the help of a finite canonical term rewriting system. The corresponding question for semi-Thue systems was asked by Jantzen [8] in 1982, and negative answers were given e.g. by Book [3] in 1983, and by Jantzen [9] and Kapur-Narendran [10] in 1985. Since semi-Thue systems can be considered as term rewriting systems for terms over monadic function symbols ( see Kapur-Narendran [10], p. 342 ), this also answers the question for term rewriting *Thisresearchwas donewhilethe authorwas stillat the IMMD 1, UniversityErlangen.

397

systems. But the examples - which were used to demonstrate this answer - were merely constructed for that purpose. In Section 4 we shall give countably many examples which are of some mathematical interest: All varieties of idempotent semigroups have a decidable word problem. But only three of them can be defined by a finite canonical term rewriting system. Using term rewriting systems for semigroup theories means that we work with terms and realize associativity by rules of the rewrite system. A more promising - and also more usual - approach would be to rewrite modulo associativity, i.e., to work with words instead of terms. In this case we talk about word rewriting systems ( please note that our word rewriting systems have nothing to do with semi-Thue systems, which are sometimes also called "word rewriting systems" ). But even for word rewriting systems, only nine varieties of idempotent semigroups can by defined by finite canonical systems. In Section 3 we shall consider term rewriting systems for semigroup theories and show that canonical term rewriting systems for regular semigroup theories are of a very specific form. This will be used in Section 4 to prove the above mentioned result about term rewriting systems for varieties of idempotent semigroups. Section 5 is devoted to word rewriting systems and clarifies the connection between finite canonical term and word rewriting systems. In Section 6 we shall state the results about word rewriting systems for varieties of idempotent semigroups. A proof of these results can be found in Baader [1], Chapter IV. It is rather involved and requires knowledge of Fennemore's solution of the word problem for varieties of idempotent semigroups ( Fennemore [4], see also Baader [1] Chapter III ).

2

Definitions and Notations

Let f2 be a signature, i.e., a set of function symbols with fixed arity, and let V be a countable set of variables. We denote the set of all f~-terms with variables in V by F(I2,V). This set is the carrier of the free f2-algebra with generators V, which will also be denoted by F(fLV). Any mapping of V into an f~-algebra A can be uniquely extended to a homomorphism of F(I2,V) into .~ We write homomorphisms in suffix notation, i.e., sO instead of 0(s). Consequently, composition is written from left to right, i.e., G0 means fn'st ~ and then 0. An endomorphism 0 of F(~,V) is called a substitu-

tion iff it has finite domain, where the domain of 0 is defined as D(0) := { x; x0 # x }.

398

Let s be a term. The set of all variables occurring in s is denoted by V(s). Let E be a set of identities ( equational theory ) and let ~

be the equality of terms,

induced by E. The theory E is called regular iff (1,r) ~ E implies V(1) = V(r). An equational theory E defines a variety ~ ] , i.e., the class of all algebras ( of the given signature f~ ) which satisfy each identity of E. The set of all subvarieties of a given variety ~ ] is a complete lattice w.r.t, set inclusion, which will be denoted by L([E]).

EXAMPLE 2.1. Consider f2 = { f } for a binary function symbol f. The variety of all

idempotent semigroups ( which are also called bands in the literature ) is defined by B := { f(f(x,y),z) = f(x,f(y,z)), f(x,x) = x }. Complete descriptions of the lattice L([B]) have been given by Birjukov [2], Gerhard [5], and Fennemore [4] ( see Figure 2.3 below, and Baader [1], Chapter III ). There are countably many varieties of bands. The varieties [TB], [RZ], [LZ], [RB] of all trivial, right zero, left zero, and rectangular bands are defined by non-regular theories, namely by TB = { x = y }, RZ = { f(f(x,y),z) = f(x,f(y,z)), f(x,y) = y }, LZ = { f(f(x,y),z) = f(x,f(y,z)), f(x,y) = x }, and RB = { f(f(x,y),z) = f(x,f(y,z)), f(x,f(y,x)) = x, f(x,x) = x }. The other varieties are defined by regular theories.

DEFINITION 2.2. An equational theory E is called semigroup theory iff the corresponding signature consists of only one binary function symbol, say f, and E implies associativity of f, i.e., f(f(x,y),z) =E f(x,f(y,z)) holds.

Please note that we do not allow constant symbols in the signature.

3 Term Rewriting Systems for Semigroup Theories Let R be a term rewriting system ( TRS ) and let -->R be the rewrite relation defined by R. The transitive closure of '->R is denoted by +-%R' and the reflexive, transitive closure is denoted by -'g R" Obviously, =R is the reflexive, transitive, and symmetric closure of "-->R"A term t is R-irreducible iff there does not exist a term s such that t ->R s. The system R is canonical iff -->R is both confluent and terminating. It is a term

399

The lattice of all varieties of bands

FIGURE 2.3.

fight semiregular

left

fight seminormal

left seminormal

left q

quasinormal

fight regular

left regular rectangular right normal

left

left zero

semilattice

trivial

right zero

400 rewriting system for the equational theory E iff =E = =R" A finite canonical TRS R for E can be used to decide the word problem for E as follows: for given terms s, t we reduce s to an R-irreducible term s' and t to an R-irreducible term t'. Then

s =E t iff

s' = t'. For a finite terminating TRS R, confluence can be decided by considering finitely many critical pairs. If R is not confluent we can try to find an equivalent confluent system with the help of the Knuth-Bendix algorithm ( Knuth-Bendix [11], Huet [7] ).

E X A M P L E 3.1. We consider the semigroup theories L Z o f all left zero bands, RB of all rectangular bands ( see Example 2,1 ), and LR = { f(f(x,y),z) = fix,fiy,z)), f(x,f(y,x)) = fix,y), fix,x) = x ], which is the theory of all left regular bands. If we orient the identities of LZ, RB, and LR from left to right, we obtain terminating TRSs R, S and T. The system R = { f(f(x,y),z) --) f(x,fiy,z)), fix,y) --) x } is confluent. The system S = { f(f(x,y),z) --~ f(x,f(y,z)), f(x,fiy,x)) ---) x, fix,x) ---) x } is not confluent since the critical pair between the first and the third rule is not confluent. If we apply the Knuth-Bendix algorithm to S, we obtain the finite canonical TRS { f(f(x,y),z) --~ fix,z), f(x,f(y,z)) --~ fix,z), fix,x) ~ x } for RB. The Knuth-Bendix algorithm does not terminate for T = { f(f(x,y),z) ~

f(x,f(y,z)),

f(x,f(y,x)) ---) f(x,y), fix,x) ---) x } since it computes infinitely many critical pairs of the form

or .

But it is easy to see that it generates the following infinite canonical TRS for LR: { f(f(x,y),z) --~ fix,fly,z)), fix,x) --~ x, fixl,f(x 2 ..... fiXn_l,fiXn,Xl))...)) ---) f(xl,f(x 2 ..... flXn_1 ,Xn)..-)), f(xl,f(x 2 ..... f(Xn_l,f(xl,Xn))..,)) ---) f(xl,f(x 2 ..... flXn_1 ,Xn)...)); n > 2 }.

Most implementations of the Knuth-Bendix algorithm yield reduced TRSs, i.e., TRSs R where the right hand side r of the rule 1 --) r ~ R is R-irreducible and the left hand side 1 is (R \ { 1 --) r })-irreducible. P R O P O S I T I O N 3.2. ( Metivier [12] ) (1) Let R and S be reduced canonical TRSs for E and assume that termination of R and S can be shown with the same termination ordering. Then R and S are equal up to

401

variable renaming. (2) Let R be a canonical TRS for E, and let S be defined as follows: S := { (l,r$); (1,r) e R, 1 is ( R \ {I --~ r})-irreducible a n d r $ is the unique R-irreducible element of the =E-Class of r

}

Then S is a reduced canonical TRS for E. The canonical TRSs for RB and LR of Example 3.1 are reduced. The system R = { f(f(x,y),z) ~

fix,fly,z)), fix,y) ~

x } is not reduced since the left hand side of

f(f(x,y),z) ~ f(x,f(y,z)) can be reduced by f(x,y) --~ x. Part (2) of Proposition 3.2 implies that { f(x,y) ~ x } is a reduced canonical TRS for LZ. Reduced canonical TRSs for regular semigroup theories are of a very specific form. L E M M A 3.3. Let R be a canonical TRS for the regular semigroup theory E. Then we have either f(x,fiy,z)) ~ R flf(x,y),z) oder f(fix,y),z) +-+--~Rf(x,fly,z))PROOF.

In this and in the following proofs we shall write --+ instead of ~R" From

f(x,(y,z)) =E f((x,y),z) we obtain that there exists a term t such that f(x,f(y,z)) -~ t ~*- f(f(x,y),z). If one of the -~-derivations is a 0-step derivation, then the lemma is proved. Otherwise, we have fix,fiy,z)) -% t ~+ f(fix,y),z). Since E is regular we know that V(t) = { x, y, z }. That means that f occurs at least twice in t, i.e., t = f(u,f(v,w)) or t = f(f(u,v),w) for terms u, v, w. Without loss o f generality we may assume that t = f(u,f(v,w)). The terms t, u, v, w do not contain other variables than x, y, z. Hence we can write t = t(x,y,z), u = u(x,y,z), v = v(x,y,z), w = w(x,y,z). W e define u 1 := u, v 1 := v, w 1 := w and - if u n, v n, w n are already def'med - Un+l:= U(Un,Vn,Wn), Vn+l := V(Un,Vn,Wn), Wn+l:= W(Un,Vn,Wn). Now the following is an infinite chain of reductions for R: f(x,f(y,z)) ~

t(x,y,z) = f(ul,f(vl,Wl)) ~

t(Ul,Vl,W 1) = f(u2,f(v2,w2)) ~

t(u2,v2,w 2) =

f(u3,fiv3,w3) ) --% ... --~ t(Un,Vn,Wn) = f(Un+l,f(Vn+l,Wn+ 1) --~ .... This contradicts the fact that R terminates. ~1

The canonical TRS { f(x,y) --~ x } for LZ shows that the condition "E regular" is necessary. According to Proposition 3.2, any canonical system R for E can be trans-

402

formed into a reduced canonical system S for E such that ISI _
L E M M A 3.4.

Let E, R satisfy the assumptions of L e m m a 3.3, and let R be reduced.

Then we have ( modulo renaming o f variables ) (f(x,f(y,z)),f(f(x,y),z)) ~ R u R -1. PROOF.

Without loss of generality we m a y assume that f(f(x,y),z) +-% f(x,f(y,z)).

We consider the first reduction step f(f(x,y),z) ~

t. N o w t is of the form t =

f(u,f(v,w)) for terms v, w and a variable u ~ { x, y, z }. Otherwise we would have t = f(f(u',v'),w') for terms u', v', w ' , which is in contradiction to the termination of R ( see the proof of L e m m a 3.3 ). Assume that the reduction f(f(x,y),z) ~

f(u,f(v,w)) is done with the rule 1 ~

r ~ R

and the substitution c. According to the chosen subterm in f(f(x,y),z) there are three possible cases: (1) l c = f(f(x,y),z), (2) l c = f(x,y), (3) 1~ ~ { x, y, z }. In the third case we have I = v for a variable v. That means that r = t(v) for a term t, which is in contradiction to the termination of R. In the second case, 1~ = f(x,y) and V(r~) = { x, y }. Hence rcr = f(s,t) for term s, t and thus r o is an instance of 1~ which is also in contradiction to the termination of R. In the first case there are ( modulo renaming of variables ) three subcases: (1.1) 1 = f(f(x,y),z),

(1.2) 1 = f(x,z),

(1.3) 1 = z.

The cases (1.2) and (1.3) contradict the termination of R. Hence we may ( modulo renaming of variables ) assume that f(f(x,y),z) ~

f(u,f(v,w)) is a rule of R. Since R is

reduced, the right hand side f(u,f(v,w)) is R-irreducible

and thus f(u,f(v,w))

--'b

f(x,f(y,z)) implies f(u,f(v,w)) = f(x,f(y,z)). O

Let R be a reduced system for the semigroup theory E such that the rule f(f(x,y),z) --~ f(x,f(y,z)) is an element of R. Then for any rule 1 --~ r ~ R \ { f(f(x,y),z) --~ f(x,f(y,z)) } we have that the terms 1, r are of the form f(xil,f(xi2,...f(xi,.1,xin)...)). W e call such a term right normalized. A TRS R for a semigroup theory is called right normalized iff it contains the rule f(f(x,y),z) ~ f(x,f(y,z)), and for any rule 1 --~ r ~ R \ { f(f(x,y),z) -+ f(x,f(y,z)) }, the terms 1, r are right normalized. We shall now consider termination of right normalized TRSs. For a term t ~ F({f},V), and a variable x ~ V(t), let Ittx be the number of occurrences of x in t. B y Itl we denote the number o f occurrences o f variables in t.

403

L E M M A 3.5. Let R be a right normalized, terminating TRS, and let s be a right normalized term. Then s +--")R t implies lsl > Itl. In particular, any rule 1--~ r e R \ { f(f(x,y),z) ---) f(x,f(y,z)) } satisfies III > Irl. PROOF. Let t' be the right normalized term which corresponds to t. We have s +--)R t "-~R t' and Itl = It'l. Let s = f(xil,f(xi2,...f(xin4,xin)...)) and t' = f(xjl,f(xj2,...f(Xjm4,Xj )...)), and let o be a substitution which substitutes all variables in V(s) u V(t') by a single variable x. Now n < m would imply that so is a subterm of t'tJ, which contradicts the termination of R. Hence n = Isl > m = It'l = Itl. For a rule 1 --~ r e R \ { f(f(x,y),z) --) f(x,f(y,z)) }, the term 1 is right normalized and 1

-~R r. ~1 A right normalized TRS R which satisfies the condition "111> Irl for all rules I ---) r e R \ { f(f(x,y),z) ~ f(x,f(y,z)) }" need not terminate. As an example, consider the system S = { f(f(x,y),z) ---) f(x,f(y,z)), f(y,f(y,x)) ---) f(x,x)}. We have f(z,f(z,f(z,z))) ' ) S f(f(z,z),f(z,z)) ~ S f(z,f(z,f(z,z))), which shows that S does not terminate. This example depends on the fact that x occurs only once on the left hand side of f(y,f(y,x)) --~ f(x,x, ) but twice on the right hand side. A rule 1 --~ r is called length reducing if it satisfies the property III > trl and illx > Irlx for all variables x occurring in 1. If 1 ---) r is length reducing then 11~1 > Ircl for all substitutions o. This shows P R O P O S I T I O N 3.6. Let R be a right normalized TRS such that all rules I --~ r e R \ { f(f(x,y),z) --~ f(x,f(y,z)) } are length reducing. Then R terminates. The assumption of the proposition is sufficient for termination of right normalized TRSs, but it is not necessary: E X A M P L E 3.7.

Consider the right normalized TRS R := { f(f(x,y),z) ---) f(x,f(y,z)),

f(y,f(x,z)) ---) f(x,x) }. The rule f(y,f(x,z)) ~ f(x,x) is not length reducing. The termination of R can be shown with the following polynomial interpretation ( which has been found by Frank Drewes from the University of Bremen ): the minimal value of the interpretation has to be > 3, and the polynomial x 2 + xy is associated to f(x,y).

404

4 Term Rewriting Systems for Varieties of Idempotent Semigroups We have already seen that { fix,y) ~ x } ( resp. { f(fix,y),z) --~ f(x,z), fix,fly,z)) --a fix,z), fix,x) --~ x } ) is a finite canonical TRS for L Z = { f(f(x,y),z) = f(x,f(y,z)), fix,y) = x } ( resp. RB = { f(f(x,y),z) = fix,fly,z)), f(x,f(y,x)) = x, f(x,x) = x } ). By symmetry we have that {f(x,y) --~ y } is a finite canonical TRS for RZ = { f(f(x,y),z) = fix,fly,z)), fix,y) -- y }, which is the theory of right zero bands. There does not exist a canonical TRS for TB = { x = y } - which is the theory of all trivial bands - since all rules 1 ~ r of a terminating TRS must satisfy V(r) ~ V(1). All the other theories which define varieties of bands are regular theories.

PROPOSITION 4.1. Let E be a regular semigroup theory which defines a variety of bands. Then there does not exist a finite canonical TRS for E. PROOF.

Assume that S is a canonical TRS for E. By Proposition 3.2, there exists a

reduced canonical TRS R for E which does not have more rules than S. Without loss of generality we may assume f(fix,y),z) --) fix,fiy,z)) ~ R ( Lemma 3.4 ). Now =B _c =E implies flx0,fix 1..... f(Xn,f(x0,fix 1..... flXn-l'Xn)'")))"')) =E flx0'fixl ..... f(Xn-l'Xn)'")) for all n > 0. Since E is regular, the term t := fix0,f(x 1..... f(Xn.l,Xn)...)) has minimal length in its =E-Class. Because t is also right normalized, Lemma 3.5 implies that t is R-irreducible. Hence f(x0,fix 1..... f(Xn't)"')) +---)R t. Assume that the first step in this derivation is done with the rule g --~ d and the substitution ~. Since t is R-irreducible we have g a = f(x i..... flXn,t)...) for some i, 0 < i < n. This implies that g is of the form g = f(zjl,flzj2,...f(Zjm_l,Zjm)...)) for variables Zjv. Since g can be reduced by R, the variables Zjv cannot be pairwise different. In addition, we have that IZja~l = lzj/cl . . . .

=

Izjmqerl = 1 because otherwise g~ would not be right normalized. For IZjm~l = 1 we have m = 2(n+l)-i > n. On the other hand, lzjmol > 1 implies: Zjm is different from zjl, zj2 ..... zjm_t, and there

405

exist v < g < m-1 such that Zjv = zig. The first n+l variables of g~ - namely xi, Xi+l, .., Xn, x 0 ..... xi_ 1 - are all different. This yields g > n+l. In any case we have Igl > n. This shows that R cannot be finite, which implies that S is also infinite. ~1

Thus we have shown our first main theorem

T H E O R E M 4.2. Let E be a semigroup theory which defines a variety of bands. There exists a finite canonical TRS for E if and only if E defines one of the varieties [LZ], [RZ], or [RB].

5 Word Rewriting Systems Let A := { f(f(x,y),z) ---) fix,fly,z)) } denote the theory of semigroups. The quotient algebra F({f},V)/= A is isomorphic to V +, i.e., the free semigroup with generators V. The elements of V + are words over the alphabet V, and the semigroup operation is the concatenation of words. If we omit the f's and the parentheses, then any semigroup theory can be regarded as a subset of V + x V +. Instead of TRSs, we can now consider word rewriting systems ( WRSs ) for E. A set R c V + x V + is called word rewriting system iff for all (1,r) ~ R we have V(r) K V(1) ( for a word w we denote by V(w) the set of all variables occurring in w ). The W R S R defines the following rewrite relation --)R on V+: ---)R := { (u(l~)v,u(r~)v); t ~ r ~ R, ~ is a substitution and u, v ~ V* } ( In this context substitutions are endomorphisms of V + such that { x ~ V; xG ~ x } is finite. V ' d e n o t e s the free monoid with generators V ). It is easy to see that { x 2 --~ x, xyx ---) xy } is a canonical WRS for LR = { x 2 = x, xyx = xy }. This shows that it m a y be advantageous to use WRSs instead of TRSs. A disadvantage of WRSs is the fact that, even for terminating systems, confluence can in general not be decided by considering only finitely many critical pairs. This is a consequence of the fact that A is of unification type "infinitary" ( see e.g. Plotkin [13] ).

406

But termination of WRSs is decidable. For a word w ~ V + and a variable x e V we denote by Iwl the length of w, and by lwl x the number of occurrences of x in w. A rute 1 --~ r of a W R S is called

length reducing iff

Ill > Id and Iltx > Irlx for all variables x oc-

curring in 1.

P R O P O S I T I O N 5.1. A WRS R terminates iff all rules of R are length reducing. PROOF.

I f all rules of R are length reducing, then u -%R v implies lul > Ivl, which

shows termination of R. Conversely, assume that the rule 1 ~ r e R is not length reducing. It is easy to see that there exists a substituition ¢r such that llcl < trcl and V(kr) = V(rcr) = { z }. But then l c is a subword of rcr which yields an infinite derivation.

As an immediate consequence of this proposition we have

C O R O L L A R Y 5.2.

Let R be a canonical W R S and let w E V + be a word. The =R"

class of w contains exactly one element u o f minimal length. The word u is the unique R-irreducible element in the =R-Class of w.

Before we can clarify the connection between confluence of WRSs and TRSs we need a technical l e m m a concerning abstract reduction properties ( see Huet [6] for notations ). Let -~1 u --~2 c T x T be a reduction on the set T, and let ~ be the reflexive, transitive, and symmetric closure of --~2" The relation ---~1 induces a reduction ~

on

the set o f all --classes T/_ = { T ; t e T } ( where ~ := { s; t ~ s } ): --,'~ :¢~ There exist s' E ~, t' e "t such that s' ---~1 t'.

L E M M A 5.3 If --~1 u -~2 is confluent on T, then -~ is confluent on T / . PROOF.

Let ~ 1 , 2 denote the reduction ~ 1 u ~ 2 " N ° W ' i l ~ "/2 implies t 1 ~ 1 , 2 t2"

Since -~1,2 is confluent, there exists t ~ T such that t I -'~1,2 t 4~--1,2 t 2.

The --~l-steps

407

of these derivations can be simulated by ---)-steps on the --classes. The --)2-steps can be omitted since they do not change the N-class. Hence we have't 1 --*-)'t~- "{2" Q

P R O P O S I T I O N 5.4. Let R = R 1 t_) R 2 be a confluent TRS for the semigroup theory E such that all rules 1 ---) r ~ R 1 satisfy 1 =A r. Then there exists a confluent WRS S for E with I R21 rules. If, in addition, all rules of R 2 are length reducing, then S is canonical. PROOF.

Without loss of generality we may assume that f(f(x,y),z) ---) f(x,f(y,z))

R 1. Otherwise we can insert this rule into R 1 without changing the generated congruence, or destroying the confluence property. W e want to apply L e m m a 5.3. To that purpose, we define T := T({f},V), ---~1 := ---)Rr and ---)2 := --)R2" Let ~

and - be de-

fined as in L e m m a 5.3. The l e m m a yields that --~ is confluent on T/N. Obviously, T/_ is isomorphic to V +. The system R 2 can be considered as W R S S which generates the reduction --). If the rules of R 2 are length reducing, then S is terminating by Proposition 5.1. Q

It is still open whether there exists a semigroup theory E which has a finite canonical TRS, but which does not have a finite canonical WRS. The problem is termination. If E has a finite canonical TRS, then it also has a finite canonical TRS which is reduced and thus right ( or left ) normalized. But the property "length reducing" - which is necessary for termination o f WRSs - is not necessary for termination of fight ( left ) normalized TRSs ( see Example 3.7 ). The TRS of Example 3.7 is not confluent. Thus it remains an open question whether there exists a semigroup theory which has a

re-

duced canonical TRS which is not length reducing.

E X A M P L E 5.5.

R = { f(f(x,y),z) ---) f(x,f(y,z)), fix,y) ~ x } is a canonical TRS for

L Z and S = { fff(x,y),z) --) f(x,f(y,z)), f(x,f(y,z)) -~ f(x,z), fix,x) ~ x } is a canonical TRS for RB. Proposition 5.4 implies that { xy --) x } is a canonical W R S for L Z and { x 2 ~ x, xyz ~ xz } is a canonical WRS for RB.

408

6 Word Rewriting Systems forVarieties of Idempotent Semigroups Siekmann and Szabo [15] showed that { x 2 ---) x } w { uvw ~

uw; V(v) ~ V(u) =

V(w) } is an infinite canonical W R S for B, the theory of idempotent semigroups. They conjectured that B does not have a finite canonical WRS. In Baader [1] it is shown that this conjecture is true for almost all varieties of idempotent semigroups. Another proof of the conjecture for B can be found in Schmidt-Schaul3 [14]. In this section we shall recall the results of Baader [1], Chapter IV. For the theories TB = { x = y }, LN = { x 2 -- x, xyz = xzy } ( left normal bands), RN = { x 2 = x, zyx = yzx } ( right normal bands), N = { x 2 = x, xyzx = xzyx } ( normal bands ) and R = { x 2 = x, xyxzx = xyzx } ( regular bands ) one can easily find equivalence classes with two different elements of minimal length. By Corollary 5.2 we thus get that these theories do not have finite canonical WRSs. The proofs for the other theories are rather involved. They require knowledge of Fenn e m o r e ' s solution of the word problem for varieties of idempotent semigroups ( Fennemore [4], see also Baader [1], Chapter III ).

T H E O R E M 6.1. Let E be a semigroup theory which defines a variety of bands. There exists a finite canonical WRS for E if and only if E defines one of the varieties [LZ], [RZ], [RB], [LR], [RR], [LQN], [RQN], [LSN] or [RSN]. More precisely: (1) The theory L Z = { xy = x } of all left zero bands has the canonical WRS { xy ---) x}. (2) The theory RZ = { xy = y } of all right zero bands has the canonical W R S { xy ---~y} (3) The theory RB = { xyx = x, x 2 = x } of all rectangular bands has the canonical WRS { x 2 ---) x, xyz " ' ) XZ }. (4) The theory L R = { xyx = xy, x 2 = x } of all left regular bands has the canonical W R S { x 2 ~ x, xyx ---~ xy }. (5) The theory RR = { xyx = yx, x 2 = x } of all right regular bands has the canonical WRS { x 2 --) x, xyx ~ yx }. (6) The theory L Q N = { xyxz = xyz, x 2 = x } of all left quasinormal bands has the canonical WRS { x 2 ---) x, xyxz ~ xyz }.

409

(7) The theory RQN = { zxyx = zyx, x 2 = x } of all fight quasinormal bands has the canonical WRS { x 2 ~ x, zxyx --~ zyx }. (8) The theory LSN = { xyz = xyzxz, x 2 = x } of all left seminormal bands has the canonical WRS { x 2 --~ x, xazbzx ~ xazbx, xzbzx --4 xzbx, zxbzx --~ zxbx, zbxzx --~ zbx, zbxazx ~ zbxax }. (9) The theory RSN = { zyx = zxzyx, x 2 = x } of all fight seminormal bands has the canonical WRS { x 2 ~ x, xzbzax ~ xbzax~ xzbzx ~ xbzx, xzbxz ~ xbxz, xzxbz xbz, xzaxbz ~ xaxbz }. (10) The other varieties of bands cannot be defined by a finite canonical WRS. PROOF.

See Baader [1], Chapter IV. The proof cannot be included in this paper due

to the space limitations. El

Acknowledgements I should like to thank Frank Drewes for the termination proof of Example 3.7.

References [1] Baader, F. Unifikation und Reduktionssysteme fiir Halbgruppenvarietaten. Ph.D. Dissertation. Arbeitsberichte des IMMD 22. Erlangen: Institut fiir Mathematische Maschinen und Datenverarbeitung, 1989. [2] Birjukov, A.P. Varieties of Idempotent Semigroups. Algebra i Logika 9, 1970. English translation in Algebra and Logic 9, 1970. [3] Book, R.V. A Note on Special Thue Systems With a Single Defining Relation.

Math. Systems Theory 16, 1983. [4] Fennemore, C.F. All Varieties of Bands I, II. Math. Nachr. 48, 1971. [5] Gerhard, J.A. The Lattice of Equational Classes of Idempotent Semigroups. J. Al-

gebra 15, 1970. [6] Huet, G. Confluent Reductions: Abstract Properties and Applications to Term Rewriting Systems. J. ACM 27, 1980. [7] Huet, G. A Complete Proof of the Correctness of the Knuth Bendix Completion Algorithm. J. Comp. Sys. Sci. 23, 1981.

410

[8] Jantzen, M. Semi Thue Systems and Generalized Church-Rosser Properties. Bericht Nr. 92, Fachbereich Informatik, Universit~it Hamburg, 1982. [9] Jantzen, M. A Note on a Special One-Rule Semi-Thue System. Information Pro[10] [11]

[12] [13] [14] [15]

cessing Letters 21, 1985. Kapur, D. and P. Narendran. A Finite Thue-System with Decidable Word Problem and without Equivalent Finite Canonical System. Theor. Comp. Sci. 35, 1985. Knuth, D.E. and P.B. Bendix. Simple Word Problems in Universal Algebra. In Leech, J. ( Ed. ). Computational Problems in Abstract Algebra. Pergamon Press, 1970. Metivier, Y. About the Rewriting Systems Produced by the Knuth-Bendix Completion Algorithm. Information Processing Letters 16, 1983. Plotkin, G. Building in Equational Theories. Machine Intelligence 7, 1972. Schmidt-SchauB, M. Unifikation Properties of Idempotent Semigroups. SEKI Technical Report, Universit~it Kaiserslautern, 1986. Siekmann, J. and P. Szab6. A Noetherian and Confluent Rewrite System for Idempotent Semigroups. Semigroup Forum 25, 1982.

Improving

associative Joachim

path

orderings"

Steinbach 2

Abstract The effective computation with term rewriting systems modulo a t h e o r y E p r e s u m e s E - t e r m i n a t i o n . W e w i l l g i v e a c l a s s i f i c a t i o n of t h e w e l l known methods guaranteeing AC-termination based on the recursive path ordering. Furthermore, we will show that these techniques [called associative p a t h o r d e r i n g s ~] c a n n o t u s e q u a s i - o r d e r i n g s o n o p e r a t o r s . A b o v e all, t h i s r e p o r t w i l l d e a l w i t h t w o n e w o r d e r i n g s a p p l i c a b l e to A C - t h e o r i e s . W e a p p l y t h e c o n c e p t of t h e a s s o c i a t i v e p a t h o r d e r i n g to t h e r e c u r s i v e p a t h o r d e r i n g w i t h s t a t u s [RPOS] a n d t h e i m p r o v e d r e c u r s i v e d e c o m p o s i t i o n o r d e r i n g w i t h s t a t u s [IRDS]. S i n c e t h e s e o r d e r i n g s a r e s t r o n g e r t h a n t h e r e c u r s i v e p a t h o r d e r i n g , t h e c o r r e s p o n d i n g o r d e r i n g s r e s t r i c t e d to A C - t h e o r i e s a r e m o r e p o w e r f u l t h a n t h e a s s o c i a t i v e p a t h o r d e r i n g . F r o m a p r a c t i c a l p o i n t of v i e w t h e a s s o c i a t i v e commutative IRDS is m o r e i n t e r e s t i n g than the associative path ordering b e c a u s e t h e d e t e c t i o n of a n a d m i s s i b l e p r e c e d e n c e for o r i e n t i n g t h e r u l e s of a g i v e n s y s t e m is e a s i e r .

1 Motivation T e r m r e w r i t i n g s y s t e m s a r e g a i n i n g m o r e a n d m o r e in i m p o r t a n c e because t h e y a r e a u s e f u l m o d e l for n o n - d e t e r m i n i s t i c computations: They are based o n d i r e c t e d e q u a t i o n s w i t h n o e x p l i c i t c o n t r o l . T h e b a s i c c o n c e p t of t e r m r e w r i t i n g s y s t e m s [[KB70]] is t h a t of r e d u c i n g a g i v e n t e r m to a s i m p l e r o n e . A n e q u a t i o n is c o n v e r t e d i n t o a d i r e c t e d r e w r i t e r u l e in s u c h a w a y t h a t t h e right-hand s i d e of t h e r u l e is s i m p l e r t h a n t h e l e f t - h a n d s i d e . In o r d e r to exclude infinite derivations of t e r m s a r e w r i t e system must terminate. 0 r d e r i n g s on t e r m s a r e a b l e to g u a r a n t e e t e r m i n a t i o n . A s u r v e y of t h e m o s t i m p o r t a n t o n e s is g i v e n in [De87]. T h e b a s i c i d e a of u s i n g a n o r d e r i n g > is t o v e r i f y t h a t t h e r e w r i t e r e l a t i o n ~ [ i n d u c e d b y t h e r u l e s y s t e m 9%] is i n c l u d e d in >. S u c h a n o r d e r i n g m u s t b e w e l l - f o u n d e d to a v o i d i n f i n i t e d e r i v a t i o n s of t e r m s . To c h e c k t h e i n c l u s i o n ' ~ c >' a l l [ i n f i n i t e l y m a n y ] p o s s i b l e d e r i v a t i o n s m u s t b e t e s t e d . The m a i n i d e a is t o r e s t r i c t t h i s i n f i n i t e t e s t to a f i n i t e o n e b y r e q u i r i n g a r e d u c t i o n ordering. A reduction o r d e r i n g is a w e l l - f o u n d e d ordering which has the replacement p r o p e r t y [ a l s o c a l l e d c o m p a t i b i l i t y w i t h t h e s t r u c t u r e of t e r m s ] w h i c h e n s u r e s t h a t a v a l u e of a t e r m w i l l b e d e c r e a s e d if a n y o n e of i t s s u b t e r m s is d e c r e a s e d . T h e n o t i o n of r e d u c t i o n o r d e r i n g s l e a d s t o t h e f o l l o w i n g d e s c r i p t i o n of t e r m i n a t i o n of r e w r i t e s y s t e m s [ d e v e l o p e d b y L a n k f o r d , s e e

[De87]]: 1 This research was supported by the Deutsche Forschungsgemeinschaft. S F B 314 2Universit~t Kaiserslautern, FB Informatik, Postfach 3049, D-6750 Kaiserslautern

412

A r e w r i t e s y s t e m if{ t e r m i n a t e s if a n d o n l y i f t h e r e e x i s t s a r e d u c t i o n o r d e r i n g > s u c h t h a t o[i] > air] for e a c h r u l e 1 -->~ r a n d for a n y g r o u n d s u b s t i t u t i o n cs. This t h e o r e m r e v e a l s a n o t h e r d i l e m m a w h i c h is k n o w n a s t h e u n i v e r s a l quantification on substitutions or t h e s o - c a l l e d s t a b i l i t y w.r.t, s u b s t i t u t i o n s : s > t i m p l i e s ~[s} > ~[tl, for a l l g r o u n d s u b s t i t u t i o n s 6. S u m m a r i z i n g , i t is t o r e m a r k t h a t a t e r m i n a t i o n p r o o f of a t e r m r e w r i t i n g s y s t e m r e q u i r e s a r e d u c t i o n o r d e r i n g s t a b i l i z e d w.r.t, s u b s t i t u t i o n s . In g e n e r a l , it is v e r y d i f f i c u l t t o g u a r a n t e e t h e w e l l - f o u n d e d n e s s of a r e d u c t i o n o r d e r i n g . This f a c t l e a d s to t h e b a s i c c o n c e p t of c h a r a c t e r i z i n g c l a s s e s of o r d e r i n g s for w h i c h t h e r e is no n e e d to p r o v e t h i s c o n d i t i o n . O n e p o s s i b l e s o l u t i o n is r e p r e s e n t e d b y t h e c l a s s of s i m p l i f i c a t i o n o r d e r i n g s w h i c h a r e a t l e a s t r e d u c t i o n orderings:

A n o r d e r i n g is a s i m p l i f i c a t i o n o r d e r i n g i f a n d o n l y if it h a s the replacement property, t h e s u b t e r m p r o p e r t y [ a n y t e r m is g r e a t e r t h a n a n y of i t s proper subterms] and t h e d e l e t i o n p r o p e r t y [ d e l e t i n g s u b t e r m s r e d u c e s t h e term]. Well-known simplification orderings are the recursive path orderings, various k i n d s of p a t h a n d d e c o m p o s i t i o n o r d e r i n g s a n d t h e K n u t h - B e n d i x orderings, for e x a m p l e . U n f o r t u n a t e l y , t h e t e r m i n a t i o n of a n a r b i t r a r y t e r m r e w r i t i n g s y s t e m is a n u n d e c i d a b l e p r o p e r t y , e v e n in t h e ) o n e - r u l e c a s e ' [[Da88]]. A n a d d i t i o n a l n e g a t i v e f a c t d e r i v e s f r o m t h e e x i s t e n c e of e q u a t i o n s of w h i c h t h e l e f t - h a n d s i d e a n d t h e r i g h t - h a n d s i d e a r e i n c o m p a r a b l e in a n y c a s e . F o r example, a rewriting system containing the commutativity a x i o m x*y = y+x as a r u l e is n o n - t e r m i n a t i n g , H o w e v e r , if t h e t e r m i n a t i o n p r o p e r t y is n o t s a t i s f i e d , t h e s e t of a x i o m s c a n b e s p l i t i n t o t w o p a r t s [[PS81], [ J K 8 6 ] ] : T h o s e axioms causing non-termination are used as equations E while the others are used as rewrite rules ~. The appropriate reduction relation allows reductions m o d u l o t h e e q u a t i o n s in E. T h e e f f e c t i v e c o m p u t a t i o n w i t h t h i s r e l a t i o n p r e s u m e s

a c o m p l e t e u n i f i c a t i o n a l g o r i t h m for t h e e q u a t i o n a l t h e o r y E, E - t e r m i n a t i o n , i.e. t h e r e is n o i n f i n i t e s e q u e n c e of t e r m s of t h e f o r m t I ~ ' E t~ ~ t2 = E t~2 ~9~¢ ....

W e n o w a d a p t t h e g e n e r a l r e s u l t s on t e r m i n a t i o n m e n t i o n e d a b o v e t o t h e c a s e of e q u a t i o n a l t e r m r e w r i t i n g s y s t e m s . A n e q u a t i o n a l t e r m r e w r i t i n g s y s t e m t e r m i n a t e s if t h e r e is a n o r d e r i n g > w h i c h c o n t a i n s t h e r e w r i t e r e l a t i o n ~ / E E° ~ o = E [ w h e r e o d e n o t e s c o m p o s i t i o n of r e l a t i o n s ] . T e s t i n g t h i s i n c l u s i o n r e q u i r e s a l l d e r i v a t i o n s of t h e f o r m s ~ / E t tO b e c h e c k e d . This requirement c a n b e r e f i n e d : If > is E - c o m p a t i b l e { [ P S 8 1 3 , s e e fig. 11, t h e n > contains ~IE if a n d o n l y if it c o n t a i n s ~ [cf. [BP85]I.

413

If a r e d u c t i o n o r d e r i n g > is E - c o m p a t i b l e a n d e[ll > e[rl, for e v e r y r u l e 1 -->;~ r a n d e v e r y g r o u n d s u b s t i t u t i o n e, t h e n t h e e q u a t i o n a l t e r m r e w r i t i n g s y s t e m ~/E terminates. Jouannaud and Munoz succeeded in w e a k e n i n g the E-compatibility for t h i s s t a t e m e n t [see [JM84]I. They introduced a property called E-commutation [ s e e fig. 1). S

~-'~"E

SI

>

t

S I ~'~>

~'-~'E t ~ i8 E - c o m p a t i b l e

S

>

>

t~

t

Figure 1

~E

S~

Sj ~>

~t ~

>

t

=E

t~

~ is E-commuting

T h e f o l l o w i n g t h e o r e m [of [ S t 8 9 b ] ] p o i n t s o u t t h e m a i n i m p o r t a n c e of t h e E-commutation for t h e E - t e r m i n a t i o n p r o b l e m . T h e t h e o r e m is a m o d i f i c a t i o n of a r e s u l t c o n t a i n e d in [ J M 8 4 1 A rewrite system ~ is E-terminating i f t h e r e e x i s t s an E-commuting s i m p l i f i c a t i o n o r d e r i n g > s u c h t h a t ~[1] > ~[r] f o r e a c h r u l e 1 --~¢ r a n d f o r a n y g r o u n d s u b s t i t u t i o n o. Obviously, E-termination strongly depends For example, E must satisfy the following i n f i n i t e d e r i v a t i o n s I s e e [ J M 8 4 ] I : F i r s t of v a r i a b l e s of b o t h t e r m s m u s t b e i d e n t i c a l . b e s a t i s f i e d if t h e r e is a n e q u a t i o n of t h e t h a n o n e o c c u r r e n c e in t.

o n t h e g i v e n u n d e r l y i n g t h e o r y E. t w o c o n d i t i o n s in o r d e r t o p r e v e n t all, if s = t E E, t h e n t h e s e t of Furthermore, E-termination cannot form t =E x such that x has more

W e a r e g o i n g t o d e a l w i t h a s p e c i a l t h e o r y E: a s s o c i a t i v e - c o m m u t a t i v e a x i o m s . A n e q u a t i o n a l t h e o r y E is c a l l e d a n a s s o c i a t i v e - c o m m u t a t i v e theory if e v e r y e q u a t i o n in E is e i t h e r a n a s s o c i a t i v e [ f [ x , f [ y , z l ) = f [ f [ x , y l , z ) , f E ~ A 1 or c o m m u t a t i v e [ f [ x , y l = f l y , x ) , f E ~ c ) a x i o m . In o r d e r t o d e s c r i b e t h e f a c t t h a t f is b o t h a s s o c i a t i v e a n d c o m m u t a t i v e w e u s e 'f c ~ A C ' A n e q u a t i o n a l term rewriting system [~,El will be an associative-commutative term r e w r i t i n g s y s t e m if E is a n a s s o c i a t i v e - c o m m u t a t i v e theory. T h e r e o n l y e x i s t a f e w o r d e r i n g s for t h i s k i n d of r e w r i t i n g s y s t e m s , e.g. t h e a s s o c i a t i v e p a t h o r d e r i n g s [EGL86], [BP85], [ D H J P 8 3 ] I , t h e o r d e r i n g s o n s p e c i a l polynomial interpretations [EBL87], ESZ90]I a n d t h e a s s o c i a t i v e - c o m m u t a t i v e Knuth-Bendix orderings [[St89b]l. Associative path orderings extend the r e c u r s i v e p a t h o r d e r i n g s to A C - c o n g r u e n c e c l a s s e s . T h e y a r e b a s e d on f l a t t e n i n g a n d t r a n s f o r m i n g t h e t e r m s b y a r e w r i t i n g s y s t e m w i t h r u l e s s i m i l a r to t h e distributivity [or t h e e n d o m o r p h i s m l a x i o m s . H e r e , w e s u p p l y a c o n c e p t w h i c h e x t e n d s t h e a s s o c i a t i v e p a t h o r d e r i n g in t w o w a y s . F i r s t of alt, a p r o o f w i l l b e g i v e n t o j u s t i f y t h e u s e of s t a t u s in t h e d e f i n i t i o n of t h e a s s o c i a t i v e p a t h o r d e r i n g s I t h e u s e of s t a t u s is a n e x t e n s i o n to t h e c o n c e p t s of [GL863, [BP85] a n d EDHJP83]I. F u r t h e r m o r e , w e h a v e s u c c e e d e d in a p p l y i n g t h e c o n c e p t s of t h e a s s o c i a t i v e p a t h o r d e r i n g s to

414

t h e i m p r o v e d r e c u r s i v e d e c o m p o s i t i o n o r d e r i n g [[Ru87], [St89a]]. T h u s , t h e results presented h e r e e x t e n d t h o s e of [ S t 8 9 a ] to A C - t h e o r i e s . A n o t h e r a d v a n t a g e of t h i s A C - d e c o m p o s i t i o n o r d e r i n g is t h a t t h e p r e c e d e n c e c a n o f t e n b e d e r i v e d f r o m t h e s t r u c t u r e of t h e r e d u c t i o n r u l e s i n a n e a s i e r w a y t h a n with the associative path ordering. After giving some indispensable definitions in the next chapter, the classical t e r m o r d e r i n g s [ s e e [St89a]] w i l l b r i e f l y b e p r e s e n t e d . In c h a p t e r 4, w e r e c a p i t u l a t e , c l a s s i f y a n d e x t e n d [ b y i n c o r p o r a t i n g s t a t u s ] t h e c o n c e p t of t h e r e s t r i c t i o n to A C - t h e o r i e s c o n t a i n e d i n [BP85] a n d [GL86]. M o r e o v e r , i t w i l l b e s h o w n t h a t t h e s e t e c h n i q u e s c a n n o t u s e q u a s i - o r d e r i n g s o n t h e s e t of f u n c t i o n s y m b o l s . S u b s e q u e n t l y , t h e a p p l i c a t i o n of t h i s a p p r o a c h to t h e d e f i n i t i o n of o n e of t h e m o s t p o w e r f u l p a t h a n d d e c o m p o s i t i o n o r d e r i n g s a s w e l l a s t h e a p p r o p r i a t e l e m m a s a n d s o m e e x a m p l e s w i l l b e g i v e n . The c o r r e s p o n d i n g p r o o f s of t h e l e m m a s a r e g i v e n i n [St89c].

2 Notation A t e r m r e w r i t i n g s y s t e m ~R o v e r a s e t of t e r m s F is a f i n i t e or c o u n t a b l y i n f i n i t e s e t of r u l e s , e a c h of t h e f o r m 1 - - ~ r , w h e r e 1 a n d r a r e t e r m s i n F, s u c h t h a t e v e r y v a r i a b l e t h a t o c c u r s i n r a l s o o c c u r s i n I. The s e t F of all t e r m s is c o n s t r u c t e d from e l e m e n t s of a s e t ~ of o p e r a t o r s [or f u n c t i o n s y m b o l s ] a n d s o m e d e n u m e r a b l y i n f i n i t e s e t ~ of v a r i a b l e s . T h e s e t of g r o u n d t e r m s [ t e r m s w i t h o u t v a r i a b l e s ] is d e n o t e d b y Fo The l e a d i n g f u n c t i o n s y m b o l a n d t h e t u p l e of t h e [ d i r e c t ] a r g u m e n t s of a t e r m t a r e r e f e r r e d to b y top[t] a n d args[t], r e s p e c t i v e l y . A s u b s t i t u t i o n d is d e f i n e d as a n e n d o m o r p h i s m o n F w i t h t h e f i n i t e d o m a i n {x i~[x] $ x}. W e u s e t h e f o r m a l i s m of p o s i t i o n s of t e r m s w h i c h a r e s e q u e n c e s of n o n - n e g a t i v e i n t e g e r s . The s e t of all p o s i t i o n s of a t e r m t is c a l l e d t h e s e t of o c c u r r e n c e s a n d i t s a b b r e v i a t i o n is OIt]. A t e r m i n a l o c c u r r e n c e is a n o c c u r r e n c e of a leaf of a t e r m . W e w r i t e t / u to d e n o t e t h e s u b t e r m of t a t o c c u r r e n c e u E O[t]. A [ p a r t i a l ] o r d e r i n g o n FO is a t r a n s i t i v e a n d i r r e f l e x i v e b i n a r y r e l a t i o n >. It is c a l l e d w e l l - f o u n d e d if t h e r e a r e n o i n f i n i t e d e s c e n d i n g c h a i n s . M o s t of t h e o r d e r i n g s on t e r m s are p r e c e d e n c e o r d e r i n g s u s i n g a s p e c i a l o r d e r i n g on o p e r a t o r s . M o r e p r e c i s e l y , a p r e c e d e n c e is a p a r t i a l l y [or q u a s i - ] o r d e r e d s e t [~ , ~] c o n s i s t i n g of t h e s e t ~ of o p e r a t o r s a n d a n i r r e f l e x i v e [or r e f l e x i v e ] a n d t r a n s i t i v e b i n a r y r e l a t i o n ~ d e f i n e d o n e l e m e n t s of ~. O b v i o u s l y , a q u a s i - o r d e r i n g d e f i n e s a n e q u i v a l e n c e r e l a t i o n -- as b o t h E a n d ~_ [~_ n ~_], a n d a p a r t i a l o r d e r i n g ~ as E b u t n o t 4 [ E \ ~_]N o t e t h a t a t e r m o r d e r i n g ~ is u s e d to c o m p a r e t e r m s . S i n c e o p e r a t o r s h a v e t e r m s as a r g u m e n t s w e d e f i n e a n e x t e n s i o n of 7, c a l l e d l e x i c o g r a p h i c a l l y g r e a t e r [~lex], o n t u p l e s of t e r m s as f o l l o w s : [sl,s 2 ..... Sm} ~.lex [ t l , t 2 ..... t n ] if e i t h e r [m > 0 ^ n = 0 ] or [s i ~ t 1] or Is I = t 1 ^ Is 2 ..... Srn] ~lex It 2 ..... t n ] ] '

415

If t h e r e i s n o o r d e r of s u c c e s s i o n a m o n g t h e t e r m s of s u c h t u p l e s , t h e s e structures are called multisets. Multisets differ from sets by allowing multiple o c c u r r e n c e s of i d e n t i c a l e l e m e n t s . T h e m u l t i s e t d i f f e r e n c e is r e p r e s e n t e d b y \. T h e e x t e n s i o n of ~ o n m u l t i s e t s of t e r m s is d e f i n e d a s f o l l o w s . A m u l t i s e t S is g r e a t e r t h a n a m u l t i s e t T, d e n o t e d b y S ~ T i f f S ~ T ^ [Vt 6 T\SI [3s 6 S\TI s ~ t. To c o m b i n e t h e s e t w o c o n c e p t s of t u p l e s a n d m u l t i s e t s , w e a s s i g n a s t a t u s z[fl to each operator f 6 ~ that determines the order according to which the s u b t e r m s of f a r e c o m p a r e d . F o r m a l l y , a s t a t u s is a f u n c t i o n w h i c h m a p s t h e s e t of o p e r a t o r s i n t o t h e s e t { m u l t , l e f t , r i g h t } . Thus, a f u n c t i o n s y m b o l c a n h a v e o n e of t h e f o l l o w i n g t h r e e t y p e s of s t a t u s : m u l t [ t h e a r g u m e n t s will b e c o m p a r e d a s m u l t i s e t s ] , l e f t [ l e x i c o g r a p h i c a l c o m p a r i s o n f r o m l e f t to r i g h t ] a n d r i g h t [ t h e a r g u m e n t s w i l l l e x i c o g r a p h i c a l l y b e c o m p a r e d f r o m r i g h t to left]. T h e r e s u l t of a n a p p l i c a t i o n of t h e f u n c t i o n a r g s to a t e r m t = f[t I ..... tn] d e p e n d s o n t h e s t a t u s of f : If z[f] = m u l t , t h e n a r g s [ t ] is t h e m u l t i s e t {t 1..... t n} a n d o t h e r w i s e , a r g s [ t l l e a d s to t h e t u p l e It 1..... tn]. In t h e r e m a i n i n g p a r t s of t h i s r e p o r t , b y w r i t i n g s, t a n d ~ w e w i l l a l w a y s a s s u m e t h a t s a n d t a r e t e r m s o v e r F a n d ~ is a [ p a r t i a l or q u a s i - ] p r e c e d e n c e o n t h e s e t ~ of o p e r a t o r s . M o r e o v e r , w e s y n o n y m o u s l y use >ord with ord to d e n o t e a n o r d e r i n g . T h e i n d e x ~[f] of > o r d , z [ f ] m a r k s t h e e x t e n s i o n of >ord w.r.tt h e s t a t u s of t h e o p e r a t o r f: Is 1 . . . . . s m l > o r d , z [ f ] It1 . . . . . t n ] iff z[f] = m u l t ^ > {s~ . . . . . sin} >~ord {tl . . . . . t n} or z[f] = l e f t ^ Is I . . . . . Srn I ol er dx [tl ' ... , t n ] o r z[f] = r i g h t ^ [Srn . . . . . s 1] > loe xr d It n ' ... ' tl]. Permitting additional

v a r i a b l e s , w e h a v e to c o n s i d e r e a c h a n d e v e r y o n e of t h e m a s a n c o n s t a n t s y m b o l i n c o m p a r a b l e [w.r.t. ~] to a l l o t h e r o p e r a t o r s in 6.

3 Term

orderings

T h e m a i n p o i n t of t h i s c h a p t e r is a b r i e f d e s c r i p t i o n of t h e r e c u r s i v e p a t h ordering with status and the improved recursive decomposition ordering with s t a t u s . T h e m e t h o d of c o m p a r i n g t w o t e r m s w.r.t, t h e r e c u r s i v e p a t h o r d e r i n g w i t h s t a t u s [RPOS, for s h o r t ] d e p e n d s on t h e l e a d i n g f u n c t i o n s y m b o l s . T h e r e l a t i o n s h i p b e t w e e n t h e s e o p e r a t o r s w.r.t. ~ a n d t h e s t a t u s z is r e s p o n s i b l e for d e c r e a s i n g o n e [or b o t h ] t e r m [ s ] i n t h e r e c u r s i v e d e f i n i t i o n of t h e RPOS. If o n e of t h e t e r m s is ' e m p t y ' [i.e. t o t a l l y d e c r e a s e d ] t h e n t h e o t h e r o n e i s g r e a t e r . D e f i n i t i o n s iff

3.1

[ R P O S , [ K L S 0 ] & [De87]]

>RPOS i] ii]

t top[sl ~ t0p[t] topis] = t0p[t]

^ ^

{S} ~RPOS a r g s [ t l z[top[s]] = mult

A

a r g s [ s l **RPOS a r g s [ t ]

iii]

topis] = t0p[t]

^

z[top[s]] ~ mult

^

{s} *~RPOS a r g s [ t ]

iv]

^ args[s] >RPOS,z[top[s]] args[t] a r g s [ s ] Z R P O S {t}

416 R e m a r k

3.2

W e w o u l d l i k e t o p o i n t o u t t h a t t h e r e e x i s t t w o d i f f e r e n t v e r s i o n s of t h e RPOS in the publications: a somehow non-deterministic one [see definition 3.1] a n d a d e t e r m i n i s t i c o n e [if t h e f o u r t h c o n d i t i o n [iv] is r e p l a c e d by ~ [ t o p [ s ] ~_ t o p [ t ] ] ^ a r g s [ s ] ~ R P o s {t}]. N o t e t h a t t h e d e t e r m i n i s t i c version is n o t a s i m p l i f i c a t i o n o r d e r i n g , in g e n e r a l , s i n c e [ x * y ] ~ z S R P O S x * y if z[~)=right. • The improved recursive decomposition o r d e r i n g [IRDS, for s h o r t ] h a s b e e n developed by Rusinowitch [ERu87]]. H e h a s a l s o i n c o r p o r a t e d s t a t u s i n it. H o w e v e r , w e p r e s e n t a n o t h e r [ s i m p l e r ] v e r s i o n [of [ S t 8 9 a ] ] w h i c h is s i m i l a r t o it, T h e p o w e r of t h e s e t w o o r d e r i n g s o v e r l a p w i t h e a c h o t h e r . To d e f i n e t h e o r d e r i n g of [ S t 8 9 a ] , w e n e e d s o m e k i n d of f o r m a l i s m .

3.3

D e f i n i t i o n

[Decomposition]

" Path-decomposition of a t e r m f i t 1..... t n ] : d e c i . u [ f [ t l ..... t n ] ] = {fit I ..... tn]} u d e c u [ t i ]

with

deceit]

• Decomposition of a s e t {t I ..... t n} of t e r m s : d e c [ { t I ..... tn}] = { d e c u [ t i ] I i c [1,n], u is a t e r m i n a l " S e t of p r o p e r s u b t e r m s of a p a t h - d e c o m p o s i t i o n s u b [ P , t] : { s 6 P I [Bu¢~] t / u = s }

P

= {t}

occurrence

w,r.t, a t e r m

of t i } t: •

O n e of t h e i m p o r t a n t d i f f e r e n c e s b e t w e e n t h e i m p r o v e d r e c u r s i v e d e c o m p o s i t i o n ordering and the recursive p a t h o r d e r i n g is t h e f a c t t h a t t h e I R D S s t o p s a comparison a s s o o n a s it h a s t o c o m p a r e i n c o m p a r a b l e o p e r a t o r s . A t e r m s is g r e a t e r t h a n a t e r m t [w.r.t. t h e IRDS] if t h e d e c o m p o s i t i o n of s is g r e a t e r t h a n the decomposition of t. T h e o r d e r i n g o n t h e s e m u l t i s e t s [ , ~ D ] is a n e x t e n s i o n of t h e b a s i c o r d e r i n g o n t e r m s [>D' D s t a n d s for d e c o m p o s i t i o n ] to multisets of m u l t i s e t s .

3.4

D e f i n i t i o n s >IRDS t iff w i t h >D d e f i n e d

dec[{s}] as:

[IRDS, [St89a]] * *~D d e c [ { t } ]

d e c u [ S ' ] ~ s >D t £ d e c v [ t ' ] iff i] t o p [ s ] ~ t o p [ t ] ii] t o p [ s ]

-- t o p [ t ]

^ z[top[s]] = mult

^ sub[decu[S']'s]

~D s u b [ d e c v [ t ' ] . t ]

i i i ] t o p [ s ] -- t o p [ t ] ^ dec[args[s]]

^ z[top[s]] = mult ,~D dec[args[t]]

^ sub[decu[S'],s]

= sub[decv[t'],t

iv] t o p [ s ]

^ z[top[s]]

^ {s} ~ I R D S a r g s [ t ]

^

-- t o p [ t ]

args[s]

>IRDS,z[top[.]]

¢ mult

]

args[t]

N o t e t h a t b o t h o r d e r i n g s [ t h e R P O S a s w e l l a s t h e IRDS1 u n i q u e l y define a congruence ~ dependent o n ~ a n d z v i a : f[s 1..... s m] ~ g [ t 1..... t n] iff f -- g ^ m -- n ^ i] z[f} = m u l t ^ [3rc][Vi] s i ~ t~[i} or ii] z[f] ¢ m u l t ^ [Vii s i ~ t i.

417

4 An

improved

concept,

of the

APO

T e r m i n a t i o n o r d e r i n g s b a s e d on t r a n s f o r m a t i o n t e c h n i q u e s h a v e b e e n first p r o p o s e d in [ D H J P 8 3 I This m e t h o d is r a t h e r c o m p l e x a n d it w a s n o t p o s s i b l e to lift t h e c o r r e s p o n d i n g o r d e r i n g to t e r m s c o n t a i n i n g v a r i a b l e s . The a s s o c i a t i v e p a t h o r d e r i n g [APO, for s h o r t ] o f [BP85] is s i m i l a r to t h i s o r d e r i n g . H o w e v e r , t h e A P O is c o n c e p t u a l l y s i m p l e r s i n c e a n y t e r m is t r a n s f o r m e d i n t o a s i n g l e t e r m w h e r e a s in [ D H J P 8 3 ] t h e t r a n s f o r m a t i o n of a t e r m l e a d s to a m u l t i s e t of t e r m s . The s t a b i l i t y w.r.t, s u b s t i t u t i o n s c a n b e g u a r a n t e e d b y c h e c k i n g ~ a f i n i t e n u m b e r of t h e p o t e n t i a l l y [ i n f i n i t e l y m a n y ] g r o u n d substitutions. In [GL86], G n a e d i g a n d L e s c a n n e s i m p l i f y t h e A P O to t h e s o - c a l l e d NFLO. The NFLO g e n e r a l i z e s t h e r e c u r s i v e p a t h o r d e r i n g a n d t h e t r a n s f o r m a t i o n c a n be d e s c r i b e d b y a r e d u c t i o n r e l a t i o n , In c o n t r a s t to t h e APO, t h i s o r d e r i n g m a k e s a strong difference between the flattening and the distributing [applying d i s t r i b u t i v i t y a x i o m s ] p r o c e s s e s . F i r s t of all, d i s t r i b u t i v i t y r u l e s m a p t h e t e r m s to b e c o m p a r e d in t h e s a m e c l a s s m o d u l o d i s t r i b u t i v i t y , in o r d e r to i n s u r e t h e r e p l a c e m e n t p r o p e r t y . Then, for s a t i s f y i n g A C - c o m m u t a t i o n , t h e s e t e r m s w i l l b e f l a t t e n e d a l o n g i t s A C - o p e r a t o r s [to r e p r e s e n t t h e a s s o c i a t i v i t y a x i o m s ] a n d c o m p a r e d w.r.t, t h e r e c u r s i v e p a t h o r d e r i n g w i t h o u t s t a t u s [to r e p r e s e n t the commutativity axioms]. Besides the simplicity, Gnaedig and Lescanne g a v e a proof for t h e u n i v e r s a l q u a n t i f i c a t i o n on s u b s t i t u t i o n s b a s e d on s i m p l e o b s e r v a t i o n s on t h e s u b s t i t u t i o n m e c h a n i s m . O b v i o u s l y , from a p r a c t i c a l p o i n t of v i e w , t h i s m e t h o d is m o r e i n t e r e s t i n g t h a n t h a t of B a c h m a i r a n d P l a i s t e d . H o w e v e r , t h e r o o t of t h e NFLO is t h e APO, a n d t h e r e f o r e , in t h e r e m a i n i n g p a r t s of t h i s p a p e r , w e w i l l r e f e r to t h i s o r d e r i n g b y ' a s s o c i a t i v e p a t h o r d e r i n g L In t h i s c h a p t e r w e t r y to g i v e a m o t i v a t i o n for t h e u s e of G n a e d i g ' s a n d L e s c a n n e ' s a p p r o a c h . T h e y h a v e p r e s e n t e d t h e i r m e t h o d for A C - t h e o r i e s , only. F i r s t of all, w e w i l l s p l i t AC i n t o t h e c o n c e p t s of C- a n d A - t h e o r i e s , In p r a c t i c e , t h i s w i l l b e a n e n h a n c e m e n t of t h e e f f i c i e n c y if e i t h e r C - t h e o r i e s or A - t h e o r i e s a r e u s e d . The r e a s o n .is t h a t t h e c o n d i t i o n s r e q u i r e d of t h e RPO a r e n o t as s t r i c t a s t h o s e for t h e c o m b i n e d t h e o r i e s . S u b s e q u e n t l y , t h e p o w e r of t h e v a r i o u s m e t h o d s w i l l b e c o m p a r e d . A n o t h e r m a i n p o i n t of t h i s c h a p t e r is t h e i n t r o d u c t i o n of an i m p r o v e m e n t of t h e APO. The e x t e n s i o n w e d e a l w i t h c o n s i s t s of t h e i n c o r p o r a t i o n of s t a t u s to t h e RPO. It w i l l b e s h o w n t h a t t h e c o n c e p t s of t h e A P O [ b a s e d on t h e RPO] c a n b e t r a n s f e r r e d to t h e RPOS b y g u a r a n t e e i n g m u l t i s e t s t a t u s of a s s o c i a t i v e and commutative operators. L a s t b u t n o t l e a s t , w e s h o w t h a t p a r t i a l [ i n s t e a d of q u a s i - I p r e c e d e n c e s a r e n e c e s s a r y to g u a r a n t e e t h e s t a b i l i t y w.r.t, s u b s t i t u t i o n s of t h e t e c h n i q u e s p r e s e n t e d in t h i s c h a p t e r . It is s t r a i g h t f o r w a r d to s e e t h a t t h e RPOS is C - c o m p a t i b l e if e a c h c o m m u t a t i v e f u n c t i o n s y m b o l h a s m u l t i s e t s t a t u s . T h e r e f o r e , l e t s >c t iff s >RPOS t w i t h z[f] = m u l t if f 6 ~ c

418

In o r d e r to r e s t r i c t t h e RPOS so t h a t it c a n p r o v e t h e A - t e r m i n a t i o n of t e r m r e w r i t i n g s y s t e m s w e p u r s u e t h e f o l l o w i n g s t r a t e g y : [i] E s t a b l i s h i n g e x a c t l y o n e r e p r e s e n t a t i v e of e a c h A - e q u i v a l e n c e c l a s s , [ii] R e d u c i n g e a c h t e r m to the representative of its A - e q u i v a l e n c e c l a s s a n d [iii] C o m p a r i n g the r e p r e s e n t a t i v e s w.r,t, t h e RPOS. O b v i o u s l y , t h e m a i n p r o b l e m of t h i s m e t h o d is t h e d e f i n i t i o n of t h e r e p r e s e n t a t i v e s . U s u a l l y , t e r m s w i t h A - o p e r a t o r s a r e d e s c r i b e d b y f l a t t e n e d t e r m s h a v i n g no n e s t e d o c c u r r e n c e s of i d e n t i c a l a s s o c i a t i v e o p e r a t o r s , e.g. *[+[1,*[2,+[1,3]]],2] = +[1,2,1,3,2]. This r e p r e s e n t a t i o n r e q u i r e s t h e o p e r a t o r s to h a v e v a r i a b l e a r i t y , i.e, a s s o c i a t i v e f u n c t i o n s y m b o l s m a y p o s s e s s a n y p o s i t i v e n u m b e r [> 1] of a r g u m e n t s , w h e r e a s n o n - a s s o c i a t i v e o p e r a t o r s h a v e f i x e d a r i t y . B a s e d on t h i s b a c k g r o u n d , t h e f l a t t e n i n g o p e r a t i o n -is d e f i n e d as f o l l o w s : Definition

4.1

[Flattening

operation,

[BP85]]

Let t = f[t 1..... t n] b e a t e r m . Then, t

t

if t is a c o n s t a n t

or a v a r i a b l e

t' otherwise w i t h t ~ r e s u l t s f r o m t b y r e p l a c i n g t i b y Ti a n d r e p l a c i n g t i b y s 1..... s m if ~ = f[s 1..... Sm].

if

top[t i]¢

f,

In o r d e r to c o m p a r e t e r m s [w.r.t. t h e R P O S ] w i t h o p e r a t o r s h a v i n g v a r i a b l e a r i t y , w e do n o t n e e d to c h a n g e t h e d e f i n i t i o n of t h e RPOS. H o w e v e r , t h e d e l e t i o n p r o p e r t y [ f[..,t,...] > f[ ....... ] ) m u s t be s a t i s f i e d to p r e s e r v e t h e p r o p e r t y of b e i n g a s i m p l i f i c a t i o n o r d e r i n g , The r e c u r s i v e p a t h o r d e r i n g w i t h o u t s t a t u s d o e s h a v e t h e d e l e t i o n p r o p e r t y . Thus, in o r d e r to g u a r a n t e e t h i s p r o p e r t y , t h e s t a t u s f u n c t i o n of t h e RPOS m u s t s a t i s f y t h e m u l t i s e t s t a t u s of e a c h v a r y a d i c f u n c t i o n s y m b o l . C o n s e q u e n t l y , e a c h A - o p e r a t o r h a s to h a v e m u l t i s e t s t a t u s . Now, an A - c o m p a t i b l e o r d e r i n g c o u l d b e d e f i n e d as s >A t iff S >RPOS ~ U n f o r t u n a t e l y , >A d o e s n o t h a v e t h e r e p l a c e m e n t p r o p e r t y : Let f E ~A a n d f ~ g. Then, f[a,b) > R P o s g [ a , b ] b u t f[f[a,b],c] = f[a,b,c]
4.2

[w.r.t. ~] A - o p e r a t o r s ,

[Associative

the

precedence

must

p a i r c o n d i t i o n , [BP85]]

A precedence ~ has the associative pair condition • f is m i n i m a l or [3g E ~ A ] f is m i n i m a l w.r.t. ~ \ { g } .

if a n d o n l y if [Vf E ~A]

For g u a r a n t e e i n g t h e r e p l a c e m e n t p r o p e r t y , w e h a v e to r e d u c e b e c o m p a r e d in t h e f o l l o w i n g w a y :

• the terms

to

419

D e f i n i t i o n

4.3

[Distributivity

operation,

[GL86]]

Let ~ be a precedence satisfying f ~ g where f and g are associative o p e r a t o r s . T h e d i s t r i b u t i v i t y o p e r a t i o n 8 : F --> F r e w r i t e s a t e r m to a n irreducible form with the system described by the two rules D:

f[x,g[y,z]]

--> g [ f [ x , y ] , f [ x , z ] ]

f[g[x,y],z]

--~ g[f[x,z],f[y,z]]

•

N o t e t h a t t w o f l a t t e n e d ~ - n o r m a l f o r m s of t e r m s a r e C - e q u i v a l e n t . D u e t o t h e C - c o m p a t i b i l i t y of t h e R P O S it is p o s s i b l e to d e f i n e a n A - c o m p a t i b l e o r d e r i n g : s ~ , D t i f f 8Is] >RPOS ~[t] r e q u i r i n g t h e p r e c e d e n c e to h a v e t h e a s s o c i a t i v e p a i r c o n d i t i o n a n d z[f]=mult if f c ~ A

T h e g e n e r a l i z a t i o n ~ D of ~ a d m i t s p r e c e d e n c e s w h e r e a n A - o p e r a t o r is g r e a t e r t h a n a n o t h e r A - o p e r a t o r . H o w e v e r , t h e r u l e f[x]~f[y] --> f[x~y] c a n n o t b e o r i e n t e d w i t h t h e h e l p of ~ D b e c a u s e t h e A - o p e r a t o r * m u s t b e g r e a t e r t h a n f w h i c h is n o t a s s o c i a t i v e . A s o l u t i o n for t h i s p r o b l e m c o n s i s t s of a p p l y i n g t h e b a s i c c o n c e p t of t h e f o r m e r a p p r o a c h : I n s t e a d of u s i n g d i s t r i b u t i v i t y axioms we take rules similar to the endomorphism for p r e - r e d u c i n g t e r m s . In o r d e r t o e x a c t l y d e f i n e t h i s m e t h o d , t h e s e t of a d m i s s i b l e p r e c e d e n c e s must be established first. D e f i n i t i o n

4.4

[Simple pair condition,

A precedence ~ has the simple pair condition • f is m i n i m a l or [3 u n a r y g 6 8] f is m i n i m a l w.r.t. ~ \ { g } . To g u a r a n t e e t h e r e p l a c e m e n t reduced in the following way: D e f i n i t i o n

4.5

property,

the terms

[Endomorphism

[Ze89]]

if a n d o n l y if [Vf

E

~A ] •

to b e c o m p a r e d

operation,

must

be

[GL86]]

L e t ~ b e a p r e c e d e n c e s a t i s f y i n g f ~ g w h e r e f is a n a s s o c i a t i v e o p e r a t o r a n d g is a u n a r y f u n c t i o n s y m b o l . T h e e n d o m o r p h i s m o p e r a t i o n s : F ~ F r e w r i t e s a t e r m to a n i r r e d u c i b l e f o r m w i t h t h e s y s t e m d e s c r i b e d b y t h e two rules E: f [ g [ x ] , y ] --~ g [ f [ x , y ] ] f [ x , g [ y ] ] --> g [ f [ x , y ] ] • N o t e t h a t t h i s r u l e s y s t e m [E] is c o n f l u e n t a n d t e r m i n a t i n g u s i n g t h e r e c u r s i v e p a t h o r d e r i n g w i t h f ~ g. T h e n o r m a l f o r m of a t e r m t is d e n o t e d b y s[t]. It c a n be proved that two terms are AE-equivalent if a n d o n l y if t h e i r f l a t t e n e d ~ - n o r m a l f o r m s a r e s y n t a c t i c a l l y e q u a l : s ~ A E t i f f ~[S] = ~[t]. B a s e d on t h i s f a c t , another A-compatible ordering can be defined: s hE tiff ~[s] >RPOS requiring the precedence to h a v e t h e s i m p l e p a i r c o n d i t i o n a n d z[f]=mult if

f ~A-

420

N o w w e a r e g o i n g to d e a l w i t h t h e e x t e n s i o n s [to C - t h e o r i e s ] of t h e o r d e r i n g s p r e s e n t e d a b o v e [ ~ , ~ D a n d ~_E]" Thus, w e d e m o n s t r a t e t h e c o n t e n t s of [ G L 8 6 ] e x t e n d e d b y t h e i n c o r p o r a t i o n of s t a t u s to t h e r e c u r s i v e p a t h o r d e r i n g .

D e f i n i t i o n

4.6

Let z be a status function such that each C-operator has multiset status. s ~c

t

iff

S >RPOS ~^ each A-operator

is m i n i m a l

and each A-operator

w.r.t.

s ~CD

t

iff

8[s] > R P O S 8[t] A > satisfies the associative pair condition

s ~.cE

t

iff

4s] >RPos 4t] A

~ satisfies the simple pair condition

It is p o s s i b l e t o e x t e n d t h e s e c o n d a n d t h e t h i r d o r d e r i n g . In [BP85] a m o r e powerful method is p r e s e n t e d . If t w o t e r m s h a v e the same flattened ~-normalforms [flattened ~-normalforms] they could be still compared using s o m e r e d u c t i o n o r d e r i n g ~ t h a t is A C - c o m p a t i b l e a n d w e l l - f o u n d e d on e v e r y s e t [t] = {s I ~[s] -- ~[t]} [{s I ~[s] = ~[t]}]. S u c h a n o r d e r i n g is c a l l e d a d m i s s i b l e for t h e t r a n s f o r m a t i o n 8 [E]. F o r e x a m p l e , c o m p a r i n g t e r m s b y t h e i n v e r s e of t h e i r s i z e s is a n a d m i s s i b l e o r d e r i n g for t h e t r a n s f o r m a t i o n u s e d h e r e . M o r e p r e c i s e l y , ~ c a n b e d e f i n e d a s s ~ t i f f Isl < Itl a n d no v a r i a b l e a p p e a r s m o r e o f t e n i n s t h a n i n t [ w h e r e Iti d e n o t e s t h e s i z e of t]. In [GL863, > d e p e n d s o n a n d s, r e s p e c t i v e l y : s ~ t i f f s ~ D / A t IS ~ E / A t].

A s w e h a v e s e e n , for g u a r a n t e e i n g the C-compatibility of t h e A - c o m p a t i b l e o r d e r i n g s p r e s e n t e d a t t h e b e g i n n i n g of t h i s c h a p t e r , w e o n l y h a v e to r e q u i r e m u l t i s e t s t a t u s of c o m m u t a t i v e o p e r a t o r s . Thus, t h e u n i o n of t h e a p p r o a c h for C - t h e o r i e s w i t h e a c h m e t h o d for A - t h e o r i e s m u s t b e c o n s i d e r e d . T h e o r e m

4.7

>c, ~ , ~ D , ~,E, ~a.c, ~ C D a n d ~ C E a r e s i m p l i f i c a t i o n o r d e r i n g s w h i c h a r e s t a b l e w.r.t, s u b s t i t u t i o n s a n d C-, A - a n d A C - c o m p a t i b l e , r e s p e c t i v e l y . •

In a d d i t i o n to t h e a s s e r t i o n s of [GL86], ACD-compatible lACE-compatible]. L e m r n a ~CD

we

can

prove

that

~a_CD [ ~ C E ]

is

4.8 is A C D - c o m p a t i b l e

and

~-CE is A C E - c o m p a t i b l e .

•

421

All orderings presented i n t h i s c h a p t e r a r e b a s e d o n a p r e c e d e n c e b. T h i s o r d e r i n g on t h e o p e r a t o r s is n o t c l e a r l y d e f i n e d a n y w h e r e . N o t e t h a t it c o u l d be a partial ordering as well as a quasi-ordering. However, quasi-precedences on A C - o p e r a t o r s m u s t b e p r o h i b i t e d i n o r d e r to g u a r a n t e e t h e s t a b i l i t y w.r.t. substitutions:

L e m r n a

4.9

>.4.' >AD' >AE' >AC' >ACD a n d >ACE a r e n o t s t a b l e w.r.t, s u b s t i t u t i o n s p r e c e d e n c e o n t h e A [ C l - o p e r a t o r s is a q u a s i - o r d e r i n g .

if t h e ,,

The following counter-example s a t i s f i e s t h i s a s s e r t i o n : L e t ^, v E ~ A a n d ^ --~ v, 0 ~ 1 a n d > a n y of t h e o r d e r i n g s of l e m m a 4.9. T h e n , 0 v x > l^x. But, ~[0vx] ~ ~[l^x) u s i n g ~ = {x + - 0v0}, It is o b v i o u s t h a t q u a s i - o r d e r i n g s on n o n AC-operators can still be used.

F i n a l l y , w e n o w c o m p a r e t h e p o w e r of t h e o r d e r i n g s p r e s e n t e d in t h i s c h a p t e r . N o t e t h a t w e o n l y e x a m i n e t h e r e l a t i o n b e t w e e n [ n o t t h e s i z e ofl t w o s e t s of c o m p a r a b l e t e r m s . T h e f o l l o w i n g l e m m a d e s c r i b e s t h e c o m p a r i s o n w.r.t. partial precedences. aem~-,a

4.10

A s s u m i n g a r b i t r a r y t e r m s a n d p a r t i a l precedences [ t h a t a r e a d m i s s i b l e r e l a t e d to t h e c o r r e s p o n d i n g o r d e r i n g s l , t h e f o l l o w i n g r e l a t i o n s a r e v a l i d :

~CD / ~.D

~

/

~cs ~

>

~C

The relations are represented using a kind of Hasse diagrams. If > is stronger than ~, w e arrange > above

AE

A difference between the orderings presented here and those in other papers published is the additional status. It is obvious that the orderings without status are included in the corresponding orderings with status [see example 6.2 and example 6.3].

5 Decomposition

ordering

This chapter deals with the application to t h e i m p r o v e d r e c u r s i v e d e c o m p o s i t i o n

modulo

AC

of t h e c o n c e p t s u s e d in c h a p t e r o r d e r i n g of c h a p t e r 3.

4

422

Note that an essential precondition must be guaranteed t o u s e a n y of t h e o r d e r i n g s d e s c r i b e d i n c h a p t e r 4: e a c h A - o p e r a t o r a n d C - o p e r a t o r m u s t h a v e m u l t i s e t s t a t u s . A n o t h e r f a c t t h e p r e s e n t e d o r d e r i n g s h a v e in c o m m o n is t h a t t h e y a r e b a s e d on t h e r e c u r s i v e p a t h o r d e r i n g w i t h s t a t u s . O u r g o a l c o n s i s t s of e x t e n d i n g each strategy by making the basic ordering stronger. More precisely, the recursive path ordering with status will be replaced by a more powerful ordering: the improved recursive decomposition ordering with status. F o r a c l e a r - c u t r e p r e s e n t a t i o n of t h e o r d e r i n g s w e c h o o s e t h e i r p a r a m e t e r s in t h e f o l l o w i n g w a y , F o r e x a m p l e , l e t > 6 { ~ , >c ' ~a~c , ~a~D , ~ E ' ~ C D ' ~ C E }" T h e n , >* d e n o t e s t h e m e t h o d of > w h e r e >RPOS is r e p l a c e d b y >IRDS' F o r e x a m p l e , s ~ c * t iff s >IRDS "[- b y g u a r a n t e e i n g that each A-operator is m i n i m a l w.r.t, b a n d e a c h A - / C - o p e r a t o r has multiset status. T h e o r e m

5.1

>c * is a s i m p l i f i c a t i o n ordering, C-compatible a n d s t a b l e w.r.t. substitutions. ~*, >ADS a n d >AE * a r e s i m p l i f i c a t i o n o r d e r i n g s , A-compatible and s t a b l e w,r.t, s u b s t i t u t i o n s . >AC * , >ACD* a n d ~ C E ~ a r e s i m p l i f i c a t i o n o r d e r i n g s , A C - c o m p a t i b l e a n d s t a b l e w.r.t, s u b s t i t u t i o n s . •

T h i s t h e o r e m g u a r a n t e e s t h e c o r r e c t n e s s of m e r g i n g t h e c o n c e p t s of t h e v a r i o u s v e r s i o n s of t h e a s s o c i a t i v e path orderings with the improved recursive d e c o m p o s i t i o n o r d e r i n g . In o r d e r to c o m p l e t e t h i s s t u d y w e w o u l d l i k e to p o i n t o u t t h a t it is p o s s i b l e to a p p l y t h i s m e t h o d to o t h e r p a t h a n d d e c o m p o s i t i o n o r d e r i n g s i n c l u d i n g t h e p a t h of s u b t e r m s o r d e r i n g of P l a i s t e d [[P178]], t h e p a t h ordering of K a p u r , N a r e n d r a n and Sivakumar [[KNS85]], t h e recursive decomposition o r d e r i n g of L e s c a n n e , J o u a n n a u d a n d R e i n i g [[JLR82]]. The c o r r e s p o n d i n g l e m m a s a n d p r o o f s a r e c o n t a i n e d in [St89c]. In s u m m a r y , it c a n b e s t a t e d t h a t t h e s t r a t e g y of t h e A P O a s w e l l a s t h e s p e c i a l i z e d [to A - or C - t h e o r i e s , o n l y ] a n d i m p r o v e d o n e [to t h e R P O w i t h status] can be applied to the improved recursive decomposition ordering with status. Note that ~CD • and ~CE • are the most powerful orderings presented here. Another advantage of t h e s e o r d e r i n g s r e l a t i v e to t h e A P O is t h e f a c t t h a t it is e a s i e r to c o n s t r u c t a p r e c e d e n c e for a g i v e n r u l e s y s t e m w i t h t h e h e l p of a d e c o m p o s i t i o n ordering than with the recursive path ordering [ s e e [Ch84 ]].

There only exist a few other orderings proving AC-termination: the polynomial o r d e r i n g s o n r e s t r i c t e d i n t e r p r e t a t i o n s of o p e r a t o r s [ w h i c h a r e n o t a s e a s y to h a n d l e as t h e o r d e r i n g s p r e s e n t e d p r e v i o u s l y , s e e [BL87] a n d [SZ90]] a n d t h e associative-commutative Knuth-Bendix o r d e r i n g s [[St89b]]. C o m p a r i n g t h e m , t h e f o l l o w i n g r e l a t i o n s c a n b e d e t e c t e d [ s e e [St89c]]:

423

The p o w e r of t h e A C - o r d e r i n g decomposition ordering

based

on

the

improved

is s t r o n g e r t h a n t h a t of t h e A P O [cf. 6.1] o v e r l a p s w i t h t h a t of t h e p o l y n o m i a l orderings i n t e r p r e t a t i o n s of o p e r a t o r s [cf. 6.3] o v e r l a p s w i t h t h a t of t h e a s s o c i a t i v e - c o m m u t a t i v e o r d e r i n g s [cf. 6.3]

on

recursive

restricted

Knuth-Bendix

T h e p o w e r s of t w o o r d e r i n g s > a n d ~ o v e r l a p if t h e r e e x i s t s a t l e a s t o n e p a i r of t e r m s w h i c h is o r i e n t a b l e w.r.t, > b u t n o t w.r.t. ~, a n d v i c e v e r s a .

6

E x a m p l e s

T h i s c h a p t e r d e a l s w i t h t h e p o w e r of t h e p r a c t i c a l a p p l i c a b i l i t y of t h e o r d e r i n g s p r e s e n t e d . W e c o l l e c t e d s o m e e x a m p l e s of r e w r i t e s y s t e m s [9~] t o g e t h e r w i t h u n d e r l y i n g t h e o r i e s [E]. A d d i t i o n a l l y , t h e a p p r o p r i a t e o r d e r i n g g u a r a n t e e i n g t h e E - t e r m i n a t i o n of 9~ is g i v e n . E x a m p l e

6.1

A s s u m i n g w e h a v e t h e t w o b o o l e a n c o n s t r u c t o r s O [ f a l s e ] a n d ~ [not]. F u r t h e r m o r e , t h e r e is a c o m p l e t e d e f i n i t i o n of t h e b o o l e a n o p e r a t o r ^ [ a n d ] i n a d d i t i o n to t h e r u l e ~ x - - - > x. T h e n , t h e f o l l o w i n g s y s t e m is a c o m p l e t e d e f i n i t i o n of t h e b o o l e a n i m p l i c a t i o n [h~]. 9~:

--~

~0

x D 0

-~

~x

-,x ~ ~y

--~

y D [x ^ y]

0

~ y

E:

^ E SAC

~C[>IRDS

]

with

D >~ ~^

Note that the last rule cannot be oriented in this way by the associative path ordering. E x a m p l e

6.2

[Jantke

9~: x ÷ 0 x ÷ s[yl

fig[fix]I]

--.>

f[g[h[x,y],y]] f[h[x,h[y,z]]] E x a m p l e X

6.3 • 0

& Thomas]

x s i x ÷ y]

E:

÷ ~ SAC

f[h[s[O],x]} f[h[s[x],y]] f[h[x + y,z]]

~a.CE[>RPOS] w i t h >: g > 0 ~ h ~ ÷~s z[h] = r i g h t

[Padawitz] --~

0 Ix * y] ÷ x

E:

s[O] fac[0]

-->

1

fac[s[x]]

--~

six] * fac[x] y f l o o p [ x , s [ x ] • y]

~.CD[>RPOS] w i t h ~: fac~ • >÷ fac ~ 1 > s ~ 0 floop ~ * ~[ftoop] = left

x • s[y]

floop[O,y] floop[s[x],y]

÷, • 6 S A C

.

424

It is n o t e w o r t h y t h a t n e i t h e r t h e p o l y n o m i a l o r d e r i n g s nor t h e a s s o c i a t i v e c o m m u t a t i v e Knuth-Bendix orderings can g u a r a n t e e the E-termination of ~.

