10th International Conference on Automated Deduction: Kaiserslautern, FRG, July 24-27, 1990. Proceedings (Lecture Notes in Computer Science)

Lecture Notes in Artificial Intelligence Subseries of Lecture Notes in Computer Science Edited by J. Siekmann

Lecture Notes in Computer Science Edited by G. Goos and J. Hartmanis

Editorial

Artificial Intelligence has become a major discipline under the roof of Computer Science. This is also reflected by a growing number of titles devoted to this fast developing field to be published in our Lecture Notes in Computer Science. To make these volumes immediately visible we have decided to distinguish them by a special cover as Lecture Notes in Artificial Intelligence, constituting a subseries of the Lecture Notes in Computer Science. This subseries is edited by an Editorial Board of experts from all areas of AI, chaired by JOrg Siekmann, who are looking forward to consider further AI monographs and proceedings of high scientific quality for publication. We hope that the constitution of this subseries will be well accepted by the audience of the Lecture Notes in Computer Science, and we feel confident that the subseries will be recognized as an outstanding opportunity for publication by authors and editors of the AI community. Editors and publisher

Lecture Notes in Artificial Intelligence Edited by J. Siekmann Subseries of Lecture Notes in Computer Science

449 M.E. Stickei (Ed.)

10th International Conference on Automated Deduction Kaiserslautern, FRG, July 24-27, 1990 Proceedings

Springer-Verlag Berlin Heidelberg New York London Paris Tokyo Hong Kong Barcelona

Editor Mark E. Stickel Artificial Intelligence Center SRI International 333 Ravenswood Avenue, Menlo Park, CA 94025, USA

CR Subject Classification (1987): 1.2.3 ISBN 3-540-52885-7 Springer-Verlag Berlin Heidelberg N e w Y o r k ISBN 0-387-52885-7 Springer-Verlag N e w Y o r k Berlin Heidelberg

This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in other ways, and storage in data banks. Duplication of this publication or parts thereof is only permitted under the provisions of the German Copyright Law of September 9, 1965, in its version of June 24, 1985, and a copyright fee must always be paid. Violations fail under the prosecution act of the German Copyright Law. © Springer-Verlag Berlin Heidelberg 1990 Printed in Germany Printing and binding: Druckhaus Beltz, Hemsbach/Bergstr. 2145/3140-5432t0 - Printed on acid-free paper

~L~i

Li International Conference on Automated Deduction, Kaiserslautern, FIT Germany

Hambacher SchloB property of Landkreis Bad DOrkheim drawn by Prof. Horst R6mer, Krickenbach

Preface This volume contains the papers presented at the Tenth International Conference on Automated Deduction (CADE-10) held on 24-27 July 1990 in Kaiserslautern, West Germany, a famous center of automated deduction research. CADE is the major forum at which research on all aspects of automated deduction can be presented. Proceedings of previous CADEs are invaluable references for the field; this volume should be no exception. There were t09 papers submitted to CADE-10. Each was reviewed by three program committee members, and 42 papers were selected for presentation at the conference. Over eighty referees outside the program committee assisted in the reviewing process. The papers here represent the richness and diversity of the field. They range from theory to implementation and experimentation, from propositional to higher-order calculi and nonclassical logics; they refine and use a wealth of methods that includes resolution, paramodulation, rewriting, completion, unification, and induction; and they work with a variety of applications that includes program verification, logic programming, deductive databases, and theorem proving in many domains. Research in this field is conducted around the world: about half the papers are from the United States; Germany, the United Kingdom, and France are strongly represented; authors from Australia, Brazil, Finland, Japan, Korea, and Sweden are also present. This volume also contains abstracts of 20 implementations of automated deduction systems, and descriptions of tutorials given at the conference. I am indebted to the program committee for their effort and thought in organizing the program; to Hans-Jfirgen B~rckert and Hans J~rgen Ohlbach for making the local arrangements for the conference; to the invited speakers Robert Boyer and J Moore (Keynote Address), Woody Bledsoe (Banquet Address), Wolfgang Bibel, and Alan Bundy; to the presenters of tutorials at the conference; to Fernando Pereira and Bell Laboratories for hosting the program committee meeting; and to the organizations listed below for their financial and organizational support of CADE-10.

Mark E. Stickel Chairman, CADE-10

Program Committee Peter Andrews, Carnegie Mellon University Wolfgang Bibel, Technische Hochschute Darmstadt W. W. Bledsoe, University of Texas at Austin Alan Bundy, University of Edinburgh Robert Constable, Cornell University Jean-Pierre Jouannaud, Universit~ de Paris-Sud Deepak Kapur, State University of New York at Albany Matt Kaufmann, Computational Logic Inc. Claude KirchneT; INRIA Lorraine & CRIN Jean-Louis Lassez, IBM T. J. Watson Research Center Donald Loveland, Duke University Ewing Lusk, Argonne National Laboratory Michael McRobbie, Australian National University Dale Miller, University of Pennsylvania Hans Jiirgen Ohlbach, Universit/it Kaiserslautern Ross Overbeek, Argonne National Laboratory William Pase, Odyssey Research Associates Lawrence PauIson, Cambridge University Fernando Pereira, Bell Laboratories David Plaisted, University of North Carolina at Chapel Hitl JSrg Siekmann, Universit/it Kaiserslautern Mark Stickel, SRI International Richard Waldinger, SRI International Christoph Walther, Universit£t Karlsruhe

Local Arrangements IIans-Jiirgen Biirckert, DFKI, Kaiserslautern Hans Jiirgen Ohtbach, Universit~t Kaiserslautern

Referees S. Anantharaman O. Astrachan P, Attie F. Baader L. Bachmair S. Bailin B. Brock H.-J. Biirckert R. Butler J. Christian E. Clarke H. C0mon E. Contejean B. Courcelle D. Craigen M. Dauchet M. Davis J. Dix E. Dorenjoud M. Fitting L. Fribourg H. Ganzinger I. Gnaedig B. Gramlich M. Gray R. Helm M. Hermann L. Hines

K. Palem S. HStldobler C. Petrie J. Hsiang F. Pfenning M. Huhns W. Pierce D. Hutter A. Pr£cklein T. Huynh L. Puet J. Jaffar D. Reed G. N. Kartha M. Rusinowitch S. Kaufman D. Russinoff H. Kirchner M. Saaltink F. Klay R. S&ott E. Kounalis R. Shostak K. Kunen D. Simon D. Lankford R. Socher C. Lassez W. Stephan P. Lescanne R. Stevens C. Lingenfelder J. Stillman D. Lugiez V. S. Subrahmanian M. Maher S. Tison C. March6 C. Tretkoff K. Marriott M. Truszczynski N. McCain P. Viry W. McCune L. WMlen N. McPhee M. Wilding J. M/itler W. Winsborough X. Nie W. Young T. Nipkow H. Zhang A. Nonnengart W. Nutt

Support CADE-IO is supported by

International Joint Conferences on Artificial Intelligence, Inc. Adam Opel AG, Werk Kaiserslautern BASF AG, Ludwigshafen Daimler Benz AG, Stuttgart Deutsche Forschungsgemeins&aft (DFG), Bonn Dornier GmbH, Friedrichshafen Krupp Atlas Elektronik GmbH, Bremen Siemens AG, Mfinchen Stifterverband fiir die Deutsche Wissenschaft, Essen Volkswagen AG, Wolfsburg Assistance in organizing CADE-IO was given by

Deutsches Forschungszentrum f/ir Kfinstliche Intelligenz (DFKI), Kaiserslautern Universitiit Kaiserslautern SRI International, Menlo Park, California Bell Laboratories, Murray Hill, New Jersey

Table of Contents Session 1: K e y n o t e Address 8:30-10:00 Wednesday, 25 July 1990

A Theorem Prover for a Computational Logic Robert S. Boyer, J Strother Moore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1

Session 2 10:30-12:00 Wednesday

A Complete Semantic Back Chaining Proof System 16

X u m i n Nie, David A. Plaisted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Parallelizing the Closure Computation in Automated Deduction 28

John K. Slaney, Ewing L. Lusk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PARTHEO: A High-Performance Parallel Theorem Prover 40

J. Schumann, R. Letz . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Session 3 13:30-15:30 Wednesday

Substitution-based Compilation of Extended Rules in Deductive Databases 57

Sang Ho Lee, Lawrence J. IIenschen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Automatic Theorem Proving in Paraconsistent Logics: Theory and Implementation Newton C. A. da Costa, Lawrence J. Henschen, James J. Lu, V. S. Subrahmanian

72

Case-Free Programs: An Abstraction of Definite Horn Programs Toshiro Wakayama, T. H. Payne . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

87

Generalized Well-founded Semantics for Logic Programs Chitta Baral, Jorge Lobo, Jack Minker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

102

Session 4 13:30-15:30 Wednesday

Tactical Theorem Proving in Program Verification M. IIeisel, W. Reif, W. Stephan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

117

Extensions to the Rippling-Out Tactic for Guiding Inductive Proofs Alan Bundy, Frank van HarmeIen, Alan Smaill, Andrew Ireland . . . . . . . . . . . . . . . . .

132

Guiding Induction Proofs Dieter Hutter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

147

Term Rewriting Induction Uday S. Reddy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

162

×ll

Session 5 16:00-17:30 Wednesday

A Resolution Principle for Clauses with Constraints tIans-Jiirgen Biirckert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

178

Strq-veC_: The Strq-ve-based Subset Prover Larry H i n e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

193

Ritt-Wu's Decomposition Algorithm and Geometry Theorem Proving Shang-Ching Chou, X i a o - S h a n Gao . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

207

Session 6 8:30-10:00 Thursday, 26 July 1990

Encoding a Dependent-Type A-Calculus in a Logic Programming Language A m y Felty, Dale M i l l e r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

221

Investigations into Proof-Search in a System of First-Order Dependent Function Types David Pyre, Lincoln I/VaIten . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

236

Equality of Terms Containing Associative-Commutative Functions and Commutative Binding Operators is Isomorphism Complete David A. Basin

................................................................

251

Session 7 10:30-12:00 Thursday

An Improved General E-Unification Method Daniel J. Dougherty, Patricia Johann . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

261

Some Results on Equational Unification Patiath Narendran, Friedrich Otto . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

276

Unification in a Combination of Equational Theories: an Efficient Algorithm Alezandre B o u d e t

..............................................................

292

Session 8 13:30-15:30 Thursday

SLIM: An Automated Reasoner for Equivalences, Applied to Set Theory Alan F. M c M i c h a e l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

308

An Examination of the Prolog Technology Theorem-Prover M a r k Tarver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

322

Presenting Intuitive Deductions via Symmetric Simplification Frank Pfenning, Dan N e s m i t h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

336

Toward Mechanical Methods for Streanflining Proofs William Pierce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

351

Xlll

Session

9

13:30--15:30 Thursday

Ordered Rewriting and Confluence Ursula Martin, ~Ibbias Nipkow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

366

Complete Sets of Reductions with Constraints Gerald E. Peterson . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

381

Rewrite Systems for Varieties of Semigroups Franz Baader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

396

Improving Associative Path Orderings Joachim Steinbach : . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

411

Session

10: Invited

Talk

16:00-17:00 Thursday

Perspectives on Automated Deduction Wolfgang Bibel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Session

426

11

8:30-10:00 Friday, 27 July 1990

On Restrictions of Ordered Paramodulation with Simplification Leo Bachmair, Haratd Ganzinger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

427

Simultaneous Paramodulation Dan Benanav . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

442

Hyper Resolution and Equality Axioms without Function Substitutions Yusuf Ozturk, Lawrence Henschen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Session

456

12

10:30-12:00 Friday

Automatic Acquisition of Search Guiding Heuristics Christian Suttner, Wolfgang Ertel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

470

Automated Reasoning Contributes to Mathematics and Logic L. Wos, S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, R. Butler ... 485

A Mechanically Assisted Constructive Proof in Category Theory James A. Altucher, Prakash Panangaden . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

500

XIV

Session 13 13:30-15:30 Friday

Dynamic Logic as a Uniform Framework for Theorem Proving in Intensional Logic Heikki Tuominen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

514

A Tableaux-Based Theorem Prover for a Decidable Subset of Default Logic Camilla B. Schwind . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

.............................

528

Computing Prime Implicants Peter Jackson, John Pals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

543

Minimizing the Number of Clauses by Renaming Thierry Boy de la Tour . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

558

Session 14 13:30-15:30 Friday

Higher Order E-Unification Wayne Snyder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

573

Programming by Example and Proving by Example Using Higher-order Unification Masami Hagiya . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588 Retrieving Library Identifiers via Equational Matching of Types Mikael Rittri . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

603

Unification in Monoidal Theories Werner Nutt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

618

Session 15: I n v i t e d T a l k 16:00-17:00 Friday

A Science of Reasoning: Extended Abstract Alan Bundy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

633

System Abstracts The TPS Theorem Proving System Peter B. Andrews, Snail Issar, Dan Nesmith, Frank Pfenning . . . . . . . . . . . . . . . . . . .

641

Schemata Frank M. Brown, Carlos Araya . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

643

Cylindric Algebra Equation Solver Frank M. Brown, Carlos Araya . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

645

The Oyster-Clam System Alan Bundy, Frank van Harmelen, Christian Horn, Alan Smaill . . . . . . . . . . . . . . . . .

647

A High-Performance Parallel Theorem Prover Ralph Butler, Ian Foster, Anita Jindal, Ross Overbeek . . . . . . . . . . . . . . . . . . . . . . . . . . .

649

×Y

The Romulus Proof Checker Carl EichenIaub, B r u c e Esrig, J a m e s HOok, Carl Klapper, GarreI P o t t i n g e r . . . . . .

651

IMPS: An Interactive Mathematical Proof System W i l l i a m M. Farmer, Joshua D. G u t t m a n , F. J a v i e r T h a y e r . . . . . . . . . . . . . . . . . . . . . .

653

UNICOM: A Refined Completion Based Inductive Theorem Prover B e r n h a r d Gramlich . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

655

The Theorem Prover of the Program Verifier Tatzelwurm T h o m a s I(duJ:l, Nicolas Zabel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

657

RCL: A Lisp Verification System Matt Kaufmann

................................................................

659

ORME: An Implementation of Completion Procedures a~ Sets of Transitions Rules Pierre Lescanne . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

661

OTTER 2.0 William McCune ...............................................................

663

DISSOLVER: A DisSolution-based Theorem Prover N e l l V. Murray, E r i k Rosenthal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

665

TRIP: An Implementation of Clausal Rewriting Robert N i e u w e n h u i s , Fernando Orejas, Albert Rubio . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

667

OSCAR J o h n L. Pollock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

669

EXPERT THINKER: An Adaptation of F-Prolog to Microcomputers RonaId W. S a t z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

671

A Prolog Technology Theorem Prover M a r k E. Stickel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

673

A General Clause Theorem Prover G e o f f Sutcliffe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

675

LISS--The Logic Inference Search System A. A . Voronkov . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

677

ACE: The Abstract Clause Engine D. A. W o l f r a m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

679

Tutorials Tuesday, 2~ J u l y 1990

High-Performance Automated Theorem Proving E w i n g Lusk, W i l l i a m M c C u n e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

681

Reasoning and Representation with Concept Languages Jiirgen Miiller, Franz Bander, B e r n h a r d Nebel, W e r n e r Nutt, Gert Smolka . . . . . . .

681

×YJ

,kProlog A m y Felty, Elsa Gunter, Dale Miller, Frank Pfenning . . . . . . . . . . . . . . . . . . . . . . . . . . .

682

Equational Unification Claude Kirchner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

682

Compilation Techniques for Logics Hans Jiirgen Ohlbach, Andreas Herzig . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

683

High-Performance Theorem Provers: Efficient Implementation and Parallelisation J. Schumann, R. Letz, F. Kurfess . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

683

Rewrite-Based Theorem Proving Jieh Hsiang, Jean-Pierre Jouannaud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

684

Program-Synthetic Deduction Richard Waldinger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

684

Computing Models of Propositional Logics Paul Pritchard~ John Slaney . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

685

Author

686

Index

.............................................................

Keynote Address

A Theorem Prover for a Computational Logic Robert S. Boyer 1 J Strother Moore C o m p u t a t i o n a l L o g i c , Inc., Suite 290 1717 W . 6th St. A u s t i n , T e x a s 78703 U.S.A.

Abstract We briefly review a mechanical theorem-prover for a logic of recursive functions over finitely generated objects including the integers, ordered pairs, and symbols. The prover, known both as NQTHM and as the Boyer-Moore prover, contains a mechanized principle of induction and implementations of linear resolution, rewriting, and arithmetic decision procedures. We describe some applications of the prover, including a proof of the correct implementation of a higher level language on a microprocessor defined at the gate level. We also describe the ongoing project of recoding the entire prover as an applicative function within its own logic.

1 Introduction We feel honored to be invited to give the keynote address for CADE-10. We thank Mark Stickel and the program committee for the invitation. It has been suggested that we discuss our theorem prover and its application to proving the correctness of computations. We have been working on our prover, on and off, since about 1972 [9]. This prover is known both as the Boyer-Moore theorem prover and as NQTHM. (pronounced en-que-thum, an acronym for "New, Quantified THeoreM Prover," an uninspired parochialism that has taken on a life of its own). The details of our prover and its applications have been extensively presented in several books and articles. In fact, from these publications the prover has been recoded by at least three other groups. In this paper, we will (a) very briefly review the prover and its applications, (b) provide pointers to the literature on the prover and its applications, and (c) discuss ACL2, a new development of the prover which involves recoding it in its own logic, a subset of applicative Common Lisp. In the subsequent discussion, we will make reference to two books, which are the main references on NQTHM. They are (a) A Computational Logic [11] which we will abbreviate as " A C L " and (b) A Computational Logic Handbook [18] which we will abbreviate as " A C L H " . Although a decade old, ACL still provides a rather accurate description of many of the prover's heuristics and some simple applications, whereas the much more recent ACLH accurately describes the current logic and user interface.

1Mailing address: Computer Sciences Department, University of Texas at Austin, Austin, Texas 78712 U.S.A.

2 The

Logic

Although many theorem provers, especially those of the resolution tradition, are designed to work with arbitrary collections of first order axioms, NQTHM is designed to be used mainly with the fixed set of axioms we provide, typically augmented by a number of definitions provided by the NQTHM user. Questions one might ask about the NQTHM theory are "What are the well-formed formulas, what are the axioms, and what are the rules of inference?" The precise answers to these questions may be found in Chapter 4 of ACLH. Roughly speaking, in that chapter, we present our logic (the Boyer-Moore Logic or NQTHM Logic, as it is sometimes known) by starting from standard first order logic as in [70] and then adding some axioms that describe certain data structures, including the integers, ordered pairs, and symbols. We include in the logic a principle of definition for recursive functions over these data structures. Among our rules of inference is a schema for proof by induction. This schema would be merely a derived rule of inference were we to cast our induction axioms in the traditional form. The syntax of our logic is close to that of Lisp. In fact, from the time we started writing our prover [9] we have regarded it as a theorem prover for a theory of Lisp functions. Some of the earliest theorems we proved mechanically were inspired by some of McCarthy's seminal papers on the logic of Lisp, including [54], [56], and [58]. Because Lisp may be viewed as both a logic and a programming language, we have always found it a most natural setting in which to express theorems about computations and other parts of constructive mathematics. Both the axioms of the NQTHM logic and the conjectures it entertains are quantifier free, or, more precisely, implicitly universally quantified " o n the far outside." In fact, NQTHM does not include rules for manipulating quantifiers at all. However, by using recursive functions, we are able to express many of the things that one usually expresses with quantifiers when dealing with "finite" objects such as trees of integers. For example, to state and prove the uniqueness and existence of prime factorizations [11], we define recursive functions which factor integers and which compute whether two finite sequences of integers are permutations of one another. This practice of using recursive functions to do work one might do with quantifiers may have been originated by Skolem in [71], who was perhaps the earliest to demonstrate that arithmetic could be built up using entirely constructive methods. Skotem's program is further carried out in [34]. Here is an example of a definition that one might give to the prover for a function that appends, i.e. concatenates, two lists: Definition.

( ~ P X Y) (IF (LISTP X) (CONS (CAR X) Y)

(APP (CDR X) Y))

In rough English, this definition says that to append a list X to a list Y, if X is nonemtpy, then construct (i.e. CONS) the list whose first element is the first element of X, i.e. (CAR X) , and whose other elements are the result of appending the rest of X, i.e. (CDR X), and Y. On the other hand, if x is empty, just return Y. A simple example of a theorem that one might ask NQTHM to prove is the associativity of ~D~,p, which one would state as

Theorem. ( ~ P (APt' X Y) Z) =

(APP X

(APP ~ Z))

We discuss a proof of this theorem below when we describe the induction heuristic. 3 The Prover 3.1 H o w to G e t a C o p y NQTHM is a Common Lisp program whose source files require about one million characters. NQTHM runs in a variety of Common Lisps including Lucid, Allegro, Symbolics, and KCL. It is publicly available, but a license is now required. We have recently started to require a license to keep track of copies at the strong suggestion of one of our sponsors. We previously distributed the same code without copyright or license. At the time of this writing, a copy may be obtained without fee by anonymous ftp from Internet site cli.com (start with the file /pub/nqthm/README) or on tape for a modest fee by writing to the authors at Computational Logic, 1717 W. 6th St., Austin, Texas 78703. The currently released version of NQTHM was first released in July of 1988, and no bugs affecting soundness have been reported as of the time of this writing. The chapter of ACLH on installation describes in complete detail how to bring up NQTHM from the sources. 3.2 W A R N I N G : Difficulty of Use It is hard, perhaps impossible, to use NQTHM effectively without investing a substantial amount of time learning how to use it. To avoid disappointment, a prospective user should probably be prepared first to understand most of two rather long books, ACL and ACLH. Almost all of the successful users of NQTHM have in fact also taken a course from us at the University of Texas at Austin on proving theorems in our logic. Based upon teaching related courses at Stanford, our former student N. Shankar advises that a user unfamiliar with the heuristics employed in the prover, as described in great detail in ACL, is very unlikely to direct the prover to prove anything significant. Besides precisely describing the logic of NQTHM, ACLH also serves as a user's manual, describing in great detail all of the commands with which one can direct the prover. 3.3 H e u r i s t i c C h a r a c t e r o f N Q T H M NQTHM is a heuristic theorem-prover. By heuristic, we mean that we have coded guessing strategies for searching through the space of possible proofs for conjectures. For example, NQTHM guesses when it is best to cut off "back chaining". If the guess is wrong, which it can easily be, then no proof may be found. As another example, NQTHM often guesses an induction to try, when all other proof techniques cease to be applicable. If the guess is wrong, then NQTHM will irrevocably go chasing down a search path that is probably totally fruitless. On the other hand, because NQTHM does have heuristics, NQTHM is able to find proofs for what we believe is a remarkable number of theorems. One crude measure of the effectiveness of NQTHM is that it is always is able to make an above average grade on the final examinations we give to our students in an introductory graduate course on proving theorems in the NQTHM logic. We were inspired in part to build a theorem prover that is heuristic by the success of W. W. Bledsoe [4], [5] in writing such theorem provers, including one that guessed inductions based upon the terms in the conjecture. One of the major concerns in the literature on automated reasoning in the 60's and 70's was with the completeness of proof procedures. NQTHM is certainly not complete, except when guided by a knowledgeable user.

3.4 Induction Perhaps the most important heuristic in NQTHM is the induction heuristic. The key to the success of our induction heuristic is that it is closely tied to the principle of recursive definition which we employ. For example, to prove the associativity of APP, mentioned above, NQTHM would guess to induction on X by CDIK i.e. by the length of the first argument. This induction mirrors the way that APP recurses. An important part of the induction heuristic is filtering out suggested inductions which are "not likely" to work, such as the induction on Y by CDR in the theorem above. The NQTHM practice of not permitting quantification but of permitting the user to define recursive functions to express what might otherwise require quantification has an effect of forcing the user to hint implicitly how to prove conjectures: try inductions that mirror the definitions of the recursive functions used in the conjectures. This heuristic is startlingly successful for the NQTHM logic. 3.5 Simplification Besides induction, the other most important theorem proving component in NQTHM is the simplifier. The simplifier combines rewriting (cf. [74] and [4]) with linear and binary resolution and subsumption (cf. [65] and [53]). The simplifier also includes a semi-decision procedure for a part of arithmetic, based upon ideas in [36]. An aspect of our simplifier that accounts for much of its effectiveness is a "type set" facility which keeps track, for each expression actively under consideration, a bit-mask's worth of information indicating a conservative estimate of the " t y p e " of the expression in terms of the basic data types of the NQTHM Logic. The type set procedure, like most of the current simplifier, is described in ACL. 3.6 O t h e r Heuristics Of considerably less significance than induction or simplification are various NQTHM routines which are named "elimination of destructors," "cross fertilization," "generalization,"and "elimination of irrelevance." The structure of NQTHM, at least as it was in 1979, is described in complete detail in ACL. That work remains a largely accurate description of NQTHM except for (a) the integration of the arithmetic decision procedure, described in [19], (b) the addition of metafunctions and an efficient representation for large constant terms, described in [12], (c) some simplifications of the induction machinery that have never been documented, (d) the axiomatization of an interpreter for partial recursive functions [20], and (e) an implementation of a derived rule of inference called "functional instantiation" [8]. 4 T h e I m p o r t a n c e o f t h e U s e r in F i n d i n g P r o o f s Although NQTHM is quite capable of finding proofs for some simple theorems with which even graduate students may struggle, we think of NQTHM as more of a proof checker than as a theorem-prover. What do we mean by this distinction? It is perhaps not possible to spell out clearly what the distinction is. However, whenever we have in mind an interesting theorem for NQTHM to prove, we almost always expect to have to suggest to NQTHM what the main intermediate steps to the proof are. We do expect NQTHM to do a great deal of tedious work filling in minor details. And when filling in such minor details, NQTHM very often exposes minor oversights in our statement of theorems. The situation is entirely

different for some "real theorem-provers," such as those of Wu and Chou [27], which one expects to decide quickly any theorem in their domain. The earliest version of NQTHM [9] had no facility for user guidance. The power of that early version of the prover may be very crudely characterized by saying that, starting from Peano's axioms, and analogous axioms for lists, the prover could not prove anything much more difficult than the associativity of multiplication or the correctness of an insertion sort algorithm. In order to permit NQTHM to prove theorems harder than these (without "cheating" by adding additional formulas as axioms), the most important step we took was to permit the user to suggest "lemmas," i.e. intermediate theorems, which would f'trst be proved by NQTHM and then made available for use in subsequent proofs, mainly by the simplifier [10]. Permitting the use of lemmas on the one hand makes NQTHM feel more like a proof checker than a theorem prover, but on the other hand itpermits the checking of a very substantial part of elementary number theory [66], even including Gauss's law of quadratic reciprocity (the crown jewel of number theory), and the correctness of some interesting algorithms [ 16].

5 Our Motivation: Computer System Correctness Given that NQTHM is not a very "smart" theorem prover, one might well ask why we have kept working on it for so many years! Our main motivation has been to develop NQTHM into a system that can be used in a practical way to check the correctness of computer systems, thereby reducing the frequency of bugs in computer programs. The idea of proving the correctness of algorithms is at least as old as Euclid's demonstration of the correctness of an algorithm for finding the greatest common divisor of two integers [29]. The idea of correctness proofs is also clearly stated in the classic papers of Goldstine and von Neumann [73] that describe the first yon Neumann machine and how to use it. In those papers fifteen programs, including a sort routine, are specified, coded in machine language, and proved correct. Although correctness proofs were undoubtedly constructed by many early programmers, publications about this idea seem rare until the 60s, when McCarthy [56], Floyd [30], Hoare [35], and Burstall [26] described means for proving the correctness of programs written in higher level languages. Subsequently a rather sizable literature on the subject has developed. Proofs of the correctness of computing systems seem to be much longer, much more tedious, and much more error prone than proofs in ordinary mathematics. The additional length is due to the fact that the computing systems may easily require hundreds of pages of specification, whereas most propositions in mathematics can easily be stated in a few pages -- even if one includes the axiomatization of set theory, analysis, and algebra. The tediousness and error level are perhaps due to this length and also to the fact that many parts of computing systems are mathematically boring. The idea of mechanically checking proofs of correctness of computing systems has been pursued by many researchers, e.g. those mentioned in the review article [7]. Research on this topic has grown to the extent that there are several research laboratories (e.g. the Computer Science Laboratory of SRI International) and several small companies (e.g. our own Computational Logic, Inc. and Richard Platek's Odyssey Associates, Inc.) which devote a major portion of their efforts to research on this topic.

6 Applications We and others have used NQTHM to check the correctness of many small programs. However, after many years of effort, we are beginning to see mechanical correctness proofs of entire small computing systems. By far, the most significant application of NQTHM has been to a prove the correctness of a computing system known as the CLI Stack, which includes (a) a microprocessor design (FM8502) based on gates and registers [38], (b) an assembler (Piton) [61] that targets FM8502, and (c) a higher level language (micro Gypsy) [76] that targets Piton. We have also seen a proof of correctness of a small operating system kernel (KIT) [2]. Except for the Piton work, all of these projects represent Ph.D. dissertations in computer science which we supervised at the University of Texas. FM8502, Piton, micro Gypsy, and Kit are documented in one place, a special issue of the Journal of Automated Reasoning [62]. Another major application of NQTHM is the Ph.D. work of N. Shankar in proof checking Godel's incompleteness theorem [69]. The text of this proof effort is included in the standard distribution of NQTHM, along with Shankar's checking of the Church-Rosser theorem. On pp. 4-9 of ACLH, we enumerate many other applications of NQTHM, including those in list processing, elementary number theory, metamathematics, set theory, and concurrent algorithms. Descriptions of some of these applications may be found in [16, 66, 12, 21, 17, 67, 68, 69, 20, 60, 28, 51, 37, 52, 13, 14, 15, 22, 77] and also in [1, 31, 32, 33, 40, 75, 3, 48, 44, 41, 42, 39, 45, 23, 24, 25]. Recently colleagues of ours at Computational Logic, Inc., Bill Young and Bill Bevier, have used NQTHM to construct mechanically checked proofs of properties relating to faulttolerance. A key problem facing the designers of systems which attempt to ensure fault tolerance by redundant processing is how to guarantee that the processors reach agreement, even when one or more processing units are faulty. This problem, called the Byzantine Generals problem or the problem of achieving interactive consistency, was posed and solved by Pease, Shostak, and Lamport [64, 50]. They proved that the problem is solvable if and only if the total number of processors exceeds three times the number of faulty processors and devised an extremely clever algorithm (the "Oral Messages" Algorithm) which implements a solution to this problem. Bill Young and Bill Bevier, have just finished developing a machine checked proof of the correctness of this algorithm using NQTHM. Matt Kaufmann, of Computational Logic, Inc., has made extensive additions to NQTHM, building a system called "PC-NQTHM" on top of NQTHM, which many find more convenient than NQTHM for checking proofs. Information about PC-NQTHM and some extensions and applications may be found in [46, 49,45, 47, 63, 43, 76]. Among the theorems which Kaufmann has checked with PC-NQTHM are: • Ramsey's theorem for exponent 2 (both finite and infinite versions), with explicit bound in the finite case [41, 46]. • Correctness of an algorithm of Gries for finding the largest "true square" submatrix of a boolean matrix [40]. • The Cantor-Schroeder-Bernstein theorem [46]. • The correctness of a Towers of Hanoi program. • The irrationality of the square root of 2. • Correctness of a finite version of the collapsing function of Cohen forcing.

7 W o r k in P r o g r e s s : A C L 2 We are currently constructing an entirely new version of our prover. The name of the new system is A Computational Logic for Applicative Common Lisp, which might be abbreviated as "ACL ACL" but which we abbreviate as "ACL2". Whereas NQTHM has been available for some time, extensively documented, and widely used, ACL2 is still very much under development. Hence the following remarks are somewhat speculative. Instead of supporting "Boyer-Moore logic", which reflects an odd mixture of functions vaguely, but not consistently, related to Lisp 1.5 and Interlisp, ACL2 direcdy supports perfectly and accurately (we hope) a large subset of applicative Common Lisp. That is, ACL2 is to applicative Common Lisp what NQTHM is to the "Boyer-Moore logic", a programming/theorem proving environment for an executable logic of recursive functions. More precisely, we have identified an applicative subset of Common Lisp and axiomatized it, foUowing Steele's [72] carefully. Because arrays, property lists, input/output and certain other commonly used programming features are not provided applicatively in Common Lisp (i.e., they all involve the notion of explicit state changes), we axiomatized applicative versions of these features. For example, when one "changes" an array object, one gets a new array object. However, we gave these applicative functions very efficient implementations which are in complete agreement with their axiomatic descriptions but which happen to execute at near von Neumann speeds when used in the normal von Neumann style (in which " o l d " versions of a modified structure are not accessed). The result is "applicative Common Lisp" which is also an executable mathematical logic. Like NQTHM, the logic of applicative Common Lisp provides a definitional principle that permits the sound extension of the system via the introduction of recursive functions. Unlike NQTHM, however, functions in applicative Common Lisp may be defined only on a subset of the universe. Like NQTHM, the new logic provides the standard first order rules of inference and induction. However, the axioms are different since, for example, NQTHM and ACL2 differ on what (CAR NZT.) is. Most importantly for the current purposes, we claim that all correct Common Lisps implement applicative Common Lisp directly and that, unlike NQTHM' s logic, applicative Common Lisp is a practical programming language. ACL2 is a theorem prover and programming/proof environment for applicative Common Lisp. ACL2 includes all of the functionality of NQTHM (as understood in the new setting) plus many new features (e.g., congruence-based rewriting). The source code for ACL2 consists of about 1.5 million characters, all but 43,000 of which are in applicative Common Lisp. That is, 97% of ACL2 is written applicafively in the same logic for which ACL2 proves theorems. The 3% of non-applicative code is entirely at the top-level of the read-eval-print user interface and deals with reading user input, error recovery and interrupts. We expect to implement r e a d applicatively and limit the non-applicative part of ACL2 to the essential interaction with the underlying Common Lisp host system. Thus, in ACL2 as it currently stands, the definitional principle is implemented as a function in logic, including the syntax checkers, error handlers, and data base handlers. The entire "Boyer-Moore theorem prover" -- as that term is now understood to mean "the theorem prover Boyer and Moore have written for ACL2" -- is a function in the logic, including the simplifiers, the decision procedures, the induction heuristics, and all of the proof description generators.

The fact that almost all of ACL2 is written applicatively in the same logic for which it is a theorem prover allows the ACL2 source code to be among the axioms in that definitional extension of the logic. The user of the ACL2 system can define functions, combine his functions with those of ACL2, execute them, or prove things about them, in a unified setting. One need only understand one language, Common Lisp, to use the " l o g i c " , interact with the system, interface to the system, or modify the system. DEFMACRO can be used to extend the syntax of the language, users can introduce their own front-ends by programming within the logic, and all of the proof routines are accessible to users and have exceptionally clear (indeed, applicative) interfaces. Many new avenues in metatheoretic extensibility are waiting to be explored. We believe we have taken a major step towards the goal of perhaps someday checking the soundness of most of the theorem prover by defining the theorem prover in a formalized logic. At the time of this writing, we have completely recoded all of the functionality of NQTHM, but have only begun experimentation with proving theorems. However, our preliminary evidence is that there will be no substantial degradation in performance, even though ACL2 is coded applicatively.

8 Conclusions 8.1 Proof Checking as a Mere Engineering Challenge In our view it seems humanly feasible to write mechanical proof checkers for any part of mathematics and to check mechanically any result in mathematics. There has been much doubt cast on the feasibility of formal proofs, even by such respected authorities as Bourbaki [6] But formalized mathematics cannot in practice be written down in full, and therefore we must have confidence in what might be called the common sense of the mathematician ... We shall therefore very quickly abandon formalized mathematics ... We believe that we have enough practical evidence to extrapolate that mechanical proof checking any mathematical result is feasible, not some mere theoretical possibility which would require a computer the size of the universe. We can make no definite claim about the cost of doing such proof checking, given a suitable proof checker, but we suspect that in the worst case it is somewhere between approximately ten and one hundred times as expensive as doing careful hand proofs at the level of an upper level undergraduate mathematics textbook. In a few areas of mathematics, such as those described by [27] the cost is much less than doing careful hand proofs. We are optimistic that research by top mathematicians will expand the areas in which mechanical theorem-provers are better than most mathematicians. 8.2 Checking the Correctness of Computing S y s t e m s Almost as a corollary to the preceding view, we assert that it is humanly feasible to check mechanically the correctness of computer systems against formal specifications for those systems. Moreover, we believe that the reliability of computing systems could and should be increased significantly by requiring that critical systems be formally specified and that their correctness with respect to those specifications be mechanically checked. Again, we make no definite claim about the cost of doing such certification, but given that, for example, there exist microprocessors that are in control of nuclear weapons, we believe that the cost of doing such checking may well be less than the cost of not doing such checking.

8.3 Formalizing the Real World Although the correcmess of algorithms and even systems is something that is reasonably clearly understood from a mathematical point of view, it remains a major and largely unexplored area of research to formalize the interactions of computing systems with the "real world." Even correctly formalizing the behavior of a typical industrial microcontroller, with its myriad timers, interrupts, buses, and A/D converters seems to be on the edge of the state of the art of formalization. Any claim that a computing system has been formally proved to interact safely with the world is no better than the accuracy with which the behavior of the world has been formalized. The difficulty of accurately formalizing the behavior of the world does not diminish the fact that typically a very large part of what any computing system is supposed to do (especially the internal workings) can be formally specified, and that part is suitable for scrutiny with formal, mechanical proof attempts.

9 Acknowledgements We want to express our thanks to a number of people who have contributed significantly towards making NQTHM a successful prover. The first version of our prover was developed in the amazingly fertile environment of Edinburgh University in the period 1971 to 1974. While working in Bernard Meltzer's Metamathematics Unit (which then became the Department of Computational Logic), we had the joy of working with such figures as J.A. Robinson, Bob Kowalski, Pat Hayes, Alan Bundy, Aaron Sloman, and Woody Bledsoe. In nearby groups, such as the Department of Machine Intelligence, we found inspiration from the likes of Rod Burstall, Donald Michie, Robin Popplestone, Gordon Plotkin, Michael Gordon, Bruce Anderson, David Warren, Raymond Aubin, Harry Barrow, John Darlington, and Julian Davies. The time and place seemed to be embued with quiet inspiration. It is hard for us to imagine that our prover could have put down its roots anyplace else. John McCarthy's influence on our work has been major. His invention of Lisp gave us a language [55, 59] in which to write NQTHM. His papers on proof checking, e.g. [57], and the mathematical theory of computation [58] gave us incentive to write a prover for program verification, reasoning techniques to encode, and sample theorems on which to work. We have mentioned above Woody Bledsoe's influence on our work in showing how to write heuristic theorem provers similar to ours. We thank Rod Burstall for his inspiring and elegant paper on structural induction [26]. We thank Burstall, Michie, and Popplestone for use of the POP2 system running on an ICL 4130 on which we coded the earliest version of our prover. POP2 is a Lisp-like language with an Algol-like syntax and many features ahead of its time, including streams and abstract data types, which influenced the design of the shell construct in the NQTHM logic. At SRI International and Xerox PARC (JSM), we translated our prover into Lisp and made major extensions to it. We owe a debt of thanks to many people there for their support and encouragement, including Robert W. Taylor, Warren Teitelmann, Peter Deutsch, Butler Lampson, Jack Goldberg, Peter Neumann, Karl Levitt, Bernie Elspas, Rob Shostak, Jay Spitzen, Les Lamport, Joe Goguen, Richard Waldinger, Nils Nilsson, and Peter Hart. We owe our user community a major debt. In particular, we acknowledge the contributions of Bill Bevier, Bishop Brock, S.C. Chou, Ernie Cohen, Jimi Crawford, David Goldschlag, C.H. Huang, Warren Hunt, Myung Kim, David Russinoff, Natarajan Shankar, Mark

10 Woodcock, Matt Wilding, Bill Young, and Yuan Yu. In addition, we have profited enormously from our association with Matt Kaufmann, Hans Kamp, Chris Lengauer, Norman Martin, John Nagle, Carl Pixley, and Bill Schelter. Topher Cooper has the distinction of being the only person to have found an unsoundness in a released version of our system. We also most gratefully acknowledge the support of our colleagues at the Institute for Computing Science at the University of Texas, now almost all at Computational Logic, especially Don Good and Sandy Olmstead who created and maintained at the Institute a creative and relaxed research atmosphere with excellent computing facilities. In 1986 we moved our entire verification research group (and its atmosphere) off campus and established Computational Logic, Inc. Notwithstanding the contributions of all our friends and supporters, we would like to make clear that NQTHM is a very large and complicated system that was written entirely by the two of us. Not a single line of Lisp in our system was written by a third party. Consequently, every bug in it is ours alone. Soundness is the most important property of a theorem prover, and we urge any user who finds such a bug to report it to us at once. The development of our logic and theorem prover has been an ongoing effort for the last 18 years. During that period we have received financial support from many sources. Our work has been supported for over a decade by the National Science Foundation and the Office of Naval Research. Of the many different grants and contracts involved we list only the latest: NSF Grant DCR-8202943, NSF Grant DCR81-22039, and ONR Contract N00014-81K-0634. We are especially grateful to NSF, ONR, and our technical monitors there, Tom Keenan, Bob Grafton, and Ralph Wachter, for years of steady support and encouragement. The development of our prover is currently supported in part at Computational Logic, Inc., by the Office of Naval Research. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of Computational Logic, Inc., ONR, or the U.S. Government. We have received additional support over the years from the following sources, listed chronologically: Science Research Council (now the Science and Engineering Research Council) of the United Kingdom, Xerox, SRI International, NASA, Air Force Office of Scientific Research, Digital Equipment Corporation, the University of Texas at Austin, t h e Venture Research Unit of British Petroleum, Ltd., and IBM. We thank Bill Schelter for the numerous suggestions he has made for improving the performance of NQTHM under Austin-Kyoto Common Lisp. Thanks to Anne Boyer for editing this and other writings. Finally, we wish to express one negative acknowledgement. The research group assembled at Edinburgh in the early 70's was scattered to the winds by the "Lighthill Report," the devastatingly negative review of artificial intelligence in Britain conducted by Sir James Lighthill. If computing becomes the dominant branch of both science and engineering, as seems possible, we hope that renowned computer scientists, if asked, will take the greatest care to review new developments in physics with humility, not arrogance, and not attempt to quash new developments that do not fit into old paradigms of science.