7 Conclusion This p a p e r i n t r o d u c e s t w o c l a s s e s of t e r m i n a t i o n o r d e r i n g s for a s s o c i a t i v e a n d [or] c o m m u t a t i v e t e r m r e w r i t i n g s y s t e m s . These o r d e r i n g s e x t e n d t h e w e l l k n o w n a s s o c i a t i v e p a t h o r d e r i n g s [see for e x a m p l e [BP85], [GL86]] b y u s i n g a s t r o n g e r [ t h a n the RPO] u n d e r l y i n g ordering. More p r e c i s e l y , w e a p p l y the b a s i c f e a t u r e s of the a s s o c i a t i v e p a t h o r d e r i n g to t h e r e c u r s i v e p a t h o r d e r i n g w i t h s t a t u s [[I<[L801] a n d the i m p r o v e d r e c u r s i v e d e c o m p o s i t i o n o r d e r i n g w i t h s t a t u s [[St89a]]. The m a i n i d e a s of t h e APO as well as t h o s e of t h e are t h e f o l l o w i n g ones: [i] A p p l y i n g d i s t r i b u t i v i t y a x i o m s to the t e r m s to be c o m p a r e d b y r e q u i r i n g the pair c o n d i t i o n , [ii] F l a t t e n i n g the t r a n s f o r m e d t e r m s f l a t t e n e d t e r m s w.r.t, a c l a s s i c a l t e r m ordering.

new orderings presented [or e n d o m o r p h i s m , resp.] a s s o c i a t i v e [simple, resp.] a n d [iii] C o m p a r i n g the

In the case of the APO, t h e u n d e r l y i n g term o r d e r i n g is r e p r e s e n t e d by the r e c u r s i v e p a t h o r d e r i n g w i t h o u t s t a t u s . W e s u c c e e d e d in e n h a n c i n g t h e APO b y s u b s t i t u t i n g t h e RPO b y the RPO w i t h s t a t u s or one of t h e m o s t p o w e r f u l p a t h a n d d e c o m p o s i t i o n o r d e r i n g s . F u r t h e r m o r e , in [St89c] it is p r o v e d t h a t also o t h e r p a t h a n d d e c o m p o s i t i o n o r d e r i n g s [of [St89a]] c a n be u s e d i n s t e a d of the RPO. A n o t h e r s u p p l e m e n t to the p a p e r s of B a c h m a i r / P l a i s t e d and G n a e d i g / L e s c a n n e is the fact t h a t the APO i n c l u d i n g d i s t r i b u t i o n of t e r m s [ a p p l y i n g e n d o m o r p h i s m , r e s p e c t i v e l y ] is A C D - c o m p a t i b l e l A C E - c o m p a t i b l e , r e s p e c t i v e l y ] . F u r t h e r m o r e , w e w e r e a b l e to s h o w t h a t q u a s i - o r d e r i n g s on A C - o p e r a t o r s c a n n o t be u s e d s i n c e t h e y injure the s t a b i l i t y w.r,t, s u b s t i t u t i o n s . C o n c l u d i n g , it is to r e m a r k t h a t w e h a v e also s u c c e e d e d in p r o v i n g the s u b t e r m p r o p e r t y of all the o r d e r i n g s p r e s e n t e d [ i n c l u d i n g the different v e r s i o n s of the APO]. The g e n e r a l i z a t i o n of the p r e s e n t e d a p p r o a c h for e q u a t i o n a l t h e o r i e s o t h e r t h a n a s s o c i a t i v e a n d c o m m u t a t i v e ones c o u l d be part of f u t u r e plans.

References [BL87]

A h l e m Ben C h e r i f a / P i e r r e L e s c a n n e : T e r m i n a t i o n of r e w r i t i n g systems b y p o l y n o m i a l i n t e r p r e t a t i o n s and its i m p l e m e n t a t i o n , S c i e n c e of

[BP85]

Leo B a c h m a i r / D a v i d A. Plaisted: T e r m i n a t i o n o r d e r i n g s for a s s o c i a t i v e - c o m m u t a t i v e r e w r i t i n g s y s t e m s , J o u r n a l of S y m b o l i c

[Ch84]

O h i s l a i n e Choque: H o w to c o m p u t e a c o m p l e t e set of m i n i m a l i n c r e m e n t a t i o n s w i t h t h e r e c u r s i v e d e c o m p o s i t i o n o r d e r i n g ?, Internal

C o m p u t e r P r o g r a m m i n g 9 [2], October 198Z pp. 137-160 C o m p u t a t i o n ], 1985, pp. 3 2 9 - 3 4 9

425

Report 84-R-056, Centre de Recherche N a n c y , France, I984

en I n f o r m a t i q u e

d e Nancy,

IDa88]

M a x D a u c h e t : T e r m i n a t i o n of r e w r i t i n g is u n d e c i d a b l e in t h e o n e - r u l e c a s e , Prec. 13th S y m p o s i u m of MFCS, Carlsbad, CSSR, S e p t e m b e r 1988,

[De87]

Nachum

L N C S 324, pp. 2 5 2 - 2 7 0 Dershowitz:

Termination

J o u r n a l of S y m b o l i c

of r e w r i t i n g ,

C o m p u t a t i o n 3, 1987, pp. 69-II6 [DHJP83]Nachum Dershowitz / Jieh Hsiang Plaisted: Associative-commutative [GL86] [JK86]

/ N. A l a n J o s e p h s o n / D a v i d A. r e w r i t i n g , Prec. 8th Int. J o i n t

Conf. on A r t i f i c i a l I n t e l l i g e n c e , Karlsruhe, W. G e r m a n y , A u g u s t I983, pp. 9 4 0 - 9 4 4 Isabelle Gnaedig / Pierre Lescanne: Proving termination of associative-commutative r e w r i t i n g s y s t e m s b y r e w r i t i n g , Prec. 8th Conf. on A u t o m a t e d D e d u c t i o n , Oxford, U.K., 1986, L N C S 230, pp. 5 2 - 6 0 Jean-Pierre Jouannaud / H e l e n e K i r c h n e r : C o m p l e t i o n of a s e t of r u l e s m o d u l o a s e t of e q u a t i o n s , S I A M J o u r n a l of C o m p u t i n g I5 [4],

1986, pp. I155-1194 [JLR82]

Jean-PierreJouannaud/PierreLescanne/Fernand Reinig:Recursive d e c o m p o s i t i o n o r d e r i n g , IFIP W o r k i n g Conf. on F o r m a l D e s c r i p t i o n of

P r o g r a m m i n g C o n c e p t s II [1:). Bjerner, ed.], W. G e r m a n y , 1982, pp. 331-348 [JM84]

Garmisch-Partenkirchen,

J e a n - P i e r r e J o u a n n a u d / M i g u e l M u n o z : T e r m i n a t i o n of a s e t of r u l e s m o d u l o a s e t of e q u a t i o n s , Prec. 7th Conf. on A u t o m a t e d D e d u c t i o n ,

Napa, California, I984, L N C S 170, pp. 175-193 [KB70]

D o n a l d E. K n u t h / P e t e r B. B e n d i x : S i m p l e w o r d p r o b l e m s in u n i v e r s a l a l g e b r a s , C o m p u t a t i o n a l P r o b l e m s in a b s t r a c t algebra, P e r g a m o n

p r e s s , I970, pp. 2 6 3 - 2 9 7 [KL80] [KNS85]

Sam Kamin / Jean-Jacques Levy: Attempts for g e n e r a l i z i n g the r e c u r s i v e p a t h o r d e r i n g s , Unpubl. m a n u s c r i p t , Urbana, Illinois, I980 Deepak Kapur/ P a l i a t h N a r e n d r a n / G. S i v a k u m a r : A p a t h o r d e r i n g for p r o v i n g termination of t e r m r e w r i t i n g systems, Prec. lOth

C o l l o q u i u m on Trees in A l g e b r a a n d P r o g r a m m i n g , Berlin, W. G e r m a n y , M a r c h 1985, LNCS I85, pp. 173-187 [P178]

D a v i d A. P l a i s t e d : termination of t e r m

A recursively defined ordering for rewriting s y s t e m s , I n t e r n a l Report,

proving

Univ.

of

Illinois, Urbana, U.S.A., S e p t e m b e r 1978 [PS81]

G e r a l d E. P e t e r s o n / M a r k some equational theories,

E. S t i c k e l : C o m p l e t e

s e t s of r e d u c t i o n s

for

J o u r n a l of t h e A s s o c i a t i o n for C o m p u t i n g M a c h i n e r y 28 [2], A p r i l 1981, pp. 233-264 [Ru87]

Michael Rusinowitch: P a t h of s u b t e r m s ordering and recursive d e c o m p o s i t i o n o r d e r i n g r e v i s i t e d , J o u r n a l of S y m b o l i c C o m p u t a t i o n 3,

[St89a]

Joachim Steinbach: Extensions and comparison of s i m p l i f i c a t i o n o r d e r i n g s , Prec. 3rd Conf. on R e w r i t i n g T e c h n i q u e s a n d A p p l i c a t i o n s ,

[St89b]

J o a c h i m S t e i n b a c h : P r o v i n g t e r m i n a t i o n of a s s o c i a t i v e - c o m m u t a t i v e rewriting systems using the Knuth-Bendix ordering , SEKI-Report,

198Z pp, I17-131 C h a p e l Hill, N o r t h Carolina,

U.S.A., A p r i l I989, pp. 4 3 4 - 4 4 8

A r t i f i c i a l I n t e l l i g e n c e Laboratories, Dept. Univ. of K a i s e r s l a u t e r n , W. G e r m a n y , I989

of

Computer

Science,

[St89c]

Joachim Steinbach: Path and decomposition o r d e r i n g s for p r o v i n g AC-termination , S E K I - R e p o r t , A r t i f i c i a l I n t e l l i g e n c e Laboratories,

[SZ90]

Joachim Steinbach / Michael Zehnter: Vade-mecum of p o l y n o m i a l o r d e r i n g s , S E K I - R e p o r t , A r t i f i c i a l I n t e l l i g e n c e Laboratories, Dept. of

[Ze89]

Michael

Dept. of C o m p u t e r S c i e n c e , Univ. of K a i s e r s l a u t e r n , Computer Science, Zehnter:

Univ. of K a i s e r s l a u t e r n ,

Theorievollst~indige

P r o j e c t report, Univ. of K a i s e r s t a u t e r n ,

W. G e r m a n y , I989

IV. G e r m a n y , 1990

Ordnungen

- Eine Ubersicht

W, G e r m a n y , N o v e m b e r t989

,

Perspectives on Automated

Deduction

W. B i b e l Technische Hochschule Darmstadt,

Germany*

Research in the field of Automated Deduction has spread out into various directions. While this development has generated a great wealth of knowledge that eventually might contribute to the construction of truly powerful deductive systems, the accumulation of knowledge by itself is not sufficient for this goal to be achieved. To see why, we only have to recognize that research carried out by the community may suffer from the same (search) problems as our systems. First, as knowledge grows (exponentially), resources (ie. talented researchers, funding, etc.) are exhausted in too many search branches. Also, since a community acts like a growing distributed system, (relatively) less knowledge will be shared by different groups in their future work. Evaluation of progress becomes harder. And so forth. For these reasons it is worthwhile (indeed necessary) for the community to step back from time to time and reflect upon its various directions, its shared and differing goals, assumptions, methods, implementation techniques, and so forth. Such reflection might help to prune the (re-) search space, to agree on criteria for measuring progress so as to avoid redundant search, and to find effective mechanisms to guarantee that all available knowledge of value for future systems becomes known to those building them. The purpose of this talk is to stimulate this kind of reflection by attempting an analysis of all the issues just mentioned. No individual may claim to speak for the community as a whole so that my own perspective presented, of course, is not claimed valid for the entire community. Rather the hope is that the talk will intensify the discussion on these issues so that some consensus might eventually be reached.

*Also affiliated with The University of British Columbia, Vancouver

On R e s t r i c t i o n s of O r d e r e d P a r a m o d u l a t i o n w i t h Simplification* Leo Bachmair

Harald Ganzinger t

Department of Computer Science SUNY at Stony Brook Stony Brook, New York 11794, U.S.A. l e o C s b c s , sunysb, edu

FB Informatik Universit£t Dortmund D-4600 Dortmund 50, F.R.G. hg¢inf ormat ik. uni-dortmund, de

We consider a restricted version of ordered paramodulation, called strict superposition. We show that strict superposition (together with equality resolution) is refutationally complete for Horn clauses, but not for general first-order clauses. Two moderate enrichments of the strict superposition calculus are, however, sufficient to establish refutation completeness. This strictly improves previous results. We also propose a simple semantic notion of redundancy for clauses which covers most simplification and elimination techniques used in practice yet preserves completeness of the proposed calculi. The paper introduces a new and comparatively simple technique for completeness proofs based on the use of canonical rewrite systems to represent equality interpretations.

1

Introduction

A v a r i e t y of techniques have been suggested for theorem p r o v i n g in theories w i t h equations. For instanee, the use o f equations s ~ t in one direction only, as r e w r i t e rules s ~ t, can be very effective, as exemplified b y the various a p p l i c a t i o n s to which t h e K n u t h - B e n d i x c o m p l e t i o n m e t h o d ( K n u t h a n d Bendix 1970) has been put. C o m p l e t i o n c a n be a p p l i e d to theories described by universally quantified equations. Its two m a i n c o m p o n e n t s are superposition, which is a r e s t r i c t e d form o f p a r a m o d u l a t i o n ( R o b i n s o n a n d Wos 1969), a n d simplification by rewriting, of which d e m o d u l a t i o n (Wos et al. 1967) is essentially a special ease. C o m p l e t i o n has been e x t e n d e d to a r e f u t n t i o n a l l y c o m p l e t e p r o o f m e t h o d for e q u a t i o n a l theories (called "ordered c o m p l e t i o n " ) , el. L a n k f o r d 1975, H s i a n g a n d R u s i n o w i t c h 1987, a n d B a c h m a i r , Dershowitz a n d P l a i s t e d 1989. I t has been an o p e n question to w h a t e x t e n t s u p e r p o s i t i o n a n d simplification can be a p p l i e d to first-order clauses. *The research described in this paper was supported in part by the National Science Foundation under grant COR-8901322, by the ESPRIT-project PROSPECTRA (reL no. 390), and by a travel grant from Deutsche Forschungsgemelnschaft. tThis work was done while the second author was on leave at SUNY at Stony Brook.

428

Consider, for instance, paramodulation for variable-free formulas: r --~ A, s ..~ t

A--~II, u[s]~v

I', A --, A , H , u [ t ] ~ v and suppose that ~- is an ordering which is total on variable-free terms and formulas. We say that the paramodulation inference is ordered (with respect to >-) if and only if (i) s ~- t; (ii) s ..~ t is maximal with respect to P U A; and (iii) u[s] ~ v is maximal with respect to A U H. An ordered paramodulation inference is said to be a superposition inference if (iv) u[s] ~- v. A weak superposition inference is a paramodulation inference for which conditions (i), (iii), and ( i v ) - - b u t not necessarily (ii)--are satisfied. Hsiang and Rusinowiteh (1989) have proved that ordered paramodulation is refutationally complete, whereas Rusinowitch (1988) has established the refutation completeness of weak superposition. Zhang and Kapur (1988), finally, have claimed that superposition is also refutationalty complete. However, their suggested proof, given in detail by Zhang (1988), is incorrect in several aspects. In particular, it depends on the incorrect assumption that superposition is compatible with deletion of tautologies. For example, the set of clauses c..~d b~d a~d

~

a~c

---* a ~ b , a ~ d where a, b, c, and d are constants, is unsatisfiable: the last three clauses imply that a, b, c, and d are all equal, which contradicts the first clause. Let ~- be an ordering in which a ~- b ~- c ~- d and suppose equations are compared in the following way: s ~, t >- u ~ v if and only if either m a z ( s , t) >- m a x ( u , v) or else m a z ( s , t) = m a x ( u , v) and rnin(s,t) ~- rain(u, v). Then the only clause that can be obtained from the above clauses by superposition is the tautology a ~ d --~ b ~ c, a ,~ d (obtained from the third and fourth clause). In other words, if tautologies are deleted (as they usually are), then superposition is not refutationally complete for first-order clauses with equality. In this paper, we analyse some of the difficulties with superposition and present a sharpened version of superposition, called strict superposition, which we prove to be refutationally complete for Horn clauses. We also prove that strict superposition can be augmented either by specific restricted applications of ordered paramodulation or by generalized factoring rules to yield refutationally complete inference systems for first-order clauses. Finally, we show that these inference systems are not only compatible with tautology deletion, but allow considerably stronger techniques for deletion and simplification of clauses, such as subsumption, contextual rewriting, etc. Our completeness proofs are comparatively simple and are characterized by the use of canonical rewrite systems for describing equality interpretations.

2

Equality Herbrand Interpretations

We formulate our inference rules in an equational framework and define clauses in terms of multisets. (First-order clauses with predicate symbols other than equality can easily

429 be described in this formalism, as indicated in a later section.) A multiset over a set X is a function M from X to the set of natural numbers. Intuitively, M ( z ) specifies the n u m b e r of occurrences of z in M . We say t h a t z is an element of M if and only if M(z) > 0. A multiset M is a submultiset of M' (written M C_C_M ' ) if and only i f M ' ( z ) > M ( z ) , for all z. Union and intersection ofmultisets are defined in the usual way by identities M1 tJ M z ( z ) = M l ( z ) + M2(~) and M1 N M2(~) = m i n ( M l ( ~ ) , M2(z)). If M is a multiset and S a set, we write M C S to indicate t h a t every element of (the multiset) M is an element of (the set) S, and use M f3 S to denote the set {z E S : M(z) >_ 1}. For simplicity, we often use a set-like n o t a t i o n to describe multisets. For example, (~, ~, z} denotes the multiset M such t h a t M(z) = 3 and M(y) = 0, for y ¢ z. A n equation is a multiset {s, t}, where s a n d t are (first-order) terms built from given function symbols a n d variables. We write s ~ t to denote the equation {s,t}. By a ground expression we m e a n an expression containing no variables. A clause is a pair of multisets of equations, written I" -~ A. The multiset I' is called the antecedent; the multiset A, the succedent. We usually write F1, F2 instead of I'z t2 F2; P , A or A , F instead of I' t3 {A); and A 1 , . . . , A m --~ B a , . . . , B , ~ instead of { A 1 , . . . , A m } --~ ( B 1 , . . . , B n ) . A clause A 1 , . . . , A m --~ BI,...,B,~ m a y be regarded as representing an implication A1 A . . . A Am D B1 V .-. V Bin. The empty clause --* indicates a contradiction. Clauses of the form F , s ~ t --~ s ~ t , A or F --* A , t ~ t are called tautologies. We write u[s] to indicate t h a t s is a s u b t e r m of u and (ambiguously) denote by u[t] the result of replacing a particular occurrence of s by t. By t~r we denote the result o f a p p l y i n g the substitution ¢r to t, and call t ¢ an instance of t. If tcr is ground, we speak of a ground instance. We shall also consider instances of multisets of equations and of clauses. For example, the multiset {a ~ b, a ~ b} is an instance of {z ~ b, a .~ y}. T h e c o m p o s i t i o n vp of two substitutions r and p is defined by: z r p = (zr)p, for all variables X.

An equivalence is a reflexive, transitive, s y m m e t r i c binary relation. A congruence is an equivalence ~ on terms, such that s ~ t implies u[s] ~ u[t], for all terms u, s, and ~. If E is a set of g r o u n d equations, we denote by E* the smallest congruence N such t h a t s .- t whenever s ~ t C E. By an (equality Herbrand) interpretation we mean a congruence on g r o u n d terms. A n interpretation I is said to satisfy a g r o u n d clause F --~ A if and only if either F ~ I or else A N I 7& 0. We also say t h a t a g r o u n d clause C is true in I, if I satisfies C; and t h a t C is false in I, otherwise. An interpretation I is said to satisfy a (n6ng r o u n d ) clause F --* A if and only if it satisfies all ground instances Fc~ --. A~r. For instance, a t a u t o l o g y is satisfied by any interpretation. A clause which is satisfied by no i n t e r p r e t a t i o n is called unsatisfiable. The e m p t y clause is unsatisfiable by definition. If I satisfies all clauses of a set N, we say t h a t I is a (equality Herbrand) model of N. A set N of clauses is unsatisfiable if it has no model. We say t h a t a set of clauses N implies a clause C (and write N ~ C) if and only if C is satisfied by any model of N.

3

Canonical Rewrite Systems

We shall use canonical rewrite systems to describe and reason a b o u t equality interpretations.

430

A b i n a r y r e l a t i o n ::~ on t e r m s is called a rewrite relation if a n d only i f s ~ t i m p l i e s u[s~r] ~ u[tcr], for all t e r m s s, t a n d u, a n d s u b s t i t u t i o n s or. A transitive, well-founded rewrite r e l a t i o n is called a reduction ordering. By ¢~ we d e n o t e the s y m m e t r i c closure o f ¢ ; by ~ + t h e t r a n s i t i v e closure; by 3 " t h e t r a n s i t i v e , reflexive closure; a n d b y ¢:>* the s y m m e t r i c , t r a n s i t i v e , reflexive closure. F u r t h e r m o r e , we write s ~ t to i n d i c a t e t h a t there exists a t e r m v such t h a t s o * v a n d t ~ * v. A r e w r i t e r e l a t i o n ::~ is said to be Church-Rosser i f a n d o n l y if t h e two r e l a t i o n s ¢~* a n d g are the same. W e say t h a t a set o f e q u a t i o n s E is a rewrite system w i t h respect to an o r d e r i n g ~for every e q u a t i o n s ~ t in E , either s ~- t or t ~- s. E q u a t i o n s in a rewrite s y s t e m are s o m e t i m e s called (rewrite) rules. W e s p e a k o f a g r o u n d r e w r i t e s y s t e m E if all e q u a t i o n s in E are g r o u n d . If E is a r e w r i t e s y s t e m w i t h respect to ~-, we d e n o t e b y ~ E ~ (or simply ~) t h e s m a l l e s t r e w r i t e r e l a t i o n such t h a t s ~ E t, whenever s ~ t C E a n d s ~- t. A t e r m s is said to be reducible by E i f t h e r e is a t e r m t such t h a t s ~ E t; a n d irreducible, otherwise. For i n s t a n c e , if s ~E t a n d s ~- t, t h e n the t e r m s is reducible by E . A rewrite s y s t e m E is said to be canonical i f a n d o n l y if the rewrite r e l a t i o n ~ + is well-founded a n d C h u r c h - R o s s e r . L e r n r n a 1 Let E be a ground rewrite system with respect to some reduction ordering ~-. I f there are no two distinct equations s ~ t and u ,~ v in E, such that s ~- t and u ~ v and s is a subterm of u, then E is canonical. For a p r o o f o f t h e l e m m a see H u e t (1980). A n y o r d e r i n g F- on a set S can be e x t e n d e d to an o r d e r i n g ~-m~t on m u l t i s e t s over S as follows: M ~-muZ g i f a n d only if (i) M ~ N a n d (it) whenever g ( z ) > M ( z ) then M'(y) > N ( y ) , for s o m e y such t h a t y ~- ~. If ~- is a t o t a l [well-founded] o r d e r i n g on g r o u n d t e r m s , t h e n ~,n~z is a t o t a l [well-founded] o r d e r i n g on equations. If C is a clause A 1 , . . . , A , ~ --~ B 1 , . . . , B n , let 7 c be t h e m u t t i s e t (of m u l t i s e t s )

{A1 U {T},...,Am U {T},B1 U {_L},..., B~ U { ± } } , where 2_ a n d T are new s y m b o l s , used to d i s t i n g u i s h occurrences of e q u a t i o n s in t h e a n t e c e d e n t from occurrences in the succedent. W e a s s u m e t h a t t >- T ~- 2-, for all t e r m s ~, a n d define the o r d e r i n g ~c on clauses b y : C ~-~ C ~ if a n d only if 7c(~-mul)rnul .yC'. If ~- is a t o t a l [well-founded] o r d e r i n g on t e r m s , t h e n ~-~ is a t o t a l [welt-founded] o r d e r i n g on clauses. I f ~- is a n o r d e r i n g on t e r m s , we say t h a t a n e q u a t i o n A is maximal with respect to a m u l t i s e t o f e q u a t i o n s I~ i f a n d only if t h e r e is no e q u a t i o n B in F such t h a t B ~-ra~t A. We say t h a t A is strictly m a x i m a l with r e s p e c t to P if a n d o n l y if A is m a x i m a l a n d does n o t occur in r . A t e r m s is m a x i m a l in a clause C --- F --~ zX if a n d only if C c o n t a i n s an e q u a t i o n s ~ t a n d s ~ s is m a x i m a l w i t h r e s p e c t to P u A.

4

Ordered Inference Rules

Let >- be a r e d u c t i o n o r d e r i n g . W e say t h a t a clause P --* A , s ~ t is reductive (for s ~ t) i f a n d only i f (i) t ~ s, (it) s ~ t is s t r i c t l y m a x i m a l w i t h respect to P u A , a n d (iii) s does not occur in P.

431

T h e following inference rules are defined with respect to ~-. P,s~t-+A rc~ --* Ao-

Equality resolution:

where o- is a m o s t general unifier of s a n d t, a n d so- ~ to- is m a x i m a l with respect to 1"o- U Ao'. This inference rule encodes the reflexivity of equality. Its ground version is the inference F, s m s - ~ A P-~A where s is a m a x i m a l term in F U A. Ordered

F ~

factoring:

A,A,B

I~o- --~ AO-, Ao-

where o- is a m o s t general unifier of A and B, and A~ is m a x i m a l with respect to Po-U Ao'. We do not include a corresponding inference rule for factoring in the succedent, as such a rule is not necessary in order to obtain a refutationally complete inference system. Strict Superposition,

left:

r~A,s~t

u[s']zv,

h~lI

u[t]a ~ vo-, to-, ho- ~ Ao-, II~

where (i) o- is a m o s t general unifier of s and s', (ii) the clause to- --~ Act, so- ~ to- is reductive for so- ~ to-, (iii) vo- ~ uo- and uo- ,~ vo- is maximal with respect to Ao- and strictly m a x i m a l with respect to IIo-, and (iv) s' is not a variable. Strict Superposition,

right:

r-~ A,s~t A --, u [ s '] ~ v , II I'o-, Ao- -~ u[t]o- ~ vo-, Ao-, IIo-

where (i) o- is a m o s t general unifier of s and s', (ii) the clause l'o- --+ Ao-, so- ~ to- is reductive for sir ~ to-, (iii) vo- ~ uo- and uo- ~ vo- is strictly m a x i m a l with respect to ho. U IItr, and (iv) s I is not a variable. Strict s u p e r p o s i t i o n is a sharpened version of superposition. For instance, if a >- b ~c >- d, then a ~ d --+ a ~ c

--+ a .~ b, a ~ d

a ~ d --~ b ~ c , a ..~ d

is a superposition inference, but not a strict one (as the clause a ~ d --+ a ~ c is not reductive, if a is maximal). Observe the difference, in condition (iii), between the two superposition rules: when superposing on an e q u a t i o n u m v in the antecedent o f a clause, we require uo- ~ voto be m a x i m a l , b u t not necessarily strictly maximal. This difference is due to the fact t h a t ordered factoring is applied only to equations in the succedent of a clause. Indeed, if ordered factoring is also applied to antecedents, it suffices to superpose on strictly m a x i m a l equations. It is evident (from our previous example) t h a t strict superposition is not refutationally complete, but has to be c o m b i n e d with an additional inference rule.

432

r ~ A,s,z t

Merging Paramodulation:

to', Act ~

h---,u~v[s'],u'~v',ii

u # "z v[t]~r, u~r ~. v ' ~ , A c t , Ilo"

where (i) c~ is the composition r p of a most general unifier r of s and s', and a most general unifier p of u r and u'z, (ii) the clause F a --+ An, act ~ to" is reductive for so- ~ to-, (iii) the clause Ao" --+ IIe, ucr ~ vet is reductive for u ~ ~ we, (iv) uv >- v r and v'~r ~ v~r, and (v) s' is not a variable. Merging paramodulation is more restrictive than ordered paramodulation, in that the clause obtained is an i n s t a n c e (by p) of the ordered paramodulant

rr,

hr

-+ u r ~ v[t]r, u ' r ~ v ' r , A r , I I r

(where r is a most general unifier of s and s ' ) . If the ordering >- is total on ground terms, the ground version of merging paramodulation can be written as: r --, A , s .~ t

h --, u .~ v[s], u ~ v ' , i i

r , A --, u ~ v[t], u ~ v ' , A , i i

where P --+ A , s ~ t is reductive for s ~ t and A --+ lI, u ~ v ' , u

~ v is reductive for

For example, if a >- b >- c >- d, then ---, b ~ d

---, a ~ b, a "~ d

---* a ~ d, a ,~ d

is a merging paramodulation inference. Continuing our previous example, we see that the clause --+ a ~ d may be obtained by ordered factoring. This clause allows us to replace each occurrence of the term a by the simpler term b (el. the discussion of simplification below), so that we obtain two clauses c~

d

d~d

---+ --*

d~c

where the second can be superposed on the first to yield the clause d~d,d~d

--+

from which the empty clause (a contradiction) can be obtained by equality resolution. Note that merging paramodulation is designed in such a way that its repeated application to ground clauses (in conjunction with ordered factoring) has the effect of merging certain atoms containing the maximal term. By S we denote the inference system consisting of all of the above inference rules, with the additional restrictions: (a) the premises of an inference rule must not share any variables (if necessary, the variables in one premise are renamed); and (b) no premise must be a tautology.

433

5

Refutation

Completeness

We shall prove t h a t the inference system S is refutationally complete. T h e key to the p r o o f is the construction o f an equality H e r b r a n d model for a given set of clauses. From now on let N denote some fixed set of clauses and ~ a reduction ordering t h a t is total on ground terms. We shall construct an i n t e r p r e t a t i o n by m e a n s of a canonical rewrite system as follows. We use induction on ~c to define sets of equations E c , R v , a n d I c , for all g r o u n d instances C of clauses in N. Let C be such a g r o u n d instance a n d suppose t h a t E v , , R c , , and Iv, have been defined for all clauses C j with C ~ -c C ~. T h e n we define

Re=

U

Ec,

and Ic=R~.

Moreover

Ec = {s z t} if C is a clause F --~ s ~ t, A such t h a t (i) C is reductive for s ~ t, (it) s by R e , ( i i i ) r c I v , and (iv) A N I c = 0. In t h a t case, we also say t h a t C equation s ~ t. In all other cases, E v = 0. Finally, let I be the equality interpretation R*, where R = ~Jv E c is equations generated by g r o u n d instances of clauses in N. (It is evident t h a t system with respect to ~-.) Lemma

is irreducible generates the the set of all R is a rewrite

2 A n y of the rewrite s y s t e m s R e and R is canonical.

Proof. There are no two distinct equations s ~ t and u ~ v in R v [R], such t h a t s ~- t and u ~- v and s is a s u b t e r m of u. By L e m m a 1 the rewrite system R e [R] is canonical. [] L e m m a 3 Let C be a ground instance of some clause in N with m a z i m a l term s. (1) I] s ~- u and s ~- v, then u ..~ v ~ I if and only if u J~Rc v. (2) I t s is reducible by R e and s ~ u and s ~ v, then u ~ v C I if and only if u ~Ro

V.

L e m m a 4 Suppose Ccr is a ground instance of a clause C in N and z a is reducible by R, for some variable ~ occurring in C. Then there is a ground instance C7" of C, such that (i) Cer ~e C r and (it) C'r is true in I if and only if Ccr is true in I. Proo£ If z e ~ R t, define ~- to be the s u b s t i t u t i o n for which z r = t and y r = y~, for all ywithy#z. [] T h e preceding l e m m a ensures t h a t the following Lifting L e m m a can be applied to certain g r o u n d instances of clauses. L e m m a 5 ( L i f t i n g L e m m a ) Let C be a clause F --* A , s z t and D a clause A, A[u] --* II or A 2.~ A [ u ] , I I , such that u is not a variable and C and D have no variables in common. Suppose scr =- ucr and C ' is a grounfl clause of the f o r m [ ~ , A~s, k[t]cr --+ Ao', Iio"

434

or

F~, A ~ -~ Aft]o-, Ac~, II(T

obtained from C a and Da by strict superposition or merging paramodulation. Then C ~ is a ground instance of a clause that is obtained from C and D by strict superposition or merging paramodulation. Note t h a t (ordered) factoring is not required for this (version o f the) Lifting L e m m a , since we have defined a clause as a multiset ( r a t h e r t h a n as a set) o f a t o m s . Also n o t e t h a t a merging p a r a m o d u l a t i o n on the g r o u n d level m a y c o r r e s p o n d to a s t r i c t s u p e r p o s i t i o n inference on the n o n - g r o u n d level. L e m m a 6 Suppose the set N of clauses is closed under the inference rules of S. If C = F -* s ~ t, A is a ground instance of some clause in N and generates s ~ t, then

(i) r c i, (2) i r a = s ~ w , A j, then t is irreducible by R a n d t ~ w, and (3) A N I = O. Proof. T h e p r o o f proceeds by i n d u c t i o n on ~-¢. Let us a s s u m e t h a t ( 1 ) - ( 3 ) a r e t r u e for all ground instances C ~ of N with C N ¢ C ' . (1) Observe t h a t P C Iv C I. (2) We know t h a t t ~ w, because s ~ t is s t r i c t l y m a x i m a l w i t h respect to F tA A. I f t is reducible by R, then there exists a g r o u n d i n s t a n c e D = A -~ u ~ v, ]I of s o m e clause in N , such t h a t (i) t = t[u] a n d u ~ v, (it) D generates u ~ v, a n d (iii) C ~c D. Let C ~ be a clause F ' -~ s' ~ t', A I in N a n d o" be a s u b s t i t u t i o n , such t h a t C = CJo" ( a n d s = s'a and t = t'o'). If z0~ is reducible by R e , for some v a r i a b l e z occurring in t ' , t h e n by L e m m a 4 t h e r e is a n o t h e r g r o u n d i n s t a n c e C " = F " -~ s" ~ t ' , A " of C I, such t h a t C N c C " a n d ( b e c a u s e s is irreducible by R e ) s = s". Moreover, F " C Re,, a n d A ' N R c , , = O, as F " a n d A " are o b t a i n e d from F a n d A , respectively, b y r e w r i t i n g b y R. Also, since s does n o t occur in F a n d F~-eP ", the t e r m s can not occur in F " either. B u t this i m p l i e s t h a t C" generates a rule s ~ w ~, which c o n t r a d i c t s t h e a s s u m p t i o n t h a t s is i r r e d u c i b l e by R e . Let us therefore a s s u m e t h a t x(r is irreducible by R e , for all v a r i a b l e s • o c c u r r i n g in t *. Consider the inference

h - ~ u ~ v , II r - ~ s ~ t [ u ] , s ~ w , A ' r , h - ~ s ~t[v],s ~ w,h',II by merging p a r a m o d u l a t i o n . Since C is an instance Cto - of a clause C ~ in N a n d ~o- is irreducible, for all z, we m a y a p p l y the Lifting L e m m a to infer t h a t the conclusion D ~ of this inference is a g r o u n d i n s t a n c e of N . Using the i n d u c t i o n h y p o t h e s i s , we m a y infer t h a t IIV)ID, C I I N I = O. Moreover, the t e r m s does not occur in F U A a n d ( F U A ) C ID'. Consequently, we m a y infer t h a t D ~ generates a rule s ~ w ~. tIowever, C N ¢ D ~, so t h a t s is reducible by R e , which is a c o n t r a d i c t i o n . (3) Suppose there is an e q u a t i o n u ~ v in I , such t h a t A = u ~ v, A I. Since A ~ I c = 0, we have u ~ v E I \ I c , so t h a t by L e m m a 3 we o b t a i n s = u a n d t ~ v C I c . F r o m (2) we conclude t h a t t ~- v a n d t is irreducible by R e , which c o n t r a d i c t s t ~Rc v. [] T h e o r e m 1 Let N be a set of clauses closed under S. only if it contains the empty clause.

Then N is unsatis]iable if and

435

Proof. Evidently N is unsatisfiable if it contains the e m p t y clause. Suppose N does not contain the e m p t y clause. We show t h a t the equality interpretation I constructed f r o m the set of all ground instances of clauses in N is a model of N. Suppose, to the contrary, t h a t some ground instance of a clause in N is not satisfied by I. Let C = I' --, A be a minimal (with respect to the ordering ~-~) g r o u n d instance o f a clause in N for which r c I and A N I = 0, and let s ~ ~ be a m a x i m a l equation occurring in C. We m a y assume t h a t s ~ t and t h a t C -- Ccr is an instance of a clause in N for which z a is irreducible by R, for all variables ~. (1) Suppose C is r ~, s ~ s --~ A. Since N is closed under equality resolution, the clause P~ --~ A is also a ground instance of N and is false in I . This clause is simpler than C, which contradicts the assumption t h a t C is a minimal clause false in I. (2) If C is 1'1, s ~ ~ --* A and s >- ~, then s m ~ ff I and s is reducible by R. Let D = A --~ u ~ v, II be a clause t h a t generates the rule u ~ v, where u F- v and u is a subterm of s. Using L e m m a 6 we m a y infer t h a t (i) A C I and lI N I = 0 a n d (ii) u .~ v occurs exactly once in D and, if u occurs in II, v is irreducible by R. Consider the inference step

r', A, sly]

~ ~ ~ ~x, ii

by strict superposition. By the Lifting L e m m a the conclusion C ' of this inference is a ground instance of some clause in N . Since ( r ' U A) C I and s[v] ~-. * E I and (A U II) N I - = O, the clause C ~is false in Z. I f u does not occur in II, then C ~ c C ' , which is a contradiction to C being a minimal clause false in L Otherwise, v is irreducible by R. Therefore, * ~ v, whenever ~ -- ~, because * ~R ~. Therefore (s ~ *) ~ _ . ~ (~ ~ ~) and, since u m v occuzs only once in D, we m a y infer t h a t (s ~ t) ~,n~,z A, for every equation A in A U I I . But then again C ~_c C ~, which is a contradiction to C being a m i n i m a l clause false in I. (3) If C is r - . A ' , s ~ t, then s ~- *. Note t h a t in this case the t e r m s is reducible by R. (This is certainly so if s occurs in the antecedent F of C. If s occurs only in the succedent A of C, then s also has to be reducible, for otherwise C would generate the rule s ~ t and consequently would be true in L ) Again let D : A --~ u ~ v, II be a clause t h a t generates the rule u m v, where u F- v and u is a s u b t e r m of s. Using L e m m a 6 we m a y infer that (i) A C I and II N I ---- 0 and (ii) u m v occurs exactly once in D and, if u occurs in II, v is irreducible by R. Consider the inference step

A--,u~v,

II

r --. A ' , s [ u ] ~ ~

r , A -~ A, n, s[v] ~ by strict superposition. The conclusion C t of this inference is a g r o u n d instance o f some clause in N (by the Lifting L e m m a ) and is false in I. Since C is a minimal clause false in [ and C # C t, we m a y infer t h a t C ' ~c C. This is only possible if s :- u and II --- IU, s m w, where v ~- w ~ t. T h e n F can not contain an equation s ~ w', for this would imply ~ ~- w' ~ v (cf. case (2) abo~e). In other words, the term s does not occur in F U A . We also know ( F U A ) C_ I, from which we m a y infer (F U A) C Iv,. Furthermore, ( A ' U II') N I = 0 implies ( A ' U II') n Ic, = 0. From s~vGI and s ~ t ~ I , weinfer v~t~I, a n d h e n c e v . . ~ * ~ I c , . Since D ~ - * C ' a n d s

438

is irreducible by RD, we may infer that s is also irreducible by R e , . But then C ~ would generate the rule s m w, which is a contradiction. In summary, we have shown that no ground instance of a clause in N can be false in I. Thus I is a model of N, which completes the proof. [3

6

Horn

Clauses

A Horn clause is a clause P ~ A where A contains at most one atom. Ordered factoring and merging paramodulation require at least two atoms in the succedent of a clause; hence can not be applied to Horn clauses. The refutation completeness of strict superposition for Horn clauses is therefore an immediate corollary of Theorem 1. C o r o l l a r y 1 Let N be a set of Horn clauses that is closed under equality resolution and strict superposition. Then N is unsatisfiable i] and only if it contains the empty clause. Kounalis and Rusinowitch (1988) announced the somewhat weaker result that ordered resolution and superposition (with ordered factoring in antecedents) is refutationally complete.

7

Additional

Predicate

Symbols

In formulating our inference rules, we have assumed that the only atomic formulas are equations. Suppose we also wish to consider atomic formulas P ( t l , . . . , t , ~ ) , where P is a predicate symbol other than equality. We represent such atomic formulas as equations P ( t l , . . . , tn) ..~ ± (where 3, is minimal in the given reduction ordering ~-). Clauses of the form r, P(*l,...,t~) ~ ± -~ • or r -~ ~ , P ( t l , . . . , t,) . ± in which P ( t l , . . . , t,~) ..~ ± is a maximal equation can evidently not be part of an equality resolution or merging paramodulation inference. Furthermore, the strict superposition of a clause 17 --~ A , P ( S l , . . . ,sn) .~ A_ on a clause A --* II, P ( t l , ...,t,~) ..~ A_ results in a tautology £o-, A(r ---+ A~r, H(r, 3_ ~ 3" and is therefore unnecessary. Strict superposition inferences of the form r ~ a, e(s~,..., s,) ~ ±

e ( t ~ , . . . , t,,) ~ ±, A -~ n

on the other hand, correspond to ordered resolution in the sense of Hsiang and Rusinowitch (1989), whereas inferences of the form

F -* A , s ,-~ t

A --~ II, P ( u l , . . . , u[s'],..., un) 'm _l_

r~, A~ -~ zx~, n~, P(u~,..., u[t],..., u.)~ ~ ± (and analogous superpositions into the antecedent of a clause) correspond to ordered paramodulation in the sense of Hsiang and Rusinowitch (1989). (The remaining inference rules are more restrictive, of course, than the corresponding inference rules specified by Hsiang and Rusinowitch.)

437

8

Equality Factoring

We have shown t h a t strict superposition is not refutationally complete for non-Horn clauses, but have obtained a refutationally complete inference system by adding merging paramodulation as an inference rule. Another refutationally complete inference system is obtained by generalizing ordered factoring as follows: E q u a l i t y f a e t o r i n g ~ left:

r , s I , ~ t I -~ A , s ~ t Fo-, slo- ~ rio- ~ Aft, to" ~ ~lff

where (i) ~ is a most general unifier of s and s'; (it) to- ~ so- and t'o- ~ so-; and (iii) scr ~ tc~ is m a x i m a l with respect to Fo- u Ao- U {s~o- ~ ~to-}. Equality factoring, right:

to-, to- ~ t~a --~ Act, J a ~ t'o-

where (i) ~ is a most general unifier of s and s'; (it) tc~ ~ sc~ and t'~r ~ so-; and (iii) scr ~ ~c~ is maximal with respect to to- t2 Ac, U {sto- ~ t~r}. It can easily b e checked t h a t these inference rules are sound. Equality factoring has a similar effect as merging p a r a m o d u l a t i o n in that occurrences of equations with the same maximal term can be merged. By 9r we denote the inference system obtained from S by substituting equality factoring for merging paramodulation. T h e o r e m 2 Let N be a set of clauses that is closed under the inference rules of Y . Then N is unsatisfiable if and only if it contains the empty clause.

Sketch ofproo£ The proof is similar to the proof of Theorem 1 in t h a t it can be shown that whenever N is closed under equality resolution, equality factoring, and strict superposition and does not contain the e m p t y clause, then the interpretation I constructed from the set of ground instances of N is a model of N. The main difference is in certain modifications that are required because part (2) of L e m m a 6 does not hold under the given conditions on N. O Equality factoring may essentially be regarded as the controlled application of superposition to tautologies. For instance, the (derived) inference F---+ A , s ~ t , S

I~t I

SI ~ t t - ~ St ~ t I

I~o-,tO- ~ tter --* AO-, stcr ~ ~lowhich corresponds to superposition followed by factoring, yields the same conclusion as equality factoring on the right.

9

R e d u n d a n t Clauses

A theorem proving procedure deduces new clauses by systematically applying the given inference rules to existing clauses. Some of these deduced clauses may be redundant in that a refutation can be constructed without them. In particular, a clause C is redundant

438

in a set N of clauses if every ground instance Cc~ logically follows from simpler ground instances of N. Redundant clauses can be deleted. In formalizing this notion of redundancy, we first define a well-founded ordering >--* on pairs (C, or) of clauses and substitutions. A clause C = P ~ A is said to subsume a clause D = A -~ II if there exists a substitution ~r such that Fo" C A and A~r C II. We say that C properly subsumes D (and write D t> C) if C subsumes D but not vice versa. We define: (C, ~r) ~-' (D, ~) if and only if Cc~ ~-~ D r , or else C~ = D r and C t> D. Given a set N of clauses, a clause C = F -~ A is said to be redundant in N if and only if for every ground instance Cc~ there exist clauses C 1 , . . . , C,~ in N and corresponding ground substitutions ~ 1 , . . . , o-n such that (i) { C ~ r l , . . . , C~¢~} ~ C~r and (it) (C, o-) ~-' (Ci, ~ri), for all i with 1 < i < n. This notion of redundancy is quite general and encompasses a number of mechanisms for simplifying and eliminating clauses. Tautology elimination.

A tautology is evidently redundant in any set of clauses N.

S u b s u m p t i o n . If a clause C properly subsumes another clause D, then there exists a substitution ~r such that (D, r) ~-' (C,~r~-) and Ccrr ~ D r , for all substitutions ~-. Therefore, if N contains clauses C and D where C properly subsumes D, then D is redundant and can be deleted from N. C o n t e x t u a l r e d u c t i v e r e w r i t i n g . If C is a clause and N is a set of clauses, let in the following N~c denote the set of all substitution instances D~r of clauses D in N such that (C, ~) ~-' (D, e), with ~ denoting the identity substitution. Let C = r , A[up] a (or C = r zx, A[up]) be a clause in N and let 7- be a skolemizing substitution (which replaces each variable by a new constant). Suppose that there exists a clause D = A ~ u ~ v, II in N, such that (i) u ~- v, (ii) Dp E Y l c , (iii) ( Y l c ) r ~ Pv --~ spr ~ tpr, for any s ~ t in ,,1 and (iv) ( N I c ) r ~ spy ~ tpT" --* A t , for any s z t in II. Then C can be simplified to C ' = F, A[vp] --~ A (or C ' = F --~ A, A[vp]). In other words, if C f is added to the set of clauses then C can be deleted afterwards. Replacing C by C t is a generalization of simplification by contextual and reductive conditional rewriting as described by Ganzinger (1987) in the context of a completion procedure for conditional equations. The contextual aspect is that up and vp have to be equal only for those substitutions that make P true and A false. In practice, proofs of ( N I c ) r ~ F r ~ sp~-~ tp~-, for any s ~ t in A, may be conducted by reductive conditional rewriting with rule instances in N l c , and using the skolemized antecedent Yr as additional rewrite rules. Reductive conditional rewrite rules D in N do not have an occurrence of the maximal term in the antecedent. If they match a proper subterm in C, the corresponding substitution instances belong to N I c . The ordering ~-' as defined above places too hard a restriction on rewriting occurrences of the maximal term up of C in a positive literal of C. In this case vp must be smaller than the smaller term t in A[u]p = up ~ t as otherwise Dp would not be in N l c . A slightly more complex ordering on clause-substitution pairs exists which would allow to rewrite the root of up, regardless of the size of vp, if II = 0, Dp is reductive for up ..~ vp and if u is a proper prefix of up. 1One cannot replace this condition simply by "NIc ~ F --* sp ~. tp." When proving that F implies Ap one must not instanti~te clauses in NIc by too big substitutions.

439

E l i m i n a t i o n o f r e d u n d a n t a t o m s . Let C : F , u ~ v -~ A be a clause in N and let v be as above. If for n -- F -~ u ~ v , A we can show that ( N l c ) r ~ D~-, then C can be simplified to C' :- F --* A. A particular case is the elimination of multiple occurrences of atoms in the antecedent, ff C = r , u ~ v, u ~ v --~ A, then the clause F, u ~ v -~ u ~ v, A is a tautology and hence trivially implied by N l c . In a similar way, redundant atoms in the suecendent can be eliminated. Let 7~ be a set of inference rules. We say that a set of clauses N is closed under 7£ up to redundancy if and only if there exists a set N', such that (i) N C_ N ' , (ii) any clause in N' \ N is redundant in N ' , and (iii) N ' contains all clauses obtained from N by an inference rule in 7~. In this case we also say that N is closed relative to N' under 7Z. T h e o r e m 3 Let N be a set of clauses which is closed under S (or Y:) up to redundant

clauses. Then N is unsatisfiable if and only if it contains the empty clause. P r o o f If N contains the empty clause it is unsatisfiable. Let us now assume that N is closed relative to N ' and construct the interpretation I from N'. We show that if the empty clause is not in N' (and hence not in N as the empty clause is not redundant), [ is a model of g ' (and of N). If (C,~r) is a minimal (wrt. >-') ground instance of a clause in N ' such that C~r is false in I, C cannot be redundant in N'. Moreover, if C a is a clause which generates a rule s ~ t we can always choose the minimal such C in the subsumption ordering. Then, if we may additionally assume that I is a model of all ground instances of clauses in N ' with a maximal term smaller than s, C cannot be redundant either. For if C is redundant, there exist ground instances C ~ ' 1 , . . . , C~a,~ of clauses in N ' such that C a >.c C~r~. The Cicr~ are then valid in I c . For if they contain s in the antecedent, the antecedent is false in I c . If s occurs in the succedent of C~c~ but not in the antecedent, Cicri is true in Iv as otherwise C/ai would have generated a rule for s. Finally, if s does not occur in a Cic~i, C~ri is true in I v as it is true in I. But, then, Ccr would also be true in Iv, hence not generating a rule. With these additional facts, the proof for Theorem 1 can be used as a proof of the present theorem, provided that Lemma 6 can be extended, too. It is possible to prove (a version) of Lemma 6 for sets of clauses N which are closed under S up to redundancy, with the additional assumption that I is a model of all ground instances of clauses in N with a maximal term smaller than s~ for s as in L e m m a 6. The proof makes again use of the fact that clauses which generate rules are not redundant. [] To construct a set of clauses that is closed under 7~ up to redundancy, we may proceed as follows. A finite or countably infinite sequence No, N1, N ~ , . . . of sets of clauses is called a theorem proving derivation in T~ if and only if Ni+l results from Ni either by adding some clause which is implied by N~, or else by deleting a redundant clause from Ni. By Noo we denote the set Uj Nk>j Nk of all persisting formulas. A derivation is called fair if any clause that can be deduced from N ~ by 7£ (in one step) is contained in some set Nj. In other words, fairness requires that that inference rules be exhaustively applied to persisting clauses. Apart from these requirements it may be useful to freely add other clauses (in a sound way) if this triggers subsequent deletions of more complex clauses. The composition of two such steps can be considered as one step of simplification of the complex clause.

440

L e I n l n a 7 If No, Nx, N2,... is a fair theorem proving derivation in S (or iT), then Noo

is closed up to redundant clauses. Hence, No is inconsistent if and only if the empty clause is in some of the Nj.

10

Summary

In this paper we have been able to shed some new light on the refutation completeness of restrictions of ordered paramodulation. We have introduced a calculus of strict superposition and proved its refutation completeness for Horn clauses. We have also demonstrated that this completeness property does not extend to the full first-order case. Fortunately, some moderate enrichments of the calculus suffice to achieve refutation completeness for general first-order clauses. We have proposed two such enrichments, represented by the inference rules of merging paramodulation and equality factoring, respectively. We have left open the question as to whether superposition with tautologies, though of little worth in practice, would form a refutationally complete enrichment of the strict superposition calculus, too. We have chosen to consider clauses as pairs of multisets of atoms, rather than sets, as this more closely reflects actual implementation practice and at the same time allows a more precise investigation as to where factoring is needed and where not. In particular, we have shown that factoring in the antecedent is not needed, at the expense of a slightly more liberal strict superposition rule. Besides these improvements of previously known completeness results, another contribution of this paper is our technique for constructing a model for a consistent set of clauses via a canonical rewrite system. The technique admits comparatively simple completeness proofs based on elementary properties of canonical rewrite systems. In particular we have been able to include a rather general notion of redundancy for clauses in the strict superposition calculus without complicating the completeness proofs too much. We have briefly indicated how various simplification and deletion techniques (such as subsumption, contextual rewriting, and elimination of redundant atoms) can be formulated within this framework. The completeness results of this paper are based on one particular proposal of how to lift the ordering on terms to an ordering of clauses. In Bachmair and Ganzinger (1990) a slightly different, and perhaps preferable, ordering is given in which occurrences of a term in the antecedent of a clause have more weight than occurrences in the succedent. As a consequence, there are corresponding slight variations in the definition of strict superposition. It can be shown that strict superposition in this latter sense is refutationally complete without any extensions such as merging paramodulation or equality factoring, and is also compatible with the elimination of redundant clauses. In fact, the notion of redundancy which we propose in (Bachmair and Ganzinger 1990) is even more powerful than the one given above as it refers to inferences rather than to clauses and hence takes into account of how a clause is generated from (larger) parent clauses.

References [1] BACHMAII¢, L., DERSHOWITZ, N., AND PLAISTED, D. 1989. Completion without failure. In Resolution of Equations in Algebraic Structures, vol. 2, ed. H. Ait-Kaci

441

and M. Nivat, 1-30. Academic Press. [2] BACHMAII~, L., AND GANZINGER, H. 1990. Completion of first-order clauses with equality by strict superposition, In Proc. Second Int. Workshop on Conditional and Typed Rewriting Systems. Leer. Notes in Comput. Sci. Berlin, Springer-Verlag. To appear. [3] GANZINGER, H. 1987. A completion procedure for conditional equations, tn Conditional Term Rewriting Systems, ed. S. Kaplan and J.-P. Jouannaud, 62-83. Leer. Notes in Comput. Sci., vol. 308. Berlin, Springer-Verlag. To appear in J. Symbolic Computation. [4] I-IsIANG, J., AND RUSINOWITCH, M. 1987. On word problems in equational theories. In Proc. l$th ICALP, ed. T. Ottmann, 54-71. Lect. Notes in Comput. Sei., vol. 267. Berlin, Springet-Verlag. [5] HSIANG, :I., AND RUSINOWITCtt, M. 1989. Proving refutational completeness of theorem proving strategies: The transfinite semantic tree method. Submitted for publication. [6] HUET, G. 1980. Confluent reductions: Abstract properties and applications to term rewriting systems. J. ACM 27:797-821. [7] KNUTH, D., AND BENDIX, P. 1970. Simple word problems in universal algebras. In Computational Problems in Abstract Algebra, ed. J. Leech, 263-297. Oxford, Pergamon Press. [8] KOUNALIS, E., AND RUSINOWlTCH, M. 1988. On word problems in Horn theories. In Proc. 9th Int. Conf. on Automated Deduction, ed. E. Lusk and R. Overbeek, 527-537. Lect. Notes in Comput. Sci., vol. 310. Berlin, Springer-Verlag. [9] LANKFORD, D. 1975. Canonical inference. Teeh. Rep. ATP-32, Dept. of Mathematics and Computer Science, University of Texas, Austin. [10] ROBINSON, G., AND Wos, L. T. 1969. Paramodulation and theorem proving in first order theories with equality. In Machine Intelligence 4, ed. B. Meltzer and D. Michie, 133-150. New York, American Elsevier. [11] RUSlNOWITCtI, M. 1988. Theorem proving with resolution and supetposition: An extension of the Knuth and Bendix procedure as a complete set of inference rules. Submitted for publication. [12] Wos, L. T., ROBINSON, G. A., CARSON, D. F., AND SHALLA, L. 1967. The concept of demodulation in theorem proving. J. ACM 14:698-709. [13] ZI~ANG~ H. 1988. Reduction, superposition and induction: Automated reasoning in an equational logic. Ph.D. diss., Rensselaer Polytechnic Institute, Schenectady, New York. [14] ZHANG, H., AND KAPUR, D. 1988. First-order theorem proving using conditional rewrite rules. In Proc. 9th Int. Conf. on Automated Deduction, ed. E. Lask and R. Overbeek, 1-20. Lect. Notes in Comput. Sci., vol. 310. Berlin, Springer-Verlag.

Simultaneous Paramodulation Dan Benanav New Jersey Institute of Technology Computer and Information Science Department Newark, New Jersey 07102 Email: [email protected]

Abstract In this paper we present a variant of paramodulation, called s-paramodulation, that simultaneously replaces certain subterms that unify with the "into-term" by an instance of the "from-term". We show that in contrast to ordinary paramodulation, the lifting lemma holds for s-paramodulation. We also show that s-paramodulation in conjunction with resolution is refutationally complete in the ground case. Completeness in the general case follows easily from the lifting lemma and the ground case.

1

Introduction

There are several ways to use resolution-based systems for theorem proving with equality. By adding axioms for transitivity, reflexivity, commutativity and substitution, the resolution inference rule alone suffices. Alternatively, other methods such as paramodulation, E-resolution and RUE-resolution build the equality axioms into the inference rules and use resolution in conjunction with those rules. In [7] an inference rule is formulated that encompasses both resolution and paramodulation. In this paper we present a form of paramodulation in which terms are replaced simultaneously, in contrast to paramodulation where terms are replaced one at a time. We call this form of paramodulation, s-paramodulation. Although the lifting lemma does not hold for paramodulation we show that it holds for s-paramodulation. By slightly modifying a proof found in [7] we are able to show that s-paramodulation in conjunction with resolution is complete in the ground case. Completeness in the general case follows easily from the ground case and the lifting lemma. Some theorem proving systems appear to offer paramodulation with simultaneous replacement [3]. However, more experiments are required to determine if the method improves the performance of such systems. In addition to this potential improvement, we

443

believe the results will be useful in proving other conjectures. In particular, to show completeness of a strategy one can a t t e m p t to show that s-paramodulation can be simulated. In [1] we show an example of one such conjecture. To prove claims about s-paramodulation it is often necessary to make statements involving sets of positions within terms. These statements can become rather long. To shorten and simplify the presentation of such proofs we have introduced a notation for referring to sets of terms that satisfy certain properties. We present this notation in section 2.2.

2

Notation

We will briefly describe notational conventions used in this paper. For a more complete description see [5]. Terms are constructed in the usual manner using variable, function and predicate symbols. Positions of subterms are denoted by strings of natural numbers. The e m p t y string wilt be denoted by 0. Two positions are independent if neither is a prefix of the other. A set of positions is independent if they are pairwise independent. The subterm at position n of a term t is denoted by t/n. For example if t = f(x, (g(y))) then t/(1) = x, t/(2, l) = y, and t/O = t. We use tl[n #-- t2] to denote the term obtained by replacing tl at position n by t2. If N is an independent set of nodes then tl[N ~-- t2] denotes the term obtained by replacing tl at all positions in N by t2. The set of variables in a term t or a set of terms S is denoted by Vars(t) or Vats(S) respectively. The set of positions that occur in a term t is denoted by dora(t). The set of positions of a term t where a nonvariable subterm occurs is denoted by sdom(t). Atoms and literals are defined in the usual way. A clause is a set of literals. We will sometimes write a clause of the form { L 1 , . . . , L,~} as L1 V . . . , V L,~. If C1 and C2 are clauses then (C1 V C2) = (C1 U C2) In addition we sometimes write VAeC F(A) to denote UAec{F(A)} where F(A)is an expression that depends on A.

2.1

Substitutions

and

Unification

A substitution is a mapping 0 : Terms ~ Terms such that O(c) = c if c is a constant, and if t = f ( t l , . . . , tk), then O(t) = f(O(tl),..., O(tk)). Thus a substitution is determined by its values on the variable symbols. Bowing to common usage, we write tO instead of O(t). If O and ¢ are substitutions, then 0¢ = ¢ o O. It follows that if O, ¢, and ¢ are substitutions and t is a term, then ¢(0¢) = ( ¢ 0 ) ¢ and t(0¢) = (t0)¢. For any set of terms S, SO = {tOlt E S} The substitution, e, defined by e(x) = x for all x E 13, is called the identity substitution. For any substitution 0,

Lvar (O) = {v VivO # v} Rvars(O) = {v e l;I(3u e Lvars(O))(v e Vars(uO))} Vars(O) = Lvars(O) U Rvars(O)

444

For any substitution 8 and any V C P the projection of 0 to V, denoted by 8 J~ V, is given by xO for x E V (8~V)(x)= x forxeV It follows from this definition that if S is a set of terms and Vars(S) C V then S(8 V) = Se. D e f i n i t i o n 2.1 Suppose 0 is a substitution. Then 8 is a variable substitution if and only if for a l l y E P, v8 ~ P. 8 is a permutation if and only if the restriction of 8 to 12, 8 y : ]~ --* ~, is a bijection. T h a t is, for all v, v' E ~, v8 E ~ and v8 = v~8 implies v = v'. Note that the identity substitution, e, is a permutation. Also for any permutation e it is easy to show that there is a unique permutation ¢-1 such that e = ¢~-1 = ¢-~s. For any permutations ¢1 and s2, cle2 is a permutation. D e f i n i t i o n 2.2 Let S be a set of terms and 0 a substitution. Then 0 is a unifier of S if and only if SO is a singleton. S is unifiable if and only if there is a unifier of S. A substitution 0 is an most general unifier(m.g.u) of S if and only if 0 is a unifier of S and for all A, if A is a unifier of S then there exists a A~ such that 0 = AA~. L e m m a 2.1 If a set of terms S is unifiable then there exists an m.g.u, of S such that

Lvars(O) C__Vats(S). PROOF: See Robinson unification algorithm, o Any such m.g.u, that satisfies the conditions of this lemma will be called a standard

unifier. The following ]emma is easy to prove. L e m m a 2.2 If 0 is an m.g.u of a set of terms S then for any permutation ¢, 0c is an m.g.u of S. D e f i n i t i o n 2.3 A clause C1 subsumes a clause C2, denoted by C1 E C~, if and only if there exists a substitution 0 such that CIO C C2.

2.2

Position

Sets

The position set notation introduced here facilitates references to sets of positions within terms that satisfies certain properties. For example, b/e(tl, t2) denotes all positions within t2 in which there occurs a subterm equal to tl. U(tl, t2, 0) denotes all positions in within t2 which become equal to tl after applying the substitution 0 to t2. sbl(tl, t2, O) denotes all nonvariable positions in within t2 that become equal to tl after applying 0 to t2. Finally, vN(tl, t2, O) denotes variable positions within t2 that contain a subterm equal to tl after applying O to t~.

445 D e f i n i t i o n 2.4 For any terms tl, and t~, and any substitution 0,

U(tl,t~,O)

=

U~(tl,t2)

~- U ( t l , t 2 , £ )

sl.t(tl,t2,0) vU(t,,t2,0)

= =

Note that U e ( t l , t : ) = {u E

{u e dom(t2)l(t:lu)O = t,} {u E sdom(t2)I(t~lu)O = tl} {u E vdorn(t2)]Ue(tl, (t2/u)O) ~ ft}.

dom(t2)lt2/u = tl}.

Example 2.4.1 With

t = f(x,g(~), g(z),g(~)), all d

0 = {~ ~- b , z ~- b,x ~- g(b)} then tO =

and

f(g(b), g(b), g(b), g(b))

u~(g(y),t)

=

{{2},{4>}

udb, t)

=

0

u(g(b), t, o) = ~u(g(b), t, o) = vU(b, t, o) =

{(i),<2>,<3>,<4>} {(2>,{3},{4>}

{{I},{2,1>,(3,1),<4,1}}

The following temma is easy to prove.

Lemma 2.3 U(tl, t2, 0), sbt(t,, t2, 0), vl~(t,, t2, 0), and/de(Q, t2) are independent sets.

3

S-paramodulation

Suppose that C1 is a clause of the form Lx VCu and that C2 is a clause of the form s = t V C~1. Suppose also that some nonvariable subterm, L1/u, of L1 unifies with s and that a is the m.g.u, of La/u and s. Then by paramodulation we can derive the clause,

Lla[u ~- ta]

V Cua v

C::.

For example, consider the ground clauses,

f(a, b) = b v

P(f(a, b), f(a, b))

V

R(c)

(el)

Q(f(a,b)).

(c2)

By paramodulation we can derive any clause obtained by replacing one occurrence of f(a, b) in c2 by b and adding the literal R(c) to the resulting clause. One such clause is

P(b, f(a, b)) V Q(f(a, b)) V R(c).

(c3)

446

From this clause and cl the clause

P(b, b) V Q(f(a, b)) V n(c)

(c4)

can be derived. Finally, fl'om this clause we can derive

P(b, b) V Q(b) V R(c).

(c5)

In this last clause all occurrences of f(a, b) have been replaced by b. In c2 there are three occurrences of the term f(a,b). It is not hard to see that seven paramodulants can be derived from this clause and cl, corresponding to any nonempty subset of these occurrences. We will show that only the clause cs, in which all occurrences of f(a, b) have been replaced, need be derived. It-is well known that resolution (with factoring) and paramodulation form a complete set of inference rules for theorem proving with equality [4]. We will show that resolution and s-paramodulation also form a complete set of inference rules. We have illustrated s-paramodulation where clauses are ground. To illustrate the rule for non-ground clauses consider the clauses

P(f(x, b), f(x, b)) V Q(f(a, b)) (c~) f(a, y) = a V Q(y). (c7) Since f(a, y) unifies with f(z, b) with m.g.u, a = Ix ~ a, y ~ hi, then by paramodulation we can derive the clause

P(a, f(a, b)) V Q(f(a, b)) V Q(b). Note that the result of applying a to c6 is

P(f(a, b), f(a, b)) V Q(f(a, b)). By paramodulation the first occurrence of f(a, b) is replaced with a. In s-paramodulation we require that all occurrences of f(a, b) be replaced with a, giving the clause P(a, a) V Q(a) v Q(b). Also note that f(a,y) unifies with paramodulation the clause

f(a,b) with m.g.u, al = [y *- hi. Therefore by

P(f(x, b), f(x, b)) V Q(a) v Q(b) can be derived. The result of applying al to c6 is just the clause c6 itself. This clause has only one occurrence of f(a, b) and therefore, in this case, s-paramodulation and paramodulation yield the same clause. Using ordinary paramodulation seven clauses can be derived from c6 and cr. By s-paramodulation only two clauses are derived. For s-paramodulation to be complete factoring must be done. For purposes of clarity, we first define the notion of a clause overlap. The clause overlap is s-paramodulation without factoring. Assume that C and t = r V C1 have no variables in common. Let r be a nonempty set of nonvariable subterms in C that unify with l and let ,~ be the most general unifier (m.g.u.). Let C" be the clause formed by replacing every occurrence of l), in CA by rA. Then C" V C1A is a clause overlap of C and l --~ r. We formally define this using position set notation as follows:

447

D e f i n i t i o n 3.1 ( C l a u s e O v e r l a p ) Let C and C' be clauses, and let R be a clause of the form l = v V C1, then C' is a clause overlap of C and R if and only if there is an R', a set of terms F, and a substitution A such that F is a set of nonvariable subterms in C, R' is a variant of R of the form l' = r' V C~, where Vars(R') f3 Vats(C) = 0, A is an m.g.u. of F U {l'}, and

C ' = ( V AA[He(I'A, AA) *-r'A]) V C, A.

(1)

AEC

It is not hard to show that if C' is a clause overlap of C and R then any variant of C' is a clause overlap of C and R. In addition, for any variant of C and any variant of R, the set of clause overlaps of C and R is the same. D e f i n i t i o n 3.2 ( S - p a r a m o d u l a t i o n ) C is an s-paramodulant of C2 into C1 if and only if C2 is of the form C21 V C22 and there is a 0 such that 0 is an m.g.u of C21, C210 is of the form {1 = r ) or {r = l), and C is a clause overlap of C, and l = r V C220. Suppose that the clause C2 in the definition above is of the form l = r V C22 and that no nonvariable subterm of C1 unifies with I. In that case, it is still possible, according to the definition of clause overlap and the definition given above, to derive clauses of the form

C1 V C;2 where C~2 is an instance of C22. Obviously such a clause is subsumed by C;. This definition of s-paramodulation makes certain proofs easier, obviating the need to consider certain cases. All the completeness results still hold if we do not allow such derivations. Recall that an interpretation i s a mapping I :/3 = {T, F} where/3 is the set of ground atoms. An E-interpretation I of a set of clauses is an interpretation which satisfies for all s, t, L E/3,

1. I(s = s) = T, 2. If L/u = s and I(s = t) = T then I(L) = I(L[u ~-- t]). Two results which immediately follow from this definition are, for all t, s, a E/3,

1. I(s = t) = I(t = s), and 2. If I(s = t) and I(t = a) then I(s = a). A set of clauses S is E-satisfiable if and only if there is an E-interpretation that satisfies all clauses in S. Otherwise S is E-unsatisfiable. We intend to show that if S is E-unsatisfiable then there is a refutation proof from S U {x = x} that uses only resolution and s-paramodulation rules of inference. In order to show this we will show it holds for the ground case and use a lifting lemma to show the general case.

448

3.1

Lifting L e m m a for S-paramodulation

The following is a general form of the lifting lemma for resolution that is well known. L e m m a 3.1 ( L i f t i n g L e m m a ) If C1 E_ C~ and C2 E C~, and if C' is a resolvent of C[ and C;, then either

1. C1E C' or 2. 02 E C' or 3. there exists a resolvent C of C1 and C2 such that C E C'. The lifting lemma can be used lift a proof of ground clauses to a more general proof. Unfortunately, the lifting temma does not hold for ordinary paramodulation. For example, consider the clauses

Q(x,x,f(z)) Q(f(a), f(a), f(a))

(Cs)

(c9)

a = b

(clo)

Q(f(b), f(a), f(a)).

(eii)

cll is a paramodulant of c9 and cl0. There is no paramodulant that can be formed from Cs and cl0. Also Cs does not subsume cll. For s-paramodulation this same problem does not occur since all occurrences of a in Cil are replaced, giving the clause Q(f(b), f(b), f(b) ).

(el2)

This clause is an instance of cs. L e m m a 3.2 ( S - p a r a m o d u l a t i o n L i f t i n g L e m m a ) Suppose that C1, C2, C~, C~ and C' are clauses such that C' is an s-paramodulant of C~ into C~, C1 U C~ and C2 E C; then either C2 E C ~or there exists an s-paramodulant, C of C2 into C1 such that C _ C t.

In order to prove the lifting lemma we will need two lemmas concerning the clause overlap. This first lemma shows that if C' is a clause overlap of a C and R and R" is a variant of R then C' is also a clause overlap of C and R". L e m m a 3.3 Let C' be a clause overlap of C with a clause R of the form l = r V C1 and R" a variant of R of the form l" = r" V C~' such that Vars(R") f3 Vars(C) = 0. Then there is a ~ such that A is an m.g.u of

( U A/sU(l")~,A, A)) U{l"} AEC

and C'

=

(VAec AA[sU(I")~, A, ~) ~ r"A]) V C~')t.

449

Suppose that C is a clause and I -* r V C1 is a clause with no variables in common. For any substitution 0 there may be severM subterms in CO that are equivMent to the term lO. Let C" be the clause obtained by replacing all occurrences of lO in CO by tO. The following lamina states that there is a clause overlap C' of C and l --* r V C1 such that C ~ is an instance of the clause consisting of literals in C" and literals in CaO. L e m m a 3.4 Let C be a clause, and R a rule of the form I --* r V C1 where Vats(R) fq Vats(C) = 0; then for any substitution 0 there exists a C j and a substitution 3' such that C ~ is a clause overlap of C with R and

C'7 = ( V AO[lge(lO,AO) ~ re]) V CIO.

(2)

\AEC

For a proof of these two lemmas see [1] P r o o f : ( L i f t i n g L e m m a f o r S - p a r a m o d u l a t i o n ) Since C' is an s-paramodulant of C~ into C~ then C~ is of the form C~1 V C ~ and there is a substitution 9 and an R such that I I 9 is an m.g.u of C~, C~9 is of the form {l = r}, R is of the form I ~ r V C~20, and C I is a clause overlap of CI and R. Let R t be a variant of R such that

Vars( R') A (Vars(C~) U Yars(C1))

= 0.

(3)

Let c be such that Rz = RL Then by lemma 3.3 there is a ~ such that

C'=(ycAX[ble(le)~,AA)~--re,k])VC~20¢~. A

(4)

I

Now since C2 G C~ there is a al, a C21 and a C~2 such that

C2 = C21 V C22,

c Ch,

(5)

and

C2~2 c_ G2. Also since C1 G C~ there is a al such that

C1~'i c_ G We can ,~sume Lva,'s(~,) C_ Yar4Cl). If C2~ = 0 then C~

= C22~ C_ G . .

From which it follows that

C~a2Oe~ c_ C~Oe~ c_ C'. In which case C2 C C ~ and the result follows. On the other hand, if C21 ~ 0 then from 5.

C21~2&GChOe.

450 Since C~10 is a unit clause and since C21 is not empty it follows that C2zcr20e is a unit clause. Therefore a20e is a unifier of C21 and

C21a20e = C;lOe. Let 01 be a m . g . u of C21 such that

Yars(C~01) n ( V , - ' 4 C l o - , ) u V a , ' 4 C l ) = 0 Note that C2101 is a clause of the form {1" = r"} Since 01 is an m.g.u it follows that there is a O~ such that

010~ = a@e. It follows that

c~,olo~

II

(6)

/

:

{ r ' = r }01

:

C210"20e

:

ct210e :

{le : re}

From this it follows that 1I I 01! = le

r v, = re and from 6

C2~010~ = C22a20e Let 0 i' = O~ ~ Vats(C201). Now we can apply lemma 3.4 to C1, to R", where R" is a rule I! of the form l" = r" V C2201, and to the substitution al01X By that lemma there is a 7 and a C such that C is a clause overlap of C1 and R" and

C7 =

AalO l`k[uc(l alO l`k, AalO~'`k) ~-- r"alOi'`k ] V ~22 , 1via A

z

C is an s-paramodulant of C2 into C1. We will show that C E_ C' and therefore the result holds. Note that for all A E C1, AalO~' = A a l , l'al = l", r"al = r", and C2201al = C2201. From this we get,

C')'

= = =

(VAec, Aal`k[lJe(l"Of`k, Aal`k) ~- r"Ol`k]) V C220101`k (V..,~c, Aol`k[U~(le`k, A~l`k) ~- ,-~`k]) v c~2~oe`k (VA~o,,, A`k[U~(Ze`k, A`k) ~- re`k]) V C2~,,~0e`k

Now since

C2~a2Oe`kc_ C;~Oe`k and since

Clal c_ C; it follows that C"/ Et

C (VAecl A`k[Lle(le`k, A`k) ~ re,k]) V C~20e`k _-_ C /

451

3.2

Completeness

of Resolution

and

S-paramodulation

In order to show completeness in the ground case we will use a result by Zhang [7]. Zhang defines a rule of inference called clausal superposition which combines resolution and paramodulation and shows, in the ground case, clausal superposition constitutes a complete inference rule for first-order theorem proving with equMity. By a slight modification to the definition of clausal superposition the result for s-paramodulation will follow. We will briefly review some background for this result. For more information the reader should refer to [7]. To combine resolution and paramodulation, clauses are viewed as conditional rewrite rules. Rewrite rules are made from clauses according to a given reduction ordering. A reduction ordering is a partial order that is well-founded, monotonic and stable. In the case of ground clauses we assume the reduction ordering is total. Each literal in a clause is represented by an equality. Positive literals of the form P ( h . . . G ) where P is not the equality symbol are represented by P ( t l . . . t~) = true. Negative literals of the form ~ P ( t l . . . t,~) where P is any predicate symbol (including equality) are represented by P ( h • .. t~) = false. Literals of the form A = B remain unchanged. Under the reduction ordering, ~-, these literals become rules such as P ( t l . . . tn) -* true, P ( t l . . . t,~) --* false and A --- B, where A ~ B. In the ground case, since the reduction ordering is total, each clause C contains a literal L such that for all L' in C, L ~- L'. The literal L is said to be maximal. For any ground clause C of the form

L~ V . . . V Li-I V Li V Li+] .. • V, L,~ the rule

lhs(Li) -~ rhs(Li) if {-~L1,...,-~Li_,,-~Li+,...,-~L,} is formed, where L~ is the maximal literal in C and lhs(L~) --~ rhs(L~) is the rule form of L~. The literal lhs(Li) -4 rhs(L~) is called the head of the rule and the literals {-~L1, • •. -~Li_l, -~Li+l... L~} are the premises or condition of the rule. E x a m p l e I Consider the clause

P(a) V (f(a) = a) V (g(a) ~ a). If P(a) )-- ( f ( a ) = a) and P(a) ~- (g(a) 7g a), then the rule

P(a) --* true if {(f(a) ~ a), (g(a) = a)} is formed. If P = {L1, L 2 , . . . , Ln } is a set of literals we write -,P to denote -,L1 V -,L2 V ... V -,L,~.

452

D e f i n i t i o n 3.3 Let C1 be a rule of the form,

lhsl --* rhsl if P1 and let C2 be a rule of the form,

lhs2 --~ rhs~ if P2 If u E sdom(lhsl) and a is an m.g.u, of lhsl/u and lhs2 then by clausal supevposition the clause

(lhs,[u ~-- rhs2] = rhsl)a V -~P,a V -~P2a can be derived. The result of a clausal superposition is called a critical clause. If C1 and C2 are ground then by clausal superposition we replace a single occurrence of lhs2 in lhsl by rhs2. We will modify the definition of clausal superposition so that all occurrences of lhs2 in C1 are replaced with rhs2. E x a m p l e 2 Consider the clauses,

P(a) --~ true if {(f(a) # a), (g(a) = a)} P(a) ---* false if {(f(a) = g(a))}

(c13)

(c~4)

From these we can form the critical clause,

(true = false) V (f(a) = a) V (g(a) # a) V (f(a) # g(a)). This clause is equivalent to the clause,

(f(a) = a) V (g(a) ~ a) V (f(a) ~ g(a)). Note that this is equivalent to just resolving c13 and c14. E x a m p l e 3 Consider the clauses,

f(a) ~ a if {(g(a) = a),-~Q(a)} (f(a) = g(a)) --* false if {P(f(a), f(a))}

(c15) (C~s)

From these we can form the critical clause,

((a = g(a)) = false) V -~P(f(a), f(a)) V (g(a) # a) V Q(a) This is equivalant to a paramodulation of c15 into c16. Now we present the formal definition of the modified clausal superposition in the ground case.

453

D e f i n i t i o n 3.4 Let rl be a ground rule of the form, lhsl --* rhs2 if P1, and let C1 be the clause form of rl. Suppose that C2 is a ground rule of the form, lhs2 ~ rhs2 if P2. If there exists a subterm s of lhsl such that s = lhs2 then by A-clausal superposition the clause

can be derived. E x a m p l e 4 Consider the clauses c15 and Cx6 from example 3. Using A-clausal superposition we can derive

((a = g(a)) = false) V -~P(a, a) V (g(a) 7~ a) V Q(a) This differs from clausal superpostion since all occurrences of f(a) in c16 are replaced with a.

in addition to clausal superposition certain trivial reductions of clauses are performed. For example the literal true = false reduces to false. Any clause of the form true V C reduces to true, and any clause of the form false V C reduces to C. The clause containing only the literal false is the empty clause. In addition, any literal of the form t = t reduces to true. Zhang shows the following theorem: T h e o r e m 3.1 If S is an E-unsatisfiable set of ground clauses then the empty clause can be derived from S using only clausal superposition and t h e trivial reductions. We will show the following theorem: T h e o r e m 3.2 If S is an E-unsatisfiable set of ground clauses then the empty clause can be derived from S using only A-clausal superposition and the trivial reductions. Since the proof of this theorem requires only a slight modification of the proof of theorem 3.1 given in Zhang's thesis, we will not present the entire proof here 1. The basic structure of the proof remains the same. Only Lemma 3.2.4 needs to be proved. That lemma states, L e m m a (3.2.4. of Z h a n g ' s thesis) If r~ and rj of R have a critical clause, n > j and the head of rj is assigned the value true, then II~_l(r,~) = true. PROOF: Let rj be of the form Ihsj ---+rhsj if Pj and let c~ be the clause corresponding to r~ Because r~ > rj the critical clause of r~ and rj is a clause ck of the form,

(AYcn

A[lde(lhsj,A)~--rhsj])V'~Pj.

1The basic idea for this modificationcame from Zhang in a private communication.

454 It is clear that r~ >s ck. If ck is trivial then ck has the true value in every interpretation. Otherwise, let rk be the rule made from ck. Then k < n and by the induction hypothesis II~_~(rk) = true. In both cases II(ck) = true and therefore for some literal L E ck II~_I(L) = true. There are two cases: 1. There is an A E c, such that L is of the form, A[Dle(lhsj, A) ~-- rhsj]. This implies II~_l( A[Ue( lhsj, A) *- rhsj]) = true. Moreover, because IIn_l ( lhsj = rhsj) = true, then H._I(A) = II~_l(A[btc(lhsj, A) ,-- rhsj]) = true Therefore II~_t(r~) = true.

2. L C -~Pj. This is impossible because in this case Pj has the value false and the head of rj does not need to be assigned the value true. [] The rest of the proof is the same and therefore theorem 3.2 holds. It would be possible to modify the general definition of clausal superposition and show that this modified clausal superposition along with reflexivity and factoring constitute a complete set of inference rules for first-order theorem proving with equality. Here, we show s-paramodulation and resolution constitute a complete set of inference rules. The proof for a modified clausal superposition would basically be the same. Using the s-paramodulation lifting lemma and theorem 3.2 the following theorem is easy to prove. T h e o r e m 3.3 Let S be an E-unsatisfiable set of clauses then there is a refutation proof from S U {x = x} using only resolution and s-paramodulation.

References [1] D. Benanav. Recognizing Unnecessary Inference. PhD thesis, Rensselaer Polytechnic Institute, 1989.

[2]

D. S. Lankford. Some approaches to equality for computational logic: A survey and assessment. Memo ATP-36, Automatic Theorem Proving Project, University of Texas, Austin, 1977.

[3] W. McCune. Otter 1.0 users' guide. Technical Report ANL-88-44, Argonne National Laboratory, Argonne, IL, January 1989. [4] G. Peterson. A technique for establishing completeness results in theorem proving with equality. SL4M J. Computing, 12(1):82-99, February 1983. [5] G. Peterson and M. Stickel. Complete sets of reductions for some equational theories. Journal of the Association for Computin 9 Machinery, 28(2):231-264, April 1981.

455

G. Robinson and L. Wos. Paramodulation and theorem-proving in first-order theories with equality. In B. Meltzer and D. Michie, editors, Machine Intelligence 4. Edinburgh University Press, 1969.

[7] H. Zhang.

Reduction, Superposition ~ Induction: , Automated Reasoning in an Equational Logic. PhD thesis, Rensselaer Polytechnic Institute, August 198':+

H y p e r R e s o l u t i o n and E q u a l i t y A x i o m s w i t h o u t Function Substitutions Yusuf Ozturk Lawrence Henschen

Electrical Engineering and Computer Science Department Northwestern University Evanston, IL 60208 U.S.A.

Abstract When hyperresolution used with equality axioms, the function substitution axioms tend to produce myriads of new clauses whenever a positive equality literal is present. The analogue for paramodulation is the large number of potential paramodulants where the "into" term is not at the top level of its literal. ]n this study, we will prove that for some class of clause sets, the use of function substitution axioms can be eliminated. Analogously, paramodulation can be applied to the top level terms only.

1

Introduction

One of the results of the test runs made on the database of 37 Theorem Proving (TP) problems which were obtained from the Argonne National Laboratory in August 1988 showed that hyperresolution, when used with equality axioms, spends a significant amount of time on the expansion of the terms of the equality literals by using the function substitution axioms [3]. The database contained puzzle, algebra, logic and circuit design problems. A second set of experiments was made on those clause sets by removing the function substitution axioms but keeping the remaining equality axioms. The result was an improvement of up to 40% in the time to reach the empty clause for some of the clause sets. The common property of those clause sets was that there were no inner term matches (See Section 2) in the terms of the literals. In this paper, we will describe the inner term match property and prove that if an unsatisfiable clause set has that property then hyperresolution can reach the empty clause without the use of function substitutions. A corollary is that paramodulation into variables not at the top level in literals can be eliminated even when hyperresolution is used [2].

457

Two lemmas are introduced before the theorem. The first lemma replaces all the instances of the term t l with corresponding instances of the term t2 in the hyperresolution steps if t l = t2 is in the clause set. The second lemma proves that if a clause tl=t2

V Q1 v Q 2 . . . V Q n

is one of the parents in a hyperresolution proof step, then we can divide the whole proof into two pieces: resolve all the literals Q1, ..., Qn first and derive t3 = t4; then apply t3 = t4 to the remainder of the deduction.