11

References 1. W. Bevier. A Verified Operating System Kernel. Ph.D. Th., University of Texas at Austin, 1987. 2. W. R. Bevier. "Kit and the Short Stack". Journal of Automated Reasoning 5, 4 (1989), 519-530. 3. William Bevier, Matt Kaufmann, and William Young. Translation of a Gypsy Compiler Example into the Boyer-Moore Logic. Internal Note 169, Computational Logic, Inc., January, 1990. 4. W.W. Bledsoe. "Splitting and Reduction Heuristics in Automatic Theorem Proving". Artificial Intelligence 2 (1971 ), 55-77. 5. W. Bledsoe, R. Boyer, and W. Henneman. "Computer Proofs of Limit Theorems". Artificial Intelligence 3 (1972), 27-60. 6. N. Bourbaki. Elements of Mathematics. Addison Wesley, Reading, Massachusetts, 1968. 7. R. S. Boyer and J S. Moore. "Program Verification". Journal of Automated Reasoning 1, 1 (1985), 17-23. 8. R. S. Boyer, D. M. Goldschlag, M. Kaufmann, and J S. Moore. Functional Instantiation in First Order Logic, Report 44. Computational Logic, 1717 W. 6th St., Austin, Texas, 78703, U.S,A., 1989. To appear in the proceedings of the 1989 Workshop on Programming Logic, Programming Methodology Group, University of Goteborg. 9. R. S. Boyer and J S. Moore. "Proving Theorems about LISP Functions". JACM 22, 1 (1975), 129-144. I0. R. S. Boyer and J S. Moore. A Lemma Driven Automatic Theorem Prover for Recursive Function Theory. Proceedings of the 5th Joint Conference on Artificial Intelligence, 1977, pp. 511-519. I1. R. S. Boyer and J S. Moore. A Computational Logic. Academic Press, New York, 1979. 12. R. S. Boyer and J S. Moore. Metafunctions: Proving Them Correct and Using Them Efficiently as New Proof Procedures. In The Correctness Problem in Computer Science, R. S. Boyer and J S. Moore, Eds., Academic Press, London, 1981. 13. R. S. Boyer and J S. Moore. A Verification Condition Generator for FORTRAN. In The Correctness Problem in Computer Science, R. S. Boyer and J S. Moore, Eds., Academic Press, London, 1981. 14. R. S. Boyer and J S. Moore. The Mechanical Verification of a FORTRAN Square Root Program. SRI International, 1981. 15. R. S. Boyer and J S. Moore. MJRTY - A Fast Majority Vote Algorithm. Technical Report ICSCA-CMP-32, Institute for Computing Science and Computer Applications, University of Texas at Austin, 1982. 16. R. S. Boyer and J S. Moore. "Proof Checking the RSA Public Key Encryption Algorithm". American Mathematical Monthly 91, 3 (1984), 181-189.

12 17. R. S. Boyer and J S. Moore. "A Mechanical Proof of the Unsolvability of the Halting Problem". JACM31, 3 (1984), 441-458. 18. R. S. Boyer and J S. Moore. A Computational Logic Handbook. Academic Press, New York, 1988. 19. R. S. Boyer and J S. Moore. Integrating Decision Procedures into Heuristic Theorem Provers: A Case Study with Linear Arithmetic. In Machine Intelligence 11, Oxford University Press, 1988. 20. R. S. Boyer and J S. Moore. "The Addition of Bounded Quantification and Partial Functions to A Computational Logic and Its Theorem Prover". Journal of Automated Reasoning 4 (1988), 117-172. 21. R. S. Boyer and J S. Moore. A Mechanical Proof of the Turing Completeness of Pure Lisp. In Automated Theorem Proving: After 25 Years, W.W. Bledsoe and D.W. Loveland, Eds., American Mathematical Society, Providence, R.I., 1984, pp. 133-167. 22. R. S. Boyer, M. W. Green and J S. Moore. The Use of a Formal Simulator to Verify a Simple Real Time Control Program. In D. Gries, et. al, Ed., Beauty Is Our Business, Springer, 1990. To Appear. 23. A. Bronstein and C. Talcott. String-Functional Semantics for Formal Verification of Synchronous Circuits, Report No. STAN-CS-88-1210. Computer Science Department, Stanford University, 1988. 24. A. Bronstein. MLP : String-functional semantics and Boyer-Moore mechanization for the formal verification of synchronous circuits. Ph.D. Th., Stanford University, 1989. 25. A. Bronstein and C. Talcott. Formal Verification of Synchronous Circuits based on String-Functional Semantics: The 7 Paillet Circuits in Boyer-Moore. C-Cube 1989 Workshop on Automatic Verification Methods for Finite State Systems. LNCS 407, 1989, pp. 317-333. 26. R. Burstall. "proving Properties of Programs by Structural Induction". The Computer Journal 12, 1 (1969), 41-48. 27. S. Chou. Mechancial Geometry Theorem Proving. Reidel, 1988. 28. Benedetto Lorenzo Di Vito. Verification of Communications Protocols and Abstract Process Models. Ph.D. Th., University of Texas at Austin, 1982. 29. T.L. Heath (translation and commentary). The Thirteen Books of Euclid's Elements. Dover, New York, 1908. p. 298, Vol 2., i.e. Proposition 2, Book VII. 30. R. Floyd. Assigning Meanings to Programs. In Mathematical Aspects of Computer Science, Proceedings of Symposia in Applied Mathematics, American Mathematical Society, Providence, Rhode Island, 1967, pp. 19-32. 31, David M. Goldschlag. "Mechanically Verifying Concurrent Programs with the BoyerMoore Prover". IEEE Transactions on Software Engineering (September 1990). To appear. 32. David M. Goldschlag. Mechanizing Unity. In Proceedings of the IFIP TC2/WG2.3 Working Conference on Programming Concepts and Methods, M. Broy and C. B. Jones, Eds., Elsevier, Amsterdam, 1990.

13 33. David M. Goldschlag. "Proving Proof Rules: A Proof System for Concurrent Programs". Compass '90 (June 1990). 34. R. L. Goodstein. Recursive Number Theory. North-Holland Publishing Company, Amsterdam, 1964. 35. C. A. R. Hoare. "An Axiomatic Basis for Computer Programming". Comm. ACM 12, 10 (1969), 576-583. 36. L. Hodes. Solving Problems by Formula Manipulation. Proc. Second Inter. Joint Conf. on Art. Intell., The British Computer Society, 1971, pp. 553-559. 37. C.-H. Huang and C. Lengauer. "The Automated Proof of a Trace Transformation for a Bitonic Sort". Theoretical Computer Science 1, 46 (1986), 261-284. 38. W. A. Hunt. "Microprocessor Design Verification". Journal of Automated Reasoning 5, 4 (1989), 429-460. 39. Matt Kaufmann. A Formal Semantics and Proof of Soundness for the Logic of the NQTHM Version of the Boyer-Moore Theorem Prover. Internal Note 229, Institute for Computing Science, University of Texas at Austin, February, 1987. 40. Matt Kaufmann. A Mechanically-checked Semi-interactive Proof of Correctness of Gries's Algorithm for Finding the Largest Size of a Square True Submatrix. Internal Note 236, Institute for Computing Science, University of Texas at Austin, October, 1986. 41. Matt Kaufmann. An Example in NQTHM: Ramsey's Theorem. Internal Note 100, Computational Logic, Inc., November, 1988. 42. Matt Kaufmann. Boyer-Moore-ish Micro Gypsy and a Prototype Hardware Expander. Internal Note 73, Computational Logic, Inc., August, 1988. 43. Matt Kaufmann. A Mutual Recursion and Dependency Analysis Tool for NQTHM. Internal Note 99, Computational Logic, Inc., 1988. 44. Matt Kaufmann. A User's Manual for RCL. Internal Note 157, Computational Logic, Inc., October, 1989. 45. Matt Kaufmann and Matt Wilding. A ParaUel Version of the Boyer-Moore Prover. Tech. Rept. 39, Computational Logic, Inc., February, 1989. 46. Matt Kaufmann. DEFN-SK: An Extension of the Boyer-Moore Theorem Prover to Handle First-Order Quantifiers. Tech. Rept. 43, Computational Logic, Inc., 1717 W. 6th St, Suite 290, Austin, Texas, June, 1989. 47. Matt Kaufmann. Addition of Free Variables to an Interactive Enhancement of the BoyerMoore Theorem Prover. Tech. Rept. 42, Computational Logic, Inc., Austin, Texas, May, 1989. 48. Matt Kaufmann. A Mechanically-checked Correctness Proof for Generalization in the Presence of Free Variables. Tech. Rept. 53, Computational Logic, Inc., Austin, Texas, March, 1990. 49. Matt Kaufmann. An Integer Library for NQTHM. Internal Note 182, Computational Logic, Inc., March, 1990.

14 50. Leslie Lamport, Robert Shostak, and Marshall Pease. "The Byzantine Generals Problem". ACM TOPLAS 4, 3 (July 1982), 382-401. 51. C. Lengauer. "On the Role of Automated Theorem Proving in the Compile-Time Derivation of Concurrency". Journal of Automated Reasoning 1, 1 (1985), 75-101. 52. C. Lengauer and C.-H. Huang. A Mechanically Certified Theorem about Optimal Concurrency of Sorting Networks. Proc. 13th Ann. ACM Symp. on Principles of Programming Languages, 1986, pp. 307-3t7. 53. D. Loveland. Automated TheoremProving: A Logical Basis. North Holland, Amsterdam, 1978. 54. J. McCarthy. "Recursive Functions of Symbolics Expressions and their Computation by Machine". Communications of the Association for Computing Machinery 3, 4 (1960), 184-195. 55. J. McCarthy. The Lisp Programmer's Manual. M.I.T. Computation Center, 1960. 56. J. McCarthy. Towards a Mathematical Science of Computation. Proceedings of IFIP Congress, 1962, pp. 21-28. 57. J. McCarthy. Computer Programs for Checking Mathematical Proofs. Recursive Function Theory, Proceedings of a Symposium in Pure Mathematics, Providence, Rhode Island, 1962, pp. 219-227. 58. J. McCarthy. A Basis for a Mathematical Theory of Computation. In Computer Programming and Formal Systems, P. Braffort and D. Hershberg, Eds., North-Holland Publishing Company, Amsterdam, The Netherlands, 1963. 59. J. McCarthy, et al. LISP 1.5 Programmer's Manual. The MIT Press, Cambridge, Massachusetts, 1965. 60. J S. Moore. "A Mechanical Proof of the Termination of Takeuchi's Function".

Information Processing Letters 9, 4 (1979), 176-181. 61. J. S. Moore. "A Mechanically Verified Language Implementation". Journal of

Automated Reasoning 5, 4 (1989), 461-492. 62. J. S. Moore, et. al. "Special Issue on System Verification". Journal of Automated

Reasoning 5, 4 (1989), 409-530. 63. Matt Kaufmann. A User's Manual for an Interactive Enhancement to the Boyer-Moore Theorem Prover. Tech. Rept. 19, Computational Logic, Inc., Austin, Texas, May, 1988. 64. Marshall Pease, Robert Shostak, and Leslie Lamport. "Reaching Agreement in the Presence of Faults". JACM 27, 2 (April 1980), 228-234. 65. J. A. Robinson. "A Machine-oriented Logic Based on the Resolution Principle". JACM 12, 1 (1965), 23-41. 66. David M. Russinoff. "An Experiment with the Boyer-Moore Theorem Prover: A Proof of Wilson's Theorem". Journal of Automated Reasoning 1, 2 (1985), 121-139.

15 67. N. Shankar. "Towards Mechanical Metamathematics". Journal of Automated Reasoning 1, 4 (1985), 407-434. 68. N. Shankar. A Mechanical Proof of the Church-Rosser Theorem. Tech. Rept. ICSCACMP-45, Institute for Computing Science, University of Texas at Austin, 1985. 69. N. Shankar. Proof Checking Metamathematics. Ph.D. Th., University of Texas at Austin, 1986. 70. J. R. Shoenfield. Mathematical Logic. Addison-Wesley, Reading, Ma., 1967. 71. Y. Skolem. The Foundations of Elementary Arithmetic Established by Means of the Recursive Mode of Thought, without the Use of Apparent Variables Ranging over Infinite Domains. In From Frege to Godel, J. van Heijenoort, Ed., Harvard University Press, Cambridge, Massachusetts, 1967. 72. G. L. Steele, Jr. Common Lisp The Language. Digital Press, 30 North Avenue, Burlington, MA 01803, 1984. 73. J. von Neumann. John yon Neumann, Collected Works, Volume V. Pergamon Press, Oxford, 1961. 74. L. Wos, et al. "The concept of demodulation in theorem proving". Journal of the ACM 14 (1967), 698-709. 75. Matt Kaufmann and William D. Young. Comparing Gypsy and the Boyer-Moore Logic for Specifying Secure Systems. Institute for Computing Science, University of Texas at Austin, May, 1987. ICSCA-CMP-59. 76. W. D. Young. "A Mechanically Verified Code Generator". Journal of Automated Reasoning 5, 4 (1989), 493-518. 77. Yuan Yu. "Computer Proofs in Group Theory". Journal of Automated Reasoning (1990). To appear.

A COMPLETE SEMANTIC BACK CHAINING PROOF SYSTEM*

Xumin Nie 1 David A. Plaisted Department of Computer Science University of North Carolina at Chapel Hill Chapel Hill, North Carolina 27599 Abstract

We discuss a sequent style clause-based proof system that supports several important strategies in automatic theorem proving. The system has a goal-subgoal structure and supports back chaining with caching; it permits semantic deletion, sometimes using multiple models; it is also a genuine set of support strategy; and it is complete for first order logic in clause form. 1. I n t r o d u c t i o n

Several strategies are important for automatic theorem proving. First is back chaining with caching. Back chaining is a fundamental problem solving method; any proof system that cannot do it is handicapped from the start. Caching is used to avoid repeated solution of the same subgoal. Second is semantic deletion, that is, subgoals fail if they are false in one of a collection of interpretations. Semantic deletion allows the use of problem dependent knowledge to reduce the search space. Third is a genuine support strategy [17] which concentrates on t h e theorem. This strategy is important when there are many assertions, because it focuses the search on relevant assertions. We wilt discuss a sequent style clausebased complete proof system that supports these strategies. The proof system is a refutation-based strategy, in contrast to other subgoal methods like Gentzen style systems. We will first introduce some terminology and the modified problem reduction format. Then we will present the system and its soundness and completeness proofs. Some issues concerning the system are discussed next, followed by the discussion of related work. Several examples conclude the paper.

1.1. T e r m i n o l o g y A term is a well formed expression composed of variables, constant symbols and function symbols, A n a t o m is an expression of the form P(h . . . . . t,) where

*This work was supported in part by the National Science Foundation under grant DCR8516243. 1Current Address: Institute for Programming and Logics, Department of Computer Science, University of Albany, State University of New York, Albany, NY 12222

17 t~ (1 < i < n) are terms and p is a predicate symbol. A literal is an atom or an atom preceded by a negation sign -,. A literal is positive if it is an atom, negative if it is an atom preceded by -,. For an atom A , A = -, -,A. A clause is a disjunction of literals. A Horn-like clause is an expression L :- L1, L2 . . . . . Ln, which represents a clause L v -,L 1 v --,L2 • • • --,L., where L is called the head literal and the clause body is the set of L,'s (i = I . . . . . n). A clause C is converted into a Horn-like clause HC as follows. One of the literals or the reserved literal F A L S E is chosen as the head literal of HC and all other literals in C are negated and put in the clause body of I-IC. A clause containing n literals corresponds to n + l Horn-like clauses. These n + l Horn-like clauses are called contrapositives of each other. For example, the four contrapositives of the clause P v -,Q v --tR are (FALSE :- -~e, Q, R), (P :- Q, R), (.-,Q :- --,P, R) and (-,R :- Q, -,P). A Horn-like clause whose head is F A L S E is called a goal clause.

A simplified first order formula (a formula in negation normal form) is a quantifier-free first order formula containing no logical symbols other than -~, ^ and v, also each negation symbol --, occurring in the formula is applied to an atom. A clause is a simplified first order formula by definition. An interpretation I for a simplified first-order formula W consists of a domain D together with (1) For each n-ary P,: D" ~ -{T, F}-.

predicate

symbol

P

in

W,

an

associated

function

(2) For each n-ary function symbol G in W, an associated function Gz: D" --. O. The logical symbols are interpreted in I in the usual way. A n interpretation instance of a term or a simplified first-order formula W, denoted by W~, is obtained from W by substituting all variables occurring in W with some elements in D. We use E to stand for existential and U to stand for universal. For a simplied first-order formula W, we use I l=e W to denote the fact that there is an interpretation instance W of W which is interpreted to be T by I; we use I l=u W to denote the fact that the interpretation I interprets all the interpretation instances W of W to be T; We use I Ice W to denote I I=v --,W and use I Icy W to denote I l=g -,W. We call an interpretation I a model for a simplified first-order formula W if I I=v W. A n interpretation I is a model for a set of simplified firstorder formulae is it is a model for each formula in S. We use I-- and I== to denote derivability and validity, respectively.

1.2. Modified Problem Reduction Format

The modified problem reduction format [8] is an extension of Prolog-style H o r n clauses logic programming to full first order logic. It uses Prolog style back chaining without contrapositives and handles non-Horn clauses using case analysis. The input clauses to the modified problem reduction format are given as Horn-like clauses. For each clause C, only one Horn-like clause H C will be needed; the clause heads of the input clauses must be a positive literal (for

18

clauses containing positive literals) or F A L S E (for all-negative clauses). The modified problem reduction format has an inference rule for each input clause plus the a s s u m p t i o n a x i o m s and the case analysis rule. If S is a set of Horn-like clauses, we obtain a set of inference rules from S for the modified problem reduction format as follows: For each Horn-like clause L : - L x , L~ . . . . L n in S, we have the following clause rule. We call the r's on the left of the arrow ~ the a s s u m p t i o n list.

Clause Rules [P0-*L1 => r ~ - . L d , [r~--*Lz => P2---~L2]. . . . . P0---~L => Pn--.L

[Pn_I--~L. --> rn---~L.]

We also have the a s s u m p t i o n a x i o m s and the case analysis rule.

Assumption Axioms F--+L => P-.L if L E r F-,-d, => F , -,L--*~L

L is a literal.

L is a positive literal.

Case Analysis Rule [Po-'~L => rl, .-,M--.L], [P1, M - . L => P l , M--.L] r0--*L => I'I"-+L

Ir01 r2--*L may be read as "transforms to"; F~--.L is the subgoal to be solved and I~z-~L is the subgoal solved. I'2 will be rl with extra assumptions added to make rz-.L solvable. If the clause set contains only H o r n clauses, the modified problem reduction format will behave exactly like Prolog. If the clause set contains non-Horn clauses, the assumption axioms and the case analysis rule will be used and case analyses will be performed. The idea is: for each negative literal -,L in the clause body of a Horn-like clause, we first assume -,L to be true (by adding it to the assumption list) and obtain the proof under this assumption. Then we assume L to be true and obtain the proof under this assumption. The transformation I'~--.L => r2--+L is the device for introducing the assumptions and the case analysis rule performs the case analyses. The readers can refer to [8] for a complete discussion of the modified problem reduction format. We only give the soundness and completeness theorems. [IS is used to denote derivability using the inferences rules from S.

Soundness Theorem: If [--s r~--.L => Fz--+L, then the list r~ is a prefix of the list I'2 and S 1== r2 D L.

19

Completeness

Theorem:

A

set

of

clauses

S

is

unsatisfiable

iff

I-

s "-'* F A L S E => ---, F A L S E .

2. A Semantic Proof System The modified problem reduction format can be generalized as follows. Suppose we are given a set S of clauses and an interpretation M for S which interprets the literal F A L S E to be T. For the moment, we will assume that the input clauses are all the contrapositives and all the clauses of the form F A L S E : - L 1 ,L2 . . . . . L , where --,L1 v -4_,2 v • • • v --tLn is a clause in S. We have the following set of inference rules. For each Horn-like clause L : - L1, L2 . . . . . Ln, the clause rule M [ = E L , [Fo----*L1=> FI'-'+L1] , [FI"*L2 => Fz'+L2] . . . . .

[F,,_l--'-*Ln => F,,"--*Ln]

P0---~L => Pn---,L The case analysis rule M I---EL, [P0---~L=> P~, -~N--~L], IF 1 , N--*L => Pl , N--~L]

Irol F1..-~L The assumption axioms are F--,L=>F---~L if L E F I'---~--,L => P, -,L--,-~L

L is a literal.

L is a positive literal.

Note that the semantic proof system differs from the modified problem reduction in that contrapositives are used and the semantic tests M I=~ L are added to the rules. We will prove the soundness and completeness of the system. We only deal with the ground case, which can be lifted to first order logic in the usual way. Given a set of clauses S and an interpretation M for S, we denote by I--sM derivability in this system.

Theorem 1 (soundness): If 1--~t Ft---,L => F2--+L, then the list I'1 is a prefix of the list r2 and S 1== r2 ~ L. Proof. We can prove this by induction on the size of the proof, i.e., the number of times the inference rules are used, making use of the length restriction in the case analysis rule (This theorem is the same as the soundness theorem in [8]). Q.e.D. T h e o r e m 2 (completeness) A set of clauses S is unsatisfiable iff for any interpretation M for S, l--sM--* F A L S E => ~ F A L S E .

Proof. Let atom(S) denote the set of set of literals --,L where L E atom(S). Let interpreted true by M, then M C atom(S) atom A (E atom(S)), either A E M or

atoms in S and N-atom(S) denote the M be the set of literals in S which are U N-atom(S) U {FALSE}. For every -,A E M. Specifically, F A L S E ~ M.

20

Consider the following set of inferences rules which includes all the clauses rules from S as described above, plus the assumption axioms P---.L => F--.L if L E I" F--~L => 1", L-..,L if MIC.EL and the case analysis rule MI=EL, [Po--~L => Fl, N---,L], [rl, ~ N ~ L => r~, ~N--*L] trol_ FI--*L where N is a literal. This system is complete from the proof of theorem 6 in [8], if we regard all the literals in M as positive and all other literals as negative. The completeness of the semantic proof system follows if we observe that the semantic proof system merely fixes the order of the two cases for each application of the case analysis rule. Obviously it does not matter in which order the case analysis is done. Q.E.D.

3. D i s c u s s i o n

The modified problem reduction format is a special case of the semantic proof system where M = atom(S) t3 {FALSE}. Both the modified problem reduction format and the semantic proof system support back chaining with caching. We will elaborate on this issue and other issues related to the semantic proof system. Back Chaining with Caching. One advantage of the semantic proof system is that it supports true back chaining, which resolution strategies fail to do. In back chaining, goals are expressed as subgoals, which are similarly expressed, and each subgoal is solved separately. Caching means that a subgoal is solved only once. If a subgoal is solved, its solution is remembered; if a subgoal fails, it is not attempted again. In resolution, many subgoals can occur together in the same clause. If there are a number of choices for how each subgoal could be solved, these choices get multiplied together. As a result, the number of clauses generated could be much larger than the number of subgoals. If caching is used in a back chaining system, the search space is proportional to the number of subgoals. In resolution, however, the search space could be considerably larger. Consider the example of H o r n clauses. If back chaining is used on a set of Horn clauses, all the subgoals are unit clauses. Thus the search space consists entirely of unit clauses. Once a subgoal has been solved and its solution recorded, it never needs to be solved again. Thus the search time is roughly proportional to the number of subgoals (literals) seen times the number of solutions generated. However, using all-negative resolution, which is the closest approach to back chaining in resolution, the search space will contain clauses having many literals and can be proportional to the number of clauses seen, which may be larger than the number of

21 literals. We do not mean to imply that resolution is always inferior, however. Semantic Deletion. A n o t h e r advantage of the semantic proof system is that it allows deletion of false subgoals in an arbitrary interpretation. Semantic deletion can be made stronger in several ways. First, consider the input clause L :-L1 ,L2 . . . . . Ln. M is the interpretation used. Suppose a subgoal P0---~L is attempted. The use of the clause rule [Po--~L1 => Py-~L,],

[P1---~L2 = >

F2---*L2] . . . . .

[P._r--*L,, => P.-*L~]

Fo---~L => Fn--*L can be stopped if there exists a literal L~ among L1,L2, . . . . L n such that L~ is a positive literal and M I ~ Li and --,(LiEF0), even if MI=EL. This is because when FI_I-+Li is attempted, the only way to solve it is to use the assumption axiom since M I ~ L~. But it is impossible to have any extra positive literal in Fi-i other than those already in F0, since the assumption axiom only adds negative literals and the case analysis rule, although adding positive literals, only add them to the subgoals of ri_l~L,. Second, a new solution F0---~L need not be cached, in case caching is performed, if MI#EL since the subgoals of the form F---~L will never be attempted except using the assumption axioms. Third, consider the case analysis rule. Suppose the clause set is S = so (3 G where G are all the goal clauses and we have several models M~ . . . . . Mk for S0. The application of the case analysis rule can be stopped if there exists an Mi among M x . . . . . M k such that M i lee rl -'-~L, where Pt---.L is as in the case analysis rule. This follows from the soundness theorem since $1 1== rl--*L. Finally, consider the clause L:-LI,L2, . . . . Ln. If M lee L, this clause will never be used in the semantic proof system. Thus we need not to include such clauses in the input. In general, we only need to include those clauses whose heads are existentially satisfied by M.

Set of Support Strategy. The set of support strategy [17] is a powerful and completeness preserving restriction strategy for resolution. In this strategy, the clause set is divided into two sets A and T where S = A U T and A f3 T = O . A usually represents the axioms and the special hypotheses and is satisfiable and T, which is called the set o f support, represents the negation of the theorem. A resolution operation is only allowed for two clauses if at least one of them comes from the set of support directly or indirectly. The modified problem reduction format is not compatible with the set of support strategy because its goal clauses are always all-negative clauses which do not always come from the negation of the theorem. The semantic p r o o f system is a set of support strategy, because, given an interpretation M, we only need those clauses as goal clauses that are false in M. This means that we need not to include all the Horn-like clauses of the form FALSE:-LI, L 2 ..... L n where - . L ~ v ~ L 2 v • . • v - ~ L n is a clause, contrary to what we have stated earlier. If M is a model of the axioms, then only clauses from the theorem will be false in M, giving us a true set of support strategy. A stronger result can be obtained: it is only necessary to have one goal clause according to some interpretation M. Suppose S is an unsatisfiable clause set. A s s u m e that S = A U T and A fq T = Q and A is satisfiable, where A represents

22 the axioms the special hypotheses and T represents the negation of the theorem. Further assume T = {C1, C2 . . . . . C,}. If there exists an interpretation M such that M I=v A and M l=v C/ (i = 1 . . . . . n-l) and M I¢u C,, we can use C, as the only goal clause according to the interpretation M. If such an interpretation does not exist, then we k n o w 1== (A U {C1, C2 . . . . . C,_~}) D C,. Thus A U {C~, C2 . . . . . Cn_~} = S, is unsatisfiable since S is. We can apply the same argument to S, to conclude the proof. We may not know what goal clause to pick, but in a given proof, only one goal clause need be used. Gelernter's System. If the clause set consists of only H o r n clauses and the interpretation only interprets negative unit clauses to be false, the semantic proof system is the same as Geternter's method. Furthermore, no contrapositive will be needed. Thus the semantic proof system is a generalization of Gelernter's method to full first order logic. Contrapositives and Interpretation. The Prolog-style extension to full first order logic (non-Horn clauses) using the Model Elimination procedure [6] requires the use of all the contrapositives if the clause set is non-Horn [13]. The modified problem reduction format, on the other hand, does not need any contrapositives. Using contrapositives sometimes costs efficiency since it effectively increases the number of clauses. More importantly, though, it can lead to unnatural search behavior and makes the search process difficult to control. See [8] for some examples. However, our experience has shown that, for non-Horn problems especially, some contrapositives can significantly help to improve the efficiency of the prover based on the modified problem reduction format. This is because less case analysis is needed. The problem is to decide which contrapositives to use. As we have noted, given an interpretation M for a set of clause S, we only need to include the Horn-like clauses whose clause head is existentially satisfied by M. Thus the semantic proof system brings a solution to this problem by making use of problem domain knowledge represented in an interpretation. Now the question is how to design an interpretation for a given theorem. This is not a trivial question. It is difficult to automate since problem domain knowledge is usually required and it is hard to give a precise description of what is a suitable interpretation. The difficulty for a h u m a n to design an interpretation lies in the interpretation of the skolem functions [15]. Usually, however, a human has a natural interpretation in mind when he states a theorem. A method for designing interpretations for a set of clauses is proposed in [15]. This method is a general method and can be slightly modified to select.the input clauses for the semantic proof system. The basic idea of Wang's method is to put together all the clauses containing the same uninterpreted symbol, often skolem function symbols, and use some interpretation rules to interpret the uninterpreted symbol. We will briefly present Wang's method and the modification below.

23 Given a natural interpretation I for a t h e o r e m and the natural interpretations of the function symbols and predicate symbols, we need to interpret the uninterpreted symbols. W e call a simplified first-order formula an i n t e r p r e t a t i o n n o r m a l f o r m (INF) if it is in the following form: LIv ...

vLkv[C1A ...

ACh]

where Li's are literals and Ci's are clauses. Note that, corresponding to each I N F • • • v L k V [C1 A • • • A Ch], there is an equivalent set of clauses L 1 v • • • v L ~ v C1, L1 v •.. v L k V Cz ..... L I V • • • V L k V Ch. There are two special cases of INF: a clause L1 v • • • v Lk is in I N F f o r m where h = 1 and C1 = [ ] and a f o r m u l a C~ A • • • A Ch is in I N F f o r m where k = 1 and L 1 = F]. L 1v

We usually c o m b i n e all the clauses containing the same skolem function symbol into I N F form, t h e n interpret the symbol according to the i n t e r p r e t a t i o n r u l e s . There are two interpretation rules for formulae in I N F form. In addition to interpreting skolem function symbols, these rules can be used to select all the necessary contrapositives. F o r each interpretation instance of an I N F f o r m L1V

"'"

VLkV[C1A

"'"

ACh]

R1 if I I=E [-,Lx ^ • • • ^'~Lk], t h e n for each i (l_ #. 2. I,v ~ -~k(A: #), k > 1 iff I, v ~ -~k-l(A:-~#). 3. I , v ~ ( F & G) iff I, v ~ F and I, v ~ G. 4. I , v ~ (F V e ) iff I, v ~ F or I, v ~ e . 5. I , v ~ ( F 6. I , v ~

~ e ) iffI, v ~ F o r I , v ~ G . F i f f I , v~: F.

7. I, v ~ (3x)H iff for some variable assignment v~ such that for all variable symbols y different from x, v(y) = v'(y), it is the case that I , v r ~ H. 8. I , v ~ (Vx)F ifffor all variable assignments v~ such that for all variable symbols y different from x, v(y) = v'(y), it is the case that I , v t ~ H.

75

We say I ~ H iff for all variable assignments v, I, v ~ H. The philosophical motivation behind the negation symbol -, can be found in [7]. However, as the next theorem shows (Normal Form Theorem), -~ is not necessary for the development of our theory. IIerbrand interpretations are defined in the usual way - the domain of any such interpretation is the set of all ground terms that can be expressed using the non-logical symbols of our language L. The assignments to constant and function symbols are identical to the classical logic case. However, predicate symbols of arity n are assigned functions from HU n to T where HU is the IIerbrand Universe of our language.

A mega-clause is a formula of the form: v . . . v L,,) where x l , . . . , x , ~ are all the variable symbols that occur in L1 V . . . v Ln and each Li is a mega-literal of order less than or equal to 1. T h e o r e m 1 (Normal Form Theorem) Suppose F is a closed formula. Then there is a finite set MCL(F) of mega-clauses containing no occurrence of the annotation _l_ such that F has a model iff MCL(F) has a model. [] A consequence of this theorem is that given any (finite) set S of formulas, there is a set of mega-clauses, denoted MCL(S) such that S is satisfiable iff MCL(S) is satisfiable. Moreover, if S is finite, then MCL(S) is finite. In addition, MCL(S) doesn't contain any occurrences of the annotation 1. We call sets of clauses that contain neither hyper-literMs of order greater than 0, nor occurrences of _l_, normal. T h e o r e m 2 (Kifer and Lozinskii, [12]) Suppose T is any set of mega-ctauses such that the set of annotations, # E T, occurring in T is finite. Then: T has a model iff every finite subset of the set of ground instances of T has a model. [] Two common situations under which T contains only finitely many annotations are: (a) when T contains finitely many truth values. There are many useful logics when T is finite. For example, the logic based on the set FOUR (eft Figure 1, [1, 2, 8, 9, 10]) of truth values is one such logic, while the logic based on the set SIX (cf. Figure 1) of truth values is another. (b) When T is any finite set of clauses, then it automatically contains only finitely many annotations. In general, this is the case that arises ordinarily in logic programming and in artificiM intelligence, where storage req~rements dictate that only finitely many sentences can be stored at any given point in time. A recursively enumerable axiomatization of the propositional logic fragment of Q T was proven sound and complete in [7]. However, this axiomatization is not amenable to a computer implementation because it contains sixteen rules of inference. Most theorem-proving researchers would agree that the more rules of inference an automated reasoning program is allowed to apply, the more "irrelevant" inferences it will generate, thus leading to the notorious combinatorial explosion problem. Thus, our aim in this paper is to develop a resolution-like proof procedure for paraconsistent logics which is amenable to a computer implementation. Moreover, this procedure will be applicable to first order Q T rather than just its propositional fragment.

76

L:O:f

T

T

_L

_L

Figure 1: The Complete Lattices FOUR and S I X

3

Linear Resolution

Procedure

for Q T

In this section, we develop the basic theory of resolution in paraconsistent theories. We recall that throughout this paper, T will denote some arbitrary, but fixed, complete lattice of truth values, and -~ will be some arbitrary, but fixed, unary function from T to 2r. As described in the previous section (cf. Definition 4), this will induce a definition of a particular paraconsistent logic. Suppose # E T is a truth value. Then we use the following notation:

up(p±) = {,x E T I), ~ p,} strictup(p,) = { A E ':rl ,X > p, and A -¢/1,} = up(#) - { i t }

in¢omz,(~) = {~ e 7-1 ~ ;~ p, and ~ ~ p,} down(p±) = {~ C T I~ #, then

.~(#, p) = 0. incomparable, then .q(#, p) # 0. .~(#,p) = 0. ~ ( # , p) ~ 0.

T h e o r e m 3 Let #, p E T. Then: .~(#, p) = 0 iff p < #.

[] [3

Intuitively, the above result makes it a bit easier for us to check whether two clauses are megaresolvable because instead of naively checking whether the condition up(#) A (stric~down(p) (3 incomp(p)) = 0 holds, we only need to check if p _< #. First, observe that mega-resolution is not refutation complete even for propositional programs and finite sets of truth values. E x a m p l e 2 Consider the lattice FOUR and let T = {p : t , p : f, ~ (p : T)}. T has no model, but there is no mega-derivation I of the empty mega-clause, denoted D, from T. To see this, observe that neither p : f nor p : t can mega-resolve with ,.~ (p : 3-) because of the requirement that ~ ( f , T) and .~(t, 3-), respectively, be empty. Alternatively, observe that 3- ~ f and T ~ t and hence, ~ (p : 3-) cannot resolve with either p : t or p : f. The above example tells us that if we wish to obtain a completeness result for megaresolution, we must rectify this situation in some way. D e f i n i t i o n 6 Suppose # , # 1 , # 5 E T . The pair, (#1,#2) is called a decomposition of # if # = U{pl,#2}. (#1,#2) is said to be a strict decomposition of # if, in addition to being a decomposition of #, it is also the case that #1 # # # #5E x a m p l e 3 Consider the complete lattice FOUR of truth values. Then the only strict decompositions of the truth value T are the pairs (t, f) and (f, t). w e know that T is a complete lattice under the ordering ~. Thus, D* is the set of minimal elements, if any, of D.

84 D e f i n i t i o n 16 Let S I , - . . , Sn be sets of truth values. We denote by I~1{$1,..., Sn} the set

{ U { s l , . . . , s n } lsi E Sifor 1 < i < n} The operation ~ allows us in definition 18 below to generalize factoring in the context of extended literals. D e f i n i t i o n 17 Given two truth values #, $ E T where # < $. M(~,~) = ( { P I P e 7", p # ~, and U {p,#} = ~})* D e f i n i t i o n 18 Suppose C1 and C2 are the era-clauses shown below:

C1 -~ =-

(B V L1 V . . . V Ln V D) ( B ' v Li v . . . . . .

v L " v D')

and Li = (Ai : #i), 1 < i < n, and L~ = ~ (A~ : Si) , 1 _< j < m, and A1,...,A,~, A~,...A~ are unifiable (via mgu 0), lq{#l,...,#,~} = #, and for some p E ~ { $ 1 , . . . , Sin}, either # > p or # < p. Then an ep-resolvent of 6'1 and C2 is: 1. if # > p, then an ep-resolvent of 6'1 and C2 is (B V D V B ~ V D')O. 2. i f # < p, then (B V D V B' V D ' V ~ (Ax : ]t,/(p,#)))0 is an ep-resolvent of C1 and 6'2. The em-literal ~ (A~ : Jk4(p,#)) is called the residue of the resolution. The substitution 0 is called the em-unifier of the mega-resolution step. Two strategies for reducing the search space are implicit in the definition of ep-resolution. We discuss each one informally. First of all, decomposition is performed only when a positive literal unifies with a negative literal, but their annotations do not satisfy the appropriate conditions for mega-resolution. In such a case, tile positive literal and one of the negative literals is resolved away immediately in the sazne step. The other negative literal generated as the result of decomposition is then annotated with the remainig set of possible truth values such that each may be used for ep-resolution in the future. From experiments, one of the places where a great deal of inefficiency occurs in a straightforward implementation of p-resolution is that the theorem prover generates decompositions blindly 2. On the other hand, ep-resolution directs its search process by decomposing only when necessary, again, avoiding the generation of many useless clauses. Secondly, a point related to the first point above is that in ep-resolution, no decomposition is ever necessary for positive literals. This eliminates a possibly enormous portion of the search space since two clauses are generated for each application of decomposition to a positive literal. Furthermore, since no input clause may contain literals with annotation of a set with more than one truth value, it follows that no clause generated in the course of a deduction will ever contain a positive literal with more than one possible annotation. This also trims the number of possible resolvents that one may generate. 2The number of decompositions can be quite large, depending both on the size of 7" and its asociated lattice ordering.

85

Issues relating to the completeness of ep-resolution with cloning are investigated in [16]. Experiments have already shown that in sets of clauses where a refutation is found, ep-resolution, by virtue of its embedding the above pruning strategies, generates fewer clauses. In the rest of this section, we briefly describe other strategies that are currently implemented. We define the complexity of a clause as the number of predicate symbols and the negation of predicate symbols occurring in the clause. For example, the clause p ( a ) : l V p(b):O V q(a,b):OY ~p(a): TV ~p(b):_l_ has complexity 3. The theorem prover attempts resolutions on clauses of smaller complexities first. This idea is nbt unlike the strategy of unit preference [21], or the fewest literal strategy, in classical theorem proving, where proofs are attempted first on "simpler" formulas. Our reason for defining complexity as above stems from the observation that often ep-resolution resolves away all or most of the literals with the same predicate symbol (or the negation of a predicate symbole) in one step. Subsumption, as defined in the previous section, is also incorporated into the implementation. This results in the discarding of many redundant clauses. Our current implementation is written in C-Prolog and runs on an Encore Multimax at Northwestern University. The real time for finding the proofs for the examples given in the previous section ranges up to 10 seconds during heavy system load. Much more extensive tests will be conducted. The results will be included in the long version.

6

Conclusions

Our principal aim in this paper was to develop a sound and complete linear proof procedure for annotated logic over an arbitrary complete lattice of truth values. As shown by the example in Section 4, these annotated logics provide a framework for formal reasoning about systems exhibiting inconsistency. Annotated logics were proposed by Subrahmanian [17] and subsequently extended by Blair and Subrahmanian [2, 3]. This work improves upon the work of Blair and Subrahmanian [2, 3] by developing proof procedures for full fledged annotated logic. The proof procedures developed earlier applied only to a fragment of annotated logics. To our knowledge, our experimental theorem prover is the first implementation of a theorem prover for full fledged annotated logics.

References [1] N.D. Belnap. (1977) A Useful I~bur- Valued Logic, in G. Epstein and J.M. Dunn, eds. Modern Uses of Many-valued Logic, (eds. G. Epstein and J.M. Dunn), D. Reidel, pps. 8-37. [2] It. A. Blair and V.S. Subrahmanian. (1989) Paraconsistent Logic Programming, Theoretical Computer Science, 68, 1, pp 135-153. [3] H. A. Blair and V. S. Subrahmanian. (1988) Paraconsistent Foundations for Logic Programming, Journal of Non-Classical Logic, 5,2, pp 45-73. [4] C. L. Chang and R.C.T. Lee. (1973) Symbolic Logic and Mechanical Theorem Proving, Academic Press.