2

Preliminary

Throughout the text the following syntax is used: • logical operator or:. V. • logical operator not: "~.

• Union: U. • Constants and function symbols: lowercase letters except [u, v, w, x, y, z]. • Variables: lowercase letters [u, v, w, x, y, z]. • Predicate symbols: a capital letter in [E...Z], except U and V, plus =. • Clause: a capital letter in [A...D]. • Clause list or set: a capital letter followed by the capital letter L. A variable or a predicate symbol might be followed by a digit or a lowercase letter. T h e reader is assumed to be familiar with the hyperresolution inference rule [5], setof-support strategy [4] [5] and the concept of equality axioms [1]. D e f i n i t i o n 1 Let S L be a nonempty set of clauses. An inner term match is found in S L if a constant or a function symbol occurs at more than one depth. E x a m p l e 1: T h e following set of clauses is unsatisfiable and there is a hyper proof which derives the e m p t y clause:

1. P ( f ( a ) , b ) 2. " , P ( x , y ) V R ( h ( x ) , g ( y ) )

3.

458

The depths for the constants and the function symbols are as follows: a : 2 (in clause 1) b: 1 (in clause 1), 2 (in clause 3) f : 1 (in clause 1) h : 1 (in clauses 2 and 3) g : 1 (in clauses 2 and 3) In this example, there is an inner term match since the constant b has two different depths.

3

Main Results

L e m m a 1 Suppose that there is no inner term match in CL and there is a hyperresolution refutation for the clause set S L = CL U EL, where EL is the set of equality axioms. If there is an equality clause t l = t2 in SL, and if an instance of tl is a term of any literal in CL or a term or a subterm of any generated literal, then it can be replaced by a corresponding instance of t2 without the use of function substitution axioms. P r o o f : T h e inner term match limits all the occurrences of a constant or a function symbol to the same depth in a clause set. If the clause set S L has a literal t l = t2, and if t l and t2 are constants a n d / o r start with function symbols, then the occurrences of t l and t2 in the original clauses in CL will be at the top level terms of the literals, and t l can be replaced by t2 by use of predicate substitution axioms and without the use of function substitution axioms. Now consider a case when an instance of t l is a subterm of a generated literal P , P ( . . . , f ( t l ' ) , . . . ) . The term tl" can only come from a top level term t l ' of another literal Q in an original clause in SL, say Q ( r l , . . . , t F , . . . ,rn). The literal P can originally only have a variable x or a term f ( x ) in the position corresponding to f(il"), and through the substitutions x is replaced eventually by tl". In the following, if a variable v is replaced by t l (or a subterm o f / 1 if t l starts with a function symbol), and becomes t2 (or a subterm of t2) after the unifying substitutions are applied to the literal Q, then v is considered to be affected. Consider where the original Q(rl, ..., tU, ..., rn) enters the hyper deduction by hyper resolving against -~Q literal. There are three forms where an affected variable x can be found and substituted by t l when Q resolves with -~Q: A. a top level term: e.g.1

Q(tl)

v s . - , Q ( x ) v Q21(x)

e.g.2

Q(tl, x) v Q l l ( x )

vs. -~Q(y, y)

459

B. a subterm of a function: e.g.1

Q(tl)

vs. "~Q(x) v Q21(g(x))

e.g.2

Q(tl,x) V Qll(g(x))

vs.-~Q(y,y)

C. if t l starts with a function symbol, say t l is f(c), then c can be a term or a subterm of a function: e.g.1

Q(f(c))

v s . - , Q ( f ( y ) ) v Q21(y)

e.g.2

Q(f(c),x) v Qll(g(x))vs. -Q(f(y),y)

e.g.3

Q(f(x), x)

vs. ~Q(y, a)

Suppose that the following hyper resolution exists (See the example following this proof for illustrations of steps 1-5 in the following.): Satellites : P l l V P12 V ... V Pln

P21 V P22 V ... V P2n ... P m l V Pm2 V ... V Pmn

Nucleus : - , P l l V -,

1 V ... V - , P m l v Q l l v ... v Qlk

Before resolving the clauses, perform the following steps: Step 1. Find the simultaneous Most General Unifier (MGU) 0 for the unifying literals P l l and - ~ P l l , ..., P m l and -~Pml. Step 2. Locate those variables in Pil (or -~Pil), where 1 < i < m, which will be replaced by tlO and are top-level terms. Apply the predicate substitution axiom together with t l = t2 using t2 as the "from" term to the literal Pil (or -~Pil); this transforms the "into" occurrences of the top-level variable to tl, while the other occurrences of the same variable become t2 (Apply the commutativity axiom and the transitivity axiom together with the clause t l = t2 if Pil is an equality literal. Hence, this step will have two resolution steps for an equality literal). Therefore, if x is a top-level term of Pil, and after the hyperresolution if x would be replaced by tlO, then by applying the predicate substitution all the occurrences of x in a term of any literal involved in this hyper step will be replaced by t2. That is, if a literal has the term g(x), after step 2 that term will be g(t2). The only exception is the top- level term to which the predicate substitution has been applied. T h a t term will be replaced by t 1. Step 3. Locate those variables in Pil (or -,Pil) which will be replaced by e if tl0 is f(c), where f is a function and c is a subterm. This can happen if Pil (or -~Pil) has a term f(x) and 0 replaces x by e. Apply the predicate substitution axiom together with t l = t2 to the term f(x) to make it t2. This will replace all other occurrences of x with c. T h a t is, if a literal has a term h(j(x)), after step 3 that term will be h(j(c)).

460

Step 4. Apply the predicate substitution axiom to all those literals involved in this hyper step which still have an instance of tl as a top-level term and make them corresponding instances of t2. At this point, tl instances can only occur at the top-level positions, since step 2 replaced all the subterm variables with t2 which would have been tl after the original hyperresolution In step 2, we have replaced all the variables which would have been tl with t2, except those top-level terms to which the predicate substitutions are applied. That is, a literal in the derived clause can not have tl as a subterm, since those subterms have already been replaced by t2. The inner- term match limits the occurrences of the tl and t2 to be at the top-level terms of the original clauses if they are constants or start with function symbols. Applying predicate substitutions to a top-level term of a unifying literal might affect the other variables, if the term is in the form f(c), and a variable y is substituted by the subterm c. This can only be possible if there is a term f(y) in one of the unifying literals. Step 3 handles this case by applying the predicate substitution together with f(c) = t2 to the f(y) term, and replaces it with t2 while replacing all the other occurrences of the variable y with c. So all those variables will be replaced by ¢ which would have been c if we did not apply the predicate substitution. The only exception is the top-level f(y) term to which the predicate substitution is applied. It will be replaced by t2. When we perform steps 2 and 3, all the variables will be replaced by t2 which would have been tl otherwise, and all the variables will be replaced by a subterm of tl which would have been that subterm regardless. There still might be some top-level terms which were tl before, or were variables but were replaced by an instance of tl after the predicate substitutions. Step 4 takes care of those terms and replaces them by t2. The new MGU for the hyper inference with the modified clauses is different from the one before steps 2-4, in the sense that the substitutions for the affected variables will be t2 which would have been tl otherwise. Substitutions for the variables affected by subterms of tl remain the same. The clauses are still unifiable, since all the substitutions will be the same except for those variables which would have been tl, and they are replaced by the term t2. Step 5. Do the hyper step with the revised clauses and generate a hyperresolvent. When we apply the procedure explained above, each hyper step will resolve the clauses with the condition that the resolvents can not have tl as a subterm but t2 instead. Since the original clauses can not have tl as a subterm because of the inner-term match requirement, and all the generated clauses will have t2 as the subterms, and the variables will be replaced by an instance of t2 which would have been an instance of tl otherwise, hyperresolution will find a refutation with the revised clauses, r3 E x a m p l e 2: In this example, the procedure described above is applied to each hyper step, and the effects are shown in subtitles. So, 7.3 displays the satellite or the nucleus clause after step 3 has been applied to the affected variable. If a step is applied more than once, lower-case letters are added to the subtitle (e.g. 8:3a). If a step is applied to an equality literal, the subtitle includes/e also (e.g. 7.3b/e). The terms to which a

461

predicate substitution was applied are underlined, and the affected variables are typed in bold. The connection graph of the refutation is shown in figure 1.

I.

f(a) = f(b)

1.1

(1,

2.

Q(f(a), f ( y ) , y ) v R(g(y))

3.

"-,R(g(a))

4.

S(f(a),w,w)

5.

--S(f(x),f(x),y) V T(f(x),g(y),x,h(x))

6.

-,Q(x,x,z) v --,T(x,g(x),z,h(z.))

7.

(2,3)

f(b) = f(a)

= y) v y = x)

7.1 Substitution list {a/y} 7.2 No top-level affected variables 7.3 (2, 1,'-(x = y) V ",Q(zl, x, z2) v Q(zl,y, z2))

Q(f(a), f(b),a) V R(g(a))

7.4 (7.3,1,'-,(x = y) v -',Q(x, zl, z2) v Q(y, zl, z2))

Q(f(b), f(b),a) V R(g(a))

7.5 (7.4,3)

Q(f(b),f(b),a)

s.

(4,5)

8.1 Substitution list {a/x,f(a)/y,f(a)/w} 8.2a (4, 1.1,-~(x = y) V ~ S ( z l , x , z 2 )

V S ( z l , y , z2))

8.2b (5, 1,--(x = y) V -,S(zl, z2, x) V S(zl, z2, y))

S(f(a),f(a),f(b)) "-,S(f(x), f(x), f(a)) V T(f(x), g(f(b)), x, h(x))

8.3 (8.2b, l.1,-,(x = y) V --,S(x, zl, z2) V S(y, zl,z2)) --,S(f(b), f(a), f(a)) V T(f(a), g(f(b)), a, h(a)) 8.4a (8.2a, 1,-~(x = y) V ~S(x, zl, z2) V S(y, zl, z2))

S(f(b),f(a),f(b))

8.4b (8.4a, 1, --(x = y) V --,S(zI, x, z2) V S(zl, y, z2))

S(f(b), f(b), f(b))

8.4c (8.3,1.1,'-(x = y) V -S(zl,x, z2) V S(zl,y, z2)) -,S(f(b), f(b), f(a)) V

462

l -R(g(a) ) l

If (a)=f (b)I

Q(f (a) ,f'(y),y) I

I R(g (Y))l

I - (~=y) I -Q(zl,x,,2) I Q(zI'Y"2) I

I - Ix=y)

-Q(x,zl, z21 I Q(y, zl,z2) I

I s,~<-),w,-)l L -T(x,g(x), z,h(z))~

t

!-(---,) ! ~(-~,~',~,

I -~('~,z~,,,

I -(~y)I

l -S(f (x) ,f(x) ,f (a))

I

-',-,'1,z2,z3, I T(y, zl,z2,z3) I

I T(f (x),g(f(b)) ,x,h(x))

Figure i: The Connection Graph of Example 2

I

463

T(f(a), g(f(b) ), a, h(a) ) 8.4d (8.4c, 1.1,-~(x = y) V

8.4¢ (8.4d, 1, -~(x = y) V

~S(zl, z2, x) V S(zl, z2, y)) ~S(f(b), f(b), f(b)) V T(f(a), g(f(b) ), a, h(a) )

~T(x, zl, z2)

V

T(y, zl, z2)) -S(f(b), f(b), f(b)) V T(f(b), g(f(b)), a, h(a)) T(f(b), g(f(b)), a, h(a))

8.5

(8.4b, 8.4e)

9.

(6,7.5,8.5)

9.1

Substitution list

9.2

No t e r m s will be substituted by

9.3

No subterms will be affected.

9.4

No top-level constants which are instances of tl.

9.5

(6,7.5,8.5)

L e m m a 2 : Let contains a clause

{a/x,f(b)/z} f(a)

SL = CL (3 EL be a n o n e m p t y and unsatisfiable set of clauses. If CL t l = t2 V P l l

V ... V

P l m , m > O,

where Pli is any positive or negative literal, then we can hyper resolve the literals Pli, 1 > i > m, and reduce the clause to t3 = t4 before using the literal t l = t2 as the literal of resolution. P r o o f i Since SL is an unsatisfiable set of clauses, then SL' results from SL deleting t l = t2 from tl = t2 V P l l

V ... V

SL' is also unsatisfiable, where

Plm.

Form a h y p e r refutation from SL'. Adding back t l = t2 produces a h y p e r deduction of t3 = t4, which can then be used to complete the refutation. D T h e o r e m 1 : If there is a hyperresolution proof for the clause set SL = CL U EL, where EL is the set of equality axioms, we can omit the function substitution axioms: 1. if there is no inner t e r m m a t c h in the clause set

CL, and

2. if no inner t e r m m a t c h results when a clause with one positive equality literal is derived ( l e m m a 2) just before applying the function substitution axiom.

464 P r o o f : In a hyperresolution proof, a function substitution axiom

-~(x = y) V f ( z l , ...,x, ...,zn) = f ( z l , . . . , y , . . . , z n ) can only be resolved with the clause tl=t2

V Q l l v ... v Q l m

where Q l i is a positive literal. By l e m m a 2, we can divide the proof into two steps: . Resolve all the literals Q l l , ..., Q l m first, and derive t3 = t4, and n a m e this new clause set S L t = CL' U E L . According to the second condition, C L I will have no inner t e r m m a t c h in SL'. 2. Resolve the clauses of the clause set SL'. If we apply l e m m a 1 to the hyper resolution proof steps for the clause set SL', then there will be no possible occurrence of t3 or an instance as a t e r m or a subterm, but t4 only. The only exception will be the clause t3 = t4 itself which will be used when a predicate substitution is applied to a literal to change a specific t e r m or s u b t e r m into t4. Now suppose t3 = t4 is used with a function substitution axiom to generate f ( w l , . . . , t3,..., wn) = f ( w l , ..., t4, ..., wn). We have the following transformation according to l e m m a 1:

1.

t3 = t4

2.

-,(x = y) V f ( w l , . . . , x,..., wn) = f ( w l , ..., y,..., wn)

3.

(1,2)

3.1

{t3/x, t4/y}

3.2a/

(1,

3.2a

(3.2a/e,l,-,(x=y)

3.5

(3.2a,2)

= y) V

t4 = t3

=

V --(y=z)

V x=z)

t4=t4

f ( w l , . . . , t4, ..., wn) = f ( w l , . . . , t4, ..., wn)

If we skip this modified deduction and use the equality axiom x = x instead, we will reach the e m p t y clause as well, since x --- x subsumes 3.5. rn E x a m p l e 3: Connection graph of the proof steps are shown in figure 2. I. H y p e r resolution proof with the function substitution axioms:

1.

P(g(a),g(b))

465

2~

-P(g(x),g(y)) v h(~)= h(y)

3.

~(f(x) = f(y)) V Q(x,y) v R(x,y)

4.

",Q(h(a), h(b))

5.

",R(h(x), h(y)) V ",T(d(x), d(y))

6.

T(d(a),d(b))

7.

(1,2)

h(a) = h(b)

8.

(7,-~(x = y) V f(x) = f(y))

f(h(a)) = f(h(b))

9.

(s,3)

Q(h(a), h(b)) V R(h(a), h(b))

10.

(9,4)

R(h(~), h(~))

11.

(5,6,10) II. Divide the proof into two steps:

1.

P(g(a),g(b))

2.

~P(g(x),g(y)) V h(x)= h(~)

3.

",(f(x) = f(y)) V Q(x,y) v R(x,y)

4.

",Q(h(a),h(b))

5.

~R(h(x), h(y)) V -,T(d(x),d(y))

6.

T(d(a), d(b))

Step 1: Derive the clause with the equality literal (Lemma 2): 7.

(1,2) Step 2: Replace all h(a) with h(b) (Lemma 1):

8.

(7,--(x = y) V f(x) = f(y))

8.1

{h(a)lx, h(b)lY}

h(a) = h(b)

466

S.2a/e (7,~(x = y) V y = x)

h(b) = h(a)

8.2a

(S.2a/¢, 7, ~(~ = y) V ~(V = z) V z = z) h(b) = h(b)

8.5

(8.2a,-~(z = y) V f(x) = f(y))

f(h(b)) = f(h(b))

9.

(8.5,3)

Q(h(b), h(b)) V R(h(b), h(b))

10.

(9,4)

10.4

(4, 7, -~(x - y) V -,Q(y, z) v Q(x, z))

-,Q(h(b), h(b))

10.5

(10.4,9)

n(h(b), h(b))

11.

(5,6,1o)

11.1

{a/x, •'/U}

11.3

(5, 7,-~(~ = y) v -,n(y, z) v n(x, z))

11.5

(11.3,6,10)

~n(h(b), h(y))

V

-,T(d(a),d(y))

III. Replace the proof step 8 with the equality axiom x=x:

Q(x, x) v R(x, x)

9.

(x = x, 3)

10.

(9,4)

10.4

(4, 7, ~(x = y) v ~Q(y, z) v Q(x, z))

~Q(h(b), h(~))

10.5

(10.4,9)

R( h(b), h(b) )

11.

(5,6,10)

11.1

{alx, b/u}

11.3

(5, 7, -,(= = u) v -,n(y, z) v n(x, ~))

11.5

(11.3,6,10)

",R(h(b), h(y)) V ",T(d(a), d(y))

T h e o r e m 2 : If there is a hyperresolution proof for the clause set SL = CL U EL, where EL is the set of equality axioms, and if the clause tl=t2VP11V

... V P l m , m > _ l

467

Step

1 : Derive

h (a) =h (b)

i P(g(a) ,g(b)) I

i -P(g(x),g(y))

i h(a)=h(b ) J i h (x)=h (y) i

Step 2: Use h(a)=h(b)

and replace all h(a)

with h(b)

I -~,x'--f,y'' I °,-,y' I R'x'Y'I

t

I h,a,oh,b, II -O,h,a,, b, i -{x=y) I -R(y,z) IR(~ (x,z)I I T(d(x),d(y)) I

f

Figure 2 : The Connection Graph of Example

3

468

is in CL, and the terms tl and t2 have no variables in common with the literals P l l , ..., P l m , then the inner t e r m m a t c h requirement holds when l e m m a 2 is applied to the clause to derive the literal t3 = t4. P r o o f i If the literal t l = t2 has no variables in common with the other literals P 1 1 , . . . , P 1 m in the same clause, the variables of the literal t l = t2 will never change if we resolve the literals P l l , ..., P l m first. Therefore the derived literal t3 = t4 will be the same as the original literal t l = t2. Hence, the depth of the constants or the function symbols will not be affected, and the inner t e r m m a t c h requirement will be met. rn E x a m p l e 4: T h e inner t e r m m a t c h requirement might fail if either tl or t2 is a variable x, and x is substituted by a s u b t e r m of a function f through the resolution steps as shown below:

1. P(g(a),g(b)) 2.

V x = y

3. "-(f(x)= f(y)) V Q(f(x),f(y)) 4. As it is seen, there is no inner t e r m m a t c h among the t e r m s of the clause set above. However, if we resolve clauses 1 and 2 as follows:

5. (1,2) a = b then the new set has an inner t e r m match, since a and b have two different depths in clauses 4 and 5. Therefore, we can not apply the theorem to the original set to eliminate the use of function substitution axioms. In fact there is no resolution refutation which does not use a function substitution axiom. We examined 37 problems [3], and found only one clause, "the well- definedness of multiplication", with a positive equality literal having variables in common with other literals in the same clause. T h e clause is defined as

",P(x, y, u) V ",P(x, y, v) V u = v and is mostly found in algebraic problems. One can easily identify such a clause in a clause set.

4

Conclusion

T h e use of function substitution axioms in a hyperresolution proof can be eliminated for some classes of clause sets. In our experiments, this elimination speeded up the search for a proof as much as 40%. This study defines one such class, and gives a sufficient condition for the class t h a t can be determined by inspection.

469

References [1] Kowalski, R. The Case for Using Equality Axioms in Automatic Demonstration. Symposium on Automatic Demonstration, Paris, 1969. [2] McCune, W., Henschen, L. Semantic paramodulation for horn sets. Proceedings of the 8th Int. Joint Conference on AI, pp 902-908, Karlsruhe, W. Germany, 1983. [3] Ozturk, Y. Interactive Advice System for Automated Theorem Provers. Ph.D. Thesis, EECS Department, Northwestern University, Evanston, 1989. [4] Wos, L., Carson, D., and Robinson, G. E~iciency and completeness of the set-ofsupport strategy in theorem proving. Journal of the ACM 12, pp 536-541, 1965. [5] Wos, L., Overbeek, R., Lusk, E., Boyle, J. Automated Reasoning: Introduction and Applications. Prentice-Hall, Inc., New Jersey 1984.

Automatic Acquisition of Search Guiding Heuristics* Christian Suttner

Wol/gangErtel

FG K/instliche Intelligenz Technische Universit£t Augustenstr. 46 Rgb. D-8000 Miinchen 2 West - Germany E-mail: < name> @lan.lnformatlk.tu-muenchen.dbp.de

Abstract Our approach to improve the search of a theorem prover employs empirical knowledge gMned from former proofs. A connectionist network is used to learn heuristics which order the choices at nondeterministic branch-points. This is done by estimating their relative chance for leading to a shortest proof. Using the method it was possible to reduce the search effort required by a high speed theorem prover. Several experiments are presented showing the attained improvements. K e y w o r d s : Automated theorem proving, model elimination, heuristics, evaluation functions, features, learning, connectionism, back-propagation.

1

Introduction

Automatic proving of challenging mathematical theorems is a very difficult task even for the best today existing general purpose theorem provers. Since proving formulas of firstorder logic is a NP hard search problem, faster computers and better implementations which reduce the time for finding a proof by a constant factor cannot solve the problems. One way to reduce the search complexity involved seems to be the employment of additional knowledge supporting the proof process. For this purpose heuristics can be sought which select the "best" out of the set of branches (alternatives) at each branch-point occuring during the search. *This paper was supported by the Nixdorf Computer AG within E S P R I T project 415 F.

471

Several attempts have been made to improve the performance of AI-programs by learning of evaluation functions based on features. It all started with Samuels successful use of such techniques for playing checkers ([11] and [12]). Examples of work applying it to automated theorem proving can be found in [13] and [8]. A more recent contribution employing hand coded heuristics is found in [2]. In [5] Bayes decision theory is used for training an Othello playing program which leads to a better performance than linear evaluation functions. The back-propagation (BP) algorithm used in our approach is nonlinear as well, but makes less assumptions on the distribution of the training data. We use a general purpose theorem prover based on model elimination, which is a sound and complete calculus for full first-order logic. At each branch-point during a proof various independent possibilities exist for a continuation. Our heuristic evaluation function now attaches a numeric value to each of the branches. Then the branches are selected in the order of their associated ratings until a branch leads to a success or no more branches are available. The evaluation function used by the heuristic is realized by a BP-network whose functionality comes from training on a set of example proofs (these proofs are found by the prover without heuristics). All the choices made in such proofs are called successful selections and will be used as positive training data. The remaining choices which were not selected for the proof are taken as negative training data (see Figure 1). In some sense the neural network is used to represent the intuition of a mathematician during the process of finding a proof. The learning phase of the neural network corresponds to what humans do when they study already existing proofs in the literature and develop their skills by training on easy problems.

m : Positive training data r=n: Negative training data .~::~: Not used as training data

Figure 1: Schematic search-tree with a solution-path marked by bold lines. The nodes in this path serve as positive training data. The nodes marked with a minus sign stand for the negative training data, In this article we describe our approach to automatic learning of feature-based evaluation functions. Section 2 gives a short outline of the model elimination proof calculus. In section 3 we describe evaluation functions and some of the features which are used to represent the alternatives at branching points. Section 4 covers the back-propagation learning algorithm used for training the evaluation function. In section 5 finally we present the results of various experiments showing significant performance gains through the use of the heuristics.

472

2

D e s c r i p t i o n of the P r o v e r

SETHEO (for SEquential THEOremprover) is a fast and efficient theorem prover for full first-order logic. The proof calculus employed is model elimination, which is also used as the basis for several other high-speed theorem provers. (A well known example is the PTTP system [14]). SETHEO uses powerful preprocessing for reducing the input formula and various heuristics and strategies during the search for a proof. The implementation of the prover is based on an extended Warren Abstract Machine which interprets compiled input formulas. The peak performance on a SUN 4/110 lies at about 40 kLIPS 1. A detailed description of the prover and performance evaluations can be found in [6]. For better understanding of the heuristic module and the learning part a brief description of the relevant issues is given in this section. Model Elimination [7] can be viewed as a tree-based refinement of the Connection Method [1]. The language used for expressing formulas of first-order predicate logic is restricted to skolemized conjunctive normal form. The Model Elimination calculus provides two kinds of inference steps. Extension steps are a generalisation of ordinary PROLOG steps for solving subgoals of clauses. The difference to PROLOG is that each literal of a clause can serve as head where the remaining literals are the (positive/negative) subgoals. For Horn clauses the execution mechanism is identical to the PROLOG procedure. In case of non-Horn clauses reduction steps are necessary to attain completeness. They allow inferences with predecessor literals. For our purposes, however, these steps do not need to be considered. Since usually several clauses (OR-branches) exist which are possible candidates for an extension step, a decision must be made which one to choose (see Figure 2). In case the decision does not lead to a proof, one of the other alternative choices needs to be tried instead (backtracking). Obviously, good decisions at OR-branches would lead to enormous performance improvements. In practice, no proof can be found unless appropriate bounds which restrict the size and/or shape of the search tree are supplied. One method to approach this problem is the use of iterative deepening search, which means that a bound is successively increased until a proof is attained. However, in many cases it will be practically impossible to explore the search tree for a specific bound, although a proof might be easily found if the correct, but larger bound would be specified. On the other hand, of course, a bound too large than necessary may increase the search space tremendously, which is detrimental as well. Obviously the optimal selection of bounds is an important issue. Therefore a backpropagation network was recently used to learn the selection of depth bounds for a propositional theorem prover ([4]). The heuristic approach presented in this paper will turn out to reduce the need for specifying optimal bounds significantly. 1Our experiments have been performedon a slower machine.

473

Formula

p(a,b)

p(a,b)

p(a,b)

{ {~p(a,b)}, {p(X,Y),-~q(X),-~q(Y)}, {p(a,Y),-~p(Y~a)}, {p(X, Y), -~q(X), -~p(y,y)}, {q(a)}, {q(b)} }

I -~q(a)

-~q(b)

f

t

q(a)

q(a)

-,q(a)

-~p(b,a)

p(b,a)

p(b,a) q(a)

-,p(b,b)

p(b,b)

p(b,b)

.'.

.'.

j,

Figure 2: A partial model elimination search tree for the formula given on the right. A '*' denotes a closed branch of the tree. The surrounded area marks a proof for the formula.

3

Feature-based

Evaluation

Functions

The goal is to shorten the search for a proof by using empirical knowledge. Therefore the choices given at any OR-branch shall be tried in an order which reflects their estimated usefulness to derive a proof. In the following we explain in more detail how this can be done. To compare the various branches of an OR branch-point an evaluation function eval for branches is used. This evaluation function gets as input a representation of a clause occurrence2 and calculates as output a numeric value (the rating for the branch). Having the ratings of all the branches (ck)k=l ...... , the order for trying them is defined by

rating(q) > rating(cj)

==~ ci is tried b e f o r e c j , i,j E [ 1 , . . . , n ]

ratin9(ci) -- rating(cj)

~

default order (i.e. order in the input file)

T h e case that two branches are rated equally means that they are either very similar or that the evaluation function is not selective enough. In the latter case a more complex evaluation function could be introduced which is invoked only if two or more ratings are equal. This would improve the ability to differentiate between the branches and yet would have limited effect on the average heuristic overhead. For the representation of the input to the evaluation function, features (attributes) of the branches (i.e. the number of literals in a clause) have been used. In general, a feature is a function

f,: {d~use occurrences} -~ {0, 1,..., k,} 2A clause occurrence refers to the particular occurrence of a clause within a proof-tree (i.e. a node of the tree), possibly including information on the tree built so far.

474

mapping a clause instance on an integer value between 0 and ki, where kl is a constant limiting the range of feature i. As input for the feature-based evaluation function we have a fixed number of n features, the so called feature-vector (fi(c)),=l,...,~ of clause occurrence c. Now the term evaluation function can also be defined formally: An evaluation function is a function

eval:

{0,1,...,kl) ×...x{0,1,...,k~} (fi(c))i=, ...... '

~

[0,1]C/F/

, eval((f,(c))i=l ...... )

which maps a feature-vector onto its rating.

Features All the features we use are easy to calculate. Some of them, e.g. the depth of the branch-point in the proof are explicitly present in the data structures of the prover. Moreover, most of the features are invariant for a given clause and therefore need only be calculated once and for all during the preprocessing phase. To account for such differences, a classification of the features is introduced. Static f e a t u r e s are independent of the actual clause occurrence and are calculated at compile time. Examples for static features are the number of literals and the number of different predicates in a clause. Uniform d y n a m i c f e a t u r e s are not static, but uniform for all branches of an OR branch-point and therefore must be calculated only once for each branch-point. An example is the current depth in the proof which is equal for all possible choices at an OR branch-point. D i s t i n c t d y n a m i c features finally depend on the actual clause occurrence at prooftime and therefore must be calculated for each branch. The total number of uses of a clause in the proof so far is such a dynamic feature. According to the distinction between static and dynamic features, heuristics can be separated as well. Any heuristic which solely relies on static features is independent of proof time aspects and therefore can be restricted to the compilation of the formula (static heuristic). This results in a rearranged, but fixed order of evaluation for choices at branch-points. On the other hand, any heuristic which makes use of a dynamic feature can only be applied at proof-time, which causes heuristic overhead during the search for a proof (dynamic heuristic). For the SETHEO theorem prover a feature module has been implemented which performs an efficient calculation of the features and invokes an evaluation function ([16]). The evaluation function can be supplied by the user and may be a simple hand coded heuristic. However, in the present work the function is learned by a back-propagation network. The features to be employed can be selected by the user out of a set of currently 21 static, 4 dynamic and 3 uniform dynamic features. Note, however, that this is not supposed to be used to derive an optimal set of features by hand. Rather, the option is

475

supplied for generality of the tool and for increasing efficiency. A subset of the features is listed below together with their symbolic names, a brief description, and some examples. Static features : Number of LITeralS in a clause : Number of N E G a t i v e Literals in a clause (e.g. {p(X) ;q(V) :- r(X).} --~ N_LITS = 3, N_NEG_L = 1) N_DIS-P : Number of DIStinct Predicates in a clause N_ALL_V : Number of ALL Variable occurrences in a clause (e.g. {p(X,Z) :- q(X,Y), q(Y,Z).} ~ N-DIS_P = 2, N.ALL_V = 6) N_CONSTS : Number of occurrences of CONSTantS in a clause N_FUNCTS : Number of FUNCTionS in a clause (e.g. {p(a,f(X,b)) :- q(g(h(a))), r(X,g(f(a,b)),b).} --* N_CONSTS = 6, N-FUNCTS = 5) Number of Variables CONnecting 2 literals N_CON2_V : N_EXPL_I : average Number of subgoals to be solved 1 level deeper in the proof-tree (i.e. N_EXPL_I( P ) = ~QE,~bgoat,(P)average(Isubg°als(Q)[) ) N_HDIS_V : Number of DIStinct Variables in the Head (e.g. {p(X,f(g(X)),Y) :. . . . . } --* N_ItDIS_V = 2) N_HCON_V: Number of CONnections through Variables from Head to subgoals (e.g. {p(X,f(X),Y) :- q(f(Y),g(X,Y)).} ---* N_ttCON_V = 4) N_LITS N_NEG_L

Dynamic features N_ALUSES : total Number of USES of the clause in the proof so far S P E C I A L I : n u m b e r of variables of calling clause becoming SPECIALIzed G E N E R A L I : n u m b e r of vars of clause-head G E N E R A L I z i n g a p a r a m e t e r of the caller (e.g. calling subgoal: -~ p(X,Y,c), with run-time instantiation of X with constant 'a'; OR-branch clause (to be rated): {p(a,b,Z) :. . . . . } --, SPECIALI = 1 [since Y = b], GENERALI = 1 [since c = Z]) Uniform dynamic features D E P T H _ P T : current D E P T H in the ProofTree N_INST_V : Number of INStantiated Variables in the calling subgoal N_UNIN_V : Number of UNInstantiated Variables in the calling subgoal From these examples it can be seen that most static features represent counts of syntatic components, relations between literals or global properties of predicates like the explosiveness (see NSEXPL_I). The dynamic features refer to the clause history, proof status and run-time instantiations.

476

4

Using Back-Propagation for Learning

T h e B a c k - P r o p a g a t i o n A p p r o a c h Obviously there are many possibilities for the realization of the learning task. However, a connectionist approach using back-propagation learning qualifies more than other methods for its ability to represent nonlinear relati, onships between features, and for the relatively small computational complexity of the obtained functions (in case of small networks). For a more detailed analysis of this issue and comparisons to other learning schemes see [16]. L The algorithm employed is a straightforward variant (see [3] for details) of standard back-propagation as presented in [10]. Figure 3 shows the basic components employed to obtain a learning network in a slightly simplified form. connectionist model (for standard backpropagation) activation function (determining the activity of a unit)

network model (arrangement of units and interconnections)

learning rule (how interconnection weights are changed)

l

generalized delta rule:

oi(t + 1) = fi(neti(t)) ~er later

1 f~(,mi) = i + e:,,,i

/kwii 81 ,,~tp,~t

=

~ioi

=

(ti - o i ) f [ ( n e t l )

layer

layers

ol fi wij 0i

: : : :

activation value of unit i activation function applied to unit i weight of connection between unit j and unit i bias for unit uj ~_~ wiioj + 61 : net input into unit i

:

target output (desired output for presented input)

neti

k

J

~i

Figure 3: Components of the learning system

Topology: A network consists of layers of units. Each unit in a layer is connected to all units of adjacent layers, and no other connections exist. The bottom layer contains the so-called input units, which are used to encode the feature-vector of a clause-occurrence to be rated. The top layer is made up of a single unit. In between the input and the output layer there may be a hidden layer, in which case the number of hidden units used has been determined empirically (Fig. 3: network model). Each connection between units has a weight coefficient wlj representing the strength of the connection.

477

Activity:

The activation values of the input units are set in a way to represent the values of a feature-vector. The activation values o~(t) of all other units depend on the state of the network at time t - 1 and are determined by a function which maps the net input of unit ui to its output (Fig. 3: activation function). In normal application mode (i.e. non-learning mode) the network operates in a feedforward fashion, that is, activation values are spread only from the input layer towards the output layer, but not backwards. With properly learned weight coefficients, this represents the evaluation function with the activation value of the output unit as heuristic rating of the feature-vector presented as input.

Learning: One training step consists of two parts: First, input values of a learning pattern (i.e. a feature-vector) are propagated forward through the network (same way as in application phase). The resulting output value is then compared with the desired output (intended rating for presented feature-vector) and the difference (error) is determined. Second, the error is propagated back through the network and weight changes are performed to reduce the error according to the generalized delta rule (Figure 3: learning rule). Since the activation function is nondecreasing and differential~le with respect to the net total output, learning is done through a gradient descent minimizing the quadratic error function Ep = (desired output-value - actual output-value) 2. This basic step is executed for all pairs of training patterns (which is called a learn cycle), and this again is repeated until the reduction of the overall error (sum of errors per pattern) ceases.

5

E x p e r i m e n t a l Results

A good domain for the evaluation of the benefits through the heuristic needs to be simple enough such that a proof can be found without heuristics and complicated enough to make the application of heuristics efficient (problems solved within milliseconds by the unaided prover are not considered as being of interest). A standard problem with these properties which is often used for benchmarking automated theorem provers is Schuberts Steamroller (taken from [9], discussed in [15]). The basic formula describes a world of animals and plants and the eating relationships between them (employing 6 facts and 19 rules). The Steamroller then is a theorem (specific query) which states that a particular relation between individuals holds. Additional theorems (labeled SimpIesteam, Stl, St2, . . . , St7) have been created for this domain to allow the investigation of domain-specific heuristics. Finally, to check for the behaviour of the evaluation functions in domains different from where the training data are from, two other problems from [9] (namely P43, P46) have been examined. To attain some intuition about the complexity of these problems, Table 1 shows the required work to find a proof using optimal proof bounds. In addition to depth-bounds, inference-bounds are used. These bounds limit the number of inference-steps allowed in a proof. A straightforward way to evaluate the quality of the learned functions is to compare the size of the explored space using/not using a heuristic. This measures the reduction

478

Problem3 (only query shown) sroller: t~ ~. " ~(x), ~(v), g(z), ¢(x,Y), e(Y,Z). s~c~pl¢.. 7- a(x), a(¥), s(z), e(X,Y), ~(w,z). Stl: ?- a(x), m(X,Y), e(Y,cb). St2: ?- e(X,Y),e(Y, cc). St3: ?- m(Z,W), m(Y,Z), m(x,Y), e(Z,Y). St4: ?- m(X,Y), m(Y,Z), m(Z,W). St5: ?- m(X,Y), e(Y,Z), m(Z,Y). St6: ?- e(X,V), e(Y,Z), e(Z,W). St7: ?- a(X), a(Y), e(X,Y), e(Y,Z). P43: Pelletier 43 P46: Pelletier 46

Length of shortest proof (inferences)

70 25 (40) 4 53 51 57 10 10 53 10 25 (27) 4 35 (75) 4

required depth 6 5 6 6 6 4 4 6 4 7 6

total n u m b e r of

inferencesw i t h depth bound

4725 338 270 1038 360 31 42 8706 65 1275 410

Table 1: Complexity of the problems. Note that all problem-labels beginning with "S..." refer to the Steamroller world and represent different queries in this domain. Problems "P..." are 2 unrelated problems and serve as comparisons for the use of heuristics in other domains. of work achieved by the reordering of choices, and therefore depends on the search space spanned by the formula under consideration (different theorems may inherently allow for very different reductions of search). However, this makes comparisons between different heuristics tested on different theorems problematic. Therefore a specific performance measure (Obey) was developed, whic~ gives an evaluation of the orderings derived through a heuristic relative to a random ordering (the ordering which would be obtained from an evaluation function doing blind guessing). For simplicity it shall be sufficient to supply the asymptotic behaviour of the performance measure: 1 0 Ohe~, =

-1

best possible performance (at each branch-point correct decision) performance equal to random ordering of choices (at each branch-point, a random ordering is used) worst possible performance (at each branch-point, correct choice is tried last)

We shall now present a comparison both between static and dynamic heuristics and between the consequences induced by choosing different training data. In Figure 4 the performance of 6 heuristics on 5 different problem sets is given. The bar-graph is organized into 5 sets of bars, one set for each test problem. Each set in turn consists of 3 pairs of bars, one pair at a time for a specific training set used. The leftmost pair of a triple is based on the data from SimpleSteam, the middle one on {Stl,St2,St3} and the one on the right side on the Steamroller itself. Finally, the 3Note that the clause orderings of the problem formulas are taken unmodified from the literature. 4This is the length of the proof attained using the smallest depth-bound (a minimal depth-bound does not guarantee to find a shortest proof).

479

pairs consisting of a framed and a filled bar represent the best static (~) and dynamic (I) heuristic found for the training data.

0.6 0.4

Oheu

0.2 0.0 -0.2

×

I ...... I

I

SimpleSteam

Stl St2 St3

I

I

I

Steamroller

s~4 sts s~s s,7

P43 P46

different test sets used Figure 4: Performance of static and dynamic heuristics based on different training sets. A 'x' denotes that the above bars give the performance on the training data. Unsurprisingly, the best performance is achieved by a heuristic when applied to its own training data (see bar-pairs marked with 'x'). As expected, dynamic heuristics are clearly superior in this case, since more information is employed. But interestingly this can have detrimental effects when used on other problems (see black bars n o t marked with 'x', esp. above {P43, P46}). This is a quite important fact to realize, since it means that dynamic heuristics are much less general than static heuristics. A consequence is to apply dynamic heuristics only in the context of a single domain. Now the actual gains for the proof process will be determined. Since a major limitation of the prover is the necessity to supply bounds which sufficiently restrict the search space, the benefit through heuristics will be examined for the case that suboptimal depth-bounds are used. In all graphs, the smallest value of the abscissae is equal to the smallest depthbound allowing a proof to be found. The quality measures employed will be the number of inferences performed during the search for a proof and the length of the obtained proof (also in inferences). Note that for static heuristics an additional time measurement is unnecessary, since no run-time overhead occurs.

Static Heuristics In the following, two heuristics will be compared with the non-heuristic case (remember that these heuristics are only applied during the preprocessing phase). In all graphs, the results for the standard prover will be denoted by a 'o'. Those for the heuristic learned from SimpleSteam will be indicated by a '*', and those derived from training set {Stl,St2,St3} by a '×'. For simplicity, we will refer to heuristics in the following by the letter H indexed with the symbols used for them in the figures (here: H. and H× ). Figure 5 shows the results of applying the heuristics to the Steamroller problem.

480

o : no heuristic, • : SimpleSteam, x : {Stl,St2,St3} 5 000 000

1

000 000 500 000

total number of inferences done

$ X

X

X

100 000 50 000

10 000 5 000

1 000 numberof 125 1 inferences in proof 70 -J

i

I

•

i

*

m

m

m

*

*

I

|

I

I

I

I

I

I

6

7

8

9

l0

11

12

,.;,h~t depth

depth bound

bound

Figure 5: Static heuristics for the Steamroller Using H× doe.s lead to proofs of the same length as without heuristics, but only about half as many inference-steps are required in order to find a proof. H., on the other hand, requires marginally the same amount of computations as without using a heuristic, but allows a shortest possible proof to be found for all depths. For other complex examples from the Steamroller world similar results apply. In Figure 6 the same heuristics will be applied to a different domain. Here H× leads to an exponential reduction of required inferences for non-optimal depths, while H. is inferior to the non-heuristic case (with respect to the total number of inferences required) until the depth-bound is 3 counts larger than the optimum. Analyzing the results it can be found that static orderings have a significant impact on the proof process. Although any static arrangement is predetermined to lead to wrong choices at times, the difference between "good" and "bad" orderings is enormous. The improvement that can be obtained by static heuristics depends, of course, crucially on the initial ordering of the clauses. Since in most cases such orderings are not optimized, static heuristics are usually beneficial to apply. The presented experiments show that automatically derived static heuristics are a simple, yet powerful approach to enhance the given proof system. They are especially

481

• :

SimpleSteam, x : {Stl,St2,St3} $

10 000 ooo 5 000 000

$

000 000 500 000

0

1

total number of inferences done

100 ooo; 50 000 10 000 000 500 i

5o01 100 "

200 length of 100 proof (inferences) 50 30

0

X

o

i

I

I

I

'I

I

I

6

7

8

9

10

20

50

depth bound Figure 6: Static heuristics for P46. Missing evaluations denote either stack overflow or unterminated search. desirable, since their application reduces to fast heuristic preprocessing, and no run-time overhead is incurred which would lead to a decrease in the inference rate of the prover.

D y n a m i c Heuristics By use of proof time information dynamic heuristics are capable of adaptive behaviour. This promises improved decisions and consequently better performance of the prover. On the other hand, Figure 4 shows that dynamic heuristics are much less general (and therefore less reliable) than static ones. There is also the question about the trade-off between quality and complexity of heuristics, since any gain in the reduction of the search space has to be compared to the extra time spent for the heuristic overhead. To illuminate this issue, two evaluation functions of different complexity have been learned from {Stl,St2,St3}. One of them employs a 3-layer network with 25 hidden units (H,), while the other one is based on a simple 2-layer setting (H×). In both cases, binary coding of the input was used. Standard evaluations (e.g. Oh~) showed H. to be superior over H×. On the other hand, each application of the evaluation function from H. takes about 25 times longer than the one from H×. Thus the comparison illuminates the trade off between

482

* : 25 hidden units, x : no hidden units o : without heuristic

5 000 000

I o /

1 000 000

,s

500 000

.-.0"

100 000 50 000

total number

of inferences done

10 000 --X . . . . . . ~1:. . . . . . .

...,,X--

1 000

. .

X --'~

100

length of proof (inferences)

1251 7O

0

~

I~1

X

Q

n

t

m

n

•

*

*

I

I

I

I

I

I

I

6

7

8

9

10

11

12

I

without depth bound

depth bound Figure 7: Dynamic heuristics for the Steamroller- Inferences

0

1000

/ / 1 /

t

t

i00

50 proof

time in seconds

10 5:

X

_.-.-~ -x~

" .....

x ' - ' - ' ' x .......

i

~x~X.--~ 0

I

I

I

I

I

I

I

I

6

7

8

9

10

11

12

..ho.t

depth bound Figure 8: Dynamic heuristics for the Steamroller - Proof time

depth

bou,~d

483

decision quality and required time. Figure 7 shows the reduction in the search space and the length of the obtained proofs, while Figure 8 reveals how much time was actually spent for the search of the proof. Clearly, H, achieves better heuristic decisions than H×. For larger depths, the 3-layer network leads to minimal proofs wasting only a few inferences. H× requires slightly more inferences and leads to suboptimal proofs after a certain depth. However, Figure 8 reveals an important performance trade-off. Employing a significantly simpler and therefore faster evaluation function, H× takes between ~ and ~ of the time to find a proof than using H.. For a high-speed proof system, even the reduction to half the number of inferences (maximal gain of H. over H×) cannot outweight the additional computational costs. Experiments with other problems from the Steamroller world showed comparable results. Moreover, in some cases the simpler function even gave the better heuristic (resulting in very fast proofs with much less inferences wasted than by the complex function). This seemed to be due to insufficient generalization of the complex heuristic. Altogether, dynamic heuristics proved to be able to lead to enormous improvements with respect to all performance indicators. A relatively complex evaluation function was shown to outweight the expensive overhead and to lead to much faster proofs than not using a heuristic. However, a less complex function may outweight quality differences by speed. Another advantage of simple functions is, that in case no gain is achieved, the useless overhead is more tolerable. This brings up an important issue. A major drawback of dynamic heuristics is their unreliability when applied to new problems. This can be reasonably controlled only by restricting the application of an evaluation function to the same domMn as the training data are from and by using a sufficiently large training set.

6

Summary

We described a method for supporting a theorem prover through a trainable connectionist network. The network serves as an evaluation function and works on a meta-level guiding the search of the prover. The feature concept solves the problem of coding arbitrary complex clauses as fixed-length input for the evaluation function. Running experiments we found that static heuristics constitute a way to speed up the prover without any runtime overhead. Significantly higher performance is possible through the use of dynamic heuristics which, however, are very domain specific. While the results show a success of the principal approach, our aim is to come up with a completely automatic system which is able to generate problem-specific heuristics for difficult theorems. A larger set of features will be necessary to make sure that the full power of the connectionist approach is utilized, and more experiments need to be conducted to access the generality of the method. For these goals the results of our work form the basis of ongoing research.

484

References [1] W. Bibel. Matings in Matrices. In Comm. of the ACM, 26 1983. [2] K. Bl~ius, N. Eisinger, J. Siekmann, G. Smolka, A. Herold, and C. Walther. The Markgraf Karl refutation proof procedure. In Proceedings of the Seventh International Joint Conference on Artificial Intelligence, Vancouver, 1981. [3] W. Ertel. Back-Propagation with Temperature Parameter and Random Pattern Presentation. Techn. Report FKI-122-90, Technische Universit£t Miinchen, 1990. [4] W. Ertel, J. Schumann, and C.B. Suttner. Learning Heuristics for a Theorem Prover using Back Propagation. In Proceedings of the 5. OGAI-Conference, Igls, Austria, 1989. Springer. [5] K.F. Lee and S. Mohajam A Pattern Classification Approach to Evaluation Function Learning. Artificial Intelligence, 36, 1988. [6] R. Letz, S. Bayerl, J. Schumann, and W. Bibel. SETttEO: A High-Performance Theorem Prover. to appear in: Journal of Automated Reasoning. [7] D.W. Loveland. Mechanical theorem-proving by model elimination. JACM, 15(2), 1968. [8] R. Overbeek, J. McCharen, and L. Wos. Complexity and Related Enhancements for Automated Theorem-Proving Programs. Comp. ~ Maths. with Appls., 2(l-A), 1976. [9] F. J. Pelletier. Seventy-five problems for testing Automated Theorem Provers. Journal of Automated Reasoning, 2:191-216, 1986. [10] D.E. Rumelhart, G.E. Hinton, and R.J. Williams. Learning Internal Representations by Error Propagation. In Parallel Distributed Processing, 1986. [11] A.L. Samuel. Some Studies in Machine Learning Using the Game of Checkers. IBM Journal,

1(3), 1959. [12] A.L. Samuel. Some Studies in Machine Learning Using the Game of Checkers, II. IBM Journal, 11(6), 1967. [13] J.R. Slagle and C.D. F~rrell. Experiments in Automatic Learning for a Multipurpose Heuristic Program. Comm. of the ACM, 14(2), 1971. [14] M.E. Stickel. A prolog technology theorem prover. New Generation Computing, 2(4):371383, 1984. [15] M.E. Stickel. Schubert's steamroller problem: Formulations and solutions. Journal of Automated Reasoning, 2:89-101, 1986. [16] C.B. Suttner. Learning Heuristics for Automated Theorem Proving. Diploma Thesis, Technical University Munich, May 1989.

Automated Reasoning Contributes to Mathematics and Logic* L. Wos S. Winker W. McCune R. Overbeek E. Lusk R. Stevens Mathematics and Compu~r Science Division Argonne National Laboratory Argonne, IL 60439-4844 R. Butler Division of Computer and Information Science University of North Florida Jacksonville, FL 32216

Abstract In this article, we present some results of our research focusing on the use of our newest automated reasoning program OTTER to prove theorems from Robbins algebra, equivalential calculus, implicational calculus, combinatory logic, and finite semigroups. Included among the results are answers to open questions and new shorter and less complex proofs to known theorems. To obtain these results, we relied upon our usual paradigm, which heavily emphasizes the role of demodulation, subsumption, set of support, weighting, paramodulation, hyperresolution, and UR-resolution. Our position is that all of these components are essential, even though we can shed little light on the relative importance of each, the coupling of the various components, and the metarules for making the most effective choices. Indeed, without these components, a program will too often offer inadequate control over the redundancy and irrelevancy of deduced information. We include experimental evidence to support our position, examples producing success when the paradigm is employed, and examples producing failure when it is not. In addition to providing evidence that automated reasoning has made contributions to both mathematics and logic, the theorems we discuss also serve nicely as challenge problems for testing the merits of a new idea or a new program and provide interesting examples for comparing different paradigms. 1. O b j e c t i v e s a n d O r g a n i z a t i o n Consistent with our primary research objectives of contributing to mathematics and logic, designing ever more effective programs, and stimulating additional research, from the preceding year's experiments with our newest program OT'IER [5], we select and present certain new results and then focus on the key elements of the underlying paradigm [11] and various implied and as yet unanswered questions. The contributions include new theorems, answers to open questions, shorter proofs, and less complex proofs. They were obtained with *This work was supported by the AppLied Mathemat/cal Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38, and by the National Science Foundation under grant CCR-8810947.

486

a variety of approaches, discussed here, relying to various extents on the use of demodulation, subsumption, the set of support strategy, and weighting. The new results concern Robbins algebra, equivalential calculus, implicational calculus, combinatory logic, and finite semigroups. Because of space limitations, we omit the clause proofs and various other details---which are presented in a far more comprehensive Argonne report in preparation [14]--but include the input clauses for each problem. Regarding additional research in automated reasoning itself, we discuss the given experimental data in the context of the control of redundancy and irrelevancy. For example, without the use of demodulation and subsumption, the growth of redundant information will ordinarily be so large that assignment completion can be made impossible. Since we can shed little light on the precise nature and importance of the individual components of the paradigm underlying our research, and since we understand very little concerning the coupling of these components, the implied questions provide the basis for future research in the field. The evidence we present strongly suggests that paradigms that do not avail themselves of all four major components----demodulation, subsumption, the set of support strategy, and weighting--will, for most studies, offer inadequate power. Even further, the problems on which we focus present challenges for and tests of ideas, approaches, paradigms, and programs. They also provide interesting examples for comparing different paradigms for the automation of reasoning. Regarding additional research in mathematics and logic--whether the goal is to attempt to answer an open question, find a new proof for a known theorem, or simply obtain (possibly the first) computer proof of some theoremmwe present various approaches, each within the given paradigm. Among the approaches, we focus on one that relies on a weighting scheme based simply on symbol count, one based on a scheme emphasizing the " t a i l " of expressions, and one in which the use of weighting is replaced by level saturation. Since we currently cannot explain when and why one approach will be far more successful than another, implicit in this discussion is the basis for research both in automated reasoning and in mathematics and logic. A source of additional research rests with the incomplete results we include concerning questions in mathematics that are still open. The thesis throughout this article is that to make contributions to mathematics and logic by relying on an automated reasoning program, one must have a means to control the deduction of redundant information and also a means to control the deduction of irrelevant information. The means the program OTTER employs consists of the use of demodulation, subsumption, the set of support strategy, and weighting. However, even with reasonable control of redundancy and irrelevancy, one must currently rely on a variety of approaches, for example, by varying the choice of inference rule, of set of support, and of demodulators. One of the different approaches we present here may provide the basis for research that leads to the answer to an open question, a new and shorter proof, or a computer proof that had not been found earlier.

2. Robbins Algebra The first area for discussion is Robbins algebra, an area that presents a question that is still open. Is every Robbins algebra a Boolean algebra? A Robbins algebra is a nonempty

487

set satisfying the following three axioms in which the function o can be interpreted as plus and the function n as negation. (R1) o(x,y) = o(y,x) (R2) o(o(x,y),z) = o(x,o(y,z) ) (R3) n ( o ( n ( o ( x , y ) ) , n ( o ( x , n ( y ) ) ) ) ) = x A Boolean algebra is a nonempty set S with two operations, plus and times, and a 0 and a 1. Each operation is commutative, and each distributes over the other. The 1 is a multipicative identity, and the 0 is an additive identity. In addition, for every x, the negation of x exists with x plus its negation equal to 1 and x times its negation equal to 0. An alternative axiomatization of Boolean algebra consists of R1, R2, and Huntington's axiom [3]. (H3) o(n(o(n(x),y) ),n( o(n(x),n(y) ) ) ) = x Therefore, a way to prove a Robbins algebra Boolean is to derive H3 from R1-R3. This question has obviously interested mathematicians, for Tarski and his students studied it [2]. It has been proved that every finite Robbins algebra is a Boolean algebra. Our contributions focus on the addition of one or more properties to see whether the resulting system can be shown to be Boolean. For example, some years previous, we proved that the addition of the single equality o(x,x) = x to the Robbins axioms yields a Boolean algebra. Also, the addition of a 0 such that o(x,O) = x, or a 1 such that o(x,1) = 1 suffices. But weaker axioms can be added and still yield a Boolean algebra. For example, the addition of the equality o(a,a) = a for some constant a suffices. Even weaker, the addition of o(a,b) = a for some a and b suffices. We call these properties s u ~ c i e n c y p r o p e r t i e s [14]. For this last result, in contrast to the preceding results, our proof required substantial intervention, direction, and a number of runs by Winker using one of our programs. Here we select from recent research two new results concerning the addition of a single equality that guarantees, when considered with the axioms of a Robbins algebra, the properties of a Boolean algebra. T h e o r e m RA-1, near miss equality. If there exist elements a and b in a Robbins algebra that satisfy n ( o ( n ( o ( a , o ( a ~ ) ) ) , n ( o ( a , n ( b ) ) ) ) ) = a (which is syntactically similar to R3), the resulting algebra is Boolean. T h e o r e m RA-2. If the equality n(o(x,y)) = i(n(x),n(y)) is adjoined to R1-R3, the resulting algebra is Boolean. (Although intersection has not been defined, the given equality is reminiscent of De Morgan's law.) To attempt to prove that a Robbins algebra is not Boolean, two ways to proceed are (1) find a (infinite) model of R1-R3 that fails to satisfy one of the known sufficiency propertSes, or (2) prove that from R1-R3, one cannot derive one of the known sufficiency properties. 3. C a l c u l i In this section, we focus on theorems concerned with possible axiom systems for various logical calculi. The calculi to be visited are equivalential calculus, implicational calculus, and the R-calculus. We begin with equivalential calculus.

488

3.1. Equivalential Calculus The study of equivalential calculus can be confined to the consideration of formulas involving variables and a two-place function e such that, in each formula, every variable occurs twice [12]. In addition, the single inference rule condensed detachment suffices; this inference rule permits the deduction of the formula d from the formulas e(a,b) and c when c and a unify, with d the corresponding instance of b. If hyperresolution is used, the clause --~P(e(x,y)) I ~P(x) 1P(y) suffices to encode condensed detachment. Equivalential calculus can be axiomatized with formulas quite reminiscent of reflexivity, symmetry, and transitivity. The following three clauses serve nicely. P(e(x,x)) P(e(e(x,y),e(y,x))) P(e(e(x,y),e(e(y,z),e(x,z)))) In place of this perhaps more natural axiomatization, it can be proved that there exist single formulas each of which provides a complete axiomatization. The shortest consists of eleven symbols, excluding parentheses and commas, and thirteen such formulas exist. Theorem EC-1. The formula

(XHN) e(x,e(e(y,z),e(e(z~x),y)) ) provides a complete axiomatization for equivalential calculus. Our proof, requiring approximately 443 CPU seconds on a Sun 3, rests on deriving the formula

(UM) e( e(e(x,y),z),e(y,e(z,x) ) ) which itself is known to be a single axiom for this area of logic [7]. The question regarding the axiomatic status of XHN was open until Winker obtained a proof in the early 1980s. His original (never published) proof consisting of 159 derived formulas, the longest of which consists of 103 symbols, was obtained over a period of weeks from a number of runs with one of our earlier programs. We have recently obtained a proof consisting of 23 derived formulas, the longest of which consists of 39 symbols, and in a single run with OTTER. Our approach was one of level saturation combined with a technique for comparing and preferring shorter derivations of each deduced formula. Theorem EC-2. The formula

(XHK) e(x,e(e(y,z),e(e(x,z),y) ) ) provides a complete axiomatization for equivalential calculus. Our proof, requiring approximately 461 CPU seconds, rests with the derivation of

(YRO) e(e(x,y),e(z,e(e(z,y),x))) which is known to be a single axiom for the calculus. The corresponding open question was first answered by Winker in the early 1980s when he obtained a proof consisting of 83 derived formulas, the longest of which consists of 71 symbols. As with XHN, he extracted the proof from a series of runs with an earlier program. We recently obtained a 35-step proof, the longest formula of which consists of 47 symbols,

489

and in a single run with OTTER. In contrast to the use of level saturation, which led to the cited proof of XHN, for XHK we employed a weighting strategy that emphasizes the consideration of formulas whose righthand major argument is short.

3.2. Implicational Calculus As with equivalential calculus, there exist single formulas that serve as complete axiomatizations for implicational calculus; the inference rule of condensed detachment is used. In the preceding CADE conference, one of the challenge problems that was posed asks one to find a computer proof of a theorem by Lukasiewicz concerning such a single axiom [8]. The calculus can be axiomatized with the following three formulas.

i (x,i (y ,x ) ) i(i(i(x,y),x),x) i(i(x,y),i(i(y,z),i(x,z)))

(Simplification) (Peirce's Law) (Hypothetical Syllogism)

Theorem IC-1. The formula i(i(i(x,y),z),i(i(z,x),i(u,xi)) provides a complete axiomatization for implicational calculus. Our proof rests with deriving each of the given three axioms, requiring approximately 11 CPU hours. Our approach involved weighting formulas by symbol count and used hyperresolution as the inference rule.

3.3. R-Calculus The R-calculus also admits axiom systems that consist of a single formula [7]; condensed detachment again is the inference rule. Indeed, any of the following three formulas, by itself, provides a complete axiomatization.

(aYE) (YAM) (WO)

e(e(e(x,y),e(x,z)),e(z,y)) e(e(x,y),e(e(z,y),e(z,x))) e(e(x,e(y,z)),e(z,e(y,x)))

Both of theorems RC-1 and RC-2 answer, respectively, open questions; the two proofs were obtained by Winker in the early 1980s. Theorem RC-1. The following formula is a new shortest single axiom for the Rcalculus.

(XGJ) e(x,e( e(y,e(z,x) ),e(y,z) ) ) Our proof rests with a derivation of the formula WO. Theorem RC-2. The formula (XEH) e(x,e( e(y,e( e(y,z ),x ) ),z ) ) is not a single axiom for the R-calculus. Our proof rests with producing a complete characterization of the formulas deducible from

XEH and showing that none of the given single axioms can be so deduced.

490

4. Combinatory Logic In this section we focus on combinatory logic, a field that offers a variety of problems for testing, and sometimes exceeding, the power of an automated reasoning program. Barendregt [1] in effect defines combinatory logic as an equational system satisfying the combinators S and K (defined shortly) with S and K as constants. Noting that expressions are assumed to be left associated unless otherwise indicated, the actions of S and K are given by the following two equations. Sxyz = xz(yz) Kxy=x

If one uses paramodulation as the inference rule, problems from combinatory logic in its entirety can be submitted to the program OTTER with the following axioms. X=X

a(a(a(S,x),y),z) = a(a(x,z),a(y,z)) a(a(K,x),y) = x Rather than focusing on combinatory logic as a whole, here we study various fragments, subsets of the logic in which S and K are replaced by other combinators of which the basis of the fragment under consideration consists. In this article, we confine the discussion to the search for what are called combinations. By definition, when given a specific combinator P, a combination from the basis B of the fragment is an expression that satisfies the equation for P. Also, by definition, the length of a combination is the number of occurrences of the basis elements. For a simple example of the type of question under consideration in this section, let us focus on the combinator L with Lxy = x(yy)

and the fragment whose basis B consists of the combinators B and W with Bxyz = x(yz) Wxy = xyy

Given this basis B, a search for a combination satisfying the equation for L will succeed, finding the combination BWB. For a proof of success, one simply notes that BWBxy = W(Bx)y = Bxyy = x(yy).

Given the preceding material as background, let us now turn to some of the theorems we succeeded in proving in our study of combinations. Based on correspondence with Raymond Smullyan, we understand that the theorems presented here make a contribution to combinatory logic, by answering questions that were open concerning the existence, minimal length, and number (of that length) of various combinations. Rather than a complete proof, for each theorem we simply give one of the corresponding combinations and certain additional information, reserving the details (including the precise clauses and parameter settings) for the far more comprehensive Argonne report [14]. We also include some of the pertinent statistics (to permit one to judge the difficulty of the theorem), the input for OTTER, and a summary of the approach we used.

491

These theorems, if viewed as challenge problems for testing programs, approaches, or paradigms, do not ask one to verify that the combination that we give fulfills its requirements. Instead, the more interesting challenge is to begin with an appropriate set of axioms--which might include those for equality, especially when no mechanism exists for equality-oriented reasoning--and the denial that a combination of the desired type exists. Using as an example the B, W, and L problem discussed earlier--purely for illustration and for a template o f how to attack the various theorems presented shortly--with one of the notations acceptable to OTTER, one could have the input consist of the following. X=X

a(a(a03,x),y),z) = a(x,a(y,z)) a(a(W,x),y) = a(a(x,y),y) a(a(x,f(x)),g(x)) ~ a(f(x),a(g(x),g(x))) In contrast, were one simply attempting to have OTTER prove that BWB is a combination that behaves as L does, one would replace the given inequality by the following. a(a(a(a(B,W-),B),f),g) ~ a(f,a(g,g)) The presence of Skolem constants in place of Skolem functions makes the corresponding problem, in general, far easier to solve. Here is a list of the combinators [10] relevant to this section.

03) (C) (F) (G) (L) (P)

Bxyz = X(yz) Cxyz = xzy Fxyz = zyx Gxyzw = xw(yz) Lxy = x(yy) Pxyyz = xy(xyz)

(Q) Qxyz = y(xz) (Q1) alxyz = x(zy) (T) Txy = yx ( v ) Vxyz = z ~ ( w ) Wxy = xyy

T h e o r e m CL-1. From the basis consisting o r B and T, a combination can be found that satisfies the equation for Q. A proof of the theorem rests with an examination of either of the following two combinators, both found in less than 6 CPU seconds.

B(TB)(BBT)

B(B(TB)B)T

In addition, no shorter combination exists with the desired properties, nor does any other exist of length 6. T h e o r e m CL-2. From the basis consisting of B and T, a combination can be found that satisfies the equation for Q1. A proof of the theorem rests with an examination of either of the following two combinators, both found in less than 14 CPU seconds.

B(TT)(BBB )

B (B (TT)B)B

In addition, no shorter combination exists with the desired properties, nor does any other exist of length 6.

492

Theorem CL-3. From the basis consisting of B and T, a combination can be found that satisfies the equation for C. A proof of the theorem rests with an examination of either of the following two combinations, both found in less than 19 CPU seconds.

B(T(BBT) )(BBT)

B(B (T(BBT))B)T

In addition, no shorter combination exists with the desired properties, nor does any other exist of length 8. Theorem CL-4. From the basis consisting of B and T, a combination can be found that satisfies the equation for F. A proof of the theorem rests with an examination of any of the following five combinations, all found in less than 50 CPU seconds.

B(TT)(BB (BBT) ) B(B(TT)B)(BBT) B(TT)(B(BBB)T)

B(B(TT)(BBB ))T B(B(B(TT)B)B)T

In addition, no shorter combination exists with the desired properties, nor does any other exist of length 8. Theorem CL-5. From the basis consisting of B and T, a combination can be found that satisfies the equation for V. A proof of the theorem rests with an examination of any of the following ten combinations, all found in less than 248 CPU seconds.

B(T(BBT) )(BB(BBT) ) B(B(T(BBT))B)(BBT) B(T(BBT) )(B(BBB)T) B(B (T(BBT) )(BBB) )T B(B(B(T(BBT))B )B)T

B(T(BBT) )(BB(BTI3 ) B(B(T(BBT))B)(BTT) B(T(BBT) )(B(BBT)T) B(B(T(BBT))(BBT))T B(B(B(T(BBT))B)T)T

In addition, no shorter combination exists with the desired properties, nor does any other exist of length 10. Theorem CL-6. From the basis consisting of B and T, a combination can be found that satisfies the equation for G. Rather than giving a combination of the desired type, we instead observe that five of length 10 do exist, and no smaller ones suffice. Theorem CL-7. From the basis consisting of B, Q, and W, a combination can be found that satisfies the equation for P with Pxyyz = xy(xyz). A proof of the theorem rests with an examination of either of the following two combinations, both found in less than 11 CPU seconds.

QQ(W(Q(QQ) ))

B(W(Q(QQ)))Q

In contrast to our approach to proving the preceding six theorems, for this theorem, we replaced the restriction of paramodulating from the left sides of equalities into the left sides of inequalities with the restriction of paramodulating from the right sides into the right sides.

493

Moreover, the shortest such combination that we have found in which all three combinators occur, measured in occurrences of B, Q, and W, has length 6, and we have also found a combination of length 6 in which B is absent. Our approach to finding appropriate combinations relies heavily on paramodulation and the set of support strategy. In addition, for this type of problem, we frequently restrict paramodulation to be from the left side of positive equalities only and into the left side of the inequalities. We use the ANSWER literal to extract (from each proof) the desired combination.

5. Finite Semigroups The basic operations of a theorem prover like OTTER can be used to carry out a variety of algebraic operations. For example, given a subset S of a set T and a binary operation f on T, it is easy to get OTTER to compute the subset of T generated by S andf. One merely lists the elements of S: p(a) p(b) . ° °

where p(x) means " x is an element of the set generated by S a n d f ' , and where the elements a, b .... are the elements of S. One also needs a "closure" axiom ~p(x) I ~p(y) I p(f(x,y)) and a definition off, which can be given as a demodulator f(x,y) =.... Then the standard algorithm of OTIER, computing as it does the logical closure of its input, computes the closure of S in T under f [9]. Optimizations are possible, also within the OTYER framework, if f is associative. Recently we have applied this outlook to the computation of the sizes of certain finite semigroups whose sizes were previously unknown. A semigroup is a set with an associative binary operation. We start by defining the 5-element Brandt semigroup B2 by the following multiplication table:

0 e

f a

b

0 0 0 0 0 o

e 0 e 0 0 b

f 0 0 f a o

a 0 a 0 0 f

b 0 0 b e o

An interesting semigroup, because it plays a key role in classifying other semigroups with certain properties (see [4]) is F2B2, which can be described as follows: Consider all 25tuples of the form xl ... x25, where xi is in B2. Let g l = (O,O,O,O,O,e,e,e,e,ef f f f J, a,a,a,a,a,b,b,b,b,b)

494

g2 = (O,ef , a,b,O,e f ,a,b,O,e f ,a,b,O,e f ,a,b,O,e f ,a,b ) (It will be useful to denote these by 05eSfSaSb 5 and (0efab) 5, respectively.) Define F2B2 to be the semigroup generated by g l and g2 under componentwise multiplication in B2 and the "inverse" operation in B2. (The elements 0, e, a n d f are their own inverses, and a and b are mutual inverses.) Although F2B2 is clearly finite, there are potentially 525 = 298,023,223,876,953,125 elements. In [4], an automated theorem prover similar to OTTER was used to compute that it actually had only 71 elements and to reveal other information about its internal structure. Since the operation in a semigroup is associative, it was possible to take advantage of the optimization cited above, so the input to O'IWER consisted of the following clauses, where p(x) is construed to mean that x is an element of F2B2. Axioms

Set of Support

g(tup(0,0,0,0,0,e ..... b,b)) g(tup(0,e,f,a,b,0 ..... a,b)) g(tup(0,0,0,0,0,e ..... a,a)) g(tup(0,e,f,b,a,0 ..... b,a)) -.g(x) I ~p(y) I p(f(x,y))

p(tup(0,0,0,0,0,e ..... b,b)) p(tup(0,e,f,a,b,0 ..... a,b)) p(tup(0,0,0,0,0,e ..... a,a)) p(tup(0,e,f,b,a,0 .....b,a))

Demodulators f(tup(xl,x2 ..... x25),tup(yl,y2 ..... y25)) = tup(m(xl,yl),m(x2,y2) ..... m(x25,y25)) m(0,x) = 0

m(b,b) = a In this case the deduction is small enough that almost any theorem prover is adequate. However, related questions are more difficult. The first of these is to compute the size of F3B2, where B2 is as above and F3B2 is the corresponding set of 125-tuples generated by 025 e 25f25 a 25b 25 (05 eS fS aS aSbS)S (Oefab) z~ and their inverses. This has a potential size of 5125. We used O'ITER to compute that its actual size was 1435. A semigroup closely related to B2 is the semigroup B21 obtained by adjoining an identity element 1 to B2. One then asks for the sizes of F2B21 and F3B21. The size of F2B21 was readily calculated to be 223. One was left with the following table:

B2 B21

F2 71 223

F3 1435 ?

Despite the fact that the F3B21 appeared within reach, it turned out to be much larger than expected, and resisted attempts to calculate it until OTTER was moved to a large-memory

495

machine and specially tuned for this problem by adding a special intrinsic for calculating products and some modifications to the underlying data structures to conserve memory. The potential number of elements is 636. Finally, on a Sequent Symmetry with 120 megabytes of memory, the answer 102,303 was obtained. The run was a substantial one, involving generation of 613,818 clauses altogether, of which 511,521 were subsumed in a run lasting more than 7 hours. The most essential feature of OTTER used was its extremely fast forwardsubsumption technique. The run also computed substantial information on the internal structure of F3B21. This will be reported on separately.

6. The Art of Exploring Huge Search Spaces Problems of the sort discussed in this paper vividly illustrate the need to dramatically prune the search space. The programs that we have created to produce proofs of such problems are directly based on a number of techniques that address different aspects of redundancy control and search prioritization. In particular, we have made use of subsumption, the set of support strategy, demodulation, and weighting. In this section, we discuss each of these techniques, pointing out specific problems that illustrate w h y we believe that each is required.

6.1. Subsumption Subsumption offers a straightforward attempt to eliminate redundancy by discarding clauses that are obviously "weaker" than other existing clauses. Debates have existed for years about the cost of performing subsumption tests, and it is not completely clear that a complete subsumption test is always required. For example, one might test only for cases in which the subsuming clause is a unit, since that test can be performed quickly. Similarly, one can frequently avoid the use of back subsumption (the subsumption of already existing clauses by a newly derived clause) without disastrous consequences. However, we doubt that any system will automatically derive a proof of the following problem from the implicational calculus (posed as a challenge problem by Frank Pfenning at CADE-9 [8]) without using subsumption: --~(i(x,y)) 1--d?(x) I P(y) P(i(i(i(x,y),z),i(i(z,x),i(v,x)))) --~(i(i(a,b),i(i(b,c),i(a,c)))) A typical run of our system to demonstrate that this set of clauses is, in fact, unsatisfiable generates over 6,000,000 clauses, of which well over 90% are subsumed. It is worth noting, in the context of subsumptiou, that we recently wrote a paper [13] with (what we thought were) a graduated set of five problems illustrating the utility of subsumption. To our surprise, Andre Marien was able to solve the fourth problem in the set using a "Prolog Technology Theorem Prover" which did not use subsumption. Mark Stickel has verified his result (by reproducing it on his system). The specific problem asks one to prove that the formula XGK is a single axiom for equivalential calculus, by deriving the formula PYO.

496

6.2. The Set of Support S t r a t e g y The set of support strategy is not, in fact, a mechanism for redundancy control. Rather, it is used to avoid generation of general lemmas, when a more focused search often produces a proof fax more quickly. Examples of the general utility of this strategy are widely available in the literature. Indeed, serious debates have revolved around how best to choose the clauses to be put into the set of support. As always, we encourage the reader to experiment and observe the results on a wide class of problems. To emphasize the utility of the set of support strategy (for some, but certainly not all problems), we propose the following problem: X----X

a(a(a(Q,x),y),z) = a(y,a(x,z)) a(a(W,x),y) = a(a(x,y),y) a(a(a(a(x,f(x)),g(x)),g(x)),h(x)) ~ a(a(f(x),g(x)),a(a(f(x),g(x)),h(x))) This problem is an encoding of a theorem in combinatory logic that states the following: A combinator A can be constructed from the combinators Q and W such that Axyyz = xy(xyz), for arbitrary x, y, and z. It should be noted that this is actually a more general version of a problem proposed in the context of relevance logics by Ohlbach and Wrightson at CADE-7 [6]. In our experiments, using paramodulation with minimal constraints (in particular, no paramodulafionfrom or into variables), we found that the use of the set of support strategy (putting just the last clause in the set of support) allowed a proof in less than 10 seconds (on a Sun 4); without the use of set of support, no proof was produced in 10 minutes. A proof produced in less than 30 seconds that did not rely on the use of set of support would be of interest to us. 6.3. D e m o d u l a t i o n Demodulation is used to control redundancy by performing two distinct functons: 1.

When two apparently distinct terms have been proven equal, it is frequently critical that one of the references be removed from the set of current clauses. For example, in problems in group theory, one might always wish to rewrite i(i(x)) as x (where i(x) is the inverse of x).

2.

In some cases, demodulation is used to rewrite a term into a known canonical representation (for example, one might wish to fight-associate a term in which the function is known to be associative).

Clearly, the two uses are closely related, and deeper insights into the basic theory of rewriting have emerged over the last decade. A problem that clearly illustrates the practical role of demodulation can easily be found within the context of Robbins algebras: Input Clauses X=X

o(x,y) = o(y,x) o(o(x,y),z) = o(x,o(y,z))

497

n(o(n(o(x,y)),n(o(x,n(y))))) = x n(g(x)) = x o(E,E) = E

o(n(o(A,n(B))),n(o(n(A),n(B)))) ¢ B n(n(C)) ;~ C o(D,D) # D o(x,n(x)) # x

% Robbins axiom R3 % lemma % hypothesis % denial of Huntington axiom H3 % denials of sufficiency properties

Demodulators o(x,y) = o(y,x) o(o(x,y),z) = o(x,o(y,z)) n(o(n(o(x,y)),n(o(x,n(y))))) = x n(g(x)) = x o(E,E) = E

% Robbins axiom R3 % lemma % hypothesis

Our experiments using paramodulation produce computer proofs in a few minutes, and demodulation apparently plays a major role. Again, we would be quite interested in having anyone produce a proof without making heavy use of rewriting. 6.4. W e i g h t i n g

Versions of weighting have now been in use for almost twenty years. The essential notion is that one circumscribes the set of terms that are allowed to appear in clauses, or that one limits the complexity of the clauses that are retained. To do this, a mechanism is used to estimate the complexity of terms and clauses. For example, the most common (and quite useful) measure is just to count the symbols that occur in the term or clause. Various schemes use weighting to discard generated clauses and to prioritize the search by using weighting to dictate when clauses become candidates for use by inference rules. The use of weighting to discard generated clauses that exceed some designated complexity can dramatically limit the number of clauses that must be retained. However, the more critical use appears often to be the use of weighting to order the selection of clauses from the set of support (in particular, the selection of the next clause used to generate new resolvents or paramodulants). We should note that a very simple weighting scheme (such as symbol count) is often adequate. Occasionally, it is very useful to be able to use specialized weighting schemes to produce desired effects. For example, one might preferentially weight equality clauses that had " h e a v y " left arguments, but " l i g h t " right arguments, to produce rewrite rules that simplify generated clauses. To illustrate the utility of something as simple as symbol count, we urge the reader to consider the problem from the impticational calculus cited earlier under the topic of subsumption. We believe that weighting and subsumption are the two key redundancy control mechanisms required to derive a proof for that problem. Perhaps a more interesting phenomenon is represented by the following problem from the equivalential calculus. --ff'(e(x,y)) I ~P(x) I P(y) ---~P(e(e(a,b),e(c,e(e(c,b),a))))

% denial of YRO

498

P(e(x,e(e(y,z),e(e(x,z),y))))

% XHK

A proof that this set is unsatisfiable is straightforward, if preference is given to clauses of the form P(e(tl,t2)) in which the complexity of t2 is less than the complexity of tl (and greater emphasis is placed upon clauses in which the difference is greatest).

6.5. Summary Our view that effective theorem proving hinges on successful redundancy control is probably an overgeneralization. There are almost certainly interesting theorems for which proofs can be acquired more quickly by foregoing the cost of the techniques we employ. On the other hand, we seriously doubt that approaches with minimal redundancy control will be at all "robust" in that most of the theorems that can be proven with the techniques of redundancy control cannot be proven without such techniques.

7. Conclusions The objectives of this article are three: (1) to present some of the results of our research forays into various areas of mathematics and logic; (2) to offer experimental data supporting our position concerning essential components for the automation of reasoning when the goal is the proof of interesting theorems; and (3) to suggest challenge problems for measuring the value and power of concepts, paradigms, and programs. Consistent with these objectives, we began by giving evidence of the value of using an automated reasoning program for making contributions to mathematics and logic. The contributions briefly discussed here include answers to open questions, new theorems, and proofs (of existing results) that are far shorter and far less complex than those previously known. The fields of interest are Robbins algebra, various logical calculi, combinatory logic, and finite semigroups. Focusing on the results of the earlier sections, we discuss the need for using the set of support strategy, demodulation, subsumption, and weighting. Our conjecture is that, without all of these components, a paradigm or program will offer inadequate power when the goal is proving theorems of even moderate difficulty or of attacking open questions. Because of the growing interest in automated reasoning, evidence to the contrary is most welcome. From the viewpoint of challenge problems, whereas some of the theorems discussed here focus on equality-oriented reasoning, for others, such reasoning is irrelevant. These problems vary widely in difficulty; for us to solve them, they required a number of approaches, of course all within our usual paradigm.

References [1] Barendregt, H.P. The Lambda Calculus: Its Syntax and Semantics, North-Holland, Amsterdam, 1981. [2] Henkin, L., J. Monk, and A. Tarski. Cylindric Algebras, Part I, North-Holland, Amsterdam, 1971. [3] Huntington, E. New sets of independent postulates for the algebra of logic, with special

499

reference to Whitehead and Russell's Principia Mathematica, Trans. of AMS 35 (1933), 274304. [4] Lusk E. and R. McFadden. Using automated reasoning tools: a study of the semigroup {F2B2}, Semigroup Forum 36, 1 (1987), 75-88. [5] McCune, W. OTTER 2.0 Users Guide, ~krgonne National Laboratory Report ANL-90/9, 1990. [6] Ohlbach, H.-J. and G. Wrightson. Solving a problem in relevance logic with an automated theorem prover, Proc. of CADE-7, Springer-Verlag Lecture Notes in Computer Science, Vol. 170, ed. R. Shostak, New York, 1984, 496-508. [7] Peterson J. The Possible Shortest Single Axioms for EC-Tautologies, Aukland University Department of Mathematics Report Series No. 105, 1977. [8] Pfenning, F. Single axioms in the implicational propositional calculus, Proc. of CADE-9, Springer-Verlag Lecture Notes in Computer Science, Vol. 310, ed. E. Lusk and R. Overbeek, New York, 1988, 710-713. [9] Slaney, J. K. and E. Lusk. Parallelizing the closure computation in automated deduction, to appear in the proceedings of CADE-10, 1990. [10] Smullyan, R. To Mock a Mockingbird, A. Knopf, New York, 1985. [11] Wos, L.o R. Overbeek, E. Lusk, and J. Boyle. Automated Reasoning: Introduction and Applications, Prentice-Hall, New York, 1984. [12] Wos, L., S. Winker, B. Smith, R. Veroff, and L. Henschen. A new use of an automated reasoning assistant: open questions in equivalential calculus and the study of infinite domains, Artificial Intelligence 22 (1984), 303-356. [13] Wos, L., R. Overbeek, and E. Lusk. Subsumption, a sometimes undervalued procedure, preprint MCS-P93-0789, Argonne National Laboratory, Argonne, IlL, July 1989. [14] Wos, L., S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, and R. Butler. OTFER Experiments Pertinent to CADE-10, Argonne National Laboratory Report ANL89/39, to appear.

A Mechanically Assisted Constructive Proof in Category Theory James A. Altucher

Prakash Panangaden*

Department of Computer Science Carnegie Mellon University

Department of Computer Science Cornell University

Abstract Recently there has been a significant confluence of ideas from category theory, constructive type theory and functional programming. Our goal is to develop a toolkit that provides mechanical assistance in putting together constructive proofs of theorems in category theory and to extract executable programs from the result. We describe a machine-assisted proof of the adjoint functor theorem from category theory. The theorem is a simple version of the adjoint functor theorem. It was chosen because of its interesting constructive content, the fact that the machine-checked proof is fairly large and because it is mathematically non-trivial. The category theory toolkit was built on top of the Nuprl system. The core of this toolkit is a collection of tactics for mechanizing "diagram chasing". We selected Nuprl because the underlying type theory is constructive and one can automatically extract executable programs from the proofs and partly because of the large collection of tactics and techniques that were available to us. So far we have concentrated on proving the theorem rather than on extracting the computational content of the theorem.

1

Introduction

The last twenty years have seen a significant confluence of ideas from category theory, constructive type theory and functional programming. Constructive type theories have been recognized as examples of certain classes of categories. Type constructors have been recast as categorical constructions and category theorists have developed fascinating new models of type theories. Research in type systems have led to new typed lambda calculi and, in turn, to new typed functional languages. Recently Burstall [3] has proposed categoricalprogramming. Categorical programming takes advantage of the fact that proofs in category theory tend to be constructive and often *Research supported in part by NSF Grant CCR-8818979.

501

of a very mechanical nature, amenable to programming. Furthermore, when coded up as programs they lead to very general programs since they are abstracted over categories and hence independent of data type. This program has been pursued vigourously by Burstall, Rydeheard and their co-workers, see, for example, the recent book by Burstall and Rydeheard [14]. Another example of the relevance of category theory to computer programming has been shown by Moggi. He showed that by using monads one can incrementally build models for languages with fairly complicated features; in other words, one has a modular approach to denotational semantics. Our program is twofold, first we would like an environment in which one can develop theorems in category theory with as much automated assistance as possible. As such, this is part of the general efforts to develop mathematical problem solving environments such as, for example, is being done in the Nuprl project at Cornell [6] or in the Ergo project at CMU. We believe that category theory is a particularly interesting choice in view of the generality of the subject and its recently forged connections with computer science. Our second goal is to contribute to categorical programming in the same spirit as the Computational Category Theory program enunciated by Burstall. Our approach, however, is to extract the programs from constructive proofs rather than to write the prograr~s directly. Clearly, our extracted programs will be much less efficient than hand-coded programs but we feel that it is nevertheless an important experiment. The importance stems from the clear advantage of being able to develop proof and "program" together. We are also motivated by the fact that the more interesting extracted programs one can exhibit the more pressure there will be to improve "extraction technology." To summarize, our goal is to develop a toolkit that provides mechanical assistance in putting together constructive proofs of theorems in category theory and to extract executable programs from the result. In this paper, we describe an experiment in using a machine-assisted proof development enviromnent to prove an adjoint functor theorem. This theorem was chosen because of its interesting constructive content and the fact that the proof was fairly large and hence stressed the capabilities of the Nuprl system. Even stating the theorem requires the development of a significant fraction of all the elementary definitions in category theory. It required the development of new automated inference mechanisms for diagram chasing. Finally, the adjoint functor theorem is mathematically nontrivial and part of the experiment was to do this with a person who was learning category theory as the proof was being developed. In this regard we are able to say that the proof was carried out without any unusual contortions that required an expert categorist; the main technical contribution was in the development of powerful and efficient enough tactics that made this program feasible. The version of the theorem that we prove is taken from Herrlich and Straeker [8]. It says that if G is a functor from a complete category A to B then G has a left adjoint if and only if G preserves limits and every/3 object has a G-solution set. The mechanical proof at this point is complete in one direction, the one that asserts the existence of the left adjoint. This is the direction with interesting constructive content. In the other direction we have proved that every object has a solution set but we have yet to complete the demonstration of limit preservation. This statement of the theorem should give some idea of the number of definitions involved.

502 As a prelude to the adjoint functor theorem we completed a mechanical proof of the special case when the categories are posets and the adjoint pair is a Galois connection. We also proved several simple theorems as a sanity check of our definitions. As an example, suppose that One is the one object one morphism category and F is the unique functor from a category ~t to One. Then the left adjoint of F maps the object of One to the initial object of A. The category theory toolkit was built in the Nuprl system. We selected Nuprl because the underlying type theory is constructive and one can automatically extract executable programs from the proofs. We also benefited tremendously from the sophisticated user interface it provides, from the the rich collection of tactics that the Cornell group has developed and from the expressiveness of the underlying type theory. The results of the experiment are that it is indeed feasible to develop such a proof. We feel that the most significant outcome is that it has given us ideas for designing and implementing a new theorem proving environment especially geared towards category theory. The effort took approximately 7 months to complete, this included the time spent for the first author to learn to use the Nuprl system and to learn the category theory needed to define the concepts and carry out the proofs. Clearly, a more experienced user would have done this more quickly. In this short version of the paper we do not provide a review of category theory or type theory. In the full paper [1] we include self contained reviews of these concepts. As far as the category theory is concerned, the first few chapters of Mac Lane's book should more than suffice [9]. A summary of both type theory and category is contained in a review article by Panangaden, Mendler and Schwartzbach [12].

2

Nuprl Definitions for Category Theory

An important part of the development of any mathematical theory is the ability to state definitions that abstract out some important ideas. Category theory possesses a small core of remarkably general definitions; category, functor, natural transformation, universal morphism. Nuprl provides a definition facility that allows one to state theorems and lemmas much as they might appear in a mathematical logic text. Unfortunately, this level of abstraction is not preserved by the proof steps. In other words, refinement steps may expand definitions into the base type theory and result in proofs that are not possible to read at the proper level of abstraction. The definition facility is under development and we expect that the new definition facility will allow significantly more elegance in the use of definitions. The definition of category uses the dependent product type to encode the standard definition, like Dyckhoff [5]. The definition below is as it appears in the proofs we developedI.

Category == Obj :U2

1We use typewriter font for text that is taken directly from the Nuprl system.

503

# Mor:(Obj

# Obj)->Ul

# Id: (ol:Obj->Mor(ol,ol)) # o : (ol :Obj ->02 :Obj ->o3 :Obj ->Mor (oi, o2) ->Mor (o2, o3) ->Mor (oi, o3) )

# forall A,B:Obj.forall f:Mor(A,B). f o Id(A) {A,A,B} = f in Mor(A,B)

# forall A,B:Obj.forall g:Mor(B,A) Id(A) o g {B,A,A} = g in Mor(B,A)

# forall A,B,C,D:Obj.forall f:Mor(C,D).forall g:Mor(B,C).forall h:Mor(A,B). ((f o g {B,C,D}) o h {A,B,D}) (f o (g o h {A,B,C}) {A,C,D})

-in Mor(A,D)

The definition above asserts that a category consists of two collections, the objects and the morphisms and that the morphisms obey some standard axioms. Note that composition is defined between composable morphisms only. Having dependent types makes it possible to express this easily. Composition, defined this way, takes five arguments instead of two. We use the definition facility to put the three additional arguments in braces so that it reads more like the traditional definition of composition. The last part of the definition expresses associativity of composition. The definition above uses the notion of type "universes" in an essential way. Note that the collection of objects is in a higher universe (1/2) than the collection of morphisms between two objects. In category theory one traditionally requires the collections of morphisms between a pair of objects to be a set whereas the collection of objects may be a proper class, such category is called a locally small category. Categorists are often driven to a thesaurus to find synonyms for the word "collection" in order to accomodate larger and larger collections. The point is that there are simple constructions that drive one out of a collection of categories; for example, functor categories between locally small categories are not locally small, in general. In fact the notion of stratified universes was present in some treatments of category theory, notably Grothendieck's [7], long before Martin-Lof's type theory emerged. The other feature worth noting about the above definition is that a morphisms comes with the information of what its domain and codomain are. This turned out to be essential in the rewrite tactics that we developed later. It allows one to check whether morphisms are indeed composable. Categories are often used to model different areas of mathematics or different aspects of programming languages and programming logics. In Nuprl when we want to model a particular theory using the category theory library we will open a new theorem and state as the top level goal "Category". A proof of this goal will be a term which actually inhabits the type Category. For instance we have proved the goal "Category" using U1 (the universe of small types in Nuprt) to represent the objects and the function space between two types to represent the morphisms. Identity and composition are what you would expect and the axioms were easily proved. Proving theorems about this category would be equivalent to proving theorems about U1 so in some sense each category can be thought of as a "mathematical workspace". Reasoning about the relationship between

504

two categories can thought of as reasoning about the relationship between two areas of mathematics. This leads us to the next definition: F u n c t o r ( A , B ) == fl:IAt -> [B] # f2:(ol:IAJ -> o2:[Al -> Hom(A)(ol,o2) -> Hom(B)(fl(ol),fl(o2))) # forall x,y,z:IAl, forall f:Hom(A)(y,z).forall g:Hom(A)(x,y). f2(x)(z)(f o(A) g) = f2(y)(z)(f) o(B) f2(x)(y)(g) in Hom(B)(fl(x),fl(z)) # forall x : l J I , f2(x)(x)(Id(A)(x)) = Id(B)(fl(x)) in Hom(B)(fl(x),fl(x))

In this definition we refer to two different categories with different compositions and identities. Here we use the notation o as a function that takes a category as argument and returns the composition of that category. Thus we write ( f o (A) g) to mean that we are using composition in the category A. A similar statement applies to Id and Hom. We have suppressed the additional arguments that occur in the definition of composition. The definition typed into Nuprl must, of course, have these arguments. Here Horn is a function that takes a category and extracts the morphism function, the latter is a function that takes two objects and returns the type of morphisms between those objects. When A is a category IAI stands for the class of objects in A. Part of the original motivation for formulating category theory is to make precise the notion of natural transformation. The following definition is the Nuprl definition for natural transformation. Nat_Trans(C,D,F,G) == n: ( o l : l C l -> H o m ( D ) ( F ( o l ) , G ( o l ) ) ) # forall a,b:IC].forall f:Hom(C)(a,b).

G(f) o n(a) = n(b) o F(f).

Although we have given three important definitions in category theory all we can do so far is model theories and logics with categories, functors or natural transformations. To actually prove theorems in category theory we need many other basic tools and constructs. Among the definitions that were implemented are sections, retractions, isomorphisms, epimorphisms, subobjects, limits, pullbacks, universal maps, adjunctions, CCC's,triples and many more. Particularly important was the ability to express universal maps: If A and B are categories, G is a functor from A to B ,b is an object of B, a is an object of A, and u is of type Hom(b,G(a)) then universal_map(A,B,G,b,a,u) == forall al:iAi.forall f:Hom(B)(b,G(al)), f = G(fl) o u

exists!

fl:Hom(A)(a,al).

505 Many theorems also had to be proved in order to make non-trivial use of these definitions. The development of the library was greatly assisted by the interface provided by the Nuprl system. The definitions and proofs greatly benefited from the definition facility in Nuprl and the readability and naturality of our definitions was assisted by the use of the dependent product (often referred to as a "Sigma" type) type in the Nuprl type theory.

3

Tactics

The use of tactics in interactive proof development has proved crucial to the development of non-trivial proofs. In the Nuprl project a rather rich collection of tactics has been assembled, primarily through the work of Howe, Basin and Murthy. An example of a very powerful tactic developed by the Nuprl group is the Autotactic. This tactic is capable of proving many goals of the form t E T where T is a type. This type of goal is known as a well-formedness goal and appears at almost every stage of a proof in Nuprl. A basic, but rather outdated, account of tactics in Nuprl appears in the book "Implementing Mathematics" by R. Constable and his coworkers [6]. For our purposes the main tactics that we needed were "diagram chasing" tactics. When developing the category theory library we have attempted to make the proofs as automatic as possible. Although the tactics provided by the Nuprl system were helpful, particularly in proving well-formedness goals, they did not provide the support required in order to do diagram chasing. Tactics for doing this became important for both aesthetic reasons (we wanted the proofs to resemble textbook proofs) as well as for practical reasons. Some proofs that could be solved automatically using some simple rewrite tactics would take hundreds of steps using the tactics that were provided or even thousands of steps using just the inference rules of the underlying type theory. Using these tactics we have been able to prove other basic results, largely automatically, including an proof that the composition of two functors is a functor. This latter proof was done after the proof of the adjoint functor theorem was complete and did not use tactics that wre specifically writen for it. Also included in our rewrite package are tactics for exposing the properties of certain terms in an equation and doing some simple syntactic manipulations. The core of the package is a user supplied database of lemmas of the form Vx....Vy.B1 --~ Each lemma is paired with a list of patterns where each pattern represents the left-hand side of the equality in the lemma. A subterm of an equation is said to match a lemma if it unifies with one of the patterns. The reason that each lemma is associated with more than one pattern is because the Nuprl definition facility allows the user to supply more than one possible form for a given term. Current changes being made in Nuprl may resolve this inefficiency. The tactic, R e w r i t e , takes a lemma, a list of patterns, and a term appearing in the goal of the proof being proved. If the term unifies with one of the patterns then the appropriate variables are instantiated into the lemma. The result will be an equation X ' = Y ' . R e w r i t e will transform this equation into the rewrite rule X --* Y and apply this rewrite to the goal. A similar tactic can be used to rewrite hypotheses. •. . B 2 . X t = X 2 .

506

Using the currying capabilities of ML one can build rewrite tactics such as LeftAssociate by applying Rewrite to the associativity lemma and the appropriate pattern list. T h e result will be a tactic which given a term of the form f o (g o h) will rewrite it to ( f o g) o h. A tactic that makes use of Rewrite is the DiagramRewrite tactic. This tactic first breaks an equation into a tree of subterms. A simple example is the following: if the equation is (f o (go h)) o k = (fog) o (h o k)

then the resulting tree is root

(f

o (g o h)) o k f o (g o h)

f goh g

h k (f o g) o (h o k) fog f g

hok h k

DiagramRewrite will then take a rewrite tactic, R, as input and, by doing a depth first search on the tree, attempt to apply R to each subterm. If R successfully rewrites a subterm then DiagramRewrite is called recursively on the new resulting equation. This process will continue until the equation does not change. It is also possible to combine rewrite tactics using the tacticals supplied by Nuprl. For instance, if one wanted a rewrite tactic which given a subterm of the form f oid rewrites the term to f or given a subterm of the form id o g rewrites it to g one would want a tactic Identity where Identity = )~x. LeftIdentity x O R E L S E RightIdentity x. T h e tactics LeftIdentity and RightIdentity are the rewrite tactics that reduce the above terms. A similar rewrite package for Nuprt was developed independently for the hardware verification library [2]. T h e techniques used there are similar to the techniques developed by Paulson for ISABELLE [13]. These are also similar to the techniques used in this part of our rewrite package in that they both use higher order tactics which take rewrite tactics and a user supplied temma database to do the appropriate rewriting. However, our rewrite package does not extend to user-defined equalities but only makes use of the equality which is associated with each type in Martin-Lof type theory. We feel that it would not be difficult to extend our rewrite package to include this facility but an example where it is needed in our proofs has not occurred yet.

507

An example of our rewrite package follows. To show" the equality

F ( f o g) o F(h o k) = (F(f) o (F(g) o F(h))) o F(k) where F is a functor and the other symbols denote morphisms, one can apply

DiagramRewrite(FunctorsPreserveComp) and

T H E N DiagramRewrite( Assoc). A similar tactic was used to prove that the composition of two functors is a functor. This theorem is similar to the challenge problem issued by Wos in the Journal of Automated Reasoning to prove automatically that the composition of homomorphisms is a homomorphism [15]. Another application of DiagramRewrite occurs when we prove theorems about diagrams. For instance, we know that if the following two equations hold l o l' = g o h and k o j = f o l' then the equation (k o j) o I = f o (g o h) also holds. Once this lemma was proved we were able to construct a rewrite tactic which given terms of the form f o (g o h) would rewrite them to (k o j ) o l. It would also be possible to make a rewrite tactic which would rewrite the above term in the other direction, i.e. (k o j ) o I would rewrite to f o (g o h). Hence, by implementing a theory of diagrams on Nuprl one can build a substantial and useful set of general rewrite tactics related to simple diagram chasing. When using a constructive theorem prover it is important to have tactics that can expose the properties of a certain proposition by reducing the function that a proposition might represent. For instance suppose

9. P:D -> U1 I0. f: (forall a:A. forall b:B. exists d:D. P(d)

appears in the hypothesis list and f s t ( f (x) ( y ) ) appears in the goal. We would like to be able to say that this term satisfies P. This can be accomplished by a tactic written by the Nuprl group called GenThen. When given the above term as input, GenThen introduces a new constant, say dl, replaces every occurrence of f s t ( f (x) ( y ) ) with dl and introduces a new hypothesis P ( d l ) . GenThen takes as input the term that the user wants simplified and the number of the hypothesis that contains the relevant function. Often, however, a given function may appear in many different places in a goal. Each occurrence of the function may have different arguments applied to it. It would be too difficult for the user to apply GenThen to each occurrence of a term containing the function in order to expose its properties. As part of our package, we have written a tactic, ExposeProperties, which takes a function and the number of arguments the function expects and attempts to unify the function with every subterm in the subterm tree. Similarly to DiagramRewrite, every time ExposeProperties succeeds in rewriting a subterm it calls itself recursively on the new" resulting equation. An example of when this proved useful will be shown in the next section.

508

4

The P r o o f of the Adjoint Functor T h e o r e m

In this section we outline the proof of the adjoint functor theorem at the level of lemma structure. This closely follows the pattern of the presentation in Herrlich and Straeker's book [8]. One of the positive experiences that we had was being able to carry out this proof without any contortions. The mechanically developed proof closely follows this structure. We annotate the proof outline with a discussion of the Nuprl definitions involved and the tactics used. T h e o r e m 1 ( F i r s t A d j o i n t F u n c t o r T h e o r e m ) Let A and/3 be categories, ~4 is complete and G is a functor from A to B. G has a left adjoint if G preserves limits and each B-object has a G-solution set.

We will first show what conditions are necessary for an adjoint situation to exist and then show how the above situation meets these conditions. L e m m a 1. If each b E Obj(B) has a G-universal map (nb, Ab) then G has a left adjoint. Constructing the left adjoint is the heart of the proof. The following lemma is used to do this. L e m m a 2. Let A and B be categories and G a functor from A to B. Let bl, b2 E Obj(/3) such that (ui, Ai) is a G-universal map for Bi, i = 1,2 then for each morphism f : bl --* b2 there exists a unique morphism f~ : A1 -* A2 such that the following diagram commutes. Since each bl E Obj(B) has a G-universal-map (ul, al) we can construct the left adjoint F in the following manner. Let F(bc) = ac and if f : b --* b' then let F(f) = f' where f' is as constructed in the above theorem. Proving this is actually a functor requires using the extracted code obtained from the above lemma and doing some rather extensive diagram chasing. T h e tactic ExposeProperties came in particularly useful when proving that the functor preserves composition of morphisms. At that point, several different occurrences of the above lemma, being used as a function, appeared in the goal. Also, the fact that each occurrence had 9 parameters made it too unwieldy in practice to repeatedly apply the GenThen tactic. The tactic ExposeProperties was able to reduce the goal significantly. When proving the above functor is an adjoint to G we made use of the fact that for each hi, ul is the unit of the adjunction. Now that we have shown that an adjoint functor can be constructed when every b has a G-universal map, we need to show that if G preserves limits and every b has a G-solution set then every b has a G-universal map. This is shown by proving several lemmas about the properties of multiple equalizers and multiple products. Some of the lemmas which needed to be proved were: 1. Each multiple equalizer is a subobject.

509

2. If e is an equalizer for f and G and e is an epimorphism then e is an isomorphism. 3. Let G : A--* B b e a f u n c t o r and let u : b ~ following are equivalent:

G(a) b e a B - m o r p h i s m .

Then the

(a) (u,a) is a G-universal map for b (b) (u,A) is a G-solution set for B and u-G-generates for A. 4. If (u,a) is a G-universal map for B then u extremally G-generates A. 5. If f is an isomorphism then it is a monomorphism and a retraction. 6. If A,B are categories, G : A --* B, F : B --+ A, and F is the left adjoint to B then for all b E Obj(B) there exists a universal map for b. Other lemmas that were proved are listed in the complete paper [1]. The proof was complicated and detailed enough that it provides a useful study of what is needed in a theorem prover which is to be used to prove substantial constructive proofs.

5

Extracting Constructive Content

One of the interesting aspects of adjoint functors is that uninteresting functors have interesting adjoints. For example, the forgetful functors from a category to algebras to S E T typically have, as left adjoint, the free construction of that algebra. The proof of the A F T allowed the Nuprl system to extract a program which is an example of an interesting categorical programming paradigm. The work described here is still preliminary. The extracted terms turn out to be very large and executing them involves first showing that the functor for which we are computing the adjoint satisfies the limit preservation properties and the solution set condition. We expect to carry out the proofs needed for this section and compute free constructions as adjoints over the next two months. Given some category of algebras one can use the A F T to generate the functor from

S E T to t h a t category which given a set returns the free algebra generated from that set. As an example define MON, the category of monoids and monoid homomorphisms, in the following way:

Monoid

== A:UI

# op:(A->A->A) # e:A # ... m o n o i d a x i o m s

A monoid homomorphism would be defined as:

510

monoid_homomorphism(A,B) == f:IAl->ISl # f(Id(A)) = Id(B) # forall x,y:IAl f(x * y) = f(x) * f(y)

Using these definitions we can prove the theorem >>Category by using monoids to represent the objects and monoid homomorphisms to represent the morphisms. The extracted code from this proof will be the category M O N . In a similar way we can prove a theorem in which the extracted code is the forgetful functor from M O N to S E T . Proving that M O N is complete, that the forgetful functor preserves limits and that every object in S E T has a solution set could be a non-trivial task on Nuprl. The tactics that we developed and the definitions and lemmas in the library made these proofs fairly easy. The fact that many categories have a similar structure to M O N should allow tactics to be written that can automatically prove many categories of algebras to be complete. The term extracted from the AFT when applied to a set should generate an object of the category M O N . described our experiences with using Nuprl as a proof development environment for category theory. The main technical effort involved the development of a family of tactics for rewriting that are of use in category theory. For example, we were able to show that the composition of functors is a functor almost completely automatically. Recently Larry \Vos had posed the problem of showing that the composition of two homomorphisms is a homomorphism [15] as test problem 15. Our proof that the composition of two functors is a functor does not, of course, solve Wos' problem but it does represent progress in that direction. Category theory is an excellent arena for automated deduction partly because of the tremendous variety of mathematical concepts that can be expressed and partly because there are a few, very general, proof patterns. In our opinion this area of mechanized mathematical reasoning has not received the attention that it deserves from the automated deduction community at large. Indeed we feel that our main contribution is that we demonstrated that one can really do a non-trivial proof in category theory. It is our opinion that experts in rewriting theory could implement systems that would probably be more useful than our package. It is our hope that our effort will motivate such people to think about using their methods to prove substantial theorems in category theory. We suspect that a system with powerful rewrite mechanisms, for example, Paulson's ISABELLE system [13], could well be as effective for automated deduction in categorytheoretic. Part of our goal was to extract executable terms from the constructive proof. In principle, such extraction can be done now, but we need to do more work before we can apply the extracted term and obtain a meaningful result. Currently we are interested in generating the adjoint to the forgetful functor from monoids to sets. Martin-Lof type theory provided a very useful object language for implementing category theory. Martin-LSf remarked that "set theory does not provide adequate foundations for category theory" [10]. While we do not make such a claim, we do find that the hierarchy of universes in intuitionistic type theory fit naturally with many of the definitions

511

of category theory. Viewing concepts in category theory as specifications in a programming logic has allowed us to move towards extracting meaningful programs that could be of use in the development of a categorical programming language. Another possible choice for an object language could have been the Calculus of Constructions (CoC) [4]. However, the fact that an equality relation is built into each type in Nuprl proved to be quite useful. If the category theory toolkit were implemented in a type theory like that of CoC, we would have had to define equality for each type. Clearly, one could have carried out this work in the CoC. The major difference in the type theories is that fact that CoC allows impredicative definitions whereas in Nuprl one has a predicative hierarchy of type universes. The impredicativity can potentially allow one to express certain concepts that may not be expressible in the predicative theory but we have not come across concepts in our experience with category theory where this would have made a difference. The Nuprl type theory was not always able to express ideas and concepts in the most natural way. For instance, proving that f o (go h) o k = ( f o g ) o (h o k) requires a non-trivial rewrite tactic. The tactic is often quite inei~cient because of the number of lemma instantiations, substitutions and wetl-formedness goals that have to be proved even though that we know the tactic will work every time. The natural solution to this is to explore the idea of reflection. How can we use the object logic to reason about proofs in the logic? Wbrk on this is currently being done at Cornell. In the example above, one of the sources of inefficiency in the rewrite tactic was the fact that we would have to repeatedly instantiate the lemma which handled associativity and then use the results of this instantiation in the substitution. In other words, although every value of type "category" comes equipped, by definition, with a built in associativity property for composition, the tactic writer cannot conveniently make use of this fact without proving additional Iemmas or theorems. An implementation of a theory in Nuprl can be viewed as a small subset of types out of all the possible types in one or more universes. The creation of a theorem to specify a property already known to be trivially true adds one more type to our theory or the specification of our theory. Whether or not this is the most natural and economical way to specify a theory is an open question. We are considering two new directions for future research. The first is an extension of the rewriting package for category theory. The second is developing a theory of monads on top of our existing libraries. Recently the importance of monads for computer science has been pointed out by Moggi [11]. Roughly; the idea is that you have a fixed category which represents all the basic types and operations in your programming language and then you incrementally add more features by defining the appropriate monad and using this monad to build the Kteisti category over the fixed category. This new category now models a programming language where the programs are morphisms taking values to computations. Thus the terms extracted from proofs about morphisms in this category can be viewed as programs in a Nuprl defined programming language where the semantics of this language is modeled by the Kleisli category over the monad. We have begun to implement parts of Moggi's theory and have been able to express the basic definitions like monad and Kleisli category.

512

It would be interesting to understand the relation between the extraction process and the computations defined in Moggi's calculus.

Acknowledgements We have benefited from helpful discussions with Doug Howe, David Basin and Chet Murthy. This research was supported in part by NSF grant CCR-8818979.

References [1] J. A. Altucher and P. Panangaden. A machine-assisted proof of the adjoint functor theorem. Technical report, Cornell University, 1990. In preparation. [2] D. Basin. Generalized rewriting in type theory. Technical Report 89-1031, Cornell University, Computer Science Department, 1989. [3] R. BurstM1. Electronic category theory. In Proceedings of the Ninth Annual Symposium on the Mathematical Foundations of Computer Science, 1980. [4] T. Coquand and G. Huet. Constructions: A higher order proof system for mechanizing mathematics. In Proceedings of EUROCAL85, Linz. Springer-Verlag, 1985. [5] R. Dyckhoff. Expressing category theory in martin-loPs type theory. Unpublished manuscript, 1984. [6] R. L. Constable et. al. Implementing Mathematics with the Nuprl Proof Development System. Prentice-Hall, 1986. [7] A. Grothendieck and J. L. Verdict. Theorie des Topos, volume 267-270 of Lecture Notes in Mathematics. Springer-Verlag, 1972. Reprinted in LNM, original version 1957. [8] Horst Herrlich and George E. Straeker. Category Theory. Allyn and Bacon, Boston, 1973. [9] Saunders Mac Lane. Categories for the Working Mathematician, volume 5 of Graduate texts in Mathematics. Springer-Verlag, New York, 1971. [10] P. Martin-L5f. Notes on intuitionistic type theory. Padova Summer School, notes by G. Sambin, 1980. [11] E. Moggi. Computational tambda-calcutus and monads. In Proceedings of the Fourth IEEE Symposium on Logic in Computer Science, pages 14-23, 1989. [12] Prakash Panangaden, Paul Mendler, and Michael Schwartzbach. Resolution of Equations in Algebraic Structures I, chapter Recursively Defined Types in Constructive Type Theory, pages 369-410. Academic Press, 1989.

513

[13] L. Paulson. Natural deduction proof as higher-order resolution. Technical Report 82, University of Cambridge, Computer Laboratory, 1985. [14] D. Rydeheard and R. Burstall. Computational Category Theory. Prentice-Hall, 1988. [15] L. Wos. Automated Reasoning: 33 Basic Research Problems. Prentice Hall, EngleWood Cliffs, New Jersey, 1988.

D y n a m i c Logic as a U n i f o r m F r a m e w o r k for T h e o r e m P r o v i n g in I n t e n s i o n a l Logic* Heikki Tuominen

Nokia Telecommunications P.O.Box 33, SF-02601 ESPOO, Finland e-mail: [email protected]

Abstract Dynamic logic is proposed as a uniform framework for theorem proving in propositional intensional logic. Satisfiability and unsatisfiability preserving translations from various modal, deontic, epistemic, temporal, and intuitionistic calculi into dynamic logic calculi are defined and partly proved to be correct. The translations unify theorem proving in intensional logic by using dynamic logic as an intermediate logic for which the actual theorem provers can be implemented.

1

Introduction

Automated reasoning in intensional - - i.e. modal, temporal, epistemic etc. - - logics has recently drawn much attention. Several methods based on resolution, natural deduction, and semantic tableaux have been proposed for the most general form of this reasoning, theorem proving. However, the reasoning is complicated by the multiplicity of intensional calculi, the methods have to be at least partly calculus-specific.

One way to reduce the multiplicity and to unify theorem proving in intensional logic is to use a common intermediate logic into which formulas of the various calculi can be translated. It is much easier to develop and maintain one theorem prover for the intermediate logic and a set of translation rules than several separate theorem provers. The standard candidate for the intermediate logic is first-order predicate logic which can be used for most intensional calculi, the intensional operators correspond in a way to quantifiers of first-order logic. Unfortunately the use of first-order predicate logic *This research was supported by the Academyof Finland.

515 as the intermediate logic leads to an unnatural representation, the intensionality gets reduced to a certain kind of extensionality. To avoid the unnatural reduction to extensionMity also the intermediate logic should be an intensional one. Fortunately there is an intensional logic - - actually a family of calculi - - which includes most of the other intensional calculi as special cases. It is dynamic logic which was originally developed by V. Pratt in the middle of the 1970's for reasoning about computer programs [11]. The generality of dynamic logic is based on the fact t h a t its primitives are on a lower level than those of the other calculi. This makes it possible to construct other intensional operators on top of the operators of dynamic logic. Although the generality was noticed already in the pioneer paper on propositional dynamic logic [7], it seems not to have been exploited systematically. The approach taken in this paper is to define satisfiability and unsatisfiability preserving translations from various propositional modal, deontic, epistemic, temporal, and intuitionistic logic calculi into dynamic logic. Most of the translations are fairly obvious; they reflect the properties of the accessibility relation in the source calculus and are based on the similarity of models in the source and target calculus. In addition to defining the translations, a systematic method to prove their correctness in cases of modal and deontic logics is presented. Because the translations cause only polynomial blow-up in the length of the formula, it is clear that the computational complexity of satisfiability in the target calculus has to be at least as high in the complexity hierarchy as that in the source calculus. Fortunately there are dynamic logic calculi in the relevant complexity classes, mainly PSPACE complete and E X P T I M E complete, so that the target calculus can be chosen to be in the same class as the source calculus. The rest of the paper is organized as follows. Section 2 is a short introduction to dynamic logic. The translations from various intensional calculi into dynamic logic are presented and partly proved correct in Section 3.

2

Dynamic logic

By syntax dynamic logic resembles modal logic. The modal operator L is replaced by the constructions [a], where a is a program. The intended reading of [a]~b is "¢ is true after every possible execution of the program a " and (a) is defined as -,[a]-,. Programs of the basic propositional dynamic logic, PDL, are constructed from atomic programs using the (regular) program operators concatenation (;), nondeterministic choice (U), and repetition (*). In addition there is the test operator, ?, which maps formulas to programs. Models of dynamic logic are ordered 3-tuples (W,%p), where W is a non-empty set (set of states), r is a function from the set of atomic formulas to the power set of W (valuation function), and p is a function from the set of atomic programs to binary relations over W (set of accessibility relations). The valuation function and the

516

accessibility relations are extended for arbitrary formulas and programs of PDL by the following definitions.

~(2) ~(~) ~(~ ^ ~) ~([~]~)

: =

: = p(¢?) = p(~;~) = p(~ u 19) = p(a,) =

O, ~ ( T ) : W w~(~) ~(~) n ~(~) {~ c wlvt(O,t) E p(~) ~ t E ~(~))} {0,~)1~ E r ( ¢ ) } p(~) o p(19) -- {(s,t)l~KO,~) E p(~) ^ (~, t) E p(19))} p(,~) u p(19) (p(a)),, the reftexive transitive closure of p(a)

In the sequel also the more familiar notation M, s ~ ~b is used instead of s E T(ff). DPDL, the deterministic version of PDL, differs from PDL only in that the accessibility relations assigned to atomic programs in its models are functional. SDPDL (structured or strict DPDL) is the syntactic restriction of DPDL in which the program operators U and * are allowed to appear only in constructs of the form (if?; a) U (-~b?; a) and (~b?;a)*;~¢?, respectively. The constructs are abbreviated as if ~b then a else 19 and while ~ do a. CPDL, PDL with converse, is PDL augmented with the converse operator, c, whose semantics is defined as follows.

p(o~°)

=

p-'((~)

=

{O, t)l(t, ,) E p(oO}

RPDL, PDL with repeat, allows reasoning about infinite computations using the repeat operator mapping programs to formulas with the following semantics.

r(repeat(a))

=

{so13S13S2...Vi > 0 (s,,s~+l) Z p(a)}

ODPDL is the obvious combination of CPDL and DPDL, CRPDL similarly of CPDL and RPDL. PDL has the collapsed model property. The construction of the filtration of the canonical model through the Fischer-Ladner closure of a given formula can be used to decide satisfiability of the formula [17]. The only drawback of the method is that it takes exponential time in the length of the formula independently of the formula. There exists also a tableaux-based goal-oriented procedure which constructs only the relevant part of the filtration [18]. CPDL has as well the collapsed model property and the filtration method is thus available for testing satisfiability [11]. However, a goal-oriented procedure is more difficult to formulate because a model cannot be built recursively in a simple way. DPDL doesn't have the collapsed model property but the existence of the pseudo-model (filtration of the canonical model) for a formula can be shown to guarantee the existence of a model [2]. This makes it possible to use a tableaux-based decision procedure for satisfiability also in DPDL. RPDL has the finite model property but not the collapsed model property [11]. CRPDL is still more complicated, it is decidable even though it doesn't have the finite model property, e.g. the satisfiable formula [b.](b)T A [b*]-~repeat(b c) has no finite models, The same goes for CDPDL, e.g. the satisfiable formula P A [(bC)*](b¢)-~P has no finite models. The published decision procedures for RPDL, CRPDL, and CDPDL are based on automata

517

almost

almost

reflexive reflexive symmetric K KD KT KB K4 K5 KDB KD4 KD5 K45 KD45 KB4 KTB KT4 KT5 OM 0S4 OB OM + 0S4 +

symmetric

transitive

Euclidean

•

0 0

• • •

0

• •

•

•

•

•

•

• •

• •

• •

OB +

Table 1: Properties of the accessibility relation for some modal logic calculi (p is almost symmetric if VzVyVz(((z,y) 6 p A (y,z) E p) ~ (z,y) 6 p) and almost reflexive if

w v y ( ( y , ~) • p ~ (~,, x) e p)). on infinite trees [5,19]. S D P D L is of special interest in the present context because its satisfiability problem is P S P A C E complete [10]. The other calculi are harder: PDL, DPDL, CPDL, CDPDL, and R P D L are E X P T I M E complete [11,19,5] and C R P D L is decidable in eightfold exponential time [11].

3

Translations into dynamic logic

The translations from intensional calculi into dynamic logic are defined as two-level functions, the upper levels are labelled with Fcl,c~ and the lower levels by ~1.~:2, where £1 and £2 are the source and target calculus, respectively. If not otherwise stated the 4~c,,c~ functions preserve atomic formulas and the truth-functional connectives in the following way.

518 Oz,,L2(¢)

=

¢, for atomic formulas ¢

• ~,,~2(¢ ^ ¢)

=

¢~,,L,(¢) ^ ~ , , ~ , ( ¢ )

b is used as an anonymous atomic program in the translation functions. T h e translations for modal and deontic logic calculi are proved correct, the others are given without proof. The translations for epistemic and tense logics are obvious extensions of the ones for modal logic and the translation for intuitionistic logic is based on the well-known reduction to the modal calculus KT4 ($4). At the end of the section part of the translations are reformulated so that the target calculus is SDPDL, the calculus whose satisfiability problem is P S P A C E complete.

3.1

M o d a l and d e o n t i c calculi

To be compatible with dynamic logic we represent models of modal and deontic logic as ordered 3-tuples (W, % p), where W is a non-empty set of states, T a valuation function assigning subsets of 14~ to atomic formulas and p a binary accessibility relation between states. The calculi differ from each other only regarding the properties p is supposed to have. The properties of p for the considered calculi are given in Table 1 which is collected from [3] and [11. The translations for the calculi whose accessibility relation is not serial are defined as follows.

r~,,~(¢)

=

~,,~.(¢)

• ~,~(r¢) ~KB,OPDL(L¢)

= =

[b u r ? ] ~ , ~ . ~ ( ¢ ) [bUbC]~KBOpD,(¢)

q)KS,CPDL(L¢)

=

[((bC)T?; (b U be)*; (be)T?) U ([b¢l_L?; b)](I)Ks,CPDL(¢)

~K~,OPDL(L¢)

=

[(~ U b°);(b U bc)*l~B~,o~,~(¢)

(I)KTB,CPDL(L¢) ----- [b U T ? U bC]~KTB,CPDL(¢) q~XT4,er)i(L¢) = [b*I~KT4,PDL(¢)

• o~.,o~,~(o¢) (I)oB,CPDL(O¢)

= =

[(b;b.) u
The translations for the calculi with serial accessibility relation are defined as follows.

519

rXDS,CPDL(¢) £KD4,PDL(¢) £KDb,OPDL(¢) FKD45,OPDL(¢) £OM+,CPDL(¢)

= = = = = =

@KB,CPDL(¢) A (b)T @K4,PDL(¢)A [b*](b)T ~Kb,OPDL(¢) A (b)T ¢K4S,¢PDL(¢) A (b>T ~OM,CPDL(¢) A (b)T ^ (b)T

=

^

m

To prove that the translations really preserve satisfiability and unsatisfiabihty we need the following three lemmata. L e m m a 3.1 Let the translation rule for the intensional operator in calculus £1 be @~,x,(Q¢) = [a]@~lx,(¢) where Q is L or O. If p(b) has the properties of the ac. cessibility relation in £1 then p(c~) = p(b).

Proof. The proof of the identity p(c~) -- p(b) is carried out separately for each calculus in two parts: p(b) C_ p(a) and p(a) C_ p(b). The former one is obvious for all the calculi and thus omitted from the proof. K, KD: Clearly p(b) = p(b). KT: To show p(a) = p(bU T?) C_ p(b) suppose that (si, sz) E p(bU T?). This implies (sl, s2) • p(b) U p(T?) and because p(b) is reflexive (sx, s2) • p(b). KB, KDB: To show p(a) = p(b U bc) c p(b) suppose that (sl, s2) • p(b U bc). This implies (Sl, s2) E p(b) U p(b ¢) and because p(b) is symmetric (sl, s2) • p(b). K4, KD4: p(a) = p(b; b*) C p(b) because p(b) is transitive. gb, KDb: To show p(c~) = p(((be)T?; (b U be)*; T?) U ([be]±?; b)) C p(b) suppose that (Sl, s2) • p(((b~)T?; (bUbe)*; (b¢)T?)U([be]±?; b)). This implies (si, s2) • p([b¢]±?; b) or there are states s3 and s4 such that {(Sl,Ss),(s4,s2)} C_ p((A¢)T?) and (ss,s4) • p((bU b~)*). In the former case clearly (Sl,S2) • p(b), in the latter si = sa, s2 = s4, and {(.1, c p(b) because p(b) is Euclidean and thus almost re exive. Further there is a finite sequence of states sb, s s , . . . , s, such that ss = ss, sn = s4, and for each i ( 5 < i < ( n - i ) ) : (si,Si+l) • p(bUbc). Now (an,S2) • p(b;b) and for e a c h / ( 6 < j < n): if (sj, s2) • p(b; b) then (sj-1, s2) • p((bUb~); b; b) = p((b; b; b)U(b~; b; b)) C p(b; b) because p(b) is Euclidean. Thus (ss,s2) • p(b;b) and further (s~,s2) E p(b) because s~ = s3 = ss, • p(b, and p(b)is Euclidean. K45, ZD$5: To show p(a) = p((b U b~)*; (b*)T?) C_ p(b) suppose that (Sl,S2) • p((b U b*)*; (be)T?). This implies that there exists a state s3 such that (sl,ss) • p((b U b~)*) and (sa, s2) • p((be)T?). The latter implies further (ss,s2) • p(b) because p(b) is Euchdean and thus almost reflexive. The former implies that there exists a finite sequence of states s4, s b , . . . , s , such that s4 = sl, s , = ss, and for all i (4 < i < n - 1) (si,s~+~) • p(b U b¢). Now (s,~,s2) • p(b) and for each j (5 < j < n): if (sj,s~) • p(b) then (sj_~,s2) • p((b U be); b) = p((b; b) U (be; b)) C_ p(b) because p(b) is transitive and Euclidean. Thus (sx, s2) • p(b).

520

KB.¢: To show p(a) = p((b

U

be); (b U b*)*) C p(b) suppose that (Sl, 82) E p((b U

~o); (b u bo),). This implies that there exists a state s~ such that (sl, s~) E p(b U b~) and (s~,s~) E p((b U b°)*). Because p(b) is symmetric (sl,s~) e p(b) and (s~,s~) e p(b*). Further, this implies (si, s2) E p(b) o p(b*) = p(b; b*) and because p(b) is transitive

(sl,s,) e p(b). KTB: To show p(ct) = p(b U T? U b¢) C_ p(b) suppose that (sl, s~) E p(b U T? U b~). This implies (sl, s2) E p(b) U p(T?) U p(b ~) and because p(b) is reflexive and symmetric

(sl,s2) e p(b). KT~4: To show p(c~) = p(b*) C_ p(b) suppose that (si,s2) e p(b*). This implies E p(T?) U p(b; b*) and because p(b) is reflexive and transitive (sl, s2) E p(b).

(sl, s2)

KTh: To show p ( a ) = p((b U be)*) C_ p(b) suppose that (Sl,S2) E p((b U b~)*). This implies (sl,s2) E p(T?) U p((b U be); (b U be)*) and because p(b) is symmetric (sl,s2) E p(T?) U p(b; b*). Further, because p(b) is reflexive and transitive (s~,s2) E p(b).

OM, OM+: To show p(a) = p(bU (b~)T?) C_ p(b) suppose that (Sl, s2) E p(bU(b~)T?). This implies (sl, s2) E p(b)Up((b¢)T?) and because p(b) is almost reflexive (sl, s2) E p(b). 0S4, 0S4+: To show p(a) = p((b;b*) U (b0T?) C_ p(b) suppose that (s~,s~) E p((b;b*) U (b')T?). This implies (Sl,S2) E p(b;b*) U p((b')T?) and because p(b) is transitive and almost reflexive (Sl,S:) E p(b). OB, OB+: To show p(a) = p(bU (b0T? U (b~; (b¢)T?)) C_ p(b) suppose that (sl, s2) E p(b U (b~)T? U (b¢; (be)T?)). This implies (sl,s2) E p(b) U p( (bOT? ) U p(bC; (b0T?) and because p(b) is almost symmetric and almost reflexive (si, s~.) E p(b). []

L e m m a 3.2 Let the translation rule for the intensional operator in calculus £1 be ¢A,£2(Q¢) = [a]¢A,c2(¢) where Q is L or O. p(a) has all the properties of the accessibility relation in £1 ezcept perhaps seriality.

ProoJ. The proof is carried out separately for each calculus. K, KD: There are no restrictions on p(b). KT: To show that p(bU T?) is reflexive suppose that sl is a state. Clearly (sl,sl) E

p(v?) c_ p(b u v?). KB, KDB: To show that p(bUb c) is symmetric suppose that (sl,s2) E p(bObC). This implies (s2,s~) E p((b O be)c) = p(bU bC).

K$, KD$: To show that p(b;b*) is transitive suppose that {(Sl,S2),(s2,s3)} C p(b; b*). This implies (si, s3) E p((b; b*); (b; b*)) C_p(b; b*). 1{5, KDh: To show that p(((b¢)T?; (b U be)*; (be)T?) U ([b~l_L?;b)) is Euclidean suppose that {(sl, s2), (si, s3)} c_ p(((b¢)T?; (b U be)*; (b~)T?) U ([b¢]-L?; b)). This implies that (s2,ss) E p((((b~)T?;(b U be)*; (be)T?) U ([b¢]_L?;b))~;((b¢)T?;(b U b~)*; (be)T?) U ([b¢]_L?;b)) = p((b¢)T?;(b U be)*; (be)T?; (b¢)T?;(b U be)*; (be)T?) U p((b¢>T?;(b U

521 be)*; {be)T?; [b~l_L?;b) U p(be; [bel-L?; {bC)T?; (b U be),; (b~>T?) U p(b¢; [be)l?; [boil?; b) = p((bc>m?;(b U b~)*;(be)m?;(b U be)*;T?; (bUb~)*; T?)Up(b~;[b~l_L?;b) C_p((bC)T?; (bUbe),; {be)T?) C p((a¢)T?; (b U be),;
K~5, KD~5: To show that p((b U be)*;(be)T?) is transitive suppose that {(sl,s2),(s2,ss)} C_ p((b U b~)*;(bC)T?). This implies that (sl,ss) E p((b U be)*; (b')T?; (b U be)*; (be)T?) C p((b U be)*; (b U b~)*; (be)T?) = p((b U b~)*; (b~)T?). To show that p((b U b~)*; (be)T?) is Euclidean suppose that {(sl,s2),(sl,ss)} C_ p((b U b~)*;{b~)T?). This implies that (s2,s~) E p(((b U bC)*;(be>T?)~;(b U b~)*;(be>T?) = p((be)T?; (b U be)*; (b U be)*; (be)T?) = p((b)T?; (b U be),; (be)T?) C_p((b U be)*; (b~)T?). KB$: To show that p((b U be); (b U b*)*) is symmetric suppose that (s,,s2) E p((b U b*); (bUb~)*). This implies that (s2, sl) e p(((bUbe); (bUb~)*) ~) = p(((bUb*)*)c; (bUb~) *) = p((b U be)*; (b U be)) = p((b U be); (b U be)*). To show that p((b U be); (b U be)*) is transitive suppose that there are states Sl, s2, and sa such that {(s~, s2), (s2, s~)} C p((b U be); (b U be).). This implies that (Sl, ss) E p((bUb~);(bUbe)*; (bUb¢); (bUb¢)*) C_ p((bUb¢); (bUbe).). KTB: To show that p(b U T? U be) is reflexive suppose that sl is a state. Clearly (sl, Sl) E p(T?) C p(b U T? U b~). To show that p(b U T? U b¢) is symmetric suppose that (sl, s2) E p(b U T? U b~). This implies that (s~, Sl) E p((b U T? U be)¢) = p(b¢ U T? U b). KT~: To show that p(b*) is reflexive suppose that s~ is a state. Clearly (sl,s~) E p(T?) C p(b*). To show that p(b*) is transitive suppose that there are states Sl, s2, and s~ such that {(s~ s2), (s~., sz)} C p(b*). This implies (sl, ss) E p(b*; b*) C_ p(b*). KTh: To show that p((b U b~)*) is reflexive suppose that s~ is a state. Clearly (s~,sl) E p(T?) C_ p((b U b~)*). To show that p((b U be)*) is transitive suppose that {(sl, s2), (s~, s~)} C_ p((bUb¢),). This implies (sl, ss) E p((bUbC)*;(bUb¢)*) = p((bUbe)*). To show that p((b U be)*) is symmetric suppose that (s~, s2) E p((b U b)*). This implies e p(((b u bg,) o) = p((b u bo),). OM, OM+: To show that p(b U (be)T?) is almost reflexive suppose that (,$1,S2) E p(b U (b~)T?). This implies that (s2, s2) E p((bC)T?) C p(b U (b~)T?).

OS4, OS4+: To show that p((b¢)T? U (b; b*)) is almost reflexive suppose that (s~, s2) E p((b¢)T? U (b;b*)). This implies that (s2,s2) E p((bC)T?) C_ p((b¢)T? U (b;b*)). To show that p((b¢)T? U (b;b*)) is transitive suppose that {(s~,s2),(s2,ss)} C_p({b¢)T? U (b;b*)). Thus (s,,sa) E p(((b~>T? U (b;b*));(T? U (b;b*)) = p((ibC>T?; T?)U((b; b*); (b; b*)) C p((b¢>T?U({b~)m?; (b; b*))U (b; b*)U (b; b,)) = p(
OB, OB+: To show that p(b U {b~>T? U (be; T?)) is almost symmetric suppose that {(sl,s~),(s~,s~)} C p(b U T? U (T?; b)); T?) = p((b~; (b~>T?) U (T?; {be}T?) U ({b~)T?; b; T? U (b~; (be)T?)).

[]

522

L e m m a 3.3 ]Jet M = ( W , v , p ) be a model of some modal or deontic calculus generated 1

by state s and having a state t such that (s,t) E p. If p is symmetric, Euclidean, or almost reflezive then p is serial. Proof. It is enough to show that if p has some of the mentioned properties then for all states u such that (s,u) E p* there exists a state v for which (u,v) E p. If u = s then according to the premises (u, t) E p, otherwise (s, u) E p * op which means that there is a state w such that ( w , u ) E p. If p is symmetric then (w,u) E p implies (u,w) E p. If p is Euclidean then ( w , u ) E p implies (u,u) E p. If p is almost reflexive then (w,u) E p implies (u, u) E p. In each case there exists a state v such that (u, v) E p and p is thus serial. []

Proposition

3.1 ¢ is satisfiable in the calculus f~l iff F£~,£2(¢) is satisfiable in the

calculus ~2. Proof. From left to right. Let M = (W, r, p) be a model of /21 generated by s such that M, s ~ ¢. Let further M ' = 0 4'', r', p') be the structure such that W' = W, p'(b) = p and r ' = r . Clearly M ' is a model of £:2. We show that M', s ~ F~:1,~2(¢). We show first that for any formula ¢ of £1 and for any state t in M: M, t ~ ¢ iff M ' , t ~ ~I'q,~:2(¢). This is done using induction on the structure of ¢. For atomic formulas the claim holds because q~cl,c2(¢) = ¢ and 7"' = r . Supposing that the claim holds for X and ~ it holds also for -~X and X A ~ because all of the translations preserve negation and conjunction. If ¢ is of the form QX (where Q is L or O) the reasoning goes as follows. M, t ~ QX if and only if X is true in all states u in M such that ( t , u ) E p. The induction hypothesis implies that this is equivalent to: ~:~,L2(X) is true in all states u of M ' such that ( t , u ) E p = p'(b), i.e. for all u in M ' such that (t,u) E p'(b) : M ' , u ~ ~cl,c~(X). This is equivalent to M ' , t ~ [b]ffc,,c2(X), further to M ' , t ~ [a]q'~:,,z:~(X) (where c~ is the program in the translation for the intensional operator) because according to L e m m a 3.1 p'(a) = p'(b), and thus to M', t ~ ~:~,~:~(¢). Now for the calculi £1 for which Fc~,L~(¢) = ~cl,c~(¢) it follows that M ' , s F~:~,z:2(¢). The same follows for the calculi £1 for which Fc,,~:~(¢) = ~bc,,c2(¢) A (b)T or Fq,~:~(¢) = q'c,,c~(¢) A [b*](b)T because in these calculi p and thus also p'(b) is serial and the additional conjunct in the translations is true in all states of M'. From right to left. Let M = (W, r, p) be a model of £2 (having b as its only atomic program) generated by state s such that M , s ~ Fc~,c~(¢). Let M ' = ON',r',p') be the structure such that W' = W, r ' = r , and p' = p(a) where a is the p r o g r a m in the translation rule for the intensional operator. Let further M " = (W", r " , p") be the submodel of M ' generated by s. All the relevant properties of the accessibility relation

1M = (W,r,p) is generated by state s iffVz(z E W --, (s,z) E p*).

523

(seriality, almost reflexivity, ... ) are preserved under taking the generated submodel and thus p" has all the properties of p'. M" is a model of £:1 in the calculi in which p" is not supposed to be serial because according to Lemma 3.2 p(ct) and thus p' as well as p" have all the needed properties. M" is also a model of £1 in the calculi KD5, KD45, OM +, OS4+, and OB + in which p" is supposed to be serial because the premises of Lemma 3.3 are fulfilled: there is a state t such that (s,t) E p" (M,s ~ (b)T, and p(b) c p ( . ) ) a n d / ' is serial in KDB, Euclidean in KDS, KD45, and almost renexive in OM +, OS4 +, and OB +. In KD ~and KD4 the seriality of p" is guaranteed by having M,s ~ [b*](b)T which due to M being generated by s means that every state in M has an b-successor and thus together with p(b) C p(a) that every state in M' and M" has a successor. Now because p" is p(a) restricted to }a2", it is obvious that for any formula ¢ in £:~ and any state t in M": M " , t ~ ¢ iff M,t ~ ~ , , ~ ( ¢ ) . Further this implies that M", s ~ ¢. []

3.2

Epistemic

calculi

The epistemic calculi K(m), T(m), S4(m), $5(~), KC(~), TC(m), S4C(r,), and S5C(m) are multi-dimensional versions of the modal calculi K, KT, KT4, and KT5, the latter series augmented with the common knowledge and everyones knowledge operators (C and E) [9]. The translations, which appear more or less explicitly already in [15], are defined as follows.

r~,~(¢) ¢~,,PDL(K~¢) ¢£,.PDL(KI¢)

¢~,,pDL(KI¢) e~£, ,PDL(C¢)

~s~c(.),CPvL(C¢) ¢c,,c,(E¢)

3.3

= = = = = = = =

~,,~,(¢) [b~]~C,,PDL(¢), £1 E {K(m),KC(m)} [b~ U T?]qI~£,,PDL(¢), •1 • {T(m),TC(~)} [bi$]¢£l,PVL(¢), C 1 • {S4(m), S4C(m)} [(b/U b~)*]~£1,CPDL(¢), ~1 E {SS(m), S5C(m)} [(bl U . . . U b,~)*]q~C,,PDL(¢), £1 E {KC(m),TC(m),S4C(~)} C , [(bl u slC u . . . u b~ u b~) ]~S~C(.),C~.L(¢) ¢~:,,c,(K1¢) A . . . A ¢c,.L,(K,~¢)

Temporal calculi

In the temporal logic Kt there are no restrictions on the accessibility relation, in CR it is transitive, and in Kb transitive and left-linear [14]. The translations are defined as follows.

524

{]~K,,CPDL(G¢) ~K,,CPDL(H¢)

= =

[b]tiCK,,CPDL(¢) [bC]~Kt,CDPDL(~b)

~CmCPDL(G¢) ~CR,OPDL(H¢) ~K~,CDPDL(G¢)

= = =

[b; b*]~Ca,CPDL(¢) [(b;b*)C]~CR,ODPDL(¢) [(b;b*)C]~K~,ODPDL(¢)

¢T~K~,CDPDL( - ~ )

=

[b; b*]~K~,CDPDL(¢)

In the linear time temporal logic 0 the accessibility relation is a function, i.e. each state has exactly one successor [8]. Part of the following translation for ® is given in [10].

~®,DPDL(O¢)

= =

CO,DPDL(¢) A [b*](b)T [b]¢®,DPDL(¢)

~)O,.PDL(¢U¢)

=

<(~O,DPDL(¢)? ; b)*) CI~O,DPDL(¢)

FO,DPDL(¢)

In the branching time temporal logic CTL (Computation Tree Logic) the accessibility relation is serial [6]. In POTL (Partial Order Temporal Logic) both the accessibility relation as well as its converse are serial [16].

FCTL,RPDL(¢) FPOTL,CRPDL(¢) ~CTL,RPDL(AX¢) ~CTL,RPDL(E[¢U¢]) ¢ CTL,RPDL(A[CU¢])

= = = = =

VOTL,RP.L(¢) A [b*](b)T ~OTL,CRPDL(¢) ^ [b*](b)T A [(b*)cl(b°)T [b]~cTL,RPDL(¢) ((¢°T'.~PVL(¢)?; b)*>~CT~,~.~(¢) [(¢CTL,RPDL(¢)?;-~¢CTL,RPDL(¢)?; b)*]

(~CTL,RPDL(¢) V ¢CTL,RPDL(¢))A -~r epeat(-~¢ CTL,aPDL ( ¢ ) ? ; b) [b]VPOTL,CRPDL(¢)

VPOTL,CRPDL(AX¢) = ~POTL,CRPDL(AX¢)

=

[b°]VPOTL,CRpDL(¢)

CPOTL,CRPDL(EG¢)

=

repeat(~POTL,CaPDb(¢)?; b)

CPOTL,CRPDL(EVe) ~POTL,CRPDL(AG¢) ~POTL,CRPDL(AG¢)

= = =

~ep~a~(~POTL,CRPDL(¢)?; b°) [b*]~POTL,CRPDL(¢) [(b*)°]e~OT~,O~.L(¢)

3.4

Intuitionistic calculus

The translation for the intuitionistic propositional calculus, IPC, is a composition of the translation from IPC into KT4 ($4) [4] and from KT4 into PDL above. ripc,PDL(¢) ¢~°,PDL(¢)

= =

~IPC,PDL(¢) [b*]~IpC,pD,(¢), for a t o n e formulas ¢

~IPC,PDL('-~)

=

[b*]'~IPC,PDL(~)

525

3.5

T r a n s l a t i o n s into S D P D L

Part of the translations having PDL or DPDL as the target calculus can be reformulated to lead into SDPDL. The reformulation is of interest because the satisfiability problem in SDPDL ~ in contrast to PDL and DPDL - - is PSPACE complete. It means that although there are satisfiable formulas in SDPDL which have only models of size exponential in the length of the formula, a decision procedure can run in space polynomially limited by the length of the formula. This is due to the possibility to construct the models in separate parts [10]. At least the modal calculi K, KT, and KT4 are known to have PSPACE complete satisfiability problems [13] and it should thus be possible to rewrite their translations to lead into SDPDL with only a polynomial blow-up in the length of the formula. The reformulation for the calculi K and KT is based on the following two facts. 1. A formula ¢ is satisfiable in PDL iff ¢' is satisfiable in DPDL where ¢' is the result of replacing every atomic program a in ¢ by a;fl* where fl is a new atomic program [11]. 2. The formula [a*]¢ e-~ [while ¢ do ~]± is valid in DPDL [10]. Clearly only the translation rules for the intensional operator L have to be rewritten. The foUowing equations show a stepwise reformulation of the translations.

~K,SDPDL(L¢)

=

[b][while ~K,SDPDL(¢) do b']±

KT.SDPDL(L¢)

=

[b][while

do b']± ^

For the calculus KT4 the situation is more complicated, the method used for K and KT does not give a translation into SDPDL. However, for KT4 the translation into SDPDL can be based on the fact that if a formula is satisfiable in KT4 then it is satisfiable in a treelike model whose depth is polynomially limited by the modal degree (maximum depth of nested modal operators) of the formula [13]. Using that limit the translation rule for the intensional operator in KT4 can be formulated according to the following scheme.

(]~KT4,SDPDL(L(~) =

~KT4,SDPDL((~)^ [bl(~I~KT4,SDPDL(~b)^ [b](~I)KT4,SDPDL(¢)^ . . . ) )

Similarly the translations for K(m), T(m), S4(m), and IPC can be modified to lead into SDPDL. OM, 0S4, and OB have a polynomial reduction into KT, KT4, and KTB with a propositional constant Q (~cl,r,(O¢) = L(Q -~ ~1.c2(¢)) [1]) and can thus be translated into SDPDL. Further the temporal logic ® can be translated into SDPDL as follows.

526

~i®,SDPDL(O~) ) ~O,SDPDL(fU¢)

---- [while 4fO,SDPDL(¢) do b]l = (while-~o,SDPDL(¢)do(~o,SDPDr,(¢)?;b))T

The satisfiability problem of KT5 is even easier than that of K, KT, and KT4. KT5 is NP complete and has thus a polynomial translation into classical propositional calculus, CPC. The translation can be based on the property that every KT5 is reducible to a formula whose modal degree is at most one [12]. Such a formula can be translated further into CPC quite easily.

4

Conclusions

Satisfiability and unsatisfiability preserving translations from various intensional logic calculi into dynamic logic calculi were defined. The main motivation for the translations is to reduce the number of needed theorem provers. Actually theorem proving in all the mentioned 36 calculi could be handled by only two different provers, one for CDPDL and one for CRPDL. However, that wouldn't give optimal performance and a more reasonable set of provers would include one for PDL, CPDL, DPDL, SDPDL, CDPDL, RPDL, and CRPDL. Fortunately these provers could share parts of their code. The translation method can be extended to cover more calculi, at least the nonnormal modal calculi ($2, $3, ... [12]) and some conditional logic calculi can be handled following the same principle. There exist also quantified dynamic logic calculi but theorem proving in them might be quite tricky.

References

[1]

&qvist, L. Deontic logic. In Handbook of Philosophical Logic, Volume II: Eztensions of Classical Logic, D. Gabbay and F. Guenthner, Eds., D. Reidel Publishing Company, Dordrecht, 1984, pp. 605-714.

[2]

Ben-Ari, M., ttalpern, J., and Pnueli, A. Deterministic Propositional Dynamic Logic: Finite Models, Complexity, and Completeness. Journal of Computer and System Sciences 25 (1982), 402-417.

[3] Chellas, B. Modal Logic, an Introduction. Cambridge University Press, Cambridge, 1980.

[4]

van Dalen, V. Intuitionistic logic. In Handbook of Philosophical Logic, Volume III: Alternatives to Classical Logic, D. Gabbay, and F. Guenthner, Eds., D. Reidel Publishing Company, Dordrecht, 1986, pp. 225-339.

[5]

Emerson, E., and Jutla, C. The Complexity of Tree Automata and Logics of Programs. In Proceedings of the 29th Annual Symposium on Foundations of Computer Science (White Plains). 1988, pp. 328-337.

527 [6] Emerson, E., and Srinivasan, J. Branching Time Temporal Logic. In Linear Time, Branching Time and Partial Order in Logics and Models for Concurrency (School/Workshop, Noordwijkerhout, The Netherlands, May/June 1988), J. de Bakker, W. de Rover, and G. Rozenberg, Eds., Springer-Verlag, Berlin, 1989, pp. 123-172. [7] Fischer, M., and Ladner, R. Propositional Dynamic Logic of Regular Programs. Journal of Computer and System Sciences 18 (1979), 194-211. [8] Goldblatt, R. Logics of Computation and Time. Center for the Study of Language and Information, Leland Stanford Junior University, 1987. [9] Halpern, J., and Moses, Y. A guide to the modal logics of knowledge and beliefi preliminary draft. In Proceedings of the Ninth International Joint Conference on Artificial Intelligence (Los Angeles, Aug. 18-23). Morgan Kaufmann, Los Altos, California, 1985, pp. 481-490. [10] Halpern, J, and Reif, J. The Propositional Dynamic Logic of Deterministic WellStructured Programs. Theoretical Computer Science 27 (1983), 204-216. [11] Hard, D. Dynamic logic. In Handbook of Philosophical Logic, Volume II: Extensions of Classical Logic, D. Gabbay and F. Guenthner, Eds., D. Reidel Publishing Company, Dordrecht, 1984, pp. 497-604. [12] Hughes, G., and Cresswell, M. An Introduction to Modal Logic. Methuen and Co Ltd, London, 1968. [13] Ladner, R. The Computational Complexity of Provability in Systems of Modal Propositional Logic. SIAM Journal of Computing 6 (1977), 467-480. [14] McArthur, R. Tense Logic. D. Reidel Publishing Company, Dordrecht, 1976. [15] Parikh, R. Logics of Knowledge, Games and Dynamic Logic. In Foundations of Software Technology and Theoretical Computer Science. Springer-Verlag, Berlin, 1984, pp. 202-222. [16] Pinter, S., and Wolper, P. A Temporal Logic for Reasoning about Partially Ordered Computations. In Proceedings of the third A CM Symposium on Principles of Distributed Computing (Vancouver). 1984, pp. 28-37. [17] Pratt, V. Models of Program Logics. In Proceedings of the 20th IEEE Conference on Foundations of Computer Science (San Juan, Oct.). 1979, pp. 115-122. [18] Pratt, V. A Near-Optimal Method for Reasoning about Action. Journal of Computer and System Sciences 20 (1980), 231-254. [19] Vardi, M., and Wolper, P. Automata-Theoretic Techniques for Modal Logics of Programs. Journal of Computer and System Sciences 32 (1986), 183-221.

A TABLEAUX-BASED THEOREM PROVER FOR A DECIDABLE SUBSET OF DEFAULT LOGIC

Camilla B. Schwind

Facult6 des Sciences de Luminy Groupe d'Intelligence Artificielle, CNRS 163 Avenue de Luminy, Case 901 13288 Marseille, Cedex 9, FRANCE Phone : ++3391269195, E-mail : Schwind @ frmrsll.bitnet

ABSTRACT We present a new, efficient and clear method for computing extensions and deriving formulas of a normal default theory which offers a new insight into the nature of default reasoning and seems to be equally successfully applicable to open and non-normal default theories. It is based on the semantic tableaux method (Smullyan 1968) and works for default theories with a finite set of defaults which are formulated over a decidable subset of fh-st-order logic. We prove that all extensions of a normal default theory can be produced by constructing the semantic tableau of 9n~ formula built from the general laws and the default consequences.

I. INTRODUCTION Since default theories were first defined by Reiter (1980), many papers have been written about this obviously very appealing theory, the formulation of which is so simple. It is very difficult however to understand how default proofs can be obtained, it seems even untractable for general (non-normal) defaults. Up to now; only a few theorem provers have been proposed for default logic most of which are based on resolution (Reiter 1980, Besnard et aL 1983) and work only for normal defaults without free variables. The term used by Reiter is "closed default theory". Since "closed" is a term used to design contradictory tableaux (see chapter III), we used the term "default theory without free variables" in order to omit confusion.

529

Brown has proposed a deduction system for nonmonotonic logics including default logic which is based on a modal logic (Brown 1986). His reasoning system is essentially based on the same idea a semantic resolution (formulas are systematically instantiated by true or false) and is much slower than ours. In this paper, we present a radically different approach, based on semantic tableaux, which offers a new insight into the nature of default reasoning and can be equally successfully applied to non-normal default theories. In the next chapter, we shall briefly def'me default logic and repeat some theorems proven in the original paper by Reiter. Part three defines semantic tableaux for first-order logic and shows some of their properties. In the fourth part, we will outline the application of this method to default reasoning and we will prove that all extensions of a normal default theory (without free variables) can be obtained with this method. In part five, we will give some examples which outline how the method could be extended to non-normal default theories.

II. D E F A U L T L O G I C We first introduce default logic as defined by Reiter (1980).

Definition 1 : A default is an expression having the form

o~(x):131(x)132(x)...13n(x)

co(x)

where ¢z(x), 13i(x) and 0)(x) are all formulas of first order logic. 0~(x) is called the prerequisite, 13i(x) the justifications and co(x) the consequent of the default. A default theory is a pair (W, D) where W is a set of first-order formulas and D a set of defaults. A default is called without free variables when cz, 13and c0(x) are closed formulae. A default theory is called without free variables when all its defaults are without free variables. Given a set F of formulas, we denote by Th(F) the theory over F, i.e. Th(l") = {F : F I-- F}.

530

Definition 2 : An extension of a default theory (W, D) without free variables is def'med in the following way : Let S be a set of formulae without free variables. Let F(S) be the smallest set satisfying D1 W _.C F(S) D2 Th(F(S)) = F(S) et:J31152...13n

D3 If

e D and 0~e F(S) and ~13i ~ S then toe F(S).

A set of formulas without free variables E is an extension for (W, D) iff F(E) = E. Reiter gives another more intuitive definition of extensions which is iterative since an extension can be viewed as what can be produced by successively applying defaults to formulas of W. The following theorem is proven in (Reiter 1980). Theorem 1 : Let E G L be a set of formulae without free variables and let A = (W, D) be a defaults theory without flee variables. Define

E0=W Ei+t

= ThL(Ei) u ( c o :

a:tSl132...15n 00

e D w h e r e 0~e E i a n d ~ i ~

E}

Then E is an extension for A iff E = U0~ Ei. Definition

3 :

The set of generating defaults of an extension, E, of a default theory without free variables A = (W, D) is defined by

GD(E, D) =

{d : de D, d

~:B1B2...Bn -

co

and cx e E and ~l]i ~ E}

The set of consequents of a set D of defaults is defined by ~(x):~l(x)~2(x)...13n(x) CONS(D) = {o(x) . e D}

0~(x)

The set of prerequisites of a set D of defaults is defmed by ot(x):{31(x)152(x)...13n(x) PREREQ(D) = {~(x) : eD}

o~x)

531

Example 1 : A1 = (W1, D1) with D1 - {

B'

I

W l = {B --> ~ A ^ ~C} A1 has two extensions : E11 = Th(Wl u {S}) E1 z = Th(W1 t3 {A,C}) In Reiter (1980) we find the following theorem which characterizes extensions in terms of theories over W and consequences of defaults.

Theorem 2 (Theorem 2.5. from Reiter) Suppose that E is an extension for a default theory without free variables A = (W, D). Then E = Th(W kJ CONS(GDfE, A))).

Theorem 3 (Corollary 2.2. from Reiter) A default theory D = (W, D) without free variables has an inconsistent extension iff W is inconsistent. But some default theories do not have extensions :

Example 2 : q:--¢ A2 = (W2, D2) with D2 = { " 7 - }, W2 = {~p ^ q}. A2 has no extension because the consequent of the default rule is inconsistent with W2 whereas its prerequisite and its justification suggest that it should be applied. But Reiter has presented a class of defaults, called normal defaults, for which extensions always exist.

A normal default is a default of the form

a(x): t~(x)

13(x)

Default proofs are defined for a normal default theory A = (W, D) without free variables in the following way : A formula F has a default proof with respect to A iff there exists a finite sequence DO, D1 ..... Dk of finite subsets of D (1) W u CONS(D0) ~- F (2) For 1 < i < k W k3 CONS(Di) }-- PREREQ(Di.1) (3) Dk = 0 (4) W u U

{CONS(Di) : 0 < i < k} is satisfiable.

532

Reiter has shown that a formula F has a default proof with respect to a default theory A iff F is contained in an extension of A. But the extension membership problem is not even semidecidable as is shown clearly in (1) and (4). Therefore we consider a trivially decidable subset of first-order logic, the predefinite variable formulas. It is the same subset considered by (Besnard et al. 1983) and first defined by (Bossu and Siegel 1985). The formulas contain only constant function symbols and all variables occuring positively in a formula occur also negatively in it. For example, 3x p(x) does not belong to the subset, but p(x) ~ q(x) does. Let us also note that this definition of a default proof is incremental, i.e. it suggests that we take a default, then try to "apply" it to the set W, when possible, and then continue the same process with the new set W augmented by the default consequence (which has been "added" to W). We will see later that our approach is radically different in its philosophy because we will suggest that all default consequences be added first and then those which could not be applied (for two kinds of reasons either they lead to contradictions or the prerequisite condition does not hold) be retracted.

III. THE THEOREM PROVER The theorem prover we have used is based on the analytic tableaux method [Smullyan 1968] and is described in [Schwind 1985], where the classical part contains only predefinite variable clauses. Within the scope of this paper, we will consider only its propositional part (for classical logic). This is sufficient because the idea of our algorithm is the same whether the logic has quantifiers or not. TP proves a formula F by trying to derive a contradiction from assuming --~F. TP builds for ..qz a set of sets of formulas (called semantic tableaux) by applying a number of operations to ~ F yielding this set.TP can be defined as a mapping between sets of formulas and sets of sets of literals recursively defined as follows : TP(M)=TP(M'u{p})if--,~p~

TP(M) =TP(M'u (p} u{q} ) i f

M andM'=M\{~p} p^qE

M and M ' = M \ { p ^ q }

TP(M) = T P ( M ' • { ~ p } ) u T P ( M ' u {--, q}) if - - , ( p A q ) ~ M and M ' = M \ {--,(pAq) } TP(M) = TP( M u {A[c] }) if 3 x A(x) E M, where c is a ~ew parameter TP(M) = TP( M u {A[c] }) if V x A(x) ~ M, where c is any parameter TP(M) = {M} if M is a set of literals.

533

For an example : TP({(avb)Ac}) = TP({avb,c}) = { {a,c},{b,c} } Note that this way of splitting formulas gives us sets of sets of literals at the end of the process. The tableau for a formula corresponds to its disjunctive normal form, i. e. each set represents the conjunction of its elements and the tableau represents the disjunct of its elements. Definition

4 :

A set of literals is closed if it contains two opposite literals (i.e. L and ~ L ). A set of sets of literals is closed if each of its elements is closed. The fundamental property of TP for theorem proving is the following completeness theorem : Theorem

4 :

F is a theorem iff TP({--T}) is closed. (Proof in [Smullyan 1968]). We consider TP not only as a theorem prover (or consistency checker) for first-order formulae but also as an application which has useful properties for formulas and formula sets. We will frequently use the following properties of TP : Lemma

1 :

TP({FAG})={XuY:X~ TP({F}) and Y~ TP({G})} This will allow us to consider conjunction as an operation upon sets of sets of literals. We will have to compute only once the image by TP of each formula and the image of any conjunction of already "split" formulas will be obtained using lemma 1. Lemma 1 gives rise to the following notation : F ® F' = {XwY:X~ F and Y~ F'}. The set of sets of literals constructed by TP for a formula F corresponds to the disjunctive normal form of F, where each set corresponds to a conjunction and is itself a disjunct. For example : TP({ (avb)Ac })= { {a,c 1, {b,c } ] = TP({ (a,xc)v(bAc) }) and (aAC)v(bAc) is the disjunctive normal form of (avb)Ac. The disjunctive normal form of a formula F obtained from TP(F) is denoted ~p(TP({F})).

534 As an immediate consequence of the completeness theorem, we have

Corollary

1

:

F ~ Th(F) i f f T P ( F ) ® TP({~F}) is closed. Proof: F e Th(F) i f f F I- F iff t- F --~ F (deduction theorem) iff T P ( { ~ ( F --~ F)}) is closed (completeness theorem) iff TP(F ^ {-~F}) = TP(F) ® TP({~F}) is closed. In what follows we will frequently consider "subtableaux", where literals in a set are suppressed. This is written as follows : Let T be a set of sets of literals, and L a set of literals. Then T+L=

{Y:Y =XXL forXe

T}.

Sometimes, we will have to consider "subtabteaux" (for a complex formula), where all literals coming from the same subformula are suppressed. In order to recognize from which part the literals come, we will index the formulas and subsequently literals. For example, let be dl = (A A B) v G, d2 = F m A --~ G. Then dlAd2 may be noted (A(dl) ^ B(dl)) v G(dl) ^ (F(d2) ^ A (d2)--~ G(d2). By suppressing within a tableau constructed from a conjunction of formulas all literals coming from one of the conjuncts, we obtain the tableau belonging to the conjunction of all the other formulas. Lemma 2

Let F(d), G(d') be indexed formulas and L ( d ) , L'(d') the set of literals of F resp. G. Then TP({F(d) }) = TP((F(d)AG(d') }) + L'(d').

TP frequently contains closed sets or sets which contain other sets in TP. In this case we are sometimes (especially when a TP is not closed) interested in a minimal form, defined by TS(M) = T P ( M ) \ {X : X ~ TP(M) and X closed o r 3 y ~ TP(M) such that Y c X}

Clearly, q) (TS(M)) 4-~ q>(TP(M)), because of (A ^ B)v A 4-~ A and (A ^ - - ~ ^ B)v C 4-->C.

This can very often considerably shorten a tableau.

535

IV. C O M P U T I N G

EXTENSIONS

The idea of our proposed method is very simple : An extension for a default theory A = (W,D) is roughly speaking the set of theorems over the union of W and a set of default consequences (see Theorem 2). It is a maximal set of this kind in the sense that the addition of any other default consequence is not possible because the prerequisite condition does not hold or this would make E inconsistent. Now the idea of our algorithm is as follows : We consider the set W u CONS(D). There are two cases : either W to

CONS(D)

is consistent. Then

A

has at most one extension,

T h ( W u CONS(D')), where D' is the greatest subset o f D containing the respective prerequisites. in the other case, W w CONS(D) is not consistent. Then the tableau T constructed for -

W to CONS(D) is closed, i.e. each set in T is closed. But it is possible to "open" T by suppressing within T literals "responsible" for the contradiction. Remember that T is open whenever at least one of its sets is open. By opening each of the sets of T in this way and by verifying the prerequisite condition, all extensions can be obtained.

Example 1 (continued) : A1 = (W1, D1) with D1 =

f

:A A'

:B B'

:C } C and

W l = {B --~ --,A ^ ~C} The extensions are obtained in the following way : TP(W1 u {A, B, C}) = { {--~, ~C, A, B, C}, {~B, A, B, C}} TP(W1 u {A, B, C}) is closed. There are two ways of opening it by suppressing literals coming from default consequences : We can suppress A and C responsible for the contradiction in its first element, or we can suppress B, responsible for the contradiction in the second element. This yields the two extensions : E1 i = Th(Wl u {B}) E12 -- Th(Wl u {A,C}) In this example it was straightforward to give the extensions because the consequences of the formulas were atomic. When this is not the case, we have to suppress together with a literal all other literals which come from the same default consequence. In order to find them, default consequences are indexed and together with the literal L(d) all other literals L'(d) are suppressed.

536

Example 3 :

:wE :B } RE ' B and

A3 = (W3, D3) with D3 = {dl, d2, d3} = ~{ :A ^ F , AAF W3 = {A ^ B ~ E } . TP(W3) = { {E }, {mA }, {mB } }

TP(CONS(D3)) = { {A(dl), F(dl), -~E(d2), B(d3)} } T3 = TP(W3 u CONS({dl, d2, d3})) = TP(W3) ® TP(CONS({dl, d2, d3})) = {{E, A(dl), F(dl), mE(d2), B(d3)}, {RA, A(dl), F(dl), ~E(d2), B(d3)}, {roB, A(dl), F(dl), ~E(d2), B(d3)} } T3 is closed and there are several ways to open it yielding the following extensions : E31 = Th(W3 u {A, F, B }) (by suppressing all L(d2) because of the contradicnon in the first se0 E32 = Th(W3 u {--~E,B }) (by suppressing all L(dl) because of the

contradiction in the

second set) E33 = Th(W3 u {A, F, RE}) (by suppressing all L(d3) because of the contradiction in the third set) When a default d "to be kept" in an extension has a prerequisite 0~, it has to be verified that tx is derivable. This is the case when TP(W) ® TP(CONS(D \ {d})) ® TP({RO~}) is closed.

Example 4 (Example 4.1 from Reiter 1980) : A4 = (W4, D4) with D 4 = {dl, d2, d3, d4}=

W4=

f

It

EvF:AAF A A F

A:B

'

B

AAE:C

'

C

:mE

' RE

{C--> D, A ^ B --~ E, E v D, D ~ F}.

We represent the sets of the tableau for W4 as colums : TS(W4) =

RC

mC

--~

~B

D

-4)

E

D

D

E

E

F

F

F

F

TP(CONS(D4)) = {{A(dl), F(dl), B(d2), C(d3), RE(d4)} }

J and

537

TS(W4) ® TP(CONS(D4)) is closed. The f'n'st set is closed by E and ~E(d4). Hence dl, d2 and d3 possibly belong to the extension. The precondition for dl, E v F is derivable, since TS(W4) ® TP(CONS({d2, d3})) ® TP({~(E v F)}) is closed. In the same way, we find that the prerequisites of d2 and d3 are also derivable. By verifying the other colums in the same way, we get the following extensions : E41 = Th(W4 u CONS({dl, d2, d3}) E42 = Th(W4 u CONS({dl, d4}) The algorithm for choosing the defaults to keep is described in more detail in (Risch 1989). The following example shows how the method behaves with directly contradictory defaults.

Example 5 : A 5 = ( W 5 , D5) w i t h D 5 = { B~A., B:--aA ~ A } and W5 = {B }. The extensions are obtained in the following way : TP(W5 u {A, --,A}) = {{B, --,a, A} } TP(W5 w {A, ~A}) is closed. There are two ways of opening it by suppressing literals coming from default consequences : We can suppress A coming from the first default or --~ coming from the second default. This yields the two open tables T x = TP(W5 u {A}) and T2

=

TP01¢'5 t..) {~A}).

The prerequisite condition holds for both since TP(W5 u {A}) ® TP({~B }) and TP(W5 u {--~A})® TP({--,B}) are both closed. This gives the two extensions : E5x = Th(W5 u {A}) E5 z = Th(W5 t3 {---,A}) It is also straightforward to deduce formulas from the default theory. A formula F is deducible if it is in an extension Th(F), i.e. if TP(F) ® TP({--,F}) is closed (by Corollary 1). Since, with our algorithm all extensions are constructively produced and then available in the form TP(...), it is sufficient to construct TP({-,F}) and to check whether TP(F) ® TP({~F}) is closed using lemma 1. Defaults have to be "grounded" in the set W. Each prerequisite has to be derivable in W alone or in W and some set of consequences of defaults which have not been derived by means of the

538 prerequisite itself. It is not possible that two defaults have as a consequence the prerequisite of each other (and be applied). The following example illustrates this case.

Example 6 : A6 = (W6, D6) with D6 =

B:A A '

A:B } B

and W6 = O.

A6 has one extension : E6-- Th(O) In order to exclude that {A, B } be an extension, we define groundedness of default sets in the following way. D~finition 5 : A set D of normal defaults without free variables is grounded in W iff for all de D there is a

o~i : ~i finite sequence do, dl .... dn of elements of D, di - - such that if0 e Th(W) and tXi+l e Th(W u CONS({d0, dl .... di}) for 1
The set of generating defaults GD(E, A) of an extension E of a default theory A = (W, D) is grounded in W. Proof : This is a direct consequence of theorem 1. The following theorem, which is the main result presented in this paper, shows that all extensions of a closed normal default theory are obtained in this way.

Theorem 5 :

l e t be A = (W, D) a normal default theory without free variables and W consistent. Then E is an extension o f A iff there is D' C D, D' grounded in W and E= Th(W u CONS(D')) and

(*)Vde

D,d=

,de D'iff

(*1) TP(W) ® TP(CONS(D')) ® TP({~ 0~}) is closed and (*2) TP(W) ® TP(CONS(D')) ® TP({ 1~}) is open

539

Proof : " = ~ " (immediately by theorem 2) Let E be an extension of A. Then, by theorem 2, E = Th(W u CONS(GD(E, A))). By setting D' = GD(E, A), we have to show that (*) holds for D' = GD(E, A). Let be d e D, d = (o~ : M~ / [~). Then d e GD(E, A) iff 0~ e E and --,1~ ~ E. This is the case iff

TP(W) ®

TP(CONS(D'))

®

TP({--7

0~})

is

closed

and

TP(W) ® TP(CONS(D')) ® TP({I]}) is open by corollary 2 and lemma 1. GD(E, A) is grounded by Lemma 3. On the other hand, consider D' c_ D, D' grounded in W and E = Th(W u CONS(W)) for which (*) holds. In order to show that E is an extension, we have to show that F(E) = E. We begin by observing that D1 ° : W C E D2 ° : Th(E) = E 0~:13 D3 ° : I f ~ e Dand~

13

E a n d c ~ e E t h e n [ 3 e E.

D1 ° and D2 ° are clearly true by the definition of Th(W • CONS03')). D 3 ° : Let be a : 1 3 e

D, --q3 ~ E and (x e E. But this is equivalent saying that

13

TP(W) ® TP(CONS(D')) ® TP({~cx}) is closed and TP(W) ® TP(CONS(D')) ® TP({13}) is open by corollary 2 and lemma 1. Suppose that 13 ~ E. Then d ~ D', i.e. TP(W) ® TP(CONS(D')) ® TP({~c~}) is open or TP(W) ® TP(CONS(D')) ® TP({[3}) is closed by (*). Contradiction! Hence by the minimality of F, we have F(E) C_ E. In order to show that E c_ F(E), consider d e D', d =

~:13

. We will show that

[3 e F(E), whence E c_ F(E). D' is grounded, therefore there is a finite sequence do, dl .... dn of elements of D, di -

cxi : ~i

such that do e Th(W) and

~i+l e Th(W tA CONS({do, dl .... di}) for l_
540 V. C O P I N G W I T H F R E E VARIABLES Our method applies aUso easily to default theories with free variables. In order to obtain a family of defaults without free variables from a default with free variables, the free variables are instantiated by every constant of the theory. For an example, let {a, b, c } be the set of constants of the theory (W, D) (i.e. the set of constants occurring in W and in formulae of D).

The default

~(x): ~(x)

Nx)

{ cx(a):13(a) ~(a)

will then produce the family

o~(b): ~(b) '

~(b)

o~(c): 13(c) } '

~)(c)

"

Hence, a default theory with free varables correspond a default theory without free variables where the defaults are replaced by their families as shown above. Our method of computing extensions and deriving formulas however does not force us to replace the defaults by (sometimes big) families of defaults. When the tableau for W u CONS(D) is produced for a default theory (W, D), we produce it with the universal closure of the consequents. The quantifier rule for TP will then allow us to replace every formula VxA(x) by A(c) for any parameter c. The prerequisite condition has then to be verified for the same parameter which has been replaced. Example 6 :

A6 = (W6, D6) with W6 = {~P(a), Q(b)} and D6 = t

P x) } "

P(x)

A6 has one extension E6 = Th (W6 u {P(b)}) which is computed as follows : TP(W6 u {VxP(x)}) = {--@(a), Q(b), VxP(x)}. Then x may be instantiated by ~

parameter

(see the definition of TP in chapter III). By instantiating x by every constant which has an occurrence within W6 or D6 (i.e. by a and by b), the closed tableau { {-~P(a), Q(b), P(a), P(b) } } is obtained. It can be "opened" by suppressing P(a) yielding E6, which is the only extension. The precondition is valid, Q(b) belongs to the tableau.