86 [5] N.C.A. da Costa. (1974) On the Theory of Inconsistent Formal Systems, Notre Dame J. of Formal Logic, 15, pps 497-510. [6] N.C.A. da Costa and E.It. Alves. (1981) Relations between Paraconsistent logic and Manyvalued logic, Bulletin of the Section of Logic, 10, pps 185-191. [7] N.C.A. da Costa, V.S. Subrahmanian and C. Vago. (1989) The Paraconsistent Logics P T , to appear in: Zeitschrift fur Mathematische Logik und Grundlagen der Mathematik, Vol. 37, 1991. [8] M. C. Fitting. (1989) BiIattices and the Theory of Truth, to appear in: Journal of Philosopbical Logic. [9] M. C. Fitting. (1988) Logic Programming on a Topological Bilattice, Fundamenta Informatica, 11, pps 209-218. [10] M. C. Fitting. (1988) Bilattices and the Semantics of Logic Programming, to appear in: Journal of Logic Programming. [11] M. Kifer and T. Krishnaprasad. (1989) An Evidence Based Framework for a Theory of Inheritance, Proc. l l t h InternationM Joint Conf. on Artificial Intelligence, pp 1093-1098, Morgan-Kaufmann. [12] M. Kifer and E. Lozinskii. (1989) RI: A Logic for Reasoning with Inconsistency, LICS-89. [13] M. Kifer and J. Wu. (1989) A Logic for Object Oriented Logic Programming, Proc. 8th ACM Symp. on Principles of Database Systems, pp 379--393. [14] D. W. Loveland. (1970) A Linear Format for Resolution, Proc. IRIA Symp. on Automatic Demonstration, Lecture Notes in Mathematics, Springer, pps 147-162. [15] D. W. Loveland. (1972) A Unifying View of some Linear Herbrand Procedures, JACM, 19, pps 366-384. [16] J. Lu, V.S. Subrahmanian, and L. Henschen. (1990) An Improved Resolution Procedure for Paraconsistent Logics, submitted to AAAI-90. [17] V.S. Subrahmanian. (1987) On the Semantics of Quantitative Logic Programs, Proc. 4th IEEE Symposium on Logic Programming, Computer Society Press, Washington DC, pps 173-182. [18] V. S. Subrahmanian. (1988) Mechanical Proof Procedures for Many Valued Lattice Based Logic Programming, to appear in: JournM of Non-Classical Logic. [19] M.H. Van Emden. (1986) Quantitative Deduction and its Fixpoint Theory, Journal of Logic Programming, 4, 1, pps 37-53. [20] A. Visser. (1984) Four Valued Semantics and the Liar, J. of Philosophical Logic, 13, pps 181-212. [21] L. Wos, D. Carson, and G. Robinson, (1964) The Unit Preference Strategy in Theorem Proving, Proceedings of the AFIPS Conference 26, pp. 615-621.

C a s e - F r e e P r o g r a m s : A n A b s t r a c t i o n o f Definite H o r n P r o g r a m s Toshiro Wakayama Xerox Webster Research Center 800 Phillips Road, 128-29E Webster, New York, 14580 wakayama.wbst [email protected] T. H. Payne Department of Mathematics and Computer Science University of California, Riverside, CA 92521 [email protected]

A b s t r a c t . We consider a form of linear resolution (called SEI) that requires no factoring and no ancestor resolution. Thus, SEI behaves just like SLD, but it can tolerate certain non-Horn clauses and negative clauses. We prove that the class of case-free programs (a program here is a finite set of any clauses with the consistency requirement) is the largest class of programs for which SEI is sound and complete. Intuitively, a case-free program is a program in which no case analyses are required for computing correct query answers. The class of case-free programs is significantly larger than that of definite Horn programs. In particular, it is large enough to allow extensive manipulation of negative information, including non-allowed clauses: recall that negation-as-failure in SLDNF is essentially a test, and the allowedness is an essential requirement for the completeness of SLDNF[3]. We then prove a result that strongly indicates that SLDNF has some fundamental difficulties when and only when it deals with non-case-free programs. This result may open the possibility of obtaining better completeness results of SLDNF by restricting our attention to case-free programs.

§1. Introduction In studies of resolution-based theorem provers, there have been ambitious efforts to refine a full linear resolution and use it as a basis for programming languages while preserving its first-order completeness(e.g., [8, 12]). The major obstacle against these efforts has been the fact that a full linear resolution procedure generally requires two costly operations, namely factoring and ancestor resolution in addition to the basic SLD-like deduction. One of the interesting questions is then how powerful a theorem prover can be without factoring and ancestor resolution. Notice that such a theorem prover, which we call SEI in this paper(see section 2), is significantly more general than SLD: it does not have the definite Horn clause restrictions, i.e., it may take non-Horn clauses or clauses in which every literal is negative. On the other hand, since it lacks factoring and ancestor resolution, it behaves just like SLD, and hence we can expect its efficiency to be fairly comparable to that of SLD. Thus, our first task is to characterize the computational upper bound of SEI resolution: 1 We define the notion of case-free programs. Intuitively, a program, i.e., a finite set of any clauses with the consistency requirement, is case-free just in case it requires no case analyses for obtaining correct query answers. 2 We establish soundness/completeness results of SEI with respect to case-free programs. 3 We then show that the class of case-free programs is in fact the largest class of programs for which SEI is sound and complete.

88 Since SEI is an abstraction of the essential deductive features of SLD (dropping the syntactic requirements of definite Horn clauses), the class of case-free programs can be seen as a corresponding abstraction of definite Horn clauses, abstracting the program properties which are amenable to the SLD-like deduction defined as SEI. The most notable advantage of SEI over SLD is that it is now general enough to allow extensive manipulation of negative information, without adding extra inference mechanisms. See the example below. (1.1) E x a m p l e (1) (2) (3) (4)

math.maj(Mike) -~math.maj(Jon) take(x, Math200) take(x, MathlO0)

~-~~- math.maj(x) ~-- -~math.maj(x)

Apparently, this program violates the definite Horn clause restriction and contains some nonHorn(4) and negative(2) clauses. However, this program is still amenable to the SLD-like deduction: see the following proof of the query 3z take(x, MathlO0) constructed by SEI.

take(x, MathlO0) -,math.maj(y) empty goal

; ;

take(y, MathlO0) ,-- ~math.maj(y) -~math.maj(Jon)

; ;

{x/y} {y/Jon}

Note that the first side clause, take(x, MathlO0) ~ -~math.maj(x), in the above proof is an example of non-allowed clauses: a clause, written in the head-body notation, is allowed if every variable appearing in the clause appears at least once in some positive literal of the body([1], [3]). Recall that this allowedness condition is an essential requirement for the completeness of SLD extended through negation-as-failure. Note also that negation in SEI is the usual logical negation of first-order logic, and it is different from the negation interpreted through the negation-as-failure mechanism of SLDNF. These two types of negations have both advantages and disadvantages, and one is more appropriate than the other only in some applications. It is also possible to combine the two types, and they do not have to be mutually exclusive. In particular, it is interesting to see how SEI can be extended by adding negation-as-failure to it. However, it is important to have more comprehensive understandings of these two kinds of negation before attempting to naively combine the two. In particular, our second task in this paper is to characterize SLDNF in terms of its ability to perform case-analyses (i.e., to answer the circled question in the diagram below). In this regard, our findings are the followings: 1 SLDNF does perform sound case analyses, but only in peculiar situations. 2 We establish a proposition(5.8) that strongly indicates the fundamental difficulties of case analyses in SLDNF, i.e., we show, in the ground case, that whenever a query that requires case-analyses has an SLDNF refutation proof, it also has an SLDNF refutation proof such that the query is not a logical consequence of the clauses employed in this proof.

89 SEI

SLDNF

negation

logicM

NF

negative facts

explicit

via NF

case analyses

no

upper bound

case-free programs

some decidable classes

O ? strictness and allowedness

Notice that the latter finding is by no means intended to question the soundness of SLDNF, which is usually associated with much stronger semantics induced by completions of programs. However, this result may have an important implication to the completeness issue of SLDNF. The completeness issue of SLDNF is one of the central issues of logic programming, and there have been various attempts to identify satisfactory upper bounds of SLDNF query-answering procedure. Various concepts such as stratification ([1]), strictness, and allowedness have been proposed in this regard, but they are generally considered to be still too strong. Our formalization of case-free programs offers another conceptual dimension for understanding SLDNF. For instance, we may actually benefit from limiting our attention to case-free programs in characterizing upper bounds of SLDNF. This possibility, however, is beyond the scope of this paper. Related works include [21 and [71. [21 offers a logic programming scheme in which negation is treated through annotations attached to literals and not through negation-as-failure. [7] discusses a logic programming system called near Horn Prolog which interprets negation as the logical negation of first-order logic. Also, [12] and [9] present systems which treat negation as the logical negation. Compared with these studies, the contribution of this study is to show that the treatment of negation as the logical negation is quite possible within the framework of SLD-like deduction, without using any additional inference mechanisms, as long as we are dealing with case-free programs. §2. P r e l i m i n a r i e s Any definitions and notational conventions not specified in this section or other parts of this study follow [4] or [11]. We use upper case letters to denote literals, either positive or negative. If 2" is a formula, 3(~') and V(~') denote the existential and the universal closure of 2", respectively. I" ~ 2" means that the formula 2" is a logical consequence of the set of formulas F in the sense of classical first order logic [11]. By a model we mean a subset of the Iterbrand base of the language under consideration.

A substitution is a finite set of the form {zl/tl, z2/t2,..., z,~/tn} where each zl is a variable, each ti is a term distinct from zi, and zi's are distinct from each other. The set { z l , . . ' , z,} is called the domain of the substitution. A substitution is ground if no variables occur in the term t in any member z / t of the substitution. A clause is a formula of the form V(A1 V---VA. V-~B1 V.-. V-~Bm) where Ai's and Bj's are atomic formulas, n > 0, and m > 0. A clause in the above form is

90

a negative clause if n = 0, a positive clause if n >_ 1, a definite Horn clause, or simply a definite clause if n = 1, an indefinite clause if n > 2, a ground clause if no variables appear in it, and an A-clause if the literal A appears in it. Following the usual convention, we drop all quantifiers when we write a clause. An input representation of the clause A1 V . . - V An is a (logically equivalent) formula of the form

Ai ~ -~AI& . . . . Ai-x~-,Ai+l & . . . &'~An. The literal Ai is called the head of the input representation, and the conjunction to the right of the arrow is called the body of the input representation. An input representation is positive if its head is positive. A program is a consistent set of finitely many clauses, and we use P to denote a program. A program is positive if every clause in it is positive, and it is definite Horn if every clause in it is a definite Horn clause. A program is in an (positive) input representation if every clause in it is in an (positive) input representation. We allow a program in an input representation to have multiple input representations of a single clause. A set of clauses is ground if every clause in it is ground. If S is a set of clauses, we write ground(S) to denote the set of all ground instances of clauses in S over the (unspecified) language of S (S as a first-order theory). A goal or a query is the existential closure of a conjunction of literals. When we write a goal or a query, we usually omit all of its quantifiers. Literals of a goal are called subgoals.

(2.1) D e f i n i t i o n . An SEI-derivation from a goal g in a program P is a sequence of triples < g l , s l , 0 t >, < g2, s2,02 > , . . - such that, -

gl=g. si is an appropriate variant of a clause in P in an input representation such that its head is unifiable with the right-most subgoal of the goal gi via an mgu 0i. We call si's the side clauses of the derivation. if gi = A t & ' " &A,, and si = A0 (--- B I & . . . &Bin, then gi+l = ( A I & . . . ~ A , ~ _ I ~ B ~ & . . . ~=Bm)Oi. We say the ith triple derives the goal gi+l.

SEI, as defined above, may be seen as the most general form of the model elimination procedure of Loveland [5, 6] that requires no reduction and no re-entry resolution. Reduction is a form of ancestor resolution. Re-entry resolution refers to those derivation steps in which the second components of the triples are the negation of the top goal in an appropriate input representation. Thus, SEI stands for Single-Entry Input deduction, where single-entry means that the top goal can enter the derivation only once, namely as the top goal, and input deduction is the terminology used in automated theorem proving to mean linear resolution without ancestor resolution. (2.2) D e f i n i t i o n An SEI-proofof a query q in a program P is a finite SEI-derivation from q in P in which the last triple derives the empty goal. If A is an SEI-proof of q with its m g u ' s o h , . - - , an, then the composition al - - - a n restricted to the variables of q is called the answer

computed by A .

91

In logic p r o g r a m m i n g , a query answer is usually a single substitution. However, in the presence of non-Horn clauses, a query answer m a y be a set of substitutions. For instance, given the p r o g r a m {p(a) V p(b)}, we would like to say the query 3 z p(z) has an indefinite or

disjunctive =swer {{z/a}, {z/b}}. ( 2 . 3 ) D e f i n i t i o n . A n answer is a n o n e m p t y finite set of s u b s t i t u t i o n s having the s a m e d o m a i n . If an answer is a singleton {o.}, we m a y write it o. and t r e a t it s i m p l y as a substitution. A n answer is ground if every s u b s t i t u t i o n in it is ground. T h e domain of an answer ~ , w r i t t e n dome, is t h e d o m a i n of a s u b s t i t u t i o n in it. If ]C = {o-1,-.., o'n} is an answer and q a query t h e n q ~ denotes qo-1 V - - . V qo.,,. We say t h a t a query q has an answer ~ in a p r o g r a m P if t h e d o m a i n of ~ is the set of variables of q, and P ~ V(q]E). (2.4) o. is a in P . in P :

D e f i n i t i o n . Suppose t h a t a query q has an answer ~E in a p r o g r a m P . If a s u b s t i t u t i o n m e m b e r of an instance of ~ such t h a t P ~ V(qo.), then o. is called a unit instance of ~ is definite in P if it is a singleton, or every ground instance of it has a unit instance otherwise ~ is indefinite in P . If no p r o p e r subset of ~ is an answer of q in P , it is a minimal answer of q in P .

Note t h a t SEI only c o m p u t e s definite answers. Note also t h a t the notion of definite and indefinite answers depends on the underlying language of the p r o g r a m under consideration. See the e x a m p l e below. ( 2 . 5 ) E x a m p l e . Consider the p r o g r a m P = {p(a) V p(x)}, the query q = 3zp(z), and the answer E = {{z/a}, {z/z}}. If the u n d e r l y i n g language of P has only one constant and no other function symbols, the answer ]E is a definite answer of q in P . On the other hand, if the underlying language of P has a n o t h e r constant different from a, E is an indefinite answer of q in P . §3. P o i n t - w i s e D e t e r m i n a t i v e n e s s

and WeH-Informedness

T h i s section will identify the largest class of p r o g r a m s for which SEI is c o m p l e t e in

a strong sense (see the definition 3.12). We a d a p t the notation L + to denote the atomic c o m p o n e n t of t h e literal L. We also employ the n o t a t i o n atom{F} to denote the set of all a t o m i c f o r m u l a s a p p e a r i n g in the formula or the set of formulas F. ( 3 . 1 ) D e f i n i t i o n . Let S be a set of ground clauses in an i n p u t representation. T h e positive map based on S is the m a p , + s , + s ( L ) = L +, from the set of literals a p p e a r i n g in S to the set atom{S}. Define S+ = { A + ~-- B + & ' " & B + I A ~ B I & - . . & B , , E S}. W e refer to S + as the positive image of S. Note t h a t if P is a ground p r o g r a m in an i n p u t representation, P + is a definite Horn p r o g r a m . ( 3 . 2 ) L e m m a . Let P be a ground p r o g r a m in an i n p u t representation such t h a t the positive m a p based on P is a bijection. T h e n given a ground literal A, (1). A has an S E I - p r o o f in P i f f A + has an S L D - p r o o f in P + , (2). P ~ A i f f P +

~ A +.

92 P r o o f . (1) follows from the fact that the positive map based on P is a bijeetion. For (2), suppose P + ~ A +. Then A + has an SLD-proofin P+, by the completeness of SLD. By (1), we get an SEI-proof of A in P. Finally, by the soundness of SEI, we have P~A. Now suppose P~A. Let .M be a model of P+. We will show that A + is true in .h4. Let .,4+(.,4 - ) be the set of all atomic formulas that appear positively (negatively) in P. Since the positive map based on P is a bijection, A + n A - =0. We then define M ' = ( A - - M ) u (.a + n .M).

We will show .h4 ~ is a model of P. First note that (A- - M) n (A + n M) =

We claim that for each literal L appearing in P , (a). if L is positive, L E M ~ iff L E M , (b). if L is negative, L + E A4' iff L + ~ M . For (a), i r a positive literal L is in M , it is in (.4 + n M ) c_ M ' : conversely if L is in M ' , it is in (.4 + A M ) C_ M . To show (b), let L be a negative literal. I f L + is not in M , it is in (,4- - M ) C_ M~: on the other hand, if L + is in M ~, it is in .,4- - M , and hence it is not in M. Thus for every literal L appearing in P, we have L is true in M ~ iff L + is true in .h4. Since M is a model of P+, .h# is a model of P. Hence, by the supposition that P ~ A, A is true in 2v/~. This in turn implies the desired conclusion that A + is true in M . | The following diagram summarizes the l e m m a and related results. P t-SEX A

P+ ~SLD A +

I I i

P~A

P+ ~ A +

(3.3) Definition. If a ground clause has an input representation whose body is a logical consequence of a set S of clauses, then the clause is said to be determinative in S; otherwise it is nondeterminative in S. S is determinative if every clause in ground(S) is determinative in S. The following is immediate from the definition. (3.4) L e m m a . If two programs, with the same underlying language, are both determinative, their union is also determinative.

93

However, the converse does not follow. For instance, the ground program consisting of two clauses

AVB -,B is determinative, but its subset {A V B} is not. (3.5) L e m m a . Let S be a consistent set of ground clauses. Suppose that S is determinative and that every clause in S is in a determinative representation. Then the positive map based on S is a bijection. P r o o f . It suffices to show that no atomic formulas appear both positively and negatively in S. But this is clear because every clause in S is in a determinative representation and because S is consistent. II (3.6) L e m m a . Let P be a determinative program. Suppose for some P ' _ a ground literal A, P ' ~ A. Then A has an SEI-proof in P'.

ground(P) and

P r o o f . Let S = ground(P). Since S is determinative and consistent, by Lemma 3.5, the positive map + s is a bijection. Note that, since the positive map +p, based on P ' is a restriction of +s, it is also a bijection. Since P ' ~ A, A has an SEI-proof in P ' , as indicated in the diagram above. | In what follows, we adapt the notation S ~min ~" to mean that the formula ~- is a logical consequence of the set of clauses S but not a logical consequence of any proper subset of S. (3.7) Definition. Suppose that a query q has a ground minimal answer E in a program P. Then, P is (q, E)-determinative if a program P ' ___ground(P) is determinative whenever P ' ~ , m , qE. A program P is point-wise determinative if it is (q, E)-determinative whenever a query q has a ground minimal answer E in P. Intuitively, a point-wise determinative program is a program that locally looks like a definite Horn Program. However, this condition alone is not sufficient to assure an appropriate abstraction of definite Horn programs. This is because the notion of determinativeness is about what a program explicitly talks about and it says nothing about what is not mentioned in the program. If the underlying language is relatively large and contains constants not mentioned in the program, the program has a larger room for indefiniteness, which may in turn require non SLD-like deduction. Consider the example below. (3.8) E x a m p l e . Let V = {-,p(b), p(c)}. Then, clearly P is point-wise determinative. But, assume that the language of P has another constant a, and consider the query 3~3y~p(x)ap(y). Then we have

P ~ -~p(a)~p(c) V -~p(b)&p(a). Thus the query has an indefinite answer

y/a}},

which can not be computed by SEI. Thus, we need a condition that roughly states that a program contains sufficiently large information relative to its underlying language. (3.9) Definition. P is well-informed if atom(qE) C atom(P') whenever a query q has a minimal ground answer E in P, P ' C ground(P), and P ' ~ qE.

94 (3.10) Definition. P is case-free if it is well-informed and point-wise determinative. The reason we call point-wise determinative and well-informed programs case-free will become clear in next section. (3.11) L e m m a . If P is case-free, every minimal answer in P is definite. P r o o f . Suppose a query q has an indefinite minimal answer 22 in P. Then, by definition, some ground instance 22~ of 22 is an indefinite minimal answer of q in P . Let q22, = ql V . . . V qn, n >_ 2. Then for some pi C ground(P),

P' ~min ql V ... V qn. If AJ is a model of P ' , some q~ is true in A4. But then since P ' is determinative and atom({ql,..., qn}) C_ atom(P'), q~ is true in every model of P ' . Thus, we have

P' ~ qk, contradicting the minimality of 22'. 1 Now we will establish a completeness result of SEI analogous to that of SLD. Note that the completeness of SLD for definite Horn programs is actually a strong one in the following sense. (3.12) Definition. A program P is said to be strongly SEI-complete if for every query q and its minimal ground answer 22 in P, whenever P ' ~ q22 for a program P ' C ground(P), it has an SEI-proof in P ' that computes 22. If A is an SEI-derivation, we use side(A) to denote the set of all side clauses appearing in A. (3.13) L e m m a . If A is a ground SEI-proof, side(A) is determinative. P r o o f . A simple induction on the length of A. II (3.14) P r o p o s i t i o n . P is case-free iff it is strongly SEI-complete. P r o o f . Suppose P is case-free, and that a query q has a ground minimal answer 22 in P. By Lemma 3.11, 22 is definite. Since 22 is ground, it is a singleton by the minimality of 22. Let 22 = {0}, and

qO = At&...&A,,. Let P ' C ground(P) be a program such that

P' ~ At&.'. &A.. For each Ai, let Pi be a subset of P~ such that Since P is point-wise determinative, Pi is determinative. By Lemma 3.6, Ai has an SEIproof A~ in Pi. We then get an SEI-proof A' of qO = A I & " "&An in [3{Pi}l Other M[s are defined as Mi+l = MIU < TM,; FM, > U < TE,; F E, > TMo = T~o = F E o = { } FMo = {c}

MI-UU

=

Dis(P, M1) contains the clauses {a V b; p ~-- a; p +- b} and p can be derived from Dis(P, M1). = {p}.

TM1 = FM, = FME1= {}.

M2=UU F~

=

=

{e}

M3 = < {p}; {c} > U < q ) ; { c } > U < O ; O >

= < {p};{c,e}>

TM3 = {f}

M4 = < {p}; {c,e} > U < {f};¢ > U < {f,q};O > = < { p , f , q } ; {c,e} > M5 = M4 is the fixpoint. The reasoning is as follows. There is no clause with c in its head so c can be assumed to be false. This is captured by WFS. The first two rules of the program mean a V b is true. Since c can be assumed to be false, r4 means p e- b (we will now refer to it by r~). From rl, r2, r3, r~ we can safely assume p is true. This reasoning extends WFS, where any fact depending solely on p is assumed to be unknown. Since p can safely be assumed to be true, e can safely be assumed to be false by rs, the only rule with e in its head. By assuming e to be false, f can be assumed to be true by r6. By assuming f to be true and

110

using rl,r2,rr and rs, q can be assumed to be true. So we can safely give a value true or false to all atoms except a and b. As shown above, we obtain this truth assignment from our GWFS. The WFS being skeptical in nature, assigns the value unknown to all atoms except that it assign false to c.

D

T h e o r e m 3 Mfi is consistent.

P r o o f (sketch): Let M E = < T, F >.

As defined, M~+I = M~, U < TM~; FM~ > U

< TM~; FME >. If M E = M~ then clearly, W = U~<sTM~ U U~ [while exX do [sxx od$i][x:=x] q~ ) . Using the scheme for approximations (see section 2) we immediately get [x:=x][while e do [5 odSnext(i)] cp, Hyp J-

[x:=x][if E then [5 else abort~fi] [while e do I~ od$i][x:=x] ~p By the rules for the conditional and mk_srule(commute(x, x, [5,cp)) we get [x:=x][while e do [5 odSnext(i)] (p, Hyp J-

[if ExX then [sxx else abort fi][x:=x][while e do [~ od$i][x:=x] ~p By a rather special rule for applying the inductive hypothesis we then get the desired result. The condition that there must be no assignments to variables in x:=x is checked in the proof for the case where cx -= y:=c~. Here we use the second axiom given in section 2.3. Variable conditions for basic rules are implemented directly in LISP.

5 Metavariables A very special feature of the KIV system are the metavariables. Sequents may contain metavariables for any syntactic category like formulas, terms, programs and so forth. They act as placeholders which may become instantiated later. This feature allows to specify and to prove schematic statements. For instance, the basic rules schemes of our calculus are represented as schematic proof trees of height one, and, conversely, each schematic proof tree can be used as an inference rule. In the KIV system metavariables are used for several purposes: Statements can be generalized by inserting metavariables for subexpressions which are irrelevant for the proof. Thus the structure o f the statement becomes simpler and the search space of the proof is reduced. Metavariables are also used to postpone decisions. For example, an invariant required in Dijkstra's method for program construction (see below) need not be given as a whole beforehand. A part of it is given immediately when the corresponding rule is applied, but the yet unknown rest of it is postponed by inserting a metavariable instead (cf. the metavariable $rest below). Finally, metavariables are one of the important concepts in the KIV system that enable the integration Of program verification and program development without any changes to the logic or to the system itself. With the help of a metavariable we may express the specification of a program as a total correctness assertion F ~ ($C)~ with known preconditions F and postcondition ~ but a yet unknown program $C. In the rest of this section we will concentrate on this use of metavariables.

5.1 Developing Programs by Instantiating Metavariables Program development in the KIV system means to construct a particular proof tree: We start with a specification like the one above containing a metavariable for the yet unknown program. The application of proof refinements gradually leads to a series of new proof trees resulting in a

126

stepwise instantiation of the metavariables. We stop if there are no further uninstantiated metavariables in the proof. Then the conclusion of the proof tree is the total correctness assertion with the original pre- and postconditions but with the generated program instead of the metavariable. The premises of the proof tree are first-order verification conditions entailing the conclusion. There are two types of proof refinements applied to the specification and the intermediate proof trees: (i) operations to instantiate a metavariable with a new code fragment possibly containing other metavariables and (ii) operations which reduce a goal containing such a code fragment to sufficient subgoals (subspecifications for the remaining metavariables in it). The central operation of type (i) is the specialization of proofs which takes a proof tree, a metavariable and an expression of the same syntactic category and yields an instance of the given proof where the metavariable is replaced by the expression throughout the proof. The operations of type (ii) are refinements with verification rules for the various PASCAL-like instructions. 5.2 An Example Due to space limitations we will not display the applied rules. They are standard, and a rough understanding of what they do is enough for the purpose of this example. Suppose we wanted to develop a function computing the length of a list~ The initial specification is F- (proc lg ~ ~.(1 : n). $C in lg(l : n)) n = length(l) where the implementation of the procedure body is left open. We decide to develop a recursive version of lg and apply the induction rule (with respect to the input list 1) although we do not know all the details by now. Applying the rule yields a proof tree of height one with the above specification at the root and the following subgoal as the only premise Ind[$C] t- (proc lg ~ ~.(1 : n). $C in lg(1 : n)) n = length(l). Ind[$C] is the induction hypothesis and the notation displays the metavariables occurring in it. Ind[$C] -- ~'(1', n).(l'< 1 ~ (proc lg ~ ~.(1 : n). $C in lg(r : n)) n = length(l')) Now we apply the verification rule for procedure calls as a reduction rule and get a proof tree of height two with the original specification at the root and the following premise Ind[$C] b (proc lg ~ ~.(l : n). $C in $C) n = length(l). It is noteworthy that with most of the rules there is associated a variable check or a validation. However, these checks cannot be performed immediately, since the sequents still contain unspecified parts. Here we make use of the possibility to postpone the validations until the end of the proof. In our example we decide to specialize the current proof tree by inserting a conditional for $C. All the occurrences of $C in the current proof tree are replaced by if 1 = nil then $B else $G fi. This yields Ind[$B; $G] 1- (proe lg ~ ~.(1 : n). if I = nil then $B else $G fi in if 1 = nil then $B else SG fi) n = length(l). This goal can be reduced by the splitting rule for conditionals. The proof tree branches and we get two premises (the above procedure body is abbreviated by bdy) Ind[$B, $G], 1 = nil I- (proc lg ~ ~.(1 : n).bdy in SB) n = length(l) Ind[$B, SG], 1 ~ nil I- (proe lg ~ ~,(1 : n).bdy in SG) n = length(l). We now deal with the first one. We specialize the proof by inserting n:=0 for $B and apply the assignment reduction rule to the first premise. This results in the verification condition

127

1 = nil t- 0 = length(I). Note that replacing $B also affects the second subgoal since $B occurs on its left hand side and in bdy. For the second subgoal we specialize the proof by inserting (lg(cdr(1) : n); $D) for $G and apply the decomposition rule for compound statements. The result is Ind[$D], 1 ~ nil ~- (proc ... in lg(cdr(1) : n))(proe ... in SD) n = length(l). Applying the induction hypothesis yields Ind[$D], 1 ~ nil, n = length(cdr(1)) ~ (proc ... in SD) n = length(1). Finally we specialize the proof once more and insert n:= n+l for $D. Reducing the assignment yields 1 ~ nil, n = length(cdr(1)) ~- n+l = length(l). The two remaining subgoals are first-order verification conditions and do not contain any metavariables. Therefore we are done and the root of the tree contains the generated program F- (proe lg ~ ~(1 : n). if l=nil then n:=0 else lg(cdr(1) : n) ; n:=n+lfi in lg(1 : n)) n = length(l). Since every metavariable is instantiated now, we may execute the validations postponed so far. In our example the validations are successful. If they were not, we had to backtrack and revise our program decisions that led to the failure.

6 Strategies Strategies are top-level programs that provide the control structure of a proof method by calling substrategies and tactics in a certain order. They guide an uninformed user, i.e. a user without specific knowledge about the system and its logic, through proofs according to the special verification or development method. Strategies embody the interaction with the user and heuristics for the selection of rules and tactics as well as for backtracking. Typically the user is required to provide loop invariants, induction hypotheses, or convergence formulas. Depending on the strategy it may also happen that the system needs help to decide what to do next. Especially in the case of program development, where no (complete) program is available, this situation occurs frequently. Most verification strategies are syntax-directed in that they rely heavily on the form of the given program. Although the search space is typically much smaller than in other areas, conflicts arise. We have to decide what goal to tackle next and which rule or tactic to apply to it. In addition to methods for the selection of goals and tactics, strategies contain specific ways of doing backtracking and proof search. 6.1 I m p l e m e n t e d S t r a t e g i e s In the following, we give a list of the proof methods implemented in the KIV system, where we also mention the special heuristics involved, if there are any. • A (complete) proof procedure for propositional logic is implemented, which does not make use of any structural rules. • There are several versions of a prover for predicate logic, for instance with or without equality, complete or terminating. Heuristics are taken from [OS 88]. • There is a comfortable interactive implementation of Hoare's calculus: user guidance and backtracking facilities provided by the system enable the interactive development of proofs. For example, this has the advantage that the user does not need to know all the loop invariants in

128

advance, but can experiment with several possibilities. • We have implemented Bergstra's and Klop's method for proving program inclusion and equivalence, which is published in [BK 84]. Given a first-order axiomatization Ax of a data structure and two programs ~ und 13 the method proves that 0~ is equivalent to [3 in every model of Ax by showing: Ax' F- HOARE tp ---) [O~]~t ¢:~ Ax'~- HOARE (P - ~ [~]~/ for all conservative refinements Ax' of Ax and all formulas (p and ~. • An implementation of Burstall's method [Bur 74], [HRS 87] allows to verify programs that implement inherently recursive functions by loops. Given the goal 17"~ ((x;~}tp, the strategy eliminates ct and computes a new goal of the shape 17' ~- (~}(p. But in contrast to Hoaxe's calculus, loops are not eliminated by proving an invaxiance relation, but by structural induction on the data structure involved. Heuristics for this method have been developed in [Ha 87]. • As an example for a program development method we implemented Gries's method [GR 81], [He 89]. The program works like a smactural editor for programs: Given a precondition F and a postcondifion (p, a goal F [-- ($C)tp is created, where $C is a metavariable standing for the program to be developed. This metavaxiable gets more and more instanfiated until it is a concrete program. The heuristics involved in this strategy can also be found in [GR 81]. • Based on the implementation of Gries's method, there is the implementation of a strategy (introduced by an example by Dijkstra [Di 88]) which is capable of generating certain programs completely automatically. This strategy is treated below in more detail.

6.2 General Control Problems Although the strategies mentioned above are very different, we can state some control problems they have in common. How to Build up Proof Trees There axe two possibilities to build up proof trees: depth-first or breadth-first. Depth-first means that one branch of the proof tree has be be built up completely before another branch is worked on. This approach is useful for program development, since it corresponds to top-down program construction. In program verification, however, one might want to switch the branches to work on in order to be able to prove goals that are considered as critical first. In this case the proof tree is built up in layers. These two different approaches are also reflected in the backtracking structure of the respective strategy. Backtracking In all strategies that axe interactive or that involve heuristics, the possibility of backtracking should be included. In PPL, there axe two backtracking constructs, or and org (global or). e 1 or e2 is evaluated as follows: First evaluate e 1. If this was successful, then this is the value of e I or e 2. Otherwise the value of e I or e 2 is the value of e 2. The or-construct is equivalent to ? in ML [GMW 79]. It is sufficient if the strategy builds up proof trees in a depth-first manner. The advantage of this backtracking construct is that it can be implemented rather efficiently, because only the state before evaluation of e 1 has to be stored. Also, the use of o r leads to readable programs. However, the or-construct has one disadvantage: once the evaluation of e I was successful, there is no possibility to evaluate e 2 any more. This may be required when the proof tree is built

129

up breadth-first, giving the user the possibility to experiment, e.g. with different rules or different invariants or induction hypotheses. In such a situation the user might want to undo some steps and return to a former state by explicitly invoking a failure. Thus a backtracking construct having a "memory" is needed. This is the org-construct, which works as follows: first evaluate e 1. If this fails, the value o f e 1 o r g e 2 is the value o f e 2. Otherwise return the value of e l, but put the current environment together with e 2 onto a stack of open alternatives. If a failure occurs, then the dynamically last alternative is tried, as opposed to the syntactically last alternative, which is tried by or. There is no ML-equivalent to org.

Proofs as a Means for Resolving Conflicts In the implementation of every strategy one has to decide how to treat goals of predicate logic. One possibility is to leave them as verification conditions and prove them after the strategy has terminated. This approach has been taken e.g. in the implementation of Gries's method. However, if one wants to try several ways to proceed, it can be useful to apply a rule, try to prove some of the simpler goals created, and undo the rule application if the subgoals in question could not be proved. One example where this is the case is the verification of a loop in Hoare's logic. Before the invariance of a suggested formula is shown, it should be proven that the formula is not too weak, i.e. that the formula together with the negation of the loop condition implies the postcondition. 6.3 A Completely Automatic Strategy In the case of development strategies it is sometimes possible to fix the overall structure of the proof. In this situation, the program constructs are selected such that the subgoals yielded by that strategy become provable. As an example we present a strategy which completely automatically generates programs for specifications of the following shape: • (0) = b ~ ( k + l ) = O((I)(k), W(k)), where t5 is an elementary operation and W does not depend on ~ . The basic ideas of this strategy go back to an example presented by E. W. Dijkstra [Di 88]. The task was to develop a program that computes n 3 for a given n_>0 without using multiplication. The idea is to successively compute 13, 23 ..... n 3, such that (i+l) 3 is computed from i 3 using only addition (the preliminary loop invariant is 0~_0 [- ($C)x0=~(n), we generate the following schema for $C: i:-- 0, x0:= ~(0); {0_m i n - h t ( ~ ,

rD

in which b o t h 1 a n d r are induction variables. We will need the following multi-wave rules:

==~ ~ a x _ h t ( u ~ ) , r n a x _ h t ( u ~ ) ~ ] :=~ ~ i n _ h t ( u ~ ) , r n i n _ h t ( u ~ ) ~ ) ] 1

2

Note t h a t all four of these rules have multiple Us, the first two and last have multiple Fs, and t h a t the last one also has multiple Ss. Recall t h a t the direction of implication in the last two rules is right to left. Rippling-out (5) then produces:

> ~in_ht(1),rnin.ht(r)~ ~ n a x _ h t ( l ) , raax_ht(r)~ > F~in---Onin_ht(1),min_ht(r)~ max_ht(l) > min_ht(l) [ ] >_minJ t( ) to which strong fertilization applies, finishing the proof of the step case. N o t e t h a t the first two wave fronts are c o m p o u n d and m u s t be rippled-out in two stages. Note also t h a t the last wave front is a logical connective. Rippling-out can proceed t h r o u g h predicates a n d connectives as well as functions.

4

Conditional

Wave Rules

Our second extension is to allow conditional wave rules, i.e. wave rules t h a t are only true under some condition. T h e y have the form:

< condition > --r LHS =¢, RHS where

LHS =ezRHS

is a wave rule.

If the condition of a rule is provable from the current hypotheses then, clearly, we can use the rule. But even if it is not currently provable we can still use the rule provided we divide the p r o o f into two cases using the condition a n d its negation. T h e condition is t h e n trivially provable in the first case. So a m a j o r p r o b l e m to be solved in the use of conditional rules is when to t r y to prove the condition within the current case (either i m m e d i a t e l y or later} a n d when to use the condition to split the current case into sub=cases.

139

As a partial solution to this problem, related conditional rules are stored, in CLAM , in c o m p l e m e n t a r y sets of the form:

where

RHSI is either of the form: . . . ,

), . . . , F(v;,,

. . . , v::

)E]

1 < q~, rjl _< m1 for 1 _ times(x y) -- 0 ~' x,y:nat x --- s(p(x)) ---> times(x y) -- plus(y times(p(x) y)) }

The distributivity of plus over times is formalized by the statement ~' x,y,z:nat plus(times(x y) times(x z)) -- times(x plus(y z)) and, in order to prove this claim by structural induction on x, we obtain as an induction step V x:nat x = s(p(x)) --~ (V y',z':nat plus(times(p(x) y') times(p(x) z')) - times(p(x) plus(y' z'))) ---> (V y,z:nat plus(times(x y) times(x z)) - times(x plus(y z)) )

(hypothesis) (conclusion).

Assume, we have already proven the associativity and the commutativity law of plus and times, Then, we obtain a proof of the induction step in the following way (terms underlined will be changed): = = = = = = = = =

plus(times(x y! times(x z)) plus(plus(y times(p(x) y)) times(x zll Dlus(DluS(y times(o(x) y~l Dlus(z times(D(x! z ~ plus(y plus(times(p(x) y) plus(z times(_o(x! z)!)) plus(y 121us(times(o(x~ y~ Dlu~(times(olx~ z~ z ~ plus(y plus(olus(times(D(x'J y! times(D(x! z)) z)! plus(y plus(z Dlus(times(o(x) y) times(o(x) z)!)) Dlus(v Dlus(z times(o(x~ Dlus(v z~')~ Dlus(olus(v z~ times(D(x~ Dlus(y ZI!~ times(x plus(y z))

(1) (2) (3) (4) (5) (6) (7) (8) (9) (10)

Def. of times: Def. of times: Associativity of plus: Commutativity of plus: Associativity of plus: Commutativity of plus: using Induction hypothesis: Associativity of plus: Def. of times:

The problem is, however, to find such a proof by machine, since in each step of the deduction a lot of other deductions are possible but rather useless. For instance, using the commutativity law of times causes the theorem prover to run into a blind alley in each of the deduction steps. Thus, how can we avoid such useless deduction steps ? The answer is based on the observation that the results of each of the deduction steps (1) - (7) (regarded as strings) share the same pattern : ...ptus(...times(...x ...... y...) ...... times(...x ...... z...)...)...

(*).

Hence, if we substitute the fill-ins ... by appropriated strings, we obtain each of the terms (1) - (7). By way of contrast, applying the commutativity law of times to (1) results in a term plus(times(y x) times(x z)) which violates the given pattern. Thus, knowing the pattern at the beginning of a proof, we restrict our search to those deduction steps which satisfy the pattern. Each term satisfying a pattern may be divided into parts which correspond to the fill-ins in the pattern and parts which do not, For example, the term (4) satisfies the pattern (*) and thus we split up (4) into different sections (sections not corresponding to fill-ins are bold):

plus(y plus(times( p( x ) y) plus(z times( p( x ) z) ) ) ) In the same way we divide (7) into different sections: plus(y plus(z plus(times(p(x) y) times(p(x) z)) ))

149 Suppose some terms satisfy a common pattern. Then, they only differ in sections corresponding to fill-ins while the others coincide. In our example sections of the terms (1) - (7) which do not correspond to fill-ins are equal. I.e. removing all sections from the terms (1) - (7) corresponding to fill-ins yields always the same: plus(times(x y) times(x z)). Since sections corresponding to fill-ins may change during deduction, we call them changeable and sections not corresponding to fill-ins unchangeable. In short we call a term partitioned into changeable and unchangeable sections a partitioned term (and print unchangeable sections bold). Furthermore, the induction hypothesis satisfies (*) and thus we denote it also as a partitioned term

plus(times(

p( x ) y) times( p( x ) z),

the unchangeable sections of which are equal to those of the terms (1) - (7). Hence we use (*) to guide our induction proof if we admit only those deduction steps the result of which satisfy the given pattern (*). This solution will be approached in three different steps: (i) The first step is to define a representation of partitioned terms, so-called C-terms, which also distinguish between changeable and unchangeable sections of a term. To manipulate C-terms by equations we propose a special representation of equations, called C-equations. A C-equation is a pair of C-terms denoting two terms with coincident unchangeable sections. (it) The second step is to generate the pattern guiding the induction proof. Based on a comparison of the given induction conclusion (the starting point of the deduction) and the induction hypothesis (the final point of the deduction) we compute C-terms of one side of conclusion and hypothesis such that the unchangeable sections of both C-terms coincide. (iii) The last step is to manipulate the computed C-term of the conclusion with the help of given Cequations to enable the use of the induction hypothesis. Comparing the changeable sections of the Cterms of conclusion and hypothesis we minimize the differences until we obtain a C-term representing a term which allows to use the hypothesis. 2. C - T E R M S A N D C - E Q U A T I O N S In this chapter we propose a representation of partitioned terms. In a first approach we might mark each function- and variablesymbol if it is unchangeable as we have done by printing unchangeable sections bold. Hence, we might represent the term (4) of our introductory example by

plus(y plus(tlmes(p(x)

y) plus(z times(p(x) z) ) ) )

(**) .

For our purposes, however, this representation is somewhat unwieldy. We obtain a more practical representation if we denote the changeable sections of a term in the usual representation of terms and the unchangeable sections by their structure trees. For a given partitioned term we construct a socalled C-term as follows: Given a term t, we first replace each maximal subterm ti of t with unchangeable top-level symbol by an asterisk *. The resulting term, in which some asterisks occur, is called a context (cf. def. 1). If the top-level symbol of the term is itself unchangeable, we obtain nothing but an asterisk, which we call an empty context. For instance, in the example (**) we obtain plus(y ") as context and plus(times(p(x) y) plus(z times(p(x) z) ) ) as the replaced subterm tl.

150 Next, the context c and the representations [plus(y *), plus] Sl...Sn of the replaced subterms tl...tn are denoted in a list enclosed in brackets [c, Sl ... Sn]. In doing so, the sequence Sl ... Sn c o r r e s p o n d s to the [*, times] [ptus(z *), times] appearances of the asterisks if we traverse the context c from left to right. Sl ... Sn is a sequence of trees. The (unchangeable) top-level symbol of ti forms the root o f the tree si and there are [p(*), x] [*, y] [p(*), x] [*, z] i m m e d i a t e l i n k s f r o m the r o o t to the representations of the arguments o f the top-level Fig. 2.1: C-termof the result of the deduction step (4) symbol in ti. If ti is a variable or a constant we obtain a trivial tree si which is the symbol itself. Figure 2.1 shows a C-term representing (**). So, roughly speaking, the unchangeable sections of a term form the construction of the underlying trees of the C-term while the changeable sections form the left-hand sides of the labels in each of their nodes. To ease readability, we shall use both representations of partitioned term and C-term for the rest of the paper.

[plus(* *), times, times]

[*,x]

[*,z]

[*,y]

Fig.2.2: C-term of plus(times(x z) times(y z))

[*,z]

Figure 2.2. shows a C-term of the partitioned term plus(times(x z) times(y z)) in which a context with more than one asterisk occurs. The left asterisk of the context corresponds to the left tree and the right one corresponds to the right tree.

Next, we define how to manipulate C-terms by equations without changing unchangeable sections of them. For this reason we define so-called C-equations as pairs of C-terms. Now, using a C-equation to manipulate a C-term means to match one side of the equation with a subterm of the C-term and replace it by the instantiated other side of the equation. Hence, to preserve unchangeable sections of the C-term the unchangeable sections of both instantiated sides of the C-equation have to coincide. Thus, we demand that already both sides of the C-equation coincide in their unchangeable sections. A C-substitution t~ (cf. def. 6) is a mapping of variables into C-terms which is identical almost everywhere on the set of variables. W e extend this mapping to C-terms in the usual way except that a variable x occurring in a context is mapped into the term denoting ~(x) without unchangeable sections. For instance, consider the associativity law of plus:

~/x,y,z:nat plus(plus(x y) z) = plus(x plus(y z)) Among others, there are two possible partitioned equations such that the unchangeable sections of both sides coincide:

~' x,y,z:nat plus(plus( x y) z) == plus(x plue(y z) ) or ~' x,y,z:nat plus(plus(x y) z) -- plus(x plus(y z) )

151 In both cases the unchangeable sections of both sides are equal. The C-equation shown in Figure 2.3 represents the first partitioned equation and Figure 2.4 shows the Cequation representing the second one.

[*, plus]

[plus(x *), plus]

,/'x [plus(x *), y]

: [*, z I

[*, y]

[*, z]

Fig. 2.3: C-equation of plus(plus(x y) z) E plus(x plus(y z)) Up to n o w we used the notion of coincidence in such a way that the unchangeable sections of terms coincide if [*, plus] [plus(* z), plus] the strings obtained by r e m o v i n g all changeable sections of these terms are equal. Let us extend this notion of coincidence. [*, x] [plus(* z), y] [*, x] [*, y] Consider the intended use of the C-term r e p r e s e n t a t i o n . I f we d e m a n d that Fig. 2.4: C-equation of plus(x plus('y' z)) E plus(plus(x y) z) unchangeable sections of both sides of a partitioned equation are equal, each occurrence of a symbol in an unchangeable section of the hypothesis exactly corresponds to one occurrence in the conclusion. Manipulating one side of the conclusion by C-equations, we finally obtain only one possibility for using the hypothesis. But, for instance, proving properties about trees often requires to use the hypothesis twice. Thus, we have to extend our notion of coincidence such that an occurrence of a symbol in an unchangeable section of the hypothesis may correspond to various occurrences in the conclusion. If we trace this condition back to the equations used for deduction, each occurrence of a symbol in an unchangeable section of one side may correspond to various occurrences on the other side. Precisely we define a mapping co (cf. def. 4) which relates a partitioned term t to a set of terms co(t) representing the unchangeable sections of t and define the coincidence of two partitioned term s, t by the equality of co(t) and c0(s): we obtain each member of co(t) if we gradually replace each subterm of t with a changeable top-level symbol by a subterm of it with an unchangeable symbol. The set c0(t) of a partitioned term t is called the skeleton of t. The skeleton of a C-term is the skeleton of its represented partitioned term. For instance, given the following partitioned distributivity law

~' x,y,z:nat plus(tlmes(x y) times(x z)) -= tlmes(x plus(y z)) [plus(* *), times, times]

[*, x]

[*, y]

[*, x]

[*, times]

[*, z]

[*, x]

Fig. 2.5: C-equation of the distributivity law.

[plus(* *), y, z]

we represent it by a C - e q u a t i o n s h o w n in F i g u r e 2.5. The unchangeable occurrence of times (resp. x) on the right-hand side corresponds to both (!) occurrences of times (resp. x) on the left-hand side. The skeletons of both sides are equal to {times(x y), times(x z)}.

152 Let us consider some more examples: Given the recursive case of the definition of plus: ~' x,y:nat x -= s(p(x)) ---) plus(x y) -= s(plus(p(x) y) ).

[*, plus]

[s(*), plus]

/%;/%

Both sides of the partitioned equation plus(x y) [*, x] [*, Y] [p(*), x] [*, y] = s ( p l u s ( p ( x ) y ) ) have the same skeleton, n a m e l y { plus(x y) }. Therefore we may Fig. 2.6: C-equation of plus(x y) ~ s(plus(p(x) y)) represent this partitioned equation (ignoring the condition x -= s(p(x)) ) by the C-equation shown [*, times] [plus(y *), times] in Figure 2.6. Consider now the recursive case of the definition of times: V x,y:nat x- s(p(x)) --) times(x y) - plus(y times(p(x) y)).

/",

[*, x]

" /'x

[*, Y]

[p(*), x]

[*, y]

Fig. 2.7: C-equation of times(x y)=- plus(y times(p(x) y))

Analogously a common skeleton of the partitioned equation times(x y) ~ plus(y times(p(x) y) ) is { times(x y) }. Ignoring the conditions we obtain the C-equation shown in Figure 2.7 In general there are several different C-equations or several partitioned equations denoting one equation. In case of the associativity law of plus, for instance, there are more than the C-equations represented in Figures 2.3 and 2.4, but on the other hand the skeletons of the C-equations not presented here are less specific than those of the C-equations presented above. We compute these Cequations if we just "weaken" each of the presented C-equations by "declaring" unchangeable sections as changeable. E.g. if we "declare" the symbol plus to be changeable, we may "weaken" the C-equation in Figure 2.3 to the C-equation: [plus(plus(x *) *) , y, z] - [plus(× plus(* *)), y, z] which represents the partitioned term ptus(plus(x y) Z) --= ptus(x plus(y Z)). 3. G E N E R A T I N G A P A R T I T I O N F O R T H E C O N C L U S I O N This chapter describes how to compute a suitable partition of one side of the initial induction conclusion such that manipulating only its changeable sections enables the use of the induction hypothesis. A promising partition of the conclusion is chosen by comparing conclusion and hypothesis. Based on this partition we construct both an initial C-term of the conclusion and a scheme of C-terms representing potential results of deduction, i.e. C-terms denoting terms which enable the use of the hypothesis. Starting at the initial C-term we manipulate it by repeated use of Cequations until we obtain a C-term satisfying the scheme noted above. But how can we compute such a partition to guide the proof by comparing hypothesis and conclusion. Since the unchangeable sections of the final conclusion remain the same as the unchangeable sections of the initial conclusion, both the initial conclusion and the resuk of deduction are built up on the same skeleton. On the other hand, the only thing we know about this result is that it is enabled for using the hypothesis. I.e. the hypothesis matches a subterm of the result. Hence it seems to be obvious to use a skeleton for guiding the induction proof on which both the conclusion and the (instantiated) hypothesis can be built up. The more specific this skeleton is, the more we

153

reduce the search space but also the more we run the risk to miss the proof. At present, however, we are interested in a most specific skeleton of the conclusion and the (instantiated) hypothesis. In order to compute such a skeleton, consider the generation of an induction formula for an arbitrary formula V x,y p(x y ) , cf. [Aubin, 1979, B o y e r and Moore, 1979; Stevens, 1988; Hutter, 1989]. Suppose, we carry out induction on x. Then we obtain as base case a formula like: V x,y q)(x) --* P(x y) and as an induction step a formula like: V x --,O(x) --> (V y P(~(x) y) -~ (V y P(x y)) ). Comparing the induction hypothesis V y p(~(x) y) with the induction conclusion V y P(x y), we observe two differences: 1. Each occurrence of the so-called i n d u c t i o n v a r i a b l e x in the conclusion corresponds to an occurrence of a term ~(x), which denotes a predecessor of x w.r.t, some well-founded ordering, in the hypothesis. 2. All free variables occurring in both hypothesis and conclusion are induction variables. Hence we proceed with the assumption that the sets of all non-induction variables of hypothesis and conclusion are pairwise disjoint. To get a most specific skeleton of conclusion and hypothesis we neglect the second point and identify each non-induction variable in the hypothesis with its corresponding variable in the conclusion. Thus, we are left with the differences from substituting the induction variables by their "predecessors". Examining many examples, we made the following important observation: an induction variable x occurs almost always in its corresponding term 8(x). For instance, in the introductory example the induction variable x occurs in p(x). Provided x occurs in a(x), we may represent ~(x) by a C-term like [tx, x], or [tx, x . . . . . x] if x occurs more than once in 8(x). For instance, [p(*), x] denotes the term p(x). Thus, if we add a proper context tx to each occurrence of an induction variable x in the conclusion, we obtain the (renamed) induction hypothesis. Hence, we interpret the entire conclusion as unchangeable and achieve a partition of the conclusion which has no changeable sections. Based on this partition we construct the initial C-term for an arbitrary side of the conclusion. Since both sides o f the partitioned conclusion have no changeable sections, all contexts of the corresponding C-terms are empty. In order to compute a scheme of C-terms representing potential goals of the deduction we make following considerations: (i) Since we are interested in using the hypothesis, a subterm of the modified conclusion needs to be matched by one side of the instantiated hypothesis. Hence it does not matter in which surroundings this subterm occurs, i.e. the root of the final C-term may possess an arbitrary context. (ii) In order to compute a common skeleton of one side of hypothesis and conclusion, we have identified the non-induction variables of both formula. But since we may instantiate the noninduction variables of the hypothesis arbitrarily, also the nodes of the final C-term labelled with noninduction variables may possess arbitrary contexts. Let us now return to the introductory example of proving the distributivity law of plus over times by induction:

154 Since the left-hand side of the conclusion plus(tlmes(x y) tlmes(x z)) has no changeable sections we obtain the initial C-term shown in Figure 3.1. Figure 3.2 shows the scheme of a final C-term which enables the use of the induction hypothesis. ? denotes the arbitrary contexts mentioned above.

[~, plus]

[*, plus]

[*, times]

,/',, [*, times]

[*, times]

/%/% [*,x]

[*,y]

[*,x]

[*,z]

Fig. 3.1: C-term of plus(times(x y) times(x z))

[p('), x]

[*, times]

t~, y] [P(*),x]

[~, z]

Fig. 3.2: scheme of a final C-term

4. P R O V I N G I N D U C T I O N S T E P S The last step is to manipulate the computed C-term of one side of the conclusion to enable the use of the hypothesis. Thus, we manipulate the C-term shown in Figure 3.1 until it satisfies the scheme of Figure 3.2. This aim is divided into two subgoals: Initially, only the contexts of the induction variables prevent the use of the induction hypothesis. They are all empty in the conclusion but (usually) non-empty in the hypothesis. Now, we generate these missing contexts by using appropriate C-equations. This is done with the help of so-called context-creating C-equations. We call a C-equation context-creating iff its left-hand C-term contains only the empty context *. Consider a recursive case in a definition of a function f: C -~ t(xl ...Xn) - g(...f(6(xl) ...6(Xn)-.). If each of the formal parameters xi occurs in the actual parameters 8(xi) of the recursive call, i.e. ~(xi) is equal to some hi(xi), then the C-equation corresponding to f(xl...Xn) - 9(...t(h(xl) ...h(xn) )..) is context-creating. This condition is, for instance, satisfied by almost every recursive case in the function definitions of the exemplary database in [Boyer & Moore, 1979]. Examples are the C-equations of recursive cases of plus and times as shown in Figures 2.6 and 2.7. Further examples of context-creating C-equations are structure definitions like [', x] - [p(s(')), x] denoting x - p(s(x)). In our example we use the C-equation of Figure 2.7 to generate the missing context p(*) at both occurrences of the induction variable x. Hence we use this C-equation at the positions designated by in Figure 3.1. Note, that this C-equation is governed by a condition and before application we have, of course, either to verify that condition or we have to divide the proof into several cases. The former may be done by the help of some depth-limited refutation procedure, while the use of the latter has to be restricted by some heuristics which prevent the prover to divide the proof into infinite many cases. But we do not go into details how do this.

155 Comparing the C-term shown in Figure 4.1 and the scheme shown in Fig. 3.2, the contexts of both occurrences of x are equal. But unfortunately, the use of the C-equation in Figure 2.7 has generated also unwanted contexts plus(y *) and plus(z *).

[*, plus]

[plus(y *), times]

[plus(z *), times]

After the first step of our approach we have generated all missing contexts in the occurrences [p(*), x] [*, y] [p(*), x] [*, z] of the induction variables. In doing that we also generated unwanted contexts in other nodes of the Fig. 4.1: C-term of plus(plus(y times(p(x) y)) plus(z times(p(x) z))) C-term. Hence, in a second step we have to "move" these contexts to positions in which arbitrary contexts are admissible, i.e. positions the contexts of which are labelled by ? in Figure 3.2. We do this by the help of so-called context-moving C-equations. A C-equation is called contextmoving iff on one side only the root and on the other side only leaves have non-empty contexts. A typical example of a context-moving C-equation is the associativity law, e.g. the associativity law of plus as shown in Figures 2.3 and 2.4. But also C-equations of other "classical" mathematical laws such as distributivity (Figure 2.5) or homomorphism - are context-moving. Almost half of the equations given in the exemplary database of [Boyer and Moore, 1979] are representable as contextmoving C-equations, which illustrates the importance of this form of equations for induction proofs. Wave rules [-Bundy, 1988] can be interpreted as another form of context-moving equations.

[plus(y *), plus]

[*, timesl

[plus(z *), times]

./'.,../-,, [p('), xl

[*, Yl

[p(*), xl

[*, z]

Fig. 4.2: C-term of plus(y plus(timos(p(x) y) plus(z times(p(x) z))))

[plus(y plus(z *)), plus]

[*, times]

[p(*), x]

[*, times]

[*, y]

[p(*), x]

[', z]

Fig. 4.3: C-term of plus(y plus(z plus(times(p(x) y) times(p(x) z))))

Let us now return to our example. We use the Cequation of the associativity law of plus (Figure 2.3)at the top-level of the C-term shown in Figure 4.1 to move the unwanted context plus(y *) to the root. Hence we obtain the C-term shown in Figure 4.2. Comparing the scheme in Figure 3.2 with the actual C-term in Figure 4.2 only one unwanted context, namely plus(z *), is left but neither one of the C-equations of the associativity law nor any Cequation of the definition of plus is applicable to move this context to the root. The C-equation shown in Figure 2.4, however, seems to be suitable (ignoring the not unifiable contexts plus(z *) and plus(" z) ), since it enables us to move a context from the right leaf to the root. Now, there are two possibilities: either we know that plus is commutative and we thus manipulate the context plus(z *) to plus(* z) or we generate a task to prove that both contexts are equal. In any case after that, the C-equation representing the associativity law of plus (Figure 2.4) is usable to move the manipulated context to the root. Applying again the commutativity law of plus we

156

change the context in the root to plus(y plus(z *)) and obtain the C-term shown in Figure 4.3, which already fits the scheme in Figure 3.2. Hence the induction hypothesis can be used to obtain the term plus(y plus(z times(p(x) plus(y z)))). Applying the same approach to the right-hand side of the conclusion yields the term plus(plus(y z) times(p(x) plus(y z))) and after using the associativity law of plus the theorem is proved. Let us now consider a more difficult example in which we have to use the induction hypothesis twice: Suppose,

we

have defined the binomial coefficient ( ~ ) by the following set of conditional

equations: Defbinom = { V x,y:nat y - 0 --~ binom(x y) --- s(0) ~" x,y:nat x - 0 ^ y - s(p(y)) ---) binom(x y) -- 0 'V' x,y:nat x - s(p(x)) ^ y - s(p(y)) --~ binom(x y) - plus(binom(p(x) y) binom(p(x) p(y))) } Analogously to the remarks in the [plus(* b*), inom, b ~ last example the equation of the recursive case of binom (ignoring its condition x - s(p(x)) A y ----s(p(y)) ) may also be represented as a [*, x] [*, y] [p(*), x] [*, y] [p(*), x] [p(*), y] context-creating C-equation as shown in Figure 4.4. The skeleton Fig. 4.4: C-term of binom(x y) .~ plus(binom(p(x) y) binom(p(x) p(y))) of both sides is {binom(x y) }. Suppose, we want to prove the theorem V x,y:nat y - s(p(y)) -~ binom(x ptus(x y)) =- 0 by structural induction on x. Hence, we obtain as induction step V x:nat x -- s(p(x)) ( (~' y:nat y - s(p(y)) ---) binom(p(x) plus(p(x) y)) - 0) --~ (V y:nat y - s(p(y)) --) binom(x plus(x y)) - 0 ) ). Choosing the left-hand side binom(x plus(x y)) of the conclusion we again try to make the induction hypothesis useable and again we compare both left-hand sides of conclusion and hypothesis to get a suitable partition. The resulting partitioned term binom(x plus(x y)) has [*, binom] [~, binom] no changeable sections such that its representing C-term (Figure 4.5) [*, x] [*, plus] [p(*), x] [*, plus] possesses only empty contexts. The scheme of the final C - t e r m is [p(*), x] [~, y] [*, x] [*, Y] shown in Figure 4.6. Fig. 4.5: C-term of binom(x plus(x y)) Fig. 4.6: scheme of the fmal C-term

,/-,,,

157 Again, the first step is to generate the missing contexts in the occurrences of the induction variables x. Searching for a suitable contextcreating C-equation we only find the [plus(**), binom, binom ] C-equation o f the definition of bloom (Figure 4.4). Using it yields the C-term shown in Figure 4.7. [p(*), x ] ~ [p(.), x] Since its unchangeable section on the left-hand side corresponds to two unchangeable sections on the right-hand side of the used C[*, x] [*, y] [*, x] [*, y] equation we obtain two possible Fig. 4.7: C-term of p o s i t i o n s to c o m p a r e with the plus(binom(p(x) plus(x y)) binom(p(x) p(plus(x y)))) scheme of a final C-term. In order to generate the missing contexts in the [plus(* *), binom, binom ] r e m a i n i n g occurrences of x, we a p p l y the C - e q u a t i o n o f the definition of plus (Figure 2,6) to these occurrences and fmatIy obtain the C-term shown in Figure 4.8.

/',,

/'x

Comparing the scheme of a final C-term with both candidates yields Fig. 4.8: C-term of unwanted contexts s(*) resp. p(s(*)) plus(binomIp(x) s(plus(p(x) y)) binom(p(x) p(s(plus(p(x) y))))) in each of them. The second one can be removed by applying the contextcreating C-equation [p(s(*)), *] - [*, x], stemming from the structure axioms of nat from right to left. W e obtain the C-term shown in Figure 4.9.

[p(*), x]

[*, y]

[p(*), x]

[*, y]

W e are left with the context s(*). Since one non-induction variable occurs in the hypothesis we have two possible sinks (marked by ?) for unwanted contexts. Moving binom ] [plus(*~ the context s(*) to the root seems to be impossible, since we would need a C - e q u a t i o n r e p r e s e n t i n g an [p(*), x] [*, plus] [p(*), x] 4~ equation like

/.,, /',,

[p(*), x]

[*, Y]

[p(*), x]

[7 y]

~' u,v:nat blnom(u s(v) ) --f(...blnom(u v)...).

On the other hand we may move this context to the leaf marked with a plus(binom(p(x) s(plus(p(x) y)) binom(p(x) plus(p(x) y))) non-induction variable y. Hence we search for a suitable context-moving equation. Assume, there is no appropriate C-equation in our database. Then, one solution is to generate an appropriate equation and prove it as a subgoat by induction. But how can we formulate such an equation? Comparing the scheme of the goal and the actual C-term we can formulate a scheme of the required C-equation as shown in Figure 4.10. Thus, we have to "guess" an appropriate context instead of ? at the leaf marked with v.

Fig. 4.9: C-term of

158 A solution is to use the context s(*) of the root of the left C-term. This yields the subgoal

[s(*), plus]

[*, plus]

V u,v:nat s(plus(u v)) - plus(u s(v)) which is easily proved by induction. Using the context-moving C-equation corresponding to

[*, u]

[*, v]

[*, u]

[?, v]

Fig. 4.10: s(plus(u v) ) -- plus(u s(v) ) we obtain the C- scheme of a C-equation of s(plus(u v)) ---plus(u ...v...) term shown in Figure 4.11, which satisfies the scheme of a final C-term in two ways.

[plus(* *

~

[p(*), x]

Since the condition y = s(p(y)) of the hypothesis is satisfied in both cases, i.e. both s(y) = s(p(s(y))) and y - s ( p ( y ) ) hold, we may apply the induction hypothesis twice in the term represented by the C-term

binom]

,/-,,,

[*, plus]

,/-,,, [p(*), x]

Fig. 4.11: C-term of

[p(*), x]

Is(*), y]

['plus]

above and obtain plus(O o) as the left [p(*), x]

plus(birlom(p(x) plus(p(x) s(y))) binorn(p(x) plu$(p(x) y)))

[*, y]

side of the conclusion, which now can be evaluated to 0. Thus, left and right side of the conclusion agree and the formula is proven.

5. RELATED W O R K S

The best known work on proving theorems by induction is that of Boyer and Moore [Boyer and Moore, 1979]. Recently, their heuristics for the guidance of induction proofs have been reconstructed in terms of proof plans as a specification of tactics in the LCF-system by Bundy [Bundy, 1988]. Based on these proof plans we will consider some differences between the heuristics of Boyer and Moore and our approach. In order to modify the conclusion for the application of the hypothesis, Bundy uses a method called "Rippling Out ". This method uses wave rules to move, in our notion, undesired contexts into the root. These rules are a special form of our context-moving equations. There are no methods corresponding to the context-creating equations. A main point is, that our approach makes a distinction between the maintenance of unchanging parts of terms during the deduction and heuristic guidance of the induction proof. The former is automatically achieved by the choice of representation of terms while the latter one is accomplished by a set of tactics each of which operates on C-terms resp. C-equations. Thus our tactics operate on a more abstract level, since they do not care about invariant parts of terms and occurrences which denote these parts, They just handle creating and moving contexts, like moving wagons on a track system. 6. C O N C L U S I O N We proposed a representation of terms that allows us to mark parts of them to be unchangeable during deduction. Based on this representation we developed a representation of equations. We used

159

this representation to guide induction proofs. It turns out that with the help of this representation we are able to think of the application of equations in a quite operational way: The modification of the conclusion is reduced to the problem to create or move contexts into the appropriate positions of the correspondent C-tenn. The equations can be thought as rules, how to create or move contexts inside a C-tenn. This operational view of equality reasoning make this approach of interest to other fields of equational reasoning. Our technique is integrated in the INKA-system, an induction theorem prover under development at the University of Karlsruhe [Biundo et al. 1986; SFB, 1990]. As a rule, our approach reduces the possible deductions during the reduction of the conclusion drastically such that the system obtains the intended deduction without backtracking. For example, given the definitions of plus and times the INKA-system successively proves the theorems associativity and commutativity Of plus and times, distributivity of plus over times, n

n

I1

Et

n

plus(~ i E i ) - times(n s(n)) and E i 3 - times(,~ i Y, i)

i=l i=l

i=l

i=1 i=l

by a Symbolics 3640 all together in less than 45 seconds. 7. A C K N O W L E D G E M E N T S I am indebted to my colleagues B. Hummel, M. Protzen, W. Reif, and Chr. Walther for their support and helpful discussions during the preparation on this work. I also want to thank one (anonymous) referee of this paper for his helpful suggestions and clarifying comments.

8. REFERENCES Aubin, R. Mechanizing Structural Induction, Theoretical Computer Science, voL 9, 1979 Biundo, S., Hummel, B., Hutter, D. and Walther, C. The Karlsruhe Induction Theorem Proving System, Proceedings 8th CADE, Springer Lecture Notes Comp. Sc. vol. 230, 1986 Boyer, R.S. and Moore, J S. A computational Logic. Academic Press, 1979 Bundy, A. The Use of Explicit Plans to Guide Inductive Proofs, Proceedings 9th CADE, Springer Lecture Notes Comp. Sc. vol. 310, 1988 Goguen, J.A., Thatcher, J.W. and Wagner, E.G. An Initial Algebra Approach to the Specification, Correctness, and Implementation of Abstract Data Types. In Current Trends in Programming Methodology, R.T. Yeh (Ed.), Prentice Hall, 1978. Huet, G. and Oppen, D.C. Equations and Rewrite Rules: A survey. In: Formal Language Theory: Perspectives and Open Problems, R. Book (Ed.), Academic Press, 1980. Hutter, D. Complete Induction. In: Deduction systems in artificial intelligence, Bl~isius, K.H. and B/lrckert, H.J. (Ed.), Ellis Horwood, 1989 Stevens, A. A Rational Reconstruction of Boyer and Moore's technique for constructing induction formulas. Proceedings of the 8th ECAI, 1988 Sonderforschungsbereich (SFB) 314 Arbeits- und Ergebnisbericht fiir die Jahre 1988-1990, Universit/it Karlsmhe, 1990

APPENDIX:

FORMAL DEFINITIONS OF C-TERMS AND C-EQUATIONS

The reader is assumed to be familiar with the usual notions of first-order logic and equality reasoning [Goguen et al., 1978; Huet and Oppen, 1980].

160

W e a s s u m e we are g i v e n a n o n - e m p t y set S of sort symbols, which are n a m e s for the various domains under consideration. Given any n o n - e m p t y set M, we let M * denote the set of all finite sequences of elements of M, including the empty sequence ~., and use M + as an abbreviation for M*-{~.}. For an S-indexed family of sets M=(Ms)sES and any W=Sl ... Sk e S*, Mw denotes the set of all finite sequences ml,..mk e M* with mi e Msi for l g > np > s u m > pair > + > s > 0

The set {0, S n } is uniformly chosen as the >-cover set for nat (by the equations of Figure 1). The subterms shown in boxes are those used for the mandatory reduction step in each expansion. Notice how the theorem and the lemma use each other as inductive hypotheses. The lemma (rule 2) is used in the proof of both the theorem as well as the lemma in the first two simplification steps. The theorem (via rule 5) is used in both in the last simplification step. []

5

Relationship to K n u t h - B e n d i x C o m p l e t i o n

In this section, we relate the inductive completion procedure of the previous section to an inductive proof procedure based on Knuth-Bendix completion [10, 19, 24]. The correctness of the latter then follows immediately.

172

Ei

Rule

1.

Expand

Expand Simplify/ Delete Expand Simplify/ Delete

=g(x)

2. f(Sx) + f ( x ) = sum(g(x)) <S0, f(0)) = g(0) = g(Sn)

Simplify/ Delete

Hi+l, simplifications

so + f(o) = sum(g(O)) f ( S n ) + f(n) + f ( S n ) = sum(g(Sn)) 3. <sum(g(n) ), f ( S n ) ) = r~(g(n)) 4.sum(g(n) ~ + f ( S n ) = sum(np(g(n))) <sum((SO, 0)), f(SO)) = np(g(O)) (sum(np(g(n))), f ( S S n ) ) = np(g(Sn)) sum((SO, 0>) + f ( S n ) = sum(up(g(n))) sum(np(g(n))) + f ( S S n ) = sum(np(g(Sn))) 5. (sum(np(g(n))),sum(g(n))> = up(up(g(n) )) sum(np(g(n) ) ) + sum(g(n) ) = sum(np(np(g(n) ) ) )

up(up(<So, 0>)) = <sum(up(g(0))), sum(g(0))> up(np(np(g(n)))) = (sum(np(g(Sn))), sum(g(Sn)))

sum(np(g(n))) + sum(g(n)) = sum(np(np(g(n))))

using using using using

R; deleted R R; deleted R and 2

using using using using

R; deleted R and 2 R; deleted R and 2

using R; deleted using R and 5; deleted using R and 5; deleted

Figure 3: Proof of the specification of g

5.1

Cover sets

The inference rule Expand places an important constraint on the choice of cover sets, viz., for each case eai = e'ai, ea~ must be reducible by R. The completion method of inductive proofs attacks this problem by first trying to satisfy the requirement of reducible left hand sides. The set of cases is obtained by choosing ~ such that ea~ is the most general instance of e rewritable by a rule in R at some position. The cases generated in this way are then examined for the cover set property. L e m m a 22 Let e be a term, a a nonvariabIe position in e, and R : l --~ r a rewrite rule. The most general instance of e rewritable by R at a is e~ where a = mgu(e/a, 1) is the most general unifier substitution. This property is often exhibited as a narrowing relation e ~-zR.... ec~[a+-rcr] (Cf. [9, 17,

27, 31]). D e f i n i t i o n 23 (cover set of n a r r o w i n g s ) Let e be a term, R a rewrite system. A set of narrowings {e "-*n,~,,~, dl) is a >-cover set of narrowings if {czi}i is a >-cover set of substitutions for e. Just as we have used the rewrite relation --*+ as the well-founded order for induction, we can also use it as the well-founded order to show cover sets. A necessary and sumcient condition for the existence of --++-cover set of narrowings is inductive reducibility [5, 19].

173

D e f i n i t i o n 24 ( i n d u c t i v e r e d u c i b i l i t y ) A term e is inductively reducible by R (also called ground reducible and quasi-reducible) if every ground instance of e is reducible by

R. Methods for testing inductive reducibility when R is left-linear are given in [19]. Methods for the general case, which are however efficient only for the left-linear case may be found in [22]. More efficient tests are possible when a set of constructors is available [15, 19]. P r o p o s i t i o n 25 Let R be a terminating rewrite system, then e has a --*+ cover set of

narrowings if and only if e is inductively reducible by R. It is easily seen that the set of all narrowings of e is a cover set if e is inductively reducible. O p t i m i z a t i o n s Even though the set of all narrowings gives a cover set, it is often an over-kill. For instance, if e has an inductively reducible subterm e/a then the set of narrowings inside the subterm is adequate for a cover set. The optimizations presented in [10, 24] are based on such ideas. The methods for testing inductive reducibility [19, 22] can be adapted to finding an adequate cover set of narrowings. See [4] for recent results. L i m i t a t i o n s of i n d u c t i v e r e d u c i b i l i t y m e t h o d Even though Proposition 25 shows that inductive reducibility is a necessary condition for the existence of --~+ cover sets, it is not necessary for the existence of arbitrary cover sets of narrowings. For instance, as shown in Example 5, N2 = {0, s(0), x + y} is a ~2-cover set for nat. But, it is not a --*+-cover set. (E.g., s(s(O)) ~-2 s(O) + s(0), but it is not reducible). Such a cover set is, however, useful for proving properties of the following definition:

xxO

~

x s(O) x x (y + z)

5.2

0 x (x × y) +

x z)

C r i t i c a l p a i r s as l e m m a s

The inductive completion procedure I, with the use of cover sets of narrowings for generating cases, is very close to the Knuth-Bendix completion procedure [3, 6, 16, 23]. If e ~ n .... b is a narrowing, then the equational proof e~c~ ~-- ec~ --. b is a critical peak proof and the equation elcr = b is a critical pair. Thus the inference rule Expand is essentially constructing critical pairs. However, the set of critical pairs generated by Knuth-Bendix completion is a superset of those needed for a cover set. It is sometimes found that the additional critical pairs have a useful role as lemmas. For instance, the crucial lamina involved in example 21 can be constructed from the critical peak proof:

sum(g(x)) ~ p sum((f(Sx), f(x))) ~ R f ( S x ) + f(x) To relate the Knuth-Bendix completion procedure with the inductive completion procedure, we formulate a procedure I g as a specialization of I + (for inductive completion with lemmas). The inference rule Postulate is specialized to:

Postulate

(E (E, U EH) l, H)

E' C C P ( R U H, R U H)

174

where CP is the set of critical pairs. The relation between I K and the use of KnuthBendix completion for inductive proofs [5, 15, 19, 22] is the following. Every inductive Knuth-Bendix derivation (derivation generating only inductively reducible left hand sides of rules) can be transformed to an I K derivation using -~+ cover sets. Of the critical pairs generated by the Knuth-Bendix derivation, those belonging to the cover set are obtained by Expand and the others by Postulate. The fact that the Knuth-Bendix derivation is inductive guarantees that the critical pairs include --*+ cover sets. Thus, the following result immediately follows from Proposition 20. C o r o l l a r y 26 If there is an inductive Knuth-Bendix derivation starting from (E, R) and ending in (9, Rt), then R ~ind E. This generalizes the results of [1, 5, 10, 15, 19, 22, 24] in that it is independent of the ground confluence of the rewrite system R. Note that the purported confluence requirement is the main argument against the use of completion-based methods in [11, 32]. Not only does the inductive completion procedure I g simulate Knuth-Bendix completion, it is more powerful than the latter as it does not insist that all the critical pairs should have inductive proofs. This has been discussed elsewhere [1, 10, 24, 28].

6

Completeness

Inductive theories of equational systems are as hard as Peano arithmetic, and so, by GSdel's incompleteness theorem, are not semidecidable. There can be no procedure for inductive proofs which is complete in the real sense. The oft-cited completeness result for the completion-based procedures is the following. A completion derivation is said to be fair if the set of persisting equations E~ = Ui nj>i E~ is empty. P r o p o s i t i o n 27 If R is a ground confluent and terminating rewrite system, and there is a fair Knuth-Bendix derivation starting from (E, R), then R F-~d E if and only if the derivation is inductive. Note that there is no guarantee that the completion derivation is finite. So, this may be called completeness at w (or co-semi-completeness [22]). However, notice also the strong restriction that R must be ground confluent. Its only use is to refute false propositions, not to produce effective proofs. Given that we are mostly interested in proving propositions rather than refuting them, this requirement is of limited practicM significance. To talk about useful completeness properties, we need a notion of relative completeness which factors out the second-order aspects of inductive proofs and states that the firstorder aspects can be carried out by the proof procedure. The following definitions propose such a notion. Definition 28 (inductive p r o o f ) An inductive proof of R F-i~dE, using a stable wellfounded order ~-, consists of a finite cover set of cases for each equation in E, and an equational proof for each case equation of the form eai class(g).

The remainder formula is still valid for W-prem, except deg(R, xl) < deg(f~, xi) (where xi = tv(f~)) is not necessarily true.

Proposition ( 2 . 7 ) . For an ascending chain A S C = fl, ..., f, with class(f1) > 0 and a polynomial g, if W-prem(g; ASC) = 0, then prem(g; ASC) = O. Proof. The proposition is easy to prove using induction on r.

|

We introduce a new notation extremely useful for the rest of the paper:

P D ( A S C ) = {g t prem(g;ASC) = 0}. The following proposition insures the termination of the triangulation procedure of R i t t - W u ' s principle, when using W-prem.

Proposition

(2.8).

Let B = f l . . . . ,]~ be a w-basic set of polynomial set S with

0 < class(fl), and h be a polynomial. Suppose g = W - p r e m ( h ; f l , . . . ,f~) is not zero. Then the set S1 = S U {g} has a w-basic set lower than B.

Proof.

See [4].

|

3. A Modification of Ritt-Wu's Principle Now let us fix an extension E of the base field K .

We denote Zero(S) the c o m m o n

211

zeros o f p o l y n o m i a l s in S, i.e., t h e set { ( a l , ..., a n ) E E m I h ( a l , ..., am ) = 0, for all h e S } . Let G be a n o t h e r p o l y n o m i a l set. We denote Zero(S/G) to be Zero(S) - Zero(G). T h e following i m p r o v e m e n t o f R i t t - W u ' s Principle is used in our prover. Theorem ( 3 . 1 ) . ( R i t t - W u ' s Principle). Let S = { h l , . . . , h n } be a finite n o n e m p t y p o l y n o m i a l set. T h e r e is an a l g o r i t h m to c o n s t r u c t a w-asc chain A S C , called a characteristic set of S a n d d e n o t e d by C h a r - ~ e t ( S ) , such t h a t either (3.2). A S C consists o f a n o n - z e r o c o n s t a n t in K N Ideal(S); in this case Zero(S) is e m p t y , or (3.3). A S C = f l , . . . , f ~ with class(f1) > 0 a n d such t h a t f~ C Ideal(S) and W prem(hj; f l , .... f~) = 0 for all' i = 1 . . . . , r a n d j = 1 , . . . , n ; in this case we have: (3.3.1)

Zero(S) = Zero(ASC/{Ic(fl), ..., Ic(f,)}) U U~=lZero(S U {Ic(fi)}),

(3.3.2)

Zero(S) = Z e r o ( P D ( A S C ) ) U u[=lZero(S u {Ic(fi)}).

Proof. B y (2.5), we can c o n s t r u c t a w-basic set B t of S t = S. If B t consists o f only one n o n z e r o c o n s t a n t , t h e n we have (3.2). Otherwise, we can e x p a n d $1 to $2 b y a d d i n g n o n z e r o W-prem(g; B1) for all elements g in S1. If $2 = $1, t h e n we have (3.3). Otherwise, we can c o n s t r u c t a w-basic set B2 o f $2. By (2.8), B1 > B2. I f B2 does n o t consist o f one n o n z e r o c o n s t a n t , then we can e x p a n d $2 to $3 using t h e same procedure. T h u s we h a v e a strictly increasing sequence of p o l y n o m i a l sets: $1 C $2 C . . . , with a strictly decreasing sequence of w-asc chains B1 > B 2 >

..- •

B y (2.3), this decreasing sequence can be only finite. T h u s , there is an integer k > 1 such t h a t either Bk consists o f a n o n z e r o c o n s t a n t or Sk = Sk+l; t h e n we have either (3.2) o1" (3.3), respectively. F o r m u l a s (3.3.1) and (3.3.2) are direct consequences of the R e m a i n d e r F o r m u l a (2.1.1) a n d (2.7). | Example

( 3 . 4 ) . Let S = {hl, ..., h7} in E x a m p l e (6.2) (the Morley configuration).

S1 = S; B1 = h2, h3, h5, h7. $2 = S U { f l , f4, f6}; B2 = / 1 , h2, h3, f4, hs, f6, h7, where

f l -- W-prem(hl; B1) = prem(hl, h2), f4 = W-prem(h4; B1) = prem(h4, hs), f6 = W-prem(h6; B1) = prem(h6, h7). T h e w-asc c h a i n A S C = B2 is a characteristic set o f S. T h e n u m b e r s of terms of the p o l y n o m i a l s in B2 (abb. the ntps) are 14, 4, 2, 28, 4, 59, 13. It took a b o u t 15 sec to

212

complete the computation on a Symbolics 3600. If we use Wu-asc chain, it took about 30 minutes to reach the 5th iteration Bs. The ntps of B5 are 14, 14, 2, 301, 23, 1977, 47. The program stuck in a computation (for more than 2 hours) of a prern(p, q), where the numbers of terms in p and q are 2388 and 1977.

Remark. Algorithm (3.1) is a " b o t t o m - u p " triangular procedure. It has been observed that "top-down" triangular procedures ([1], [12], [10]) are much faster. However, topdown versions are not complete, i.e., triangular forms obtained by such kinds of procedures generally do not satisfy (3.3). It is a good strategy to incorporate a top-down triangular procedure into Algorithm (3.1). This can reduce the number of iterations in (3.1) and polynomial sizes in many cases. It was first done in [12]. For example, we can produce a triangular form TRi for Si by a top down procedure, then set Si to be Si U TRi and take a w-basic set B~ of Si, and so on. However, this approach should be combined with w-asc chain and W - p r e m , otherwise the size control generally cannot be insured. Example (3.4) is such an example, for which this approach does not help much without using W - p r e m .