541

VI. C O N C L U S I O N We presented a very simple and powerful method for computing all the extensions of a normal default theory without free variables. The algorithm presented here seems to be more efficient than all other algorithms presented up to now, because it computes extensions by producing the semantic tableau for Qn¢ formula (the conjunction of the general laws and the consequences of the defaults) only once. Moreover the method applies very naturally to defaults with free variables. All other proof methods for default theories so far given could only apply to defaults without free variables. The idea underlying our method has already been applied for producing the states resulting from the performance of an action (Lafon and Schwind 1988). Roughly speaking, it is just the idea of how to find in a very precise way a maximal consistent subset of an inconsistent set of formulae (naturally under some additional conditions). Hence our method seems also very promising for the application to other non-monotonic logics such as autoepistemic logic or supposition based logic (Besnard and Siegel 1988). Our system has been devellopped on a Macintosh in Prolog II. Acknowledgements : I thank Philippe Besnard for finding an important error in the first version of this paper. I also would like to thank Frank Brown for his critical and useful remarks. REFERENCES

[1] Besnard P. Quiniou R. Quniton P. 1983. A Theorem-Prover for a decidable subset of default logic. Proceedings of the AAAI - 83 : 27 - 30. [2] Besnard P and Siegel P. 1988. Supposition-based logic for automated nonmonotonic reasoning. Proc. 9th Conf. on Automated Deduction, Argonne, I1. [3] Bossu G. Siegel P. 1985. Saturation, Nonmonotonic reasoning and the Closed-World Assumption. Artificial Intelligence 25, 1 : 13 - 63. [4] Brown F. M. 1986. A commonsense theory of nonmonotonic reasoning. Proc. 8th Conf. on Automated Deduction, Oxford. Lecture Notes in Computer Science, Vol. 230, Springer Verlag, 209-228.

542

[5] Lafon E. Schwind C. 1988. A Theorem Prover for Action Performance. Proceedings of the 8th European Conference on Artificial Intelligence, ECAI - 88 : 541 - 546. [6] Schwind C. 1985. Un d6monstrateur de th6or~mes pour des-logiques modales et temporelles en PROLOG. 5bme Congr~s AFCET Reconnaissances des formes et Intelligence Artificielle, Grenoble, France, pp. 897-913. [7] Reiter R. 1980. A logic for default reasoning. Artificial Intelligence, 13 : 81 - 132. [8] Risch V. 1989. Utilisation d'un d6monstrateur ~t tableaux pour le calcul d'extensions en Logique des D6fauts. M6moire de D.E.A., Universit6 d'Aix-Marseille II. [9] Smullyan R. 1968. First-Order Logic. Springer Verlag.

Computing Prime Implicants Peter Jackson M c D o n n e l l Douglas Research Laboratories Dept 225, Bldg 105/2, Mailcode 1065165 P.O. B o x 516, St. Louis, M O 63166, U S A

John Pais Department of Mathematics and C o m p u t e r Studies W e b s t e r University, St. Louis, M O 63119, U S A

1 Introduction In 1955, Quine noted that the problem of devising a general mechanical procedure for reducing any formula to its simplest equivalent has proved difficult, despite the trivial nature of propositional logic. This problem is relevant to a number of applications in electrical engineering and computer science, such as the minimization of Boolean functions (McCluskey, 1956), and also to applications in automated reasoning and artificial intelligence, such as finding the minimal supports of a clause in truth maintenance systems (Reiter & de Kleer, 1987). Solutions to the problem require resources which are exponential in the number of distinct propositional variables occuring in the formula. Quine noted that it was convenient to specialize the problem of simplifying truth functions to a problem of finding the simplest normal equivalent of some formula, i.e., where the equivalent is in some normal form. The key notion in such simplification procedures is that of the prime implicants of a formula. A prime implicant is a conjunction which entails the original formula, but which ceases to do so if a single conjunct is deleted from it (see Definition 1). Quine (1955, Theorem 1) shows that any simplest normal equivalent of a formula will be an alternation of its prime implicants. However, the number of prime implicants of a formula may exceed the number of its possible truth value assignments (Quine, 1959). The only efficient algorithm for computing prime implicants that we have been able to find in the literature is due to Slagle, Change & Lee (1970). It is based on semantic trees, and we shall refer to it as the Tree Method (TM). In this paper, we compare TM with a novel algorithm based on the matrix representation underlying Bibel's (1982) connection calculus, which we shall refer to as the Matrix Method (MM).

544

2 Terminology and notation In his original papers, Quine (1952, 1955, 1959) used the term 'prime implicant of a formula • ' to refer to 'a fundamental formula that logically implies q~ but ceases to when deprived of any one literal' (1959, pp. 164-165). Formulas were sums of products of titerals, i.e., they were in Disjunctive Normal Form (DNF), and were shown to be logically equivalent to the alternation of their prime implicants. Since then, Reiter & de Kleer (1987) and others have used the term to refer to the dual notion for the Conjunctive Normal Form (CNF), where formulas are products of sums of literals and are logically equivalent to the conjunction of their prime implicants. Slagle, Chang & Lee (1970) mostly followed Quine in distinguishing between prime implicants as products of literals and 'prime implicates' which are sums of literals. Our definitions follow the terminology of Slagle, Chang & Lee, largely to facilitate comparison with their original paper. We assume throughout the rest of this paper that we are interested in deriving the prime implicants of propositional theories in CNF, since this is the syntactic form most often employed in automated theorem proving. We shall use the term

theory to refer to finite sets of propositional formulas constructed over a finite alphabet, without regard to their syntactic form, and without assuming that they are necessarily closed under deduction. Our notation shall be as follows. The letter S will stand for a theory in DNF, the letter C will stand for a conjunction of literals, while the lower case +c will stand for a conjunct of indifferent sign. Positive and negative conjuncts will be represented by c and ~ c respectively. To distinguish CNF forms, the letter T will stand for a theory in CNF, the letter D will stand for a disjunction of literats (i.e., a clause), while the lower case +d will stand for such a literal of indifferent sign. Positive and negative disjuncts will be represented by d and ~d, respectively. All such letters will be augmented by subscripts or primes as required. Definition 1 A conjunction C is a prime implicantof a theory S iff (i) C is not a contradiction; (ii) C I= S and (iii) for all literals +c in C, C' I¢ S where C' is C less +c. Definition 2 A disjunction D is a prime implicateof a theory Tiff (i) D is not a tautology; (ii) T I= D and (iii) for all literals +_din D, SI¢ D' where D' is D less +_d.

545

The crucial notion of subsumption is worth defining in detail for both normal forms. Definition 3 If C and C' are two conjunctions, then C subsumes C' iff C ' 1= C but not conversely. Definition 4 If D and D ' are two disjunctions, then D subsumes D ' iff D I= D ' but not conversely.

3

The algorithms and their implementation

In this section, we describe the two algorithms, supply a simple example of each, and show that neither algorithm is admissible. Finally, we say a few words about the implementation of the algorithms. 3.1

The TM

algorithm

The basic idea behind the TM algorithm is as follows. We do a depth-first search of an ordered tree in which the branches immediately below a given node are literals appearing in the order of their frequency of occurrence in the clauses that remain to be visited at that node. This strategy allows us to prune the tree to the right (assuming a left-to-right ordering of the branches). Failure nodes are nodes where every literal that could serve as a branch is either inconsistent with a previous branch (i.e. it is the negation of a literal that appears on a branch between the current node and the root), or has already appeared on a path to the left of the current node. The algorithm can be described by the following steps. The only input to TM is a propositional theory, T, in CNF. The notation that we shall use differs somewhat from that of Slagle, Chang & Lee, but the substance is the same. 1. Delete from T all tautologies. If T is now empty, then T (truth) is the sole prime implicant of T and the algorithm halts, else call the initial node in the tree TOand proceed to Step 2. 2. Define a frequency ordering O(T0), on the literals occurring in T0, such that, for any two distinct literals +_di and +dj in T o, +_di > +dj if+d/occurs in more clauses of TOthan +_dj does. Suppose that the literals are +dl ..... +dk. Then we construct an ordered tree from the root TO

546

with branches labelled by each of these literals. These branches lead to new nodes T 1.....

Tk,

which are defined as follows. For each i, 1 _
be that set obtained from To(+dj) by deleting ~(+dj) and all literals +dj such that j <_i from the clauses in To(+dj). If Ti(+dj) now contains an empty clause, then Tj is a failure node, else ~ is a non-terminal node. 3. If there is a non-terminal node Tj, let To be Tj and go to Step 2, else proceed to Step 4. 4. If the tree contains no success nodes, then _L(falsity) is the sole prime implicant of theory T, else, for each success node Tj, collect the product of all the literals labelling the branches on the path from the root to Tj. Let W(T) be the set of all such products. Slagle, Chang & Lee (Theorem 1) present a proof to the effect that every member of W(T) is an implicant of T, and that W(T) contains all the prime implicants of T. If we require the prime

implicates (to return the simplified theory to CNF), then we must apply the algorithm

again to W(T). Since W(T) may contain formulas other than prime implicants, an additional step of subsumption elimination is required to compute only the prime implicants: 5. W(T) := W(T) - {C e W(T) I (3C' e W(T))(C' subsumes C)}. Slagle

et al. claim that 'most of the nodes on the fight of the semantic tree terminate very

quickly,' and that 'experiments with the algorithm show that it usually generates very few (possibly none) nonprime implicants.' However, they do not provide any empirical evidence for these assertions. We investigate these and other properties of the algorithm in Section 4, and present data which demonstrate the conditions under which the above assertions are justified.

3.2 The MM algorithm The MM algorithm is essentially a breadth-first

search through a matrix of clauses, ordering the

clauses in the matrix as we go. We start by choosing one of the shortest clauses in the theory, and making each of its literals the beginning of a path. At each subsequent step, either a path

547 already contains a literal to be found in the current clause (in which case we say that it is 'trivially extended' and place it in the list SAME), or that path needs to be 'properly extended' by adding a literal that is consistent with the literals it contains. Whenever we properly extend a path, we check immediately to see if it is subsumed by another path. It turns out that it is only necessary to check if trivially extended paths (i.e., those in SAME) subsume properly extended paths; we need not check if properly extended paths subsume each other (see I~mma 1 in the Appendix). Effectively, the algorithm computes all the minimal consistent paths through the matrix of clauses. Let T be a non-empty theory in CNF. Then MM can be described by the following sequence of steps. 1. Subsumption elimination. First we eliminate all subsumed clauses from T. 2. Select first clause. We put T on OPEN and choose the first clause, saving its positive and negative literals in separate lists (POS and NEG). In addition, we create the variable

PATHS to hold the paths being constructed through the matrix, and the variable SAME to hold those paths which do not require extension with respect to the current clause (see Step 5).

OPEN := T; Let D o = {+_d1..... +dn} be one of the shortest clauses in OPEN;

OPEN := O P E N - {Do}; PATHS := {{+dl} ..... {+-dn}}; SAME := {}; POS := {dl {d} ~ Do};NEG:= {~dl {~d} ~ DO}. 3. Termination. If OPEN = 0 , then halt and return PATHS. 4. Next clause selection. For each clause D ~ OPEN, we compute h(D) = ISll × IS2t, where S 1 is the set {{d} ~ D I d ~ POS} ~ {{---d} ~ D I ~ d ~ NEG} and S2 is the set

548 {{~d) ~ D l d ~ POS) u {{d} ~ D l--,dE NEG}, i.e., we compute the product of the cardinality of the set of literals in D that we have seen before and the cardinality of the set of literals in D which are complementary to literals we have seen before. Then we select a clause D* from among the clauses that maximize h, and update POS and NEG accordingly. POS := POS u {dt {d} ~ D*}; NEG :=NEG u {--all {---,d} ~ D*}.

5. Path extension. We extend those paths that need extending to account for the current clause D*, saving the rest temporarily on SAME for use in Step 6. for P in PATHS do if ~(3+_.d e D*)(+d ~ P) then PATHS := P A T H S - {P}; [ for +_de D* such that +d is consistent with P do PATHS: = PATHS u (P u {+_d}) ]

else SAME := SAME u {P}. For any literal +_d and path P, +_d is consistent with P iff --,(+_.d) ~ P. 6. Path Subsumption. P A T H S := PATHS - {P ~ P A T H S I (3Q ~ SAME)(Q c P ) } . 7. Reeursion. OPEN := O P E N - {D*}; D O := D*; SAME := { }; go to Step 3. Given a theory T in CNF, MM returns all and only the prime implicants of T . (A proof to this effect is given in the Appendix.) To transform the prime implicants back into CNF, it is necessary to reapply the algorithm to them, as with TM. Our algorithm is obviously related to Bibers (1982) matrix method for resolution refutation, where we seek to show that all paths through a matrix of clauses are contradictory. Here, the application is to consequence finding, so we seek the minimal consistent paths. The algorithm also bears a family resemblance to the computation of minimal hitting sets (Reiter, 1987), the main difference being that we have to check that paths are consistent.

549

Note that, in contrast with TM, subsumption elimination can occur at the beginning, rather than at the end, of the computation in MM, since we are assured that only the prime implicants will be generated.

3.3

An example

Example 1 (from Slagle, Chang & Lee, op cit) Let T be the CNF theory [{XO, Xl, X2, X3}, {--ax0, --0el, x2,--ax3 } }.

The partial order on literals by their frequency of occurrence in T is:

x2 > Xo, X1, X 3, --ocO, --~Xl , ---tx3.

Figure 1 shows the search space that TM would construct, given the total order x 2 > ---ix3 > x 3 > ---oc1 > x 1 >-ax0 > x 0, which is the order generated by the program described in Section 3.5.

x0

Figure 1 A T M search space for Example 1.

550 Branches terminating in black nodes are pruned. All other nodes are white; terminal white nodes are success nodes. Note that the program generates 11 (white) nodes, each of which is on the path to a success node which represents a prime implicant. Figure 2 shows the MM search space with the clause ordering {---oc0, -,x 1, x 2, --oc3} _> {x0, x

1, x 2,

x3}, which is the order generated by the program described in Section 3.5. The

program generates 10 nodes, each of which is on the path to a success node which represents a prime implicant.

X2

Figure 2 An MM search space for Example 1.

3.4

Neither algorithm is admissible

By definition, each prime implicant generated by these algorithms is represented by a minimal path from the root node to a leaf node, and therefore constitutes an optimal solution element. However, neither algorithm guarantees to find the most compact representation of the set of a l l solution elements, i.e., the set of all prime implicants. The problem with each algorithm is the following. Both algorithms have a heuristic which, at any given point in the search, generates a partial order on the successors of the current node. In TM, the order is on literals as a function of their frequency of occurrence in the set of clauses at the current node; in MM, the order is on clauses as a function of how their literals enter into relations of identity and complementarity

551

with the literals seen so far. Admissibility is not forthcoming because there are total orders consistent with these partial orders that do not result in the most compact search space containing all the solution elements.

3.5

Implementation

Each algorithm is implemented in SLOOP (Jackson, 1987), an object-oriented extension to LISP. The corresponding programs run on a Symbolics 3650. Such a machine allows rather more computing power for experimentation than was available to Slagle et al. in 1970. The two programs share a number of data types (classes) and procedures (methods). For example, theories are represented identically by objects of type theory, and each program represents clauses using the object clause. Each of these objects has various methods attached to it which perform similar functions in both programs. Branches in the semantic tree are objects of type branch, links in the matrix are objects of type link, while link and branch are each subclasses of the class path and inherit all of its methods.

4

C o m p a r i s o n of TM and M M

In the comparison of the two programs which follows, nothing hangs on the implementation language. The only measure that we shall use as a basis for comparison is the Total Number of Nodes expanded (hereafter TNN). We use TNN rather than penetrance because, as we have seen, neither algorithm is admissible. Consequently, it is not possible to compute the shortest solution path using either of the programs, and it is infeasible to do this by hand for large theories. TNN is also critical to the time complexity of the algorithms, since the cost of creating (and subsequently destroying) nodes in the search space is a major consideration in the implementation. Both programs clean up after themselves by garbage-collecting search nodes.

4.1 Experimental procedure and results In order to effect an impartial comparison, a program was written which generated propositional calculus theories in CNF using pseudo-random numbers. The parameters to the program were the following:

552

(i) the number of clauses to appear in the theory; (ii) the maximum number of literals in such clauses; and (iii) the size of the alphabet from which literals should be fomaed. In addition, the theories generated were subject to the following constraints. • Unit clauses were outlawed, since their presence in large theories can lead to too many clauses being subsumed (making the theory too 'easy'), or the theory being contradictory (in which case its sole prime implicant is _1_). ° Theories contained no tautologies, and no clauses contained redundant literals. The three parameters listed above were systematically varied to provide different classes of theories for the comparison. In addition to comparing the performance of the two algorithms, we were also interested in estimating the effect of increased alphabet/clause/theory size upon the total number of nodes expanded. The classes of theory generated are shown in Table 1, together with their parameter values and measures of central tendency and dispersion for the number of prime implicants. 10 theories were generated for each class, making 70 in all. Fortuitously, each of the theories generated turned out to be consistent, but we were prepared to discard inconsistent theories and generate new ones. The experimental design involved comparing the performance of the algorithms on classes B, C, and D to determine the effect on each algorithm of increasing the alphabet size, on D, E and F to determine the effect of increasing the maximum clause size, and on E, G, and H to detemaine the effect of increasing the size of the theory.

Class

No. of clauses

B C D E F G H

12 12 12 12 12 24 36

Clause size (max) 4 4 4 8 12 8 8

Alphabet size 6 12 18 12 12 12 12

PI (mean) 4.3 40.8 230.7 115.9 231.5 93.2 29.0

PI(sd) 2.83 19.96 132.35 35.35 94.30 40.71 20.52

Table 1. Classes of randomly generated theory used in the experiment, showing their parameters (number of clauses, maximum clause size, and size of alphabet from which they were generated) and means and standard deviations of number of prime implicants.

553

Class B C D E F G H

MM (mean) 17.8 107.1 429.5 218.4 421.9 275.7 175.2

MM (sd) 6.01 43.57 230.71 52.61 191.79 128.41 68.06

TM (mean) 17.7 175.9 956.3 396.3 846.0 546.5 297.5

TM (sd)

NPI (mean)

NPI (sd)

7.00 71.55 536.16 96.71 434.24 264.79 152.20

0.3 4.8 6.7 16.5 51.9 25.6 8.2

0.64 2.44 7.50 12.56 33.21 18.24 11.06

Table 2. Data summary of the experiment: means and standard deviations of TNN (Total Number of Nodes expanded) for the Matrix Method (MM) and the Tree Method (TM) for each class of theory. NPI stands for Non-Prime Implicants - those implicants generated by TM that are eliminated in the final subsumption check. The experimental procedure involved no more than running each algorithm on each theory in each of the classes. The results are summarized in Table 2, and shown graphically by Figures 3-6 in the following section. 4.2

D i s c u s s i o n o f results

The data of Table 2 show that the matrix method outperforms the semantic tree method on every class of theory examined, except for class B. In fact, the raw data show that MM outperforms TM on 66 out of the 70 theories, and the four exceptions are all in class B. B is the theory class with the smallest values for each of the parameters. For theories with very small alphabets, such as those examined in Slagle, Chang and Lee's original paper (and our B class), there appears to be no significant advantage in using one algorithm over the other. But as alphabet size increases, MM's advantage becomes readily apparent (see Figure 3). We can also see from Table 2 that TM's inferior performance is not due to the generation of non-prime implicants. It must therefore be attributable to the algorithm's inability to prune the search space as effectively when alphabet size increases. Thus Slagle et al.'s claim that most of the nodes on the right of the tree terminate quickly is not supported in general. However, the claim concerning the small number of non-prime implicants generated is supported by these data. Class D contains the theory with the largest number of prime implicants (525), and TM found them all without generating a single non-prime implicant. Table 2 also shows that the dispersion of MM's scores is less than TM's, demonstrating that MM's performance is more consistent than TM's. Thus MM's superior mean performance

554

mean T N N 1000

956.3

900 800 700 600 500

429.5

400 300 200 100

6

12

18

Alphabet size

Figure 3. Bar chart showing the effect of increasing alphabet size upon mean TNN. Dark bars stand for TM data, light bars for MM data.

mean TNN 1000 900

846.0

800 700 600 500

429.5

400

396.3

300 200 100

4

8

12

Maximum c l a u s e size

Figure 4. Bar chart showing the effect of increasing maximum clause size upon mean TNN. Dark bars stand for TM data, light bars for MM data.

555 mean NPIs

60 51.9

40

20

// 16.5

6.7

4

8

12

Maximum clause size

Figure 5. Bar chart showing the effect of increasing maximum clause size upon mean NPI, i.e. upon the mean number of non-prime implicants generated by the TM algoritht

mean TNN 1000 900 800 700 600

546.5

500 400

396.3 297.5

300 200 100

12

24

36

Number of clauses

Figure 6. Bar chart showing the effect of increasing theory size upon mean TNN. Dark bars stand for TM data, light bars for MM data.

556 is not due to exceptionally good performance on some subset of the sample. However, the raw data show that, even though TM's performance is more variable than MM's, its inferior mean performance is not due to exceptionally poor performance on some subset of the sample: as mentioned earlier, MM outperforms TM on all but 4 out of the 70 theories. Figure 4 suggests that the maximum number of literals allowed in a clause is not a good predictor of search cost. But Table 2 shows that it is a good indicator of the number of non-prime implicants we can expect TM to derive (see also Figure 5). In one theory in class F, TM generated 141 non-prime implicants in addition to the 425 prime implicants of the theory. Such data demonstrate that the number of non-prime implicants generated will not always be negligible, and that the number increases exponentially with maximum clause size. Figure 6 suggests that the size of the theory alone is not a reliable indicator of search cost, while Table 2 shows that it is not a good indicator of the number of non-prime implicants generated by TM. 5

Summary

and conclusions

This paper presents a new method (MM) for computing the prime implicants of a propositional theory based on Bibel's matrix method, and compares it with the method of semantic trees (TM) due to Slagle, Chang and Lee. Specifically, we conclude the following: • MM consistently outperforms TM on randomly generated theories. ° Search cost is an exponential function of alphabet size, rather than theory or clause size. This is hardly surprising, given the complexity results for propositional satisfiability. Nevertheless, one might have expected an effect from clause size. • The number of non-prime implicants that TM generates is an exponential function of clause size. The key to MM's success is the heuristic of Step 4, and the multiplication of the two weights, representing shared and complementary literals, is essential. Any other plausible function of the weights, such as addition, leads to performance less than or equal to that of TM. This indicates that it is the interaction between shared and complementary literals that serves to limit search. Shared literals generate trivial extensions to existing links, which can then be used to subsume other links that did require extension. Complementary literals simply reduce the number of possible links at each stage.

557 Bibel, W. (1982). A comparative study of several proof procedures. Artif. Intell., 18, 269-293. Jackson, P. (1987). The SLOOP Manual. Artificial Intelligence Applications Institute, University of Edinburgh. Quine, W. V. O. (1952). The problem of simplifying truth functions. Am. Math. Monthly, 59, 521-531. Quine, W. V. O. (1955). A way to simplify truth functions. Am. Math. Monthly, 62, 627-631. Quine, W. V. O. (1959). On cores and prime implicants of truth functions. Am. Math. Monthly, 66. McCluskey, E. L. Jr. (1956). Minimization of Boolean functions. Bell Sys. Tech. J., 35, 1417-1444. Reiter, R. (1987). A theory of diagnosis from first principles. Artif. Intell., 32, 57-95. Reiter, R. & de Kleer, J. (1987). Foundations of assumption-based truth maintenance systems: Preliminary report. 6th AAAL 183-188. Slagle, J. R., Chang, C.-L., & Lee, R. C. T. (1970). A new algorithm for generating prime implicants. IEEE Trans. Computers, C-19(4), 304-310.

Appendix Lemma 1. Every conjunction in MM(T) is a prime implicant of T.

Proof. Every conjunction C = {+c1..... +cn} in MM(T) 'hits' every disjunction D = {+__d1, +din} in T, i.e., for all C e MM(T) andD ~ T, +c i = +_d,, for some +c i ~ C and +_d,e D. So C I= T, for all C e MM(T). It suffices to show that the subsumpuon check (m Step 6) is effective, i.e. to show that, at any level k in the recursion, it is only necessary to delete paths subsumed by the trivial extensions of level k in order to eliminate non-prime implicants from the result. We proceed by case analysis. For any two distinct (possibly partial) paths, C = {+c I ..... .t_cn} and C' = {+c'] ..... +c' m} on OPEN at level k, either (i) both C and C' are properly extended, or (ii) neither C nor C' is properly extended, or (iii) one is properly extended and the other is not. In case (iii), if one of path (say C) is extended by the literal +cn+I, then it can be subsumed if +_cn+1 ~ C'. This is the case allowed for by Step 6. In case (i), however, we can argue that if it is not the case that {+cI ..... +cn} c {+c'1..... +c' m} at level k - 1, then it will not be the case that {+c 1, +c n, -t-Cn+1 } C {-FC'I, +--Cm, _C m+l } at level k. In case (ii), we can see that, if neither path is properly extended and it was not the case that C c C' at level k - 1, then it will not be the case at level k. Thus case (iii) is the only one in which subsumption can take place, and this is precisely the case covered by Step 6. "'"

j

•

.

J

•

Lemma 2. MM(T) contains all the prime implicants of T.

Proof. Suppose not. Then there is a prime implicant C = {+c] ..... +cn} ~ MM(T). I f n = 1, then C hits every clause in T. But then + c / i s set up as a link (by Step 2) and can never be subsumed. So {++.c1} e MM(T), which is a contradiction. If n > 1 then, at each level k of the recursion, we compute all consistent extensions to {+_c]..... +c k ] }, pruning only those which are subsumed by the trivial extensions of that level at Step 6. B~eadth-first search ensures that we will eventually compute {+c1..... +cn}, so C ~ MM(T), which is a contradiction. Theorem 1. MM(T) contains all and only the prime implicants of T.

Proof. Follows trivially from Lemmas 1 and 2.

Minimizing the N u m b e r of Clauses by Renaming* Thierry Boy de la Tour Laboratoire d'Informatique Fondamentale et d ' I n t e l l i g e n c e A r t i f i c M l e - I M A G - C N R S 46, av. Fdlix V i a l l e t 38031 G r e n o b l e c e d e x ( F r a n c e )

Abstract The problem of translating a formula into a "good" clause form is known to be a very important one in resolution automated theorem proving. Some theorems have such a huge clause form that it is practically impossible to prove them by resolution. Several methods exist to reduce clause forms, some applied before and some after translation. They are generally based on (local or non-local) simplifications. A method consisting in the creation and use of definitions, which we call renaming, has been developed in [5], [4] and [7]. Applying it in an exhaustive way was shown to yield a translation into clause form polynomialin size (see [7]). In this paper we investigate non exhaustive renamings in the purpose of minimizing the number of clauses. We obtain a translation which is shown to be polynomial in size, and optimalin number of clauses when the theorem contains no equivalence. An example shows that this translation is not necessarily optimal in presence of equivalence. Experiments with "challenge" examples show the practical efficiency of this translation.

1

Introduction

Renaming a subformula consists in replacing it by a new literal, and joining to the whole formula, with a conjunction, a statement defining this new literal to stand for the replaced subformula (a precise definition can be found in section 2). A priori, a renamed formula seems more complex than the initial one, and is of greater length, but this technique actually allows to cut a formula into pieces, and to choose a particular formulation of the problem among many others (exactly 2 n, where n is the number of subformulas of the initial statement). Concerning the resolution method, it is known that renaming (almost) *This work was supported by the PRC-IA (CNRS-MRT).

559 all subformulas is particularly interesting (see [5]), and, among others, have the property to yield a linear translation into clause form on propositional formulas, and quadratic on first order formulas. In the following, we will mainly refer to the translation presented in [7], called structure preserving, rather than the one in [4] ; the latter is exposed in too few details and is devoted to the connection method, while we are interested in the resolution method, as in [7]. This structure preserving translation consists in renaming all subformulas except negations and atomic formulas. However, it is rather easy to see that the exhaustive renaming can be improved by further restrictions, for example not to rename subformulas gathered by a conjunction, or within string of quantifiers... Is there any general criterion telling which subformula should or should not be renamed? It is obviously impossible to try all possibilities to search for the best, i.e. the one with the shortest refutation. Incidentally, it is also possible that one renaming is suitable if used with a particular strategy, and not otherwise. For example, resolving first upon the new literals corresponds to computing the clause form of the non-renamed formula, hence makes any renaming useless and even harmful. Considering the difficulty of these questions, some of which are mentioned in [5], [7] and [3] (where an example is presented in which the renaming exponentially decreases the length of the proof), we restrict ourselves to a syntactic criterion, namely the number of clauses. The next section presents the general method used to decrease the number of clauses: it simply consists in renaming a subformula iff this renaming makes the number of clauses to decrease. Applying this criterion in any order, and until there is no subformula left that satisfies the test, is already an efficient method and leads to a result of restricted optimality: the number of clauses is less than both the standard clause form and the structure preserving clause form. The complexity in size of the method is proved to be independent of the strategy. In section 3, we consider a set of renamings which we call top-down renamings. They correspond to top-down strategies, and of course satisfy all the properties shown in section 2. We then demonstrate that these renamings are optimal in the linear case (no equivalence), and an example shows that optimality is not guaranteed in the general case. Last, we have applied the top-down renaming transformation on examples reputed for the difficulty to translate them into a concise clause form, and (efficiently) obtained very good results in this respect. This is presented in section 4. The proof presented in the following are sufficiently detailed to be understood, but may need some work to be completely checked. Some of the results of section 2 are presented in detail in [1].

560

Table I: Number of clauses

¢ ¢IA..ACn

¢lv..v¢.

p(¢) E~"=Ip(¢4 I]~"=~p(¢0

~(¢~)p(¢2) ¢1 ~ ¢2 ¢1 ¢~ ¢2 P(¢I)P(¢2) dl"P(¢I )P(¢2) p(¢~) qxl..x., ¢1 atomic

2 2.1

Definitions

~(¢) n

I-Ii=l p(¢~)

E~=I p(¢0 p(¢1) + ~(¢~) P(¢I )P(¢2) "~-P(¢I)P(¢2)

V(¢1)

~(¢1) p(¢1)

1

1

and first results

definitions

The syntax of the formulas includes, in addition to standard features, undetermined arity for conjunction and disjunction - - this allows to consider conjunctive normal forms as formulas, instead of lists of lists of literals - - quantification over lists of variables, and predicate symbols with arity 0, thus containing the syntax of propositional formulas. SF(¢) denotes the multiset of subformulas of ¢, and [SF(¢)[ the number of subformulas of ¢. 9 I'- ¢ stands for 9 E SF(¢), and we say that ¢ is a supformula of 9. We will use a slight modification of the well-known notion of polarity of a subformula : if 9 I- ¢, in the case there is no equivalence between 9 and ¢, the definition of pol(9, ¢) is standard (the value being +1 or -1), otherwise we define it to be 0. We first consider the transformation into clause form which is to be applied after the renaming. This transformation involves linearization (elimination of equivalences), skotemization, prenex and conjunctive normalizations. The last three are standard, the first is particular: following [5], the equivalences p ¢~ q are considered in a top-down order, and transformed depending on their polarity in the formula. I f p ~ q has positive polarity, it is transformed into (p :=~q) A (q =ezp), otherwise into (pA q) V (-~pA-~q). This performs simplifications which are not recognizable if the polarity is not considered, and the formula transformed into clause form, hence this technique decreases the number of clauses. Considering these transformations, it is easy to compute the number of clauses obtained from an initial formula ¢, which we note p(¢) (see table t, ~(¢) stands for p(-~¢)). This would not have been the case considering simplifications and/or subsumptions. In particular, we have the important property that the number of clauses of a formula depends only on the number of clauses of its subformulas (and/or their negations), out of which we state the following definition: V9 U ¢, let pC and ~ be the functions from /hr* x /N* to ~r. defined by V¢,p(¢[9 ~ 9']) = P~C(P(~'),P(¢)) and

561

p(¢[9

9']) =

(p(¢), p(¢)).

For example, let (2 = (9 :=~ 9 x ) A g ~ , we have p((2) = P(9)P(91) + p(~2) and ~((2) = (P(~) + P(91))P(92), hence pC (x, y) = P(91)Y + P(~2) and ~ ( x , y) = P(92)x + ~(92)P(91). From table 1, it is easy to see that PC~(z, y) is always of the form ax + by + c with a > 0 (a = 0 iff pol(9,¢) = - 1 ) , b >_ 0 (b = 0 iff po/(9,(2) = 1) and c >_ 0. This will be of importance to compute the number of clauses after a renaming (replacement of subformulas by literals). To define the renaming transformation, we first associate to each subformula ~oof (2 a new predicate symbol, noted SkP~o (skolem predicate), and a new literal SkP~(xl..xn), noted SkL~, where zi..xn are the free variables of 9- We note Def¢ (9), and call definition of SkL~, depending on the polarity of 9 in (2 the formula Vzl..zn,SkL~ ::~ ~o if poi(9,¢) = 1, VXl..Xn,9 :=~ SkL~ if pol(9,(2) = - 1 and Vxl..zn,SkL~ ¢~ ~o if pol(9, (2) = 0. The rule is that pol(~, Def¢(~)) = poi(9, (2).

A renaming R of (2 is simply a subset of SF((2) - {(2}. For technical reasons, we do not allow the renaming of (2 itself, but this would clearly be useless. To each 9 F (2 we associate a particular subset of R, noted InfR(~o), which is max{9 ~ E R : 9 ¢ E 9 A 9 ~ ~ 9}. InfR(9) is a renaming of ~,. We also associate a particular element of R, i f { 9 ' • R : 9t-- 9'} ~ O, noted SupR(~), which i s m i n { 9 ' • R : 9 U 9'}. ¢[R] denotes the formula ¢ where every subformula 9 E R has been replaced by SkL~. Of course, we have (2[R] = (2[InfR((2)]. Following this property, we agree that ~[R] stands for 9[InfR(9)]. To each renaming R of (2 we associate the formula noted Rename Rin(2, which is We see that

¢[R]^A~eRDef¢(9[R]).

Rename 91..9n in ¢ ¢:~Rename ~1 in (Rename ~ in ... (Rename 9n in ¢ ) . . . ) and it is proved that renaming a subformula preserves satisfiability (much in the same way as skolemization, which justifies the name given to the new predicate symbols, see [1]), hence T h e o r e m 1 Rename R in (2 is satisfiable iff (2 is salisfiable.

2.2

a fundamental

result

It is shown in [7] that if R contains every subformula of (2, except the negations and the atomic subformulas, then the length, and the number of clauses of the clauses form of Rename R in (2 is linear in the length of (2, which we note ](21. This is obviously not the case for any renaming, and in particular for R = 0, which gives the standard clause form, the number of clauses (and the length itself) is exponential: p((2) _< 2lsr(¢)]. However, the length of the clauses is linear, which shows the interest of minimizing the number of clauses. In this purpose, we define the benefit of a renaming R in a formula (2, noted B(R, ¢), to be p(¢) - p(Rename R in ¢). B(~, (2) stands for B({9}, (2), and if 9 t- ¢, B(9, ¢[R])

562

stands for B(~[R],¢[R]). We notice that if pC = )~xy.ax + c, then B(IO,¢) > 0 iff a > lAp(to) > 1. This will be of constant use. We are obviously interested in those renamings R of positive or zero benefit:

B(R, ¢) > 0, but we can restrict ourselves to a smaller subset of renamings using the following fundamental theorem of monotony (in short "tim"): T h e o r e m 2 V¢,VIO I- ¢, if R , R ~ are renamings of ¢ such that R C R~, then B(~, Rename R in ¢) > B(IO, Rename t~ in ¢) Proof." we show that VIO' 1-- ¢, B(IO, ¢) > B(~, Rename ~ in ¢), from which the general case can be deduced. We have B(~, ¢) = P¢~(p(io),~(io)) - PC(l, 1 ) - p(Def¢(io)), and we distinguish three eases: 1. ~ and ~' are disjoint: B(io, Rename~' in ¢) = B(~, ¢[¢]) = PC[~°'l(p(ta),p(io))P¢[~'](1,1) - p(Def¢(io)), but the coefficients of the polynomial P¢[~/] are smaller than those of P~¢ (because p(¢[¢]) < p(¢)), hence B(IO, ¢[¢]) < B(IO, ¢) (because p(io), V(~), p(io'), p(~') > 1, and the coefficients of p¢[V'] are positive).

2. to r- io': B(~,Rename~din¢) = B(io, Def¢(~')) = PDeY'o(~')(p(io),p(io))PD~I*(~')(1, 1) -- p(nef¢(io)). But the coefficients of pD~l,(v') are smaller than those of P~¢, because PC~(x,y) = P:,(P~'(x,y),-~'(x,y)) and PDeI'~G°')(x,y) = P~"l*(~')(P~'(x,y),-P~'(x,y)), and the coefficients of p~l,~(~') are obviously smaller than those of P:,. Hence B(~, Def¢(io')) < B(IO, ¢). 3. io' C io: B(IO, Rename io' in ¢) = B(~, ¢[io']) = Pg(P(io[io'l),P(io[io'])) - Pg(1, 1) p(Def¢(~)), and p(io[~']) < p(p), ~(~[~']) < p(~), hence B(IO, ¢[~']) < B(IO, ¢). Q.E.D.

2.3

restricted

optimality

From a computational point of view, we are going to compute renamings one subformula after another, hence we are also interested in sequences of different subformulas of ¢. Considering a renaming R such that B(R, ¢) > O, if there is a sequence (iol..t0n) such that R = {iol..ion} and 3iB(ioi, Rename iot..ioi-1 in ¢) < 0, then we have from tim that B(ioi, Rename R - {ioi} in ¢) < 0. Hence R - {ioi} is more interesting than R, and we can restrict ourselves to positive renamings, i.e. those corresponding to sequences (~..ion) such that ViB(~i, Rename 91..~i-1 in ¢) >_ O. We note P the set of positive renarnings. It is quite easy to compute a maximal element of P (in the order C):

/~.j(¢) = if 3~ U ¢, B(IO,¢) >__0 then {io}U Rinj(Rename ioin ¢) else

563

It is easy to show that any ~ appearing in Rin/(¢) corresponds to a subformula of ¢, and that the procedure terminates. However, although we are sure that all optimal renamings (those that minimize the function AR.p(Rename R i n ¢ ) ) are maximal elements of P, the converse is false (see the example in subsection 3.1). We can obtain any element of max P using the procedure Rinf, depending on the strategy for choosing the subformulas tP to be tested (by B(~, ¢) > 0). The problem is then to find a good strategy to reach the best possible element of max P. Another possibility is to try all the elements of max P, but this would certainly lead to an exponential and practically inefficient procedure. We will restrict ourselves to the procedure Rinl. Before considering any particular strategy, we can first state some general properties about the elements of max P. We actually have a property of restricted optimality: E maxP, p(Rename R i n ¢ ) _< min(p(¢),p(Rename R* in¢)), where R* is the renaming obtained by the structure preserving lransformation, i.e. R* is the multiset S F ( ¢ ) excepting negations and atomic subformulas.

T h e o r e m 3 V¢,VR

P r o o f : p(Rename R in ¢) < p(¢) is trivial, and p(Rename n in ¢) g p(Rename R* in ¢) comes from tim, using the fact that 3R' D R,p(Rename R' in ¢) = p(Rename R* in ¢). We construct /~ by adding subformulas to R, excepting of course negations and atomic formulas. As the test B(~, ¢) > 0 is not satisfied on atomic formulas, R does not contain any. However, R may contain negations --~, but it is then easy to see that the test is not satisfied on ~, hence ~ ¢ R, and in that case we also except ~ from//I. More precisely, we have V~ E ¢, ~ E R* - R' ¢~ --qa E R ~ - R*. Therefore, we have R I D R, differing from R* only for those negations and their arguments. But it is then easy to see that renaming either a negation or its argument leads to the same number of clauses, hence the result p( Rename R ~in ¢) = p( Rename R* in ¢). Q.E.D.

2.4

complexity

As an important consequence, the number of clauses obtained from any element of max P is bounded by a linear function of ISF(¢)I. From this we can show (see [1]) that the length of these clause forms is bounded by 0(1¢12 ) in the propositional case, and O(V(C)tSF(¢)llCl) in the first order case, where V(¢) is the number of variables (this factor comes from skolemization). In comparison, the length of the structure preserving clause form is bounded by O(V(¢)1¢1) (and linear in the propositional case). The difference is easily explained with the following example: Consider the formula F,, = ( P 1 ^ . . . A P n ) V Q I V . . . v Q , , we have p(F,,) = n, and no subformula satisfies the test: n is the optimal number of clauses. But its clause form is:

cnf(F,~) = (PIvQ1 v . . . v Q n ) A ( P 2 v Q I v . . . V Q n ) A . . . A ( P , VQIV...VQn) which length is in O(n2). This proves that, independently of the strategy, the worstcase complexity in size is exactly o(1¢1b in the propositional calculus.

564

However, there are very few examples where the length of a clause form corresponding to max P is greater than the length of the structure preserving clause form, and of course there is none where the number of clauses is greater.

3 3.1

Linear optimality top-down

renamings

We can now take care of the strategy. In [1], we adopted a bottom-up strategy, which seemed more natural to us. But it has appeared that a top-down strategy is very likely to bring fewer clauses, even if this is not always the case (see the example at the end of this subsection). The purpose of this section is to investigate the properties of top-down strategies. The meaning of top-down strategies for the test B(~, ¢) >__0 should be clear, but in the following, we will rather work on top-down renamings, the definition of which will seem more restrictive (but is not!), and we will show the correspondence between the two. First, we say that a renaming R o f ~ E ¢ isfreein ¢ iffV~oI E R, B(~I[R], Rename R {~'} in ¢) > 0. This means that the formulas in R can be obtained from the procedure Rin! in any order. Now, we say that a renaming of ~o is top-down in ¢ iff R is free in ¢ and V~' E ~, if 3~" E R, ~' E ~", then B(~d, SupR(~')[R - SF(~')]) < 0 else B(~d, ¢[R - SF(~o')]) < 0. The last condition indicates the top-down saturation: no subformula is renamed (i.e. is in R) if it has a supformula of positive benefit which is not renamed. We see that this is written in a simplified way, supposing that all subformulas in R - SF(to I) have already been replaced by their skolem literals. This is not always the case considering the order in which R~n! performs these replacements, and this is the reason why it is much simpler to consider sets instead of sequences of subformulas, hence the necessity to add the condition that R is free, and the order irrelevant. It is rather easy to show that any top-down renaming is in max P: every renaming free in ¢ is in P, and the condition of top-down saturation implies that no subformula in SF(¢) - R has positive benefit in Rename R in ¢. However, in the fully general case, top-down strategies are not necessarily optimal, as shown by the following E x a m p l e : let ¢ = ~¢~(AAB), with to = ~dV(A'AB'). We have S(ta,¢) = ~(ta') - 2 and B(~d, Def¢(~)) = p ( ¢ ) - 3, hence if we chose ~d such that p(~d),~(~') are great enough, we have a top-down renaming of ¢ containing ~ and ~oI. However, we have B(~[~'], ¢[ta']) = - 1, hence B(~d, ¢) > B({~, ¢ } , ¢), and this top-down renaming, containing ~, is not free in ¢, hence not optimal (it is easy to show, using tim, that any optimal renaming is free in ¢). Here, a bottom-up strategy is better, but other examples show that the contrary is also (and often) true, hence none of bottom-up or top-down strategies are optimal.

565

3.2

invariance

The problem is then to find under which conditions top-down strategies are better than bottom-up ones. In the following, we will restrict ourselves to linear formulas (without equivalence), and show a much stronger result: that any top-down renaming is optimal. For the sake of simplicity, we will work on negation normal forms (nnf), which is not a problem since transformation into nnf (from a linear formula) is linear in size, as well as in time. We then have polynomials pC with only one argument. We will first show that all top-clown renamings bring the same number of clauses, the consequence of which, from a computational point of view, is that we do not have to program a particular strategy: any top-down strategy suits, and in particular the simple depth-first left-right one, resulting in ease and efficiency. Surprisingly so, the proof of this fact is more difficult and technical than (the rest of) the proof of optimality, hence we will skip some details. We first have to establish, as a lemma, a structural property of top-down renamings. L a m i n a 4 let ~ r-" ¢, n a renaming of ~ top-down in ¢, ~' t-- ~, R ~ = R N S F ( ~ ' ) - { ~ ' } , and if 3~" e R, ~' f- ~" then ¢' = S u p R ( ~ ' ) [ R - R'] else ¢' = ¢ [ R - R~], then R' is a renaming of ~' top-down in ¢~ P r o o f : it is not difficult to show that R ~ is free in ¢~: Y~ '' E R', we have B ( ¢ ' , Rename R' - {~"} in ¢') = B(~", Rename R - {q0"} in ¢) (because ~¢' ¢ R - R'), which is positive as R is free in ¢. The condition of saturation in ¢t is also verified V~" ff ~', trivially if SupR(~") = SupR,(~"), and in the case where Supn,(~ N) is undefined, it comes from the fact that (R - It') t.J (R' - S F ( ~ " ) ) = R - S F ( ~ " ) (because (R - R') N SF(qo") = 0). Q.E.D. This lemma will of course help to establish inductive proofs on top-down renarnings, but we also need a more specific lemma concerning disjunction: L e m m a 5 Let ~ C ¢ with ~ = ~l V.. . v ~ , and P¢~ = )~x.x + c, R a renaming of ~ topdown in ¢, a n d s = {i e {1..n} : P(~i) > 1}, then 3k e S,~k f[ RAVi e S - { k } , ~ o l e R Proof.- it is very easy to see that if there are at least two ~i's with p(~Pi) > 1, their benefit in ¢ is positive, and negative otherwise. We conclude that they all are in R (from the saturation condition) except one (from R free). Q.E.D. We can now show our theorem of invariance: T h e o r e m 6 V~ ff ¢, let R, R' be two renamings of ~ top-down in ¢, then: p(Rename n in ¢) = p(Rename R' in ¢) P r o o f : by induction on ~, that the equality holds for any ¢, R, R'. If ~ is a literal, we have R = R ' = 0, and the equality is trivial. Otherwise, we first suppose that B(~, ¢) < 0, hence that ~ g R, ~ ~ R ~, and consider three cases:

566

1. ~ is a quantified formula Qxl..zn~', then from lemma 4, R and R' are renamings of ~ top-down in ¢, and the induction hypothesis directly gives p(Rename R in ¢) =

p( Rename R' in ¢ ). 2. ~ is a conjunction ~lA--.A~n, let Rk = R n S F ( ~ k ) and R~ = R ' n S F ( ~ k ) . From lemma 4 we infer that Rk (resp. R~) is a renaming of ~k top-down in ¢[R - Rk] (resp. ¢[R - R~]), but the replacement of subformulas not in SF(~k) is actually irrelevant: because of the conjunction, they do not interfere with the benefits inside ~k. If we take for example R~ = t,J~=~ R~ I J Uin=k+l Ri, then Rk and R~ are topdown in CIR,'I, and by induction hypothesis we have p(Rename Rk in CIR,]) = p(Rename R~ in ¢[R~]), which can be translated into k-1

n

k

n

P ¢ ( ~ p(~i[R~]) + ~-~p(~i[Ri])) + rk = PC(~-~p(~i[R~]) + ~ i=k

i=1

i=1

p(~i[Ri])) + r~

i=k+l

with rk = E~,eR~ p(~"[Rk]) and r~ = E ~ , e , ~ p(~'[R~]). Now, it is easy to show that

p( Rename R in ¢) n

= =

PC(~p(~,[Ri])) + ~ r l i=1

i=1

k

n

PC(~p(~i[R~]) + ~ i=1 rl

=

k

i=k+l rl

PC(~p(~i[R~])) + ~ i=l

n

p(~i[R,])) + ~ r ~ + ~ i=1

r, (by induction on k)

i=k+l

r~ (with k = n)

i=1

= p(Rename l ~ i n ¢ ) 3. ~ is a disjunction ~xV...V~n. Ifp(~) = 1, then R = R ~ = ¢ and it is finished, else we have pC = Az.z + c (because B(~, ¢) < 0), and we are in the conditions of lemma 5. Let S = { i E {1..n} : p(~i) > 1},and k , k ' E S s u c h that ~k ¢ R,~k, C R ' , and let Ri = / ~ f'l SF(Wi) - {WI}, R~ = R' N SF(~i) - {~i}. For i ¢ k, k', R/ and R~ are renamings of ~i top-down in ~i (lemma 4), hence p(Rename Ri in ~i) = p(Rename R$ in ~i) (induction hypothesis). From this we obtain

p( Rename R in ¢ ) - p( Rename R' in f ) =

p( Ren me

-

p( Ren me R'k in

)

-(p(Rename R~, in ¢ ' [ ~ ] ) - p(Rename Rk, in ~k,)) where ¢t = ¢[{~i : i ~ S - {k, k'}}]. However, it is very much the same to rename subformulas of ~ inside ¢~[~,] or inside ~ , because the benefits are the same ( ~ is the only non atomic disjunct in ¢ ' [ ~ , ] ) . We deduce that Rk (resp. R~) is top-down in ~ (resp. ~ , ) , and that

p( Rename R in ¢) - p( Rename R ~in ¢) = p( Rename R~ in ~ ) - p( Rename R~ in ~ ) -(p( Rename R~, in ~ , ) - p( Rename R~, in ~ , ) ) = 0 (from the induction hypothesis for ~k and qa~,)

567

We now suppose that B ( ~ , ¢ ) >_ 0, hence ~ 6 R O R ' , and R - { ~ } , R ' - { ~ } are renamings of ~ top-down in ~ (lemma 4). As B(~, ~) < 0, we proved in the previous ease that p(Rename R - {~} in ~) = p( Rename Rf - {~} in ~), in all possible cases for ~. But p(Rename R i n ¢) = p(¢[~]) + p(Rename R - {~) in ~), and the same holds for R', hence we also have p(Rename R in ¢) = p(Rename 1~ in ¢). Q.E.D.

3.3

optimality

It is clear from this theorem of invariance that in order to show that a particular top-down renaming Rinl(¢) is optimal, it is sufficient to show that there exists an optimal topdown renaming. To prove this, we are going to use a well-founded order on renamings, decreasing from any optimal renaming to a top-down one. Let us call the depth of E ¢ in ¢, and note d¢(!p), the cardinal of {~' E ¢ : ~ r- ~'}. We extend this definition to renamings R by: de(R) = ~ e R d¢(~), which gives a preorder defined by R -< R t c ~ d ¢ ( R ) <_ d¢(R'). As <_ on /N is well-founded, there is no infinite sequence of renamings (Ri)iez~ such that Vi E ZW,Ri+l -~ RiARi ~ Ri+l. We already know that any optimal renaming of ¢ is free in ¢, hence an optimal renaming R which is not top-down in ¢ does not satisfy the saturation condition, and this fact will enable us to construct R' -~ R (such that R ~ R'). However, in order to do this we need a weaker notion of saturation: we say that R is complete iff V~ S F ( ¢ ) - R, B ( ~ , R e n a m e R i n ¢ ) < 0. It is easy to complete an optimal renaming: we just add the subformulas of benefit 0. W e can now prove the following T h e o r e m 7 Let R be an optimal, complete renaming of ¢ non top-down in ¢, there exists an optimal and complete renaming R ~ of ¢ such that R t -~ R and R ~ R t Proof." the saturation condition does not hold, hence 3~ I- ¢, S ( ~ , ¢ ' [ R - SF(~)]) >_ 0 with ¢' = Supn(~) if defined, and ¢' = ¢ otherwise. Hence ~ ~ R. We also have I n f n ( ~ ) # O, otherwise R = R - SF(~), and B(~,¢'[R]) >_ O, in contradiction with R complete. Let ~' E I n f n ( ~ ) , and R' = R - {~,'} U {~}. Obviously, q¢' r- ~, ~' # ~,, thus R' -~ R, R ~ R', Let a,b such that pC'JR] = Az.ax+b, we have B ( ~ , ¢ ' [ R - S F ( ~ ) ] ) > O, hence a > 1. But P : I ~ ] = pC'[n], and B(~[R], ¢'[R]) < 0 (from R complete), hence p(~[R]) = 1, and p~[R] = Ax.z (as td E R, we should rather write p~[R] ~ But SkL~,~]"

p(Re.ame R in ¢) - p( =

p(¢'[R])

- p(¢'[R'])

.a +

e

in ¢) -

---- .iO¢'[R]l'D~alR](l"l'~~a ,.~ ~, , . , , - PC'JR](1) + p(~'[R]) - P2,[RI(p(~'[R])) because InfR(~') = I n f w ( ~ ' ) . These two facts show that p ( R e n a m e R i n ¢ ) p(Rename R ~in ¢), thus R ~ is optimal.

=

There remains to establish that R' is complete (we can not complete /~ as above, because we would obtain a complete renaming greater than R ~ in -~). Showing that

568

V~o" E S F ( ¢ ) - n', B(~", Rename n' in ¢) < 0 involves many different cases for ~d' (~" E ~ , ~" ff ~o, ~" E ¢~...), but we can see intuitively that ~0 and ~,~ play the same role as to the benefits, because p~0[nl _=. )~x.x, and exchanging them can not change these benefits, which were negatives. Q.E.D. From the existence of an optimal and complete renaming we then deduce the existence of an optimal and top-down renaming, hence that all top-down renamin#s are optimal.

3.4

a top-down

strategy

We now have to show that with a particular top-down strategy, the procedure Rin] computes a top-down renaming. Choosing the depth-first left-right strategy makes R/hi(C) = R(¢, ¢) with: R(~,¢)=

if B(~, ¢) > 0 t h e n r e t u r n ( { ~ } U R(~, ~)) else let ~1..~,~ be the direct subformulas of 9, and R = ~bin for i = 1 to n do R := RU R(~i,¢[R]); return(R)

The saturation condition is rather obvious, but we have to prove that R(¢, ¢) is free in ¢. In other words, we have to show that whatever the order of renamings, the benefits are positive. We first prove a lemma of independence concerning disjoint subformulas (within top-down saturation!): L e m m a 8 V~, ~,' t- ¢, if ~ and ~' are disjoint and V~", (q~ E ~o"A~ • ~") ~ B(~o", ¢) < O, then B ( ~ , ¢ ) > 0AB(~',¢[~]) > 0=~B(~v, ¢[~o']) > 0 P r o o f : we write 9 U ~o' for the smaller supformula of 9 and 9' (lub of 9, ~o' in the order

E). If 9 U 9' is a conjunction, we have B(~o, ¢[~o']) = B(9, ¢) > O, otherwise ~o U ~o~ is a disjunction ¢ , l V . . . V ~ , , with ~ E ~ j , ~ ' F" ~i' (J # J')- We have B(9 U 9 ' , ¢ ) < 0 (hypothesis) and p(~ U ~') > I, hence PCu~, = Ax.x + c. Let a, b, a', b' such that p f i = $ z . a z + b and P:," = .~x.a'x+ b', let d = YIi#j,j, p(¢,i), we have pC[~'l = .~z.d(a' + b')(az + b) + c. We now suppose that B(~, ¢[~']) < O, hence d(a'+b')a = 1, i.e. d = a = a ' = l a n d b ' = O. Thus P:,[~] = ) t z . ( b + l ) z + c , but B(~o, ¢[@) > O, hence b > O, and ~ # ~oj (otherwise p~s = Az.x). We conclude that B(~oj, ¢ ) < O. However, P~j = A~:.p(~')z+c and p(~,j) = p(~)+b > 1, thus B(~j, ¢) > O, which is in contradiction with the hypothesis, hence we conclude that B(~, ¢[~']) > O. Q.E.D. The next lemma establishes an analogous result of independence for the complementary case, i.e. for non disjoint subformulas. L e m m a 9 V~o' E 9 r-- ¢ , B ( 9 , ¢ ) > OAB(9',Def¢(9)) > 0:=~B(919'], ¢[~o']) > 0

569

P r o o f : Let a, b, a', b' such that pC = )~z.ax + b and pC = )~a:.a'z + b~, we have a > 1 and a' > 1. Thus p(~o[~']) = a' + b' > 1, and P¢[*'] ~[*'l = pC, hence B(~o[~o'],¢[~']) >_ 0. Q.E.D. From these two lemmas we can prove our final theorem: T h e o r e m 10 r e , R(¢, ¢) is top-down in ¢ P r o o f : We consider the order in which the subformulas in R(¢, ¢) are computed. Let (~Ol..~,) = R(¢, ¢). It is easy to show that the saturation condition holds: V~o E ¢, let i such that (qoi [Z ~ or ~i = ~) and ~i+1 I- ~ and ~/+1 ¢ ~ (with i = 0 if ~1 [-- ~0 and ~1 ¢ ~o), we have B(~o, ¢'[~1..~i]) < 0, with ¢' = SupR(¢,¢)(~) if defined, and ¢' = ¢ otherwise. Hence B(~, ¢'[R(¢, ¢) - SF(~)]) < 0 from tim. We now have to establish that R ( ¢ , ¢ ) is free in ¢.

Let i e {1..n}, we have

B(~i, Rename {~ol..~i_1} in ¢) > 0 by definition of R(¢, ¢). Let p such that ~i+l--~p l-~i and ~op+l..~on ~ ~oi, we have B(~oj, Def¢(~i)[~i+l..~j-1]) > 0 for j = i + 1..p, hence from lemma 9 we obtain B(~i, Rename {~l..~Oi-l~i+l..qop} in¢) > O. We also have B(~j, Rename {~l..~oj-1} in ¢) > 0 for j = p + 1..n, hence from lemma 8 we finally obtain B(~i, Rename {~x..~i-1, ~i+1--~'n} in ¢) > 0. Q.E.D. It should be clear that this theorem actually holds for R / , f ( ¢ ) with any top-down strategy (the proof is simpler with R(¢, ¢)), hence the notion of top-down renaming corresponds exactly to the renamings obtained from the procedure Riny with a topdown strategy. The correspondence only holds for linear formulas; the counterexample of optimality in the general case, presented above, exhibits a non free (hence non topdown) renaming computed by means of a top-down strategy. For a renaming, being free seems to be the key property to optimality - - is there any non optimal renaming of ¢ free in ¢ ? In the general case, although R(¢, ¢) is not optimal on non linear formulas, we shall not linearize ¢ before renaming, for linearization is exponential in size. However, it might be interesting to linearize some equivalences (in a way which avoids the exponential worst case complexity) before renaming. For example let ¢ = P ¢~ (Ain___xAivAinl Bi), we have R(¢, ¢) = {Ai=l " Ai} (if n >_ 3), and the resulting number of clauses is 2n + 3. If the formula is linearized first, only the positive occurrence of Ain=l Ai is renamed, and the number of clauses is 2n + 2. A systematic study of the best way to rename and linearize would however certainly be much more difficult than just studying the best way to rename on non linear f o r m u l a s - - the number of possibilities is not just exponential. It is already improbable to be able to compute the best renaming in polynomial time.

4

Some

experimental

results

The top-down renaming is not difficult to program. The algorithm works in two passes on the formula considered as a tree. The first pass computes the values p(~),~(~) for each subformula ~o C ¢, and stores them. The second pass uses these values to compute the

570

coefficients of P~, hence the values B(~, ¢), and performs the renamings (while updating the values p(~),p(~)). The complexity is bounded by O(1¢1 logmax(p(¢), V(¢))) = O(t¢IISF(¢)I). Xt is also possible to design a linear algorithm restricted to the linear case, using lemma 5 (still in two passes, to decide which subformulas ~o are such that p(~o) = 1, but without arithmetic computations). From a practical point of view, the program is based on arithmetic computations and pointer manipulations, and is very efficient. It is implemented in Common-Lisp on a SUN3 workstation, and is part of our interactive formula transformer (see [2]). The first example from [6] is the following: ¢

=

# u,',Vz(z = ^

[3zw3wvy((r(

4 . 3wVy3zW((F(x,y)4*

= y)) ,

4.

= w) 4 , • = z) = z)4*y =

and is designed to test clause form translators (the difficulty of this problem is assigned 7 points in a scale of 10). It is estimated that a correct number of clauses is about 146. However, using only the polarity-dependent linearization from [5] (presented in subsection 2.1), we have 34 clauses and a length of 1105. On this example, the structure preserving translation increases the number of clauses to 41, but the length becomes 466. Our top-down renaming is very restricted: it contains only one subformula, namely the first operand of the topmost 4* sign. The number of clauses is then 18, with length 327, which is to be compared with the expected 146 clauses. The second example is the famous challenge due to P. Andrews, and which is worked out in [5]. The formula is: ¢

=

--[3zVy(P(z) 4*P(y))4*(3zQ(z)4*VyP(y))

4* 9xVy(q(x) 4. Q(y) ) 4* (9xP(x) 4* VyQ(y) )] which yields thousands of clauses with the polarity-independent linearization (2704 clauses, length 79045). The polarity-dependent linearization also results in a quite big clause form: 128 clauses and length 3716. The structure preserving translation reduces the number of clauses to 43 and the length to 337. This was approximately the transformation used in [5], together with simplifications performed by the TAMPR system, but not described in the paper, which reduced the number of clauses to 26 (length not specified). The top-down renaming contains only three subformulas:

the subformulas

qzzVy(P(z) 4. P(y)) and qxVy(Q(:c) 4* Q(y)), and the first operand of the top-most 4. sign. The resulting number of clauses is 24, with length 274. As for the rest of the examples, this result is obtained without any simplification, hence very efficiently. We can notice that although optimality is not guaranteed on these two examples, our results are better than those obtained with other methods, hence probably very close to the optimal number of clauses. We also tried to find a proof of this last theorem with our resolution theorem prover (see [2]) using the three available translations. No proof was found after 1000 seconds with the standard clause form. The structure preserving clause form was refuted in 587 seconds, and the one obtained with the top-down renaming was refuted in 28.5 seconds.

571

5

C o n c l u s i o n and f u t u r e w o r k

The choice we have made to focus on a tractable syntactic criterion, the number of clauses, has resulted in a very efficient translation into a concise clause form, with strong properties. Our more interesting results are certainly those concerning optimality: the restricted optimality, relative to the standard and the structure preserving translations, and the optimality of top-down renamings on linear formulas. These two positive results come with two negative ones: the non-optimality of top-down renamings in the general case, and a worst case complexity which is the complexity of the structure preserving translation multiplied by a factor n, i.e. the number of subformulas of the initial formula. However, experiments with difficult examples show that these two negative facts have little importance in comparison with the positive ones. The next step is obviously to evaluate the gains of renamings with respect to proofs and search strategies. In particular, resolving first upon the new literals should be avoided. In [5] and [7], lock resolution is adopted, and examples show that this strategy can improve the efficiency of the search. There are many other ordering strategies that can be tried, but more interesting is to build new strategies, adapted to this technique. In particular, the links between resolution refutations on renamed formulas and non-clausal refutations, mentioned in [5] and [7], seem especially interesting to investigate ; the proof obtained with the structure preserving clause form is isomorphic to a proof obtained with a tableaux theorem prover, but the search space is greater (some inferences lead to tautologies). It is therefore interesting to restrict resolution in function of the renaming. The problem is then to see in which respect top-down renamings are adapted to resolution refutations, or which top-down renaming is the best: this has the advantage of preserving the property of optimality. There may be better ways to rename a formula, but we can be sure that a relative conciseness of the clause form is determinant. One possibility is to minimize the number of literals ; this is more complicated than just minimizing the number of clauses, but also very efficient. From a more general point of vue, it is known that one important problem in automated deduction is the handling of definitions. Quoting [8] (problem 30): What criteria should be used to cause a reasoning program to expand or contract definitions? [...] A solution to [this problem] would mark one of the more significant advances in the field of automated reasoning. and considering that renaming consists in creating definitions shows that it is important not to restrict the technique of renaming to clause form translation; it can be used with other theorem proving methods than the resolution calculus. The ability to creale relevant definitions, as well as expanding and contracting them, is one of the major difference existing between actual theorem provers and mathematicians. A c k n o w l e d g e m e n t s : I thank Ricardo Caferra, Gilles Chaminade and Nicolas Zabel for their helpful comments and careful reading of this paper.

572

References [1] Thierry Boy de la Tour. A Locally Optimal Transformation Into Clause Form using Partial Formula Renaming. RR 765-I-IMAG - 90 LIFIA, institut IMAG, BP 68, 38402 Saint Martin d'H~res cedex, January 1989. [2] Thierry Boy de la Tour, Ricardo Caferra, and Gilles Chaminade. Some tools for an inference laboratory (atinf). In E. Lusk and R. Overbeek, editors, Proccedings of the 9lh International Conference on Automated Deduction, pages 744-745, Springer Lecture Notes in Computer Science 310, 1988. [3] Thierry Boy de la Tour and Gilles Chaminade. Renommage et forme clausale. In Acres des 3e Journdes nationales PRC-GDR Intelligence artificielle, pages 183-192, 6ditions Hermes, March 1990. [4] Elmar Eder. An implementation of a theorem prover based on the connection method. In W. Bibei and B. Petkoff, editors, AIMSA '84, Artificial Intelligence--Methodology Systems Applicafion, pages 121-128, North-Holland, September 1984. [5] L. ttenshen, E. Lusk, R. Overbeek, B.T. Smith, R. Veroff, S. Winker, and L. Wos. Challenge problem 1. SIGART newsletter, (72):30-31, July 1980. [6] J.F. Pelletier. Seventy-five problems for testing automatic theorem provers. Journal of Automated Reasoning, 2:191-216, 1986. [7] David A. Plaisted and Steven Greenbaum. A structure-preserving clause form translation. Journal of Symbolic Compufation, 2:293-304, 1986. [8] Larry Wos. Automated Reasoning: 33 Basic Research Problems. Prentice-flail, 1988.

HIGHER

ORDER

E-UNIFICATION

Wayne Snyder Boston University Department of C o m p u t e r Science 111 C u m m i n g t o n St. Boston, MA 02215 [email protected] (215)-353-8925 In this extended abstract we report on an investigation of Higher-Order E-Unification, which consists of unifying typed lambda terms in the context of a first-order set of equations E. This problem subsumes both higher-order unification and general E-unification, and provides a theoretical background for reasoning systems which incorporate both algebraic and higherorder logic. The problem and its properties are discussed~ a set of transformations (inference rules) extending those of Ma~rtelli-Montanarl for standard unification is glven~ and then we prove the completeness of this non-deterministic algorithm. The completeness of restrictions of these rules for hlgher-order pre-E-unification and higher-order narrowing are corollaries of these results. Finally, we connect these results with previous work, and conclude with future directions and open problems. The major result is a set of inference rules for higher*order E-unification and a proof of its soundness and completeness (wrt complete sets of unifiers).

1 Introduction T h e m o d e r n period of a u t o m a t e d reasoning began with the rediscovery in 1963 by J. Robinson of the process of unification [39], which had been described in 1930 in Herbrand's thesis. T h e resolution m e t h o d (and Andrews's m e t h o d of matings [1]) were b o t h originally based on first-order logic without equality, and subsequent efforts to e x t e n d these deduction methods to more powerful languages, e.g., higher-order logic and first-order logic plus equational axioms, crucially depended on developing new forms of unification, e.g., higher-order unification [23, 24,42] and E-unificatlon [16,38,41] (the recent development of a fundamentally new form of E-unification, namely rigid Eunification [17,18], in extending the matings m e t h o d to first-order logic with equality is a case in point). In the same spirit, this paper initiates the study of Higher-Order E-Unlfication, which would form the basis for deduction systems which combine higher-order type systems and algebraic reasoning. It has been suggested [5] that such a combination arises naturally in the logic of functional programming languages. Term rewriting systems and the lambda calculus are both useful models of computation in such logics, the former for modeling first-order operations over abstract d a t a types, and the latter for modeling various notions of programming languages such as scope, higher-order

This research was partially supported by NSF Grant No. CCR-8910268.

574

functions, parameter passing, and (in the typed cases) various complex type systems, such as polymorphism and dependent types. In addition, first-order equations are used in algebraic specification languages and to prove inductive properties of data types. As argued in [5,6,9], investigating the combination of both formal systems is crucial to understanding the logic of programming, where higher-order functionality and firstorder data and functions interact in complex ways. Future 'meta-programming systems' [20,37] may combine the methods of term rewriting theory, algebraic specification, or proof by consistency with those of various typed lambda calculi to synthesize, transform, or proof correct computer programs. (To give just one example, it would be interesting to see if term rewriting techniques, such as algebraic simplification, thought of as 'code optimization' in [5], could be incorporated into the partial evaluator implemented in AProlog discussed in [21].) More generally, automated deduction systems may someday combine the computational advantages of term rewriting in algebraic contexts with higher-order expressivity. Current higher-order reasoning systems (see for example [2,31,33,35]) do not include explicit first-order equality; and on the other hand, implementations of rewrite rule laboratories [8,19], typically have no higher-order functionality. Clearly, a system with the advantages of both would worth exploring. Strictly speaking, higher-order systems gain no additional expressivity by adding explicit equality, since a first-order equation s - t can be represented by the axiom VP.P(s) D P(t) (see [36]). But manipulating such representations of essentially algebraic axioms may make little sense computationally when efficient implementations of the axioms as terminating and confluent rewrite rules exist [8]. Or, again, in the light of recent progress in E-unification [16,26,27,28,34,41], which has resulted in many sophisticated unification algorithms, it seems likely that a higher-order unification algorithm which calls a first-order AC-unification module, or one which also does basic narrowing, will be more efficient than a higher-order unification algorithm which simply operates with higher-order encodings of algebraic theories, where the algebraic flavor is lost. Thus it seems worthwhile to investigate the incorporation of explicit first-order equality into higher-order type systems; and the fundamental process to understand at the outset is the corresponding form of unification. Formally, a substitution 0 is a HigherOrder E- Unifier of two terms s and t iff O(s)~ * '#~E O(t) where < * , # ~ represents /~r/-convertability combined with E-equivalence. For example, if E = {f(m) - g ( m ) } , then [Am.f(m)/F] is a higher-order E-unifier of f ( f ( a ) ) and g(F(a))), since 0(F(S(=))) =

S(a)

I(S(a))

g(S(a))

a) =

Clearly, this subsumes both general E-unification and higher-order unification, and shares their general characteristics: it is undecidable and finite sets of most general unifiers may not exist in general. But in analyzing the problem further, it is not obvious how higher-order type systems and Mgebraic rewriting combine, 1 and what the general properties of ~ *#nE are; fortunately, is has been shown in [5,6] that this interaction is clean and without pathologies (see Theorem 2.7). Using these results, we can argue

1

For an interesting e x a m p l e of a potential problem, see [5].

575

that whenever 8 is a higher-order E-unifier of a and t, then there is a proof of this fact in the form 8'.- ' ,Bt', * s 0 ( t ) , and when the equational part of the problem is given by a canonical set of rewrite rules R, then we have * 8' --:-,R * R t ; * O(t). This allows us to separate out the higher-order and equational parts of the problem, so that we can apply separately the techniques higher-order unification and E-unification developed in [16,42,43] to analyse this new problem. In fact, combining these separate results is non-trivial, and several interesting problems needed to be solved. It should be noted that one might define a more general version of this problem where E is not just a first-order algebraic theory, but a set of equations between lambda terms. Unfortunately, in this setting it is not. clear that a higher-order version of Birkoff's completeness theorem for equational rewriting holds [40], and so--in spite of the fact that in this richer context many useful, non-pathological examples of equational reasoning exist--we can not adapt our standard notion of completeness from E-unification. The point of the current paper is to explore the combination of two well-understood unification problems in light of the results of [6]. The major results of this paper may now be stated. The primary contribution of this extended abstract is a definition of a new and potentially significant form of unification, a set of inference rules for the problem and a proof of its completeness; this is, as far as we know, the first rigorous analysis of this problem. In addition, we have attempted above to suggest some motivations for this work, and at the end we shall suggest some interesting open questions. Obviously much remains to be done, and in the full paper (in preparation) we look at the whole question of explicit equality in higher-order logic in more detail, as well as present a full version of the completeness proof. This work was first presented in preliminary form at the Unification Workshop in Lambrecht, Germany in the summer of 1989. The outline of this abstract is as follows. After a brief review of basic definitions and notations in the next section, in Section §3 we define the problem formally and also the notion of complete sets of higher.order E-unifiers; then we present a set of transformations for the problem which extend the Herbrand-Martelli-Montanari transformations for standard unification, and prove their soundness. The use of complete sets of transformations for analyzing unification algorithms was developed in the case of general E-unification in [16] and for higher-order unification in [42]. The major advantage of this approach (which is nothing else but giving a set of non-determlnistic inference rules for simplifying the problem into a trivial form from which a solution can immediately be extracted) in comparison with other approaches is that the purely logical properties of the problem (such as the invariance of solution sets under certain transformations) can be isolated from procedural information and data structures; also, the relationship of various unification problems with respect to the basic operations necessary for their solution is highlighted. In addition, the transformation method allows more direct and mathematically elegant proofs to be found; at the end of Section §3 we sketch our completeness proof, which for lack of space must be condensed from the version in the full

576

paper in preparation. Finally, in the finM section we conclude with some connections with our previous work and discuss some future directions and open problems.

2 Preliminaries In an attempt to be (relatively) self-contained, we now present the basic notions of term rewriting and the lambda calculus we shall need; for a more extensive treatment, see [3,8,22,24] and especially [16,42,43]. D e f i n i t i o n 2.1 Given base types To (e.g., int) the set of simple types 7" is the smallest set containing To such that (a --* fl) E 7" if a,fl E 7". (We write a l , ... ,a,~ --* fl for ax ---* ( a 2 . . . (aT, ~ f i ) . . . ) . ) Given a set E = U~Er E~ of function constants and a set V = U~ET V~ of variables (where each V~ is countably infinite), the set of atoms is , 4 = E U V , and the set o f l a m b d a terms is Z: = UBET/Z~,where {Z;~lfl E T} is the 7"-sorted collection of the smallest sets such that, for each fl, 3' E T : (i) r. e u v e c G ; (ii) el E 12~-..-~ and e2 E/2~ implies (ele=) E £-~ ; and (iii) e E £'r and a~ E V~ implies (),a~.e) E £3--*~" The type of a term e is r(e) = fl iff e E/2~. (We shall, in the interest of clarity, omit type information whenever possible, since it is inferrable from context in the cases we consider.) We follow the normal conventions ofleft-associativity of application, dropping of parentheses, etc. and assume the familar definition of free and bound vaadables; the set of free variables of a term e is denoted by FV(e) and the set of bound variables by

BY(e). The subset of algebraic terms af-. is the smallest set containing U~eTo(E~ U V~) and such that if f E E~, ..... ~ __.~, where {ill, ... ,fl,~,fl} C To, and el E a / i N £ ~ , , for 1 < i < n , then (fel...e,~) E a £ . D e f i n i t i o n 2.2 A substitution is any type-preserving (total) function ~r : V --* £ such that ~(=) # = for only finitely many • e Y (called the support, D(~)) and is

denoted by

[h/*l,

...

when the support is

.

.

.

The

restrictio

of a

substitution ~r to some W', denoted ~rlw,, is the substitution ~r' such that a ' ( z ) = cr(z) when a~ E W' and a'(x) = ~ otherwise. We denote the application of a substitution to a term e, i.e., the effect of replacing each occurrence of z E FY(e) by ~r(x), as ~(e) or

eo".

We now present the basic notions of algebraic rewriting and of lambda conversion. D e f i n i t i o n 2.3 We have the following lambda conversion rules: (a-reduction) e ~ e' iff e' is obtained from e by replacing a subterm of the form ,ks. s by ,~y. (a[y/~]), where y fd BY(s) U FY(s); (fl-reduction) e ~ e' if[ e' is obtained from e by replacing a subterm (,~a~.s)t by s[t/a~]; (y-reduction) e ,~ e' iff e' is obtained from e by replacing a subterm (,kx. s)z by s, where • ¢f F Y ( s ) . (As is common, we factor out a-conversion and assume the correctness of fl-reduction by the usual conventions, see [22,42].) Let a rewriting system be a binary relation R C a / : x a / : such that r(1) = r ( r ) for every (l,r) E R . Given any s,t E £., s rewrites to t, denoted by s ~R t , iff

577

t is produced from s by replacing some subterrn s' = le" with re', where e" is some substitution and ( l , r ) E R. We denote ~t3 O ~/~ by ~#R and similarly for other combinations; we denote the reflexive and transitive closure, the symmetric closure, and the reflexive, symmetric, and transitive closure of -'~x for any X E {fl,~hR,13E,...} by * ~×, *"'-*x, ~----'*x, * respectively. W h e n we focus on the non-symmetric relations ---~R and * ~R we call a pair ( l , r ) a rewrite rule and denote it I ~ r . On the other hand, when we emphasize ~R and ~* ~R , i.e., the unoriented use of pairs, w e d e n o t e (s,t) by a - t andcall it an equation; we shall use E (rather than R) to denote a set of equations. D e f i n i t i o n 2.4 If there exists no term t t such that t ~R ~', then t is in R-normal form, and fl-, 7/-, and fly-normal forms are defined similarly. If there exists no term t t such that t ~ v t', then t is in long r1 form, and a term in fl-normal and long r / f o r m is in long fl-normal form. If there exist no infinite sequences to ~ t2 * ... then ~ is noetherian and if there exists some e such that a-----*e~ t whenever s~ * ,t, then ~ is Church-Rosser. A rewrite system R is said to have these properties whenever ~R does. It is well-known [22] that 13- and r/-conversion are noetherian and Church-Rosser, and so unique normal forms exist (and analogously when R has these properties); these normal forms are denoted by, e.g., fl-nf(s), flR-nf(s), and l/3-nf(s) (the last for the long fl-nf). As discussed in [42], it is useful to develop unification in the presence of both fland y-conversion, and so we factor out y-conversion by keeping terms in long rI form, and only explicitly use fl-conversion (this is very natural computationally). A term in long fl-nf may be represented as Axl ... ~ n ( a e l . . . era), where the head a is an atom (and each ei is in long/3-nf). By analogy with first-order notation, such a term will be denoted A~:I . . . ~,~. a(el, . . . , e,,~), and furthermore we represent lists by vectors to obtain the notation A~-~=.a(~'m). A t e r m whose head is a function constant or a bound variable is called a rigid term; if the head is a free variable it is a flezible term. D e f i n i t i o n 2.5 The composition of e" and 0 is the substitution denoted by e'o0 such that for every variable x we have e" o 0(~) = 0(a(x)). (Note that we denote composition from left to right.) Given a set W of variables, we say that two substitutions e" and 0 are x-equal over W , for some X e {~,rh E,13E, . . .} , denoted e" = x O[W] , iff Vz E W , e'(z) ~L-~ x 0(z) (when X is absent, this is just equality). We say that e" is x-more general than 0 over W , denoted by e" < x 0[W], iff there exists a substitution 7/ such that 0 = x e" o r/[W]. W h e n W = V we drop [W]. D e f i n i t i o n 2.6 A substitution 0 is said to be normalized if 0(z) is in long/3-nf for every variable ~ E D(O), and is idempotent if 0 o 0 =Or 0. A substitution e" is idempotent whenever I ( a ) f3 D(e') = 0, and any substitution is equivalent (over an arbitrarily chosen set of variables) up to renaming to an idempotent substitution. In addition, any substitution is fly-equal to a normalized substitution; thus in this p a p e r for simplicity we assume substitutions are normalized whenever possible. Finally, we summarize the i m p o r t a n t new results from [5,6] on the interaction between higher-order types and first-order rewriting which are necessary for this paper.

578

T h e o r e m 2.7 Let s, t E / : , R be a set of rewrite rules, and E a set of equations. (1) If 8, * , ~ t , then flnf(s), Y ~Eflnf(t) and lflnf(s), * ~Elflnf(t); (2)

*

t iff

* ,E

(3) If s is in fl-nf and s }R t , then t is in fl-nf; (4) If R is Church-Rosser (noetherian) on a/:, then it is Church-Rosser (noetherian) on all terms in L in/3-nf; As a corollary we have that whenever it/is canonical on a t , then for any two terms 8 and t, s, * '#nn t i f f there exists a term w such that lflnf(s) *=~.nw ~---R lflnf(t). Also, it can be shown [24] that if t is in long r/form and t }# t ~, then t ~ is in long 77 form, and for any normalized 0, O(t) is in long r/form.

3 Higher-Order E-Unification Motivated by the possibility of combining algebraic rewriting and higher-order types, we may extend the standard notions of unification theory [43,44] to this new context.

Definition 3.1 A multiaet is an unordered collection with possible duplicates (note that multiset union is different from set union, since A t3 AA ~ A unless A = 0 ). A term pair is a multiaet of two lambda terms, denoted, e.g., by (s,t). For any set of equations E, a substitution 8 is a higher-order E-unifier of 8 and t (or HO E-unifier in brief) iff e(s),

*

0(t).

A term aystern is a multiset of term pairs, and a substitution is a higher-order E-unifier of a system iff it unifies each pair as above. The set of HO E-unifiers of a system S is denoted UE(S), and when S = {(s,t)}, it is denoted UE(s,t). By the results at the end of the previous section, this definition can be put in the form: whenever 8 is a hlgher-order unifier of two terms a and t in/fl-nf, then there exists a normalized 8 t =#n 8 and a "proof"

This formulation isolates the various components of the problem. Clearly, when E = 0, this is just higher-order unification; when all terms are first-order, it is E-unification; and when both, just standard unification. Since it subsumes two undecidable forms of unification, it is not surprizing that HO E-unification is undecidable in general. Also, mgu's may not exist, motivating the following definition (see also [14,16,42]).

Definition 3.2 Let E be a finite set of equations, S a term system, and W a set of 'protected' variables. A set U of normalized substitutions is a complete aet of higherorder E-unifier~ .for S away from W (a CSV~(S)[W l for short) iff (i) (Purity) For all ~ E U, D(tr) C F V ( S ) and I(~) N (W U D(~)) = 0; (ii) (Soundness) U C_ UE(S);

579 (iii) (Completeness) For every normalized 0 6 UE(S), there exists some a • U such that ~r <~E O[FV(S)]. If S consists of a single pair (u, v) then we use the abbreviation CSUE(u, v)[W], and if W is not significant, we drop the notation [W]. The notion of a solved form system is central to the method of transformations; these represent trivial unification problems which explicitly represent their solutions. 8.S A pair (z,t) is in solved form in a system S and z in this pair is called a solved variable if z is a variable which does not occur anywhere else in S; in particular, z ¢ F V ( t ) . A system is in solved form if all its pairs are in solved form; a variable is unsolve~ if it occurs in S but is not solved. Definition

L e m m a 3.4 If S = {
~.~

( X ; ,~. H ~ ( ~ , ~ : ~~. ) , ... , ~ z ~ .H,(r~,~-p-2))

for some atom a, where (1) r ( y l ) : c q for l < i < n , (2) ~ ( a ) = 7 1 , . . . , 7 ~ -~ Z, where 7, = ~ , -.. , % , ~ 7~ for 1 < i < m , (3) , ( z } ) = ~ j for 1 < i < m and 1 _< j < _ Pi; (4) ~ ' ( H i ) = a l , . . . , a n , ~ i , . . . , ~ @ , - ' 7 ~ for 1 < i < m , where 71, . . . , 7 " are of base types. The immediate subterms of a partial binding (i.e., the arguments to the atom a) will be called general flexible terms. If a is either a function constant or a free variable, then such a binding is called an imitation binding for a; if a is a bound variable Yi for some i, 1 < i < n , then it is called an i th projection

580

Projection: {(A~/. F(W-j=), A~-'£.a(9"j~))} U S ==*p {(F, t), (A~-~.F(g-~), A~-'/.a(9-'j~))} U S, where a is some arbitrary atom (possibly bound) and t is a variant of an i th projection binding for some i, 1 _< i _< n, appropriate to the term Ah-~.F(~-j,), that is, t = Ag-g~.y~(A~.Hq(~-~,~-~p,)), such that if H e a d ( u l ) i s a function constant, then

Head(ui) --

a.

Flex-Flex: ((A~"/. F(Wj,), )t~'-~.G(~'-j~))} U S

:-~r ( i F , t), (Ag/. F(~--j=), 1~~. G(~-£~))} U S,

where t = A~'~.a(Az-~'~. H,~(~-'g,z--~-~'~)) is a variant of some partial binding appropriate to the term ,~-~. F(g'~) such that t is either a projection binding or an imitation binding where a is an arbitrary variable other than F or G. As a part of the last three transformations, we immediately apply Variable Elimination to the new pair (F, t), which amounts to just applying the substitution [t/F] to the rest of the system. The preceeding transformations are sufficient for higher-order unification. Our last transformation is a lazy paramodulation rule which accounts for the presence of equations.