4. A Modification of Ritt-Wu's Decomposition Algorithm T h e o r e m ( 4 . 1 ) . Ritt-Wu's Zero Decomposition Algorithm (the Refined Form). Let S and G be two non-empty polynomial sets. There is an algorithm either to detect the emptiness of Zero(S/G) or to decompose Zero(S/G) in the following form: (4.1.1)

Zero(S/G)=

U

Zero(ASCi/I~uG)

l 0 and C is a base type.

3. ()~zi : A i . . . A z n : A n . N ) : ( I I z i : A i . . . I I z n abstraction, and B is a base type.

: A n . B ) where n > 0, N is not an

Note t h a t proving an assertion of the form given by (2) or (3), respectively, in valid context r , is equivalent to proving F, zi :A1, . . . , zn : An F IIzi : B i • .. IIzm : B m . C : Type or r , z i : Ai, . . . , z,, :An ~- N : B, respectively, in valid context r , zi : A1, . . . , Zn : A n . In the first version of the translation given in the next section, we will assume t h a t assertions have the latter form, i.e., t h a t there are no leading abstractions in the t e r m on the left in a judgment.

4

Translating

LF

Assertions

to hh ~ Formulas

In this section we present the translation of LF assertions to formulas in h h '~. This translation will require an encoding of LF terms as simply t y p e d A-terms. We begin by presenting this encoding. We then present the translation, which given an LF assertion, r ~- a where r is a valid context, translates 1~ to a set of hh '~ formulas and a to a formula to be proved from this set of formulas. We then illustrate how to extend the translation to obtain a formula whose proof (from no assumptions) verifies t h a t r is a valid context before proving t h a t c~ holds within the context F. Since b o t h LF and the meta-language have types and terms, to avoid confusion we will refer to types and t e r m s of the meta-language as recta-types and m e t a - t e r m s . We only define the encoding of LF terms as simply typed A-terms for LF objects and flat

228

t y p e s / t y p e families since this is all that is required by the translation. We introduce two base types, t m and ty, at the meta-level for these two classes of LF terms. First, to encode object-level variables, we define the function (I) that maps LF types and kinds to meta-types containing only occurrences of t m and ty. O(IIx:A.P) ¢(Type) ¢(A)

:= := :=

(P(A) --~ O(P) tm

when A is a flat type

Using this function, an LF variable of kind or type P is mapped to a meta-variable of type (I)(P). These recta-types encode the "syntactic structure" of the corresponding LF dependent type or kind. Information about dependencies is lost in this mapping, but as we will see later, this information is retained in a different form in performing the general translation. We will assume a fixed mapping from LF variables to meta-variables of the corresponding type. For readability in our presentation, this mapping will be implicit. A variable x will represent both an LF variable with kind or type P and a meta~variable of the corresponding syntactic type O(P). It will always be clear from context which is meant. Note that for type or kind P and object N, ~ ( P ) = ~ ( ( [ N / x ] P ) ~ ) . We denote the encoding of term or flat type P as ((P)). The full encoding is defined below. ((Ax:A.M)) ((MN)) ((AM))

:= := :=

~x:C2(A).((M)) ((M)) ((N)) ((A)) ((M))

Note that the encoding maps abstraction in LF objects directly to abstraction at the meta-level, and that both application of objects to objects and application of type families to objects are mapped directly to application at the recta-level. The difference at the meta-level is that the former application will be a recta-term with target type t m while the latter application will be a meta~term with target type ty. It is easy to see that for object or type family P having, respectively, type or kind Q, ((P)) is a meta-term of recta-type (I)(Q). The following two properties also hold for this encoding. L e m m a 4.1 Let P be an LF object or flat type, and N an LF object. Then [((N))/x]((P)) -- (([Nix]P)). L e m m a 4.2 Let P and Q be two LF objects or fiat types. If P --8 Q, then ((P)) --8 ((Q))" We are now ready to define the translation. Two predicates will appear in the atomic hh ~ formulas resulting from the translation: hastype of type t m ---, ty -~ o and istype of type ty --~ o. We will name the signature containing these two predicates ~LF. We denote the translation of the context item or judgment ~ as ~ ] . The full translation is defined in Figure 3. It is a partial function since it is defined by cases and undefined when no case applies. It will in fact always be defined on contexts and judgments in provable LF assertions. In proving properties of the translation, we will only consider canonical judgments and context items. Note that in a canonical context item x : P , the variable

229 ~M : IIx :A.B]

::

vo(A: (lIx:4 D IIMx: "l)

~M : All

:=

hastype ((M)) ((A}

[B : IIx : A . K ]

:=

vo(A: (rrx:A]] D Bx:

[A:

Type]]

:---- istype ((A))

where A is a base type.

where A is a base type.

[IIx:A.B : Type]

:=

~A: Type] AVa(A)X ([[x:A]] D [B: Type]])

~FI-yp e kind]]

:=

Z

[[IIx :A.K kind]]

:=

[ A : Type]] AV.(A)X (~x:A] D [K kind])

Figure 3: Translation of LF Judgments to hh ~ Formulas x is not necessarily canonical since it may not be fully applied. Such judgments with non-canonical terms on the left are handled by the first and third rules in Figure 3. This translation maps occurrences of If-abstraction in LF types and kinds directly to instances of universal quantification and implication in hh ~ formulas. In all of the clauses in the definition that contain a pattern with a If-type or kind, the variable bound by II is mapped to a variable at the metaAevet bound by universal quantification. Then, in the resulting implication, the left hand side asserts the fact that the bound variable has a certain type, while the right hand side contains the translation of the body of the type or kind which may contain occurrences of this bound variable. The base cases occur when there is no leading H in the type or kind, resulting in atomic formulas for the hastype and istype predicates, or simply T in the case when the judgment is Type kind. To illustrate this translation, we consider an example from an LF signature specifying natural deduction for first-order logic. The following declaration introduces the constant for universal quantification and gives it a type: V* : (i ~ form) ~ form. (We write V* for universal quantification at the object level to distinguish it from universal quantification in hh~.) To make all bound variables explicit, we expand the above type to its unabbreviated form: IIA:(IIy:i.form).form. Note that by applying • to the above type, we get (tin --~ tin) --+ t m as the type of V* at the meta-level. The translation of this signature item is as follows.

Iv*

: IIA: (IIy:i.form).form] --

Vtrn__trnA (VtrnY ((hastype y i) D (hastype (Ay) form)) D (hastype (V'A) form)) This formula provides the following description of the information contained in the above dependent type: for any A, if for arbitrary y of type i, Ay is a formula, then V*A is a formula. We will show in the next section that if F is a valid canonical context and ~ a canonical judgment where the term on the left in a is not an abstraction, then F F ~ is provable in

230 LF iff I4~ is provable from the set of formulas IF]. (Here IF] denotes the set of formulas obtained by translating separately each item in F.) We now illustrate how to extend the translation to obtain a formula whose proof verifies that r is a valid context before proving that 4 holds within the context F. Proving that a context xl : P 1 , - - - , x ~ : P,, is valid in LF corresponds in hh '~ to proving, for i = 1 , . . . , n, either ~Pi : Type]] or [Pi kind~ from Ix1 : P 1 , . . . , xi-1 : Pi-t~. The translation in Figure 4, for an arbitrary assertion F t- 4, maps the pair (F; a ) to a single formula containing subformulas whose proofs will in fact insure that each context item is valid with respect to the context items before it. We also remove the restriction that the term on the left in 4 cannot be an abstraction. Variables bound by abstraction at the top level are treated as additional context items. The translation of such a pair is denoted IF; 4]]*. The first two clauses of this translation map each context item to a

I x : A , F;4]*

:=

[A: Vype] ^ Vo(A)*

~x:K, r; a~*

:=

II£ kind] AV¢(g)X (~x:K]] D I r ; 4 ~ * )

[[O;,kx:A.M : II=:A.B~*

:=

[ A : Type] AV¢(A)X (~x:A~ D I 0 ; M : B ] ' )

~0; Ax : A . B : Hx : / . K ~ *

:=

IA: Type] AV¢(A)x (~x:A]] D ~0;B : K]]*)

:=

I4]

[[O;Q*

D Ir;4 *)

where the left term in 4 is not an abstraction.

Figure 4: Translation of LF Assertions conjunctive formula where the first conjunct verifies that the type or kind is valid (using the previous translation), and the second conjunct is a universally quantified implication where the left hand side asserts the fact that the context item has the corresponding type (again using the previous translation), and the right side contains the translation of the pair consisting of the remaining context items and judgment. The third and fourth clauses handle the cases when the term on the left in a judgment is an abstraction. The last clause in the translation is for the base case: when the context is empty and no further abstractions remain at the head of the judgment. Then the previously defined translation is used. T h u s , a proof of a formula obtained from translating an arbitrary assertion F b 4 with respect to an initially empty set of assumptions verifies that each context item in F, and each variable bound by A-abstraction in 4 is valid with respect to those items that appear before it, and then proves that the judgment holds within the entire context. The correctness of this translation will follow easily from the correctness of the previous translation.

5

Correctness

of Translation

We consider the correctness of the translation with respect to a slightly modified LF. Our modified system replaces the (ABS-FAM)and (ABS-OBJ) rules with the following two

231

rules.

F,x:A1- B : K (ABS-FAM') F 1- A x : A . B : I I x : A . K

F , x : A 1- M : B r 1- , ~ x : A . M : I I x : A . B (ABS-OBJ')

These rules are the same as presented earlier except t h a t the left premise is omitted. We call this s y s t e m LFq It can be shown that for valid context F, an LF assertion F 1- c~ is provable in LF ~if and only if it is provable in LF, provided t h a t there is no leading abstraction in the t e r m on the left in c~. This result relies on the fact t h a t in a proof in the modified system, if an application of (ABS-FAMt) whose conclusion is F F .~x : A . B : IIx : A . K or an application of (ABS-OBJ ~) whose conclusion is F 1- ) ~ x : A . M : I I x : A . B occurs above an application of (APP-FAM) or (APP-OBJ), it is always the case that F 1- A : Type is provable, and thus the left premise is redundant. T h e proof of this fact relies on a transitivity result for LF t similar to the one stated in [HHP87]. To prove the correctness of the translation, we prove a stronger s t a t e m e n t from which the correctness of ~ ]] and [ ~* will follow as corollaries. This stronger s t a t e m e n t will talk a b o u t the provability of LF assertions of the form F 1- a in LF ~ even in the case when F is not a valid context. We also relax the requirement on a. T h e left t e r m in a can be any object, type, type family, or kind, including one with a leading abstraction. To handle these cases in proving the correctness of [ ]], we must add the following two rules to the translation.

[$x:A.M

: IIx:A.B~

~)~x : A . B : Hx : A . K ~ We m u s t then also add the restriction that the first and third rules in Figure 3 are only applicable when M and B, respectively, are not abstractions. One final l e m m a is needed to prove the correctness of the translation. This l e m m a applies to the translation extended with the above two rules. In Section 4, we stated that substitution c o m m u t e s with the encoding operation ( L e m m a 4.1). We extend this result to the translation operation on judgments which translate to provable hh ~ formulas. In particular, the l e m m a below states that substitution and fl-normalization commute with the translation operation on provable h h " sequents. We will write 0) be a canonical context (whose variables are distinct). Let N 1 , . . . , N,~,N be canonical objects with respect to F, and let E be the signature Y]LF U (I)(r). Then E; IF] 1-I ~ g : ( [ N 1 / x l , . . . , N n / x n ] A ) # ~ if and only if Z; IF] t-i [((Yl)) / x l , . . . , ((Yn)) /x,~, ((g)) /x][x : All. T h e o r e m 5.2 (Correctness of ~lYanslation) Let F be an arbitrary context (such t h a t the variables in F are distinct), and let c~ be an arbitrary canonical judgment with respect to F. Let E be ELF t3 ~(F). Then F 1- a is provable in LF' if and only if E; IF] 1-1 ~(~ holds.

232

P r o o f S k e t c h : The proof of this theorem is constructive, i.e., it provides a m e t h o d for constructing an h h '° proof from an LF f proof, and vice versa. The forward direction is proved by induction on the height of an LF ~ proof of the assertion F ~- a. For the PI and ABS rules, we can apply the induction hypothesis directly to the premises to obtain provable sequents to which we apply D-R, V-R, and A-R for the PI rules, and just D-R and V-R for the ABS rules to obtain the desired result. For the APP rules, we know the context item in the application of these rules corresponds to a formula in IF]. To this formula, we can apply V-L followed by D-L n times in a backward direction. Each of the left premises of D-L can be shown to be provable since they are the result of applying the induction hypothesis followed by L e m m a 5.1 to each of the latter n premises of the APP rule. Using L e m m a s 4.1 and 4.2, the formula introduced on the left in the right premise of the topmost application of D-L can be shown to be ~-convertible to the formula in the succedent (the translation of the j u d g m e n t in the conclusion of the APP rule). Thus this premise is an axiom. The proof of the backward direction is by induction on the structure of the t e r m on the left in a, and is similar to the proof of the forward direction. The regularity of the proofs in h h '° described in T h e o r e m 2.2 is required here. For example, the proof of the case when the t e r m on the left is an application uses the backchain search operation. • C o r o l l a r y 5.3 (Correctness of ~ ~) Let r be a valid context and a a canonical j u d g m e n t such that the t e r m on the left is not an abstraction. Let E be ~LF U (I)(r). T h e n F ~- a is provable in LF' if and only if E; [r~ ~-I [c~] holds. C o r o l l a r y 5.4 (Correctness of [ ]]*) Let F be a canonical context (such that the variables in F are distinct), and a a canonical judgment. Then F is a valid context and F k- a is provable in LF' if and only if ELF; 0 [-x [IF; a~* holds.

6

Examples

In this section, we provide some further examples to illustrate the correspondence between LF signature items and judgments and the h h ~° formulas that they map to. Note t h a t in general, formulas obtained by translating signature items have the form on the left below, but can be rewritten to have the form on the right: V T I X I . . . V T , X , (G1 ^ . . - ^

G , D D)

where n > 0, r l , . . . , v n are types, X 1 , . . . , X , ~ are variables, G 1 , . . . , G n , D are h h ~° formulas. (Here we assume that for i = 1 , . . . , n , X i + l , . . . , X n do not appear free in Gi). For readability, we will write h h ~° formulas in the examples in this section simply as G1 A ... A G , D D (or just D when n = 0), and assume implicit universal quantification over all free variables written as capital letters. T y p e subscripts for these universal quantifiers can always be inferred from context. We begin by demonstrating the translation of signature items specifying natural deduction inference rules for tile A*, V*, and D* object-level connectives. The fragment of an LF signature specifying natural deduction for the first-order logic t h a t we are concerned

233

with is the following. i :Type b r m : Type true : form ~ Type A* : form -+ form ---* form D* : form --+ form ---*form V* : (i ~ form) --~ form A*-I: IIA :form.IIB :form.true(A) ---* true(B) ~ true( A A ' B ) D*-I : IIA :form.IIB :form.( true(A) --+ true(B)) -+ true(A D ' B ) V*-I : IIA:i--~ form.(IIy:i.true(Ay))---* true(V'A) The signature item true is a function that maps formulas to types. LF objects of type true(A) represent proofs of formula A. First, consider the/',*-introduction rule specified by A*-I and its type. Its translation is the following formula.

(hastype A form) A (haslype B form) A (hastype P (true A)) A

(hastype Q (true B))

(hastype (^*-I A B P Q) (true A n'B))

This formula simply reads that if A and B have type form, P is a proof of A, and Q is a proof of B, then the term (A*-I A B P Q) is a proof of the conjunction A A*B. The correspondence between this formula and the LF signature item is straightforward. We next consider a slightly more complex example; the translation of the V*-I rule results in the following formula.

vy((hastype y i)

(h stype Ay fo m)) ^

Vy((hastype y i) D (hastype P y (true Ay))) D (hastype (V*-I A P ) (true V'A)) This clause provides the following description of the information contained in the dependent type: if for arbitrary y of type i, A y is a formula and P y is a proof of Ay, then the term (V*-I A P ) is a proof of V*A. Note that A and P at the metaAevel are both functions having syntactic type t m --~ tin. Here, A maps first-order terms to formulas just as it does at the object level, while P maps first-order terms to proofs. As a final inference rule example, consider the declaration for D*-I, which translates to the following formula. (hastype A form) A (hastype B form) A Vq((hastype q (true A)) D (hastype Pq (true B))) D (hastype (D*-I A B P) (true A D ' B ) ) This formula reads: if A and B are formulas and P is a function which maps an arbitrary proof q of A to the proof Pq of B, then the term (D*-I A B P ) is a proof of A D*B. Note that P in this formula is a function which maps proofs to proofs. An example of a canonical judgment that is provable in the LF signature for naturM deduction is

,kA :forrn. D*-I( A )( A )( ,~x : true( A ).x ) : HA :form.true( A D'A). Using the extended translation of Figure 4, we obtain the following formula:

(istype form) A VA((hastype A form) D (hastype (D*-I A A ~x.x) (true A D'A)))

234

which is provable from the set of formulas obtained by translating the LF signature specifying natural deduction for first-order logic. An LF signature specifying the reductions needed for proof normalization in natural deduction is given in [Pfe89]. As a final example, we illustrate the translation of the reduction rule for the case when an application of the introduction rule for D* is followed by the elimination rule for the same connective. The following signature items define the D*-E rule, the reduce constant used to relate two proofs of the same formula, and the reduction rule for D*. D*-E: HA:form.HB :form.true(A) --* true(A D ' B ) ---* true(B) reduce: HA :form.true(A) --* true(A) ~ Type D* -red : HA :form.II B :form.IIP : (true(A) --* true( B ) ).n O :true(A). reduce(B)(D*-E m B (D*-I d B P) Q)(PQ) The signature item for D*-red translates to the following formula.

(hastype A form) A (hastype B form) A Vq ((hastype q (true A)) D (hastype (Pq) (true B))) A (hastype Q (true A)) D (hastype (D*-red A B P Q) (reduce B (D*-E A B (D*-I A B P) Q) (PQ))) This formula reads: if A and B are formulas and P is a function which maps an arbitrary proof q of A to the proof Pq of B, and Q is a proof of A, then (D*-red A B P Q) is a meta~proof of the fact that the natural deduction proof (D*-E A B (D*-I A B P ) Q) of B reduces to the proof PQ.

7

Conclusion

We have not yet considered the possibility of translating hh '° formulas into LF. This translation is particularly simple. Let ~ be a signature for hh '~ and let 7~ be a set of E-formulas. For each primitive type r other than o in S, the corresponding LF judgment is r : Type. For each non-predicate constant c : r E E, the corresponding LF judgment is c : v. For each predicate constant p : rl ~ --- ---* rn --+ o E E, the corresponding LF judgment is p : 1"1 --* ... ~ rn ~ Type. Finally, let D E ~ and let k be a new constant not used in the translation to this point. Then the corresponding LF judgment is k : D ~ where D ~ is essentially D where B1 D B2 is written as IIx :B1.B~ and VTx B is written as IIx : r.B. In the first author's dissertation [Fe189] an encoding of LF into just hh 2 was presented. Order 2 is all that is necessary if object-level applications are represented by metaAevel constants. The proofs of the correctness of that encoding are very similar to those presented here. Notice that the translation presented here works via recursion over the structure of types. Thus, this kind of translation will not work for the polymorphic A-calculus or the Calculus of Constructions since they both contain quantification over types. Other techniques can be used, however, to encode provability of such h-calculi into hh ~. These involve coding the provability relation of those calculi directly into the metaAanguage [FM89].

235

A c k n o w l e d g e m e n t s The authors would like to thank Robert Harper and Frank Pfenning for valuable discussions on the subject of this paper. We are also grateful to the reviewers of an earlier draft of this paper for their comments and corrections. Both authors have been supported in part by grants ONR N00014-88-K-0633, NSF CCR-8705596, and DARPA N00014-85-K-0018. The first author is currently supported in part by ESPRIT Basic Research Action 3245.

References [CH88]

Thierry Coquand and G~rard Huet. The calculus of constructions. Information and Computation, 76(2/3):95-120, February/March 1988.

[Chu40]

Alonzo Church. A formulation of the simple theory of types. Journal of Symbolic Logic, 5:56-68, 1940.

[Fe189]

Amy Felty. Specifying and Implementing Theorem Provers in a Higher-Order Logic Programming Language. PhD thesis, University of Pennsylvania, August 1989.

[FM89]

Amy Felty and Dale Miller. A meta language for type checking and inference: an extended abstract. 1989. Presented at the 1989 Workshop on Programming Logic, BMstad, Sweden.

[HHP87] Robert Harper, Furio Honsell, and Gordon Plotkin. A framework for defining logics. In Second Annual Symposium on Logic in Computer Science, pages 194204, Ithaca, NY, June 1987.

[HHP89] Robert

Harper, Furio Honsell, and Gordon Plotkin. A framework for defining logics. 1989. Technical Report CMU-CS-89-173, to appear.

[HS86]

J. Roger Hindley and Jonathan P. Seldin. Introduction to Combinatory Logic and Lambda Calculus. Cambridge University Press, 1986.

[MNPS]

Dale Miller, Gopalan Nadathur, Frank Pfenning, and Andre Scedrov. Uniform proofs as a foundation for logic programming. To appear in the Annals of Pure and Applied Logic.

[NM88]

Gopalan Nadathur and Dale Miller. An overview of AProlog. In K. Bowen and R. Kowalski, editors, Fifth International Conference and Symposium on Logic Programming, MIT Press, 1988.

[Pau89]

Lawrence C. Paulson. The foundation of a generic theorem prover. Journal of Automated Reasoning, 5(3):363-397, September 1989.

[Pfe89]

Frank Pfenning. Elf: a language for logic definition and verified metaprogramming. In Fourth Annual Symposium on Logic in Computer Science, pages 313321, Monterey, CA, June 1989.

[Pra71]

Dag Prawitz. Ideas and results in proof theory. In J.E. Fenstad, editor, Proceedings of the Second Scandinavian Logic Symposium, pages 235-307, NorthHolland, Amsterdam, 1971.

INVESTIGATIONS INTO PROOF-SEARCH IN A SYSTEM OF FIRST-ORDER DEPENDENT FUNCTION TYPES David Pym University of Edinburgh Scotland, U.K. [email protected]

Lincoln Wallen University of Oxford England, U.K. [email protected]

Abstract

We present a series of proof systems for )dI-calculus: a theory of first-order dependent function types. The systems are complete for the judgement of interest but differ substantially as bases for algorithmic proof-search. Each calculus in the series induces a search space that is properly contained within that of its predecessor. The MI-calculus is a candidate general logic in that it provides a metalanguage suitable for the encoding of logical systems and mathematics. Proof procedures formulated for the metalanguage extend to suitably encoded object logics, thus removing the need to develop procedures for each logic independently. This work is also an exploration of a systematic approach to the design of proof procedures, It is our contention that the task of designing a computationally efficient proof procedure for a given logic can be approached by formulating a series of calculi that possess specific prooftheoretic properties. These properties indicate that standard computational techniques such as unification are applicable, sometimes in novel ways. The study below is an application of this design method to an intuitionistic type theory. Our methods exploit certain forms of subformula property and reduction ordering - - a notion introduced by Bibel for classical logic, and extended by Wallen to various non-classical logics - - to obtain a search calculus for which we are able to define notions of compatibility and intrinsic well-typing between a derivation ¢ and a substitution er calculated by unification which closes ¢ (a derivation is closed when all of its leaves are axioms). Compatibility is an acyclicity test, a generalization of the occurs-check which, subject to intrinsic well-typing, determines whether the derivation ¢ and substitution a together constitute a proof. Our work yields the (operational) foundations for a study of logic programming in this general setting. This potential is not explored here. 1

Introduction

We present a series of proof systems for AII-calculus: a theory of first-order dependent function types [vDa80,MR86,HHP87]. The systems are complete for the judgement of interest but differ substantially as bases for algorithmic proof-search. Each calculus in the series induces a search space that is properly contained within that of its predecessor. Our interest in proof-search in All-calculus stems from two sources. Firstly, the theory is a candidate general logic in that it provides a metatanguage suitable for the encoding of logical systems [AHM87] and mathematics [vDa80]. Proof procedures formulated for the metalanguage extend to suitably encoded object logics, thus removing the need to develop procedures for each logic independently.1 The second reason for our interest arises out from a desire (expressed in [Wa189]) for a systematic approach to the design of proof procedures. It is our contention that the task of designing a cornputationatly efficient proof procedure for a given logic can be approached by formulating a series of calculi that possess specific proof-theoretic properties. These properties are the indicators that standard computational techniques such as unification are applicable, sometimes in novel ways. The study below is an application of this design method to an intuitionistic type theory. 1This should be compared with the use of proof procedures for classical logic to effect proof-search within a modal logic, say, by means of an encoding of the latter in the former; see [Oh188] for example.

237

The first system of the series, called N, is a natural deduction formulation of ,\if-calculus. 2 The main judgement of N is the typing assertion: F ~- M:A, meaning that the term M has type A, given the type assignments for free variables and constants recorded in F. This relation is decidable [ililP87]. A typical rule of N is the elimination rule for the dependent function type constructor (if): 3 F~- N : A IlE FF M:(IIx:A.B) F F MN: B[N/z] where B[N/z] denotes capture-avoiding substitution of N for free occurrences of x in B. The second system, called L, is sound and complete (relative to N) for the semi-decidable relation of inhabitation: F ~ A, with the meaning ( 3 M ) ( £ F M:A). The judgements of L assert the existence of proofs of the judgements of N , as in the case of first-order logic [Pra65]. L is the starting point for our investigation into proof-search. A typical rule of L is the H-left rule, the counterpart of the If-elimination rule of N:

IIl

r,z:B[N/x] ~ C F=~C

(a) w : (IIx:A.B) E F

(b) z ¢ Dom(r) (c) F F N:A.

L is almost a logicistic system, in the sense of Gentzen, meaning that there is only one localized appeal to an external notion, that notion being an appeal to the system N in side condition (c) of the rule above. . Indeed, with respect to the If-type structure of terms in the language, L has a subformula property [Gen34]. As a consequence, if the inference rules are used as reduction operators from conclusion to premisses then L induces a search space of derivations of a given sequent. 4 Notice that if the Ill rule is used as a reduction, the choice of term N to use in the premiss is unconstrained by the conclusion of the rule. The subformula property of the H-types does not extend to a full subterm property (cf. the quantifier rules of the predicate calculus). The axiom sequent (or closure condition for the reduction system) is:

F, z:A, F~ ~ A i.e., the conclusion occurs as the type of a declaration in the context. The third and fourth systems are also systems of sequents. The system U is formed from L by removing the appeal to N in the H1 rule. The Ill rule of U is thus: Hl

r,z:B[a/x] ~ C F =~ C

(a) w : (Hx:A.B) e F

(b) z ¢ Dom(V). This rule introduces a free, or universal variable into the proof, denoted here by a. Universal variables are distinct from the usual eigenvariables that are bound by the derivation (and explicitly declared in contexts). The axiom sequent of U is used to compensate for the omission of term information in the Ill rule as follows: F,z:B,F' ~ A

(a) (3a) Ba - Aa

where cr is an instantiation of the universal variables of the sequent, and Ba denotes the term resulting from the application of a (as a substitution) to B. The calculation of instantiations 2This system is also known as the type system of the (Edinburgh) Logical Framework or LF [HHP87]. 3Readers that are unfamiliar with dependent types should read the construction IIx:A.B as a (typed) universal quantifier such as Yx:A.B; x is the bound variable, ranging over the type A, which may occur free in the term B. 4Kteene [Kle68] explains this in the case of the predicate calculus. Sequent systems used in this way are systems of block tableaux [Smu68].

238

can be performed by a unification algorithm for the language. A suitable algorithm has been developed by the first author [Pym90] based on a standard algorithm for simple type theory

[Hu75]. A U-proof is a pair 6rR. Without loss of generality we may choose a variant of L = R whose variables miss W and restrict the domain of 6 t to these variables, so that D6 t A W -- 0 holds. Now, ~ is minimal on the variables of L, since L is not itself a variable, and so for each x e Y a r s ( L ) , 6'(x) is a proper s u b t e r m of T / u . Finally, we construct 6 by replacing 6'(y) by 6'(y) $ for each y occurring in R b u t not in L. The above arguments still apply to 6, so it remains to see that T[u *- 6L] > T[u *--- 6R]. If not, then (since T[u *--- 6L] =_ T[u ~ 6'L]) we would have the infinite chain

T[u ~ 6'L] > T[u ~-- 6'R] > T[u *- 6R] > T[u +- 6'L] > . . . contradicting the fact that > is noetherian.

[]

The next definition is the main technical tool in all of our completeness proofs. Note that since each term T has finitely many proper > reducts, Konig's Lemma yields an u p p e r b o u n d on the length of proper > sequences out of T. D e f i n i t i o n 3.3 Let C be closed by virtue of >. The degree of a term T is the length of the longest sequence of proper :> steps from T to T J,. For a substitution 0, the 0-degree of T is the degree of O(T). The 0-degree of a pair (A, B) is 0 if 0 unifies CA, B), otherwise it is the sum of the 0-degrees of A and of B. The 0-degree of a system is the sum of the 0-degrees of the pair-occurrences in the system. Although the degree of a term is only defined relative to a fixed C and directing relation >, this will cause no ambiguity below. Note t h a t if the 0-degree of a system is 0, then 0 unifies the system (by the uniqueness of minimal forms). The next lemma is the heart of the argument that Narrowing is complete for closed C.

268

L e m m a 3.4 Let C be closed. If # is a minimal C-unifier of S and the O-degree of $ is positive, then there is a C-unifier 01 of $ and a Paramodulation step $ >v $1 such that

• 01 iS minimal and 01

O[Vars($)].

* (Ox-degree of S1) < (O-degree of $). P r o o f . Without loss of generality, DO C Vars($). Choose (A,B) from $ so that A has positive 0-degree (note that A cannot be a variable since 8 is minimal). By Lemma 3.2 there is a > reduction

OA[u +-- 6L] > OA[u ~ 6 R] in which $ is minimal and D6 n Vars(S) = ~. Take 01 to be 0 U 6. The first assertion is clearly satisfied. Since 01 unifies A / u and L, the following is a Paramodulation step:

S -~ $', (A, B) ==~v $', (A/u, L), =- Sx. The second assertion follows from the observations that 01 agrees with 8 on S t, 8x unifies (A/u, L>, and the 01-degree of A[u +- R] is less than the 01-degree of A. [] P r o p o s i t i o n 3.5 Let C be closed, and let 0 E Uc($). Then there is a sequence of transformations S ==~v g and a substitution 0 such that the O-degree of g is 0 and

,, % 0 [ V a t s ( s ) ] P r o o f . Without loss of generality, 0 is minimal. The proof is by induction on the 0-degree of S. If the degree is greater than 0, the previous lemma applies, yielding minimal 01 and St. By induction, we have S and 0 such that $1 ==~v S, the 0degree of S is 0, and 0 , c Ot [Vars(S)]. But since Vars(Sl) 2 Vars(S), S and/7 are as desired. [] Since a canonical rewrite system is a presentation of a closed set of equations, we can now show the unification completeness of Narrowing. C o r o l l a r y 3.6 Let C be closed and suppose 0 E Uc($). Then there is a Narrowing sequence yielding a [a] with a - on the function symbols together with the variables. Extend ~ to terms by comparing the size of terms, breaking ties by comparing head symbols, and if necessary, comparing immediate subterms from left to right. Let > be ( c ~ A >-. It is easy to check t h a t > is monotone and noetherian, and t h a t > has symmetric closure ~ c ~. In order to show confluence of > , it suffices to show local confluence. Suppose M > N and M > P. If the redexes of the derivation steps witnessing the > reductions are either disjoint or overlap below a variable address of the larger, the monotonicity of ~ ensures the existence of a common > r e d u c t Q. Otherwise, the facts t h a t C contains all of its critical equations and t h a t >- is total ensure t h a t eitherN>PorP>N. [] The key result is the Simulation L e m m a below, to the effect t h a t any critical equations added for the sake of the arguments in the previous section can be removed in favor of applications of Relaxed Paramodulation. It is not possible, in general, to compute critical pairs by Paramodulations - it is precisely here t h a t general E-unification parts company with the canonical case. The Simulation L e m m a is indebted to L e m m a 6.7 of [GS89], but we do a more delicate simulation which allows us to preserve at least some of the "unifiability" of the witness pair in question.

271

L e m m a 4.3 ( S i m u l a t i o n L e m m a ) Suppose $o ~ $1 using an equation from C(E), and let W be a coinfinite set of variables disjoint from those in the step So R ~ $1. Then there exists an idempotent a such that D a N W = 0 and $o ~ > $1, [0"] using equations from E. P r o o f . The proof is given in Section 5.

[]

L e m m a 4.4 Suppose D a n (Vars(S)) = O. Then $ ~ > - T implies $, [a] = ~ > T , [a t] for some substitution a t such that D a t c_ Dcr. Furthermore, a' is idempotent if cr is, and no variables appear in the sequence $, [a] R~>_ T , [a] which are not present in the sequence $ R~>_ T . P r o o f . It suffices to consider the cases in which S goes to T by a single S T step or a single Relaxed Paramodulation step. If $ ;-tri~ T, $ ~ t d T , or $ :-rp T , we can take a' to be a. If $ - $o,(x,N) ==~e (S0)[x := N ] , ( x , N ) , take a' to be a[x := N] restricted to the domain of a. Recall that we only do variable elimination on x if x is not solved in $. T h e n since D a N Vars($) = 0, no Yi is identically x. So $,[a]

--~, ~

$ ' , ( x , N ) , { ( y , , M i ) [ i e I} ($')[x :----g ] , ( x , g ) , { ( y , , ( M ~ ) [ x := N])[i C I} - T,[o']

T h e n a' is idempotent since x ~ N, and Da' n Vars(T) c_ Da A Vars(T) = Da n Vars($) = 0. [] T h e o r e m 4.5 Suppose S R ~ . ~ using equations in C(E) and suppose 0 unifies $. Then there exists a sequence of transformations $ R~,_ ~, using equations in E and a substitution ~ such that 05 =- 0 on Vats(S) and 85 unifies $'. Proof.

By induction on the length of the sequence $ R ~

~. Suppose S R ~

Let P and r / b e obtained by the induction hypothesis on the sequence $1 R~,~ ~, so t h a t $1 R ~ /5 using equations in E and 0r/unifies/5, O r / - O[Yars(S1)]. Using the Simulation L e m m a on the step $ ~ . - $1 with the protected set W including all the variables of $ together with the variables appearing in the derivation $1 =~>- /5, we get an idempotent a such that D a fq W = 0 and $ R~>_ $1, [a] using equations in E . Now Vars($1) fq D a = O, so Lemma 4.4 yields an idempotent a' such that Da' C Da and $1, [a] R % /5, [a'] for some a', using equations in E. Let 5 - rla' and let S' -- 15, [a']. It remains to verify the claims about 05. First, 05 unifies/5, [a']: Orla' unifies [a'] by idempotence of a', and it unifies/5 since Da' fq Vars(/5) = 0 by our choice of protected set W, so that O~a' - Orl on Vats(~5).

272 Next, 08 = O[Vars($)]: Orl = 0 on Vars($1) by the induction hypothesis. But a' is the identity on the variables of $, since D a I C_ D a and D a N V a r s ( $ ) = O. So Otla' =- 0 on Vars( $ ). [] T h e o r e m 4.6 Relaxed Narrowing is complete for any E . P r o o f . Let S be a system and let 0 C UE(S). Expand E to the closed set C*(E). Corollary 3.7 applies, and we find a sequence of C* (E) transformations $ R~_ [a], with a - $' and a 6 such that a6 unifies $' and a6 z- a[Vars($)]. Finally, apply S T steps to arrive at a [r], with r < a6[Yars($)] =_ a[Vars($)] ,(A[u +-- aL[v ~ aT]],B> -~ $1 and II. $o =- $', (A,B) ~

$',dec(A/u,a(L[v ~ T])), (A[u +-- aR],B) =_ $1.

In case the transformation is as in I, we mimic the derivation dependent on critical equations by the following derivation, which uses equations only from E:

$o =n~

$', (A,B) $',dee(A/u,R>, (A[u ~- L],B>

R~ ST.. .,.~ ST,~,.

$',dec(A/u,R),dec(L/v,S>,(A[u +- L[v ~ T]],B) $',a(dec(A/u,R)),[a], (A[u ~- an[v ~ aT]],B> $',dee(a/u,aR>, [a], (A[u ~- aL[v +-- aT]],B>

-

Sl, [o].

Notice that in passing from the third to the fourth line above we use S T to compute a. We also use the fact that dec(a $',dec(A/u,L}, (A[u ~-- R],B} S', $',dec(L/v't,S), ((L/v')[t ~- Ti,A/uv'), {dec(A/uw,L/w)tw C_I_~,(L)}, (A[u +-- R],B) $', [a], (a (L/v')[t ~-- aT], A/uv'), {dec(A/uw, an~w)Iw E_Lo, (n)}, (A[u ~ aR], B) &, [o],

For v an address of A/u, we write dec(A/u,a(L[v *- T])) from S1 as dec(A/uv, aT), {dee(A/uw,aL/w)lw eJ_~ (L)}, so that

$o =-:~ -~>-= _=

S',{(A,B)} $',dee(A/uv, T), {A[uv +-- S],B) $',dec(A/uv, T},dec(A[uv +- S]/u,L), ((A[uv +- S])[u *-- R],B} S',dee(A/uv, T),dee(A/u[v *-- S],L), (A[u +-- R],B) $',dee(A/uv,T),dee(S,L/v), {dec(A/u[v ~-- S]/w,n/w)Iw e_L~ (n)},(A[u e- R],B) S',dec(A/uv, T),dee(S,n/v), (A[u *-- R],B), {dee(A/u[v +- S]/w,L/w)lw e_L~ (L)} S',dee(A/uv,aT), [a], (A[u *---aR],B), {deetw E_L~ (L)} S',dec(Aluv,aT>, [a], , {deetw E_L~ (n)} &, [o]

using E. Notice that all Relaxed Paramodulation steps in the simulations are justified by Lemma 5.1. [] A c k n o w l e d g e m e n t s . The authors are indebted to Wayne Snyder for several instructive discussions. Thanks also to Jim Gibson.

References [Bac87] L. Bachmair Proof Methods for Equational Theories. Dissertation, University of Illinois, Urbana Champaign, 1987.

275

[BDH86] L. Bachmair, N. Dershowitz, and J.Hsiang. Orderings for Equational Proofs. In Proc. Syrup. Logic in Computer Science, pp. 346-357, 1986. [BDP87] L. Bachmair, N. Dershowitz and D. Plaisted. Completion without Failure. In Proceedings of CREAS, May 1987. [Fay79] M. Fay. First-order Unification in an Equational Theory. In Proceedings of the Fourth Workshop on Automated Deduction, Austin, Texas 1979.

[GS89]

J. H. Gallier and W. Snyder. Complete Sets of Transformations for General E-Unification. In TCS 67:2,8, pp. 203-260, 1989. Also presented at RTA, 1987.

[Her30] J. Herbrand. Sur la Theorie de la Demonstration (Dissertation, 1930). In Logical Writings, W. Goldfarb, ed., Cambridge, 1971.

[HO821 G.

Huet and D. C. Oppen. Equations and Rewrite Rules: A Survey. In Formal Languages: Perspectives and Open Problems, R. V. Book, ed., Academic Press, NY, 1982.

[HulS0] J-M. Hullot. Canonical Forms and Unification. In Proceedings of the Fifth International Conference on Automated Deduction 1980. [Kir84] C. Kirchner. A New Equational Unification Method: A Generalization of Martelli-Montanari's Algorithm. In Proceedings of the Seventh International Conference on Automated Deduction, 1984. [Kir85] C. Kirchner. M~thodes et Outils de Conception Systematique d'Algorithmes d'Unification dans les Theories Equationnelles. Th~se d'Etat, Universit~ de Nancy I, 1985. [Kir86] C. Kirchner. Computing Unification Algorithms. Presented at LICS, 1986. [MM82] A. Martelli and U. Montanari. An Efficient Unificaton Algorithm. In A CM Transactions on Programming Languages and Systems 4:P, pp. 258-282, 1982. [MMR86] A. Martelli, C. Moiso, and G. F. Rossi. An Algorithm for Unification in Equational Theories. Presented at the Third Conference on Logic Programming, 1986. [Plo72] G. Plotkin. Building in Equational Theories. In Machine Intelligence 7, pp. 73-90, 1972.

Some Results on Equational Unification PMiath Narendran*

Friedrich Otto

Department of Computer Science

Department of Mathematics

State University of NY at Albany

University of Kassel

Albany

3500 Kassel

NY 12222

West Germany

Abstract

A clear distinction is made between the (elementary) unification problem where there is only one pair of terms to be unified, and the problem where many such pairs have to be simultaneously unified - it is shown that there exists a finite, depthreducing, and confluent term-rewriting system R such that the (single) E-unification problem rood R is decidable, while the simultaneous E-unification problem is undecidable. It is also shown that E-unification is undecidable for variable-permuting theories, thus settling an open problem. The corresponding E-matching problem is shown to be PSPACE-complete.

1

Introduction and Basic Definitions

Equational unification (or 'E-unification' for short) is an important problem in automated reasoning. It is of special interest in provers using Knuth-Bendix-style completion methods, since certain equations such as commutativity of a function have to be "built into" our proof steps. An important equational unification problem that has been extensively researched is associative-commutative unification, in order to handle functions that are both associative and commutative [1, 5, 6, 14]. The reader is referred to [13] for an extensive survey of the area. The theory of equational unification is however less well understood than that of standard unification (or 0-unification). For instance, even the definition of equational unification allows several (meaningful) variations; e.g., *This work was supported by the Natural Sciences and Engineering Research Council of Canada. It was done while this author was visiting the Dept. of Computer Science, University of Calgary, Alberta, Canada T2N 1N4.

277

(1) Do we allow the input terms to have function symbols that are not present in E? (2) Are we unifying one pair of input terms or many pairs simultaneously? Clearly, if we go by (1), then (2) is meaningless to ask since the simultaneous case can be transformed into the single case. Note that this is the situation in standard unification, since E = 0 there. Hence the distinction is important only for elementary E-unification, i.e., E-unification where extra uninterpreted function symbols are not allowed. It was known that the two problems are not quite the same, since they have different unification types [4]. We show in this paper that single unification and simultaneous unification problems are different from one another for elementary equational unification by exhibiting a theory E (in fact, a canonical term-rewriting system) for which the former is decidable but the latter is not (Theorem 3.20). Thus the distinction between the two is made sharper. An open problem (raised by Schmidt-Schauss [11]) in this area has been the following question: if an equational theory consists only of variable-permuting equations, then is its E-unification problem decidable? Here an equation el = e2 is said to be variablepermuting if e2 can be obtained from el by a permutation of variables. We give a negative answer to the question (Theorem 4). The corresponding E-matching problem is shown to be PSPACE-complete. The proofs of these results make heavy use of the theory of string-rewriting systems or Thue systems [2]. Our proof techniques also gave us a new result in this area, on a problem related to cancellativity of semigroups. We present this result (Theorem 2.4) first, in Section 2. Section 3 outlines the construction of the equational theory E, referred to before, for which single unification problem is decidable, but the simultaneous case is undecidable. The undecidability of the unification problem for variable-permuting theories is presented in Section 4.

Equational Theories Definitions of some of the basic terminology of rewrite rule theory that we later use are given below. For a more extensive list of definitions and survey of basic results the reader is referred to [8]. A term rewriting system 7~ is a finite set of oriented equations {ll ~ rill E N} where li and ri are terms, and Var(ri) C Var(l~). These oriented equations are commonly called rewrite rules or simply rules. The set of function symbols occurring in T~ is referred to as its signature. A term t is reducible modulo 7£ if and only if there is a rule I --* r in 7£, a subterm t' at occurrence p of t, and a substitution a such that a(l) = t'. The term tip *- a(r)] is

278 the result of reducing t by l --+ r at p. The reduction relation --~ associated with a term rewriting system R is defined as follows: s - - ~ t if and only if there exist an occurrence p in s and a rule l -+ r in R such that t is the result of reducing s by l ~ r at p. A term t is said to be in normal form or irreducible modulo a term rewriting system R if and only if no reduction can be applied to t. Two terms s and t are said to be joinable modulo a term rewriting system R if and only if there exists u such that s -+~ u and t ---~ u. The equational theory E associated with a term rewriting system R (sometimes written $ ( ~ ) for clarity) is the set of equations obtained from 7"~ by treating every rule as a (bidirectional) equation. The equational congruence =~ is the congruence (--*TzU +--7~)*. A term rewriting system 7E is said to be noetherian if and only if there are no infinite sequences of reductions, i.e., for each t e r m t, the sequence t -+Tz tl --~Tz "-" is finite. A term rewriting system 7E is confluent if and only if for all terms t, u, and v * u A t -'+7~ *v) (t --+~

3w(u -~7~ *wAy

-~R

It can be shown that a noetherian term rewriting system 7~ is confluent if and only if it is locally confluent. A term rewriting system is said to be canonical (or complete) if and only if it is noetherian and confluent. Two terms s and t are said to be unifiable modulo an equational theory E if and only if there exists a substitution 0 such that O(s) =E O(t). If E has a canonical term rewriting system R, i.e., there exists a canonical system R whose associated equational theory is E, then this is equivalent to having 0 such that 0(s) and O(t) are joinable modulo R. In this case we sometimes say "s and t are unifiable modulo R." An equation el = e2 is said to be variable-permuting if and only if there is a permutation 7r of variables in el such that e2 = 7r(el). An equational theory is said to be variable-permuting if and only if every equation in it is variable-permuting. An example of a variable-permuting theory is C = {f(x, y) = f(y, x)} (commutativity).

Thue

systems

A Thue system T on an alphabet Z is a finite set of pairs of strings from E*. A pair (l, r) is often referred to as a rule. For a rule (l, r), l is said to be its left-hand side and r its right-hand side. The set of all left-hand sides of a Thue system T is denoted by domain(T) and the set of its right-hand sides is denoted by range(T). The congruence generated by T, denoted by ( ~,, is the reflexive, symmetric, and transitive closure of the relation --*T defined as follows:

"-~T = {(xty, xry) I (I,r) E T , x, y E E * } If x ~ ~ y, then x and y are said to be congruent modulo T. The reflexive, transitive closure of the relation ~ T , denoted by ~ , is often referred to as the reduction relation

279

induced by T on E*. If x ~ y then we say 'x reduces to y modulo T'; here x is said to be the a n c e s t o r of y modulo T and y is said to be x's descendant modulo T. (The phrase 'modulo T' is often abbreviated as 'mod T'; it is usually omitted if the Thue system under consideration is obvious from the context.) We often refer to the relation "-~T as a r e d u c t i o n step. Two strings axe said to be joinable if and only if they have a common descendant. A string is said to be irreducible if and only if it has no descendants other than itself. The set of all irreducible strings is denoted by I R R ( T ) . The relation ~ T is said to be: - length-reducing if and only if x ~ T Y

implies ]x{ > tYt for all x, y.

- l e n g t h - p r e s e r v i n g if and only if x OT Y implies Ixl = lY[ for all x, y. - n o e t h e r i a n if and only if for no x is there an infinite chain of the form X ~ XO --~T Xl --+T X2 " ' ' "

- c o n f l u e n t if and only if the following holds: for all x, y, z, x - ~ y and x --+~ z

implies there exists a u such that y - ~ u and z ~

u.

Note that if "-'~T is length-reducing, then it is clearly noetherian. If --*T is both noetherian and confluent, then every string in E* has a unique irreducible descendant modulo T. A Thue system T is said to be m o n a d i c if and only if Ill > jr I and Iv] < 1 for every rule (l, r) in T. It is said to be length-reducing (length-preserving, noetherian, confluent) if and only if the corresponding relation --*T is length-reducing (resp. noetherian, confluent). For a string x, < x > denotes the set of its ancestors; i.e.,

<x> = {y I y-%x}. Its congruence class is denoted by [x]; i.e., [x] = {y ] x , ,*y}. For a set of strings L, [L] denotes the union of the congruence classes of strings in L, namely, the set {Y I 2x E L : x , ,*y}.

2

E-Unification

and

Thue

systems

This section is mostly on Thue systems. It is shown (Theorem 2.4) that there exists a length-reducing and confluent Thue system T such that the problem of determining, given

280

strings u and v, whether there exists a "right-multiplier" string w such that uw ~ ~. vw is undecidable. From ([7], Proof of Theorem 8.8, pp. 196 if) we see the following: If M = (Q, z, 6, qo, F ) is a single-tape Turing machine (TM), then there exists a set of pairs of non-empty words SM = {(x~,yi) [ i = 2 , . . . , k } , C F + × F +, where Y = Q o E U {#}, such that the following two statements are equivalent for each word w E E*: (1) M accepts on input w, i.e., w E L(M), and (2) the modified Post Correspondence Problem SM,~, = { ( # , # q o w # ) } U SM has a solution, i.e., there exists a sequence of integers i l , . . . , i = E {2,..., k} such that # x 6 . . . xl. = #qow#yil... Yl.. N o t a t i o n : "SM,~, has a solution" is expressed as "MPCP(SM,~,) holds." Let a : F* H {a, b}* be an encoding such that c~(F) C {a, b}l for some integer l _> 1. Define S ~ = {(a(xl), a(yl)) I i = 2,..., k} C {a, b}+ x {a, b}+. Then the following two statements are equivalent for each word w E E*: (1) w E L(M), and (2) MPCP(S~,~,) holds, where S~,~ = { ( ~ ( # ) , a ( # q o w # ) ) } U S~. Let M be a TM such that the language L(M) is non-recursive. Then the following problem is undecidable in general: I N S T A N C E : Two non-empty words xl,yl E {a, b} +. Q U E S T I O N : Does MPCP({(Xl, y~)} U S ~ ) hold? In what follows let S = S ~ C {a, b}+ × {a, b}+. For simplicity we write S = {(xi, Yi) l i = 2,...,k}. L e t A = {a,b, al, bl, cl,c2, c, dl,d~,d, e2,...,ek, f2,...,fk,g2,...,gk, h, hl, h2,$, f(,§}. Define 6: {e2,... ,ek}" v--r {f2,... ,fk,g2,...,gk}* through e, ~ f,g, (i = 2 , . . . ,k), and let p denote reversal.

281

We define three Thue systems on A as follows:

T1 = TI(S) = {(c,cp(x,),c) I i = 2 , . . . , k } U {(e,dp(y,),d) 1 i = 2 , . . . , k } , = {(clf~g~, ~cl), (dl/,g,, ~d,) I i = 2,..., k} U {(c~h, c), (d,h, d), ($c, c2), ($d, d~), (a,c2a, c2), (b, c2b, c2), (ald2a, d2), (bld2b, d2)}

nl

u {(t,~¢, 9, T2

=

T2(S)= T~

(t,,d~¢, u

§)},

RI.

L e m m a 2.1. (a) T1 is finite, monadic and confluent. (b) R1 is finite, length-reducing and confluent. (c) :/~ is finite, length-reducing and confluent. P r o o f : The left-hand sides do not have any overlaps in these Thue systems. [] For a pair ( x , , y , ) e {a,b} + x {a,b} + let S(x,,y,) = {(xl,yl)} U S. L e m m a 2.2. Let x~, yl E {a, b}+. If M P C P ( S ( x l , Yl)) has a solution, then there exists a word w E A* such that hl~(Xl)$ClW ~ ~* T~ h2T(y~)$dlw, where ~ : {a, b}* -+ {al, bl}* is defined through a ~ al and b ~-* bl. L e m m a 2.3. Let x~, Yl E {a, b}+. If there exists a word w E A* such that h~T(Xl)$ClW ( )* T2 h2T(y~)$d~w, then M P C P ( S ( x l , yl)) has a solution. T h e o r e m 2.4. ( M a i n R e s u l t ) For T2 the following problem is undecidable: I N S T A N C E : Two words, u,v E A*.

QUESTION: Does there exist a word w E A* such that uw ~ ~* T2 vw? P r o o f . By Lemmas 2.2 and 2.3 and the choice of S. [] Theorem 2.4 is an improvement of ([10], Thm. 3.2, p. 342) where the following uniform problem was shown to be undecidable:

INSTANCE: A finite, length-reducing, and confluent Thue system T on alphabet E, and two words u, v E E*.

282

QUESTION:

Does there exist a word w E E* such that u w ~

~vw?

From Theorem 2.4 we can now derive the following undecidability results. T h e o r e m 2.5. There exists a length-preserving, noetherian, and confluent Thue system iT over E such that the following problem is undecidable: INSTANCE:

Two distinct symbols a and b from E.

QUESTION:

Does there exist a string x such that ax and bx are congruent modulo 2-?

T h e o r e m 2.6. There exists a finite, depth-reducing and confluent term rewriting system E such that the E-unification problem is undecidable. P r o o f . Let F = A U {¢}, where all the letters from A are interpreted as unary function symbols and ¢ is a binary function symbol, and let E be the term-rewriting system resulting from the Thue system T2. Then E is finite, depth-reducing, and confluent by Lemma 2.1 (c). The following claim can now be proved: C l a i m . Let u, v C A*. Then the following statements are equivalent: (1) g w E A * : u w ,

)*r2 v w , and

(2) the terms ¢(u(x), v ( x ) ) and ¢(y, y) are E-unifiable. Theorem 2.4 and the above claim now yield the intended result. [] Theorem 2.6 by itself is not a new result, since it follows from the results in [9] where the right-divisibility problem is shown to be undecidable for Thue systems that are lengthreducing and confluent. Undecidability of the E-unification problem for noetherian and confluent term rewriting systems has been known for some time; for instance, it is not hard to show that the following set of equations has an undecidable E-unification problem: (x+y)+z x*l x*(l+y)

=

x+(y+z)

=

x

=

x+(x*y)

Note that turning the above equations into rewrite rules results in a noetherian and confluent system.

283

3

S i m u l t a n e o u s E - m a t c h i n g and simultaneous Unification

E-

Let E be a finite term-rewriting system on T(F, V). The s i m u l t a n e o u s E - m a t c h i n g p r o b l e m is the following decision problem: I N S T A N C E : Two pairs (tl,t2) and (t3, t4) of terms from T(F, V).

QUESTION: Does there exist a substitution a such that a(tt) =E t2 and a(ts) =E t47 The s i m u l t a n e o u s E - u n i f i c a t i o n p r o b l e m is the following decision problem: I N S T A N C E : Two pairs (h, t2) and (t3, t4) of terms from T(F, V).

QUESTION: Does there exist a substitution a such that a(h) = s a(t2) and a(t3) =E

The goal of this section is to prove that there exists a finite, depth-reducing, and confluent term-rewriting system E such that • the E-matching and E-unification problems are decidable, while • the simultaneous E-matching and simultaneous E-unification problems are undecidable. Clearly, if the single unification problem for a theory E is decidable and finitary then the simultaneous unification problem is also decidable and finitaxy. Thus our construction yields an equational theory E whose single unification problem is decidable but the number of minimal unifiers may not always be finite. For the following construction let S be the set S = {(xi, y~) I i = 2 , . . . , k } C {a, b} + × {a, b} + constructed at the beginning of Section 2; i.e., S = S~z, where M is a Turing machine with an undecidable halting problem, and a is an encoding of the tape alphabet of M. Define T1 = TSI(S) = {(xicei, c) I i = 2,..., k} W {(y, de~, d) I i = 2,..., k}, where c, d, e2, • .., ek are additional symbols.

Define Rl={(clala2, acl), (clbxb2, bcl), (clc2, c), (d~a~a~,adl), (dlc2, d) }, where al, as, bl, b2, Cl, c2, dl axe additional symbols, A = {a, b, c, d, e2,..., ek, al, a2, bl, b2, cl, c2, dl}, and

(dlb~b2, bd~),

284

T~ = T S ~ ( S ) = T~ 0 R , .

L e m m a 3.1. a) T1 is finite, monadic, and confluent. b) R1 is finite, length-reducing, and confluent. c) T2 is finite, length-reducing, and confluent. P r o o f : It is easy to see that the left-hand sides in these systems have no overlaps. Q

For zl, y, e {~, b}+ let S(x~, y~) = { ( ~ , ~ ) } U S L e m m a 3.2. Let Xl, y~ E {a, b}+. If M P C P ( S ( x l , y~)) has a solution, then there exists a word x e A* such that c~(Xl)X~---~2x~c and dl~(xl)x~---~2y~d. Here ~o: {a, b}* {al, a2, bl, b~}* denotes the mapping induced by a ~ ala: and b ~-~ bib2. L e m m a 3.3. Let xl, yl E {a, b}+. If there exists a word x e A* such that Cl~(X~)X ~ xlc and d ~ ( x ~ ) x e - - - - ~ x l d , then M P C P ( S ( x l , y l ) has a solution.

~* T2

From the choice of S, Lemmas 3.2 and 3.3 imply the following. C o r o l l a r y 3.4. The following problem is undecidable: I N S T A N C E : Four words u, v, w, z E A*. QUESTION:

Does there exist a word x E A* such that ux~

~.2v, and wx~

~z?

To contrast this undecidability result we now want to show that E-matching and Eunification rood T2 are decidable. L e m m a 3.5. Let $1 -- {(x~,y~) [ i -- 2 , . . . , k } C_ {a,b} + × {a,b} + be a set of pairs of non-empty words, and let T1 = TSI(S1), R1, and T2 = TS2(SI) be defined as above. Then one can effectively construct a deterministic pushdown automaton (dpda) B(SI) that, on input a word u E A*, halts with the irreducible descendant of u mod T2 on its pushdown stack. C o r o l l a r y 3.6. Let $1 = {(x,,y~) I / = 2 , . . . ,k}, and let w E A*. Then [W]T2 is a deterministic context-free language, and given the set $1 and the word w, a dpda for [wit2 can be constructed effectively.

285 P r o o f . Let w0 be the irreducible descendant of w mod T2. Then [w]T2 = < Wo >T2, i.e.,

u E [w]T2 iff on input u, B(S~) halts with w0 on its pushdown stack. Incorporating w0 in the finite control of B(S~) yields a dpda for [W]T2. [] R e m a r k . If R C IRR(T2) is a regular set, then [R]T2 is a deterministic context free language (DCFL), and a dpda can be constructed (cf. [2], Proof of Thin. 3.3). C o r o l l a r y 3.7. The following problem is decidable: I N S T A N C E : A finite set $1 = {(x,, y;) I i = 2, ..., k} c {a, b}+ × {a, b}+, and two words u~ v E A*. QUESTION:

Does there exist a word w E A* such that uw~

~&(s~)v?

P r o o f i There exists a word w E A* such that uw~..... ~2v, where T2 = TS2(S1), iff u - A* A [V]T~ # O. Given $1 and v, a dpda for [V]T2 can be constructed effectively, and hence we can obtain a dpda for the set u. A* A [V]T2. Thus, it is decidable whether there exists a word w E A* such that uw~ ~2v. [] Next we want to show that the Thue system T2 = TS2(S1) is always r i g h t - c a n c e l l a t i v e no matter which set $1 is chosen, i.e., for all u , v , x E A*, ux~ ....... ~r2vx implies u~ ....~2v. To prove this result (Theorem 3.11) we introduce the following technical notion and results. D e f i n i t i o n 3.8. Let A be the alphabet {a, b, c, d, e 2 , . . . , ek, al, a2, hi, be, cl, c2, dl} for some k ~ 2. Then II : A* ~-~ {c, d}* denotes the homomorphism induced by the following mapping: C

~

C

C1

~+

C

d dl f

~ d ~-~ d ~ A forallfEA\{c,

cl, d, dl)

L e m m a 3.9. Let u, v, w E A*. a) If u---~2v , then II(u) = II(v). b) If uw,, ,~2vw, then II(u) = II(v). Proof. a) From the form of the rules of T2 we see that u----~T2V implies II(u) = II(v). Thus induction yields that u ~ v implies II(u) = II(v).

286

b) Let u, v, w E A* such that uw~ ~ v w . Since T2 is confluent, there exists a word z E A* such that u w ~ 2 z ~-*T2 vw. Hence by a) II(uw) = H(z) = II(vw), a~d so =

[]

L e m m a 3.10. Let u , v , w E A* be irreducible rood T~ such that uw* ,~2vw. If u w is reducible rood T2, then so is v w , and the same rule of T2 applies to both u w and vw. T h e o r e m 3.11. Let S1 = { ( x , , y l ) l i = 2 , . . . , k}. Then the Thue system T2 = TS2(S~) is right-canceUative.

C o r o l l a r y 3.12. The following problem is decidable: INSTANCE: words u, v E A*.

A finite set $1 = {(x,, y,)l i --- 2 , . . . k} C_ {a, b} + × {a, b}+, and two

Q U E S T I O N : Does there exist a word w E A* such that uw
r. We denote by s J, the normal-form of s for ----~E. E is said to be convergent on ground terms if for arbitrary ground terms s~ = t$ iff s and t are equal under the equational theory =E. A proof s --+ . . . --~ . . . ~- • • • +-- t is called a rewrite proof. Applying unfailing completion [2,8], to E1 U E2 yields a (possibly infinite) convergent set R of equations for semi-deciding =EIuE: on ground terms. Since F1 ~ F2 = 0, no overlap is possible between equations of E1 and E2, hence R = R1 U R2 where the equations in R1 (resp. in R2) are pure in E1 (resp. in E~). By extending the ordering > to T(F1 U F2,X), variables being now treated as constants, we get a semi-decision procedure for =EIL~E: on terms in T(F1 U F 2 , X ) . The R-normal form of a term t will be denoted by t $. The R-normal form of a substitution a is a ~= {x ~-~ (xa) ~ I x E Dora(a)}. D e f i n i t i o n 12 Let U C X be a set of variables such that there is a one-to-one mapping h f r o m T ( F 1 U F2,X)/=E~uE~ to U. By convention, h(t) denotes the image by h of the class of t in T(F~ U F2,X)/=E,uE2. Let t E T(F1 U F2, X ) and t = F~ or F2. The U-homogeneous part ~ 7 of t with respect to 7 is defined by: if t J.E X t h e n ~7 = t J~ else if t J.= f ( t l , . . . , t . ) and f E ~r t h e n ~ ; = f ( ~ 7 , . . . , ~ 7 ) else ~ 7 = h(t) The U-homogeneous part ~ ~ of a substitution o with respect to a set ~r of function symbols is ~ 7 = {x -+ ~ i}zeDom(a ). The universal preserving substitution is Pu defined by p~(h(t)) = t j.. U-homogeneity is used only in the completeness proofs. It has the advantage that equal subterms are replaced by the same variable. When a normalized substitution a is applied to a pure t e r m t, the normalization can be performed as well on t~ ~" as on ta. Moreover, since p~ is normalized, the proof is pure in the theory of t. 3.3

Ei-Resolution

Once variable abstraction has given some pure equations in a theory, it is possible to solve t h e m independently with the rule:

E~-Res ~- {x~ ? Sk}keK if P~ is a pure subproblem in E~ not in solved form and {x~ ~-~ Sk}keK E CSUV'(P~).

P~

298

At the beginning, U~ is empty, and the rule uses standard Ei-unification. The use of Ui is explained in the next section. As long as U~ is empty, E~-Resolution is known to preserve solutions [17,13,I]. 3.4

Variable

Replacement

For the m o m e n t , no explicit replacement rule is needed, replacements being performed by Ei-resolution in P1 and P2- Nevertheless, variable replacement, a weak form of replacement is necessary to make potential merges appear. Var-Rep ({x~y}UP, g,) F- ( { x ~ y } U P { x ~ - + y } , if b o t h x and y occur in P.

U,{x~-+y})

The completeness of Variable Replacement is a straightforward. 3.5

Theory

Clashes

It m a y happen t h a t a unification problem contains an equation Sl ~ s2 or two equations q ? x - sl and x - s2 with sl E T(F~, X ) and s2 E T(F2, X ) . If the theories are collapse-free, then such theory clashes have no solution, otherwise, restricted Ei-unification allows to solve t h e m thanks to Lemma

1 Let Sl E T(F1, X) \ X and s2 E T(F2, X ) \ X . Let ~ be an El U E2-solution

of {Sl ~ s2}, then there exist two substitutions a' and a" such that •

Cf ~ ' E I u E 2 Ul~Ytr

• sia' =E, x for some x E X (i E {1,2}) •

xo" =

proof : Assume without loss of generality that a is in R-normM form. Let (Sla) J.= (s2a) ~= u. Assume first that u E X or u(A) E F~, and normalize sla. Since all rules are pure in E1 or E2, and a is normalized, all rewrite steps use equations in R1 and are performed in the homogeneous part of sla, hence, the proof is of the form S l 6 r - ~ R l . , . --+RI u

If u E X, then we are done, else u(A) E F2. The proof lifts to a proof on U-homogeneous parts with respect to F1 because E1 u E2-equal subterms with top function symbol in F2 are replaced by the same variable: 8 1 ~ FI--+ RI • . . ---+RI ~ FI

But u is a normalized term with top function symbol in F2, hence ~F~ = h(u) E X. Taking x = h(u), a' = ~F~ and a" = p,, we have sla' E X, a = E I u E 2 a'a", and xa" = (sla) ~. Assuming now that u(h) E F1, the symmetric result is obtained by normalizing s2. [] L e m m a 1 shows t h a t all the solutions of a unification problem containing x = sl and x -- s2 with S l e T(F1, X ) \ X and s2 E T(F2, X ) \ X , are E1 U E2-instances of an E l - m a t c h from sl to x or an E2-match from s2 to x.

299

A complete set of Ei-matches from si to a variable x is a complete set of restricted E~-unifiers of s~ and x with respect to U = {x} [4]. At this point, the algorithm becomes nondeterninistic: it is necessary to guess in which theory the variable x will not be instanciated. Furthermore, to guarantee termination, the choices t h a t have been m a d e must be memorized, and the search for solutions must be restricted to substitutions t h a t are compatible with previous choices. For this purpose, we add two "global variables": U1 and U2 are the sets of variables t h a t must not be instanciated in E1 and E2 respectively. Theory clashes are then handled by the following rule: Ei-Match i- ({xk ~- s~}keg U P~a ,"V, U {x})

(P,, V,)

if x £ s • P~ and x £ t • Pi+l and a : {xk ~-~ sk}keK • CSU~(s~,x) and V a r - R e p does not apply. T h e rule preserves solutions, as well as Ei-resolution, even when U~ is not empty: Lemma

2 E~-Res and E ~ - M a t c h preserve solutions.

p r o o f : It is known [17,13,1] shows that Ei-resolution is complete as long as Ui is empty. The third statement of lemma 1 shows that Ei-unification can be replaced by restricted Eiunification, because no further Ei equality step is needed in the proof from variable x to (sin) ~, hence it is not necessary to consider the substitutions that Ei-instanciate variable x after the term si has been matched onto x. The completeness of Ei- m a t c h is given by lemma 1 with the same remark. [] Nondeterminism is in the choice of theory Ei in which the variable x will not be instanciated anymore. Once U~ ~ 0, Ei-resolution must be applied using restricted Eiunification with respect to Ui instead of s t a n d a r d Ei-unification. This avoids creating new clashes on a variable on which a clash has already been solved by applying Ei-match. ?

If-the original unification problem contains an impure equation sl - s2 E PH with Sl • T(F1, X) \ X and sz • T(F2, X) \ X, or if such an equation is yielded by variable abstraction, the following straightforward rule reduces this problem to the previous one:

IE

? S 1 = S2

if

? 2: = S l , X

~-

? = 82

• T(FI, X) \ X and

• T(F , X) \ X,

w h e r e x is a fresh variable.

At this point, we have all the necessary mechanisms to compute a separated problem: Proposition

2

If the set of inference rules S = { V A , E i - R e s , E ~ - M a t c h , I E , V a r - R e p } terminates for some unification problem P, then it computes an equivalent separated problem. proof : apply. []

All rules preserve solutions, and if the problem is not separated, some rule must

If a separated problem contains no cycle for the occur-cheek relation x < y if x ~ s[y] • P with s[y] ~ X then we are almost done, else assumption 2 will give us the solution.

300

4

Breaking Cycles

Since $ yields a separated problem, all cycles in the graph of the occur-check relation must be compound cycles of the form xl ~ tl[x2],x2 ~ t2[xd],... ,x2n ~ t2,[Xl] where Vi E [1..n], t2,-1 e T(F1, X ) \ X and t2, E T(F2, X ) \ X . Such cycles can be broken using variable elimination: E x a m p l e 1 Let P = PBRU PO where PBte = {Y ? x + z} and Po = {x L f ( y , z ) } in the combination of a Boolean Ring theory and the free theory. There is a cycle x < y < x in the occur-check graph. The substitution a = {x ~ x I, z ~-+ x r + z r} makes x + z BR-equal to zt: it is a variable B R - e l i m i n a t o r of x in x + z. A naive transformation for solving P would be PBR ~- PBRa U {X L X', Z ? x' + Z'} this transformation yields the problem P' = P~ U P~R UP$ with Pb = {y L z',x L x'}, P~ = {x L f ( y , z ) } and PBR = {z g X' + Z'}. Now, the problem is not separated anymore, and after applying twice Variable replacement (z t is replaced by y and x t by x), we get the problem: P " = P~ U P~R UP$' with P~. = {y L z ' , x L x'}, P~ = {x -~ f ( y , z)} and PBR = {z L_ X + y}. Indeed, the edge y < x has disappeared, but a new edge z < x has been introduced, and there is a cycle x < z < x. If the same rule is applied with the BR-eliminator {x ~-+ x", y ~-+ x" + y"} of x in x + y, after variable replacement, the unification problem obtained will contain exactly the original cycle.

A solution to this non-termination problem will be given after exposing the second mechanism for breaking cycles: in case both theories have collapse axioms, a cycle can be broken by matching a term onto a variable. E x a m p l e 2 Let E1 be a Boolean Ring theory with F1 ? {+,*,0, 1} and E2 an Abelian Group with F2 = {', - , e}. Let P = {x ~- y + z, y L x. u}. The substitution a = {x ~-* y , u ~-* e} is an A G - match from x . u to y. By applying a to PAG and adding to P the corresponding equations, we get the problem P ' = {x ~- y + z , x

L- y , u ? e}

301

At this point variable replacement applies and yields P" = {x & x + z , x L y , u Z~ e} in which P~R = {x ~ x + z} is not solved anymore. An equivalent solved problem is {z ~ 0}. Finally, a separated problem with no cycle is

{ z £ O , x L y , u ? e} Note that this problem has been obtained without BR-eliminating y from y + z nor AG-eliminating x from x . u. T h e following technical l e m m a will be used in the completeness proof: 3 Let t E T(Fi, X) \ X and x E X . Let a be a substitution such that ~ f , E X and x is not Ei-eliminated by ~ f , in t and (xa) I (A) E Fi+l. Then (xa) I is a subterm

Lemma

o/(to) 1. proof : Assume without loss of generality that a is in R-normal form and normalize ta. Again, the proof is of the form Since t is pure in Ei, the proof lifts to a proof on U-homogeneous parts: t ~ F,__,R, • • • ~ n , ( t ~ )

1 ~'

Since t is pure in Ei, ~-~e~ ----E~t~e~. By hypothesis, x is not Ei-eliminated in t by a F~, hence z~ F~ = h(xa) E V((t~ e') 1). Now (ta) 1= ((t~ F') i P~, and h(za)p~, = (za) ~ is a subterm of ( t . ) i. []

Note t h a t if in addition t is not m a d e Ei-equal to a variable by ~F~ then (xa) ~ is a proper s u b t e r m of (ta) ~. T h e following l e m m a shows t h a t E~-elimination and matching are the basic mechanisms for solving cycles: 4 Let C = (xl ? tl[x2], x2 ~ t2[xa],..., X2n ? t2n[Xl]} where t2i-1 E T(F1, X ) \ X and tz, E T(Fz, X ) \ X for i E [1..n]. If a is a solution of C, then either

Lemma

• ~F~ El-eliminates some xzi from tzi-1, or • ~F~ E2-eliminates some x2i+l from t~, or • ~e~ makes some t2i-t El-equal to a variable, or • ~F~ makes some t2i E2-equal to a variable. p r o o f : Assume first that x2i~ e~ ~ X for some i in [1..n]. Then by lemma 1, tzi~ F2 E X. The symmetric result is obtained if x2i_l~/~ ~ X. We can now assume without loss of generality that Vi E [1..n], xzi~ F~ E X and x2i_l~ e2 E X. Then by the lemma 3, if cr satisfies none of the conditions above, then Yi E [1..2n], (xi+~(r~oaz,,)a) ~ is a proper subterm of (tia) 1- This implies that (xla) ~= (tta) ~ is a proper subterm of itself: a contradiction. [] W h e n a c o m p o u n d cycle involving the equation x ~ t[y] E Pi is encountered in a separated problem, it will be solved if possible by either:

302

• removing y from t using variable Ei-elimination, or * matching t on the variable x using restricted Ei-unification. Note that the substitutions that remove y from t[y] by Ei-instanciating y are not computed. For instance, the substitution {y ~-+ 0} which removes y from y * z in Boolean Rings does not correspond to the definition of a variable BR-eliminator of y in y * z. Nevertheless, such possible solutions will be computed by the algorithm: if ~ F i E~-instanciates y, then there will be a clash on y because there is an equation

y ? t~[z] E P,+~ in the cycle. Then ° is an instance of an E~+~-match from tv[z ] to y. To have termination, it is again necessary to memorize what has been done, so as not to undo it. When a variable y is Ei-eliminated from a term t[y], in order to break a cycle containing x ~ t[y] C Pi, the pair < y, x > is added to a set of constraints. D e f i n i t i o n 13 A set of constraints is a set S C = {< x l , y 1

> .... , < xn, y,~ >} of oriented pairs of variables. The corresponding variable Ei-elimination problem is

{< xi,t > I < xi,y~ >E S C andyi £ t E Pi o r t E V(Pi) a n d y i =-By t}

where x =-ev Y if there exists a sequence of equations x ? vl,

Vl ~ V2 . . . . .

Vn

~ y in Pv.

If a separated problem P admits a cycle containing x ~ t[y] E Pi, then one of the two following rules must be applied nondeterministically: Cyclel

U,, Sc)

({x Ls b

uP,

where a = {xj ~-~ s i } j c j belongs to a complete set of variable E/eliminators for the Ei-elimination problem associated with S C U {< y, x >}.

Cycle2

( P , , U,, SC) ~- ({xk L sk}~eg U P~a, U,U { x } , S C ) if a = {xk ~ sk}keK is a most general restricted Ei-unifier of s and x with respect to

u {x}. Our last rule, C y c l e consists in the nondeterministic application of C y c l e l or C y c l e 2 . L e m m a 5 C y c l e preserves solutions. p r o o f : Lemma 3 shows that every solution of a cycle containing equations z -~ t[y] must be an instance of a variable Ei-eliminator of some y in t[y] or an E~-match from some t[y] to x. Let a be a solution of P, and assume without loss of generality that a is in R-normal form. Assume first that t[y]~ y' =~, x for some x E X. Then (t[y]a) ~= xpu and (xpu) ~ (A) has its top function symbol in F~+I. No further El-equality step is necessary in the proof t[y]~F~Pu =E,uE2 (xa) ~. Hence x will not be Ei-instanciated anymore, and it can be added to the set U~. Assume now that a solution a is such that ~f~ Ei-eliminates y in t[y]. Then, by definition, y~F~ E X and ya F~ ~ V(u) for some u =E, tY F~. If after applying Cycle2 for eliminating y

303 from t[y], and making the problem separated again, the problem contains another cycle, then, it is not necessary to consider the substitutions 0 such that y~F~ ~ X, or y~F~ E V(uO) because such solutions are obtained by applying C y c l e l or by applying Cycle2 to some other equation of the cycle. Hence, the pair < y, x > can be added to SC, and possible further cycles will be broken without reintroducing y in the value of x. [] At this point, we almost have a problem in solved form: P r o p o s i t i o n 3 If $ U ( C y c l e } terminates for a unification problem P, then it computes a separated problem equivalent to P that admits no cycle for the occur-check relation.

5

Term Replacement

T h e Replacement rule is classical, and it is well known to preserve solutions: Rep

{x ? s } U P

t- {x ? s} U P { x ~ s}

if x occurs in P The problem with replacement is that it makes terms grow. If the use of R e p is not drastically restricted, termination proofs become difficult. Actually, if there is no restriction at all, then Variable Abstraction followed by the corresponding replacement may go into an infinite loop. Another problem is that replacement makes heterogeneous equations. The basic idea is to delay the use of term replacement until the end, and to prove termination of S U ( C y c l e } on one hand, and of R e p alone on the other hand, which is relatively easy. P r o p o s i t i o n 4 If a separated problem admits no cycle in the graph of the occur-check relation, then R e p applies finitely many times and yields a problem in a solved form. We are left to show that S U ( C y c l e } terminates.

6

Termination

The crucial notion for proving termination is the notion of shared variable. Intuitively, a variable x E V(P~) is shared in PI if there exists a variable y E V(P~) such that x and y will possibly be identified by an application of V a r - R e p . More formally: D e f i n i t i o n 14 x Hi y if x and y occur in Pi. =v is the equivalence on variables generated by the equations in Pv. x and y are identifiable outside Pi if (x, y) is in the transitive closure of the relation

u =v) A variable x is shared in P, if x C V(P~) and 3y E V(P,) such that x and y are identifiable outside Pi. A variable x is weakly shared in P~ if x E V(P~) and 3y E V(P~+I) such that x =v y.

304

The key of the proof is in the two following lemmas: L e m m a 6 No rules except VA and I E increase S V ( P ) . L e m m a 7 ff an application of V a r - R e p makes Pi unsolved, it removes a shared vari-

able. The complexity measure uses the following items: D e f i n i t i o n 15

THm~t(P) denotes the multiset of theory heights of heterogeneous terms in P, where the theory height of a term t is the maximal number of times the theory constraining the function symbols changes in a path of t. I E ( P ) denotes the number of impure equations in PH of the form s ~ t where s E T ( ~ , X) \ X and t E T(F/+x, X) \ X. S V ( P ) is the multiset {nl,n2} where ni is the number o/variables shared in Pi.

Vi(P) denotes the

number of equivalence classes for =v of weakly shared variables that contain no variables of Ui. Um~(P) is the multiset {N (P),N (P)}.

SC (P) denotes the number of classes for =~ of oriented pairs of shared variables that contain no pair in SC. U S P ( P ) is the number of unsolved subproblems in {P1, Pz}P V R ( P ) i s the number of potential applications of variable replacement, that is the number of equations x ?=:y E Pv where both x and y occur somewhere else in P. The weight of P is W(P) = (THm~,( P), IE( P), SV( P), ~

(P),-S'-C ( P), U S P ( P ) , P V R(P) )

The ordering <w is obtained by comparing lexieographieally the components of W ( P ) from left to right, it is well founded as a lexicographic extention of well founded orderings. T h e o r e m 1 $ U {Cycle} terminates. We do not include the complete termination proof for lack of space. Clearly, VA decreases THmul(P), and since no rules create an heterogeneous term, THm~z(P) is never increased. I E removes an impure equation, hence decreases I E ( P ) . No rules except V A create an impure equation. It can be shown that E i - M a t c h , C y c l e and Ei-Res do not increase S V ( P ) : if a new shared variable x is created, then a previously shared variable associated with x must have disappeared. E i - M a t c h and C y c l e 2 add a weakly shared variable to U1 or [72, hence decrease

(P).

305

TH,~uI(P) IE(P)

SV(P)

Um~,~(P) SC(P)

USP(P)

PVR(P)

= T

$

VA IE

=

El-Match Cycle2 Cyclel Ei-Res Var'ReP(!) Var-Rep(2)

= : = --,, : :

: = : -: :

J.= .~= j.= 1-: .L

J. = = ~.= J-:

~. = J,= J.=

Figure 1: T e r m i n a t i o n T h e o r e m W h e n C y c l e 2 applies, a pair of shared variables is added to SC, hence SC (P) decreases. Finally if V a r - R e p does not increase USP(P), then it decreases W(P) by decreasing PVR(P)(case 1). I f V a r - R e p increases USP(P), then, by ]emma 7, it decreases SV(P)

(case 2). T h e termination proof is s u m m a r i z e d in figure 1. A complete proof is given in [1]. We can now state: Theorem

2 Let E1 and E2 be two consistent equational theories on T(F1,X) and

T(F2, X) with F1 n F2 = 0, satisfying assumptions 1 and 2. The following procedure: 1. Apply the rules in $ U { C y c l e } as long as possible, 2. Apply R e p as long as possible. implements a complete unification algorithm for terms in T( FI u F~, X) modulo E1 u E2.

7

Efficiency

T h e algorithm given in this p a p e r is more efficient t h a n [13] because n o n d e t e r m i n i s m is involved only if theory clashes or c o m p o u n d cycles are encountered. Nondeterminism comes in at two levels: • T h e choice of which rule to apply for C y c l e ( C y c l e 1 or C y c l e 2 ) , and the choice of the equation on which to apply the rule for E ~ - M a t c h and C y c l e . • T h e choice of a variable identification for solving restricted Ei-unification problems or variable El elimination problems. For example, if x ~ s E P~ and x ~ t E Pi+l occur in P , then, two possible choices m u s t b e considered: s or t must be m a t c h e d on x. This nondeterministic branching corresponds to labelling step in [13]. If no clash occurs on x, then n o n d e t e r m i n i s m is avoided here while b o t h cases will be considered in [13]. W h e n E i - m a t c h i n g a t e r m onto a variable using restricted E~-unification with respect to U, or when c o m p u t i n g complete sets of variable Ei-eliminators, the n u m b e r of calls to plain E~-unification or constant Ei-elimination grows like the n u m b e r of possible

306

variable identifications. There are as many variable identifications over a set U as the number of partitions of U. Applying a variable identification corresponds to the identification step in [13], where some multiequations are merged nondeterministically. While identifications are applied nondeterministically at the beginning in Schmit-Schaut3' algorithm, here variable identifications are applied only if cycles or clashes occur, and only to the concerned variables which is a relevant optimization. In the same way as for E~-resolution, one can restrict the search for variable E~eliminators to the substitutions that do not Ei-instanciate the variables in Ui, that is the variables that must not be E~-instanciated. This avoids creating new theory clashes.

8

Conclusion

The algorithm presented here gives a new solution to unification in combination of equational theories. It can be seen as an extension of [3] because some inference rules have just been modified in order to deal with arbitrary theories. This shows that using transformation rules is a more modular approach than giving a recursive procedure. Another advantage is that completeness proofs are easier because one can prove separately that each rule preserves solutions, then that normal forms are solved unification problems, and finally that the set of rules terminate for a given control. Moreover, it is easier to separate the logic from the control when designing a unification algorithm, because it is easier to see which rules cause non termination, and to modify them, or to modify the control. It appears here that term replacement is the crucial rule for termination and that it is sufficient to delay its use until the end, while the mechanism is hidden in the recursive calls in [17] or [16]. Acknowledgement:

I thank Jean-Pierre Jouannaud for his advice on this work.

References [1] A.Boudet. Unification dans les Mdlanges de Thdories Equationnelles. P h . D . Thesis, Univ. Paris XI, Orsay, 1990.

[2] L.

Bachmair, N. Dershowitz, and J. Hsiang. Orderings for equational proofs. In Proe. 1st IEEE Symp. Logic in Computer Science, Cambridge, Mass., pages 346357, June 1986.

[3] A. Boudet, J.-P. Jouannaud, and M. Schmidt-Schau6. Unification in boolean rings and abelian groups. J. Symbolic Computation, 8:449-477, 1989. [4] H.-J. B•rckert. Matching, a special case of unification? J. Symbolic Computation, 8:523-536, 1989.