Lazy Paramodulation: u s

u s,

where u//3 is not a flexible term and l ----"r is a new variant of some equation in E U E - 1; furthermore, if 1 is not a variable, then Root(u~~3) = Root(I) and transformation (2) is immediately applied to (u//3, l) (this corresponds to a leftmost rewrite at address/3). (Recall that a pair (u,v) is in fact a multiset, and so this rule also applies to the pair (v,u} in the analogous fashion.) These rules form a non-deterministic algorithm which returns an answer substitution 0 whenever there exists a series of transformations S ~ Sn, with S,~ in solved form, and 0 = ~rs,, [~'v(s) • This last rule is not simply a paramodulation step, nor simply a paramodulation step where the unification of u/fl and I is delayed; it allows further rewrite steps to occur below (but n o t at) the roots of u / ~ and l, hence the name Lazy Paramodulation. It is interesting that lazy paramodulation is necessary for the completeness of the method here and in [16], and in fact, E-unification using standard (non-lazy) paramodulation without functional reflexivity axioms and without paramodulating at variable positions is not a complete strategy for E-unification (an example, due to Dan Dougherty, where paramodulation will not find an E-unifier is S = ( f ( z , z ) , y ) and E = {f(a,b) "- c,a b} ). Thus, the laziness of the rule is essential; this is causes some technical problems with the notion of bound variables, as discussed below.

581

binding. A variant of a partial binding t is a term p(t)~, where p is a renaming of the set H1, ... , H,n of free variables at the heads of the general flexible terms in t away from all variables in the context in which t will be used. For any variable F , a partial binding t is appropriate to F if v(t) = T(F). An imitation binding is appropriate to )~-'~. F(~-~) iff it is appropriate to F . T h e basic idea of this (unfortunately complex) definition is that we wish to 'approximate' a t e r m s occurring in the range of a substitution by finding a most general term s' with the same head symbol a (so that the binding [s'/x] will be a 'first approximation' of the binding [s/el). In the first-order case, for example, s = f(g(a),b) can b e approximated by the term s n = f(yl,y2), of which s is obviously an instance; clearly there is no more general approximation with the same head. In the higher-order case, the role of yl, y~ must be played by flexible laznbda terms, since the subterms of s may be some function of the bound variables in the binder of s; these subterms may have binders also, which creates the syntactic complexity seen above. T h e form of partial bindings can be determined (up to a-conversion and renaming of the Hi) by the type of the whole term and the type of a. For notational brevity we shall extend our vector style notation to represent partial bindings in the form ~V-. a ( ~ - T j - H , ~ ( V , , =-72)).

D e f i n i t i o n 3.6 (The set of transformations 7-/ET.) Let S be a system of lambda-terms (possibly empty) and E be a set of equations. We have the following transformations.

Trivial: us

s

Decomposition:

1<_i<_~

where a is an arbitrary atom. Variable Elimination: If u( * ~nF and v = )~'~.v', for some k, some variable F, and some t e r m v', where F • F V ( v ) , then

u s

fiR,

u

where ( r - - - [ X ~ . v ' / F ] . T h e previous three transformations are essentially the original Herbrand-MartelliMontanari set for standard unification. The next transformation accounts for function variables, and is divided into three cases.

Imitation: { ()~'-~. F(~-~), A~'-~.a(~--~))} U S ===:>i {iF, t), (A~-~. F(~-~), Ab"~. a(V-~))} U S, where a is either a function constant or a free variable not equal to F and t is a variant of an imitation binding for a appropriate to F, e.g., t = A~--~.a()~z--7~~. H,,~(~--~,z-~-~)).

582

E x a m p l e 3.7 For example, as in the introduction, let E = { f ( x ) - g ( x ) } . Then the following series of transformations leads to a system in solved form. (We present the effect of a substitution 0 on a term e in the course of Variable Elimination by °--(r2 0(e)~, to represent both the effect of the substitution and the subsequent./~-nf.) (F(/(a)), g(F(a)))

==*i (F, ,~..f(H(~))), ((~'~" f(H(~)))f(~,)' Y,,: (),~, f(H(,,))),~;X f(H(f(a))) \" f(H(a)) ]I

==*'Ip(F,)~x.f(H(:~))),(f(H(f(a))),f(x')>, (g(x'),g(f(H(a)))> =:~d(F, ,~. f(H(x))), (H(f(a)),~'), (0¢',f(H(a))) ==~ve (F, ,~. f(H(~c))>, (H(f(a)),x'},(n(f(a)),f(H(a))) f

f(°>

,.,

.

:,

:::=>t(F, ,~. f(~)), (f(a),~'}, (H,)~x.~) Hence, [,~x. f(~)/F] is a unifier of

F(f(a))

and

g(F(a)))

modulo f ( ~ ) -" g ( $ ) .

We must be careful, because of the presence of the last transformation in the context of the type system of the larnbda calculus, to insure that no type errors occur; thus, if a pair (u,v) is ever generated where T(u) ¢ r ( v ) , the transformations are said to immediately fail. This will insure that the use of first-order equations in the context of higher-order types is correct as discussed in section §2. A more pernicious technical problem arises in the interaction between lazy paramodulation, which removes subterms from their context, and the notion of bound variables. Notice that when applying a rewrite rule f(m) , g(~) to the term )~z. f(h(z)) to obtain )~z.g(h(z)), the matching substitution [h(z)/zz] contains a bound variable; since the rewriting essentially takes place inside the scope of the binding of z, no harm is done. In general E-unification however [16], it turns out that the laziness of the paramodulation rule is absolutely necessary for completeness (in order to simulate the creation of critical pairs). Hence, in the midst of a transformation sequence we may have something like:

(,~z. f(h(z)), ~z. g(h(z))) ===>lp(f(h(z)), f(~)), (,~z. g(~),,~z, g(h(z))} ==>d (h(z), ~), (~z. g(~), ,Xz.g(h(z))) ===>,,e (h(z), ~), (~z. g(h(z)), ,~z. g(h(z))). Here we pulled the term h(z), out of the scope of ,~z and then, using variable elimination, inserted it back in, which is awkward; in fact, it is not obvious that such manipulations are correct: how do we know that such freed bound variables will not be confused with originally free variables, and that at the end they all have returned to the correct scope? There are various solutions, none completely satisfactory; The solution adopted in the full paper is to rectify all terms in the beginning and to 'freeze' variables when they leave their scope, so that they will not be confused with normal variables; then we define failure conditions which flag illegal uses and show that these are sufficient to guarantee correctness. For reasons of space, we shall not treat this m a t t e r further in this abstract, referring the interested reader to the full paper to appear. In general, there are many other failure conditions one can define, and also many forms of optimizations which preserve completeness. For example, one optimization

583

is that we never apply Lazy Paramodulation to a solved pair; another is that (since wlg we may restrict our search to idempotent unifiers) whenever an imitation binding t = A~'-~.g(Az-~. H,,~(~-~,z-~)) for some variable K is added to the system in either Imitation or Flex-Flex, we mark this variable somehow and never try to find a binding for this variable thereafter. Another important optimization of this set of rules for the equational first-order case has been given by Dougherty and Johann [10] (this conference). The extension of this to the present context seems natural. The following lemmas will enable us to prove the soundness of this set of transformations. L e m m a 3.8 If S ~

S' using Trivial or Variable Elimination, then

UE(S) = UE(S').

Proof. (See the proof of Lemma 4.12 in [42].) [] This lemma shows that the invariant properties of a problem are preserved under these two transformations, as they were in the first-order case. L e m m a 8.9 If S ==~ S' using either Decomposition, Imitation, Projection, Flex-Flex, or Lazy Paramodulation, then UE(S') C UE(S).

Proof. (See Section 4.2 of [42] and Theorem 6.2 in [16].) [] Since in Imitation, Projection, and Flex-Flex, we commit ourselves to a particular approximation of a solution, and in Decomposition we may eliminate unifiers (e.g. F(a) and F(b) are unifiable but not necessarily a and b), clearly the inclusion UE(S') C__UE(S) is proper in general. This is very different from standard unification, where the set of solutions is invariant under rules Trivial, Decomposition, and Variable Elimination. Finally, using these lemmas we can show that the set of transformations ~ET is sound in the sense that an answer substitution that is computed by some sequence of transformations must always be a HO E-unifier of the original system. T h e o r e m 3.10

(Soundness) If S = ~ S t, with S r in solved form, then the substitution

~s, IFv(s) • UE(S).

Proof. We simply apply induction on the length of the transformation sequence to show that UE(~s,) C UE(S). Then we simply observe that the restriction to FV(S) has no effect on the terms in S, concluding that crS,IFV(S) 6 UE(S). [] We now sketch the completeness of the set of transformations 7-/ET presented above by showing that for any H 0 E-unifier O of an input system S, the transformations can compute a unifier ~ more general than O, i.e., such that ~ -<~E O. To do this, as mentioned above, we shall have to combine the completeness results for higher-order unification from [42] with the completeness proof for general E-unification [16] via the results in [5] and [6] which show that there is no pathological interaction between first-order rewriting and $-reduction; this will allow us to separate the firstorder and the higher-order features of the problem and combine our previous results. The combination of these results is non-trivial, however, since along the way we shah

584

have to add a number of features not found in either preceeding result, for example, the extension of reduction orderings on first-order terms to closed lambda terms. The major theorem of this section is as follows. 3.11 (Completeness of 7-/ET) For any system S and set of equations E, if 0 C UE(S) then there exists some sequence of transformations from the set 7"lET

Theorem

where S,~ is in solved form and ~s~ <-~ O[FV(S)]. Proof Sketch.

The proof proceeds in six stages. (1) We show there is no loss of generality by considering completeness over dosed unifiers only; (2) We prove there exist well-founded orderings total on the set of closed lambda terms in fl-nf; (3) Using the previous fact, we demonstrate how to construct the 'abstract completion' of a set of equations (by closing it under critical pair formation), which is canonical on closed lambda terms; (4) We use results from [5] and [6] to show how to separate the higher-order and algebraic parts of the problem, which allows us to put 'proofs' of unifiability in a particular form; also we formalize the notion of a unification proof; (5) Then, under the assumption that E is in fact closed-term canonical, we give a set of proof transformation rules corresponding to n E T which show how to extract the requisite sequence of transformations from the structure of a unification proof; (6) In the (general) case that E is not closed-term canonical, we demonstrate how to simulate the creation of the abstract completion E " 'on-the-fly' by using the transformations to calculate critical pairs. In the first-order case, the fact that there is no loss of generality in considering only closed substitutions, combined with steps two and three, are the essential ingredients of unfailing completion [4]. Step six amounts to a proof of completeness of a special case of HO E-unification, namely, higher-order narrowing, and the last step shows how to apply the result in step six to the abstract completion of a set of equations E, and then to extend the sequence of transformations found to another sequence which incorporates the calculation of critical pairs, and uses, in effect, only the equations in E. In this way, we can construct the sequence of transformations necessary in the general case. Unfortunately, for lack of space we can not develop this proof in detail; the interested reader is referred to the full paper (in preparation).

585

4 Conclusion In this extended abstract we have defined a new form of unification, provided motivations for its study, and presented a set of transformations for the problem which is sound and complete. In some sense, this completes the work started in [43], by adding a "top" to the simple lattice of unification problems (standard, higher-order, and equational), and provides further evidence that the method of transformations is a mathematically elegant means of analyzing the properties of unification procedures as formM systems which produce answer substitutions. We intend to present the theory of such systems more comprehensively in the forthcoming book [44]. Many interesting directions remain to be explored. First of all, naturally it is important to investigate the usefulness of explicit equality in higher-order logic, and to substantiate the claim that higher-order E-unification is a significant means of making theorem provers more flexible and more powerful. Also, it is worthwhile investigating alternate methods of hlgher-order unification to which equational reasoning can be added, such as the combinator approach proposed by [11]. Next, it is important to isolate interesting subcases of this very general problem; the success of both higherorder unification and E-unification in automated deduction is due to the isolation of computationally feasible subcases (i.e., pre-unification, narrowing and its refinements, and special algorithms for particular theories, e.g., AC-unification). In the present case as well, it is important to determine the computation properties of, say, "higher-order pre-narrowing" (finding pre-unifiers wrt canonical rewrite systems), "higher-order AC pre-unification", etc. A particularly intriguing possibility, mentioned in the introduction, is that perhaps such algorithms can be stratified or modularized into a higher-order component, a first-order AC-unification component, etc. (this amounts to "lifting" results at the end of [5], where an algorithm is given for reducing a word problem in * ~Z,s to a finite number of word problems in ~ * ~ ). FinMly, it would be interesting to examine the theoretical properties of various algebraic theories in the higher-order setting. Much is known about the properties of the unification problem in particular theories and interesting work has been done on combinations of theories (see [41] for references); it would perhaps be fruitful to examine the combination of higher-order unification with various algebraic unification problems from a related point of view. A c k n o w l e d g e m e n t . I would like to thank Val Breazu-Tannen, Jean Gallier, and Claude Kirchner for much helpful discussion and encouragement.

5 References [1] [2] [3] [4]

Andrews, P.B., "Theorem Proving via General Matings," JACM 28:2 (1981) 193-214. Andrews, P.B., D. Miller, E. Cohen, F. Pfenning, "Automating Higher-Order Logic," Contemporary Mathematics 29 (1984) 169-192. Andrews, P.B., An Introduction to Mathematical Logic and Type Theory: To Truth Through Proof, Academic Press, Inc. (1986). Baehmair, L., Dershowitz, N., and P1Msted, D., "Completion without Failure," in Resolution of Equations in Algebraic Structures, vol.2, A'~t-Kaci, H., and Nivat, M., (eds.), Academic Press, Inc. (1989).

586

[5] [6]

Breazu-Tannen, V., "Combining Algebra and Higher-Order Types," LICS'88, Edinburgh. Breazu-Tannen, V., and Gallier, J., "Polymorphic Rewriting Conserves Algebraic Strong Normalization and Confluence," ICALP 1989 (journal version to appear in TCS).

[7] [8]

Dershowitz, N,. "Termination of Rewriting," JSC 3 (1987) 69-116. Dershowitz, N., and Jounnaud, J.-P., "Rewriting Systems," to appear in Handbook of Theoretical Computer Science (1989). [9] Dougherty, D., "Adding Algebraic Rewriting to the Untyped Lambda Calculus," to appear in Information and Computation (1990). [10] Dougherty, D., and P. Johann, "An Improved General E-Unification Method," Proceedings of CADE90, Kaiserslautern, Germany. [11] Dougherty, D., "Higher-Order Unification via Combinators," Fourth Workshop on Unification, University of Leeds, United Kingdom (1990). [12] Elliot, C., and Pfenning, F., "A Family of Program Derivations for Higher-Order Unification," Ergo Report 87-045, CMU, November 1987. [13] Elliot, C., "Higher-Order Unification with Dependent Function Types," RTA'89, Chapel Hill. [14] Fages, F., and Huet, G., "Complete Sets of Unifiers and Marchers in Equational Theories," TCS 43 (1986) 189-200. [15] Gallier, J.H., and Snyder, W., "A General Complete E-Unification Procedure," RTA'87, Bordeaux, France. [16] Gallier, J.H., and Snyder, W., "Complete Sets of Transformations for General E-Unification," TCS 67 (1989) 203-260. [17] Gallier, J., P. Narendran, D. Plaisted, and W. Snyder, "Rigid E-Unification: NP-completeness and Applications to Theorem Proving," to appear in a special issue of Information and Computation (1990). [18] Gallier, J., P. Narendran, S. Raatz, and W. Snyder, "Theorem Proving Using Equational Matings and Rigid E-Unification," to appear in JACM (1990). [19] Guttag, J.V., Kapur, D., Musser, D.R. (eds.) Proceedings of an NSF Workshop on the Rewrite Rule Laboratory, Sept. 6-9, 1983, GE Research and Development Center Report 84GEN008. [20] Hannan, J. and Miller, D., "Enriching a Meta-Language with Higher-Order Features," Workshop on Meta-Programming in Logic Programming, Bristol (1988). [21] Hannan, J. and Miller, D., "Uses of Higher-Order Unification for Implementing Program Transformers," Fifth International Conference on Logic Programming, MIT Press (198S). [22] Hindley, J., and Seldin, J., Introduction to Comhinators and Lambda Calculus, Cambridge University Press (1986). [23] Huet, G., "A Unification Algorithm for Typed )~-Calculus," TCS 1 (1975) 27-57. [24] Huet, G., Rdsolution d'Equations dans les Langages d'Ordre 1,2,... ,w, Thgse d'Etat, Universit~ de Paris VII (1976). [25] Kamin, S. and L6vy, J.-J., "Two Generalizations of the Recursive Path Ordering," Unpublished Note, Department of Computer Science, university of Illinois, Urbana, IL.

587

[26] Kirchner, C., "A New Equational Unification Method: A Generalization of MartelliMontanari's Algorithm," CADE-7, Napa Valley (1984). [27] Kirchner, C., M~thodes et Outils de Conception Systematique d'Algorithmes d'Unification darts les Theories Equatiormelles, Th~se d'Etat, Universit~ de Nancy I (1985). [28] Kirchner, C., "Computing Unification Algorithms," LICS'86, Cambridge, Mass. (1986). [29] Martelli, A., Montanari, U., "An Efficient Unification Algorithm," ACM Transactions on Programming Languages and Systems 4:2 (1982) 258-282. [30] Martelli, A., Moiso, C., Rossi, G.F., "An Algorithm for Unification in Equational Theories," Third IEEE Symposium on Logic Programming, Salt Lake City, Utah, (1986). [31] Miller, D., and Nadathur, G., "Higher-Order Logic Programming," Proceedings of the Third InternationM Conference on Logic Programming, London (1986). [32] Miller, D., and Nadathur, G., "A I~ogic Programming Approach to Manipulating Formulas and Programs," IEEE Symposium on Logic Programming, San Franciso (1987). [33] Nadathur, G., A Higher-Order Logic as the Basis t'or Logic Programming, Ph.D. Dissertation, Department of Computer and Information Science, University of Pennsylvania (1986). [34] Nutt, W., R6ty, P., and Smolka, G., "Basic Narrowing Revisited," Technical Report SR-87-07, Kaiserslautern University, W. Germany (1987). [35] Paulson, L.C., "Natural Deduction as Higher-Order Resolution," Journal of Logic Programming 3:3 (1986) 237-258. [36] Pfenning, F., Proof Transformations in Higher-Order Logic, Ph.D. thesis, Department of Mathematics, Carnegie Mellon University, Pittsburgh, Pa. (1987). [37] Pfenning, F., and Elliott, C., "Higher-Order Abstract Syntax," Proceedings of the SIGP L A N '88 Symposium on Language Design and Implementation, ACM, June 1988. [38] Plotkin, G., "Building in Equational Theories," Machine Intelligence 7 (1972) 73-90. [39] Robinson, J.A., "A Machine Oriented Logic Based on the Resolution Principle," JACM 12 (1965) 23-41. [40] Phil Scott, personal communication. [41] Siekmann, J.H., "Universal Unification," JSC 7 (1989) 207-274. [42] Snyder, W. and Gallier, J.H. "Higher Order Unification Revisited: Complete Sets of Transformations," JSC 8 (1989) 101-140. [43] Snyder, W.S., Complete Sets of Transformations for General Unification, Ph.D. Dissertation, Department of Computer and Information Science, University of Pennsylvania (1988). [44] Snyder, W.S., General Unification Theory, Birkh£user Boston Inc. (in preparation).

Programming by Example and Proving by Example Using Higher-order Unification Masami Hagiya Research Institute for Mathematical Sciences, Kyoto University Kitashirakawa Sakyo Kyoto 606, Japan hagiya~kurims, kyoto-u, ac. j p

Abstract We propose a new aDproach to programming by example, in which a program is synthesized from examples by higher-order unification in a type theory with a recursion operator. The approach, when applied to the problem of proof generalization, makes it possible to synthesize a general proof from a concrete example proof and establish a method of proving by example. Cases in which a program and a proof are simultaneously synthesized are also considered. In order to represent proofs as terms and generalize proof terms by higher-order unification, we extend Logical Framework to a system with product and equality.

1. I n t r o d u c t i o n

Programming by example based on inductive inference, which synthesizes a program from example input-output pmrs, was extensively studied by many people including Summers, Biermann, etc., since the end of 1970's until the beginning of 1980's [Summers77, KodratoffS0, Jouannaud79, Biermann78, Smith84]. Throughout 1980's, foundational studies on inductive inference [Angluin83] and researches for applying the methodology of programming by example to specific problem domains [Shapiro82, Nix84] have been continued, but we can hardly conclude that, in the current state of the art, programming by example has been established as a general programming paradigm. On the other hand, researches on programming by example having been done in the field of visual programming, which Myers called programming with example, have made significant contributions until now [Myers86]. In those researches, allowing not only input-output pairs but also a sequence of operations from an input to an output makes it realistically possible to synthesize programs from examples. In order to synthesize a program, we can also use a correctness proof explaining why the given output is a correct answer to the input, because the proof must contain enough information to obtain the output from the input. Moreover, if a program and its correctness proof are simultaneously generalized, the correctness of the generalized program is automatically guaranteed. The problem of synthesizing a program from examples is that of finding an appropriate instance of a specific recursion schema. Therefore, as described in Section 2 of this paper, the problem can be solved by higher-order unification [Huet75], which finds appropriate terms for functional variables in the schema. According to P P P (proof-as-program paradigm, Curry-Howard isomorphism [Howard80]), a program with a correctness proof corresponds to a constructive proof

589 claiming the existence of a solution, and a constructive proof can be represented as a term in a higher-order type theory. Therefore, if we apply higher-order unification to proof terms and synthesize an instance of a specific induction schema, we are expected to establish a method of proving by example. Based on the above considerations, we develop a theory of programming by example and proving by example using higher-order unification. We first propose an approach to programming by example using higher-order unification in a type theory with a recursion operator. We then apply the approach to proof terms and shove the possibility of proving by example. Cases in which a program and a proof are simultaneously synthesized are also considered. In order to represent proofs as terms and generalize proof terms by higher-order unification, we extend Logical Framework (LF) [Harper87] to a system with product and equality. We assume that the reader is familiar with higher-order unification, and PPP, particularly LF.

2. Programming by Example We first give a brief overview of the synthesis method of LISP programs, and then define a recursion operator and give the unification algorithm for the operator.

2.1. Synthesis of LISP Programs Summers and Kodratoff's method for synthesizing LISP programs from examples consists of the following two steps: 1. For each input-output pair (xi,yi), construct a function yi = gi(xi), which yields the output Yi from the input xi, and a predicate pl, which separates xi from xj (j > i), where pi(xi) is true and pi(xj) is false (j > i). 2. Obtain recurrence relations for gi and Pi, and synthesize a recursive function definition. For example, from the input-output pairs () ~ (), (A) --~ ((A)) and (A B) --+ ((A) (B)), we construct the following functions and predicates:

go(x) = nil, g~(x) = cons(cons(ca,'(x),nil),nil), 92( x ) = con~( con~( ca~( x ), nil), con~( con~( ~ar( ~d~( x ) ), ~iZ), nit)), p0(x) = a~om(x), pl(x) = a~om(~d~(x)), P2(~) = a~om(cd~(cd~(~))) We can then obtain the recurrence relations

{

gi+l(x)

=

and synthesize the recursive function definition

g(x) = if atom(x) t h e n nil else cons(con~(car(x), nil), g(cdr(x))). In the first step, it is important that the program operates on LISP S-expressions, because S-expressions themselves have structures (i.e., tree structures), which allow an output to be expressed in terms of an input. The same fact should hold for proofs; proofs

590

also have tree structures and therefore are considered to be suitable for generalization, even if they are concerned with data with no structures such as natural numbers. 2.2. R e c u r s i o n O p e r a t o r In the second step of Summers' method, the functions d and a that satisfy the recurrence relation g~+l(X) -- a(x, g i ( d ( x ) ) ) are sought. According to this recurrence relation, we can consider the recursion operator R with the following typing rule: n E N

d E A--~A

a C A--*B--*B Rnxdab C B.

x E A

(R)

b E A-~B

N is the type of naturM numbers, and A and B may be arbitrary types. (We are considering extensions to Logical Framework, and if a context is not explicitly specified in a typing rule, a unique context is assumed for the premises and the conclusion.) Although R can be defined by the usual primitive recursion operator and vice versa, we mainly use R because R directly reflects the recursion schema used in programming by example. R also satisfies the following reduction rules: ROxdab

(R=)

= bx

R(n')xdab

= ax(Rn(dx)dab),

where ~ denotes the successor function. Using the operator R, gi can be expressed as g~ = )~x.Rixdago. Although Summers and Kodratoff assume that examples are presented in the order of recursive cMls, if we declare ni, d, a and b as free variables, and solve the simultaneous equation (G) gi = ; ~ x : A . R n i x d a b

(i = O, 1, 2 , . . . ) ,

we can obtain the recurrence relation for gi (i.e., functions d and a), regardless of the order of examples. In order to solve the equation (G) using higher-order unification, we must extend Huet's algorithm to a type theory augmented with R. The extension will be explained in the next section. Since A and B in (R) may be arbitrary types, we can also synthesize a program defined by an auxiliary function with an additional parameter [Summers77]. For example, from (A) --. (A), (A B) -+ (B A) and (A B C) --, (C B A), we have gl(x)

=

iI),

g2(x)

--

. . .

Let us declare free variables as follows: d e sexp-+sexp,

a • sexp---*sexp---*(~exp--~sexp)---+(~exp--~sexp),

b • sexp-+(sexp-~sexp),

c • ~exp,

where sexp is the type of S-expressions. A x : s e x p . ( R n l x d a b ) c , we obtain d = ;~x.cdr(x), b = Ax.)~y.y,

a--

Then, by solving the equation gl =

~x.;~f.£y.f(cdr(x))(cons(car(x),y)),

c = nil.

591

(Formally, we should have written cdr x,

cons(car x)y, etc. instead of cdr(x),

cons(car(x), y), etc.) 2.3. Unification with Recursion Operator In this section, we briefly describe the extension of Huet's algorithm of pre-unification with R . In the following discussion, a term of the form R n x d a b is called a~ R-term. We first extend the notion of a long head normal form. A term M is in a long head normal form, if M is of the form )~vl...Avk.hM1 ... Mm, where hM1 ... Mm, the matrix of M , is not a function, and h, the head of M , is a constant, a variable or an R-term R n x d a b such that n is also in a long head normal form, and n is not 0 and not of the form m'. If h is a free variable, M is called flexible. If h is an R-term R n x d a b such that n is flexible, M is called R-flexible; if n is R-flexible, M is also called R-flexible. If h is a constant or a bound variable, M is called rigid; if h is an R-term R n x d a b such that n is rigid, M is also called rigid. A term in a long head normal form is either flexible, R-flexible or rigid. As is described in [Snyder89], the pre-unification algorithm solves a unification problem, i.e., a set (or multi-set) of unordered pairs of terms, by selecting a pair from the set and doing one of the transformations. Let M = N be the selected pair of terms, where M and N axe in long head normal forms. If M is R-flexible, i.e., M is of the form $vl...;~Vk.(Rnxdab)M1 .. • ]Vim, the Rprojection transformation on M = N is either the addition of the pair n = 0, or the addition of the pair n = ( f v l " " Vk) r, where f is a new free variable. Roughly speaking, R-projection successively instantiates n with 0, ( f g ) ' , 0', ( f g ) " , 0", .... The other transformations, i.e., decomposition, imitation, and projection, can be defined as in pre-unification for simple type theory. Which transformations are allowed for each kind of pair M = N in the extended pre-unification algorithm is described in Table 2.1, where I; P, R and D denote imitation, projection, R-projection and decomposition, respectively, and C means that the pair is left as a constraint between flexible terms. Note that for each pair M = N , the reversed pair N = M is also considered. In summary, R-flexible terms behave as rigid terms against flexible or rigid terms, and R-flexible terms always allow R-projection. M \ N

flexible

R-flexible

rigid

flexible R-flexible rigid

C R

IP RD

IP RD D

Table 2.1. Extended Pre-unification The Mgorithm is not a complete one. For example, for the unification problem f 0 " 0 " ' = f 0 ' " 0 " , it cannot find the solution f = )m.)~m.Rnxod()~x.)~y.y')()~x.m). But for the following very restricted class of solutions, we can prove that it is complete. A term M is called simple, if for each R-term R n x d a b in M , n contains no bound variable. A substitution t) is called simple, if 8 ( f ) is simple for each variable f . Recall that a solution or unifier of a unification problem is a substitution for free variables in the problem which makes each pair in the problem equal (convertible).

592

T h e o r e m 2.1: If a unification problem has a simple solution 8, there exists a computation path satisfying Table 2.1 that leads to a set of constraints and a substitution that is more general than or equal to 8.

3. Proving by Example In order to allow proving by example, a type theory in which proofs are represented as terms must have properties including the following ones: 1. 2. 3. 4.

It It tt It

allows higher-order unification between proof terms. has dependent types (dependent functional types and dependent product types). contains equational logic, and unification takes equality into account. has the recursion operator for proof terms.

Since constructive proofs that correspond to programs with correctness proofs usually contain the existential quantifier (3), we need dependent product types as well as dependent functional types. Dependent product types are also used for defining flmctions with multiple values. Equational logic is needed because such constructive proofs often contain computation traces of some functions. Elliott extended Huet's algorithm of higher-order unification to unification between terms in LF [Elliott88]. He also extended higher-order unification to Elf [Pfenning89], which is an extension of LF with dependent product types. Therefore, given these results, 1 and 2 above are satisfied. In the following, we make a further extension to LF that satisfies 3 and 4 above. Such extensions may contradict the philosophy of LF, but as LF is a simple and expressive system which even allows higher-order unification between proofs, we consider it as an appropriate start point for our purpose. 3.1. E q u a t i o n a l Logic There are two approaches to introduce equational logic into a type theory: external and in~ernal (this terminology is due to the author). In the external approach, inferences in equational logic are not represented as proof terms but are done as type inferences, i.e., they are external to proofs. Equational logic is introduced by the following typing rule: McM1

=M2 NEA[M1] ]V E AIM2],

where M C M1 = M2 means that M is a proof of M1 = M2, and N E A[M1] and Y C A[M2] mem~ that N is a proof of A[M1] and AIM2], respectively (A[M] denotes A[M/x] for some variable x). In this approach, as the history of the equational inference is not recorded in the proof term N, type checking (proof checking) is not decidable in general. The typical example of this approach is Martin-LSf's constructive type theory [Martin-LSf82]. In the internal approach, on the other hand, inferences in equational logic are represented as proof terms, i.e., they are internal in proofs. Equational logic is introduced by the following typing rule: (Ei)

Hx:B.A[x] E Type M E M1 = M2 M1 C B E(IIx:B.A[x])MN • A[M2].

g • AIM1]

593

An example of this approach is the implementation of Leibniz's equality in second-order type theories such as Calculus of Constructions [Coquand88]. In this approach, type checking is, of course, decidable. However, when proofs are generalized, equational inferences often behave in a different fashion from that of other inferences. Some equational inferences may move from one place to another in the whole proof, or some may even disappear. Examples of such inferences are those that replace closed terms containing function symbols with their values (refer to the example below). A type has a proof by (Ee), if it has a proof by (Ei), but the converse does not hold in general, because IIx:B.A[x] is not necessarily a type for A[x] in (E,). In this paper, we consider a system with equational inferences in both of the approaches; i.e., we introduce (Ee) and (Ei) together with the rules (=)

M1 E A M2 E A M1 = M2 E Type

M EA (I) I M E M = M.

As for (Ee), however, we make the following restriction for the purpose of this paper. In order to describe the restriction, we first extend the notion of a context of LF. A context is now a pair (A, F) of an equational context A and a context P for variables (a context of the original LF). An equational context is a sequence of equational proofs such as

A =_ M 1 E I I x l . . . I I x ~ , . M ] = M ~ , M e E H x ~ •.. II xn2.iVl 2 ~.2i = M~, . " . are normal, . . and M{, M~ or x i is not of a where each proof M i is closed, M~. and M~ functional or product type. Contexts are constructed by the following two rules: A, ¢ ~- M E rlxl...IIx,,M1 = M2

(EC) (A,M e IIxl...nx,,M1

= M2),¢

context

A, P ~- A E Type

(VC) A , ( F , x E A) context,

where ¢ denotes an empty sequence. (Ee) is then restricted to the form (A1,M E Ilxl...Ilxn.M1 = M2,A2),I" [- N E A[O(M1)] (E~) (A1,M E nx~...nxn.M1 = M 2 , A 2 ) , r ~- N E A[O(M2)], where 0 is a substitution for x l , . . . , x n . Since each equation in A are directed from left to right, if A is decidable as a term rewriting system (e.g., canonical), then type checking is also decidable. Unification should take the equational context into account, and this will be explained in Section 3.4. 3.2. R e c u r s i o n O p e r a t o r for P r o o f s The recursion operator R + for proofs is defined as follows: nEN (R+)

xEA

dEA-+A

a E Hx:A.Pl[x]---*P[dx]---~P[x] ~ E IIx:A.P2[x]-~P[x] R + n x d a ~ E P[x].

594 P1 [x] and P2 [x] denote the conditions for choosing between recursion step and recursion base. The reduction rules for R + are

R+Oxdafl = ~x(Z~) R+(n')xdat3 -= ax(ZO)(R+n(dx)dafl)

(R+--)

(Z~ C P2[x]) (Z~ E Pl[x]),

where Z is a new free variable, which is created each time a reduction occurs and can match any proof having the specified type, and ~ is the sequence of surrounding bound variables. T h e existence of Z is an unusual situation for term rewriting systems, because in a term rewriting system, each variable in the RHS of a rewrite rule should also occur in the LHS.LSince Z is considered to be a universally quantified variable in the rules, we should restrict Pl[x] and P2[x] to types for which the inhabitance (non-emptiness) is the only concern, because the above rules implicitly claim that M , N E Pi[x] implies M = N. For example, we can restrict Pi[x] to types representing an atomic proposition. 3.3. E x a m p l e As an example, consider the quotient-remainder problem with 5 as the divisor. Let us declare free variables Pl, P2 E N---~N--+o, where o is the type of propositions, and define

P[x] p

[x]

Eq:N.Er:N.(r<5--true)

_= p l X = tr

e,

P2[x]

-

x(x=5xq+r)

p 2 x = tr

e.

(< E N--~N--+o and true E o.) We further make the following declarations of free variables: nEN, x0 E N , d E N - - + N ,

a E IIx:A.Pl[x]--+P[dx]-+P[x], ~ C IIx:A.P2[x]-+P[x]. Finally, let M be the formalization of the following proof of P[13]: 3<5

13 = (13 - 5) + 5 8 = (8 - 5) + 5

3=0x5+3

(5 < 13, ~e.~.~al) (5 _~ 8,

Lerttmal)

( Lemraa3 )

.'.S----(0×5+3)+5

.'. 8 ---- 1 x 5 + 3 .'.13=(1

( Lemrna2 )

x5+3)+5

.'. 13 = 2 X 5 + 3

(Lemma2)

under the signature containing the constants

{ Leramal E IIx:N.IIy:N. (y _< x = true) --+ (x = (x - y) + y) Lemma2 C IIx:N.IIy:N.Hz:N. (x x y + z) + y = (x + 1) x y + z Lemma3 E IIx:N.IIy:N. x = 0 x y + x, and the equational context A ---- M1 E 1 3 - 5 = 8 ,

M2C8-5=3,

M3C0+1--1,

M4C1+1----2

595 or

A -M

1 CIIx.x-O=x,

M 2 EHx.IIy.x ~-yt=x-y,

M 3 C IIx.x + 0 = x, M 4 E IIx.IIy.x + yt = (x + y)q Solving the unification problem M = R + n x o d a f l by higher-order unification under A, we obtain the solution n=0",

x0=13,

d--.kx.x-5,

pl = A x - 5 _ ~ x , p 2 = - k x - x < 5 .

a and fl axe also instantiated with appropriate proof terms. The term M and the terms assigned to a and/3 will be found in Appendix. Remark that in the case of proving by example, we can usually obtain a general proof from a single example proof. This is the situation common in EBL [Mitchell86, DeJong86]. Remark also that the predicates which control recursive calls (i.e., P1 and P2) are also obtained simultaneously. In order to construct a general proof, we have to formalize and prove that either P1 or P2 holds for each z E A (Vx:A.PI[x] V P2[x]), and that P2[dix] holds for some i. But the formalization does not affect the synthesis process. Although the divisor is fixed to 5 in the above proof, we can easily generalize 5 to an arbitrary natural number using the method of EBL or Hagiya [Hagiya89].

3.4. U n i f i c a t i o n under E q u a t i o n a l C o n t e x t Theoretically, unification under an equational context should be higher-order unification with narrowing [Fay79, Hullot80]. Given a unification problem M = N, we should reduce M and N by narrowing and then unify the results by higher-order unification. Unification required in the course of narrowing should also be higher-order. However, merging hlgher-order unification and narrowing is a difficult and challenging problem which should be studied in its own right. The result will be a very powerful procedure, but a naive implementation has a danger of being very inefficient. In this paper, we take a more practical approach that makes use of the type structure of a proof. Consider the previous example. In the proof, the terms 2 and 3 are related with the terms 1 + 1 and 8 - 5 by the type structure of the proof, and 1 + 1 and 8 - 5 are further related with (0 + 1) + 1 and (13 - 5) - 5. If 2 and 3 are replaced with (0 + 1) + 1 and (13 - 5) - 5, then ordinary higher-order unification can be used to solve the unification problem. In order to actually do such replacement, we prepare an equivalence relation among occurrences of closed normal terms whose type is not of a functional or product type. The initial state of the equivalence relation is the state in which each equivalence class consists of a single occurrence. As type checking proceeds, we update the equivalence relation by merging its equivalence classes. Assume that, in the course of type checking, a term occurrence M should be matched with a term occurrence N, where M and N satisfy the above condition. We rewrite M and N under the equational context, and if the results are identical, we merge the equivalence class of M and that of N. If M and N are identical without rewriting them, the equivalence classes of the corresponding subterm occurrences of M and N are also merged. When a type is newly constructed, term occurrences in the new type are inserted into appropriate equivalence classes. For example, if M C I I x : A . B , we let the type of

596

M N be B[N/x]. In this case, the occurrences of N in BIN/x] are inserted into the equivMence class of N in MN. The implementation of occurrences is straight-forward, if terms are represented by directed graphs as they are usually implemented in LISP. Now, assume that, while solving a unification problem, we are given a pair M = N, where N is an occurrence of a closed normal term not of a functional or product type, and M is flexible. If the equivalence class of N consists of distinct terms { N 1 , " ' , Nn}, we non-deterministieally do ordinary transformations of higher-order unification (i.e., projection and imitation) on M = Ni for 1 < i < n. Practically, the selection of a term from the set { N 1 , ' . . , N,} should be done carefully. Roughly speaking, the most complex term should be selected first. 4. Programming by Example and Proving by Example We introduce another recursion operator in order to cope with the cases in which programming by example and proving by example should be done simultaneously, and then discuss the relationship of the operator with program extraction.

4.1. Simultaneous Recursion Operator We introduce the simultaneous recursion operator R* as follows: n E N

(it*)

x C A

d E

A--~A

a E A---*B---*B

b E A---~B

Hx:A.Hy:B.P[x, y] E Type a E Hx :A.P1 [x]---*IIy:B.P[dx, y]--~P[x, axy] I~ • Hx:A.P2 [x]---*P[x, bx] R*nxdabPafl E P[x, Rnxdab]

The reduction rules for R* axe

(R*=)

{ R*OxdabPai~ = flx(Z~) • (Z~ e P2[x]) R*(n')xdabPafl = ax(Z~)(Rn(dx)dab)(R n(dx)dabPafl) (Z~ E Pi[x]).

As an example, we can consider the quotient-remainder problem again. Here, we define P by where x C N and y E N × N, and let M* be a proof of P[13, (2, 3)]. Remark that M* is a subterm of M in the previous example, i.e., we have M = (2, (3, M*)). By solving M* = R*nxodabPa*fi*, we obtain a = Ax.Ay.(v:ly + 1,~r2y) and b = Ax.(0,x), and the program

gx -- i f x < 5 then (0,x) else (~rl(g(x- 5 ) ) + 1,~:2(g(x- 5))). In general, we can construct the following program from the solution of a unification problem: gx = if P2[x] then bx else (if Pl[x] t h e n ) ax(g(dx)),

597

4.2. R e l a t i o n w i t h P r o g r a m E x t r a c t i o n

The above example suggests the relationship among programming by example, proving by example and program extraction. We are expected to show that the verified program synthesized with the operator R* is the same as the program extracted from the proof synthesized with R +. This equivalence can be depicted by the following commutative diagram: Example Proof ~t+> Constructive Proof

I Example Proof

R* ~

1 °x Verified Program,

where It+ and R°) mean synthesis with R + and R*, respectively, and I ex means program extraction such as q-realizability [ttayashi89]. Let M e ~y:B.P[xo,y] and M* e P[x0,g0], where M = (g0,M*). If we have a solution in M = R+nxoda/3 (1) and a solution in M* = R* nxodabPa*/3*,

Yo = Rnxodab

(2)

they share the values for n and d, and the values for a (fl) and a* (/3*) satisfy the following equations: o~xZ(y,Y) = (axy, a * x Z y Y ) ,

/3xZ -- (bx,t3*xg).

(3)

More precisely, we have the following theorem, whose proof is straight-forward: T h e o r e m 4.1: If a, /3, a* and t3" satisfy (1) and (3), a* and /3* also satisfy (2). Conversely, ira* and fl* satisfy (2), we can find a and/~ that satisfy (1) and (3). 5. I m p l e m e n t a t i o n Issues

An experimental system that includes the type-checker and the higher-order unifier is being implemented by the author on Common Lisp. It is not a complete one, but M1 the exaxnples given in this paper have been actuMly solved. The results for the examples in this paper, summaried in Table 5.1, suggest the performance of the system, though great improvements axe expected in the future. The first problem of Table 5.t is that of obtaining the recurrence relation for gi from three pairs (A) --* (A), (A B) ~ (B A) and (A B C) --~ (C B A). The second and third are the unification problems M = R+(O")xoda/3 and M* = R*(O")xodaba*/3* in Sections 3.3 and 4.1.

reverse quotient-remainder with R + quotient-remainder with R*

MacII/ACL

DN4500/KCL

2.6 sec 145 sec 264 sec

1.2 sec 88 sec 147 sec

Table 5.1. Performance of Experimental System

598 How to cope with the non-determinism of higher-order unification is the central issue of the implementation. Currently, we have found the following heuristic rules effective: 1. Do projection before imitation. 2. Select proof terms before non-proof terms. 3. Select more complex terms from an equivalence class before simpler terms. The rule 1 is common in high-order unification, but is particularly important when the size of an example proof is large and it cont*dns a number of induction steps. In some unification problems, we have to update the equivalence relation of occurrences not only during type-checking but also in the course of unification. In those cases, the rule 2 has been found necessary. In order to distinguish proof terms from non-proof terms, we have to make a distinction between types representing propositions and types representing sets. 6. R e l a t e d W o r k s

Generalization of proofs in which constants are replaced with variables is studied in EBL

(explanation-based learning) and also by Hagiya [Hagiya89]. In EBL, a method called EBG (explanation-based generalization) has been established, which constructs the most general proof that has the same proof tree as that of an example proof. The method can be traced back to regression [Waldinger77], which originally meant an operation to construct the weakest precondition of an inference rule. Kedar-Cabelli, Krawchuk, etc., have embedded EBG into a theorem prover such as a Prolog interpreter or a production system, where generalized proofs are constructed while theorems are being proved [Kedar-Cabelli87, Krawchuk88]. Higher-order extensions to EBL are studied by Donat [Donat88] and Dietzen [Dietzen89]. Donat points out that some restrictions should be imposed when generalized rules are applied, because trivial instantiations are always possible in higher-order unification. Shavlik and Cohen study the problem of generalizing number~ in a proof, such as the number of inputs and outputs of an electric circuit, or the number of blocks stacked on a table. Shavlik's method constructs a generalized rule which roughly corresponds to a theorem proved by induction, but his method is not based on a particular formal system [Shavlik87]. Cohen's method constructs a finite-state automaton whose output advises which rule to apply to the current situation, and does not construct a generalized rule as Shavlik's [Cohen88]. The method proposed in this paper suggests a new approach for proving an inductive theorem: that of automatically proving a concrete example of the theorem and then generalizing the result to an inductive proof. For example, the computation of a Prolog interpreter can be considered to generate a concrete proof. A rewrite tactic in LCF [Gordon79] can easily construct an equational proof for closed terms. These facts suggest that concrete examples are much easier for automatic theorem proving. However, it is not obvious and therefore should be investigated which is an easier problem, to generalize concrete proofs or to prove an inductive theorem from the beginning. In [Casta~ng84], example proofs are used to guide the generalization required to inductively prove the equivalence of two recursive functions.

599

Higher-order unification was first applied to the field of logic programming by Miller (AProlog) [Nadathur88] and Paulson (Isabelle) [Paulson86]. Other applications of higher-order unification include the works by Huet [Huet78], Pfenning [Pfenning89], etc. 7. R e m a i n i n g P r o b l e m s Until we are able to apply the method of this paper to actual programming, we should solve a number of problems: 1. How to make higher-order unification more efficient. 2. How to merge higher-order unification and narrowing. 3. How to introddce transformation rules for proofs, particularly, rules for transforming equational inferences. 4. How to apply the method to more expressive type theories such as Calculus of Constructions. 5. How to synthesize auxiliary programs or proofs. The algorithm of higher-order unification is inherently one of generating and testing. Since some results are reported as to the efficiency of programming by example, we are expected to interpret those techniques in the context of higher-order unification, and establish them as general heuristic rules for higher-order unification. For proof terms, we will be able to use their type structures and increase the efficiency of unification. As for 2, we can consider higher-order versions for each kind of extension of firstorder unification: e.g., narrowing, AC-unification, ACid-unification, etc. All of the cases are non-trivial and seem to require extensive efforts of investigation. In this paper, we defined equality as a primitive notion and gave inference rules for equality as non-derivable rules. However, if we define equality as by Leibniz, we can derive inference rules for equality, and moreover will obtain transformation rules for equational inferences. For example, we wilt obtain a rule corresponding to E(Hx :B.A[x])(IM)N = N. These transformation rules are necessary for generalization, because example proofs, whether they are written by hand or generated automatically, are usually not ready for generalization until they are transformed into a normal form. The unification algorithm, of course, should also take those transformation rules into account. Another problem concerning with equality is how to transform proofs in (Ei) into proofs in .(Ee) and vice versa, because it is not aiways obvious which equational inferences form induction and which inferences are used as rewrite rules. The extension of higher-order unification to polymorphic types is partially studied by Elliott. However, the real power of polymorphism comes with the ability to define new type constructors. Each time extending LF as in this paper, we have to extend the unification algorithm to cope with new type constructors. Therefore, we hope that we will have a method to automatically extend the unification algorithm by the definition of new type constructors. Kodratoff et al. consider the cases in which auxiliary programs are synthesized while a main program is being constructed. This amounts to synthesizing lemmata while proving a main theorem. The central issue for lemma creation is how to figure out which parts of a proof should be extracted as a lemma.

600

8. Conclusion In this paper, we showed that higher-order unification for a type theory with a recursion operator can be used synthesize a recursive program from examples and that the method can be extended to a type theory with dependent types and used to synthesize an inductive proof from an example proof. To formalize the method, we extended LF to a system with product and equality. As for equality, we took both of the external and internal approaches and proposed an extension of unification which makes use of the type structure of proofs. Finally, we showed that we can simultaneously synthesize a program and its correctness proof, and that the synthesized program coincides with the program extracted from a synthesized constructive proof. Acknowledgements The author deeply thaxlks F. Pfenning, D. Miller, S. Dietzen and C. Elliott for introducing him to higher-order unification References [Angluin83] Angluin, D., Smith, C. H.: Inductive inference: Theory and methods, Computing Surveys, Vol.15, No.3 (1983), pp.237-269. [Biermann78] Biermann, A.: The inference of regular LISP programs from examples, IEEE Transactions on Systems, Man, and Cybernetics, Vol.8, No.8 (1978), pp.585-600. [DeJong86] DeJong G. F., Mooncy, R.: Explanation-based learning: An Mternative view, Machine Learning, Vol.1, No.2 (1986), pp.145-176. [Castaing84] Castaing, J., Kodratoff, Y., Degano P.: Theorem proving by the study of example proof traces or theorem proving by a correct theorem statement, Automatic Program Construction Techniques (Biermann, A. W., Guiho, G., Kodratoff, Y. eds.), 1984, pp.421-431. [Cohen88] Cohen, W. W.: Generalizing numbers and learning from multiple examples in explanation based learning, Proceedings of the Fifth International Conference on Machine Learning, 1988, pp.256-269. [Coquand88] Coquand, T., Huet, G.: The calculus of constructions, Information and Computation, Vol.76, No.3/4 (1988), pp.95-120. [Dietzen89] Dietzen, S. R., Pfenning, F.: Higher-order and modal logic as a framework for explanation-based generalization, ERGO-89-076, School of Computer Science, Carnegie Mellon University, 1989. [Donat88] Donat, M. R., Wallen, L. A.: Learning and applying generMized solutions, 9th International Conference on Automated Deduction, LNCS310 (1988), pp.41-60. [Elliott88] Elliott, C. M.: Higher-order unification with dependent function types, Rewriting Techniques and Application8 (Dershowitz, N. ed.), LNCS355 (1989), pp.121136. [Fay79] Fay, M.: First-order unification in an equational theory, ~th Workshop on Automated Deduction, Austin, Texas, 1979~ pp.161-167. [Gordon79] Gordon, M. J., Milner, A. J., Wadsworth, C. P.: Edinburgh LCF: A Mechanised Logic of Computation, LNCS78, Springer-Verlag, 1979. [Hagiya89] Hagiya, M.: Generalization from partial parametrization in higher-order type theory, Theoretical Computer Science, Vot.63 (1989), pp.113-139. [Harper87] Harper, R., Honsell, F., Plotkin, G.: A framework for defining logics, Symposium on Logic in Computer Science, 1987, pp.194-204. [Hayashi89] Hayashi, S., Nakano, H.: PX: A computational logic, MIT Press, 1989.

601

[Howard80] Howard, W. A.: The formulae-as-types notion of construction, To H. B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism, (Hindley, J. R., Setdin, J. P. eds.), Academic Press (1980), pp.479-490. [Huet75] Huet, G. P.: A unification algorithm for typed A-calculus, Theoretical Computer Science, Vol.1 (1975), pp.27-57. [Huet78] Huet, G., Lang, B.: Proving and applying program transformations expressed with second-order patterns, Aeta Informatica, Vol.ll (1978), pp.31-55. [HullotS0] Hullot, J.-M.: Canonical forms and unification, 5th Conference on Automated Deduction, LNCS87 (1980), pp.318-334. [:louannaud89] Joumanaud, 5.-P., Kodratoff, Y.: Characterization of a class of functions synthesized from examples by a Summers like method using the Boyer-Moore-Wegbreit matching technique, Proceedings of IJCAI 79, 1979, pp.440-447. [Kedar-Cabelli87] Kedar-Cabelli, S., McCarty, T.: Explanation-based generalization as resolution theorem proving, Proceedings of the Fourth International Workshop on Machine Learning, 1987, pp.383-389. [KodratoffS0] Kodratoff, Y.: A class of functions synthesized from a finite number of examples and a LISP program scheme, International Journal of Computer and Information Science, Vol.8, Nol.7 (1979), pp.489-521. [Krawchuk88] Krawchuk, B. J., Witten, I. H.: Problem solvers that learn, Proceedings of the Third Europe Working Session on Learning (Sleeman, D. ed.), 1988, pp.93-106. [Martin-LSf 82] Martin-LSf, P.: Constructive mathematics and computer programming, Sixth International Congress in Logic, Methodology and Philosophy of Science, 1982, pp.153-175. [Mitchell86] Mitchell, T. M., Keller, R., Kedar-Cabelli, S.: Explanation-based generalization: A unifying view, Machine Learning, Vol.1, No.1 (1986), pp.47-80. [Myers86] Myers, B. A.: Visual programming, programming by example, and program visualization: A taxonomy, Proceedings of the A CM CHI'86 Conference on Human Factors in Computing Systems, 1986, pp.59-66. [Nadathur88] Nadathur, G., Miller, D.: An overview of APROLOG, Proceedings of the Fifth International Conference and Symposium on Logic Programming, 1988, pp.810827. [Nix84] Nix, R.: Editing by example, Proceedings of the 11th ACM Symposium on Principles of Programming Languages, 1984, pp.186-195. [Paulson86] Paulson, L. C.: Natural deduction as higher-order resolution, Journal of Logic Programming, Vol.3 (1986), pp.237-258. [Pfenning89] Pfenning, F.: Elf: A language for logic definition and verified metaprogralnming, Symposium on Logic in Computer Science, 1989, pp.313-322. [Shapiro82] Shapiro, E. Y.: Algorithmic program diagnosis, Proceedings of the 9th A CM Symposium on Principles of Programming Languages, 1982, pp.299-308. [Shavlik87] Shavlik, J. W., DeJong, G. F.: An explanation-based approach to generalizing number, Proceedings of IJCAI 87, 1987, pp.236-238. [Smith84] Smith, D. R.: The synthesis of LISP programs from examples: A survey, Automatic Program Construction Techniques (Biermann, A. W., Guiho, G., Kodratoff, Y. eds.), 1984, pp.307-324. [Snyder89] Snyder, W., Gallier, J.: Higher-order unification revisited: Complete sets of transformations, Journal of Symbolic Computation, Vol.8, Nos 18z2 (1989), pp.101-140. [Summers77] Summers, P.D.: A methodology for LISP program construction from examples, JACM, Vot:24, No.1 (1977), pp.161-175. [Waldinger77] W'aldinger, R.: Achieving several goals simultaneously, Machine Intelligence, Vol.8 (1977), pp.94-136.

602

Appendix We give the listing of M, a and fl in Section 3.3 in the following syntax, which is used by the experimental system implemented in Common Lisp: Type -- Type

cM1...Mm

IIx:A.B

-

(Pi A x B)

Ex:A.B

-

(Sigma A x B)

c --- c

x ~ x

Ax:A.M

-

A-+ B

( p a i r M N)

=.

IM

(id M)

-

".

Mn)

M=N

=-

(= M N)

(Pi A -> B)

A X B ---- (Sigma A ~ B)

(lain A x M )

(M,N) =-

=- (c M1

MN1...N~

~iM -

E(tlx:B.A)MN

=- ( M

N1 . . ,

N,)

(pri M) -

(eq N (Pi B x A) M).

Remark the order of arguments to eq. In order to avoid introducing many miscellaneous axioms, (! A) denotes a constant whose type is A. M= (pair 2 (pair 3 (pair (! (= (< 3 5) true)) (eq (eq (Lemmal 13 5 (! (= (<= 5 13) true))) (PI nat x (= 13 (+ x 5))) (eq (eq (Lemmal 8 5 (! (= (<= 5 8) true))) (PI nat x (= 8 (+ x 5))) (Lemma3 3 5)) (PI nat x (= 8 x)) (Lemma2 0 5 3))) (Pl nat x (= 13 x)) (Lemma2 1 5 3)))))) (LAM NAT X

(LAM (= (<= 5 X) TRUE) X1 (LAM (SIGMA NAT Q (SIGMA NAT R

(SIGMA (= (< R 5) TRUE) & (= (- x 5) (+ (, Q 5) R)))))

X2 (PAIR (+ (PR1X2) 1) (PAIR (PR1 (PR2 X2)) (PAIR (PR1 (PR2 (PR2 X2))) (EQ (EQ (LEMMA1X 5 XI) (PI NAT X3 (= X (+ X3 5))) (PR2 (PR2 (PR2 X2)))) (PI NAT X3 (= X X3)) (LEMMA2 (PRI X2) 5 (PR1 (PR2 X 2 ) ) ) ) ) ) ) ) ) ) ) (LAM NAT X (LAM (= (< X 5) TRUE) X1 (PAIR 0 (PAIR X (PAIR XI (LEMMA3 X 5)))))))

Retrieving Library Identifiers via Equational Matching of Types Mikael Rittri Programmeringsmetodikgruppen, Inst. fhr Informationsbehandling Chalmers Tekniska Hhgskola och Ghteborgs Universitet S-412 96 Ghteborg, Sweden (E-maih [email protected])

Abstract In functional programming environments, one can use types as search keys in program libraries, if one disregards trivial differences in argument order or currying. A way to do this is to identify types that are isomorphic in every Cartesian closed category; simpler put, types should be identified if they are equal under an arithmetic interpretation, with Cartesian product as multiplication and function space as exponentiation. When the type system is polymorphic, one may also want to retrieve identifiers of types more general than the query. This paper describes a method to do both, that is, an algorithm for pattern matching modulo canonical CCC-isomorphism. The algorithm returns a finite complete set of marchers. An implementation shows that satisfactory speed can be achieved for library search.

1

Introduction

In an earlier paper [13], I have argued that types are good search keys in functional program libraries, if one identifies types by a particular equivalence relation. I argue in this paper that one should also retrieve identifiers of more general types than the query type. To combine the two ideas, we need to do pattern matching modulo the equivalence relation. This paper, which is a compressed version of [14, Part C], describes an algorithm and an implementation based on similar work by Bernard Lang [5]. Although my own motivation is library search, others have suggested applications for program transformation [9] and type-checking up to equivalence [6]. In this introduction, I will first summarize the reasons to use an equivalence relation during library search, and then I will explain why more general types should be found. In Section 2, I review the basics of unification theory. In Section 3, I present Lang's work, show how my problem differs from his, and give an overview of my algorithm, which is then presented in detail in Section 4. Section 5 gives some statistics from my implementation of a library search system. Section 6 describes some related work. To understand the application, the reader should be familiar with functional programming (see e.g. [12]) and the usual Hindley-Milner type system [8, 12]. The main points are that we see types as first order terms, as in [8], and that though a function (or any value) may have many types, one of them can be instantiated to all the others.

604 For instance, the identity function has any type of the form A :=~ A, where A is a type, but it has a most general type x==Vx, where x is a variable. The most general types are derived automatically during the compilation of a functional program. About notation: I use =V for function space, x for binary Cartesian product, and 1 for the empty Cartesian product. Syntactically, =~ is right associative and binds weaker than x, which is left associative. Type variables are denoted by x, y, z , . . .

1.1

The Equivalence Relation

A library user, who is looking for a particular function, should be able to state the input types and the output type of the function, but he has no way of knowing which choice of argument order the library author used. This choice is seldom important to the user, and even when it is, the library function can always be converted to a similar function, which just differs in its argument order. The conversion is done by a higher order function; the C combinator is the simplest example (C f a b = f ba). Therefore, types that differ only in their argument order should be identified during the library search. A similar point can be made about currying: the distinction between a curried and an uncurried version of a function is trivial, since it is easy to convert back and forth by the higher order functions curry and uncurry. So a curried type A==~(B=~C) should be identified with its uncurried version (A x B):=V C during search. This leads to the axioms x x y = y x x , x x ( y x z ) = ( x x y ) x z , and x::~(y:=~z) = (x × y) =:~ z, but the question is whether there are other axioms that should also be included. To state some kind of completeness result, we need clear semantics for the equivalence relation. In [13], I proposed that types should be seen as equal whenever bijections between them (like curry/uncurry) exist in typed ~/~q-calculus with surjective pairing. In other words, we identify types that are isomorphic in every Cartesian closed category, when we interpret x as categorical product, =~ as categorical exponentiation, and 1 as a terminal object. This equivalence relation is characterized by the following set of axioms, which I call r . x×y x×(y×z) x~(y~z)

= = =

yxx (x×y)×z (xxy)~z

l×x l~x x~l

= = =

x 1

The axioms also characterize the equational theory of natural numbers under 1, multiplication and exponentiation (interpreting 1 as 1, × as multiplication and x ==~y as y~). See [7, 18, 6].

1.2

Retrieving More G e n e r a l T y p e s

There are both theoretical and practical reasons to accept identifiers whose types are more general than the query. Theoretically, we could look up the semantics of polymorphic types. According to [8], the notation e : A, where A is a type, means that e can be assigned any ground (i.e. variable-free) type that is an instance of A. It is then reasonable to interpret a query A as asking for all identifiers e in the library for which e : A holds. These are, in fact, the identifiers whose most general types are at least as general as A.

605 One can compare the situation with a search by specification, which would be ideal but cannot be automated. If we search by specification, all identifiers that satisfy equivalent specifications should be retrieved, but also identifiers that satisfy stronger specifications, i.e., if an identifier has all the properties we want, we do not mind if it Mso has other properties. "Equivalent" corresponds to "isomorphic", and "stronger" corresponds to "more general", when the specifications are just Hindley-Milner types. From a more practical view, the reason to accept more general types is that it is hard to figure out the most general possible type of a function. If we have the actuM code, the most general Hindley-Milner type can be derived automaticMly, but the user of a search system must formulate a type just based on the specification he has in mind. We will look eLt some examples of functions that have more general types than one might at first expect. E x a m p l e 1. A user wants a function member, such that member eq a 1 tells if a is an element of the list l, using eq to determine equality on list elements. It is easy to believe that the type of member must be (z :=~z ==~Bool) =:~z ==~List(x) =~ Bool, but the natural implementation will have the more general type (x ==~y==~Bool)=:~x ::~ List(y)==~ Bool. • E x a m p l e 2. Let the function foldr be defined by

foldr op b [] foldr op b (a.l)

--

b

--

op a (foldr op b t)

where '[]' is the empty list and '.' is infix 'cons'. This function is generally useful, one can e.g. sum Ml integers in a list l by evaluating foldr (+) 0 l. "An interesting consequence of letting the compiler discover the type of your function, is that it may tell you that it has a naore generM type than you realised. For example the type deduced by the system for foldr is (z ==~y =~ y) ==>y ~ List(x) =~ y, which reveals that the operator supplied to foldr can be unsymmetrical, which is something that most people miss when they are shown its definition." [21, p. 5] • E x a m p l e 3. Let a parsing function take a list of lexical tokens. If an initial segment of the list can be parsed as a vMue a, then the parsing function returns a and the rest of the list. So a parsing function has the type List(Token)=~ A × List(Token), where A is the type of a. We may want to compose such parsing functions sequentially. T h a t is, if f can parse an a and g can parse a b, then their sequential composition, which we write f (&)g, should parse an a followed by a b, and return the pair (a, b) together with the rest of the list. Such a function is easy to code:

(f (&) g)(ll)

= l e t (a, 12) = f(/1) in let (b,/3) = g(12) in ((a, b),/3)

and one might think that the type of (&) would be (List(Token) ==>xx List(Token)) (List(Token) ~ y x List(Token)) =~ (List(Token) ~ (x x y) × List(Token)) This is the type given in [12, Sec. 6.6], but the most general type of (&} is

(Zl =~Z x z 2 ) z ~ ( z 2 ~ yxz3)::~(zt ~ ( z × y)x z3)

(I have simplified the (&) of [12] a little by ignoring how to handle a failure to parse, but this does not change the main idea.) •

606 1.3

Combining

the Methods

T h e problem we solve in this paper is how to recognize a t y p e A which is more general, m o d u l o isomorphism, t h a n a query B. A n o t h e r way to express this is t h a t A m a t c h e s B m o d u l o isomorphism. T h e usual definition of such a relation is t h a t A m u s t be more general than a type B ' , which is isomorphic to B. P r o b l e m s of this kind are studied in u n i f i c a t i o n / m a t c h i n g theory. Unifiability m o d u l o isomorphism m a y also have applications for library search, b u t it might be undecidable; see Section 6. 2

Unification/Matching

in Equational

Theories

Some basic notions of terms and substitutions are assumed known, see e.g. [17, 2, 20]. T h e set of terms over a set F of function symbols with arity and an infinite set V of variable symbols (or simply variables) is denoted T(F, V). T h e set of variables occurring in a t e r m t is written V(t); t is ground if V(t) = 0. T h e top symbol of a t e r m t is denoted 7-l(t). Substitutions on terms are e n d o m o r p h i s m s t h a t only change a finite set of variables. We denote the domain of a substitution a by T)(a) and its set of introduced variables by Z(~r). Composition of substitutions is such t h a t ((r o r)(t) = a ( r ( t ) ) . T h e union o f two substitutions al and a2 with disjoint domains is written al U tr2. T h e n o t a t i o n tr[x denotes the restriction of a to a set X of variables. A rewrite rule is a pair of terms (l, r), usually written l ~ r . A rewriting system is a set of rewrite rules. If R is a rewriting system, we write t ----~n s iff there is a rewrite rule l ---~r in R and a substitution o', such that there is a s u b t e r m o f t t h a t equals c~(l), and s is the result of replacing t h a t s u b t e r m of t by c~(r). A n identity, or equational axiom, is a pair of terms (s,t), usually written s = t. If E is a set of equational axioms, we define the relation = E to be the finest congruence relation on terms such t h a t a(s) = E ~r(t) holds whenever s = t is an axiom o f E and tr is a substitution. A n equational theory is a set of identities E such t h a t s = E t if, and only if, s = t is an element of E. If E is an arbitrary set of identities, the equational theory presented by E is the smallest one that includes E. We often blur the distinction between a set of axioms and the equational theory they present. We extend the relation = E to substitutions, by letting a = E r i f f ~(z) = E r ( x ) for all x E V. If X is a set of variables, we write ~ = E r [X] if a[x =E r[X. We define the preorder _<E on terms by letting p _<E s if there is a substitution (r such t h a t
UE(s,t>. E-matching can be described as one-sided unification. An E-matching problem is a pair of terms (p,s). T h e set ME(p,s> of E - m a r c h e r s o f p to s is defined by ME(p,s} = 1Thus, the symbol < can be read as "less specific than", following the tradition in unification theory. Alas, people who write about polymorphic types [8, 15] use the opposite convention and take _
607

{or I c'(p) = E s}. The t e r m p is the pattern and s is the subject. Let p and s be terms and let W be a set of variables such that W A V(s) = 0. A set E of substitutions is a complete set of E-marchers ofp to s away from W [2] if 1. for all a E E, 79(cr) C_ V(p) and Z(a) A W = O (purity), 2. E C ME(p, s) (correctness), 3. for all 7- C ME(p,s), there is acr E E such that o" _<E v [V(p)] (completeness). An E-matching system S is a set of term pairs. We let M E ( S ) ----N{p,s)es ME(p, s). An E-matching disjunction system D is a set of E - m a t c h i n g systems. We let M E ( D ) = USED ME(S). Complete sets of marchers are defined in the natural way for such systems. The standard convention is that terms to be E - m a t c h e d or E-unified can contain no other function symbols than those occurring in the axioms for E. These are sometimes called interpreted function symbols. If terms may contain other function symbols as well (these are free or uninterpreted symbols), one must say so explicitly. Note t h a t the variables in the subject of a matching problem are never instantiated, and therefore behave like free constants. If we have access to an arbitrary number of free constants when we match, we can assume that all matching problems have a ground subject, since variables in a subject can be replaced by new constants. This assumption gives some technical benefits.

Comparison with Previous Work

3

Bernard Lang at INRIA, France, has given a matching Mgorithm for a theory very similar to F; the only difference is t h a t x is not commutative, so one has to add the axiom x x l = z explicitly [5]. I will modify his algorithm to handle commutativity, too. Lang's approach was algebraic, whereas mine is based on term rewriting; this difference is mostly a m a t t e r of presentation. To make the similarities more visible, I will present Lang's work in a t e r m rewriting style. 3.1

Lang's Algorithm for a Variant Without

Commutativity

We let L be Lang's equational theory2: =

(x×y)×z

IXZ

~

X

ZXI

----

Z

l~z

=

z

x=¢,l

:

1

Lang allows free constants in matching problems, but no free function symbols with arity > 0. As a consequence, it can be shown that every t e r m t is L-equal to a t e r m of the form ( t l ~ q l ) × ' " × ( t n ~ q n ) , with n > 0, where the qi's are variables or constants different from 1, and the ti's are arbitrary terms. I will call terms of this form regular forms. (The case where n = 0 is seen as the constant 1. A single variable or constant q is L-equal to the term l ~ q , which is regular.) 2Lang calls it .4, b u t this c a n b e m i s t a k e n for a single associativity axiom.

608 Lang calls the sequence q l " " q , , a base of t, and calls t l . - . t n an exponeni. This is in analogy with the arithmetic interpretation of the function symbols, where t =~ q is interpreted as qt. One can see the base as a t e r m ql * "'" * q,~ in a "smaller" equational theory AU: x.(y*z)=(x,y).z, A*x=z, z*A=x where '*' is a new binary function symbol, and 'A' is a new constant. T e r m s in this smaller theory will be called base ~erms. We can use the notation t B b as an abbreviation of "t has a base b" .3 Lang's key observation is that given a substitution a on terms, one can define a base w of c~ as a substitution on base terms with the property that or(z) B w ( z ) for every variable x, and t h a t this gives that if a(p)

:L

S, and p B bp, and s B b,, and w is a base of cr, then w(bp) =AU bs

that is, if p L-matches s by a, then a base of p AU-matches a base of s by any base of e. This observation gives a divide-and-conquer algorithm to find all L-matchers of a pattern p to a subject s, when the subject is ground. First, all possible bases of an L-matcher are the AU-matchers of (bp, bs), where bp and b~ are chosen to be bases of p and s, respectively. These can be found by known algorithms for AU-matching. Second, for each possible base of an L-matcher, one can find a most L-general substitution ~0 which has this base. If the base is w = {xl ~ qll * " " * ql,~,, . . . , Xm ~ qml * "'" * qmn,~.} then the substitution a0 = {xl ~-* ( Y l l ~ qll) x . . . x (Yln,:=~ q l n , ) , . . . , zm ~ ( Y m l ~ q m l ) x . . . x (Y,~n,~=:~qmn,~)} where the Ylj's are distinct variables not occurring in w, is more L-general than any other substitution whose base is w. Third, a0 is applied to p. The L-matching system {{pl, s l ) , . . . , {p,, s , ) } remains to be solved, where P l , . . . , ion is the exponent of a0(p), and s l , . . . , sn is the exponent of s. This system is solved by successive instantiation in the usual way, using the L-matching procedure recursively for subproblems. All L-matchers of p to s can be found this way. 3.2

D i f f e r e n c e s in o u r S e t t i n g a n d O v e r v i e w o f A l g o r i t h m

There are two m a j o r differences in our application. The first is that we have commuta~ tivity of ×, the second is t h a t free function symbols of any arity can appear (like List). The latter means t h a t in the regular forms, the qi's need not be variables or constants, but can also be terms like f i ( . . . ) , where fi is a free function symbol. Earlier each base component qi had a single t e r m attached (its exponent ti), now it m a y have several (the parameters of fi); this is not a difficulty. We can re-define the base of a t e r m as a bag 3 L a n g works o n equivalence classes of t e r m s , a n d h e w o u l d i n s t e a d write B(e) = u, w h e r e e is t h e equivalence class of t u n d e r L, a n d u is t h e equivalence class of b u n d e r A U . Since I prefer to w o r k directly w i t h t e r m s , I m a k e B a relation, r a t h e r t h a n a function.

609

containing all the top symbols 7-l(qi). We regard the base as a term zx ~ ... ~ Zm ~ .t'1 • . - ~ fk, in a "smaller" equational theory ACU:

xuy=y

x,

0

,=x

where 'W' is a new binary function symbol, and '0' is a new constant. The base matchers can be found as before, but by using ACU-matching [4, 19] rather than AU-matching. However, the commutativity means that for a given base matcher, there may be alternative ways to obtain a set of smaller matching problems. Consider the example ((pl:=~f)x(p2:=~f), (sl::~f)x(s2=~f)) where f is a constant. Both terms have the base f N f , so the most general base matcher is the identity. A full matcher can be found by finding a marcher either for tile system {(Pl, Sl), (p2, s2)} or for the system {(Pl, s~}, (p2, Sl}}, so we must solve the disjunction system consisting of these two systems. So when we have found a base matcher, the remaining work is to solve a disjunction system, rather than an ordinary system, which means that F-matching is slower than L-matching. In fact, F-matching is NP-complete [9], but practical experience shows that it is feasible for library search, see Section 5. E x a m p l e 4. We want to match the pattern p = (Bool =~ z) to the subject s = (IntxBool::~ List(Char)). We get that p B x and s B List. A complete set of ACU-matchers o f x to List is the singleton set containing w = {x ,-* List}. A most F-general substitution with w as base is v" = {x ~-* (Yl ==~ List(y2))}, where yl and Y2 are new variables. It remains to match the exponent of or(p) to the exponent of s. W'e have that ~(p) = (Bool ==~@1 ==~ List(y2))) = r (Bool x Yl =~ List(y~)), so we get a disjunction matching system {{(Boolxyl, IntxBool}, (Y2, Char)}}, which only contains a single matching system, consisting of two pairs. A complete set of F-matchers for the disjunction system is the singleton set only containing M = {Yl ~+ Int,y2 ~ Char}; we omit the details of how or' is found. The composition a' ocr = {x ,-* (Int =~ List(Char)), yl ~ Int,y2 ~ Char} is a F-marcher of p to s, but its domain includes variables that do not occur in p. The singleton set containing ( a ' o or)Iv(p) = {z ~-~ (Int :=~ List(Char))} is a complete set of F-matchers of p to s (away from any set of variables). • In summary, then, there are four important parts of the F-matching algorithm. 1. The definition and properties of bases of terms and substitutions. 2. How to find base matchers by ACU-matching. (This will not be described in this paper, though, since the methods of [4] or [19] suffice.) 3. How to find a most F-general substitution with a given base. We will define a function 'Mg' that does this. This function needs a supply Y of fresh variables, so we will provide it as an extra argument. 4. When a base matcher w has been found, and or0 = Mg(w, Y) has been computed, the remainder of the matching problem can be broken down to a disjunction matching system. We will define a function 'D' that takes care of this. 4

An

Algorithm

for F-matching

In this section we present a matching algorithm for the theory F; most proofs are omitted but can be found in [14]. We want to match in the presence of free function symbols of

610

any arity, since our equational theory does not interpret type operators like Int, Char, or List. So, let F be a set of free function symbols, and let a be a function F --+ IN, that gives the arity of a function symbol. Three function symbols are not in F, they are 1, x, and ==~; we let G = F U {1,×,=ez} and extend the arity function a to G so t h a t a ( 1 ) = 0, a(x) = 2, and a(:=~) = 2. In terms, x and =~ are written infix. To denote the set of function symbols given with their arity, we write Go. We let V be a countably infinite set of variables. The set of terms over G~ and V would usually be denoted T ( G ~ , V), but we will use T~ as an abbreviation. The axioms of F were given in Section 1.1. 4.1

Regular Forms

We need to show that terms have regular forms as sketched in the previous chapter. We want to show both t h a t every term has a regular form, and that regular forms are unique up to rearrangements of factors. These statements are given as Theorems 3 and 5 below. To deal with them, we use the techniques of Peterson and Stickel [10], who provide means to rewrite modulo an associative-commutative theory. We single out the associative and commutative axioms of F into a subtheory AC, and direct the other axioms into a rewriting system R.

AC

x×y (x×y) xz

= =

yxx x×(yxz)

R

l×x l==>x xWl

~ x ---4> x ~ 1

We let --~a,AC = (=AC o---~Ro =AC) (cf. [10, p. 244]). We say that a term t is irreducible, if there is no t e r m s such that t ----~r~,ACs. To show t h a t ---~R,AC is well-founded, i.e. that there are no infinite sequences to --4>R,AC tl ----~R,AC t2 ---i>R,AC '" ", we use the following measure of term size. [xj [g(tx,,.,,t~(g))j

=

4,

if×

=

4+[tlJ+...+[t~(g)j,

ifgEFU{1,x}

Ls tJ

=

[sJ

E V

• [tJ

Note that if t =AC s, then [tj = [sJ, and t h a t if t---~rt.hCS, then [tj > [sJ. Since the size of a term is at least 4, a sequence to ---I>R,ACtt ----t>R,ACt2 ---4>R,AC •. • cannot be infinite. It follows, of course, that every term is F-equM to an irreducible term. An irreducible term is a (possibly empty) product of factors, each of which has either the form s ::~ q or just q, where q denotes a t e r m such that 7"/(q) E V U F. It would be more convenient if there were only one kind of factor; we could achieve this by replacing each factor q by 1 ::¢, q. Therefore, we will define regular forms, which have only one kind of factor. T h e notion of regular form will differ from the notion of irreducible t e r m also in that regular forms need be regular only at the top level; the subterms of a regular form need not be regular. C o n v e n t i o n 1 When we talk about a product tl x . . . x t n , that the case when n = 0 is seen as the term 1.

with n >_ O, it is understood

611

D e f i n i t i o n 2 A regular f o r m is a term of the form. (sa ~ ql) × " " × (sn :=~qn), for some n >_ O, where each top symbol 7"[(qi) is either a variable or a free f u n c t i o n symbol. I f t = r r, where r is a regular form, we say that t has a regular f o r m r. T h e o r e m 3 Every term t E 7-c~ has a regular form. P r o o f . Let t I be an irreducible term F-equal to t. This term will almost be regular, but we may need to insert some l's. By a structural induction over tt, we show that it has a regular form, which must then be a regular form of t. (See [14].) • To show that regular forms are unique up to some reordering of factors, we need to know that the irreducible form of a term is unique up to AC-equality. L e m m a 4 I f t = r s, and t (-~R,A¢)* tl, and ducible, then t+ =AC s+.

s

(--4>R,AC)*St,

where t I and s I are irre-

In Peterson's and Stickel's terminology [10], the lemma states that R is AC-complete. It can be proved from [10, Theorems 9.3 and 10.5]. Given a regular form as in definition 2, we can get another regular form by rearranging the top level factors (si :=~qi), and by replacing subterms si and qi by F-equal ones. We can use Lemma 4 to prove that these are all the possibilities for F-equal regular forms to be syntactically different. Theorem 5 Left=

( t l,o =~ pl ) × . . . × ( tm,o ~ pm ) a n d s = ( SLo :~ qt ) x . . . x ( sn,o =~ qn ) be two F-equal regular forms. Let each non-variable term Pi have the f o r m f i ( t i A , .. . ,ti,~(]i)), and let each non-variable term qi have the f o r m g i ( s i A , . . . , si,a(gO). For brevity, we let oq = a ( f i ) , if pi = f i ( . . . ) , and oq = O, if pi is a variable. From these assumptions follows that m = n and that there is a permutation ~r on { 1 , . . . m} such that

Vi E { 1 , . . . , m}(7-/(pi) = 7t(q~(i)) and Y j E {0, ... , a i ) t i j

= r s,~(OJ )

P r o o f . We can translate regular forms to irreducible forms by removing l ' s to the left of=Cs, and then use Lemma 4. Details in [14]. • 4.2

Bases of Terms and Substitutions

In analogy with [5], we define a base of a term in 7"c~. Intuitively, a base of term t is the bag of the symbols 7/(qi) in a regular form of t (as written in definition 2). We define a base as a term in another equational theory ACU, whose equivalence classes behave as bags. To define ACU, we let 0 and t2 be two function symbols not in F, and we let /3 be a new arity function, with/3(0) = 0, j3(~) = 2, a n d / 3 ( f ) = 0 if f E F. We define H = F U {0, t2}. In terms, ~ is written infix and is syntactically left-associative. We write T~ as an abbreviation of 7"(Hz, V). ACU is the equational theory on Tp presented by xt2y=y~x,

x®(y~z)=(x~y)~z,

O~x=x

C o n v e n t i o n 6 When we talk about a term bl W . . . ~ bn, with n >_ O, it is understood that the case when n = 0 is seen as the term O.

612

D e f i n i t i o n 7 Let t E Ta have a regular form (sl =¢, ql) × " " × (s~ :¢, qn), where n > O. Then if b =ACU 7 t ( q 1 ) t ~ . . . ~J T-l(qn), we say that t has a base b, which we write t Bb. C o r o l l a r y 8 I f tt = r t2, and t 1 Bbt, and t2 Bb2, then bl =ACU b2. P r o o f . Follows from T h e o r e m 5. D e f i n i t i o n 9 If cr is a substitution on Ta, and ~ is a substitution on T3, we say that ¢r has a base w, and write o'Bw, if cr(x) B ~(x) for all x E V. Our main result is that a base of a r - m a t c h e r for two terms is an ACU-matcher for their bases. T h e o r e m 10 Let p , s E Te, and bp,bs G Tp, and let (r be a substitution on Ta. c~(p) = r s, and pBbp, and s Bbs, and ~r Bw, then w(bp) --'--ACUbs. P r o o f . See [14]. 4.3

If •

Most General Terms and Substitutions with a Given Base

Given a base in Tp, it is interesting to ask which terms in 7-~ that have this base. Theorem

11 Let b E 7-~, and t E 7-~, and let t Bb.

1. I f b = x, where x E V, then t = r ( t o , x ) ,

for some to E T~.

2. I f b --= f , where f E F, then t =r (to=~ f ( t t , . . . , t a ( y ) ) ) , for some t o , t l , . . . , t ~ ( ] ) E T~. 3. I f b = O, then t = r l . 4. I f b = bl ~ b2, where bx, b2 E T#, then t = r tx × t2, for some tl,t2 E T a such that tl Bbl and t2 Bb2. P r o o f . Follows from the definition of t B b.

•

Given a t e r m b E T~, we can now find a most r-general term among the terms t E T a for which t B b. Inspired by [3, Sec. 9.6], we will use two functions Take and Split to get hold of "new" variables. T h e function Take takes a natural number n and an infinite set Y of variables, and returns n distinct variables of Y. The function Split takes a natural number n and an infinite set Y of variables, and returns n infinite, pairwise disjoint, subsets of Y. Neither of the functions is defined if Y is only a finite set of variables. D e f i n i t i o n 12 We define a function Mg, that takes a term in Tp and an infinite set of variables, and returns a term in Ta. Mg(x,Y) Mg(f,Y)

= y0~z = Y o U r ( Y 1 , . . . , Y~(I))

Mg(0, Y) = 1 Mg(bl~b2,Y) = Mg(bl,Yt)×Mg(b2,Y2)

where Y0 = Take(1,V) where Yo, y l , . . . , Y , U ) = T a k e ( l + a ( f ) , Y ) where Y1,Y2 = Split(2,Y)

T h e o r e m 13 Let t B b, and let Y be an infinite set of variables such that Y f') V(b) = O. Then there is a substitution a with D(~) C_ Y , such that ~r(Mg(b,Y)) = r t.

613 Note that this means that Mg(b, Y) _
=

{ x , ~-+ M g ( b l , Y 1 ) , . . . , X n ~ Mg(b,,Yn)} where Y1,.--, Y, = Split(n, Y)

This does not yet define Mg(w, Y) uniquely, but we can stipulate a total order o n variables and sort xl, . . . , x~ in that order before using the above definition. We want to use Mg on substitutions as follows. I f p , s 6 T~ with bases bp,bs E Tp, we want to show that if ~ is a complete set of ACU-matchers of bp to bs, then every F-matcher r of p to s is a F-instance of some substitution Mg(w,Y), where w E ~. To make this work, we need some more assumptions. Before we state the main theorem (Theorem 16), we formulate a lemma. L e m m a 15 Let w be a substitution on T~ such that Z(w) : 0, let v be a substitution on T~, let X be a set of variables, and let Y be an infinite set of variables such that Y N :D(~) : I~. I f ~" Bw~ and w _
U

i

e r4}

aE:~

is a complete set of F-marchers of p to s away from V - Y . P r o o f . See [14]. 4.4

•

Matching of Exponents Using a Disjunction System

Our F-matching algorithm is now taking form. For any w that ACU-matches a base of p to a base of s, we form a most general substitution Mg(w, Y) which has w as base, and try to specialize this to a matcher from p to s. We will need to break down a matching problem (p, s), where p and s have a common, ground, base, to the matching ofsubterms. D e f i n i t i o n 17 Let p,s G To,, and let b G T# be a base of both p and s, with V(b) = 0. Choose arbitrarily regular forms for p and s, by letting P = r (Pl,0 ::>fl (Pl,1, *-. , P l , a ( f l ) ) ) X . ' . X (Pm,O~ f m ( P m j , . . . ,Pm,a(f,~))), S =r (81,0::~g1(S1,l,...,81,a(g,)))X'''×(Sn, 0::~gn(sn,i,,..,8n,a(g.))) Since p and s have a common base, m = n. We define D(p, s), the disjunction F-matching system that corresponds to (p, s), as follows. If 7r is a permutation on { 1 , . . . , m}, such that fi = g~(i) whenever 1 < i < m, then the matching system {(Pij, s~(i)j) I 1 < i < rn,

0 < j _< a(f~)}

is an element of D(p, s).

4Note that Mg(w,Y) corresponds to aw,w in [5], provided that Y is the complement of W.

614

The definition does not yet determine D(p, s) uniquely, but the only variation is that the sub-patterns and sub-subjects can be replaced with F-equal ones. So we can simply assume that we have a standard way to choose regular forms for p and s. T h e o r e m 18 If D(p, s) is defined, Mr(p, s) = Mr(D(p, s}). P r o o f . To prove 'D' is straightforward. To prove 'C', use theorem 5. 4.5

P u t t i n g it All T o g e t h e r

We are now ready to match under F. Let (p, s) be two terms in "Y~. We want a method to check whether there is a substitution a, such that a(p) --r s. To solve this, we will have to consider all possible matchers for subproblems, so we might as well describe a method to find a complete set of F-marchers of p to s. If we only care about matchability, we can of course interrupt the generation of top level matchers as soon as one is found. We will, like [5], assume that V(s) = @. Except for the main procedure, the algorithm consists of three mutually recursive procedures for pairs, systems, and disjunction systems, respectively. F u n c t i o n cMpair(p, s); Finds a complete set of F-matchers of p to s away from Return cMp((p, s), Y - V(p)).

V(p),

assuming s ground.

F u n c t i o n cMp((p, s), Y); Finds a complete set of F-matchers of p to s away from V - Y, assuming s ground. Assumes that Y is an infinite set of variables disjoint from V(p). 1. Choose a base

bv of p

and a base b, of s.

2. Let f2 be a finite complete set of ACU-matchers of set can be found by the method of [19].

bp to

b, away from V, such a

3. Let Y1, Y2 = Split(2, Y). 4. Let E = {Mg(w, Y1) [ w E f~}, and for each a e E, let E~ = cMd(D(a(p), s), ]12). 5. R e t u r n U o e s { ( a ' o a ) i v ( , )

[ a'EE~}

•

F u n c t i o n cMd(D, Y); Finds a complete set of F-matchers for a disjunction system D away from V - Y , assuming all subjects ground, and that Y is an infinite set of variables disjoint from V(D). Return USeD cMs(S, Y). • F u n c t i o n cMs(S, Y); Finds a complete set of F-matchers for a matching system S away from V - Y, assuming all subjects ground, and that Y is an infinite set of variables disjoint from V(S). 1. If S = 0, return {Id} (a set containing the identity substitution). 2. If S = {(p, s)} U S', let Y1, Y2 = Split(2, Y) and let E = cMp((p, s), Y1), then return U~c~{(~r' o e)lv(s)la' 6 cMs((r(S'), Y2)}, where the notation a(S') is defined by letting a{(pl, sl), . . . , (Pn, sn)} = {(er(pl) , s l ) , . . . , (cr(pn), sn)}. 1 o

615

The (partial) correctness of cMp can be shown from the one of cMd and from Theorems 16 and 18. It is obvious that the functions cMpair and cMd preserve correctness, and the technique used in cMs is the usual one to solve unification or matching systems, see e.g. [20, Appendix A, Lemma 4.4 and Figure 2]. The termination of our algorithm can be shown by using a well-founded relation >on subjects. If s = r (so =¢- f ( s l , . . . , so(i))) x s', where f E F, then for each sj with 0 < j < a ( f ) , we say that s ~- sj. If s = r 1, then there is no term t such that s :,- t. It can be shown that if t I is an irreducible term, and r is an arbitrary term such that ~ ~- r, then r has an irreducible form which is either 1 or a proper subterm of t~. Thus, if we have a sequence to ~- tl :,- t~ ~- .-., then we can find an irreducible form ti,j. of each ti, such that for each i > 0, ti,l is either 1 or a proper subterm of ti-l,l. Since the sequence must end when a term becomes F-equal to 1, and since we cannot take proper subterms indefinitely, there are no infinite decreasing sequences - - in other words, the ~- relation is well-founded. We extend it to matching problems by letting (p, s) >- (pr, s') iff s ~- s'. Now, when the function cMp is called with a matching problem (p, s), it reduces the problem to a finite number of other matching problems (p~, si), such that (p, s) ~- (Pi, si) for all i, and cMp must therefore terminate. The reduction goes via calls to eMd and cMs, but cMp makes only a finite number of calls to cMd, since ACU-matching is finitary, and cMd makes only a finite number of calls to cMs, since a disjunction system that corresponds to a matching problem can only consist of finitely many matching systems. Therefore, cMpair always terminates with a finite complete set of matchers. 5

Practical

Experience

of Library

Search

In 1988, I implemented a search system that retrieved library identifiers of types Fequal to a given query [13]. The speed of the system was satisfactory, but the examples in Section 1.2 convinced me that F-equality was not always enough in a programming language with polymorphic types. I have now implemented a search system that retrieves library identifiers of types more F-general than a given query. The implementation follows the description in Section 4 closely. The major difference is that the disjunction matching systems are never generated explicitly; the representation used is more like AND-OR-trees. My search system is implemented in Standard ML [12], but for my tests, I have used the Lazy ML [1] library. The test library contains 185 identifiers, but by preprocessing it, I reduced the number of attempted matches to be between 16 and 61, depending on the query. Related ideas can be found in [11]. None of my test queries has retrieved more than 14 identifiers. The time to process a query usually varies between 0.2 and 2.0 CPU seconds, but one complex query (the most specific type of (&) given in Example 3) requires 32 CPU seconds. My implementation can no doubt be made more efficient, but it already works well for resonably complex queries and fairly large libraries. The timings were made using Standard ML of New Jersey on a SUN-360. In [14], you can find some examples of search and ideas on how to reduce the number of unwanted identifiers that are retrieved.

616

6

Unification

in ( S u b s e t s

of) F

Runciman and Toyn has proposed that library identifiers should be retrieved if their types are unifiable with the query [15]. Their reason is that they derive queries automatically from contexts of use, specification laws etc. In [13], I argued that the user should be allowed to indicate, for each variable in his query, whether or not it may be instantiated. In [9], it is reported as an open question whether F-unifiability is decidable, but it is shown (among other things) that • Let P ~ be the equational theory presented by the axioms for F except distributivity. Unifiability in F ~ is NP-complete (and thus decidable), and unification is finitary. • F-matchability is NP-complete. These results are only stated for unification in the presence of free constants. It does not follow immediately that an algorithm for F~-unification can be extended to free function symbols of any arity, but the techniques in [16] might apply. The method in [9] also yields an algorithm that finds finite complete sets of unifiers in the equational theory presented by just AC and currying. Such an algorithm can be extended to free function symbols, since the theory is regular and collapse-free, see e.g. [20]. 7

Summary

and Conclusion

I have argued that when function libraries are searched by means of type, one would like to retrieve functions of types at least as general as the query, modulo canonical CCCisomorphism. To be able to do this, I have developed an algorithm that gives a finite complete set of F-matchers. An implementation of a library search system shows that satisfactory speed can be 'achieved. 8

Acknowledgements

My supervisor, Peter Dybjer, has read through many versions of this paper and given valuable comments; I have recieved further suggestions for improvements from an anonymous referee. I have also benefitted from discussions with Lennart Augustsson. I am indebted to Bernard Lang for sending me his paper and other references, and to G~rard Huet for referring me to Lang. I have also got information, references, and/or software from Tom Blenko, Hans-Jfirgen Bilrckert, Roberto Di Cosmo, Conal Elliott, Claude Kirchner, Giuseppe Longo, Paliath Narendran, Kim H. Pedersen, Gerald Peterson, Frank Pfenning, Andrew Pitts, Erik Tid~n, and Ralph Wilkerson. References [1] L. Augustsson and T. Johnsson. The Chalmers Lazy-ML compiler. The Computer Journal, 32(2), 1989. [2] F. Fages and G. Huet. Complete sets of unifiers and matchers in equational theories. Theoretical Comp. Sci., 43:189-200, 1986. [3] P. Hancock. A type-checker. In S.L. Peyton Jones, The Implementation of Functional Programming Languages, chapter 9. Prentice-Hall, 1987. [4] J.M. Hullot. Associative commutative pattern matching. In Sixth Int. Joint Conf. on Artificial Intelligence, Tokyo, 1979.

617

[5] B. Lang. Matching with multiplication and exponentiation, May 1978. Author's current address: INRIA, Domaine de Voluceau, Rocquencourt, B.P. 105, F-78153 Le Chesnay Cedex, France. E-mail: [email protected] [6] G. Longo, A. Asperti, and R. Di Cosmo. Coherence and valid isomorphism in closed categories. In D.H. Pitt et al., eds., Category Theory and Computer Science, Manchester, 1989. LNCS 389, Springer-Verlag. [7] C.F. Martin. Equational Theories of Natural Numbers and Transfinite Ordinals. PhD thesis 1973. University of California, Berkeley, CA 94720, USA. See also Notices of the Am. Math. Soc., 19(7):A-778-779, Abstract 698-E1, 1972. [8] R. Milner. A theory of type polymorphism in programming. J. of Comp. and System Sei., 17(3):348-375, 1978. [9] P. Narendran, F. Pfenning, and R. Statman. On the unification problem for Cartesian closed categories, 1989. Addresses: P. Narendran, State Univ. of New York at Albany, USA. F. Pfenning and R. Statman, Carnegie Mellon Univ., Pittsburgh, USA. E-mail: [email protected], [email protected], [email protected] [10] G.E. Peterson and M.E. Stickel. Complete sets of reductions for some equational theories. JACM, 28(2):233-264, April 1981. [11] P.W. Purdom, Jr. and C.A. Brown. Fast many-to-one matching algorithms. In J.-P. Jouannaud, ed., Rewriting Techniques and Applications, Dijon, France, 1985. LNCS 202, Springer-Verlag. [12] C. Reade. Elements of Functional Programming. Addison-Wesley, 1989. [13] M. Rittri. Using types as search keys in function libraries. In Fourth Int. Conf on Functional Programming Languages and Computer Architecture, London, 1989. ACM Press, Addison-Wesley. (Part B of [14] is a revised version.) [14] M. Rittri. Searching Program Libraries by Type and Proving Compiler Correctness by Bisimulation. PhD thesis, 1990. Dept. of Comp. Sci., Chalmers U. of Tech. and U. of G6teborg, S-412 96 Gbteborg, Sweden. E-maih rittriQcs.chalmers.se [15] C. Runciman and I. Toyn. Retrieving re-usable software components by polymorphic type. In Fou~th Int. Conf. on Functional Programming Languages and Computer Architecture, London, 1989. ACM Press, Addison-Wesley. [16] M. Schmidt-SchauS. Unification in a combination of arbitrary disjoint equational theories. J. of Symbolic Computation, 8:51-99, 1989. [17] J.H. Siekmann. Unification theory. J. of Symbolic Computation, 7:207-274, 1989. [18] S.V. SoIov'ev. The category of finite sets and Cartesian closed categories. J. of Soviet Math., 22(3):1387-1400, 1983. [19] M.E. Stickel. A unification algorithm for associative-commutative functions. JA CM, 28(3):423-434, July 1981. [20] E. Tid~n. First-Order Unification in Combinations of Equational Theories. PhD thesis, 1986. Dept. of Num. Anal. and Comp. Sci., The R. Inst. of Technol., Stockholm, Sweden. [21] D.A. Turner. Miranda: A non-strict functional language with polymorphie types. In J.-P. Jouannaud, ed., Functional Programming Languages and Computer Architecture, Nancy, France, 1985. LNCS 201, pages 1-16, Springer-Verlag.

Unification in Monoidal Theories Werner Nutt DFKI, Postfach 2080 D-6750 Kaiserslautern, West Germany e-mail: nutt @uklirb.informatik.uni-kl.de

Abstract

We study the unification problem for a class of equational theories that comprises imt)ortant examples like abelian monoids (AC), idempotent abelian monoids (ACI), and abelian groups. Monoidal theories have the common characteristic that unification algorithms are based on solving linear equation systems over a semiring. The close correspondence between unification and linear algebra can be used to characterize the unification type of monoidal theories in purely algebraic terms, and an application of Hilbert's Basis Theorem gives a sufficient criterion for a monoidal theory to be unitary.

1

Introduction

In recent years, unification algorithms for many equational theories have been devised. But in spite of the substantial body of results, the field still lacks abstraction and a reservoir of general methods. In this paper we try to make a first step in the direction of abstraction and generality exploiting techniques and results from linear algebra. We characterize a class of equational theories for which unification is basically equivalent to solving linear equations. We call these theories monoidal because they describe varieties of abelian monoids. This class comprises well-studied theories like that of abelian monoids (AC), idempotent abelian monoids (ACI), and abelian groups (AG). It is well-known that AC-unification amounts to solving linear equations over the natural numbers [LS78, St81, Fo85, B/i86], and unification in abelian groups is done by solving linear equations over the integers [La84]. But it was not clear whether the correlation between equational theories and linear equations is merely accidental or if there is some structural connection. We will show that the latter is the case. To each monoidal theory corresponds a semiring, an algebraic structure that can be thought of as a generalized ring. For instance, to AC corresponds the semiring of natural numbers and to AG the ring of integers. Unification Agorithms for monoidal theories fit into one general schema: solving pure problems is equivalent to solving homogeneous linear equation systems over the semiring, problems with constants correspond to inhomogeneous systems.

619

Applying this schema to AC-unification gives an elegant transformation from ACunification problems to linear equation systems over the natural numbers as illustrated by the following example. Suppose we want to solve the term unification problem Y2+Y2

Yl + Y3 + Y3

--

Yl+Yl+Y3

--" y l + Y 2

where + is an associative and commutative symbol. We reformulate this problem as the task to find a unifier for the homomorphisms a, ~-: ~-AC(Xl, x~) --~ ~'AC(Yl, Y2, Y3) between free AC-algebras given by UXl

~-"

Yl + Y3 + Y3

TXl

=

aX2

=

Yl Jr y l + Y3

TX2

---- Yl + Y2.

Y2 + Y2

T h a t is, we look for some homomorphism 5: ~'AC(Yl, Y2, Y3) --* ~'AC(Zl,. •., Zm) such that 5 a = 5T (see [RB85, Go89] for related ideas to generalize unification in categorical terms). Now we exploit a crucial observation: the free AC-algebras over n generators are isomorphic to cartesian products of n copies of N, the semiring of natural numbers. Moreover, under this identification we can consider a and T as N-linear mappings a, 7: N {x1'~2} --~ N (yl'y~'y3) that are represented by the matrices

C~

=

201

110

The task to find unifiers for ~r and r is now equivalent to finding matrices D solving the linear equation system C~,D

-

CrD

since from every matrix solution one can reconstruct a unifying substitution. A matrix D represents a most general unifer if and only if every vector a satisfying C o a = C.~a can be obtained as a linear combination of the rows of D. Unfortunately, this matrix equation cannot be solved with standard methods known from linear algebra over fields (like e.g. the Gauss algorithm), because the natural numbers form a proper semiring where neither inverses for multiplication nor for addition exist. This situation is typical for the general case. A specific algorithm for solving linear equations has to be found for every given monoidal theory. But a rich supply of methods for such problems is known that can be used for these unification problems. T h e clsoe correspondence between unification and linear algebra can be used to characterize the unification type [Si89] of monoidal theories algebraically: a theory without constants is unitary if the solution spaces of linear equation systems are finitely generated, otherwise it is nullary. An application of Hilbert's Basis Theorem gives a sufficient criterion for a monoidal theory to be unitary without and with constants. In this paper we restrict our attention to unification problems without constants. A more detailed presentation of the theory including the proofs is given in [Nu90].

620

In section 2 we briefly review basic definitions and fix our notation. In section 3 we give an abstract reformulation of unification as unification of homomorphisms rather than of terms. Section 4 presents semirings as the basic structure for linear equations. In section 5 we introduce monoidal theories and discuss their fundamental properties. The heart of the paper is section 6, where we characterize unification problems in monoidal theories in purely algebraic terms and derive a general schema for algorithms.

2

Basic Definitions

We briefly review the necessary notions and notation from equational logic that are used in unification theory. A collection of papers representing the state of the art can be found in the special issue [Ki89]. We assume that two disjoint infinite sets of symbols are given, a set of function symbols (like f, h) and a set of variables (like x, y, z). A signature E is a finite set of function symbols each of which is associated with its arity. Every signature E determines a class of E-algebras and E-homomorphisms. The realization of a E-function symbol f in a Nalgebra A is written as f A We define E-terms and E-substitutions as usual. The set of all E-terms with variables in X forms the free term algebra Tz(X). Substitutions are the homomorphisms between term algebras. An equational theory g = ( E , E ) is a pair consisting of a signature E and a stable congruence E on the set of all E-terms. We will write s = e t or s - t E E if (s, t) E E. Every equational theory g determines a variety of g-algebras. The set of all E-congruence classes ~ of E-terms s E T z ( X ) forms an g-algebra U~(X). The algebra ~'e(X) is free over X in the sense that for every g-algebra A every map f : X --~ A can be uniquely extended to a E-homomorphism c~]: Ye(X) --* A. Since free algebras are unique up to E-isomorphism, we call ~'c(X) the free g-algebra over the set of generators X . Every E-substitution a': T~(X) --+ Tz(Y) gives rise to a E-homomorphism a: ~'e(X) -~ ~'e(Y) if we put ax := ~7~. Conversely, every such E-homomorphism between free g-Mgebras can be obtained from some E-substitution.

3

An Abstract View of Unification

In this paper we consider unification as the unification of homomorphisms instead of terms. Let g = (E, E ) be an equational theory. A unification problem is a pair a, r: 9%(X) --* Ye(Y) of parallel E-homomorphisms between finitely generated free g-algebras. An gunifier of a and r is a E-homomorphism 5: ~e(Y) ~ Ye(Z) such that 5c~ = 57. The E-homomorphism 5 is more general than a E-homomorphism 5': ~'e(Y) --* ~-e(Z') if there exists some E-homomorphism t : 9%(Z) ~ ~e(Z') such that 5 ' = AS. In this case we write 5 _< 5r. We say that 5 is strictly more general than 5 ~ and we write 5 < ~, if 5 < 5~ but not 5' _< 5. The unifier 5 is most general if there is no unifier that is strictly more general. A set U of unifiers is complete if for every unifier 5 there is a 5 ~ E U such that ~ _< 5. A minimal complete set of unifiers is a complete set such that no proper subset is a complete set of unifiers.

621

Following Siekmann [Si89], we divide equational theories into four classes according to their unification type. A theory is infinitary if for every unification problem there exists a minimal complete set of unifiers and nullary otherwise. It is finitary or unitary if there always exists a minimal complete set that is finite or a singleton, respectively. To see how these definitions relate to the traditional concept of unification (cf. [Ki89]) consider a E-equation system F = (sl "- t l , . . . , s ~ - tn). Let X = {Xl,...,x,~} be a set of cardinality n, let Y be the set of variables occurring in F, and a, r: ~'e(X) --* .T'e(Y) be the unique E-homomorphisms satisfying axi = ~ and rx~ = ~. Suppose the E-homomorphism 6: Y e ( Y ) --~ Y e ( Z ) is given by the substitution ~'. Then we have ~a = ~r iff 8~Si =e ~tt~ for i = 1 , . . . , n . In other words, 3 is a unifier of a and T i f f St is a unifying substitution for F. Conversely, it is easy to see that for every pair a, r of parallel holnomorphisms there exists an equation system F such that unifying substitutions for F give rise to unifiers of a, v and vice versa. Moreover, one easily checks that our relation < is an abstract version of the usual instantiation preorder on substitutions. Thus traditional term unification and unification of homomorphisms are essentially the same.

4

B a s i c S t r u c t u r e s for Linear E q u a t i o n s : Semirings

The theory of linear equations is usually developed as the theory of fields, vector spaces, and linear mappings. In order to deal with a wide class of unification problems we need a generalized linear algebra. It is well known that for AC-unification one has to solve linear equations over natural numbers. Natural numbers do not form a field since inverses for addition and multiplication do not exist. They form an algebraic structure called semiring. We briefly present those definitions and results on semirings that we will need in the sequel. 4.1

Semirings

A semiring $ is a tuple (8, +, 0, -, t) such that (S, +, 0) is an abelian monoid, ($,., 1) is a monoid, and all a, fl, 7 E $ satisfy the equalities

1.

2.

(a+fl).-/=a.7+fl.

7

3.

0.c~=a.0=0.

=

We call the binary operations " + " and "." the addition and the multiplication of t h e semiring, respectively. The elements 0 and 1 are called zero and unit. A semiring is commutative if its multiplication is commutative. Semirings are different from rings in that they need not be groups with respect to addition. E x a m p l e s 4.1 Natural numbers form a semiring IN. Every ring is a semiring. In particular, the ring of integers Z and the ring of gaussian numbers Z ® iZ, consisting of complex numbers m + i n where m, n E Z, are semirings. The set {0, 1} becomes a semiring B if we define 1 + 1 := 1 and extend addition and multiplication as required by the above axioms. For every semiring $ one can construct the semiring SIX] of polynomials in the indeterminate X with coefficients from 8.

622

4.2

Modules

Modules over semirings are a generalization of vector spaces over fields. As in the case of non-commutative fields, where one has to distinguish between left and right vector spaces, we will define left and right modules. A left module over a semiring S is an abelian monoid (M, +, 0) together with a scalar multiplication S X M ~ M

(a,m) ~ am

such that for all a,/~ E S and m, n E M the following equalities hold:

1. (o~ . f3)m = a ( # m )

4.

aO = O

2.

(a+j3)m=am+flm

5.

lm=m

3.

a ( m + n) = a m + a n

6.

0m=0.

Right modules over S are defined in the same way with the only exception that equality (1) is replaced by the equality

1'. (a. #)m = fl(am). In a left module, semiring elements are applied to the left of module elements. Analogously, one could define right modules as structures where semiring elements are applied to the right of module elements. The only to the definition of left modules, that is not merely notational difference, would be in the analogue of equality (1), which would be m ( a . ~) = ( m a ) # . But this is equivalent to equality (1'). E x a m p l e 4.2 For every finite set X the cartesian product S x is turned into a left (right) S-module if we define the left scalar multiplication by a(fl~:)~ex := ( a - flx)~ex (and the right one by a(~:)~:ex := ( # , . a ) , z x ) . The y-th unit vector % E S x is the tuple (a~:),ex where ay = 1 and a , = 0 for x # y. Next we introduce structure preserving mappings between left (right) modules M, N. A map a: M --* N is left (right) linear if all a E S and all m, m' E M satisfy the equalities:

I.

a ( m + m') = a m + ~m'

2.

~(~m)

3.

aO=O

= ~m

For commutative semirings, there is no difference between left and right modules and left and right linear mappings. A left (right) module F is free over a set of generators X C_ F if for every left (right) module M and every function f : X ~ M there is a unique left (right) linear map aS: F --* M such that aS(z ) = f ( z ) for all x E X. If F , F ' are left (right) S-modules such that F is free over X and F ' is free over X', then F and F ' are isomorphic if and only if there exists a bijection between X and X'. P r o p o s i t i o n 4.3 If X is finite then S x with left (right) scalar multiplication is the free left (right) S-module over {e~ I x E X } .

623

4.3

Matrices

We compute with linear mappings by means of matrices: a left linear mapping (r: S x --* 8 Y can be described by an X x Y-matrix C~ with entries from S as follows: the x-th row of C~ = (7=~)=ex,yey contains the components of ere=, the image of the x-th unit vector e, under (r. Following the usual rules of matrix and vector multiplication we have a a = aC~ where a E 8 X is written as a row vector. Conversely, every X × Y-matrix C defines a left linear map (re: 8 x --~ St" by a c a := aC. If cr is right linear we have to slightly modify the construction. We take C~ as the Y × X - m a t r i x containing in the x-th column the components of ae=. Then (ra = C~a where a E S X is written as a column vector. For Commutative semirings both constructions are equivalent. It is the second one that is usually chosen in linear algebra over commutative fields. If (re: S x --* $ Y is left (right) linear, then the dual map of (r is the right (left) linear map a*: S r --* S x defined by (r*a = C~a (= aC~). Note that (r(r)* = (r'r*.

5

Monoidal Theories

Monoidal theories generalize AC, ACI, and the theory of abelian groups. It will turn out that unification problems in monoidal theories are equivalent to systems of linear equations over a certain semiring.

5.1

Definitions

An equational theory g = (~, E ) is m o n o i d a l if 1. ~ contains a constant 0, a binary symbol +, and all other function symbols are unary 2. + is associative and commutative 3. 0 is the identity for +, that is 0 + x =c x + 0 =~ x 4. every unary symbol h is a homomorphism for + and 0, that is h ( x + y ) =~ h ( x ) + h ( y ) and h(0) =~ 0. A monoidal theory may contain arbitrary additional equalities over ~, the only requirement is, that at least the above laws hold. Monoidal theories describe varieties of abeIian monoids with homomorphisms. E x a m p l e s 5.1 The theory AC, where EA¢ = {+: 2, 0: 0} and EA¢ is generated by associativity, commutativity, and identity laws for + and 0 describes the variety of abelian monoids. It is the least monoidal theory in that its signature contains no unary symbol and only the equalities required by the definition hold. Adding the idempotence law x + x -'-- x to AC we obtain the theory ACI of idempotent abelian monoids. Adding to AC the symbol " - " and the equality x + ( - x ) -" 0 gives the theory of abelian groups (AG). Adding to AC or AG a homomorphism symbol i results in the theories of abelian

624

monoids or groups with homomorphism (ACH or AGtt), respectively. Adding to ACH the equality x + i(i(x)) "- 0 gives a theory that we denote as GAUSS. A monoidal theory C is a theory with commuting homomorphisms if for all unary function symbols h, h ~ E E we have h(h'(x)) =c h~(h(x)), h monoidal theory E is a group theory if for some term t we have x + t =E 0. Intuitively, in a group theory inverse elements for addition exist. All our examples are theories with commuting homomorphisms, and AG, AGH, and GAUSS are group theories.

5.2

M o n o i d a l T h e o r i e s Define S e m i r i n g s

It is well-known that AC-unification amounts to solving linear equations over N [LS78, St81, Bfi86, Fo85] and unification in abelian groups is done by solving linear equations over Z [La84]. On these grounds it is natural to ask whether the correlation between equational theories and semirings is merely accidental or if there is some structural connection. We will show that the latter is the case. To every monoidal theory E one can canonically associate a semiring S~ that extends the operations specified by the signature of C.

General Assumption. In the rest of the paper we assume that E = (~, E) is a monoidaI theory. Let 1 be a distinguished variable symbol. We define a multiplication on Tz(1) by s . t := [1/t]s for terms s, t E Tg(1). In other words, the product s . t is obtained from s by replacing all occurrences of 1 with t. E x a m p l e s 5.2 If s e T~(1), then 1. s = [1/s]l = s and s . 1 = [1/1]s = s. Hence, the symbol 1 is a unit. If h is a unary function symbol, then h(1). s = [1/s]h(1) = h(s). Hence, left multiplication by h(1) is the same as applying h. The operation "." mimics multiplication of natural numbers modulo associativity and commutativity of + . For instance, (1 + 1). (1 + 1) = [1/(1 + 1)](1 + 1) = (1 + 1) + (1 + 1), which can be read as "two times two is four". C o n s t r u c t i o n 5.3 Let Se be the quintuple (~'e(1), +, 0 , . , 1-) where 0, 1 are the congruence classes of 0 and 1 in ~'e(1), " + " is the addition on .To(l) defined by ~ + t :-- s + t, and "." is the multiplication on 9v~(1) defined by ~. t := s- t. Using the laws that hold in monoidal theories it is straightforward to verify the following theorem. T h e o r e m 5.4 Ge is a semiring. We call Se the canonical semiring of C. The canonical semiring doesn't come in like the famous rabbit pulled out of the magician's hat. It is isomorphic to the semiring of E-homomorphisms ~e(1) --~ 9vc(1) where the zero is the constant mapping 0, the unit is the identity map, addition is defined pointwise and multiplication is composition in reverse order. We prefer to define Se by operations on terms as above because we find this more intuitive.

625 E x a m p l e s 5.5 The canonical semirings of the theories AC, ACI, AG, GAUSS, ACH, and AGH are isomorphic to N, B, Z, Z ~3 iZ, N[X], and Z[X]. As seen in the examples, the canonical semiring SE mirrors properties of g. P r o p o s i t i o n 5.6 1. SE is commutative if and only if g is a theory with commuting homomorphisms 2. Se is a ring if and only if C is a group theory. Finally we show that the concepts of monoidal theory and semiring have the same generality. P r o p o s i t i o n 5.7 For every semiring S there exists a monoidaI theory g such that S and Se are isomorphic. Proof. If S is a semiring, let E be the signature containing the symbols 0 and + and for every s E S a unary symbol hs. Let E be the set of equalities that hold over $ if 0 and + are interpreted as zero and addition and every unary symbol h8 is interpreted by hS~(a) = s • a for all a E S. Then it is easy to see that g = (E, E ) is a monoidal theory such that S and Se are isomorphic. []

5.3

Algebras and M o d u l e s

Next we show that it is just a m a t t e r of perspective whether one views an algebraic structure as an C-algebra or as a left Sc-module. Theorem

5.8 Let A be an S-algebra. Then there exists a unique scalar multiplication

Sex A ~ A

(-$, m) ~ ~ m

turning A into a left Se-module such that addition and zero are inherited from the algebra structure of A and h(1)a = ha(a) for all unary function symbols h and all a E A. Proof. To show existence, consider for every a C A the unique Z-homomorphism e~: ~-c(1) ~ A satisfying e~]- = a. Then it is easy to verify that ~a := ca~ defines a scalar multiplication as required, turning A into a left Se-module. To show uniqueness suppose that o:Se x A --* A is a scalar multiplication turning A into a left Se-module such that h(1)a = hA(a) for all a E A. Then ¢ ~ := ~oa defines a E-homomorphism ¢~: 9%(1) --* A satisfying Ca]- = a. Hence ¢~ = ~ , since 5%(1) is free over {1}, which proves the claim. [] We denote the left Se-module obtained from the g-algebra A as A m°d. Conversely, every left SE-module M can be turned into an g-algebra M ~ag if addition and zero are inherited from the module structure and if every unary function symbol h is interpreted as hM(m) = h(1)m. Transforming £-algebras into So-modules and Se-modules into £algebras behave like inverse operations.

626

P r o p o s i t i o n 5.9 I f A is an E-algebra and M is an Se-module, then (Am°d) ~lg = A and (Malg) m°d = M. Viewing S-algebras as left Se-modules and vice versa can be extended to structurepreserving mappings.

P r o p o s i t i o n 5.10 1. I f A, B are S-algebras and a: A ---+ B is a E - h o m o m o r p h i s m , then is left linear.

~:

A m°d -'-+ B m°a

2. I f M , N are left S e - m o d u l e s and a: M -~, N is left linear, then c~: M ~ag --* N ~lg is a E-homomorphism.

Free algebras and modules are defined by the existence of certain structure preserving maps. Since the latter remain invariant, so do free objects. C o r o l l a r y 5.11 If X is a finite set, then 2rc(X) ~°d is the free left $e-raodule over X and s is the f ee E-algebra over I x e x}. As a consequence of this corollary we obtain canonical isomorphisms between the algebras 2re(X) and ,gx~ag and the left modules S x and 2re(X) m°d if we identify the generators x E X with the unit vectors e~, x E X.

6

Unification

We saw that we can canonically identify free S-algebras and free left Se-modules and that this identification extends to homomorphisms and linear maps. This identification allows us to transfer unification problems into the framework of linear algebra. E x a m p l e 6.1 Consider the term unification problem

i( 1) + y3 =" y2 + Yl + Y3 + Y3 --

Yl + i(Y2)

for the theory GAUSS. Let X = { x l , x : } and Y = {yl, y2, y3}. Define Eancss-homomorphisms Or, T: . ~ ' G A U s s ( X ) ""+

9C'GAUss(Y)

by the equations axl

=

i(y,)+y3

~x~ =

y~+i(y2)

crx2

=

Yl -'k Y3 '{- Y3

TX2

Yl + i(y2).

=

A substitution 5' is a GAUSS-unifier of the term unification problem if and only if the corresponding EcAuss-homomorphism 5 is a unifier of a and r. Since .T'GAUss(X) m°d is isomorphic to (Z @ i Z ) x and 2rGAUSS(Y)~°d to (Z @ i Z ) Y, we can view a and r as the left linear maps given by the matrices

627

C~

=

102

1

i

0

Now, 6 is a unifier of a and r if and only if it is described by a m a t r i x C~ such that CoC~ = C~C~.

6.1

C h a r a c t e r i z a t i o n of U n i f i e r s

Our identification allows us to study unification in monoidal theories as unification of linear m a p s rather than of E-homomorphisms. In the following we assume that all Eunification problems are already transferred into problems for left linear maps. Let a, T: Sex ~ S ~ be right linear. The kernel of a and r is the set ker(a, 7-):= {a • s x [ aa = Ta}. T h e kernel of a and T is a right submodule of Sex. The image of a is the set i m a := {b • s Y ] 3 a • s x . a ( a )

- b}.

T h e image of a is a right submodule of S~'. We start with a characterization of the instance relation between left linear m a p s in t e r m s of kernels and images of their dual maps. T h e o r e m 6.2 Let 6: Sex ---+ S ~ and y: Sexm ---* S z be left linear. equivalences hold:

1. 6 < y

¢==~

im y* C im 6*

2. 6 < y

~

ira rl* is a proper subset of im 6*.

Then the following

Proo£ 1. "=C' If 6 _< 7/, then 7/= A6 for some A: Sev --* S z. Hence 71" = 6*A*, which implies imy* = 6*(imA*) C_ 6"(8~) = ira6*. " ~ " It suffices to show that there is a right linear m a p #: S z __. $ ~ such that 5"# = 7/*, since then #*6 = 7/. Let ez, z • Z, be the unit vectors o f $ z. S i n c e i m y * _ i m 6 * , i t follows t h a t y*ez • ira6* for all z • Z. Hence, there exist vectors az • 8 ~ such that 6*a~ = y*ex. Define # by #ez = az. Then 6*#e~ = q*e~. Since 6"# and y* agree on the generators of s z , they are equal. 2. T h e claim is a trivial consequence of statement (1). [] T h e next theorem characterizes unifiers. T h e o r e m 6.3 Let a, T: $ex --* Sev and 6: $ ~ --* S z be left linear. equivalences hold:

1. ~ is a unifier of a and T

~

Then the following

im 6" C ker(a*, T*)

2. 6 is a most general unifier of a and T

-'. '-

im6* = ker(a*,T*).

628

Proof. 1. 5 is a unifier of a and r ~ 5a = 6r 4==~ a*6* = r*5* 4=~ Va E S z . a*~*a = T*5*a ¢::=# VbE imh*.a*b = v*b .'. '. imh* C_ ker(a*,r*). 2. "=~" Suppose 5 is a unifier of a and r and there exists some a E ker(o'*, r*) such that a ~ imh*. Define r/:$Y --* S~{~} by r/*e~ = a. Then imr/* C_ ker(c~*, r*), and therefore 7? is a unifier of a and r by part (1). Since a E imr/* and a ~ imP*, it follows from Theorem 6.2 that 8 is not more general than q. "¢=" Suppose imh* = ker(a*,T*). We know by part (2) that for every unifier 7? we have imp* C ker(a*, r*) = imh*. By Theorem 6.2, 5 is more general than r]. [] C o r o l l a r y 6.4 Every E-unification problem is solvable by the constant map O.

Proof. Since ~ = 0, it follows that im-O* = {0} C ker(a*, r*).

[]

Intuitively, 5 is a most general unifier of a and r if 5* parameterizes the submodule ker(a*, r*) of S Y. Whether this is possible or not depends on the size of ker(a*, r*). To formalize this idea we need some definitions. Let S C ,.qx. The submodule generated by S is [S] = { ~ l a ~ a i I n E N, a~ E ,-qc, ai E S}. It consists of all linear combinations of elements of S. A submodule M of $Y is finitely generated if M = [S] for some finite set S C M. T h e o r e m 6.5 ( T y p e U n i t a r y ) Let a, r:,qx ~ ,q[ be left linear. There exists a most general unifier of a and r if and o n l y / f ker(a*, r*) is finitely generated.

Proof. 1. "=~" If 5: S y ---* S z is a most general unifier of a and T, then ker(a*, r*) = imh* = 5*(SZ). Since S z is generated by the set of unit vectors {ez I z E Z}, it follows that ker(rr*, r*) = ~*(Sz ) is generated by the finite set {5*e~ } z E Z}. "¢=" If ker(a*, r*) is generated by the finite set {a~ I z E Z}, then define 5 : 8 / --* S z by 5*e, = a,. Since S z is generated by the unit vectors e~, it follows that imh* = 5"($ z ) is generated by the vectors 5*ez = az. Hence, we know that imh* = ker(a*,r*). By Theorem 6.3, 5 is a most general unifier of a and r. [] T h e o r e m 6.6 ( T y p e N u l l a r y ) Let or, r: $ x __, SY be left linear maps. For every unifier r~ of or and T there exists a strictly more general unifier 5 if and only if ker(cr*, v*) is not finitely generated.

Proof. "=~" If ker(a*, r*) is finitely generated, then by Theorem 6.5 a most general unifier 5 of a and v exists. Hence, there doesn't exist any unifier strictly more general than 5. "¢=" Let r/: S~ --* S z be a unifier of a and r and suppose that ker(¢*, r ' ) is not finitely generated. Since/mr/* is generated by the finite set {r/*ez I z E Z}, it follows that imp* is a proper subset of ker(a*, r*). Hence, there exists some a E ker(¢*, r*) \ imp*. Suppose z' ~ Z and let 5: ,.qY --* ,qz~{z'} such that 5*ez = r/*ez for z E Z and 5*ez, = a. Then imh* C ker(cr*, T*), which implies that 5 is a unifier of of a and r. Furthermore, imp* is a proper subset of imh*, which implies t h a t / i is strictly more general than ~/. E] C o r o l l a r y 6.7 ( U n i t a r y - O r - N u l l a r y )

A monoidal theory is either unitary or nullary.

629

• let C~, C~ be the matrices describing a, r: Sex ~ $ ~ • find a generating set {a~ I z e Z} of solutions for C~,a - C~a * for every finite set V C Z let Dv be the matrix whose v-th column is a., v E V • let ~v: S Y --~ ,¢y be given by Dy • if Z is finite then 5z is a most general unifier else {by I V C_ Z, V finite} is a complete set of unifiers Figure 1: Schema for a unification algorithm for a monoidal theory g E x a m p l e s 6.8 It is well known that the theories AC [LS78], ACI [BB86], and AG [LAB4] are unitary. Recently Baader proved that ACH is nullary [Ba89a]. Analyzing the proofs of Theorems 6.5 and 6.6 we can derive a schema for unification algorithms which is shown in Figure 1. We illustrate the algorithm with an example. E x a m p l e 6.9 Consider the GAUSS-unification problem in example 6.1. Since Z • iZ is a ring, we can subtract matrices. Thus ker(a*, r*) = {a e Z (D iZ I (C~ - C~)a = 0}. The solutions of the the corresponding equation system 1

0

-i

2

a~

=

0

a3

are generated by the vector a -- (1 -}- 2 i , - 2 , - i ) .

Therefore, a most general unifier

5: 70A,ss(Y) -* 7aAUSS(z) is given by the equations

5yl -~ z + i(z + z)

5y2 = i(i(z ÷ z))

@3 = i(i(i(z))).

It is obvious how to obtain a unifying substitution from 5.

6.2

Noetherian Theories

In the following we are interested in sufficient conditions for a monoidal theory to be unitary. Bfirckert et al. [BH89] called an equational theory g = (~, E) noetherian if there exists no infinite strictly decreasing sequence ch > a2 > ... of Z-homomorphisms a~: ~'e(X) --~ ~e(Y~), n e N. Obviously, a noetherian theory is not nullary. Since monoidal theories are either unitary or nullary we have thus identified a class of unitary monoidal theories. 1In [Kn68] an algorithm for solving linear equations over the integers is given. It is straightforward to generalize this algorithm to arbitrary euclidean rings.

630 P r o p o s i t i o n 6.10 A noetherian monoidal theory is unitary. In algebra so-called noetherian rings have been thoroughly studied (for example see [Ja80]). Surprisingly, this concept is intimately related to the concept of a noetherian theory. We start with the appropriate generalization for semirings. A semiring S is noetherian if for finite sets X every right submodule of S x is finitely generated. As an example the ring Z of integers is noetherian. The following theorem shows how noetherian monoidal theories and noetherian semirings are connected. T h e o r e m 6.11 A monoidal theory $ is noetherian if and only if ~qe is a noetherian semiring.

Proof. Since we are dealing with monoidal theories we can identify E-homomorphisms between free algebras and left linear maps between free left modules. If c%: S x ~ sY., n C N, is a strictly decreasing sequence of left linear maps, then M := U~__I im a* is a right submodule of S x that is not finitely generated. Conversely, if M is a right submodule of S x that is not finitely generated one can inductively define a sequence of left linear maps cry: S x ~ sY" where lY I = n such that ima~ G M and ima~ is a proper subset of ima*+l. By Theorem 6.2, we know that al > a2 > ... is an infinite strictly decreasing sequence. [] This characterization gives us a first hint how to identify noetherian theories. C o r o l l a r y 6.12 A monoidal theory $ is unitary if SE is finite.

Proo[. If Sc is finite, then all right submodules of S x are finite and therefore finitely generated. [] Since SACI has only two elements this corollary proves that ACI is unitary without referring to an algorithm. Noetherian semirings and rings have important inheritance properties. T h e o r e m 6.13 Every quotient semiring of a noetherian semiring is noetherian. T h e o r e m 6.14 ( H i l b e r t ' s B a s i s T h e o r e m ) If S is a noetherian commutative ring, then S [ X I , . . . , A ~ ] , the ring of polynomials over $ in n indeterminates, is a noetherian commutative ring. These theorems can be translated into criteria for noetherian monoidal theories. If we add arbitrary equalities to a noetherian monoidal theory we obtain again a noetherian theory. C o r o l l a r y 6.15 Let $ = (E, E) be a noetherian monoidal theory. If E t is a stable congruence on E-terms that contains E, then $' := (E, E') is again a noetherian monoidal theory.

631

Proof. Clearly, C~ is again monoidal. Since the semiring Sc, is a quotient of $c, it is again noetherian and so is g'.

[]

This result is in sharp contrast to the general situation. Adding equalities to a noetherian theory can produce a theory that is no longer noetherian. For instance, the theory of associativity is noetherian, but adding idempotence produces a nullary theory [Ba86, ScS6]. C o r o l l a r y 6.16 A group theory with finitely many commuting homomorphisms is noethe-

rian. Proof. Since the ring of integers Z is noetherian, so is the ring Z[X1,... ,X~] of integer polynomials in n indeterminates by Hilbert's Basis Theorem. If g is a group theory with commuting homomorphisms then Sg is a commutative ring. Let h i , . . . , h~ be the homomorphism symbols of g. Then h i ( e ) , . . . , h~(e) are elements of Sg, and the evaluation map Z[X1,... ,X~] ~ Sg, p ( X , , . . . ,X~) ~-~ p ( h l ( e ) , . . . , h~(e)) is a surjective ring homomorphism. Hence, SE is the quotient of a noetherian ring and therefore again noetherian. [:3 E x a m p l e s 6.17 By the preceding corollary, AGH and GAUSS are noetherian. ACH is a theory with commuting homomorphisms, but it is not a group theory. As shown in [Ba89a], it is nullary and therefore not noetherian. Unfortunately, Hilbert's proof is not constructive. No general method is known to construct a generating set for submodules of S[X1,... ,X,~] x from generating sets for submodules of S x. Therefore, devising unification algorithms for group theories with commuting homomorphisms is still an open problem. Baader [Ba89b] gave a method for solving linear equations over the ring Z[X1,..., X,~] thus furnishing the cornerstone of a unification algorithm for the theory of abelian groups with commuting homomorphisms.

7

Conclusion

Monoidal theories encompass many theories that turned out to be useful in automated deduction like AC, ACI, and abelian groups. They have as common characteristic that unification problems can be reduced to linear equation systems over a semiring. For problems without constants the system is homogeneous. If constants are present it is inhomogeneous. In the constant free case, problems either have a most general unifier, or arbitrarily general unifiers exist. In the constant case we have a similar result for group theories: a group theory with constants has the same unification type as it has without constants. In particular, group theories with finitely many commuting homomorphisms are unitary without and with constants [Nu90]. Since the reduction of a given unification problem to linear equations is the same for all monoidal theories we are able to set up a schema for unification algorithms that has to be filled with a solution procedure for linear equations in order to give a complete unification algorithm. As a first application, Baader [Ba89b] obtained unification algorithms for

632

abelian groups with commuting and noncommuting homomorphisms, devising procedures for solving linear equations over the rings Z[Xa,..., X~] and Z ( X a , . . . , X~). Baader [Ba89a] studied unification in so-called commutative theories which he defined by categorical properties. It can be shown that modulo a signature transformation monoidal and commutative theories are the same. Therefore all results on monoidal theories apply to commutative theories as well. Baader characterized the unification type of commutative theories using techniques from category theory. In contrast to his work, our approach clarifies the algebraic structure of unification problems, and thus allows directly to use algebraic techniques in designing unification algorithms for these theories.

References [Ba86] [Ba89a] [Ba89b] [BB86] [BH89] [Bfi86] [FH86] [Fo85] [Go89] [Ja80] [Ki89] [Kn68] [LAB4] [LS78] [Nu90] [RB85] [Sc86] [Si89] [St81]

F. Baader, "The Theory of Idempotent Semigroups is of Unification Type Zero", J. Automated Reasoning 2, 1986. F. Baader, "Unification in Commutative Theories", in C. Kirchner (ed.), Special Issue on Unit~cation, J. Symbolic Computation, 1989. F. Baader, "Unification in Commutative Theories, Hilbert's Basis Theorem, and GrSbner Bases", preprint, 1989 F. Baader, W. Biittner, "Unification in Commutative Idempotent Monoids", preprint, 1986, to appear in TCS. H.-J. Biirckert, A. Iierold, M. Schmidt-Schau~, "On Equational Theories, Unification, and Decidability", in C. Kirchner (ed.), Special Issue on Unification, J. Symbolic Computation, 1989. W. Biittner, "Unification in the Data Structure Multiset'. J. Automated Reasoning 2, 1986. F. Fages, G. Huet, "Complete Sets of Unifiers and Matchers in Equational Theories", TCS 4a (2,3), 1986. A. Fortenbacher, "An Algebraic Approach to Unification under Associativity and Commutativity", LNCS 202, 1985. J. Goguen, "What Is Unification?", in H. Ait-Kaci, M. Nivat (eds.), ResoIution of Equations in Algebraic Structures, Academic Press, 1989. N. Jacobson, Basic Algebra II, Freeman, San Francisco 1980. C. Kirchner (ed.), Special Issue on Unification, J. Symbolic Computation, 1989. D.E. Knuth, The Art of Computer Programming, Vo1.1, Addison Wesley, 1968. D. Lankford, G. Butler, B. Brady, "Abelian Group Unification Algorithms for Elementary Terms", Contemporary Mathematics 29, 1984. M. Livesey, J. tI. Siekmann, "Unification of Sets and Multisets', SEKI-Report, Universit£t Karlsruhe 1978. W. Nutt, "Unification in Monoidal Theories", SEKI-Report, Universit~t Kaiserslautern 1990. Also presented at 2nd International Workshop on Unification, Val d'Ajol, France, 1988. D.E. Rydeheard, R. M. Burstall, "A Categorical Unification Algorithm", LNCS 240, 1985. M. Schmidt-Schau~, "Unification under Associativity and Idempotence is of Type NuUary', J. Automated Reasoning 2, 1986. J. It. Siekmann, "Unification Theory: A Survey", in C. Kirchner (ed.), Special Issue on Unit~cation, Journal of Symbolic Computation, 1989. M . E . Stickel, "A Unification Algorithm for Associative-Commutative Functions", J. ACM 28, 1981.

A S c i e n c e of R e a s o n i n g : E x t e n d e d A b s t r a c t * Alan Bundy Department of Artificial Intelligence University of Edinburgh Edinburgh, EH1 1HN, Scotland Email: [email protected], Tel: 44-31-225-7774

Abstract How can we u n d e r s t a n d reasoning in general and m a t h e m a t i c a l proofs in particular? It is argued t h a t a high-level understanding of proofs is needed to c o m p l e m e n t the low-level u n d e r s t a n d i n g provided b y Logic. A role for c o m p u t a t i o n is proposed to provide this high-level understanding, namely by the association of proof plans with proofs. Criteria are given for assessing the association of a p r o o f plan with a proof.

1

Motivation: proofs

t h e u n d e r s t a n d i n g of m a t h e m a t i c a l

We a r g u e t h a t Logic 1 is not enough to u n d e r s t a n d reasoning. It provides only a lowlevel, step b y step understanding, whereas a high-level, strategic understanding is also required. M a n y c o m m o n l y observed p h e n o m e n a of reasoning cannot be explained without such a high-level understanding. Furthermore, a u t o m a t i c reasoning is impractical w i t h o u t a high-level understanding. We p r o p o s e a science of reasoning which provides b o t h a low- a n d a high-level understanding of reasoning. It combines Logic with the concept of proof plans, [Bundy 88]. *The research reported in this paper was supported by SERC grant GR/E/44598 and an SERC Senior Fellowship to the author. I would like to thank other members of the mathematical reasoning group at Edinburgh for feedback, especially Frank van Harmelen, Colin Phillips, Mitch Harris and Toby Walsh. I am grateful for comments on the first draft of this paper from two anonymous referees. The full version of this extended abstract will appear in ~Computational Logic: Essays in Honor of Alan Robinson", MIT Press, forthcoming. 1We adopt the convention of using uncapitalised 'logic' for the various mathematical theories and capitalised 'Logic' for the discipline in which these logics are studied.

634

We illustrate this with examples f r o m m a t h e m a t i c a l reasoning, but it is intended t h a t the science should eventually a p p l y to all kinds of reasoning.

2

T h e N e e d for H i g h e r - L e v e l E x p l a n a t i o n s

A p r o o f in a logic is a sequence of formulae where each formula in the sequence is either a n axiom or is derived from earlier formulae in the sequence b y a rule of inference. E a c h m a t h e m a t i c a l theory defines w h a t it m e a n s to be a formula, an axiom or a rule of inference. T h u s Logic provides a low-level explanation of a m a t h e m a t i c a l proofl It explains the p r o o f as a sequence of steps and shows how each step follows f r o m previous ones by a set of rules. Its concerns are limited to the soundness of the proof, and to the t r u t h of proposed conjectures in models of logical theories. While Logic provides an explanation of how the steps of a proof fit together, it is inadequate to explain m a n y c o m m o n observations a b o u t m a t h e m a t i c a l proofs. • M a t h e m a t i c i a n s distinguish between understanding each step of a proof and understanding the whole proof. • M a t h e m a t i c i a n s recognise families of proofs which contain c o m m o n structure. • M a t h e m a t i c i a n s use their experience of previously encountered proofs to help t h e m discover new proofs. • M a t h e m a t i c i a n s distinguish between 'interesting' and ' s t a n d a r d ' steps of a proof. • M a t h e m a t i c i a n s often have an intuition t h a t a conjecture is true, but this intuition is fallible. • Students of m a t h e m a t i c s , presented with the same proofs, learn from t h e m with varying degrees of success.

3

C o m m o n S t r u c t u r e in P r o o f s

Several researchers in a u t o m a t i c t h e o r e m proving have identified c o m m o n s t r u c t u r e in families of proofs. For instance, [Bundy & W e l h a m 81] describes the c o m m o n s t r u c t u r e in solutions to symbolic equations. This c o m m o n structure was i m p l e m e n t e d in a process of recta-level inference which guided the search for solutions to equations. [Bundy et al 88] describes the c o m m o n structure in inductive theorems a b o u t natural numbers~ lists, etc. This c o m m o n structure was i m p l e m e n t e d as an inductive proof plan which was used to guide the search for proofs of such theorems.

635 [Bledsoe et al 72] describes the common structure in theorems about limits of functions in analysis. This common structure was implemented as the limit heuristic and used to guide the search for proofs of such theorems. [Wos & McCune 88] describes the common structure in attempts to find fixedpoints combinators. This common structure was implemented as the kernel method and used to guide the search for such fixed-points. [Polya 65] describes the common structure in ruler and compass constructions. This common structure was implemented by [Funt 73] and used to guide the search for such constructions.

4

Proof Plans

Common structure in proofs can be captured in proof plans. A proof plan consists of two parts: a tactic and a method. A tactic is a procedure which constructs part of a proof by applying a sequence of rules of inference. High-level tactics are defined in terms of lower-level sub-tactics. The lowest level tactics will apply individual rules of inference. A method is a partial specification of a tactic. It consists of preconditions which must be satisfied before the tactic is executed and some effects which will be true provided the tactic application is successful. Proof plans have been implemented within the OYSTER-CLAMsystem, [Bundy et al 88]. OYSTER is a theorem prover for Intuitionist Type Theory. CLAMis a plan formation program which has access to a number of general-purpose tactics and methods for inductive proofs. This system has been used to control the search for inductive proofs about natural numbers and lists. CLAMconstructs a special-purpose proof plan for each conjecture out of its methods and tactics. The tactic of the proof plan is then executed. It instructs OYSTER to build a proof of the conjecture. The search for a proof plan at the meta-level is considerably cheaper than the search for a proof at the object-level. This makes proof plans a practical solution to the problems of search control in automatic theorem proving.

5

T h e H i g h - L e v e l U n d e r s t a n d i n g of P r o o f s

Thus a high-level explanation of a proof of a conjecture is obtained by associating a proof plan with it. The tactic of this proof plan must construct the proof. The method of this proof plan must describe both the preconditions which made this tactic appropriate for proving this conjecture and the effects of this t a c t i c s application on the conjecture. It must also describe the role of each sub-tactic in achieving the preconditions of later sub-tactics and the final effects of the whole tactic. In fact, this association provides a multi-level explanation. The proof plan associated with the whole proof provides the top-level explanation. The immediate sub-tactics and

636 sub-methods of this proof plan provide a medium-level explanation of the major subproofs. The tactics and methods associated with individual rules of inference provide a bottom-level explanation, which is similar to that already provided by Logic. The general-purpose tactics and methods which we will use to build proof plans, and the association of proof plans with proofs will constitute the theories of our science of reasoning. This extends the way in which logical theories and the association of logical proofs with real proofs and arguments, constitute the theories of Logic (especially Philosophical Logic). Just as Logic also has meta-theories about the properties of and relations between logical theories, we may also be able to develop such meta-theories about proof plans.

6

W h a t is t h e N a t u r e o f our S c i e n c e o f R e a s o n i n g ?

Before we can dignify this proposed study of the structure of proofs with the epithet science we must address a fundamental problem about the nature of such a science. Traditional sciences like Physics and Chemistry study physical objects and the way they interact. The subject of our proposed science is proof plans. But proof plans are not physical objects. If they can be said to exist at all it is in the minds of mathematicians proving theorems, teachers explaining proofs and students understanding them. Physicists assume that the electrons in the apple I am eating as I write are essentially the same as the electrons in some distant star. But proof plans will differ from mind to mind and from time to time. There will be billions of such proof plans. Are we doomed merely to catalogue them all? Given the difficulty of discovering the nature of even one such proof plan, what a difficult and ultimately pointless task this would be. We would prefer to narrow our focus on a few representative proof plans. But on what basis could these few be chosen? Fortunately, this is not a new problem. It is one faced by all human sciences to some extent and it is one that has been solved before. Consider the science of Linguistics. In Linguistics the theories are grammars and the association of grammatical structure with utterances. Linguists do not try to form different grammars for each person, but try to form a grammar for each language, capturing the commonality between different users of that language. They try to make these grammars as parsimonious as possible, so that they capture the maximum amount of generality within and between languages. Linguists do not claim that everyone or anyone has these target grammars stored in their head - - nor, indeed, that anyone has a grammar at all - - only that they specify the grammatical sentences of the language. Another example is Logic itself. Again judged by the arguments people produce, the logical laws differ between minds and vary over time. Logicians do not try to capture this variety, but confine themselves to a few logics which specify 'correct' arguments. As with grammatical sentences, correct arguments are identified by initial observation of arguments actually used and consultation with experts to decide which of these are correct.

637

I place our proposed science of reasoning between Linguistics and Logic. Proof plans are more universal than grammatical rules, but it is possible to associate different, equally appropriate proof plans with the same proof. The study of proof plans appeals both to an empirical study of the way in which mathematicians structure their proofs and to reflection on the use of logical laws to put together proofs out of parts. Thus there are strong precedents for a science that takes mental objects as its domain of study and tames the wide diversity of exemplars by imposing a normative explanation informed by reflection and empirical study. It only remains to propose criteria for associating proof plans with proofs that will enable us to prefer one proof plan to another. This we can do by appealing to general scientific principles. Our proposals are given in the next section.

7

C r i t e r i a for A s s e s s i n g P r o o f P l a n s

If there were no criteria for the association of proof plans with proofs, then we could carry out our programme by associating with each proof an ad hoe tactic consisting of the concatenation of the rules of inference required to reproduce it, and constructing an ad hoe method in a similar way. This would not go beyond the existing logical explanation. The only assessment criterion we have proposed so far is correctness, i.e. that the tactic of the proof plan associated with a proof will construct that proof when executed. We now discuss some other possible criteria. the way in which the proof is structured by a proof plan accords with our intuitions about how we structure the proof.

• Intuitiveness:

Psychological Validity: there is experimental evidence that all, most or some mathematicians producing or studying proofs also structured a proof in the way suggested by some proof plan. • Expectancy:. there must be a basis for predicting the successful outcome of a proof

plan. • Generality: a proof plan gets credit from the number of proofs or sub-proofs with

which it is associated and for which it accounts. • Prescriptiveness: a proof plan gets more credit the less search its tactic generates

and the more it prescribes exactly what rules of inference to apply. • Simplicity: a proof plan gets more credit for being succinctly stated. • Ejfficieney: a proof plan gets more credit when its tactic is computationally effi-

cient.

638

• Parsimony; the overall theory gets more credit the fewer general-purpose proof plans are required to account for some collection of proofs. We might start designing proof plans using the criteria of intuitiveness and psychological validity as sources of inspiration, but then use the criteria of correctness, expectancy, generality, prescriptiveness, simplicity, efficiency and parsimony to revise them.

8

T h e R o l e of t h e C o m p u t e r

So far we have not involved the computer in this methodological discussion. One might expect it to play a central role. In fact, computers have no role in the theory, b u t play an i m p o r t a n t practical role. Computation plays a central role in the theory, because the tactics are procedures and they are part of the theory of our science of reasoning. It is not, strictly speaking, necessary to implement these tactics on a computer, since they can be executed by hand. However, in practice, it is highly convenient. It makes the process of checking that the tactics meet the criteria of the §7 b o t h more efficient and less error prone. Machine execution is convenient: • for speeding up correctness testing, especially when the proof plans are long, or involve a lot of search, or when a large collection of conjectures is to be tested; • to a u t o m a t e the gathering of statistics, e.g. on size of search space, execution time, etc; • to ensure t h a t a tactic has been accurately executed; and • to d e m o n s t r a t e to other researchers that the checking has been done by a disinterested party. In this way the computer can assist the rapid prototyping and checking of hypothesised proof plans. Furthermore, in its 'disinterested party' role, the computer acts as a sceptical colleague, providing a second opinion on the merits of hypothesised proof plans t h a t can serve as a source of inspiration. Unexpected positive and negative results can cause one to revise ones current preconceptions.

9

T h e R e l a t i o n to A u t o m a t i c T h e o r e m P r o v i n g

Although o u r science of reasoning might find application in the building of high performance, a u t o m a t i c theorem provers, the two activities are not co-extensive. T h e y differ b o t h in their motivation and their methodology.

639

I take the conventional motivation of automatic theorem proving to be the building of theorem provers which are empirically successful, without any necessity to understand why. The methodology is implied by this motivation. The theorem prover is applied to a random selection of theorems. Unsuccessful search spaces are studied in a shallow way and crude heuristics are added which will prune losing branches and prefer winning ones. This process is repeated until the law of diminishing returns makes further repetitions not worth pursuing. The result is fast progress in the short term, but eventual deadlock as different proofs pull the heuristics in different directions. This description is something of a caricature. No ATP researchers embody it in its pure form, but aspects of it can be found in the motivation and methodology of all of us, to a greater or lesser extent. Automatic theorem provers based on proof plans make slower initial progress. Initial proof plans have poor generality, and so few theorems can be proved. The motivation of understanding proofs mitigates against crude, general heuristics with low prescriptiveness and no expectancy. The 'accidental' proof of a theorem is interpreted as a fault caused by low prescriptiveness, rather then a lucky break. However, there is no eventual deadlock to block the indefinite improvement of the theorem prover's performance. If two or more proof plans fit a theorem then either they represent legitimate alternatives both of which deserve attempting or they point to a lack of prescriptiveness in the preconditions which further proof analysis should correct. Thus, we expect a science of reasoning will help us build better automatic theorem proving programs in the long term, although probably not in the short term.

10

Conclusion

In this paper we have proposed a methodology for reaching a multi-level understanding of mathematical proofs as part of a science of reasoning. The theories of this science consist of a collection of general-purpose proof plans, and the association of special-purpose proof plans with particular proofs. Each proof plan consists of a tactic and a method which partially specifies it. Special-purpose proof plans can be constructed by a process of plan formation which entails reasoning with the methods of the general-purpose proof plans. Ideas for new proof plans can be found by analysing mathematical proofs using our intuitions about their structure and, possibly, psychological experiments on third party mathematicians. Initial proof plans are then designed which capture this structure. These initial proof plans are then refined to improve their expectancy, generality, prescriptiveness, simplicity, efficiency and parsimony while retaining their correctness. Scientific judgement is used to find a balance between these sometimes opposing criteria. Computers can be used as a workhorse, as a disinterested party to check the criteria and as a source of inspiration. T h e design of general-purpose proof plans and their association with particular proofs is an activity of scientific theory formation that can be judged by normal scientific criteria. It requires deep analysis of mathematical proofs, rigour in the design

640

of tactics and their methods, and judgement in the selection of those general-purpose proof plans with real staying power. Our science of reasoning is normative, empirical and reflective. In these respects it resembles other human sciences like Linguistics and Logic. Indeed it includes parts of Logic as a sub-science.

Personal

Note

For many years I have regarded myself as a researcher in automatic theorem proving. However, by analysing the methodology I have pursued in practice, I now realise that my real motivation is the building of a science of reasoning in the form outlined above. Now that I have identified, explicitly, the science I have been implicitly engaged in for the last fifteen years, I intend to pursue it with renewed vigour. I invite you to join me.

References [Bledsoe et al 72]

W.W. Bledsoe, R.S. Boyer, and W.H. Henneman. Computer proofs of limit theorems. Artificial Intelligence, 3:27-60, 1972.

[Bundy & Welham 81] A. Bundy and B. Welham. Using meta-level inference for selective application of multiple rewrite rules in algebraic manipulation. Artificial Intelligence, 16(2):189--212, 1981. Also available from Edinburgh as Research Paper 121. [Bundy 88]

A. Bundy. The use of explicit plans to guide inductive proofs. In 9th Conference on Automated Deduction, pages 111-120, Springer-Verlag, 1988. Longer version available from Edinburgh as Research Paper No. 349.

[Bundy et al 88]

A. Bundy, F. van Harmelen, J. Hesketh, and A. Smaill. Experiments with Proof Plans for Induction. Research Paper 413, Dept. of Artificial Intelligence, Edinburgh, 1988. To appear in JAR.

[Fnnt 73]

B. V. Funt. A procedural approach to constructions in Euclidean geometry. Unpublished M.Sc. thesis, University of British Columbia, October 1973.

[Polya 65]

G. Polya. Mathematical discovery. John Wiley & Sons, Inc, 1965. Two volumes.

[Wos & McCune 88]

L. Wos and W. McCune. Searching for fixed point eombinatots by using automated theorem proving: a preliminary report. ANL-88-10, Argonne National Laboratory, 1988.

The TPS Theorem Proving System Peter B. Andrews Sunil Issar Dan Nesmith Frank Pfenning Carnegie Mellon University Pittsburgh, PA 15213-3890, U.S.A.

TPS is a theorem proving system for first- and higher-order logic which runs in Common Lisp and can operate in automatic, semi-automatic, and interactive modes. As its logical language TPS uses the typed A-calculus [6], in which most theorems of mathematics can be expressed very directly. TPS can be used to search for an expansion proof [10, 11] of a theorem, which represents in a nonredtmdant way the basic combinatorial information required to construct a proof of the theorem in any style. TPS also has facilities based on the ideas in [10, 11, 12, 13, 14] for translating back and forth between expansion proofs and natural deduction proofs. When one is seeking an expansion proof for a theorem of higher-order logic, not all necessary substitution terms can be generated by unification of formulas already present, so certain expansion options [5] are applied, and then a search for a p-acceptable mating [2] is made, using Huet's higher-order unification algorithm [8] to generate all remaining substitution terms. The expansion options consist of quantifier duplications and projective and primitive substitutions (such as . • 1 2 3 4 5 those whxch substitute [Awo~.Poco~W A Po(o~)w], [AWo~.Po(o~,)w V Po(o~)w], [Awo~.w[P~(o~ow]], [Awo~!3x.y.Pto.r(o~)WX],and [Awo~Vx~.P~(o~)WX]for a variable Po(o~)). These substitutions introduce a small amount of new structure, and contain variables for which additional substitutions can be made at a later stage. Different sets of expansion options are applied to create different expansion trees which are all subtrees of a master expansion tree. Smaller subtrees are explored before larger ones in an attempt to keep the search space manageable. The sets of expansion options are generated in a systematic and exhaustive way, except that at present the types of quantified variables in primitive substitutions (such as 7 above) are chosen from a small fixed set of types which is specified interactively. We conjecture that if this restrictive (but practical) method of specifying types were replaced by a general enumerative procedure, the search procedure implemented in TPS would be complete in principle for elementary type theory (the logical system of [ 1]). The second author has developed a matingsearch procedure (calledpath-focused duplication [9]) in which quantifier duplications are localized to vertical paths (thus reducing the enormous growth in the number of paths which accompanies duplications), and the duplications for each path are generated as needed to span that path. The search space grows and shrinks dynamically as different vertical paths are considered. TPs has various features designed to make it a versatile and friendly system. Many aspects of the program's behavior can be controlled by setting flags. There are over 150 of these flags, and This workis supportedby NSF grantCCR-8702699.

642

TPS has a facility called Review for examining and changing the settings of flags, and for defining and reusing groups of flag settings called modes. There is a formula editor which facilitates constructing new formulas from others already known to TPS. There is a library facility for saving formulas, definitions, and modes. Online documentation can be assembled automatically into a facilities guide which reflects the current state of the program. A program called ETPS containing the facilities of TPS for constructing natural deduction proofs interactively and many exercises from [3] is available for use by students in logic courses, and has been used extensively at our university. References

[1] Peter B. Andrews, Resolution in type theory, Journal of Symbolic Logic 36 (1971), 414-432. [2] Peter B. Andrews, Theorem proving via general matings, Journal of the ACM 28 (1981), 193-214. [3] Peter B. Andrews, An Introduction to Mathematical Logic and Type Theory: To Truth Through Proof, Academic Press, 1986. [4] Peter B. Andrews, Typed A-calculus and automated mathematics, In Edgar G. K. LopezEscobar David W. Kueker and Carl H. Smith, editors, MathematicalLogic and Theoretical Computer Science, Lecture Notes in Pure and Applied Mathematics, vol. 106, Marcel Dekker, 1987, 1-14. [5] Peter B. Andrews, On connections and higher-order logic, Journal of Automated Reasoning 5 (1989), 257-291. [6] Alonzo Church, A formulation of the simple theory of types, Journal of Symbolic Logic 5 (1940), 56-68. [7] Gerard P. Huet, A mechanization of type theory, In Third International Joint Conference on Artificial Intelligence, 1973, 139-146. [8] Gerard P. Huet, A unification algorithm for typed A-calculus, Theoretical Computer Science 1 (1975), 27-57. [9] Sunil Issar, Path-focused duplication: A search procedure for general matings, Technical report, Carnegie Mellon University, Pittsburgh, February 1990. [10] Dale A. Miller, Expansion tree proofs and their conversion to natural deduction proofs, In 7th International Conference on Automated Deduction, Lecture Notes in Computer Science 170, Springer-Verlag, 1984, 375-393. [ 1 I] Dale A. Miller, A compact representation of proofs, Studia Logica 46,4 (1987), 347-370. [12] Frank Pfenning, Analytic and non-analytic proofs, In 7th International Conference on Automated Deduction, Lecture Notes in Computer Science 170, Springer-Verlag, 1984, 394-413. [13] Frank Pfenning, Proof Transformations in Higher-Order Logic, PhD thesis, Carnegie Mellon University, 1987. [14] Frank Pfenning and Dan Nesmith, Presenting intuitive deductions via symmetric simplification, In l Oth International Conference on Automated Deduction, July 1990.

SCHEMATA Frank M. Brown and Carlos Araya Artificial Intelligence Laboratory University of Kansas Lawrence Kansas, 66045 (913)864-4482 [email protected] The Schemata deduction system is a programming language for specifying arbitrary deductive operations. It is based on ideas of treating deduction as (a less controlled form of) computation as suggested in [Hayes73,Kowalski74]. In particular it replaces expressions by equivalent expressions [Brown86]. Schemata was prototyped in series of previous automatic deduction systems [Brown78, Brown&Liu85, Brown86, Brown&Park87] and is now a fairly stable and well defined system which includes both an interpreter and a compiler. The constructs of the Schemata language are designed to minimize the amount of code necessary to specify complex deductive operations, thus allowing a user to more quickly prototype and test deductive systems without extensive re-programming. The following tautology checker written in Schemata gives some indication of the capability of this language. The first 11 Schemata definitions define the truth tables for a 2 valued propositional logic where the "and" symbol: ^ and the "or" symbol: v both take any number of arguments: (define (define (define (define (define (define (define (define (define (define (define

(^) t) (A "*'1 _t ooo2) (cut!(^ , , , I ,,,2))) (^ ,*oi _f *o,2) (cut! f))

(v) f) (v -,oi _f 0o02) ( c u t ! ( v 0.ol o002))) (v ,,-I _t o..2) (cutl t ) ) (-7 _t) f)

(~ _f) t) ( ~ x y) (A(-~ X y)(--) y X))) ( ~ x _t) t) (--> x _f) (-~ x))

The underscore _ symbols in the argument list of a define tell the marcher that the symbol following it is a constant and not a variable which can be instantiated by lambda conversion. For example, in the last definition of -% f is a constant while x is a variable which is bound when the definition is applied. The , - , n symbols are segment variables which match zero or more expressions. The purpose of the cut operation: CUT! in the A and v definitions is to eliminate redundant methods of computing the same row of the truth table by disallowing the application of any other A or v definition to be applied to the subexpression currently being evaluated. CUT! differs from the cut operator of PROLOG[Colmerauer et al.] in that it does not cut alternative evaluations (i.e. the other branches of the truth table) when executed. The next four definitions define t and f to be terminal symbols and tv to be the truthvalues t and f.

644

(define t _t) (define f _f) (define tv t) (define tv f) The final definition defines an example propositional function. We wish to determine whether it is a tautology or not: (define (foo a b c) (--> (^ (--> a b) (--> b c) (--~ c a) (v a b c)) (^ a b c)))

Executing foo on the truthvalues produces 8 values corresponding to the lines of the truth table. Since all values are t the result is a tautology. (foo tv tv tv) => t ,

t,

t,

t,

t,

t,

t, t

Thus, in order to write a tautology checker in Schemata all one has to do is specify the logical properties of the symbols involved and state the problem to be solved. The Schemata programming language automatically understands how to use such specifications to carry out effective and appropriate deductive operations. One does not need to program many of the details needed by other programming languages. The salient features of Schemata are the symbolic evaluation of expressions, the use of multiple definitions (axioms or derived rules of inference) for each symbol, a complete search strategy based on automatic interleaved backtracking, carefully chosen methods for controlling the backtracking such as application cutting, a powerful pattern matching language involving - - - segment variables, and some other constructs chosen to express the patterns needed to easily express deductive operations. The Schemata implementation includes both an interpreter and a compiler. The compiler is itself written in Schemata as are the laws for optimizing the object code produced by the compiler. References Brown78,F.M., "Towards the Automation of Set Theory and its Logic", ARTIFICIAL INTELLIGENCE, Vol. 10, 1978. Brown86,F.M., "An Experimental Logic based on the Fundamental Deduction Principal", (AIRIT TR-86-5), ARTIFICIAL INTELLIGENCE vol. 30 no. 2, 146 pages from page 117 to page 263, November 1986, North Holland. Brown F.M.,Liu P., "A Logic Programming and Verification System for Recursive Quantificational Logic" INTERNATIONAL JOINT CONFERENCE ON ARTIFICIAL INTELLIGENCE 85. August 1985. Brown,F.M. & P a r k , S. "Action, Reflective Possibility and the Frame Problem" (AIRIT TR-87-2), THE FRAME PROBLEM IN AI, PROCEEDINGS OF THE 1987 AAAI WORKSHOP, Morgan Kaufmann, Los Altos, CA, 1987. Colmerauer, A.,Kanoui, van Caneghem, M., "Last stops toward an ultimate PROLOG", Proceedings, 5th International Joint Conference on Artificial Intelligence, 1981. Hayes, "Computation as Deduction", Proceedings 2nd MFCS Symposium Czechoslovakia Academy of Sciences, 1973. Kowalski74 R., "Predicate Logic as Programming Language", Proc IFIP 74 North Holland Publishing Co., Amsterdam, 1974.

CYLINDRIC ALGEBRA EQUATION SOLVER Frank M. Brown Carlos Araya University of Kansas Lawrence Kansas, 66045 The Cylindric Algebra Equation Solver (CAES) is a set of about 200 Schemata definitions specifying the properties of the symbols, for solving equations in the cylindric algebra [Henkin et al.] of 25(2~N) elements with a function which maps 1 to 1 and everything else to 0. The following are some representative definitions expressed in the symbology of modal quantificational logic [Carnap, Bressan, Brown87]: (falsity: F, truth: T, and: ^, or: v, for all: V, for some: 3, not: -~, necessary: [], and synonymous: =-), rather than with algebraic symbols: (zero: 0, one: 1, multiplication: *, inclusive addition: +, products: ~, summation: sigma, minus: -, the function which maps 1 to 1 and all other elements to 0, and equality of elements of the cylindric algebra: =): (define(--> a ~) ( v ( ~ a)~)) (define(<> c()(-~[](-~ Or))) (define(< ~ _> (z)(<>(^ ~ a))) (define([ ~ _] o0([](~ --> (z))) (define([=] x y ) ( [ ] ( = x y))) ( d e f i n e ( A - e , l ( _ A , , e 2 ) e , - 3 ) ( ^ --,1 oee2 , o , 3 ) ) ( d e f i n e ( [ ] (_A P o - , I ) ) ( A ( [ ] P) ( [ ] (A ' ' ' I ) ) ) )

; i f a then ; ~ i s l o g i c a l l y possible ; a is possible given ;9 entails ;x necessarily equals y ;hssociativity of A ;distribution of [ ] across A

CAES solves equations of the cylindric algebra of the form: K=-(f K) where a solution is any equation of the form: K--g where K does not occur in g. For example, K-(-~BAA) and K-=(-~.AB) are the two solutions of K=-(((-~)v(-~B))^((A)-->A)A((B)-~B)) obtained by applying Schemata defmitions to the input equation using the methods described in [Brown86]. The above equation is solved by dividing it into 4 cases one for each combination of truth or falsity of each modalized subexpression: ( ((A) A(B) A(K------((--#~V~) m.hAB) ) ) v ((A) A (-~(B)) A ( K - - ( ( - ~ h v ~ ) hA) ) ) V ((-~(A))A(B) ^(K-((-~AV-~B)AB))) V ((-~(A))A(-~(B))A(K--(~v-~B))))

The resulting cases simplify by (nonmodal) logical laws to: (((A) A(B) A(K~F)) V ((A) A(-~(B) ) ^ ( K - ( ~ A A ) ) ) v ( (-~ (A)) A (B) ^ (K-=(-~AB)) ) v ((-~(A)) A (-~ (B)) ^ (K-(~Av-~B)) ) )

Substituting the derived value of K in each case gives: ( ((^) A (B) A (K~F)) v ( (< (-~BAA) >^) A ( ~ ( < ( - ~ ^ A ) >B) ) ^ ( K - ( ~ A A ) ) ) v ( (-~(< ( d A B ) >h) ) a (< (--#~AB)>B) A(K~-(--d~AB) ) ) V ( (-~(< (~Av-~B) >A) ) ^(-~(< (~AV-~B) >B) ) ^ (K-(-~v-~B)) ) )

which simplifies by modal and non-modal laws giving the disjunction of two solutions: ((FAFA(K~F)) v (TATA(K~(~BAA))) v ( T A T A ( K - ( - ~ A B ) ) ) v (FAFA(K=(-V~v~B)))).

Many equations with universal and existential quantifiers can also be solved by the equation solver. An example is the following equation: K - ( ( I S FR PROF)A(VX((IS X PROF)-~(((HAS X PhD))-~(HAS X PhO)))) A(HAS FR MD)A(VX((HAS X MD) ~(((-~(HAS X PhD)))~(~(HAS X PhD))))))

646 which says that Frieda is a professor with an Md, that professors have a PhD if it is possible (with respect to the knowledge K), and that when possible again, Mds do not to have a Phd. CAES solves this equation producing a disjunction of two solutions: (K=-((IS FR PROF)A(HAS FR HO)A(VX((IS X PROF)~(HAS X PhO))) A(VX((HAS X MO)-->((HAS X PhD)<->(X[:]FR)))))) v(K=-((IS FR PROF)A(HAS FR MD)A(VX((IS X PROF)-->((HAS X PhD)<-->(~(X[=]FR))))) A(VX((HAS X MB)-->(~(HAS X PhB))))))

CAES has been applied to several problem domains including automatic assembly [Missiaen] and troubleshooting [Park et al.]. It has also been used to find the flxpoints of nonmonotonic sentences or their intersection in the following 5 theories of nonmonotonic reasoning by solving their equational representation in Z: 1. The fixed point equation of a theory g in Autoepistemic Logic is:

k=(classical-theorems-of(gw{(L a):aek}•{-(L a):-~(aek)})) The Z representation is: K-=(G^(Va((L a)e-~([K]a)))). 2. The fLxed point equation of our Nonconstructive Default Logic is: k=(classical-theorems-of(gu{ (ci):((ai)ak) ^( Aj =l, mi(-,((-b ij)ek))))}) The Z representation is: K-(GA(^i=l,n((([K]Ai)A(Aj=l,mi(Bij)))-->Ci))) 3. The fixed point equation for Reiter default logic is: k=(c~{p:((classical-theorems-of p)cl~)A(gcp)A(Ai=l,n(((aiep)Aj=l,mi(-~(-¢bijEk)))-->(ciep)))}) Its representation in Z is: K-=(BP(PA([P]G)A(^i=I,n(([P]Ai^j=I,mi(Bij)))-->([P]Ci)))) 4. McCarthy's Parallel Circumscription is defined as: (Circ(G ~ 3)n 3)=df((G ~ 3)A(Vp,z((G p z)^(Vi,x((pi x)-~(ni x))))--ffVi,x((ni x)--->(pi x))))) The Z representation of (CIRC(G n 3)n 3) is: 3K(KA(K-((G ~ 3)^(ViVx(((~(~i x)))--~(-~(rd x)))) ^ViVx((-~('n3i x))~(-.('n3i x)))AViVx((('n3i x))-~('n3i x))))) where "n3 is the sequence of all predicates not in n or 3. 5. The Closed World Assumption on a theory g is: gu{(~(ni 8)): (-.((ni 8)e/cl-th g)))} Its Z representation is: G^ViVS((-.(ni 8))--~(-.(ni 8))). For these reasons, CAES provides a computationally effective method for doing nonmonotonic reasoning. Bressan, A., A GENERAL INTERPRETED MODAL CALCULUS, Yale Univ. Press,1972. Brown86, F.M., "A Commonsense Theory of NonMonotonic Reasoning" CADE 8, Oxford,1986. LECTURE NOTES IN COMPUTER SCIENCE 230. Springer-Verlag. Brown87, F.M. "The Modal Logic Z" (AIRIT TRo87-1), THE FRAME PROBLEM IN AI, PROCEEDINGS OF THE 1987 AAAI WORKSHOP, Morgan Kaufmann, Los Altos, CA 1987. Carnap, R., "Modalities and Quantification" JOURNAL OF SYMBOLIC LOGIC, volume 11, number 2, 1946. Henkin, L., D. Monk, A. Tarski, CYLINDRIC ALGEBRAS, Studies in Logic and the Foundations of Mathematics, North Holland, 1985. Missiaen, L., "Situation Calculus and Event Calculus in Modal Logic Z" Report CW85 Department of Computer Science, KU Leuven,1989. Park, S., S. Hundal, C. Araya and F. Brown, "Automated Nonmonotonic Reasoning and its Application in Manufacturing", 4th Int. Conf. on CAD/CAM Robotics & Factories of the Future, New Delhi, December 1989.

The OYSTER-CLAM system Alan Bundy

Frank van Harmelen

*

Christian Horn t

Alan Smaill

Department of Artificial Intelligence, University of Edinburgh, 80 South Bridge, Edinburgh, EHI IHN, Scotland. Emaih [email protected], Tel: 44-31-225-7774.

1

OYSTER

OYSTER [Horn 88] is an interactive proof editor closely based on the Cornell N u P R L system, but implemented in Prolog. The object-level logic is a version of Martin-LSf type theory (a higher order constructive logic including induction) in a sequent-calculus formulation. Proofs are constructed in a top-down fashion by application of the rules of inference. Notational definitions and libraries of theorems are supported. T h e tactic language for the system is Prolog. Predicates describing properties of a proof under construction are available to the user, who may also include a r b i t r a r y Prolog in tactics. Soundness of the system is ensured by the use of an abstract d a t a type of proofs: partial proofs can only be altered by application of the primitive proof rules. Tactics can be combined using system defined tacticats. Prolog pattern-matching and backtracking in tactics have proved useful in the automation of proof search. Since the object-level logic is constructive, terms of an enlarged )~-calculus can be c o m p u t e d from complete proofs, and these so-called extract t e r m s can then be executed by application on appropriate inputs. This allows the system to be used as a program synthesis environment, since a theorem can be regarded as a specification which is realised by its extract term. T h e system is written in some 2000 lines of Prolog, making it considerably more compact t h a n the original N u P R L system, while the speed of the two systems is comparable.

2

CLAM

CLAM is a meta-level system built on top of OYSTER to turn the interactive proof editor into a fully automatic theorem proving system. For every tactic written in the OYSTER system, CLAM is equipped with a specification of the tactic. We call such specifications methods. Methods consist of an input formula, *The research reported in this paper was supported by SERC grant GR/E/44598, and an SERC Senior Fellowship to the first author. tAuthor's address: Department of Mathematics, Humboldt University, Postfach 1297, 1086 Berlin, GDR

648

preconditions, output formulae and postconditions. A method is said to be applicable if the goal to be proved matches the input formula of a method, and the method's preconditions hold. The preconditions, formulated in a meta-logic, refer to syntactic properties of the input formula. Using the input formula and preconditions of a method, CLAMcan predict if a particular OYSTER tactic will be applicable without actually running it. Similarly, the output formulae gives a schematic description of the formulae resulting from a tactic application, and the postconditions specify further syntactic properties of these formulae. CLAM employs these methods in the search for a proof of a given formula by finding an applicable method, computing the schematic output formulae and postconditions of this method, and finally finding methods applicable to these output formulae, this process being repeated recursively until no unproved formulae remain. We call this process of concatenating methods by search at the meta-level proof planning, and the resulting tree of methods is called a proof plan. This p,roof plan can then be executed at the object-level: for each method in the proof plan, the system will execute the corresponding OYSTERtactic. This process of plan execution is not guaranteed to succeed, though it typically does. Thus the method acts as a heuristic operator which can capture the essential preconditions of a tactic while leaving out expensive checks for finer details. The process of proof plan construction as described above involves search: for a given sequent, more than one method may be applicable. We have experimented with a number of different search strategies (depth-first, breadth-first, iterative deepening, heuristic search). In practice, the search at the meta-level is small enough for a depth-first planner to succeed without very much backtracking, often none. CLAM is implemented in 2300 lines of Prolog code, and currently contains a set of methods and tactics modelled on the Boyer-Moore theorem prover. The system can, for instance, find an automatic proof of the existence of prime factorisation, thus extending the work by Boyer and Moore, since CLAMnot only verifies a given algorithm for prime factorisation, but indeed synthesizes this algorithm from an existentially quantified specification. CLAM takes 176 seconds to construct a plan for this theorem consisting of 15 methods, while the object-level proof consists of 553 steps, executed by OYSTER in 358 secs. More detailed descriptions of CLAMcan be found in [van Harmelen 89] and [Bundy et el 89].