307

[5] W. B/ittner and H. Simonis. Preprint, Siemens AG, Mfinchen, 1986. Embedding Boolean Expressions into Logic programming. [6] B. Brady D. S. Lankford, G. Butler. Abelian groups unification algorithms for elementary terms. In General Electric Workshop on the Rewrite Rule Laboratory, may 1984. [7] Nachum Dershowitz and Jean-Pierre Jouannaud. Handbook of Theoretical Computer Science, chapter Rewrite Systems. Volume B, North-Holland, 1990. [8] J. Hsiang and M. Rusinowitch. On word problems in equational theories. In Proc. 14th ICALP, Karlsruhe, LNCS 267, Springer-Verlag, July 1987. [9] C. Kirchner. Mgthodes et Outils de Conception Systdmatique d'Algorithmes d'Unification dans les Thdories equationnelles. Th~se d'Etat, Univ. Nancy, 1985. [10] A. Martelli and U. Montanari. An efficient unification algorithm. ACM Transactions on Programming Languages and Systems, 4(2):258-282, 1982. [11] U. Martin and T. Nipkow. Unification in boolean rings. In Proc. 8th Conf. on Automated Deduction, Oxford, LNCS 230, Springer-Verlag, July 1986. [12] J. A. Robinson. A machine-oriented logic based on the resolution principle. Journal of the ACM, 12(1):23-41, 1965. [13] M. Schmidt-Schaufl. Unification in a combination of arbitrary disjoint equational theories. In Proc. 9th Conf. on Automated Deduction, Argonne, LNCS 310, Springer-Verlag, May 1988. [14] R. E. Shostack. Deciding combinations of theories. Journal of the ACM, 31, 1984. [15] M. Stickel. A unification algorithm for associative-commutative functions. Journal of the ACM, 28(3):423-434, 1981. [16] E. Tid6n. Unification in combinations of collapse-free theories with disjoint sets of function symbols. In Proc. 8th Conf. on Automated Deduction, Oxford, LNCS 230, Springer-Verlag, July 1986. [17] C. Yelick. Combining unification algorithms for confined equational theories. J. Symbolic Computation, 3(1), February 1987.

SLIM: An Automated Reasoner For Equivalences, Applied To Set Theory Alan F. McMichael

AT&T Bell Laboratories 480 Red Hill Rd., 1A214 Middletown, New Jersey 07748, U.S.A.

Abstract Human reasoners often use logical equivalences ("if and only if" statements) in a directed fashion, employing them as definitions or in a manner similar to definitions. They use them, almost always, to reason "analytically" from complex, "defined" terms to simpler, "defining" terms. One approach to the problem of automating first-order logical inference is to incorporate this directed mode of reasoning in a modification of linear resolution. SLIM (Simple Logical Inference Machine) is a program that implements this approach. SLIM has been applied to basic problems in set theory, and its performance compares favorably with that reported for other reasoning programs. This result is noteworthy because SLIM exploits only general logical features of the set theory axioms and does not contain any specialized domain knowledge. It is hoped that SLIM's basic reasoning method can be enhanced to yield a powerful inference tool for many domains.

1 Introduction First-order logic, considered as a knowledge representation language, suffers from the continued unavailability of a powerful, generalized inference engine. Comparison with Horn clause logic, which is adequately served by the PROLOG inference engine, suggests that first-order logic's intractability is due to the essential presence of logical negation. A rule for negation can be added to the PROLOG engine; the result is a logically complete scheme of linear resolution. However, in the transition, the directedness of Horn clause inference is lost. Specifically, in Horn clause inference, one must always unify with the positive head of a Horn

309

clause in the database, but no comparable restriction seems possible in the linear resolution context. In human reasoning, guidance is often provided by logical equivalences ("if and only if" statements) employed as definitions or in a manner similar to definitions. Reasoning proceeds, almost always, "analytically" from complex, "defined" terms to simpler, "defining" terms and almost never in the opposite, "synthetic" direction. Thus, one way to attack the problem of automating first-order logical inference is to incorporate this directed mode o f reasoning in a modification of the linear resolution scheme. SLIM (for "Simple Logical Inference Machine") is a program implements this idea. Set theory was chosen as a test domain for SLIM because of its: 1.

Well-Constructed Axioms - On account of its role as a foundation for mathematics, set theory has received intense logical scrutiny. Its axioms meet the highest standards of rigor and utility.

2.

Avoidance of Special Problems of Equality - Special difficulties involving the equality relation (the general "=" relation of identity, not the "if and only i£' relation between truth-values) are ameliorated in set theory, since many of the properties of equality in set theory are deducible from the basic axioms without the use of a substitution rule.

3.

Acknowledged Difficulty - Set theory is known to be a source of difficult problems for automated reasoners, problems whose solution would be of "singular significance" [1].

4.

Power - Since set theory is an adequate foundation for all normal mathematics, it provides an ultimate standard of deductive difficulty.

As we shall see, SLIM's performance in the set theory domain is markedly superior to that of linear resolution. And, although there exist other, special purpose programs that display comparable proficiency ([2], [3], [4], [5]), SLIM is an achievement of a different nature. Unlike the special purpose reasoners, which employ a multiplicity of inference rules and are reminiscent of expert systems, SLIM is based on the single inference rule of resolution. To deal with logical equivalences, it applies a sophisticated control scheme, but one that exploits only general logical features of set theory, not its peculiarities. It is conjectured that this generality will allow SLIM's reasoning scheme to be usefully transported to other domains. SLIM is by no means complete. It lacks a rule for equality and lacks a scheme for utilizing previously proved theorems as "lemmas". Also, the methods that it does have should be improved. However, the implementation of its guiding idea, namely directed reasoning from logical equivalences, is of the highest significance and may already make SLIM worthy of its name.

2 The Problem In the early days of automated reasoning, resolution procedures were employed as theorem provers for mathematical domains. They succeeded in proving some hard basic theorems, particularly in abstract algebra. However, even very simple theorems of set theory were out

310

of their reach. Thus, in a long list of mostly positive results in McCharen, Overbeek, and Wos [6], there occurs a report of a disappointing foray into set theory, An attempt to prove the commutivity of intersection with a hyperresolution theorem prover ended when the program ran "OUT OF 240K OF CORE IN 43.51 SEC." An attempt to prove the commutivity of set union ended similarly. The program ran "OUT OF 240K OF CORE IN 41 SEC." The authors conclude, "These problems are interesting because, although they are simple problems for a mathematician, they ffrove to be difficult for the program." (Incidentally, the difficulty is not solved by the larger "CORE" storage now available. As will be made apparent in the comparisons of section 6, resource needs increase too rapidly with increasing problem complexity.) The problem posed by these simple theorems of set theory can be illustrated using the commmutivity of intersection theorem. The method we shall use is OLRA, Ordered Linear Resolution augmented by resolution with Ancestor clauses. (This is the same as what Nilsson and Genesereth call "linear resolution" [7], but supplemented by the restriction of always resolving against the leftmost tip of the proof tree.) Here are the set theory axioms we need, accompanied by their clausal representation: x -- y if and only if x ~ y and y ~; x --1. x = y =2. x ~ y --3. x ~ y

v x~.y v x~y v y~;x

v yafx

x ~ y if and only if for all z, i f z e

x, t h e n z ~

y

~;1. x ~ y v ss(x,y)~ x ~2, x ~ y v ss(x,y) ~' y ~;3. x ~ : y v z ~ x v z~ y xe y~zifandonlyifx~ c~1. x ~ y c ~ z ~2. x ~ y c ~ z c~3. x ~ ' y c ~ z

yandx~

z

v x~'y v x~z v xe y v x~ z

In the subset axioms, SS(X,y) is a skolem term, that is, a term that is introduced to replace an implicit existential quantifier. Specifically, it follows from the initial "if and only if" subset axiom that either x is a subset of y, or there exists something that is a member of x and is not a member of y. The skolem term is a device that provides, given each pair of sets x and y, a unique tag for this "something" that can be used in inference. An OLRA derivation begins with the negation of the theorem and attempts to reduce all alternatives to contradiction:

311 1. anb ~ b n a

(negated theorem) v

2. a n b g; b n a

3. b n a ~ a r i a

(1,=1) 4. ss(anb,bna) • a n b

(2,c_1) 5. ss(anb,bna) • a

(4,n2)

At this point, the OLRA prover enters a trial-and-error phase. Literal 5 must be matched against an axiom literal of the form "[variable1] g [variable2]". There are three such titerals in the axioms for this problem. In a more complex problem, requiring more set theory axioms, there might be many more. Since OLRA's selection of a match is unguided and since other choice points will inevitably occur in the derivation, there are many ways for OLRA to go wrong and it will do a large amount of backtracking. A competent human reasoner, in contrast, would do no backtracking at all for this problem. The OLRA proof procedure is complete and will eventually find a derivation. The total derivation contains four troublesome choice points.

3 Diagnosis There are but two primitive predicates in the language of formal set theory, namely "=" and "• ". All other items in the vocabulary of set theory, such as "~" and "n" are definable in terms of these. Indeed, the axiom x ~; y if and only if for all z, if z • x, then z • y

is really just a definition of the predicate "~". The situation with the axiom x•

y n z if and only if x • y a n d x •

z

is only slightly different. This axiom defines the symbol "n" and, at the same time, implicitly asserts the existence of an intersection for any given pair of sets. Even the third axiom, x = y if and only if x _c y and y ~; x

resembles a definition of "=" for sets, predicate of set theory. A warning is symbol, then we must have extra set equality substitution rule is not lost.

so that it might be said that " • " is the sole primitive in order, however. If we are to treat "=" as a defined theory axioms to insure that the logical power of the The above axiom does not tell the whole story about

312

equality, even in set theory. Because many set theory axioms have the form of definitions - - logical equivalences in which one side contains "more primitive" vocabulary than the other - - simple problems can often be solved by a routine reduction strategy: Use the axioms in one direction only to reduce all literals in the statement of the problem to a representation in terms of the primitive vocabulary; then apply some brute-force method, such as OLRA or one of the other basic resolution procedures, to derive a contradiction. Sophisticated variants of this strategy may include short cuts, sometimes selecting inferences involving nonprimitive vocabulary in preference to continued reduction. The utility of this strategy is well-known to human reasoners, who employ it both in set theory and other formal theories. Of course, it is not an all-purpose deduction strategy. Some problems cannot be solved merely by tracking down the consequences of definitions. Some problems involve the synthesis of an answer - - a more difficult and creative process. Yet the reduction strategy is a useful basic method, and it is unlikely that we can safely ignore it while pursuing the goal of effective automation of reasoning. (Concerning the theoretical basis of the strategy, see the "Appendix".) In the example above, the reduction strategy would bar the unification of literal 5 with the second literal of axiom n l , because, according to the reduction strategy, only the leftmost literals o f the axioms are available for unification (just as in PROLOG). However, if we are allowed to violate linearity and reach back into the proof tree, then a reductive inference is possible using literal 4 and axiom n3. The result is literal 6:

6. ss(anb,bna)

e

b

(4,r-.3)

In fact, the use of a nonlinear inference at this stage, if permitted, secures two advantages. First, an "obvious" inference is performed rather than an unguided choice that might later have to be undone. Second, by means of this second reductive inference involving literal 4, the entire logical content of literal 4 is exhausted. Literal 4 is replaced by a pair of literals that are simpler in form but collectively equal in content. This has the advantage that literal 4 can be ignored in the remainder of the derivation. How do we know that 5 and 6 are equal in content to 4? We know this because 5 and 6 come from 4 by applying the two clauses that represent the reductive half of the "if and only if" axiom for n . Because the axiom is an equivalence, we know that literal 4 has been transformed into an equivalent form. It is one thing to finger linearity as the culprit, quite another to find an effective substitute for linearity. Observe that once linearity is rejected, many literals in the current branch of a deduction tree may be available for inference. (In the partial derivation above, 2, 5, and 6, are unexhausted and so available.) Some scheme must be developed to select particular inferences from the multitude of possibilities.

313

4 A New Rule For Equivalences And A Priority Scheme SLIM can be viewed as an enhancement of OLRA that incorporates a new control rule for equivalences:

Extension By Conjunct: If an active literal in the current branch of the proof tree matches two or more clauses resulting from the clause translation of an equivalence, then an extension of the tree by means of one of the clauses may be followed by an extension using another. With the new rule, SLIM produces an easy proof of the commutivity of intersection. SLIM follows the reduction strategy, reducing literals to primitive form, and never needs to backtrack for this simple problem:

1. anb ~ bna (negated theorem) 2. a n b ~ b n a

3. b n a ~ anb

v

(1,=1) 4. ss(anb,bcha) E anb (2,~1)

S. ss(ac~,bc-~a) ~' bna (2,c2) 6. s s ( " ) ~ ' b

1 t. ss(bna,anb) E bna (3,~1) t2. ss(bna,anb) ~' ac~b (3,~2)

7. ss(")~Ca

13. s s ( " ) ~ a (12,nl)

8. S S ( " ) E a

10. SS(")E a

(4,n2)

(4,n2)

15. SS(")E b (11,n2)

9. SS( " ) ~ b (4,c~3)

XXX (10,7 ancestorrsl.)

16. SS(")E a (11,n3)

v

(5,c~1)

XXX

XXX

(9,6 ancestor rsl.)

(16,13 ancestor rsl.)

v

14. s s ( " ) ~ ' b 17. s s ( " ) E

b

(11,n2) XXX (17,14 ancestor rsl.)

When the symbol 'SS(")' occurs in a branch, it abbreviates the more lengthy skolem term introduced above it. The X's symbolize contradictions. To reason efficiently with multiple active literals, SLIM applies its resolution steps according to a priority scheme: o Using the literal at the tip of the current branch, check for: - - ancestor resolution (which closes the branch) - - match with a one-literal axiom (which also closes the branch) - - extension by conjunct (the next best thing to closing the branch)

314 • For active literals of the current branch, check for: - - extension of the tree by a multi-literal axiom, one that does not introduce a new free variable into the proof tree - - extension that introduces a new free variable, e. g.:

x~a

acb v xs

b

As explained below, SLIM prefers "fresh" extensions of this sort to "copies". A literal is considered to be active in a branch until its content is exhausted by a match or conjunction of matches using clauses derived from an equivalence. In the proof of the commutivity of intersection above, for example, the content of literal 1 is exhausted in the first step and the content of literal 2 is exhausted by the production of Iiterals 4 and 5. Matches that produce new free variables are responsible for an additional complication. They exhaust the content of a matched literal only temporarily. For instance, "x e( a v x ~ b" exhausts the content of "a ~ b", since it has the meaning, "Everything is either not a member of a or it is a member of b." However, when "x e( a v x E b" occurs in a proof tree, its free variable "x" may become bound to a particular term, such as "c". The resulting clause "c ~( a v c ~ b" is not equivalent to "a ~ b" and does not exhaust its content. Thus, when such a binding occurs, the parent literal "a ~ b" is reactivated, so that an additional clause, such as "y e( a v y ~ b", can be generated in the current branch when needed. Such an additional extension is called a "copy". When SLIM is forced to consider extensions of the proof tree that generate new free variables, it looks for "fresh" extensions before it tries "copies". A final noteworthy difference between SLIM and OLRA concerns the initial setup of proof trees. In the example of the commutivity of intersection, the theorem to be proved consists of a single literal, but this is not generally the case. Consider, for instance, the theorem of the transitivity of subset: If a ~ b and b c c, then a ~ c. Negating this theorem results in three one-literal clauses, "a ~ b", "b ~ c", and "a ~ c", which a resolution reasoner must show are incompatible with the axioms of set theory. These clauses, which come from the theorem, constitute its "set-of-support" [8]. OLRA would begin its derivation by arbitrarily selecting one member of the set-of-support to be the root of its proof tree and relegating the others to the role of axioms. Since SLIM can handle multiple active literals, it can do better. It can begin its proof tree with the conjunction of all three members of the set-of-support: 1. a ~ ; b 2. b c _ c 3. a ~ c

315

SLIM transcends the usual distinction between forward and backward chaining reasoners. It can reason "backward" from "a ~ c" or "forward" from the other two literals, according to its priority scheme. This flexibility has proved highly advantageous.

5 Refinements of SLIM's Inference Mechanism SLIM's basic inference strategy, with its new rule for equivalences and its priority scheme, is augmented by several refinements. They are not as important as the basic strategy, but they do merit a brief description: • Ordering Heuristic: When selecting an active literal for application of an extension rule or when ordering the literals from a match with a clause of 3+ literals, SLIM considers literals according to their "specificity". Literals with no free variables are considered first. Of literals with the same number of free variables, those that are "deeper" in function terms are regarded as more specific. • Repetitions: branch.

SLIM has a rule to prevent the expansion of identical literals in the same

• Irrelevancies: If a literal can be deduced from the axioms of set theory without using any of the special hypotheses of the current problem, then it is marked "irrelevant" to prevent further consideration. (This is an extension of the "set-of-support" idea.) • Cut: When SLIM reaches a point at which no more inferences are possible, it backtracks not merely to the last choice point but to a point that unbinds some variable in the failure branch. (This is named "cut" because it is an automated version of the PROLOG "cut" device. Another possible name is "intelligent backtracking".) • Skip: When a proof tree splits into several branches and the first branch is closed without using its initial literal, then SLIM may skip the other branches. In such a situation, the branches represent an unused case analysis. ° Search Heuristics: The simple set theory problems do not require special heuristics. For more difficult problems, various search bounds have been tried, such as depth bounds and bounds on the number of copies permitted in a branch. More work is needed in this area.

6 SLIM's Performance On Some Problems To provide a baseline for relative performance judgements, an equally sophisticated version of OLRA was developed in parallel with SLIM. As the following graphs show, SLIM handily outperformed it on problems in the domain of interest:

316 OLRA vs. SLIM

Commutivity of Intersection

Transitivity of Subset 10-

100 inferences

-

20 -

100-

10-

seconds

5-

50

200 -

"Schubert's Steamroller"

Associativity of Intersection 20k-

1--I

10k-

lk

5k

.Sk

'Z 10k

'Z

1

// f/ //

Z // // //

"/ // // // // // // // // //

_ _

(82)

(10)

SLIM's slightly poorer performance in the "Schubert's Steamroller" problem is explained by the fact that the reduction strategy is not available in the context of this problem's artificial axiom set [91. The version of SLIM used in the comparison did not have a full set of refinements. The ordering heuristic and simplified repetition and cut rules were implemented, but not the irrelevancy and skip rules. The version of OLRA used in the test shared the same capabilities. The inference times for both programs are large because they are symbolic interpreters and because the comparison was done on a PC. SLIM also solves more difficult problems in set theory. Some examples: infs in total solution infs BLEDSOE PROBLEM P(a) c~ P(b) = P(ar~b) 39 202 PASTRE PROBLEM If a ~ b, a ~ b, b c_ c, then a ;e c 16 22 POWER SET OF SINGLETON Find x and y in P({a}) such that x ~ y 21 72 DOUBLETON SETS {a,b} = {a,c} if and only if b = c 246 1872 ORDERED PAIRS { { a } , { a , b } } = { { c } , { c , d } } if 4580 385328 and only if a = c and b = d

317

The first of these problems is cited in "Non-resolution Theorem Proving" [2] for its resistance to resolution proof techniques. SLIM succeeds in solving the problem and SLIM is a resolution reasoner - - although one of a sort Bledsoe did not have in mind. The second problem is one that a non-resolution theorem prover of D. Pastre failed to solve [3]. It illustrates one of the dangers of departure from resolution techniques. Resolution is the basis of simple, logically complete proof methods. If we move away from it and towards complex sets of rules tailored to specific problems, then completeness may be lost and "blind spots" may appear. Pastre's problem is an example. It is logically simple and SLIM solves it easily. In the set theory problems discussed so far, SLIM is able to construct proofs directly without backtracking. However, for the last three problems shown in the table, SLIM's reduction strategy remains adequate and useful, but it does not preclude the need for trial-and-error search. Also, these problems exercise the complete set of inference refinements. Problem three shows that SLIM can solve a problem that requires the return of an answer. Problem four, the doubleton sets problem, is described as "difficult" in Suppes [10]. I would not call it difficult, but certainly it is tedious, requiring many inference steps. The ordered pairs problem is so tedious that it truly is difficult. F. Brown cites it as a challenging problem solved by his automated reasoner. SLIM appears to solve it, although the proof is so long that I have not attempted to verify it by hand. One reason the proof is so long is that SLIM has no substitution rule for equality. Thus, one half of the theorem, the "if' half, which is elementary given a substitution rule, must instead be proved from the basic set theory axioms. This is possible, but SLIM required 300,000 inference steps to do it! The other half of the theorem, which also has a lengthy proof, required "only" 85,000 inferences.

7 Conclusion SLIM achieves its basic objective in the selected domain of set theory. It is able to handle routine inference problems using the reduction strategy. Unlike linear resolution, it makes good use of "if and only if" axioms. However, there remain areas for improvement both in relation to its basic objective and in relation to its suitability for more ambitious automated reasoning projects. First, experience has shown the need for additional refinements of SLIM's basic inference mechanism. Although existing refinements significantly prune SLIM's search space, SLIM still searches many paths that human reasoners know to avoid. Codifying this human knowhow is a difficult task requiring careful examination of lengthy proof trees. It is very easy to misstate the rule that a human would use at a particular stage in a proof, hence much experimentation and testing is needed. The existing refinements for repetition and irrelevancy exemplify the difficulty. Much effort was expended in correcting initially plausible but faulty versions of these rules. Second, as stated above, SLIM lacks a substitution rule for equality. This simplified the development of SLIM, but certainly a substitution rule must ultimately be incorporated. Otherwise, many problems, particularly in mathematical domains, will remain beyond SLIM's reach.

318

Third, SLIM is currently able to reason only in terms of primitive axioms of set theory. It makes no use of previously proved theorems as "lemmas" in the construction of new proofs. Obviously this approach must be modified if SLIM is to tackle new problems in an efficient manner. There is no sense in constantly reproving known facts. A particularly blatant example of such inefficiency is SLIM's check for irrelevancy. The irrelevancy check eliminates from proof trees such literals as "a ~ {a}", "b ~ {b}", "a ~ a", and "b = b". SLIM returns to the basic axioms of set theory to prove these, but it would be far more efficient to store the constantly recurring forms that are already known to be provable. Finally, SLIM always proceeds analytically using the reduction strategy. This is acceptable in view of its basic goal of competent, routine reasoning. However, this does mean that SLIM is forever barred from the construction of "synthetic" proofs, proofs that require the creative discovery of some special object. An example is the proof of Cantor's Theorem, the theorem that the power set of a set cannot be mapped one-to-one into the set. The proof of this theorem begins with the assumption of its negation. That is, suppose that there is a one-toone function i from P(a) into a:

{x: x

f-l(x)}

Cantor produced a contradiction by considering a special subset of a, namely, the set of all members x of a such that x is not a member of the set that f maps to a. Certainly SLIM could not discover such a set and produce the contradiction merely by pursuing the reduction strategy. Of course, this is not a shortcoming peculiar to SLIM. It is not clear how to automate Cantor's discovery using any existing approach. (But see Andrews [11].) This is definitely an area for further research. Another area for future work concerns the applicability of SLIM to other domains. SLIM's inference mechanism is designed for general use. A guiding conjecture is that more effective knowledge representations can be developed for many domains if there exists a capability for reasoning efficiently with definitional hierarchies and their associated logical equivalences. This conjecture needs verification. Some studies should be done for less abstract domains than set theory.

319

Acknowledgments I am grateful to Paul H. Callahan, David E. Leasure, and John Roach for their help in reviewing this paper.

Appendix: Theoretical Basis of the Reduction Strategy The essential idea of the reduction strategy is to use logical equivalences in one direction only to eliminate certain symbols from the formulas Qccurring in a proof and to complete the proof using the reduced formulas. What we want to know from logical theory is whether working with the reduced formulas is in fact equivalent to working with the originals. This question can be investigated in the context of a fairly rich system of first-order logic, one in which logical equivalences can be represented in single statements using the biconditional symbol, ~--~. It is assumed that this system is one for which proofs and derivations are simple sequences of statements (as opposed to one that involves trees, tableaus, or assumption boxes). The results proved under these assumptions will hold for any adequate system of first-order logic. Many set theory axioms, such as the union and intersection axioms, have a typical form:

(v)(gl)...(tJ, n) (v ~ 5(p, 1

....

,gn) ~

~V'#l ..... #n

)

The result to be proved will pertain to axioms of this form, but a similar result holds for axioms of slightly different form, such as the subset axiom (that axiom "defines" a relation, as opposed to a function). Let A be an axiom of the above form and let T be a collection of set theory axioms that do n o t contain the fimction symbol & Corresponding to A is a transformation rule that replaces formulas matching the left side of A with formulas matching the right side. Let F be a set of formulas that can be transformed by means of this rule into another set of formulas, F', none of which contains the function symbol 5. Let 13 be an individual formula that can be similarly transformed. (In all of our "analytic" set theory problems, the premises and conclusions of the problems can be transformed in this manner.) It can be proved that: B is derivable from F in theory T+A if and only if B' is derivable from F' in T. Proof: ---~. Let D be a derivation of B from F in "I-+A. Observe that the transform of every logical inference rule used remains a valid logical inference rule. Observe also that the transform of axiom A is a logically provable formula so is clearly provable in the theory T. Thus, corresponding to derivation D is a derivation D' of B' from F' in T. Simply replace each formula in D by its transform. Then, replace each occurrence of the transform of A with the sequence of formulas that constitutes a proof of the transform in T. The final result is the desired D'.

320

~---. By the theorems of completeness and consistency for the underlying system of first-order logic, it suffices to show that if B' is a semantic consequence of F' in theory T, then B is a semantic consequence of F in theory T+A. Suppose, for a proof by contraposition, that 13 is not a semantic consequence of F in theory T+A. Then there exists a T+A-model M of F and -13. But since the underlying logic is complete, the formulas in F' can be derived, using A, from the formulas in F. Similarly, -13' can be derived from - B . Because the logic is consistent, relations of semantic consequence also hold. Therefore, by the transitivity of semantic consequence, M must also be a model for F' and - B ' . It follows that 13' is not a semantic consequence of F'. (End of Proof) Under the assumptions of the theorem, axiom A can be applied solely as a reduction rule without affecting the existence of a derivation, which is the result desired. All that remains is to determine, by inspection, that the assumptions of the theorem in fact hold for the problems attacked by SLIM. Of course, the theoretical result does not guarantee that the algorithm used by SLIM is logically adequate or computationally efficient! What it does show is that certain problems can be solved by the method SLIM is intended to implement.

References [1]

Wos, Larry, Automated Reasoning: Thirty Three Basic Research Problems, PrenticeHall, Englewood Cliffs, New Jersey, 1987.

[2]

Bledsoe, W. W., "Non-resolution Theorem Proving," Artificial Intelligence Journal 9 (1977), 1-35.

[3]

Pastre, D., "Automated Theorem Proving in Set Theory," Artificial Intelligence Journal 10 (1978), 1-27.

[4]

Brown, F. M., "Towards the Automation of Set Theory and Its Logic," Artificial Intelligence Journal 10 (1978), 281-316.

[5]

Pastre, D., "MUSCADET: An Automated Theorem Proving System using Knowledge and Metaknowledge in Mathematics," Artificial Intelligence Journal 38 (1989), 257318.

[6]

McCharen, J., Overbeek, R., and Wos, L., "Problems and Experiments for and with Automated Theorem-Proving Programs," IEEE Transactions on Computers C-25 (1976), 773-782.

[7]

Genesereth, M., and Nilsson, N., Logical Foundations of Artificial Intelligence, Morgan Kaufman, Los Altos, Califomia, 1987.

[8]

Wos, L., Robinson, G., and Carson, D. "Efficiency and Completeness of the Set of Support Strategy in Theorem Proving," Journal of the Association for Computing Machinery 12 (1965), 536-541.

321

[9]

[10]

Cohn, A. G., "On the Solution of Schubert's Steamroller in Many Sorted Logic," Proceedings of the Ninth International Joint Conference on Artificial Intelligence 1988 (Los Angeles, California), 1169-1174. Suppes, P., Axiomatic Set Theory, Van Nostrand, Princeton, New Jersey, 1960.

[11] Andrews, P. B., "Theorem Proving via General Matings," Journal of the Association for Computing Machinery 28 (1981), 193-214.

An Examination of the Prolog Technology Theorem-Prover Mark Tarver m a r k ~ u k , a c . l e e d s , des Division of Artificial Intelligence University of Leeds

Abstract The Prolog Technology Theorem Prover (PTTP) is one of the fastest theoremprovers built. Howevcr its speed does not compensate for its lack of control. By embedding the P T T P in an environment which allows the use of meta-level inferencing it is possible to grcatly improve performance. The TPL theorem-prover is a refinement based ATP system which incorporates a version of the PTTP. Keywords: P T T P , refinement, metalevel reasoning, Prolog Normal Form. The

Limitations

of the

PTTP

In 1984 Mark Stickel proposed that the technology used to develop fast implementations of Prolog, could be applied to production of a near-Prolog theorem-prover, the Prolog Technology Theorem Prover ( P T T P ) . Using Prolog compilation techniques in conjunction with model elimination resolution, Stickel (1986) built a version of the P T T P in Lisp that ran at 5000 LIPS on a Symbolics 3600 Lisp Machine. In 1986 an NLP project was begun at the University of Leeds involving a large amount of first-order reasoning in a first-order knowledge base of over 90 axioms on speech-act theory. Experience with the theorem-provers described in such introductions as Chang & Lee (1973) and Nilsson(1980) 1 showed that they were incapable of deriving solutions to speech-act problems in any reasonable time. A version of the P T T P was built to meet this problem and the result, T H O R N (Theorem Prover Based on HORN Clause Logic), successfully met the requirements of the project. Subsequent to this early success, T H O R N was tested on a portion of naive set theory (Fig 1). Surprisingly T H O R N often struggled with problems that were mathematically trivial to solve, despite the fact that the axiom base was much smaller than that of the NLP project. Further analysis showed why this was. *This research was supported by SERC grant GR/F/07866 under the heading Computer Assisted Formal Reasoning, title "Proof Development For Formal Systems" led by Professors R. Burstall and R. Milner. 1Specifically, set of support, unit preference and unrestricted linear resolution.

323

Fig. 1. A P o r t i o n of Set T h e o r y

1) (v x) (4 (x e 0)) 2) 3) 4) 5) 6) 7) 8)

(v x,y) ((x C. y) ~-* (V z) ((z e x) --~ (z e y))) (V x,y)(((x C y) ~ (y C__x)) ~ (x = y)) (V x,y,z) (z = (x U y) +=+ (V w) ((w e z) ~ ((we x) v (we y)))) (V x,y) ((x = P y) ~-~ (V z) ((z e x) ~-~ (z C y)))))) (v x,y,z) (~ = (x n y)) +-+ (v w) ((w ~ z) ~ ((we x) ~ (w~ y))) (V x,y) (x = y') ~ (V z) ((z e x) ~ (-1 (z c y))) (V x,y,z) x = ( y - z) ~-~ (V w) ((w e x) ~-~ ((w e y) ~ (-1 (w~ z))))

Structure

n o t S i z e is I m p o r t a n t

Conventional expert systems written in Prolog generally take the form of a collection of rules and a collection of facts. A typical query to such an expert system will mediate its reply through backward chaining from the problem via the rules to the facts provided. Such systems can be very large, but nevertheless efficient. The reason for this efficiency is the structure of the call g r a p h associated with the expert system. A call graph is a directed graph that shows the call-relations between the procedures of the system so that if two nodes A an B of the graph are connected as so:A

~B

then there is a Horn-clause in the system of the form (A tl,...ti) +- ...,(B tl,...,tj),.... The call-graphs of Prolog expert systems tend to approximate to trees. The leaves of the tree correspond to the procedures that are associated with facts, since these procedures do not invoke any others. Prolog programs with this structure are bound to terminate. If a Prolog procedure can invoke itself, then in all probability the procedure is a recursive procedure and the recursion bottoms out when the base condition is reached. Some simple first-order theories (like the speech-act knowledge base of our introduction) have call-graphs which approximate pretty well to those of Prolog expert systems. Not surprisingly the PTTP scores well on problems with this sort of axiom base. However axiom systems from mathematics, though much smaller, have a very different structure. Their call-graphs are extremely cyclic and the cyclicity is not bounded by any wellfounded relation terminating in a base case. For this reason, mathematical theories, unlike expert systems, have no explicit control Structure. For example, the eight axioms of fig t. generated 99 contrapositive rules of inference. The associated call-graph of these contrapositives is:-

324

Fig. 2. T h e Call G r a p h for some Basic C o n c e p t s o f Set T h e o r y

DIFFERENCE

INTERSECTION

~ ~ . . . ~

~

y

~ MEMBER

COMPLEMENT

~

POWERSET

*

SUBSET

EQUAL

The graph is highly cyclic, with MEMBER being the focus of the cyclicity. The typical behaviour of THORN confronted with a simple problem (eg that UNION distributes over INTERSECTION) was to cycle through this graph until the MEMBER node was reached; after that THORN wasted a lot of time with bizarre configurations involving POWERSET, INTERSECTION and SUBSET etc. Amongst this set of contrapositives there are no less than 14 contrapositives headed (MEMBER x y) *-- .... leading off to various destinations. Significant theorem-proving became impossible. 2 The PTTP

has no idea of Relevance

The PTTP shows a steady depreciation in performance as irrelevant axioms are added to its knowledge base. The table below shows the decay in performance for a current implementation of the PTTP as new and irrelevant axioms are added to the axiom base when trying to prove a theorem. The theorem proved is that if V = 0' and V N a = V then V = a. This has a 14 step proof in the PTTP and is provable from axioms 1,2,3,4 and 6. These timings were gained on a SUN3/80 running Kyoto Common Lisp using incremental depth first search. Fig. 3. Axioms A d d e d

Time

Inferences

1,2,3,4,6. + 5. + 7. + 8.

97.900s 186.200s 233.067s 287.733s

8,459 15,223 19,345 23,836

2It is likely t h a t a n i n v o c a t i o n of R o b i n s o n ' s P u r i t y P r i n c i p l e w o u l d h e l p t h e P T T P to s o m e extent: allowing it to reject s o m e a x i o m s w h i c h c a n n e v e r figure in a d e r i v a t i o n . How effective it w o u l d b e in c u r b i n g t h e p r o b l e m of r e l e v a n c y m e n t i o n e d in t h e n e x t s e c t i o n w o u l d h a v e to be d e t e r m i n e d experimentally.

325

Mathematics

is n o t

Chess

The machine on which these figures where gained was a SUN 3/80 - a conventional workstation with a Von Neumann architecture. The best speed for FOL problems (search to depth 10) on a SUN 3/80 was only 200 LIPS. The P T T P was conceived to be an engine that would run far faster than this; and it might be thought that with much greater speeds produced by better hardware the problems facing the P T T P could be defeated. A beguiling comparison offered by Stickel(1984) was that the P T T P could be conceived of as an analogue to the powerful chess machines which are hardware-designed to search game trees at high speed. This is an attractive thought because the current speeds of the best Prolog compilers on our best machines do compare to the speeds of the latest chess machines. For example Deep Thought, a chess machine from M.I.T., runs through about 750,000 board positions per second. A Prolog compiler in Komatsu et a1.(1986) runs at 1 M E G A L I P on an IBM 3090. Deep Thought plays grandmaster chess by brute force, so couldn't the P T T P do mathematics by brute search? Unfortunately promise does not match performance; as a thought experiment we can imagine a 'super' P T T P running on a 1,000 processors each 10 times faster than the Motorola 680030 of the SUN3/80. With a branching rate of about 3 for our axiom set, all 1,000 processors would be engaged in search after reaching depth 10. Thereafter each processor would work 10 times faster than the 680030, but the search would no longer be parallel to the same extent. In short, this super P T T P would experience difficulties about 10 depths beyond the depth at which the 3/80 P T T P begins to falter. In that case the super P T T P would start to lag between depths 20-30. But the significant theorems of set theory lie far beyond this bound, and use far more axioms than our eight axiom set. 3 The flaw in Stickel's analogy is that in chess the computer can simply refuse to search beyond a certain number of plys. In mathematics all proofs have to played down to a final Q.E.D. Without some means of controlling search and abstraction, the P T T P is effectively limited in the problems it can tackle. If Deep Thought had to reason to a conclusive winning position in order to make a move, then it would be in a similar position to the P T T P . It would be able to win a game provided it was half a dozen moves from mate. These considerations suggest that efforts to improve the performance of the P T T P by running it in parallel, (Bose et al. (1989)), though interesting, are not in themselves going to solve the combinatorial problems posed to the P T T P . Parallelism is less likely to make a profound contribution to automated deduction than it is to machine chess. Programming

the

PTTP?

One way of challenging these vast search spaces is to allow the user to program the P T T P . But it is difficult to interact with the P T T P at an object level because object-level resolution proofs are often difficult to follow and users' intuitions are often confounded. The solution adopted in the T P L 4 was to conduct proofs at a metalevel, and so send subproblems down to the P T T P at an object level, when these problems were sufficiently simple to be solved by the P T T P . Instead of compiling a mass of largely irrelevant axioms 3For example, see the challenge problem in chapter 6 of Wos[1989] concerning homomorphlsms, which completely defies our PTTP. 4Theorem Proving Laboratory

326 into code, the axioms needed to solve the problem are decided at the metalevel and sent to the P T T P at run-time for compilation into efficient code. Mediating between the metalevel and the object level in T P L is a third, intermediary level represented by a piece of software called the preprover. The preprover's task is to interpret problems handed down from the metalevel into a form which the P T T P can solve. Occasionally the preprover can solve problems itself without calling upon the P T T P and in those cases it does so. The

Metalevel

Proofs conducted in the TPL metalevel are refinement proofs in the manner of NuPrl (Constable et al. (1985)) and related systems. A refinement problem in T e L has the form < < m e t h o d > >. The <method> is the method that the user wished to be invoked on the problem, the is the immediate problem to be solved and the is the set of assumptions from which to solve it. After a method is invoked the theorem-prover backward chains in search of a solution. The user has the ability to make the theorem-prover display its reasoning and halt after each step. In order to conduct proofs in this manner, the user simply types ( i n t e r a c t <procedure1> . . . < p r o c e d u r e , , > ) . Thereafter the theorem-prover will display its reasoning whenever any of the listed procedures is called. A break package is supplied to enable the trace to be disabled and inferences can be skipped by an auto command that tells the theorem-prover to return after having made a specified number of inferences. Traced procedures also leave behind a proof record which can be consulted at the end of a successful search and proofs can be dumped to text files and laser-printed. A facility exists for inserting natural language comments into meta-level control programs. After the conclusion of a successful proof attempt, these comments will be used in the production of a proof. Untraced procedures leave no proof record. Metalevel

Languages

of TPL

T P L currently runs on Kyoto Common Lisp, and at the outset of the project it was intended that Lisp be the control language of the TPL metalevel. However Lisp proved to be too low-level for the purposes of directing the P T T P and two control languages emerged. Both these languages came from differing operational interpretations of the virtual machine SLAM 5 used to define the PTTP. The first, Backlog, supports backtracking like Prolog, but unlike Prolog, patternmatching functional expressions within Backlog clauses are evaluated and this process replaces unification as the means by which lists are composed and dissected. A further reinterpretation of the operational semantics of SLAM issued in a second language - a pattern-matching functional variant of Lisp called R a t i o n a l Lisp designed to facilitate rewriting in first-order logic. In consequence of this design, the same virtual machine that drives the P T T P also drives the control languages that enable it to be used effectively. The compactness of Rational Lisp and the code sharing induced by running the implementation from 5An acronym for Sorted Logic A b s t r a c t Machine. It is intended that the P T T P in TPL will run on many-sorted logic.

327

one virtual machine means that the implementation is very compact (< 3000 lines of machine-generated code). Rewriting

in TPL

Mathematicians make extensive use of rewrite rules in performing proofs. Typically rewrite rules can be used to reduce an expression given either an equality or an equivalence. In T P L , concepts that are to be subjected to rewriting are declared as abstractions at a metalevel by the directive ( a b s t r a c t i o n s f u n c l , . . ~ func,~). Once a concept is entered as an abstraction, the rewrite rules associated with it are entered in the form of a Rational Lisp function that defines how uses of the concept are to be treated. T h e abstraction facility is coupled to a set of higher-order rewrite functions 6 that are part of the T P L system. These are ( r e w r i t e < e x p r > ) , which takes an < e x p r > and replaces each abstraction in it according to the associated rewrite rules, ( r e w r i t e b y < a b s t r > < e x p r > ) which replaces all occurrences of < : a b s t r > in < e x p r > by their rewrite equivalents, and ( f i x r e w r i t e < e x p r > ) which rewrites all abstractions to their fixpoint. The function r e w r i t a b l e ? is a recogniser for an expression which can be reduced by a rewrite rule. The

Preprover

The preprover is a preprocessor for translating metalevel problems into a form suitable for the P T T P to solve. The preprover can also be thought of as a weak theorem-prover since it can occasionally solve problems without appeal to the P T T P . The task of the preprover is to put refinement problems in first-order logic into P r o l o g N o r m a l F o r m . The idea of the reduction to Prolog Normal Form is that we want a goal to consist of a conjunction that will form the basis of the goal stack of the P T T P . When a goal is in PNF, the" corresponding goalstack can be elicited by removing the conjunction signs and forming the remainder into a list of literals. These literals can then be signed, thus eliminating any use of the negation sign and the context compiled into Lisp. From that point the mode of execution is that of the P T T P . The recursive definition of Prolog Normal Form is as follows:1. Any literal is in Prolog Normal Form. 2. If A is in PNF and B is in PNF then A & B is in PNF. 3. (Closure) If a wff A is not in PNF by 1-3 then A is not in PNF. Reduction

to PNF

in the

Propositional

Calculus

In the course of reducing a refinement problem to Prolog Normal Form, the preprover often divides the original problem into subproblems. This strategy of division helps to make problems more tractable. The process of reduction is similar to Bledsoe's (1971) S P L I T subroutine in his P R O V E R ATP, with the addition of an important non-deterministic rule regarding implication. 6Compare Paulson(1985).