References [Bundy et aI 89] A. Bundy, van Harmelen. F., and A. Smaill. Extensions to the RipplingOut Tactic for Guiding Inductive Proofs. Research Paper 459, Dept. of Artificial Intelligence, Edinburgh, 1989. To appear in the proceedings of CADE-10. [Horn 88]

C. Horn. The Nurprl Proof Development System. Working paper 214, Dept. of Artificial Intelligence, Edinburgh, 1988. The Edinburgh version of Nurprl has been renamed Oyster.

[van Harmelen 89] F. van Harmelen. The CLAM Proof Planner, User Manual and Programmer Manual. Technical Paper TP-4, Dept. of Artificial Intelligence, Edinburgh, 1989.

A H i g h - P e r f o r m a n c e Parallel T h e o r e m Prover Ralph Butler 1 Ian Foster 2 Anita Jindal Ross Overbeek 2 Mathematics and Computer Science Division Argonne National Laboratory Argonne, IL 60439 O v e r v i e w . We have implemented a parallel theorem proving system which supports hyperresolution, subsumption, and the set-of-support strategy. The upper level of the program, written in the concurrent programming language Strand [4], implements the general algorithm and describes the inter-connectivity of processes which perform the theorem proving tasks such as resolution, subsumption, etc. These compute-intensive tasks are performed by procedures implemented in C. The distribution of the work among parallel processes is based on techniques originally prototyped in [1] and further enhanced in [5]. A linear representation of clauses in the formula database is based on the work of Christian [3]. The clauses are indexed via high-performance indexing techniques developed by Overbeek [2]. We chose to use Strand to implement the upper level of the system because it is a widely available concurrent programming language that supports a variety of desirable features including concurrency, stream communication among processes, declarative reading of programs, and interfaces to other languages. A linear representation of clauses was chosen because it is simple and yet yields high performance. T h e P a r a l l e l A l g o r i t h m . The parallel system consists of a set of communicating processes, each responsible for one aspect of the system. These comprise a host, a distributor, and one or more generators and subsumers. The host process is responsible for loading the initial clauses and creating the process network (see Figure 1). This network may be viewed as a clause pipe-line. A new clause generated by some generator is first tested for forward subsumption at the generator. If it passes this test, it is passed to the next stage in the pipeline, a subsumer, for a further forward subsumption test. If still non-subsumed, it then passes to the distributor for addition to the clause space. Eventually, the distributor may choose that clause to send back to the generators for use in hyperresolution. The distributor selects a clause from the clause space each time it receives a request for work from one of the generators. The selected clause is sent to the requesting generator for use as its given clause; it is also sent to the other generators for use as a nucleus, but not as the given clause. After choosing the next clause, but before sending it out, the distributor applies forward and backward subsumption tests. Note that there is a certain degree of duplication of effort between the generators, distributor and subsumers, all of which perform forward subsumption tests on clauses. Experience shows that the additional tests are useful because they reduce redundancy in kept clauses. Overhead due to duplicated tests is relatively low, as most clauses are eliminated by subsumption at generators. The distributor only tests clauses selected for distribution, not every kept clause. 1Supported in part by NSF grant CCR-8810947 2Supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38

650

Ii

®

I .O Figure 1. 4 generators, 2 subsumers, 1 distributor P e r f o r m a n c e . A sequential version of the system described here has been applied on a wide range of test problems, with pleasing results: run-times are between 0.5 and 1.3 times those obtained using MeCune's OTTER system. The parallel version is not yet in a distributable state. However, we have demonstrated speedups on small test problems. For example, a solution to Sam's lemma is obtained in 14 seconds on a single Intel 386 processor, using the sequential version. The parallel version takes 18 seconds on a single processor; the 4 second difference is mainly due to the overhead of converting clauses to and from a portable form when transferring them between processes. On 12 processors, using 1 distributor, 1 subsumer, and 10 generators, a solution is obtained in 2.1 seconds; this represents a 6.7 times speedup over the sequential version. We expect to obtain even better results on larger problems. We are currently refining the implementation and further evaluating its performance. F u t u r e P l a n s . We plan to enhance the system with additional functions such as forward and backward demodulation and paramodulation. The addition of a feature such as demodulation increases the complexity of the system and causes one to consider such issues as where (which process) and when demodulation should be performed. Also, the current system represents just one way in which one might group theorem proving functions among a set of parallel processes. We would like to explore other groupings of functions. We hope to determine a decomposition of function that works well for a wide variety of problems. [1] Butler, R.M., and Karonis, N.T., Exploitation of parallelism in prototypical deduction problems, CADE 9, Springer-Verlag, 1988. [2] Butler, R.M. and Overbeek, R.A., unpublished information, 1990. [3] Christian, J., Techniques for fast Knuth-Bendix completion, Proc. Conf. on Rewriting Techniques and Applications, Chapel Hill, N.C., 1989. [4] Foster, I.T. and Taylor, S., Strand: New Concepts in Parallel Programming, PrenticeHall, Englewood Cliffs, N.J. 1989. [5] Jindal, A., Overbeek, R.A., and Kabat, W., Exploitation of parallel processing for implementing high-performance deduction systems, Journal of Automated Reasoning (to appear).

The Romulus Proof Checker 1Carl Eichenlaub 1Bruce Esrig 2James Hook 1Carl Klapper and 1Garrel Pottinger iOdyssey Research Associates, Inc. 301A Harris B. Dates Drive Ithaca, New York 14850 U.S.A. 2Oregon Graduate Institute 19600 NW von Neumann Drive Beaverton, Oregon 97006 U.S.A. The Romulus proof checker offers an implementation of the theory of constructions to the Romulus system, which in turn supports reasoning about high-level specifications of systems[2,7]. The term language can be extended syntactically by abbreviations and semantically by introducing pairs each consisting of a typed constant and an equational definition of it[4]. The system of rules can be extended by writing ML code as in the nuPrl paradigm[l]. The abbreviations and definitions needed to express the elementary logical operators and constants in terms of the primitives provided by the theory of constructions are organized into theories. These theories are managed as independent modifiable segments of the environment, each of which has a view consisting of all the theories it assumes. A version control mechanism guarantees persistence of the view[3]. Instantiation and generalization of theories have also been designed and given semantics in terms of the primitive rules. As a result, theories can be considered parametrized, analogously to reusable program modules[6]. A decision procedure for intuitionistic propositional logic was used for preliminary testing of the proof checker[5]. The proof checker is now being connected to a specification language. Its performance is strongly dependent on the' performance of the matching facility, which is used to analyze terms, and of the typechecking facility, which is used to validate proofs. Quantitative measures of the performance of the proof checker are not yet available. The Romulus proof checker was implemented in ML and then re-implemented in Common Lisp. The Common Lisp implementation is slower, possibly because it uses Portable *Acknowledgment of Sponsorship: The research which produced the information contained in this document was sponsored, in whole or in part, by the U. S. Air Force Systems Command, Rome Air Development Center, Griffiss AFB, New York 13441-5700under Contract No. F30602-85-C-0098.

652

Common Loops (PCL), in which typechecking cannot in general be done at compile time.

References [1] Robert L. Constable et al. Implementing Mathematics with the Nuprl Proof Development System. Prentice Hall, Englewood Cliffs, New Jersey, 1986. [2] Thierry Coquand and G6rard Huet. Constructions: A higher order proof system for mechanizing mathematics. In EUROCAL85, volume 203 of Lecture Notes in Computer Science, pages 151-184, Berlin, 1986. Springer-Verlag. [3] Carl Eichenlaub and James Hook. Preliminary manual for theory manager interface, July 1988. Odyssey Research Associates, internal report. [4] Timothy G. Griffin. Notational definitions - - a formal account. In Proceedings of the Third Symposium on Logic in Computer Science, July 1988. [5] James Hook and Garrel Pottinger. Natural L-systems. Presented to the meeting of the Association for Symbolic Logic held at UCLA in January 1989. An abstract will appear in the Journal of Symbolic Logic., January 1989. [6] James Hook and Garrel Pottinger. Ulysses theories: The modular implementation of mathematics. Technical Report TR 11-14, Odyssey Research Associates, February 1989. [7] Ulysses Staff. Ulysses: a computer-security modeling environment. In Proceedings of the 11th National Computer Security Conference, September 1988.

IMPS

: An Interactive

Mathematical

Proof

System

*

William M. Farmer, Joshua D. Guttman, and F. Javier Thayer

farmer, guttman, [email protected] The MITRE Corporation Bedford, MA 01730 U.S.A.

IMPS, an Interactive Mathematical Proof System [2], is intended as a general purpose tool for formulating and applying mathematics in a familiar fashion. Its logic is a conceptually simple implementation of higher-order predicate logic that closely conforms to mathematical practice. Mathematical specification and inference are performed relative to axiomatic theories, which can be combined with each other and extended by definitions. The system supports a natural style of inference based on deduction graphs, which are akin to derivations in a sequent calculus. However, the individual inferences in a deduction graph may depend on theory-specific simplification procedures, and may encapsulate a large number of basic inferences. Logic The logic of I M P S iS called L U T I N S , 1 a Logic of Undefined Terms for Inference in a Natural Style. LUTINS is an extension of the formal system P F [1], which is a version of Church's simple theory of types in which functions may be partial. Although terms may be non-denoting, the logic, however, is bivalent; formulas are always defined. L U T I N S employs a subtyping mechanism in which subtypes (called sorts) may be overlapping. I n t e n d e d A p p l i c a t i o n s I M P S is currently being targeted to two principal application areas: (1) automated reasoning for mathematical analysis and (2) software verification. In particular, we plan to use I M P S to produce machine-assisted proofs in nonstandard analysis and to reason about the denotational definition of Scheme. The key features of L U T I N S - higher-order operators, partial functions, and overlapping sorts--directly support these applications. T h e o r y - S u p p o r t e d R e a s o n i n g M e c h a n i s m s A theory in I M P S is composed of a language, a set of axioms, and a variety of additional information (including definitions, *Supported by the Rome Air Development Center, United States Air Force, under contract F1962889-C-0001, and by the MITRE-Sponsored Research Program. 1Pronounced lyfg, as in French.

654

theorems, simplification methods, and information about definedness). Theories can be combined directly and via theory interpretations. Every proof is carried out within some particular theory; different theories can be used for different proofs. Unlike many theoremproving systems, IMPS builds a data structure representing the deduction, so that during the proof process, the user may choose the order in which he wants to work on different subgoals, and try alternative strategies on a particular node. At the end of a proof, this object, called a deduction graph, can be surveyed by the user or analyzed by software. The items appearing in deduction graphs are not formulas, but sequents of the form F ~ A, where A is a single formula called the assertion and F is a set of assumptions called the context. The procedure c o n t e x t - s i m p l i f y , which is used systematically in the course of building deduction graphs, exploits theory-specific and general methods to simplify expressions with respect to a context. As the algorithm traverses propositional connectives it augments the context [3]. Automatic definedness checking is an important component in context simplification, as well as in the procedures that add inferences to deduction-graphs. Each I M P S theory stores definedness conditions, each of which is a predicate that suffices to ensure that the result of applying a function constant to certain arguments will be well-defined. A value condition is a predicate expressing a property of the range of a function constant. By combining the definedness condition for the term with the value conditions associated with its subterms, it is often trivial to check that the term is defined relative to a given context F. T h e o r e m s P r o v e d In a theory of real arithmetic with higher-order operators such as and H, we have proved a variety of results leading up to the binomial theorem. Related theorems include: the combinatorial identity; the monotonicity of Z; and the fact that and II distribute over addition and multiplication (respectively). Cantor's theorem on the cardinality of power sets is trivial to prove. We believe that our proofs are noteworthy because they correspond closely to standard proofs. Our next goal is to prove basic facts about limits and continuous real functions, leading up to the intermediate value theorem from calculus. The prqof makes use of a pair of sequences (of upper and lower bounds) defined by mutual recursion.

References [1]

W. M, Farmer, A partial functions version of Church's simple theory of types. Technical Report M88-52, The M I T R E Corporation, 1988. Revised, 1990; forthcoming in

The Journal of Symbolic Logic. [2] W. M. Farmer, J. D. Guttman, and F. J. Thayer. I M P S : An interactive mathematical proof system. Technical Report M90-19, The M I T R E Corporation, 1990. [3] L. G. Monk. Inference rules using local contexts. Journal of Automated Reasoning, 4(4), 1988.

UNICOM:

A

Refined

Completion

Based

Inductive

Theorem Prover*

Bemhard Gramlich, FB Informatik, Universit~it Kaiserslautem Postfach 3049, D-6750 Kaiserslautem, FR Germany E-mail: [email protected] UNICOM (UNfailing Inductive COMpletion) is a toolbox for investigating equationally defined hierarchically smactured many-sorted algebraic specifications. Its structure is similar to that of TRSPEC (Term Rewriting Based system for algebraic SPECifications, cf. [AGG 87]). The main components of UNICOM are the following: -

The PARSER checks the syntax of user-defined external specifications (with free constructors), imports used subspecifications and produces an internal representation.

-

The CHECKER tests the function definitions for completeness and consistency. For that purpose the termination and ground convergence properties of the set of definition rules are tried to be established.

-

The COMPILER provides a means for rapid prototyping by an optimizing translation of (correct) specifications into executable LISP code.

- The central part of UNICOM is a refined completion based inductive theorem PROVER which tries to prove or disprove a set of inductive conjectures of a given hierarchical (equational) specification.The original completion based prover of TRSPEC was already able to handle certain non-orientable conjectures leading to globally finite instead of terminating rewriting systems (cf. [G6 85]). UNICOM now admits arbitrary possibly non-orientable conjectures (cf. [Ba 88]). The theoretical foundations of UNICOM (in particular of the prover), a summary of the system and some experimental results are provided in [Gr 89]. An extended case study in verifying a couple of sorting algorithms with UNICOM is presented in [Gr 90]. Technical details of a former implementation version are described in [Sc 88]. In the following we shall list the most important characteristic features of (the prover of) UNICOM (new features compared to TRSPEC are marked by (+)): -

Parallel independent inductive proofs are possible according to the different possibilities of choosing inductively complete positions (cf. [Fr 86], [Kii 87]) in conjectures together with corresponding minimal complete function definitions (+).

* This work was supported by the "Deutsche Forschungsgemeinschaft , Sonderforschungsbereich 314 : Wissensbasierte Systeme- KUnstlicheIntelligenz"

656 - Inessential critical pairs (cf. [Kti 87]) may be computed as potentially useful auxiliary conjectures that can be exploited later on (+). - A simple generalization technique (for minimal non-variable common subterms) is available. - Simplification (reduction) may be performed modulo the AC-properties of some operators using a new efficient algorithm for AC-matching (cf. [GD 88]) (+), - Non-equational inductive knowledge about free constructors is used for speeding up the proof or disproof of conjectures (cf. [HH 80]). - Various user interface parameters allow for switching on/off optional features (e.g. generalization, computation of inessential critical pairs) and enable a fully automatic or more or less strongly user-controlled running mode (+). Numerous experiments with UNICOM have shown that many inductive properties of common abstract specifications for booleans, natural numbers, lists, stacks etc. can easily be proved using such a flexible completion based inductive proof technique. Our experiments also include a couple of non-trivial verification problems, e.g. arithmetic summation formulae and various sorting algorithms (cf. [Gr 90]).

References [AGG 87] Avenhaus, J., Gtbel, R., Gramlich, B., Madlener, K, Steinbach, J.: TRSPEC: A Term Rewriting Based System for Algebraic Specifications, Proc. 1st Int. Workshop on Conditional Term Rewriting Systems, Orsay, France, 1987, LNCS 308, eds. S. Kaplan, J.-P. Jouannaud, 1988 [Ba 88] Bachmair, L.: Proof by Consistency in Equational Theories, Proc. of LICS, pp. 228-233, 1988 [Fr 861 Fribourg, L.: A strong restriction of the inductive completion procedure, Proc. 13th ICALP, Rennes, France, LNCS 226, pp. 105-116, 1986 [GD 88] Gramlich, B., Denzinger, J.: Efficient AC-Matching Using Constraint Propagation, SEKI-Report SR-88-14, FB Informatik,Universit~t Kaiserslautern [Go 80] Goguen, J.A.: How to prove algebraic inductive hypotheses without induction, Proc. of 5th CADE, ed. W. Bibel and R. Kowalski, LNCS 87, pp. 356-373, 1980 [GO 85] Gtbel, R.: Completion of Globally Finite Term Rewriting Systems for Inductive Proofs, Proc. of GWAI 85, Springer Verlag, 1985 [Gr 89] Gramlich, B.: Inductive Theorem Proving Using Refined Unfailing Completion Techniques, SEKI-ReportSR-89-14,FB Informatik, Universit~t Kaiserslautern [Gr 90] Gramlich, B.: Completion Based Inductive Theorem Proving - A Case Study in Verifying Sorting Algorithms, SEKI-Report,FB Informatik, Universit~t Kaiserslautern, forthcoming [HH 80] Huet, G., Hullot, J.: Proofs by Induction in Equational Theories with Constructors, Proc. 21 st FOCS, pp. 96-107, 1980, also in JCSS 25(2),pp. 239-266, 1982 [JK 86] Jouannaud, J.-P., Kounalis, E.: Automatic Proofs by Induction in Equational Theories Without Constructors, Proc. Symb. Logic in Computer Science, pp. 358-366, Boston, Massachusetts, 1986, see also: Information and Computation, vol. 82/1, pp. 1-33, 1989 [Kfi 87] Kfichlin, W.: Inductive Completion by Ground Proof Transformation, Proc. CREAS, Lakeway, Texas, 1987 [Mu 80] Musser, D.: On proving inductive properties of abstract data types, Proc. 7th ACM Symp. on Principles of Programming Languages, pp. 154-162, Las Vegas, Nevada, USA, 1980 [Sc 88] Scherer, R.: UNICOM: Ein verfeinerter Rewrite-basierter Beweiser ffir induktive Theoreme, Diplomarbeit, FB Informatik, Universi~t Kaiserslautern, 1988

The Theorem Prover of the Program Verifier Tatzelwurm

Thomas Kgiufl

Nicolas Zabel

Institut fiJr Logik, Komplexit/~t und Deduktionssysteme University of Karlsruhe Postfach 6980 7500 Karlsruhe 1 FR of Germany

LIFIA-INPG 46, Avenue F6fixViallet 38031Grenoble Cedex France

A theorem prover used in program verification must deal with the specific properties verification conditions have. First these formulae are in general not deep mathematical problems but have a big size, second they are in most cases big logical formulae and third their proof is found easier when reduction procedures for theories are used. There is in addition another problem. Frequently verification conditions are not valid, since something is wrong with the program or its specification. Then it is highly desirable to obtain counter-examples when analyzing the unsuccessful attempt to prove the formula. After some exhaustive experiments we decided to use the analytic tableaux of Smullyan [8] for our prover. The method has been extended in such a way that is possible to treat equality and function symbols too. One additional reason for this choice was that interaction with the user is easier than in provers transforming the theorem into normal form. Also the application of reduction procedures for theories by the prover was achieved in a natural way. Some Remarks on the Prover The prover uses the analytic tableaux of Smullyan [8] for our prover being extended such way that it is possible to treat equality, function symbols and reduction procedures for theories. In order to prune the search space heuristics preserving the completeness are applied. (See [5].) Reduction Procedures for Theories Examples show that it is not convenient to use a general automated theorem prover for the proof of a verification condition directly, since frequently these conditions are or contain formulae for which decision procedures exist. Assume that during the proof of a theorem a system of the inequalities i < n+l ^ ~ i < n, where i and n are variables over the integers, occurs. (Such systems occur frequently when one verifies programs containing while statements.) This system can be replaced by the equivalent equation i = n. It is more reasonable to use a decision procedure inferring this equation than an automated general theorem prover. In [4] the decision procedure for systems of linear inequalities over the integers is contained and in [3] the decision procedure for systems of linear inequalities over the rationals. In order to obtain a complete treatment for the combination of cooperating decision procedures the equality propagation of Nelson and Oppen [6] is used. This method can be generalized in such a way that it is applicable in a theorem prover for first order logic with equality and function symbols too. (The proof of its completeness is contained in [5].) In general each decision procedure for a theory determining whether a given formula is satisfiable is a simplification procedure. But a decision procedure alone is not sufficient, since the

658

formulae it is applied to are only subformulae of the formula to be proved and thus satisfiable in most cases. It must handle equations of this theory and derive equalities for the equality propagation.

The Preprocessor of the Prover The preprocessor consists o f two parts: Transformation of terms and literals belonging to a theory into a normal form if possible and truthfunctional simplification In many theories the literals and terms can be transformed into a normal form. This reduction and the transformation of literals and terms into normal forms gives the truthfunctional reduction we shall discuss now more power. In program verification one has frequently to show that a condition is left invariant by a statement. After transformation o f literals and terms into a normal form there are many cases in which the verification condition will have the format A A B -~ C A B. This formula can easily be simplified to the equivalent A A B -~ C. So the application of a truthfunctional reduction procedure often reduces the verification condition to be proved considerably. Sometimes it happened that a verification condition was proved by the preprocessor already.

The Treatment of Equations The tableau prover must deal with two kinds of equations. There are equations belonging to a theory and then equations consisting of uninterpreted terms only. Equations belonging to a theory are assumed to be handled by a simplification procedure for this theory. Since constant symbols introduced by application of logical rules can be considered as free object variables, (see Schtitte [7],) equations containing uninterpreted terms only belong to the quantifier theory of the equality with uninterpreted function symbols. This theory is known to be decidable. (See Ackermann [1]. An efficient decision procedure based on the congruence closure is due to Nelson and Opppen [6].) So the equality between uninterpreted terms is treated by use of a decision procedure for this theory. The prover is implemented in Common Lisp on a Vax station. Since object oriented programming is widely used, reduction procedures for new theories can be added to it without change of the system.

References [1] W. Ackermann: Solvable Cases of the Decision Problem Studies in Logic and the Foundations of Mathematics, Amsterdam: 1954 [2] Th. K~iufl: Vereinfachung Iogischer Formeln in einem Vorbeweiser Dissertation, Fakult~t ftir Informatik, Universit~it Karlsruhe: 1988 [3] Th. Kaufl: Reasoning About Systems of Linear Inequalities 9 th International Conference on Automated Deduction, Lecture Notes on Computer Science; Berlin, Heidelberg, New York: 1988; Springer [4] Th. K~iufl: Simplification and Decision of Linear Inequalities over the Integers Technical Report 9/88, University of Karlsruhe, Institut fiJr Logik, Komplexit~it und Deduktionssysteme: 1988 [5] Th. K~iufl: Cooperation of Decision Procedures in a Tableau-Based Theorem Prover Technical Report 16/89, University of Karlsruhe, Institut fiir Logik, Komptexit~t und Deduktionssysteme: 1989 [6] C.G. Nelson, D.C. Oppen: Simplification by Cooperating Decision Procedures, ACM TOPLAS 1, pp. 245 - 257:1979 [7] K. Schtitte: Proof Theory, Berlin, Heidelberg, New York: 1977 [8] R.M. Smullyan: First-OrderLogic Berlin, Heidelberg, New York: 1968

RCL: A Lisp Verification System Matt Kaufmann* Computational

Logic, Inc.

1717 W e s t S i x t h S t r e e t , S u i t e 290 Austin, T e x a s 78703 U S A [email protected]

Rose Common Lisp (RCL) is a system for reasoning about programs written in a language that satisfies the language definition requirements for a subset of Common Lisp [1]. The existing prototype system, which is described in some detail in [2], translates Common Lisp definitions to definitions in the Boyer-Moore logic [3], a variant of Pure Lisp. A key feature of the RCL system is its handling of non-applicative constructs: assignment, both for local (LET) and global (special) variables; explicit flow of control, both with local and non-local exits (CATCH and THROW, BLOCK and RETURN-FROM) and with iteration and "go-to" (i.e. PROG, including the GO construct); and property lists. The system also allows macro definitions. A number of examples have been worked, including the definition of a Zetalisp-like loop macro 1 and examples that exercise various features of the system. For example, we have performed a correctness proof for a function that multiplies all the leaves of a tree but performs a non-local return with value 0 as soon as a leaf of 0 is encountered. We have also performed a correctness proof for an efficient intersection program that uses property lists. A significant portion of the system code is devoted to keeping the output definitions as simple as possible, the principle being that verification will be easiest when the output of the translator is structurally similar to the input from which it arises.

Implementation notes. The system is built on top of PC-NQTttM [4], which is an interactive "proof-checker" enhancement of the Boyer-Moore Theorem Prover [3]. It is written in Common Lisp, so it should (in principle!) be usable in any Common Lisp environment, though to date it has only been run using AKCL 2 on a Sun-3 and using $ymbolics Common Lisp (on a Symbolics machine). (It is certainly our plan that RCL be written in RCL, but this hasn't yet been done.) The Sun-3 core image occupies about 8.5 megabytes of storage. It includes AKCL, the Boyer-Moore prover, PC-NQTHM, some libraries [5] of definitions and *This work was supported in part at Computational Logic, Inc., by the Defense Advanced Research Projects Agency, ARPA Orders 6082 and 9151. The views and conclusions contained in this document are those of the author(s) and should not be interpreted as representing the official policies, either expressed o r implied, of Computational Logic, Inc., the Defense Advanced Research Projects Agency or the U.S. Government. 1That work was done by Larry Smith. This work has benefitted from numerous conversations with him and other colleagues at Computational Logic, Inc. 2Bill Schelt~'~ ~nhancement of Kyoto Common Lisp

660 proved lemmas, and RCL.

Example. Here is a small example that gives some idea of how the system works. A more detailed summary is given in [2]. The first form below is a Lisp definition of a function that returns the reverse of its input (a list). Notice that the algorithm is iterative; in each iteration, the local variable a c c accumulates the next element the input list x, and x is replaced by its tail ( c d r x). The form (go loop) passes control to the label l o o p in the code below, which starts the next iteration. When x is finally empty, the value of the local accumulator variable ace is returned. We display the user input first 3, followed by the two definitions in the Boyer-Moore logic that are generated automatically by the system. Notice that iteration has been represented by recursion. The Boyer-Moore prover is notoriously good with recursion; in fact we have proved (without difficulty) a correctness theorem for this reverse function. (defun-rcl revl (x) ;; a list reversal function defined using iteration (prog ((acc nil)) loop ;; a label that serves as a target for the form (go loop) below (when (not (consp x)) (return acc)) (setq acc (cons (car x) acc)) (setq x (cdr x)) (go loop))) (DEFN *CL-REVI-TAGBODY-O (ACC X) ;; Created by the system to represent the iteration in REVI (IF (LISTP X) (*CL-REVI-TAGBODY-O (CONS (CAR X) ACC) (CDR X)) ACC)) (DEFN *CL-REVl (.RCL-FLG X) ;; The reader may ignore .RCL-FLG here, which concerns side-effects. (IF (EQUAL .RCL-FLG T) ;; Notice that *CL-REVI-TAGBODY-O is called below with ACC = NIL. (*CL-REVI-TAGBODY-O NIL X)

F)) REFERENCES [1] Guy L. Steele Jr., Common LISP: The Language, Digital Press, 1984. [2] M. Kaufmann, "A User's Manual for RCL", Internal Note 157, Computational Logic, Inc., October 1989. [3] R. S. Boyer and J S. Moore, A Computational Logic Handbook, Academic Press, Boston, 1988. [4] M. Kaufmann, "A User's Manual for an Interactive Enhancement to the Boyer-Moore Theorem Prover", Technical Report 19, Computational Logic, Inc., May 1988. [5] W. Bevier, "A Library for Hardware Verification", Internal Note 57, Computational Logic, Inc., June 1988. ausing ';' to begin comments on a line

ORME an I m p l e m e n t a t i o n o f C o m p l e t i o n P r o c e d u r e s as S e t s o f T r a n s i t i o n s R u l e s Pierre LESCANNE Centre de Recherche en Informatique de Nancy, CNRS and INRIA-Lorraine Campus Scientifique, BP 239 54506 Vandoeuvre-l~s-Nancy, France emaih [email protected]

O R M E is a set of completion procedures based on the idea that methods developed essentially with a theoretical purpose, namely proving completeness can be used to present simple short and understandable programs. O R M E can also be seen as a set of exercises on the use of a functional language to program, high level procedures and as a bridge between theory and practice. The completion procedure is a method used in equational logic to built from a set of identities an equivalent canonical set of rewrite rules i.e., a confluent, noetherian and interreduced set of rules used to compute normal forms. In ORME, a completion is seen as a set of inference rules or more precisely a set of transition rules acting oll a d a t a structure. T h e idea of using inference rules when dealing with completion is not new and provides the beautiful proofs of completeness proposed by Bachmair and Dershowitz [Bac87,BDH86,BN89]. O R M E shows how this description leads to actual, nice and elegant programs when used as a programming m e t h o d as illustrated by an actual CAML implementation [PMA*89]. Actually the inference rules one considers in completion are specific in the sense that they transform a t-uple of objects into a t-uple of objects with the same structure. This is why they are referred to as transition rules. Thus the basic components of such a procedure are

four, • a d a t a s t r u c t u r e on which the transition rules operate, sometimes called the universe, • a s e t o f t r a n s i t i o n r u l e s , that are the basic operations on the data structure, • a c o n t r o l , that is a description of the way the transition rules are invoked, * a t o o l k i t that is shared by several completion procedures. When one wants to describe a specific completion procedure, usually one uses the following method. First one chooses the data structure, then one chooses transition rules and often at the same time the control. T h e toolkit is something that remains from

662

one procedure to the other in many cases, it was partly borrowed from the "CAML Anthology" [FOR87] and is available for other uses as a natural attempt to reuse pieces of codes already debugged and tested. The control is typically data driven and can be easily expressed by rewrite rules. The influence of these choices on the efficiency of the procedure is illustrated through four refinements of the Knuth-Bendix completion procedure, and two unfailing completions [Les89] and an AC-completion. K B - c o m p l e t i o n , with a two component data structure this implements a completion which is similar to the completion described by Knuth and Bendix.

N-completion, with a three component data structure this implements a still naive completion that computes less critical pairs,

S-completion, with a four component data structure this implements a completion where simplification is made first citizen,

ANS-completion, with a six component data structure this implements a completion where again less critical pairs are computed, Unfailing, with a four component data structures and an argument which is the identity one wants to refute, this presents a naive unfailing completion,

ER-completion~ with a eleven component data structures this presents a more elaborate unfailing completion, A C - c o m p l e t i o n , with a twelve component data structure this implements an AC completion.

References [Bac87]

L. Bachmair. Proof methods for equational theories. PhD thesis, University of Illinois, Urbana-Champaign, 1987. Revised version, August 1988.

[BDH86]

L. Bachmair, N. Dershowitz, and J. Hsiang. Orderings for equational proofs. In Proceedings Syrup. Logic in Computer Science, pages 346-357, Boston (Massachusetts USA), 1986.

[BN89]

L. Bachmair and Dershowitz N. Completion for rewriting modulo a congruence. Theoretical Computer Science, 67(2-3):173-202, October 1989.

[FORST]

Projet FORMEL. The CAML Anthology. July 1987. Internal Document.

[LesS9]

P. Lescanne. Completion procedures as transition rules + control. In M. Diaz and F. Orejas, editors, TAPSOFT'89, pages 28-41, Springer-Verlag, Lecture Notes in Computer Science, 1989. Vol. 351.

[PMA*89] P. Weis, M. V. Aponte, A. Laville, M. Mauny, and A. Su£rez. The CAML Manuel Reference. Technical Report, Projet Formel, INRIA-ENS, 1989. Version 2.6.

OTTER 2.0 * William McCune

Mathematics and Computer Science Division Argonne National Laboratory Argonne, Illinois 60439-4844 U.S.A.

OTTER 2.0 is our current production theorem prover at Argonne. It is a descendent of the AURA and ITP programs, which are also closely associated with Argonne. A preliminary version of OTTER was distributed at CADE-9 in May 1988, and version lz0 was released in January 1989. OTTER operates on clauses in batch mode. The user may input quantified first-order formulas, but they are immediately translated to clauses. The main inference rules are binary resolution, hyperresolution, UR-resolution, and paramodulation. Newly inferred clauses can be rewritten with demodulators and can be deleted if subsumed; newly kept clauses can back subsume older clauses. There is a straightforward control strategy, called the given clause algorithm, which is a simple implementation of the set of support restriction. Input clauses and formulas are arranged into three sets: Axioms, Set of Support (SOS), and Demodulators. At each iteration of the main loop, a given clause is chosen from SOS, and inferences are drawn using the given clause, Axioms, and previous given clauses. Newly kept clauses a inserted into SOS. There are many options for specifying inference rules, restricting the chosen inference rules, handling equality, ordering terms and clauses, and otherwise controlling the search. In addition, the user can employ answer literals to keep track of substitutions and construct objects during the search. OTTER's strong points include hyperresolution and UR-resolution in small theories represented by Horn sets and near-Horn sets. (By a small theory, I mean one with few axioms.) For example, many abstract algebra problems in the relational formulation can be effectively attacked, and OTTER has found the first unguided computer proofs of several difficult theorems in implicational calculus, equivalential calculus, and related areas. Another strong point is paramodulation with sets of unit equalities. For example, the standard paramodulation options enable an effective implementation of the Kernel method [2] for searching for fixed point combinators in fragments of combinatory logic. *This work was supported by the Applied MathematicalSciences subprogram of the Officeof Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38

664

OTTER has difficulty with very non-Horn theories, theories with definitions, and other kinds of rich theories. Hyperresolution is frequently ineffective with very non-Horn clauses, because it can force proofs to be convoluted, and because nonunit subsumption can be very expensive. UR-resolution is usually incomplete with very non-tiorn theories. A case splitting rule is needed. When 'if-and-only-if' definitions are present, control of the use of the definitions is very difficult--OTTER usually ends up attempting to reason at several different levels simultaneously. A more sophisticated control mechanism is needed. Setting the appropriate paramodulation and demodulation options provides an implementation of the unfailing Knuth-Bendix completion procedure. Terms are ordered by the Lexicographic Recursive Path Ordering (LRPO, also called RPO with status). The ordering on symbols is fixed at input. A weakness is the lack of associative-commutative unification. OTTER can easily prove that x 2 = x rings are commutative, but much trickery is required to prove the x 3 = x version. If your interest is in rewrite systems, you should obtain R R L [3], by Kapur and Zhang, or one of the other sophisticated rewrite systems. Demodulation has been extended with built-in integer arithmetic, logic operations, term comparison, metalogical primitives, and an if-then-else construct. The result is a usable equational programming subsystem which can be used to 'program' aspects of the search and to easily implement state-space searches and other forward-chaining rule-based systems. Performance is achieved through coding in C, careful memory management, and fast indexing to locate unifiable terms or matching terms. Discrimination tree indexing is used to locate more general terms during demodulation and forward subsumption, and FPA-Path indexing is used to find unifiable terms during application of inference rules and unit conflict tests, and to find instances of terms during back subsumption. OTTER is free and very portable (versions are available for IBM-type PCs and Macintoshes). It is available electronically by FTP, as well as on tape or diskette through several organizations (which may charge a distribution fee). All of the source code, test problems, and manuals are included in the distribution packages. No formal support is provided by me or by Argonne. For more information, contact me by electronic mail at [email protected] or by US mail.

References [1] McCune, W., OTTER 2.0 Users Guide, Report ANL-90/9, Argonne National Laboratory (March 1990). [2] McCune, W. arid Wos, L., The Absence and the Presence of Fixed Point Combinators, Preprint MCS-P87-0689, Argonne National Laboratory (June 1989). [3] Kaput, D. and Zhang, H., RRL: Rewrite Rule Laboratory User's Manual, Report 89-03, Dept. of Computer Science, University of Iowa (May 1989).

DISSOLVER: A Dissolution--based Theorem Provert Neil V. Murray, Dept. of Computer Science, SUNY Albany, Albany NY 12222 Erik Rosenthal, Dept. of Mathematics, U. of New Haven, West Haven CT 06516 Over the last few years, we have been developing a dissolution-based automated deduction system tentatively named Dissolver. It is now the platform on which we plan to build much more sophisticated proof-search control strategies. It must be noted that the modest experimental results presented here stem from a rather primitive system. Its level of sophistication is roughly comparable to the first binary-resolution prover: Built-in equality handling, restrictions such as set-ofsupport, reductions such as the Pure Rule, and special unification algorithms - all such typical enhancements are yet to be developed or implemented. We are confident that the corresponding enhancements for dissolution will result in the kind of performance improvements that we have seen with more traditional inference methods. We also expect that techniques specific to dissolution, also awaiting implementation, will be effective. Experiments show that Dissolver can already perform quite respectably, though it certainly is not yet as powerful as the systems with which it is compared. This is neither surprising nor discouraging, since Dissolver is still embryonic (as is its meta-theory, dissolution), while the others are widely acknowledged as state-ofthe-art systems. The table below compares Dissolver with Otter, a resolution-based theorem prover from Argonne National Laboratory [3], and with RRL, the Rewrite Rule Laboratory developed by Zhang and Kapur [9]. Otter was designed to be portable and accessible to other users but nevertheless is fast. It was written in C, while RRL was written in Franz-LISP, and Dissolver in Pascal. We employed quite recent versions of both Otter and RRL; all three were run on a Sun 3/60. The systems are so fundamentally different in concept and design that the comparison is based solely upon cpu time, rather than upon more traditional parameters such as proof length, number of clauses generated, number of clauses retained, etc. The times given in the table have the form minutes:seconds. The first two problems are from Appendix A of [8]; the last was done by hand in [6]. The SET =problems are NNF and CNF versions of the theorem that set equivalence is commutative; C&L is from Appendix A of Chang & Lee [1], and Murr-5 is problem 5 in [4]. The others are taken from Lawrence & Starkey [2]. Although none of these examples are propositional, our experience indicates that Dissolver will significantly outperform RRL and Otter on virtually any ground formula. (By "Dissolver" we mean the same program used in the first order experiments below, not a propositional version.) For example, Otter uses 31 seconds to refute the standard "Pigeonhole-3" problem with 22 clauses, while RRL needs 45 seconds. Dissolver takes 0.3 seconds. Both Otter and RRL are very slow on Pigeonhole-4, and neither can handle Pigeonhole-5; Dissolver refutes Pigeonhole-6 in 168 seconds. t This research was supported in part by National Science Foundation Grant CDA-8805948 and by a UNH Summer Faculty Fellowship.

666

Problem A.1 A.2 L&S-17 L&S-100 L&S-26 L&S-41 L&S-5 L&S-76 L&S-11 L&S-115 L&S-105 L&S-55 L&S-68 L&S-106 L&S-111 Murr-5 C&L-1 Set ----(unnormalized) Set - (CNF) D.1

(All were run on a SUN 3•60 under Sun UNIX 4.2) Dissolver RRL Otter 0:00.02 0:00.33 0:00.02 0:00.08 0:00.62 0:00.12 =0:00.00 0:01.73 0:01.03 0:03.28 0:00.25 0:01.13 0:02.67 0:00.77 0:00.10 0:00.17 0:00.02 0:00.08 0:00.55 0:00.23

0:00.15 0:01.63 0:00.23 0:00.80 >15:00.00 0:00.62 0:00.20 >11:00.00 0:00.23 0:16.90 0:03.40 0:03.17 >24:00.00

0:03.55 0:02.28 0:00.57 0:29.57 1:11.00 0:06.50 0:05.37

0:00.10 0:00.34 0:00.22 0:00.18 0:00.18 0:00.38 0:00.14 0:02.08 0:00.10 >7:22.00 0:00.36 0:07.44 0:01.90 0:00.40 0:00.40 0:00.80 0:00.12 not applicable >60:00.00 0:00.50

References

1. 2. 3. 4.

5.

.

7.

8.

9.

Chang, C.L., and Lee, R.C.T. Symbolic Logic and Mechanical Theorem Proving. Academic Press, New York, 1973. Lawrence, J., and Starkey, J. Experimental tests of resolution-based theorem proving strategies. CS-74-011, Computer Sci. Dept., Washington State Univ., April 1974. McCune, W. Otter 1.0 user's guide. Technical Report ANL-88/44, Argonne National Laboratory, Argonne, IL. Murray, N.V. An experimental theorem prover using fast unification and vertical path graphs. Proceedings of the Fourth National Conference on Canadian Society of Computational Studies of Intelligence, Saskatoon, Canada, May 1982, 125-131. Murray, N.V., and Rosenthal, E. Path dissolution: A strongly complete rule of inference. Proceedings of the 6th National Conference on Artificial Intelligence, Seattle, WA, July 12-17, 1987, 161-166. Murray, N.V., and Rosenthal, E. Inferencing on an arbitrary set of links. Proceedings of the 2 nd International Symposium on Methodologies for Intelligent Systems, Charlotte, NC, October 1987. In Methodologies for Intelligent Systems, (Ras, Z., and Zemankova, M., eds.) North-Holland, 1987, 416-423. Murray, N.V., and Rosenthal, E. An implementation of a dissolution-based system employing theory links. Proceedings of the 9th International Conference on Automated Deduction, Argonne Nat. Lab., May 23-26, 1988. In Lecture Notes in Computer Science, Springer-Verlag, Vol. 310, 658-674. Newborn, M. The Great Theorem Prover. Newborn Software, Westmount, Quebec, 1989. Zhang, H., and Kapur, D. First order theorem proving using conditional rewrite rules. Proceedings of CADE-9, Lecture Notes in Computer Science, vol. 310, 1-20, Springer-Verlag, Argonne National Laboratories, Argonne, IL, May 1988.

T R I P : A n i m p l e m e n t a t i o n of Clausal R e w r i t i n g Robert Nieuwenhuis Fernando Orejas Albert Rubio Universidad Polit4cnica de Catalufia Dept. Lenguajes y Sistemas Inform£ticos Pau Gargallo 5, 08028 Barcelona, Spain E-maih eanieuw@ebrupc51 (bitnet) Abstract: In this note we present the TRIP system, an implementation of clausal rewriting and completion. Its aim is to do theorem proving in theories expressed by socalled restricted equality clauses: general clauses without negative equality literMs and with at most one positive one. Rewriting with complete systems of clausal rewrite rules provides a decision procedure for the given theory. The completion procedure itself is refutationally complete. These techniques have been described and the results proved in [NO 89], using the formalism of proof orderings, as in [BDH 86, Gan 87]. The clausal rewriting relation is defined on sets of clauses: if (L ~ R ) v l l v . . . vln is a rewrite rule and the clause C rewrites into C' using L ~ R with a substitution a (in the usual sense) then C can be replaced in a set by the clauses { C'vllO'V...vln~, Cv~llG , . . . , Cv-,tncr }. Clausal Rewriting with reductive rules (in the sense of [Kap 85]) is finite terminating, since after rewriting a clause C into Cv-,l it is not allowed to rewrite descendants of Cvl using rules having t in its condition. Moreover, a clause C is a valid consequence of a theory expressed by a complete set of rules T¢ if and only if its set of normal forms obtained using T~ contains only trivially true clauses (clauses containing the literal true or the literal (t = t) or a pair of literals l and -4). The completion procedure implemented is a fair application of the following basic computation steps: orienting an axiom, adding a clausal critical pair, simplifying an axiom, and deleting a trivial axiom. Clausal critical pairs are obtained by restricted superposition and resolution inferences on maximal literals. Powerful axiom simplification and elimination is done by clausal rewriting. Since a fair derivation is not always possible, as in purely equational completion, there is a possibility of failure for certain inputs. If it does not fail, the completion procedure itself is an efficient semi-decision procedure, since it is refutationalty complete. The procedure has been implemented under Quintus-Prolog and has also been integrated at the University of Dortmund as a part of the CEC system [BGS 88a, 88b]. Several implementations of variants of clausal completion have been developed This work has been partially supported by the ESPRIT Project PKOSPECTRAref. no. 390, under subcontract with Alcatel SESA.

668

a n d tested on m a n y non-triviM examples for b o t h refutational a n d consequence finding t h e o r e m proving, with - w e t h i n k - interesting p e r f o r m a n c e results. Here we show a very simple example of completion for a specification of naturM n u m b e r s with = < a n d m a x . Note that the totality axiom for = < has been generated as a critical pair. T h e logical simbols -~ a n d V are expressed by ' - ' a n d 'v' respectively.

Initial

axioms:

0= < A -

( s (A) = < 0 ) (s ( A ) = < s (S))

s (A) = < s (B) A=
(A=
i) 2) 3) 4) 5) 6) 7) 8) 9) 10) 11) time

-

v

m a x (A, B) = B m a x (A, B) = A A = < m a x (A, B) A = < m a x (B, A)

Completion

v

v

v v

A=
A = < s (B) - (A=
successfully 0=
spent:

3.716

terminated. --> --> --> --> --> --> --> --> --> --> -->

true true true true true true true B A true true

Final

rules:

v v

A=
v v v

- (A=
v

A=
sec.

References [BDH 86] L. Bachmair, N. Dershowitz, J. Hsiang: Orderings for equational proofs. In Proc. Symp. Logic in Computer Science, 346-357, Boston (Massachusetts USA), 1986. [BGS 88a] H. Bertling, H. Ganzinger, R. Schafers: A collection of specifications completed by the CECsystem Report, PROSPECTRA-Project, U. Dortmund, 1988. [BGS 88b] H. Bertling, H. Ganzinger, R. Schafers: CEC: A system for conditional equational completion - - User Manual (Version 1.0). Report, PROSPECTRA-Project, U. Dortmund, 1988. [Gan 87] It. Gaazinger: A completion procedure for conditional equations. 1st Intl. Workshop on Conditional Term Rewriting, Orsay (1987), also to appear in J. of Symb. Computation. [Kap 85] S. Kaplan: Fair conditional term rewriting systems: unification, termination and confluence. Recent Trends in Data Type Specification, Springer IFB 116 (1985). [NO 89] R. Nieuwenhuis, F. Orejas: Clausal Rewriting. Research Report LSI-89-29, Dept. Lenguajes y Sistemas Inform£tieos, UPC, nov. 1989. (also submitted elsewhere).

OSCAR John L. Pollock Dept. of Philosophy University of Arizona e-mail:

[email protected],arizona.edu

OSCAR is a natural deduction theorem prover for the pure predicate calculus (without identity). It uses neither skolemization nor unification, trying instead to roughly emulate human reasoning. It is based upon two leading ideas. The first concerns the nature of reasons.

Reasons provide the "atomic links" in reasoning.

OSCAR begins with the

observation that reasoning divides into forward reasoning, wherein beliefs are derived from beliefs, and backwards reasoning, wherein interests are derived from interests. The latter is really just a species of goal reduction. The interesting observation is that some reasons are only appropriate for forward reasoning, and others are only appropriate for backwards reasoning. An example of the former is simplification (from (P&Q) infer P). This is a fine rule for forward reasoning, but would be combinatorially explosive for backwards reasoning.

On the other hand, addition (from P infer (PvQ)) is an excellent rule for

backwards reasoning, but would be combinatorially explosive for forwards reasoning. Reasoning that runs both forwards and backwards and honors the distinction between forwards and backwards reasons is said to be interest-driven. In addition to being interest-driven, OSCAR engages in suppositional reasoning. In suppositional reasoning, to establish a conclusion, we often make a supposition related to it, derive a conclusion that depends upon that supposition, and then "discharge" the supposition to obtain a related conclusion that no longer depends upon it. For instance, to obtain a conditional

(P D Q), we typically suppose the antecedent P, use that to obtain the

conclusion Q, and then discharge the supposition to infer (P D Q). This is best viewed as an interest rule, viz., given interest in a conditional, suppose the antecedent with interest in the consequent, and if the consequent is obtained relative to that supposition, then infer the conditional independently of the supposition.

Other forms of suppositional reasoning

include reductio ad absurdum and dilemma. OSCAR handles quantifiers using variants of universal generalization, universal instantiation, existentiM instantistion, and existential generalization, which can once more be

670

cast very naturally as rules for interest-driven reasoning.

For instance, universal

generalization proceeds in terms of a pair of rules. The first says that given interest in (Vx)Fx, we should choose a new variable y and adopt interest in Fy. The second rules says that if our interest in Fy has this origin and we adopt Fy then we should adopt (Vx)Fx. Universal instantiation is the rule that if we adopt (Vx)Fx, then for every term t already occurring in the current supposition, we should adopt Ft. This rule is very expensive. OSCAR uses this only as a last resort, first attempting to use a more restricted rule called Ml-detachment which results only in instantiations that are more apt to be useful. OSCAR turns out to be surprisingly fast. For instance, the current version of OSCAR solves the Schubert Steamroller Problem in approximately 7 seconds on a Symbolics 3600. Its speed results from the inherent efficiency of i n t e r e s t ~ i v e n reasoning.

In most

problems, OSCAR makes very few inferences that are not used in the final proof. OSCAR

is

described

in

detail

in

"Interest-driven

forthcoming in The Journal of Automated Reasoning.

suppositional

reasoning",

OSCAR is actually designed as a

subsystem of a more general reasoner (also called 'OSCAR') that engages in both deductive and defeasible reasoning. The theory behind the more general reasoner is described in "A theory of defeasible reasoning", forthcoming in The International Journal of Intelligent

Systems.

EXPERT THINKER:

An Adaptation of F-Prolog to Microcomputers

Ronald W. Satz

Transpower Corporation I Oak Drive Parkerford, ~A

19457

U.S.A.

(215) 495-6362

EXPERT THINKER is a commercial theorem prover designed for MSDOS microcomputers (with 640K of internal memory and a floppy or hard drive).

Written and compiled in Arity Prolog and Turbo Prolog,

it is an adaptation of the DEC-IO Prolog program called 'FProlog'

(short for Full Programming in Logic) by professors

Umrigar and Pitchumani [I].

F-Prolog includes unification with

the occurs check, true negation, the capability to use non-Horn clauses, the Meson reduction and extension operations, and staged depth-first search.

EXPERT THINKER adds a very easy-to-use

operator interface to this system and a predicate calculus to clause form converter.

It is refutation complete.

After the sign-on screen, the user selects (with the cursor keys) a file from the EXPERT THINKER directory or oreates a new file.

If he chooses a current file, he may proceed to examine or

change the documentation section, the set of clauses, the goal clause, or to print, copy, rename, or delete the file.

If he

chooses to create a new file, the program moves to the documentation screen.

Here the user enters the report title, his

name, the company name, the date, the file name, and the problem statement in English.

The program features full screen editing,

the ability to scroll down and to the right, and use of all the keyboard function keys.

After pressing , the user is

transferred to the clause editor. editing, etc.

Again, there is full screen

Normal Prolog clause form is used, with these

672

additional connectives:

"@" for negation, "<=" for implication,

"&" for conjunction, and "or" for disjunction.

After pressing

, the user is transferred to the goal editor to input the goal clause--the theorem to be proved, not its negation. Pressing again begins the computation.

The screen flashes

the clause being worked on and shows the search depth and the number of solutions generated.

(EXPERT THINKER finds all the

distinct solutions to a given problem.)

When finished, the

program prompts the user for output to screen only or printer and screen.

In either case, the user can choose screen length,

continuous, or page length printing.

The report output includes

all of the user input as well as the solution(s).

At the end of

the printout, the user has the choice of going back to the document editor, the clause editor, or the goal editor, or he can create a new file or reprint the current results, or exit.

If he

exits, he is brought back to the directory screen, where he can quit the program, create a new file, or choose another file to run.

On a microcomputer with a 25 MHz 80486 processor, EXPERT THINKER solves Schubert's Steamroller Problem in 2.5 minutes.

To

date, the program has solved all of the simple and intermediate level problems put to it, including nearly all of Pelletier's test problems [2].

References

I.

Z. D. Umrigar and V. Pitchumani, "An Experiment in

Programming with Full First Order Logic", Proceedings of the 1985 Symposium on Logic Programming, Boston, MA, July 1985, pp. 40-47.

2.

F. J. Pelletier, "75 Problems for Testing Automatic Theorem

Provers", Journal of Automated Reasoning, Vol. 2, No. 2, pp. 191216.

A Prolog Technology

Theorem

Prover *

Mark E. Stickel

Artificial Intelligence ~enter SRI International Menlo Park, California 94025

A Prolog technology theorem prover (PTTP) is an extension of Prolog that is complete for the full first-order predicate calculus [2]. It differs from Prolog in its use of unification with the occurs check for soundness, depth-first iterative-deepening search instead of unbounded depth-first search to make the search strategy complete, and the modelelimination reduction rule that is added to Prolog inferences to make the inference system complete [1]. The latest implementation of PTTP is entirely Prolog-based [3]. It uses three compiletime transformations to translate formulas into Prolog clauses that directly execute, with the support of a few run-time predicates, the model-elimination procedure with depth-first iterative-deepening search and unification with the occurs check. Its performance is high, although it lacks some optimizations present in the earlier LISP-based version. It is more concise a~ad readable than the version in LISP, which makes it superior for expository purposes and easier to modify. Examples of inputs and outputs of the compile-time transformations provide an easy and quite precise way to explain how PTTP works. P T T P attains its high performance principally because its inferences are compiled and derived clauses are efficiently represented. PTTP is better able to take advantage of compilation than many other systems because its inference system is an input procedure. The absence of inference operations between derived clauses makes compilation of just the input clauses sufficient. Prolog-style efficient representation of derived clauses is possible in PTTP because it retains Prolog's depth-bounded search. Only a single derived clause need be represented (on the stack) at a time; alternatives are generated by undoing unifications upon backtracking. For completeness, depth-first iterative deepening, i.e., a sequence of bounded depth-first searches, is performed. This is expected to cost only about ~ times as many inferences as breadth-first search, where b is the branching factor. P T T P extends Prolog's inference system by the addition of the model-elimination reduction rule: If the current goal matches the complement of one of its ancestor goals, *This research was supported by the National Science Foundation under Grant CCR-8611116.

674

then apply the matching substitution and treat the current goal as if it were solved. This inference rule, used as an additional alternative goal solution method to standard Prolog inference, results in a complete inference system for full first-order predicate calculus. Contrapositives of Prolog clauses must be provided so that any literal of a clause can be resolved on. Deriving indefinite answers requires in addition the inclusion of the negation of the theorem among the axioms. The three compile-time transformations used by "PTTP in Prolog" are: • A transformation for sound unification that renames variables in clause heads to eliminate duplicat~tons and moves unification of the renamed variables into the clause bodies where it is performed by a run-time predicate for unification with the occurs check. • A transformation for complete depth-bounded search that adds extra arguments for input and output depth bounds to each predicate and adds depth-bound test and decrement operations to the clause bodies. • A transformation for complete model-elimination inference that adds an extra argument for the list of ancestor goals to each predicate and adds ancestor-list update operations to the clause bodies; additional clauses are added to perform the modelelimination reduction and pruning operations. PTTP's high inference rate is achieved at the cost of not allowing more flexible search strategies or elimination of redundancy in the search space by subsumption. Although PTTP is one of the fastest theorem provers in existence when evaluated by its inference rate and performance on easy problems and it has been used to solve reasoning problems in planning and natural-language-understanding systems effectively, its high inference rate can be overwhelmed by its exponential search space and it is unsuitable for many difficult theorems for which more conventional theorem provers have demonstrated some success. Besides being used as a stand-alone theorem prover, PTTP can play a useful subordinate role in the proof of difficult theorems by doing subproofs when the proof can be decomposed into smaller pieces, by executing the theory resolution or linked inference principle procedures, or by performing fast refutation checks on newly derived clauses.

References [1]

Loveland, D.W. A simplified format for the model elimination procedure. Journal of the ACM 16, 3 (July 1969), 349-363.

[2]

Stickel, M.E. A Prolog technology theorem prover: implementation by an extended Prolog compiler. Journal of Automated Reasoning 4, 4 (December 1988), 353-380.

[3]

Stickel, M.E. A Prolog technology theorem prover: a new exposition and implementation in Prolog. Technical Note 464, Artificial Intelligence Center, SRI International, Menlo Park, California, June 1989.

A General Clause Theorem Prover Geoff Sutcliffe Dep't of Computer Science, The University of Western Australia Nedlands, Western Australia, 6009 geoff%wacsvax.uwa.oz.au Introduction The General Clause Theorem Prover (GCTP) was designed as a test bed for semantic search control strategies in theorem proving. It is the unique combination of the Graph Construction (GC) procedure of [Shostak 1976] (which is known to out-perform many (all?) linear format systems), embedding the axioms of equality by ~he use of the Resolution by Unification and Equality (RUE) and Negative Reflexive Function (NRF) inference rules [Digricoli 1979]. To use RUE and NRF in the GC procedure, three modifications have been made. (i) Extension is is redefined to use RUE unification; (ii) NRF is added, and applied to negative equality Bliterals as an alternative to extension; (iii) Reduction is redefined to use RUE unification. In all three cases, negative equality literals generated from the use of RUE unification are classified as B-literals and added to the right hand end of the result chain. The completeness of the combination of the GC procedure and the RUE and NRF inference rules, is to be obtained by combining their respective completeness results. The GCTP implementation The GCTP has been implemented in Prolog. An input clause is represented by a Prolog fact whose single argument is a list of (non-classified) literals that constitute the represented clause. Each centre chain of a derivation is represented by a list of function structures and variables. The functor of each function structure is one of a, b or c, indicating the class of the literal argument. The second argument of an A-literal function structure is a variable identical to one of the variables in the centre chain list, indicating the C-point of the A-literal. The insertion of a C-literal, predicated the truncation of an A-literal, is efficiently implemented by the instantiation of the associated C-point variable. Extension and NRF always use the rightmost B-literal of the centre chain. Although possibly not optimal, this is convenient given the list representation of chains. The GCTP is partially self configuring. If the input clauses are all Horn clauses, an input derivation system is complete and the reduction inference rule is suppressed. If no equality literals are present in the input clauses, there is no need to embed the axioms of equality. In this case standard unification is used rather than RUE unification, and NRF is suppressed. The selection of disagreement set, selection of substitution, and equality restrictions for RUE and NRF, have been embedded into the GCTP RUE unification and search strategy. The GCTP RUE unification unifies a pair of terms only if they are identical or one of the pair is a variable. In all other cases a disagreement pair is returned. The equality restriction for RUE has been strengthened to prevent this relaxed selection of disagreement pairs from creating an ongoing sequence of negative equality literals. The GCTP search strategy A modified consecutively bounded depth first search is used by the GCTP. The modified version improves on the standard version by truncating only those long inference sequences

676

that are not making progress towards a refutation. Compatiblity with the Set-of-Support strategy allows the GCTP to form its top chains from negative input clauses. This selection of top clauses leads to 'natural' proofs, and simplifies semantic checking in the Horn clause configuration. The GCTP has relaxed the GC procedure's specification that reduction must be done if possible, to allow extension as an alternative to reduction against a C-literal. This corrects a completeness problem of the original procedure. The GCTP uses a unit preference strategy in extensions. C-literals at the left end of centre chains, which are proved, are removed from the centre chain and added to the set of input clauses as unit clauses. This is done so as to retain the most general unit clauses. The addition of unit clauses to the input set is particularly effective in conjunction with the unit preference strategy. In the environment of a consecutively bounded search there is an added advantage that proofs of B-literals discovered within one bound, are 'transferred' to the next bound as unit clauses. Search pruning In unit extensions, if the negation of the centre clause B-literal is subsumed by the input clause literal, no alternative extensions are permitted. The GC procedure's restriction that no two non-B-literals in the centre chain may have identical atoms has been extended to check that no A- or B-literal in the centre chain is identical to any A-literal to its left. This second restriction is an extension of restriction 2 of the Model Elimination procedure. All syntactic checking is repeated in order to detect violations due to substitutions. In the Horn clause configuration the GCTP can perform the semantic check that ensures the falsity of all past and current centre clause literals. In the GCTP the A- and B-literals in the centre chain are the literals that must be checked. A domain based approach to semantic checking [Sutcliffe 1988] is used. The semantic checking of negative equality B-literals generated from RUE unification may be interpreted in terms of term level semantic checking of input paramodulation. Conclusion The GCTP has been successfully tested with many of the problems given in [Pelletier 1986]. It is currently being extended to include a type checking mechanism, which will move the GCTP into the field of typed first order logic. A full description of the GCTP may be found in [Sutcliffe 1989] References Digricoli VJ.; Automatic Deduction and Equality; Proceedings of the 1979 Annual Conference of the ACM, 1979, pp 240-250. Pelletier F.J.; Seventy-five Problems for Testing Automatic Theorem Provers; Journal of Automated Reasoning 2, 1986, pp 191-216. Shostak R.E.; Refutation Graphs; Artificial Intelligence 7, t976, pp 51-64. Sutcliffe G.; Semantic Checking for Horn Clauses; Unpublished manuscript, 1988. Sutcliffe G.; A General Clause Theorem Prover written in Prolog; Western Australian College of Adv. Ed., Dep't of Computer Studies, Research Report 89/2, 1989.

LISS - THE LOGIC INFERENCE SEARCH SYSTEM A.A.Voronkov International Laboratory of Intelligent Systems Universitetski Prospekt 4 630090 Novosibirsk 90 USSR The Logic Inference Search System LISS is a general purpose automated theorem proving system developed in International Laboratory of Intelligent systems (SINTEL). It includes various logics and proof systems. LISS allows to search for a proof in (i) the first order classical predicate calculus; (ii) the first order intuitionistic predicate calculus; (iii) various logics without contraction rules [1,2,3] and in propositional variants of these logics. There are essentially two main methods of proof search. The first method is based on the modification of Maslov's inverse method [4] developed in [5]. The search for a proof can be made directly on the input formula instead of its normal forms. It allows automatically display the proof in the Gentzen-type sequential calculus. The second method uses various modifications of resolution and can be applied only to the first order classical predicate calculus. The two methods have many common features which makes possible to use them in one system. There

are

many

menu

options

in

LISS

that

allow

search. These options include • logic; • method; - strategies; • subsumption; - factoring; • quantitative characteristics of clauses; • answer variables; • interface options (printing, displaying...) etc.

to

control

proof

678

These makes LISS look like systems AURA, LMA and OTTER [6,7,8] developed in Argonne. For example one can use in LISS the same method of weighting clauses as in OTTER. Unlike the above mentioned

systems LISS

is highly interactive.

User

can interrupt proof search at any moment and to make changes in options and the data base looking over the clauses. The algorithms deciding above mentioned logics without contraction rules are built in our system. There are two implementations of LISS. The first is implemented on the subset of Common Lisp for IBM PC and compatibles. We think that it is easy to modify it for using in another computers. The performance in comparable with those of OTTER running on the same computers. The second implementation is written in Prolog for IBM PC. It lacks in performance compared to the first implementation but it is more advanced. For example it includes resolution on formula trees [9].

References:

i. Ono H. Semantic analysis of the logics without structure rules, Studia Logica, 1986. 2. Ketonen J.,

Weyhrauch R.

A decidable fragment of predicate calculus,

Theoretical Computer Science 32, 1984, pp. 297-307. 3. Mey D. A predicate calculus with control of derivations, to be published in Proc. 3rd Computer Science Logic Workshop, LNCS, 1990. 4. Maslov S.Y.

The inverse method of establishing deducibility for logical

calculi, Trudy Instituta Matematiki, vol. 67, 1968. 5. Voronkov A.A. A proof-search method for first-order logic. - In. COLOG88 (papers presented at the Int. Conf. on Computer Logic), Part 2, Tallinn, 1988, p.i04-i18.

(Also to be published in LNCS).

6. Wos L. Solving open questions with an automated theorem proving program, Proc. 6th CADE, LNCS 138, 1982, pp.l-31. 7. Lusk E.L., McCune W.W., Overbeek R.A. Logic Machine Architecture: kernel

functions, Proc. 6th CADE, LNCS 138, 1982, pp.70-84. 8. McCune W.W.

OTTER user's guide, Argonne National Laboratory, December,

1988. 9. Schmerl U.R. 1988, 425-438.

Resolution on formula

trees.

- Acta Informatica,

25(4),

ACE: The Abstract Clause Engine D.A. Wolfram*

Computer Laboratory University of Cambridge England

ACE (Abstract Clause Engine) solves constraint satisfaction problems defined by clauses. Examples include: sequent calculus proofs; equational logic programming; equational unification; logic programming; context-free grammar parsing and generation; n queens problem; and distinct representatives problems. ACE also transforms such problems. A preprocessor deletes redundant clauses. It generalizes the transformations for removing useless symbols in context-free grammars. Folding and unfolding, and other transformations can be treated similarly.

1

Search Methods

ACE incorporates a variety of search methods to solve clausal problems. Backtrack search and the following search methods are included:

adaptive backtrack [6] which dynamically and efficiently [5] reduces thrashing caused by blind backtracking and recurring failures by using minimal inconsistent subsets of choices to find early backtrack points, and by deleting clauses which cannot be used to find further solutions; an optimised version [41 of forward checking [1] with search rearrangement [3] which avoids unnecessary consistency tests and stacking; and

generalized iterative deepening [2] which can be used to find multiple solutions, and whose search method for iterations can be changed. The order of searches can be specified, and depth- and breadth-first search are standard ones. All searches use a depth bound on the search tree, and a bound on the number of solutions to be found. The total number of nodes visited can be counted. *Address from April 1990: ProgrammingResearch Group, Oxford UniversityComputing Laboratory~ 11 Keble Road, Oxford OX1 3QD. Telephone: +44 865 273838. E-marl: wolfram~prg.ox.ac.uk.

680

Search methods can be combined with ACE. For example, iterative deepening can be combined with breadth-first adaptive backtrack. In general, depth- or breadth-first orderings can be combined with any search method, and each iteration of an iterative deepening search can be done by one of the search methods. Problems, such as equational logic programming, require independent searches to be performed for their solution. Using ACE, these searches can differ: the search for equational unifiers could be done by backtrack while the search for refutations could b e done by depth-first adaptive backtrack.

2

Problem

Independence

ACE provides a convenient way to implement sequent calculi, prototype logic programming languages, and other clausal problems using a variety of search methods. Its problem independent design makes it unnecessary to re-implement search methods and preprocessors for each example problem. ACE is written in Standard ML Version 3. Extensive use is made of ML modules for combining search methods, and for applying search methods to example problems. A COMMON LISP version of ACE is being written. Users of ACE currently include: GMD, Bonn; Hewlett-Packard Laboratories, Bristol; ONERA-CERT-DERI, Toulouse; Queen Mary and Westfield College, London; Sun Microsystems, Palo Alto; and University of Pennsylvania.

References

[1]

R.M. Haralick and G.L. Elliott, Increasing Tree Search Efficiency for Constraint Satisfaction Problems, Artificial Intelligence 14 (1980) 263-313.

[2]

R.E. Korf, Depth-First Iterative-Deepening: An Optimal Admissible Tree Search, Artificial Intelligence 27 (1985) 97-109.

[3]

P.W. Purdom, Jr., Search Rearrangement Backtracking and Polynomial Average Time, Artificial Intelligence 21 (1983) 117-133.

[4]

D.A. Wolfram, Forward Checking and Intelligent Backtracking, Information Processing Letters 32 (1989) 85-87.

[5]

D.A. Wolfram, Intractable Unifiability Problems and Backtracking, Journal of Automated Reasoning 5 (1989) 37-47.

[6] D.A.

Wolfram, Reducing Thrashing by Adaptive Backtracking, University of Cambridge Computer Laboratory, Technical Report 112, August, 1987.

Tutorial on High-Performance A u t o m a t e d T h e o r e m Proving Ewing Lusk William McCune Mathematics and Computer Science Division Argonne National Laboratory Argonne, Illinois 60439 Since the early 70's, a series of automated theorem provers have been developed at Argonne, based on relatively straightforward algorithms but on increasingly sophisticated data structures and implementation techniques. Their objective has always been to find proofs of difficult theorems: those requiring proofs containing many steps and large terms. As a result, the set of problems provable by automated systems has been expanded to include a number of previously open questions in logic and mathematics. This tutoriM will begin with a brief survey of the philosophy that has guided the development of the systems at Argonne, and proceed to a presentation of the key ideas in the implementation of the current system, OTTER. The primary focus will be on data structures and algorithms required to support large searches. Parallel algorithms for theorem proving will be described, based on both distributed-memory and sharedmemory models of computation, and recent results with parallel versions of OTTER will be presented.

Tutorial on Reasoning and Representation with Concept Languages Jiirgen Miiller Franz Baader Bernhard Nebel Werner Nutt German Research Center on Artificial Intelligence Kaiserslautern and Saarbdicken, West Germany Gert Smolka IBM Scientific Center Stuttgart, West Germany Logic-based concept languages have been extensively used for representing knowledge in AI systems during the last decade. Only recently have results been obtained that give a complete overview of the decidability and complexity of inferences in most of these formalisms. This tutorial will introduce two classes of concept description languages, KLONE and Feature Logic; discuss classification algorithms, their complexity and relation to automated theorem proving; and consider several semantic approaches.

Tutorial on High-Performance A u t o m a t e d T h e o r e m Proving Ewing Lusk William McCune Mathematics and Computer Science Division Argonne National Laboratory Argonne, Illinois 60439 Since the early 70's, a series of automated theorem provers have been developed at Argonne, based on relatively straightforward algorithms but on increasingly sophisticated data structures and implementation techniques. Their objective has always been to find proofs of difficult theorems: those requiring proofs containing many steps and large terms. As a result, the set of problems provable by automated systems has been expanded to include a number of previously open questions in logic and mathematics. This tutoriM will begin with a brief survey of the philosophy that has guided the development of the systems at Argonne, and proceed to a presentation of the key ideas in the implementation of the current system, OTTER. The primary focus will be on data structures and algorithms required to support large searches. Parallel algorithms for theorem proving will be described, based on both distributed-memory and sharedmemory models of computation, and recent results with parallel versions of OTTER will be presented.

Tutorial on Reasoning and Representation with Concept Languages Jiirgen Miiller Franz Baader Bernhard Nebel Werner Nutt German Research Center on Artificial Intelligence Kaiserslautern and Saarbdicken, West Germany Gert Smolka IBM Scientific Center Stuttgart, West Germany Logic-based concept languages have been extensively used for representing knowledge in AI systems during the last decade. Only recently have results been obtained that give a complete overview of the decidability and complexity of inferences in most of these formalisms. This tutorial will introduce two classes of concept description languages, KLONE and Feature Logic; discuss classification algorithms, their complexity and relation to automated theorem proving; and consider several semantic approaches.

Tutorial

on

AProlog

Amy Felty INRIA

Elsa Gunter Bell Laboratories

Dale Miller University of Pennsylvania

Frank Pfenning Carnegie Mellon University

The logic programming language AProlog extends Prolog by containing polymorphic types, higher-order programming, A-terms as data structures, higher-order unification, modules, lexical scope, abstract data types, and implicational and universally quantified goals. These extensions are integrated into a single logical system and provide AProlog with expressive strengths not found in Prolog. After surveying various aspects of this language, we shall focus on its uses in specifying proof systems and implementing theorem provers. In particular, we shall discuss how the syntax and inference rules of object logics can be represented and on how tactic-style theorem provers can be written. We shall also illustrate how proofs can be built and manipulated in rather natural ways.

on Unification

Tutorial

Equational

Claude Kirchner INRIA Lorraine & CRIN Nancy, France This tutorial presents unification, or equation solving in abstract algebras. After an introduction to the problems of the field, we present the general results on unification theory, including the decidability and unification type of various theories and classes of theories. Then, using a rule-based view of the equation-solving process, we show different aspects of the field. For syntactic unification we describe, in an abstract fashion, the classical algorithms of Robinson and Martelli-Montanari. Semantic unification (i.e., equational unification) is then studied. We first look at two examples, giving unification algorithms for commutative and associative-commutative theories. Then we focus on the combination of unification algorithms and on general equational unification. The notion of syntactic theory, for which unification algorithms can be automatically computed, is also introduced and its usefulness shown on several examples.

Tutorial

on

AProlog

Amy Felty INRIA

Elsa Gunter Bell Laboratories

Dale Miller University of Pennsylvania

Frank Pfenning Carnegie Mellon University

The logic programming language AProlog extends Prolog by containing polymorphic types, higher-order programming, A-terms as data structures, higher-order unification, modules, lexical scope, abstract data types, and implicational and universally quantified goals. These extensions are integrated into a single logical system and provide AProlog with expressive strengths not found in Prolog. After surveying various aspects of this language, we shall focus on its uses in specifying proof systems and implementing theorem provers. In particular, we shall discuss how the syntax and inference rules of object logics can be represented and on how tactic-style theorem provers can be written. We shall also illustrate how proofs can be built and manipulated in rather natural ways.

on Unification

Tutorial

Equational

Claude Kirchner INRIA Lorraine & CRIN Nancy, France This tutorial presents unification, or equation solving in abstract algebras. After an introduction to the problems of the field, we present the general results on unification theory, including the decidability and unification type of various theories and classes of theories. Then, using a rule-based view of the equation-solving process, we show different aspects of the field. For syntactic unification we describe, in an abstract fashion, the classical algorithms of Robinson and Martelli-Montanari. Semantic unification (i.e., equational unification) is then studied. We first look at two examples, giving unification algorithms for commutative and associative-commutative theories. Then we focus on the combination of unification algorithms and on general equational unification. The notion of syntactic theory, for which unification algorithms can be automatically computed, is also introduced and its usefulness shown on several examples.

Tutorial on C o m p i l a t i o n Techniques for Logics Hans Jiirgen Ohlbach

Andreas Herzig

University of Kaiserslautern Kaiserslautern, West Germany

Universit~ Paul Sabatier Toulouse, France

Nonclassical logics, modal logics, epistemic logics, temporal logics, action logics, etc., are becoming more and more important for general AI applications. Recently a new method for designing deduction calculi for such logics has been developed. The idea is to translate formulae of a nonclassical "source logic" into predicate logic syntax, so that calculi and theorem provers for predicate logic, in particular resolution calculi, become applicable. In the tutorial we introduce the translation methods and discuss their advantages and limitations.

Tutorial on H i g h - P e r f o r m a n c e T h e o r e m Provers: Efficient I m p l e m e n t a t i o n and Parallelisation J. Schumann R. Letz F. Kurfess Technical University of Munich Munich, West Germany This tutoriM covers theoretical and implementation aspects of theorem provers for firstorder predicate logic, with the focus on analytic calculi. We concentrate on the connection method and related calculi, especially the model elimination calculus. After having presented the theoretical background, we discuss refinements of the calculus (like regularity) as well as extensions (like lemmata and proof schemata). In a second part we discuss techniques for an efficient implementation of model elimination. We describe in detail the technique of using an abstract machine, which is an extension of the Warren Abstract Machine (WAM). It serves as the kernel for a family of sequential and parallel theorem provers. Exploiting the potential of parallelism in logic will be the next major topic. Different kinds of parallelism in logic are identified and classified with respect to parameters of grainsize and independency of the parallel processes. One kind of parallelism, OR-parallelism, is explained in detail with the theorem prover PARTHEO. Questions concerning the memory model, the distribution of work, the toad balancing, and the relation to similar approaches are discussed.

Tutorial on C o m p i l a t i o n Techniques for Logics Hans Jiirgen Ohlbach

Andreas Herzig

University of Kaiserslautern Kaiserslautern, West Germany

Universit~ Paul Sabatier Toulouse, France

Nonclassical logics, modal logics, epistemic logics, temporal logics, action logics, etc., are becoming more and more important for general AI applications. Recently a new method for designing deduction calculi for such logics has been developed. The idea is to translate formulae of a nonclassical "source logic" into predicate logic syntax, so that calculi and theorem provers for predicate logic, in particular resolution calculi, become applicable. In the tutorial we introduce the translation methods and discuss their advantages and limitations.

Tutorial on H i g h - P e r f o r m a n c e T h e o r e m Provers: Efficient I m p l e m e n t a t i o n and Parallelisation J. Schumann R. Letz F. Kurfess Technical University of Munich Munich, West Germany This tutoriM covers theoretical and implementation aspects of theorem provers for firstorder predicate logic, with the focus on analytic calculi. We concentrate on the connection method and related calculi, especially the model elimination calculus. After having presented the theoretical background, we discuss refinements of the calculus (like regularity) as well as extensions (like lemmata and proof schemata). In a second part we discuss techniques for an efficient implementation of model elimination. We describe in detail the technique of using an abstract machine, which is an extension of the Warren Abstract Machine (WAM). It serves as the kernel for a family of sequential and parallel theorem provers. Exploiting the potential of parallelism in logic will be the next major topic. Different kinds of parallelism in logic are identified and classified with respect to parameters of grainsize and independency of the parallel processes. One kind of parallelism, OR-parallelism, is explained in detail with the theorem prover PARTHEO. Questions concerning the memory model, the distribution of work, the toad balancing, and the relation to similar approaches are discussed.

Tutorial on Rewrite-Based Theorem Proving Jieh Hsiang

Jean-Pierre Jouannaud

State University of New York Stony Brook, New York

Universit~ de Paris-Sud Orsay, France

Theorem proving involving equality has been one of the most exciting research areas in atitomated deduction. Wos and Robinson proposed the paramodulation inference rule and its demodulation refinement in 1967. At about the same time, Knuth and Bendix presented the method of term rewriting. Term rewriting orients equations into rules according to a well-founded ordering and selects the deductive consequences via a notion of superposition. In addition to equational theories, term rewriting has been successfully extended to inductive theories, first-order logic, first-order logic with equality, as well as having been applied to functional and logic programming. In fact, it has already become one of the most active and versatile areas in automated deduction. In this tutorial, we introduce term rewriting and survey its diverse applications. We shall emphasize more recent developments and point out the most promising approaches as well as some future research directions. We shall also present a unified view of term rewriting and paramodulation/demodulation.

Tutorial on Program-Synthetic Deduction Richard Waldinger Artificial Intelligence Center SRI International Menlo Park, California 94025 Software development is an appropriate and promising application of automated deduction. Theorem-proving techniques are being applied to such tasks as program synthesis (deriving a program to meet given specifications) and program verification (proving that a given program does meet its specifications). Deductive methods can also be adapted to less demanding applications, such as bug detection (discovering an input that causes a program to malfunction) and program modification (altering a program to reflect a change in its specifications). In this tutorial we present deduction techniques particularly well stilted to software development applications.

Tutorial on Rewrite-Based Theorem Proving Jieh Hsiang

Jean-Pierre Jouannaud

State University of New York Stony Brook, New York

Universit~ de Paris-Sud Orsay, France

Theorem proving involving equality has been one of the most exciting research areas in atitomated deduction. Wos and Robinson proposed the paramodulation inference rule and its demodulation refinement in 1967. At about the same time, Knuth and Bendix presented the method of term rewriting. Term rewriting orients equations into rules according to a well-founded ordering and selects the deductive consequences via a notion of superposition. In addition to equational theories, term rewriting has been successfully extended to inductive theories, first-order logic, first-order logic with equality, as well as having been applied to functional and logic programming. In fact, it has already become one of the most active and versatile areas in automated deduction. In this tutorial, we introduce term rewriting and survey its diverse applications. We shall emphasize more recent developments and point out the most promising approaches as well as some future research directions. We shall also present a unified view of term rewriting and paramodulation/demodulation.

Tutorial on Program-Synthetic Deduction Richard Waldinger Artificial Intelligence Center SRI International Menlo Park, California 94025 Software development is an appropriate and promising application of automated deduction. Theorem-proving techniques are being applied to such tasks as program synthesis (deriving a program to meet given specifications) and program verification (proving that a given program does meet its specifications). Deductive methods can also be adapted to less demanding applications, such as bug detection (discovering an input that causes a program to malfunction) and program modification (altering a program to reflect a change in its specifications). In this tutorial we present deduction techniques particularly well stilted to software development applications.

Tutorial on C o m p u t i n g Models of Propositional Logics Paul Pritchard

John Slaney

University of Queensland Brisbane, Australia

Australian National University Canberra, Australia

The technique of modeling propositional logics by means of finite algebras is at least as old as many-valued logic and has provided much information about such non-classical systems as relevant logics, linear logic, and connexive logic. The problem of enumerating these algebras is one of satisfying finite constraints and so solutions to it generalise widely. "Generate and Test" methods suffer from a prohibitive exponential complexity, which has generally inhibited investigation except in trivial cases. In this tutorial we present radical improvements on the naive backtrack algorithm. These have made it possible to enumerate quite large structures suitable for modelling "difficult" logics. We also discuss recent work in parallelising both the generating programs and some applications.

Author Index Altucher, James A ............................................................... Andrews, Peter B ................................................................ A r a y a , Carlos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Baader, Franz ............................................................... B a c h m a i r , Leo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Baral, Chitta .................................................................... Basin, D a v i d A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Benanav, Dan ................................................................... Bibel, W o l f g a n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Boudet, Alexandre ............................................................... Boy de la Tour, T h i e r r y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Boyer, R o b e r t S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brown, F r a n k M . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Bundy, Alan ........................................................... B/irckert, H a n s - J / i r g e n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Butler, Ralph ............................................................... Chou, S h a n g - C h i n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . d a Costa, N e w t o n C. A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dougherty, Daniel J .............................................................. E i c h e n l a u b , Carl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ertel, W o l f g a n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Esrig, B r u c e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Farmer, William M ............................................................... Felty, A m y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Foster, Ian . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ganzinger, Harald ..................... .......................................... Gao, Xia~-Shan .................................................................. Gramlich, Bernhard .............................................................. Gunter, Elsa ..................................................................... Guttman, Joshua D .............................................................. Hagiya, Masami ................................................................. Heisel, M . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Henschen, L a w r e n c e J . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Herzig, A n d r e a s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hines, L a r r y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hook, J a m e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Horn, C h r i s t i a n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hsiang, J i e h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hutter, Dieter ................................................................... Ireland, Andrew ................................................................. Issar, Sunil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Jackson, Peter ...................................................................

500 641 643, 645 396, 681 427 102 251 442 426 292 558 1 643, 645 132, 633, 647 t78 485, 649 207 72 261 651 470 651 653 221,682 649 427 207 655 682 653 588 117 57, 72, 456 683 193 651 647 684 147 132 641 543

687

JindM, Anita .................................................................... Johann, Patricia ................................................................. Jouannaud, Jean-Pierre .......................................................... K£ufl, T h o m a s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Kaufmann, Matt ................................................................. Kirchner, Claude ................................................................ Klapper, Carl .................................................................... Kurfess, F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Lee, S a n g Ho . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Lescanne, Pierre ................................................................. Letz, R . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Lobo, J o r g e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Lu, J a m e s J . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Lusk, E w i n g L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Martin, Ursula ................................................................... McCune, William ...................................................... McMichael, Alan F ............................................................... Miller, D a l e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Minker, Jack ..................................................................... Moore, J S t r o t h e r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mfiller, Jfirgen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M u r r a y , Neil V . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Narendran, Paliath .............................................................. Nebel, B e r n h a r d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nesmith, Dan ............................................................... Nie, X u m i n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nieuwenhuis, Robert ............................................................. Nipkow, T o b i a s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nutt, Werner ............................................................... Ohlbach, Hans J~rgen ........................................................... Orejas, F e r n a n d o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Otto, Friedrich ................................................................... O v e r b e e k , Ross . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O z t u r k , Yusuf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Pais, J o h n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Panangaden, Prakash ............................................................ P a y n e , T. H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Peterson, Gerald E ............................................................... Pfenning, Frank ........................................................ Pierce, W i l l i a m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Plaisted, David A ................................................................. Pollock, J o h n L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Pottinger, Garrel ................................................................ Pritchard, Paul ..................................................................

649 261 684 657 659 682 651 683 57 661 40, 683 102 72 28, 485, 681 366 485, 663, 681 308 221, 682 102 1 681 665 276 681 336, 641 16 667 366 618, 681 683 667 276 485, 649 456 543 500 87 381 336, 6 4 1 , 6 8 2 351 16 669 651 685

688

Pym, David . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reddy, U d a y S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reif, W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . R i t t r i , Mikael . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . R o s e n t h a l , Erik . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

236 162 117 603 665

Rubio, A l b e r t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Satz, R o n a l d W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Schumann, J ................................................................. Schwind, C a m i l l a B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

667 671 40, 683 528

Slaney, J o h n K . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Smaill, A l a n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Smolka, Gert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Snyder, W a y n e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Steinbach, J o a c h i m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Stephan, W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Stevens, R . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Stickel, M a r k E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S u b r a h m a n i a n , V. S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sutcliffe, Geoff . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Suttner, Christian . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tarver, M a r k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T h a y e r , F. Javier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T u o m i n e n , Heikki . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . van H a r m e l e n , F r a n k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Voronkov, A. A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . W a k a y a m a , Toshiro . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Waldinger, R i c h a r d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Wallen, L i n c o l n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

28, 685 132, 647 681 573 411 117 485 673 72 675 470 322 653 514 132, 647 677 87 684 236

Winker, S. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Wolfram, D. A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

485 679

Wos, L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Zabel, Nicolas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

485 657