328

The refinement rules which drive the reduction to PNF in the preprover are as follows:R u l e s f o r R e d u c t i o n to P N F in t h e P r o p o s i t i o n a l Calculus A, A k A

At- (A~B) AU{A}FB

AF,,,,(A--,,B) AU{~B} F-~A

A b (A V B) A k (--, A --. B)

A k --, -~ A At-A A k -~ (A V B) Ak-~A&-~B

Ak(A&B) AkA, A kB

A b(A ~ B) A k (A --+ B), A t- (B --* A)

A k -1 ,,,,(A --. B) AF (A&-~B)

A k -, (A & B),,, Ak (-~AV-~B)

(, ,A, B) Ak (A&-~B) V(B&-A)

These rules are all deterministic save the two which deal with a goal of the form (A B). In one case the strategy is to assume A and prove for B; in the other to assume -~ B and prove for -~ A. The preprover is written in Backlog so that if the first strategy fails the second is attempted. The reason for this pair of non-deterministic rules is that the P T T P is incomplete. Given a goal and an inconsistent set of axioms the P T T P may fail to derive a solution. 7 The simplest case is the problem P & -~P k Q. If P and -~P are compiled into code and Q is attempted the search will fail. Not infrequently, the P T T P is passed refinement problems which have this form (i.e. the context is inconsistent) and in such cases by adopting the alternative treatment of (A ~ B) the problem can be solved. A simple example is the problem P ~ (P V Q). A search tree of the problem shows how the nondeterministic treatment of --* plays an essential part in deriving a solution.

rlrt accounts of the P T T P written by Stickel(1988) and by Warren & Maier(1988), no mention is made of this incompleteness and b o t h authors state t h a t the P T T P is complete. They were presumably thinking of cases where the axiom base was consistent.

329

Derivation

o f P --* ( P V Q ) b y t h e P r e p r o v e r F P ~ (P V Q)

PFPvQ

P F "~P --* Q

P -~P F- Q

II

P -~Q f- -~-~p

L

P, --,Q b- P

[]

It is easy to see t h a t the r e d u c t i o n rules g i v e n a b o v e 8 are t e r m i n a t i n g , since they reduce the size of the goal. A p r o o f t h a t they t e r m i n a t e in a f o r m u l a in Prolog N o r m a l F o r m is essentially s t r a i g h t f o r w a r d b u t r a t h e r long. 9 Sin the actual implementation I also use the rule (A v B) ---* C there]ore (A -* C) & (B ~ C) as a means of splitting up problems 9Essentially a reduetio. We assume that the process terminates in a formula not in PNF and show that it must fall into one of a finite number of cases. We then show that for each case there must be an applicable reduction.

330

Reduction

to PNF

in the

Predicate

Calculus

In THORN, arbitrary first-order formulae that could not be immediately expressed as a series of Prolog goals were dealt with by what was called the "Fido" method. The method was to dicharge a proof obligation to prove P from a set of assumptions A, by proving that A,p --+ FIDO }- FIDO, where FIDO is an arbitrary proposition. The idea is that since the only information that the P T T P possesses about FIDO is that FIDO is provable from P, a proof of FIDO is ipso facto a proof of P. Since FIDO is a simple literal, it can be directly expressed as a Prolog goal. Though the "Fido" method is quite sound it is also highly unnatural. Certain formulae require the "Fido" treatment, but many first-order goals can be treated more naturally by decomposing them according to an effective procedure which we outline below. To simplify the account of the reduction of a predicate calculus formula to Prolog Normal Form, we will assume the formula has been placed in prenex form.

1. P = QlVl, ...,Q,~v,~O and P is in prenex form. 2. Working from left to right until either 0 or an existential quantifier is encountered, transform P by eliminating each P1 = Vvi, Qi+lVi+l, ..., Q,~vnO in favour of P2 = Qi+lvi+l,..., QnvnOv,/t where t is an unused name and vdt indicates that t replaces vi in all occurrences. This step reflects the well-known rule that one proves a universally quantified formula by proving for an arbitrary case. 3. Let R be the resulting formula. Either R is in Prolog Normal Form or it is not. If it is then it may be transformed into a Prolog goalstack by eliminating the conjunction signs. Suppose then it is not in Prolog Normal Form. In this case it falls into one of 3 cases. 4. It contains no quantifiers. In that case it can be dealt with by the rules for reduction to Prolog Normal Form in the Propositional Calculus. 5. The matrix of R is not in PNF and all quantifiers are existential, then we convert the matrix into disjunctive normal form so that R becomes R' = (3v), ..., QnvnAvB and distribute the existential quantifiers over the disjunction. This process is repeated on A and B if necessary until all matrices are in Prolog Normal Form. 6. The matrix of R is in Prolog Normal Form, but there are intervening quantifiers. Here the technique is to skolemise the formula, but with the rules for the skolemisation of bound variables reversed. The rationale for this approach is based on the standard approach for proof by resolution. Given a formula to prove, negate it and prove a contradiction. Negating R and driving the negation sign inwards reverses the quantifiers and leaves the negation sign dominating a matrix which is in Prolog Normal Form. If the result is then skolemised, the negated matrix -~ 0 is left. Expressed as a Prolog-style goal this becomes ~ 0. Reversing the rules for the skolemisation of bound variables is a convenient ellipsis of this procedure. 7. The matrix is not in Prolog Normal Form and there are universal quantifiers in the scope of existential ones. Then the formula is a "Fido" formula which is dealt with by the Fido method. 1° 1°Use of the Fido method is relatively rare. One possible alternative to the Fido method would be

331

In the actual implementation, the conversion to prenex form is demand-driven (i.e. the preprover does not convert to prenex form unless it seems required, as with multiple mixed quantification). In m a n y cases it proves unnecessary to convert to prenex form since working in and replacing V signs by skolem constants is often sufficient to reduce the goal to a set of goals in Prolog Normal Form. Conversion

to Prolog

Normal

Form

Loses

Completeness

T h e preprover + P T T P is not complete for two reasons. 1. If the initial context is inconsistent, then the preprover m a y return a ao for the same reasons as the P T T P itself. 2. Typically the preprover m a y call the P T T P several times in the course of a single proof. Calling the P T T P with a problem t h a t is insoluble and sends it into an endless search m a y forstall a solution t h a t would have been gained if the preprover had chosen another node in the search space. The

PTTP

in TPL

T h e P T T P in T P L is substantially that of Stickel with certain design and implementation changes. The goal stack is maintained destructively as a side-effect of successful unifications of the heads of clauses, backtracking, ancestor resolution and loop detection. Unlike Stickel's P T T P there is no incrementally bounded search; but the user can specify in advance the depth to which he wishes the search to go. Facility exists for interactively tracing the P T T P and giving yes-no directives to it. When the P T T P is called by the preprover, the context of the problem is compiled into code and the goal becomes the basis of the stack. Clauses are compiled to favour unit-preference resolution. A Theorem

Prover

for Basic

Set Theory

in TPL

Since it was some basic problems in set theory that first showed the weaknesses of the P T T P , a natural first test for the system was to specify a theorem-prover in T P L which could solve those same problems from the same axiom base. Z e f f was a simple T P L p r o g r a m of only 30 lines in which these axioms formed a knowledge base.

to strip the existential quantifier away from a Fido formula creating a free variable, and decompose the matrix by the preprover procedure, trying to solve whenever possible, by metalevel techniques. When a goal is solved, any binding for any free variables would have to be transmitted into the remaining goals. This would be a sort of "meta-Prolog" way of dealing with Fido formulae that would probably be much more effective than the Fido method.

332

Code for Zeff ; ZEFF: A THEOREM PROVER FOR BASIC SET THEORY (abstractions == mem subset) (deflog Zeff x y [mem "x y]]])) (defrl mem X [union y Z] -> [[mem x y] v [mem x z]] x [inter y z] -> [[mem x y] & [mem x z]] x [dill y z] -> [[mem x y] & [" [mem x z]]] x [compl y] -> [" [mem x y]] x [powerset y] -> [subset x y] x y -> [mem x y] )

T h e procedure Zeff follows is to receive a refinement problem and add the definition of the e m p t y set as an axiom; the problem is then handed to Zeffl for solution. Zeffl checks to see if there are any abstractions in the problem t h a t can be rewritten. If not, then the problem is treated as a first-order problem and the preprover procedure is invoked. T h e < - - is the Backlog cut so Zeffl is committed to this choice. If the goal is conjunctive, Zeffl splits the problem into its parts. Again the < - - is used as a cut to c o m m i t Zeffl to this choice. If there are abstractions to be rewritten, then the expansions are made and the results sent to the preprover to solve. If the preprover fails then Zeffl is reinvoked over the rewritten forms. The process continues until either a solution is found, or all abstractions are fully rewritten, in which case the proof a t t e m p t fails. Unlike T H O R N , the concepts of union, intersection and so on, are not entered as formulae in first-order logic. Instead they are entered as abstractions, and their meaning is explained in RationM Lisp. This t r e a t m e n t gives Zeff the ability to pull in just the

333 i n f o r m a t i o n r e q u i r e d to solve t h e p r o b l e m w i t h o u t g e t t i n g b o g g e d d o w n in u n n e c e s s a r y search. Since we are free to define o u r own n o t a t i o n , union, i n t e r s e c t i o n a n d o t h e r o p e r a t i o n s h a v e been defined as f u n c t i o n s r a t h e r t h a n as p r e d i c a t e s , following t h e u s u a l m a t h e m a t i c a l p r a c t i c e . T h e a b s t r a c t i o n s are l i n k e d to the t o p - l e v e l B a c k l o g clause Zeff b y t h e r e w r i t e f u n c t i o n which tells t h e T P L i n t e r p r e t e r t h a t all t h e a b s t r a c t i o n s in t h e c o n t e x t a n d t h e goal a r e to be r e w r i t t e n i n t o t h e i r i m m e d i a t e c o n s t i t u e n t s . D e s p i t e i t s v e r y s m a l l size, Zeff can p r o v e t h e o r e m s o f a s t a n d a r d a s s o c i a t e d w i t h d i s c r e t e m a t h e m a t i c s courses for first y e a r s t u d e n t s in c o m p u t e r science a t a s p e e d which is c o m p e t i t i v e w i t h results g a i n e d b y P o t t e r & P a i s t r e (1988) using t h e i r r e w r i t e s y s t e m 11 T h e t a b l e o f results b e l o w gives Zeff's t i m i n g s on s o m e s t a n d a r d i n t r o d u c t o r y p r o b l e m s a g a i n s t r u n n i n g those s a m e p r o b l e m s b y raw o b j e c t - l e v e l search on t h e P T T P using t h e " F i d o " m e t h o d in c o n j u n c t i o n with i n c r e m e n t a l d e p t h - f i r s t search. I t a l i c i s e d figures are Zeff's t i m i n g s , while R o m a n figures are those of t h e r a w P T T P . All figures were g a i n e d on a S U N 3 / 8 0 r u n n i n g K y o t o C o m m o n Lisp. Comparative Performance of Zeff and THORN on some problems from set theory. Key: Th Time Mlnfs Oinfs TLP LMP LOP Speedup

Theorem. T i m e t a k e n to solve t h e p r o b l e m (sees). 12 N u m b e r of m e t a l e v e l inferences t a k e n to o b t a i n an answer. N u m b e r of o b j e c t level inferences t a k e n to o b t a i n an answer. T o t a l L e n g t h of Proof. L e n g t h of M e t a l e v e l Proof. 13 T o t a l L e n g t h o f O b j e c t Level Proofs. 14 P T T P t i m e d i v i d e d b y Zeff t i m e .

Problems

1. pow rs t(a, b)

(0 a)

2. a U a = a

3.

,- (a = o)

4. c-(aUb) C ( c - a ) n ( c - b ) 5. c -

(a u b) = (c - a) n (c - b)

6. c-(ar'lb) C ( c - a ) U ( c - b ) 11This is certainly true if flxrewrite is used in place of r e w r i t e in Zeff. This produces a factor of 4 speedup over the results given in the table below. Accurate comparison with Potter & Paistre is impossible because these authors do not state on what machine their timings were obtained on. I suspect it may have been a Symbolics 3600. 12Cases marked with with > are ones where the PTTP was aborted out of boredom! In assessing these timings it is also important to know that the code from the PTTP was compiled and that this process takes about 8 minutes. The resulting code is roughly twice as fast as uncompiled code. 13This includes steps taken by Zeff and Zeffl, as well as those taken by the preprover. 14This includes only those steps performed by the PTTP

334

7.

c

-

(a n b) = (c - a) U (c - b)

8. a U ( b U c ) : ( a U b ) U c ) 9. V = O I , ( a D V ) = V t - a = V

lO. an(bu~) c (~nb)u(anc) Th

1

2

3

Time

Minis

Oinfs

TLP

LMP

6 16

12

9

5

4.483s

26

0.167s

-

2.517s 10.967s

52

2.617s

17

0.2s

4

9.75s

51

> 29m 6s

5

18.867s

99

> 16h 9m 40s

6

9.85s

51

> 35m 50s

7

18.75s

106

> 31m 29s

8

7.933s

18.617s

139

4.433s > 35m 43s

2 16

6

3 > 156,819

> 13

4 > 4,345,830

98

50

21

18

Speedup

3

0. 05

5

22

0

4

9

17

4

0.08

6

14

4 > 13

> 102

36 > 18

32

4 > 18

> 103

14

4 > 13

> 102

38

4 > 15

> 102

> 102

3

18

> 165,847

> 13

6

42 > 15

-

56 > 14

55

0

-

> 14

17

6 14

15

4 > 13

> 102

0 > 140,502

4m 47.3s 10

22 9

> 158,224

> 26m 13s

9

0 983.

LOP

23,836

36

23 14

3 > 169,730

19

15

> 13

-

The figures show that Zeff is only slower than the raw P T T P on resolution proofs of less than 8 steps and parity is obtained around 8 steps. Thereafter the advantage lies more and more with Zeff until with proofs of 18+ steps, the speedup is in excess of three orders of magnitude. These timings corroborate our previous thought experiment. Conclusion T h e P T T P compares favourably with m a n y A T P s of the resolution family. However the P~b'TP is not an adequate tool for solving certain m a t h e m a t i c a l problems where

335

the control structure of the theory is inappropriate to the manner in which it works. Parallelism is unlikely to solve the problems of the PTTP and the analogy between highspeed ATPs and high-speed chess machines is misleading because game searches can arbitrarily limit the depth of the search. On the other hand, by combining the PTTP with heuristic techniques it is possible to gain substantial increases in effective performance. The techniques used within the TPL show that the virtual machine that defines the PTTP can also be adapted to provide languages that control its use. We have shown a way of adapting the PTTP to help in the construction of refinement proofs. References Bose S., Clarke E.M., Long D.E., & Michaylov S. Bundy A. BledsoeW. W. Campbell J. A. Chang C. L. & Lee R.C.T. Constable R. et al. Komatsu H. Tamura N. & Avakawa Y. Mater D. & Warren D. S. Nilsson N. J. Paulson L. C. Potter R. C. & Plaisted D. A. Stickel M. E. Stickel M.E. Wos L., Overbeek R. Lusk E. & Boyle J. Wos L.

PARTHENON: a Parallel Theorem Prover for Non-Horn Clauses, Proceedings of the 4th Annual Symposium on Logic in Computer Science, 1989. T h e C o m p u t e r Modelling Of M a t h e m a t i c a l Reasoning, Academic Press (1983). Splitting and Reduction Heuristics in Automatic Theorem Proving, Artificial Intelligence (1971) I m p l e m e n t a t l o n s O f Prolog, Ellis Horwood (1984) S y m b o l i c Logic A n d M e c h a n i c a l T h e o r e m - P r o v i n g Pergamon Press, (1973). I n t e r a c t i v e P r o o f in t h e N u P r l P r o o f D e v e l o p m e n t S y s t e m , Academic Press, (1986). An Optimising Prolog Compiler Proceedings of the 5th Conference on Logic Programming, Springer-Verlag,(1986). C o m p u t i n g w i t h Logic, MIT Press, (1988). Principles Of Artificial Intelligence Tioga Publishing Company, Palo Alto, California, (1980). A Higher-order Implementation of Rewriting, Science of Computer Programming 3. Term Rewriting: Some Experimental Results CADE 9, (1988), Springer-Verlag, LNCS. A PROLOG Technology Theorem-Prover New Generation Computing 2 (1984). A Prolog Technology Theorem Prover Implementation by an Extended Prolog Compiler CADE 8, (1986), (1986), Springer-Verlag, LNCS. A u t o m a t e d Reasoning: i n t r o d u c t i o n a n d applications Argonne National Laboratory, Argonne, Illinois, Prentice-Hall, (1984). A u t o m a t e d Reasoning: 33 Basic R e s e a r c h P r o b l e m s Prentice-Hall, (1988).

Presenting Intuitive Deductions via Symmetric Simplification Frank Pfenning School of C o m p u t e r Science [email protected]

Dan Nesmith D e p a r t m e n t of Mathematics [email protected]

Carnegie Mellon University Pittsburgh, PA 15213, USA Abstract

In automated deduction systems that are intended for human use, the presentation of a proof is no less important than its discovery. For most of today's automated theorem proving systems, this requires a non-trivial translation procedure to extract human-oriented deductions from machine-oriented proofs. Previously known translation procedures, though complete, tend to produce unintuitive deductions. One of the major flaws in such procedures is that too often the rule of indirect proof is used where the introduction of a lemma would result in a shorter and more intuitive proof. We present an algorithm, symmetric simplification,for discovering useful lemmas in deductions of theorems in first- and higher-order logic. This algorithm, which has been implemented in the TPS system, has the feature that resulting deductions may no longer have the weak subformula property. It is currently limited, however, in that it only generates lemmas of the form C V ~C ~, where C and C ~ have the same negation normal form.

1

Introduction

In this p a p e r we deal with the problem of proof presentation, a problem t h a t is often overlooked in a u t o m a t e d reasoning: m a n y of t o d a y ' s a u t o m a t i c systems focus exclusively on the search for the proof of a theorem. A presentation of the proof t h a t is discovered is often no more t h a n a literal tracing of the search process. Such a proof presentation serves more as a verification of the a u t o m a t i c procedure t h a n as an intelligible argument for the theorem's veracity. For some applications (such as program verification) the answer Yes! m a y be all that is desired, but in m a n y other applications we would like more information. For example, in decision support systems such as (E)MYCIN [25, 27] the inability to provide a convincing argument that the machine has correctly diagnosed a problem, deduced a consequence, or constructed a plan renders the p r o g r a m much less This work was supported in part by NSF grant CCR-8702699 and in part by the Defense Advanced Research Projects Agency (DOD), ARPA Order No. 5404, monitored by the Office of Naval Research under contract N00014-84-K-0415.

337

trustworthy and thus much less effective. In systems designed to support the teaching of logic a flexible facility for giving advice should know how to construct good proofs in the deductive system underlying the course. In systems where proofs are the data to be manipulated to fit other tasks such as explanation-based generalization [10] or the extraction of programs [5], the structure of proofs becomes of primary importance which, unfortunately, in practice prohibits the use of state-of-the-art theorem proving technology in such applications. Further evidence that proof presentation is a hard and important problem is that mathematicians spend a large percentage of their time analyzing and reformulating proofs. In the literature one finds two basic approaches to the proof presentation problem. One is to conduct the search for a proof in such a way that, when it is found, it can be displayed intelligibly in a very straightforward manner. This requires the theorem prover to be based on natural deduction [7, 6, 9], or at least to be very close to the natural deduction format. The disadvantage of this approach is that, to date, other theorem proving procedures are superior in that they can prove more theorems, and can prove them faster. Moreover, even natural deduction proofs are not always "natural" and many would profit tremendously from some transformations (Example 5 provides a case in point). The second approach is to decouple the search process from the proof presentation process, in which case proof presentation is reduced to translation from one proof format, say, resolution, to another, typically natural deduction. This approach has been taken by Lingenfelder [16, 17] for the connection graph method, Andrews [1] for mating refutations, and Miller [18, 19], Felty [11], and Pfenning [21, 22] for the closely related expansion proofs. There are many subproblems one faces when trying to present a proof. What deductive system should be used? How much detail should be presented? How do we measure how "good" a presentation is? How do we interact with the user when presenting a deduction? In this paper, we assume that we have chosen the natural deduction formalism as a target for translation, since it appears to be intuitive to (most) humans and can also be used as a basis for further transformation, for example into natural language (see Chester [8] and Huang [14]) or into other, related deductive systems. We will ignore questions of detail of presentation and user interaction and concentrate on improving "structural" qualities of natural deductions. In our experience with ETPS [23] (used as a teaching toot in logic classes) and TPS [3, 2] (used as a research tool in theorem proving for higher-order logic) and in the literature, it seems that the problem of translating analytic proofs (normal proofs in natural deduction terminology, cut-free proofs in sequent calculi) between different deductive systems is relatively well understood for a number of systems, in particular for expansion proofs and resolution refutations. The crucial property characterizing the deductions representing the proofs is that they have the weak subformula property: only subformulas of the theorem and instances thereof (possibly with an added negation, hence "weak") will appear in the final deduction. Though analytic deductions are often "right," especially for many small problems, they are also often "wrong" in the sense that a non-analytic deduction with a judicious use of a lemma might have drastically reduced the size and complexity of the deduction) A word on terminology: we will use "lemma" to refer to a non-subformula in 1A theoretical analysis of this phenomenon with precise bounds is given by Statman [26].

338

a non-analytic deduction. Thus we believe that in order to make further progress, we must study ways to introduce lemmas into the presentation of a proof. In this paper, we present just one method for introducing lemmas into deductions, but one which we have found to be of great practical value. Even though our deductions do not have the weak subformula property, the lemmas are not very far-fetched, and we believe that this is but a small step towards the overall goal of presenting intuitive deductions. Other, complementary approaches come to mind, such as applying methods from the field of inductive inference [4] to achieve a more global restructuring of deductions. As our deductive systems we have chosen expansion proofs [2, 18, 19, 20, 21, 22] (on the analytic side) to be translated into natural deductions. Expansion proofs simplify a number of translation issues over, say, resolution. First and foremost, the structure of the original formula is preserved rather than translated into clausal form. Secondly, certain properties that our algorithm is required to check can be read off fairly directly. Thirdly, TPS [3] is a theorem prover for first- and higher-order logic which generates expansion proofs and thus allows for immediate experimentation with many examples in its library of theorems. We emphasize, however, that, while details certainly would differ widely, we believe that the basic idea of our translation procedure can be adapted to apply to the problem of translating other forms of automatically generated proofs into natural deduction. Moreover, other forms of analytic proofs such as resolution refutations, can be translated into expansion proof format, though the value of such translations is unclear.

2

A S u m m a r y of t h e M e t h o d

We have been using a succession of translation algorithms from expansion proofs into natural deductions in the TPS and ETPS systems for several years. ETPS is used in logic classes in first-order and higher-order logic, TPS is a theorem proving system for first-order and higher-order logic. The scale of the examples TPS typically deals with is relatively small (5-50 line proofs), though the proofs, especially in higher-order logic, are sometimes quite intricate (such as proofs of Cantor's theorem). This gives us the luxury of neglecting certain aspects of global proof restructuring, such as determining whether a certain subproof could be done more directly with the use of some 1emma stored in a database. Level of detail of the proof can be controlled by the user to some extent, though more work is certainly required on this aspect of the translation. From our experience with the system it became obvious that the least intelligible deductions arose from the use of the rule of indirect proof. But how can the application of this rule be avoided? There are some answers to this question in the literature, since it is exactly the rule of indirect proof which separates classical logic from intuitionistic logic. But very general methods 2 do not seem reasonable for our application. It is also wellknown that instead of a rule of indirect proof, we can include the axiom schema A V -~A of excluded middle in the deductive system. Many of our examples can be proven very 2For a discussion and further references see Kreisel & Maclntyre [15]

339

intuitively with a judicious use of the law of excluded middle, but the "right" formula is not always a subformula of the theorem. This basic observation led us to ask when and how we should use the law of excluded middle in the construction of natural deductions from expansion proofs. We believe we have found a good answer and it generates intuitive deductions in all of our motivating examples and others. T h e first step is to analyze when and why the translation procedure would have to use a classical rule. A little analysis shows that there are exactly three types of situations in which we need a classical rule of inference, and where the previous translation algorithm would, as a last resort, fall back on the rule of indirect proof. Imagine that we have some assumptions S and a conclusion C and our goal is to derive C from S. There are two types of steps one can apply: one is to work forward from the assumptions; the other is to work backward from the conclusion. Informally, the cases in which we will have to apply a classical rule of inference are . C = A V B and neither A nor B alone follow from the assumptions, and no progress can be made by applying an intuitionistic rule to an assumption; . C = 3x A and there is no single term t such that [t/x]A follows from the assumptions, nor can progress be made by applying an intuitionistic rule to an assumption; . C is atomic and no progress can be made by applying an intuitionistic rule to an assumption. In this case, for any assumption of the form A --* B or -~A, the formula A does not follow from the remaining assumptions. Moreover, there must be at least one such assumption. T h e examples in Section 4 illustrate these impasses. We will see that the second type of impasse actually encompasses two quite different situations. Section 5 deals with the details of how we can sometimes employ the law of excluded middle to our advantage in these situations. Let us illustrate here the general idea of the procedure in the simplest of these cases where the conclusion is a disjunction. Since this case is the simplest and our example is propositional, it may appear that the problem is in general trivial, and that easier methods than symmetric simplification should apply. Though we cannot rule out such a possibility, we have arrived at symmetric simplification only after considering and discarding many more specialized and apparently simpler methods. The list of "difficult" (in the sense that it is difficult to find an intuitive deduction) theorems at the end of this paper give a range for the kinds of problems which may arise. As an example, assume we are trying to prove [A A B] V [A A -~B] from the assumption A. Clearly neither disjunct follows from A and the assumption A does not lend itself to any useful forward reasoning, and thus we are at a disjunctive impasse. W h a t is an intuitive way of proving this theorem? Proof by contradiction is certainly possible, but clearly not very intuitive. The following argument seems natural: (1) either B is true or false. (2) If B is true, we can conclude A A B. (3) If B is false, we can conclude A A - B . (4) So the disjunction holds in either case.

340

In outline, here is how our translation algorithm arrives at the lemma (1). First we observe that we can always pick either disjunct when trying to break a disjunctive impasse and continue by distinguishing two cases: the disjunct might be true or it might be false. If we picked the left disjunct, this would construct the lemma [A A B] V -~[A A B] which we add to our assumptions and now proceed by cases and two V-introductions, yielding the obligations (1) to prove A A B from A and A A B in the first case (which is immediate), and (2) to prove A A ~ B from the assumptions A and ~[AAB]. Even though this is clearly possible, this is also circuitous and not the desired proof. The general idea underlying our translation procedure is to examine the subproof obligations arising from this first attempt at a useful lemma, namely 1. to prove A A B from A and C = A A B in the first case, and 2. to prove A A -~B from the assumptions A and -~C = -~[A A B]. We have highlighted C and -~C, since these two formed our lemma (application of excluded middle). Note that we have the freedom to change and particularly simplify C as long as both subproof obligations can still be fulfilled. This is a balancing act, since strengthening C will weaken -~C and vice versa. Here one can easily see that after erasing the left conjunct A from both C and --C both remaining proof obligations can still be fulfilled, and also that the proofs are much simpler now. In fact, we have arrived at the desired intuitive deduction shown before. The essence of symmetric simplification 3 is to simplify C (and consequently --C) such that both subgoals remain provable. This implies simultaneous changes to the proofs that C implies one conclusion and --C implies the other conclusion, where C may be varied. Our procedure does not require a general theorem prover (and it is hard to see how to take advantage of one) but uses the original expansion proof as a strong guide. To show the limitations of this method, let us reconsider the goal of deriving [A A B] V[A A --B] from A. This time we proceed with an application of the distributivity of conjunction over disjunction to change the goal to A A [B V -~B] and then proceed in the obvious fashion. This is a deduction beyond our current method, and we know of no other general method which could produce this deduction. However, we believe that the general problem of using previously proved lemmas both in theorem proving and in proof presentation and the problem of finding useful "local" lemmas in a deduction are orthogonat--it is only the latter we are addressing here.

3

Natural Deductions

The formulation of natural deduction system we use is basically Gentzen's NK [12], but our implementation uses a variant with higher-order rules (as in Prawitz [24]) and rules z "Symmetric" since both C and --C remain identical. One could imagine "asymmetric simplification" which simplifies the lemma C V -~C to C I V C" or even C ~--. C" as long the lemma remains provable. Currently we have no algorithm or heuristics for the asymmetric simplification problem.

341

for equality. The additional complexity introduced into the proof presentation process does not invalidate the analysis made here, but requires some separate considerations (see [22, Chapters 4-6]). The logical language contains the propositional constants and connectives A, V, -~, --% and 222along with the quantifiers V and 3. The inference rules of the system include the usual introduction and elimination rules for each connective and quantifier. There are also two rules involving _k. The first is -LI, the intuitionistic absurdity rule (from falsehood we can conclude anything), the second is ± c , or classical proof by contradiction. Below we also show the rule of proof by cases (the V-elimination rule VE), since proof by cases is one of the more frequent inferences generated by our proof presentation procedure which uses symmetric simplification.

_l_ 222i A

~-~A]1 : 222 -1-cl

~AI1 [B] 1 : : AVB

C

C

C

VE1

As shown above in -l-c and VE, cancelled assumptions are written as [A]. A numbered assumption is cancelled in the inference with the same superscript. An inference may cancel 0 or more assumptions with the same formula, so the inference remains correct if the assumption does not occur in the deduction.

4

T r a n s l a t i o n f r o m E x p a n s i o n P r o o f s to N a t u r a l D e d u c t i o n

Our general approach to the proof presentation problem is goal-oriented: at any stage during the translation from an analytic prooP we have a number of assumptions S (a list of formulas, though their order is irrelevant) and a conclusion A. The goal is to fill in the gap in the deduction which shows that A follows from S, given an expansion proof which shows that the gap can indeed be filled. The implementation of the translation is centered around tactics [13] which may consult the expansion proof to check if certain conditions are satisfied. In return for this benefit of expansion proofs, the tactics also have t.he obligation to construct expansion proofs for any subgoals they may produce. A complete set of tactics for the translation process is described in [22, Chapter 6]. The tactics decompose into five different categories: bookkeeping tactics (which do not apply any inference rules), minimal conclusion tactics (whiCh suggest introduction rules to be applied to the conclusion), minimal assumption tactics (which suggest elimination rules to be applied to assumptions), non-minimal tactics (which suggest use of the absurdity rule or indirect proof), and ±emma tactics (which suggest the use of a lemma). The set of all tactics in the first four categories are sound and complete when tied together properly using tacticals: they are guaranteed to produce a natural deduction of the original goal 4IIenceforth we will say expansion proof, since this is what our implementation actually uses.

342

without the use of any derived rules of inference. In this paper we concentrate on the description of the lemma tactics, which, in their simplest form, generate lemmas of the form A V -~A. In order to understand when and why lemma tactics are invoked, we give a brief description of a few crucial minimal tactics in this section. Tactic 1 (V Introduction Left) Assume our goal is to prove A V B from $. If the expansion proof for this goal provides a proof of A from S, infer A V B by VIL, leading to the subgoal of proving A from S. This tactic and its obvious symmetric variant require that one of the disjuncts of the conclusion by itself follows from the assumptions. What if neither disjunct follows? If no assumption tactic applied, we would be forced to apply the rule of indirect proof J-e, unless we can find a good way of introducing a lemma. Such a situation occurs, for example, when trying to prove [A A B] V [A A -~B] from A (see the example in Section 2). Tactic 2 (3 Introduction) Assume our goal is to prove 3xA from S. If the expansion proof for this goal contains a single instantiation term t for this occurrence of x, and the instantiation term contains no parameter which has yet to be introduced into the deduction, then infer 3xA by 3I from [t/x]A, leaving the subgoal to deduce [t/x]A from S. This tactic may fail to apply for two different reasons (assuming no tactics can be applied to the assumptions). The proofs of the formula 3xVy[Px ~ Py] and the example in Section 7 illustrate one reason for failure, namely that there is more than one instantiation term required for x, but at least one of them is free of parameters yet to be introduced into the deduction. The other, more insiduous failure is when there are one or more instantiation terms, but all of them still contain a parameter which has yet to be introduced. An example of this is the goal to deduce 3x'~Px from ",VxPx. In either case we have to apply indirect proof or find a good lemma, though finding a reasonable lemma with our symmetric simplification algorithm is much more likely in the first situation. As an example of an assumption tactic which may fail to be applicable, consider --* Elimination. Tactic 3 (--, Elimination) Assume our goal is to prove some conclusion C from S and A --* B. If the expansion proof for this goal provides a proof of A from S apply --*E and set up two new subgoals: one to deduce A from $ and one to deduce C from S, A --* B, and B. Tactic 3 may fail to apply if the negation of the conclusion is necessary to prove the antecedent A, for example when trying to deduce C from the assumption -~C --~ C. In such a case we have to apply proof by contradiction before --+E. In the next section, we will analyze more thoroughly the cases in which these tactics do not apply, and will discuss how we try to generate useful and intuitive lemmas in these situations.

343

5

Setting up a Symmetric Simplification Problem

As outlined in Sections 2 and 4 and there are three situations in which symmetric simplification is of potential interest: they are exactly the situations in which one can no longer make progress by applying intuitionistic rules of inference. We refer to this as a translation impasse. In this section we a t t e m p t to illustrate how the symmetric simplification problem which is treated by our algorithm is set up, given that we have reached a translation impasse. It should be noted that these impasses are not mutually exclusive--we will return to this point at the end of this section. Imagine again that we have some assumptions S and a conclusion A and our goal is to derive A from S. Different types of impasses can arise. It is a non-trivial theorem which shows that these impasses are exhaustive, and thus at least one of these cases and possibly more must be applicable. D i s j u n c t i v e I m p a s s e . A = A' V A" and neither A' nor A" alone follow from the assumptions, and no progress can be made by applying an intuitionistic rule to an assumption. In this case, we have two symmetric opportunities for setting up a symmetric simplification problem. An obvious lemma is A' V -~At with the intent to build the deduction

S, [A']1 591 A I V -~A'

A~ A' V A" A I V A"

S, [~A'] 1 59~ A" VIL~ VIR V A"

VE 1

Since A t V A" follows from S it is easy to see that now A" must follow from S and -~A'. Also, the corresponding guiding expansion proof is easily constructed. It is much more difficult, though not impossible, to construct a normal natural deduction for this subproof, given an original deduction which proceeded using the rule of indirect proof. In either case, we end up with two subproofs, one (591) showing that S and C = A' implies A', the other (59~) showing that S and -~C = ~A' implies A". This problem is now passed to the symmetric simplification algorithm with the goal of simplifying C and

"~C. The symmetric case is where we pick C = A" V - A " . Currently, our heuristic for choosing which disjunct to begin with is to choose the one which contains more negative literMs which are used in the expansion proof. This heuristic is aimed at minimizing the number of negations in the lemma, and thereby reducing the number of negation elimination steps in the subsequent subproofs. E x i s t e n t i a l I m p a s s e . A = 3x A' and there is no single term t such that [t/x]A follows from the assumptions, and no progress can be made by applying an intuitionistic rule to an assumption. Moreover, there must be at least one instantiation term to for x in the proof of A from S which does not contain any parameter not yet introduced.

344

In this case we again use the lemma [to/x]A' V -,[to/x]A' with the intent to build the deduction

S, [[to/x]A'] 1 231 [to/x]A' S, [-~[to/x]A'] 1 - 31 3z A'

[to/x]A' V -~[to/x]A' 3x A ~

~2 3x A' VE ~

Again, it is easy to construct an expansion proof showing that from S and ",[to/x]A' we can prove 3x A' with one fewer instantiation term for x. Clearly, this can also be done for natural deductions, though it is much more complicated. In either case, we end up with two subproofs, one (D1) showing that S and C = [to/x]A' implies 3z A', and one (~D2) showing that S and --C = -.[to/x]A' implies 3z A'. This problem is now passed to symmetric simplification algorithm with the goal of simplifying C and ~C. As in the disjunctive impasse, our heuristic for choosing which term to use for the lemma (if more than one may be used) is to chose the one which contains the most negative literals which are used in the expansion proof. This leaves two kinds of impasses to which we will return in Section 8. Assuming that no tactic can be applied to an assumption, they are: (1) The conclusion is atomic and (2) the conclusion is existential and all of its substitution terms contain a parameter yet to be introduced. An example of (1) is the goal to derive A from -~A --+ A, and an example of (2) is to derive 3x-.Px from -.VxPx.

6

A n A b s t r a c t D e s c r i p t i o n of S y m m e t r i c S i m p l i f i c a t i o n

The technical details of symmetric simplification and our implementation are very closely tied to expansion proofs and their properties. In this section we will attempt to provide an intuition about the basic ideas behind symmetric simplification independently of expansion proofs. Assume, as discussed in Section 5, that we have reached a point where we have set up the following problem: Given two sets of assumptions 81 and 82, two conclusions A1 and A2, an initial formula C, and two proofs 2)1 and ~D2 such that T~I shows that A1 follows from $1 and C, and ~D2 shows that A2 follows from 82 and -~C. While keeping $i and A~ fixed, vary C and Di so as to "simplify" C and ~Di as much as possible. In the absence of a formal measure of the degree of "intuitiveness" of the modified deductions, we will just try to shorten them as outlined below. Our symmetric simplification procedure combines three steps, each of which is complex, but can be described in isolation. These steps are called single instantiation, single

345

deletion, and propositional restructure. In the exposition below, we call an occurrence of a subformula in C and the corresponding occurrence in ",C dual occurrences. S i n g l e I n s t a n t i a t i o n . Let us assume that we have a positive occurrence of VxC' somewhere in C which is instantiated to t in the deduction T)I. This inference could be avoided, if we could replace the occurrence of Vx C' by [t/x]Cq In the dual formula --C, the dual occurrence is equivalent to 3x-~C ~ which at some point in T)~ might have been instantiated with a parameter a. This would be transformed into -~[t/x]Cq The deduction T)2 then would also have to be changed: we may have to permute inferences, and also substitute t for the parameter a in the deduction :D2. The conditions on t guarantee that this is possible. There are a number of other conditions which must be satisfied for the transformation outlined above to be valid. 1. the assumption Vx C ~ and none of its instances can be used elsewhere in :D1, since it is replaced by [t/x]Cq Similarly for the dual occurrence in T)2. 2. the substitution t e r m t must not contain any parameter b which is introduced somewhere in :D1 or :D2, since this would invalidate the occurrence condition on the inference rule which introduced b (either an 3-elimination or a V-introduction). As one might imagine, it is difficult but not impossible to check these conditions on natural deductions. It requires that we can trace occurrences as they multiply and propagate through the deductions. In expansion proofs, it is trivial to check them. We currently only apply single instantiation if Vx C' does not tie below any other quantifier, though it would be easy to generalize our algorithm to search for cases where such a replacement would be legal. S i n g l e D e l e t i o n . This is the most useful of the three steps. Let us assume we have a positive subformula occurrence C ~A C" in C. If none of the instances of C t is used in the derivation 2Pl of Ax, we can erase it from C and -~C. Note that this weakens C and thus strengthens --C, and thus no applicability checks need to be made in T~2. However, T)2 often simplifies. For example, if the dual assumption -,C I V -~C" is strengthened to -~C', a proof by cases is simplified to one of its subproofs. Another case where essentially the same m e t h o d applies is a negative subformula occurrence C ~V C" in C. P r o p o s i t i o n a l R e s t r u c t u r e . s This is the most complex of the steps, and also perhaps the least intuitive. It was not part of the original algorithm we implemented, but we found it necessary for many examples. Because of redundancies introduced when creating the lemma C V -~C it is often the case that an assumption C' (as in the scenario for single deletion) is used in :D1, even though its use could be avoided if we changed :D1. A general theorem prover is not very good at changing :D1, since the goal is to avoid using any assumption in C as much as possible (which is hard to communicate to a theorem prover), and simply enumerating all subformulas and checking (with a theorem prover) whether 5In [22] in the context of expansion proofs this is called single mating change.

346 A1 still follows is completely impractical. This is not a completely accurate transcription of what our single mating change procedure does, but roughly our solution is to look through the places where forward reasoning and backward reasoning meet, t h a t is, where gaps in the proofs are completely filled. If an instance of a subformula D of C is the only way the gap can be filled, we m a r k it as necessary, otherwise we locally restructure the proof (with propositional inferences only) so that D is not used. This is iterated until no more propositional restructure is possible, unless perhaps after a single deletion.

Propositional restructure m a y enable further single deletions and also single instantiations, since all instances of some subformula C ~ of C m a y now be unnecessary and could thus be deleted. In general, applying any of the above three steps m a y enable other steps to further simplify the deduction. We impose the following control structure: . Repeatedly apply single instantiation in a top-down fashion (top-level quantifiers first) until it is no longer applicable. Go to Step 2. . Repeatedly apply single deletion in a b o t t o m - u p fashion (leaves first) until it is no longer applicable. Go to Step 3. . A t t e m p t to apply propositional restructure. If this fails and Step 2 did not perform any deletions, terminate: no further simplification is possible. Otherwise, go to Step 1.

7

An Example of Symmetric

Simplification

In this section, we explain by means of an example how a l e m m a is generated when we have reached a translational impasse. Suppose we have three blocks, a mb, and c, such that b is on a and c is on b. Moreover, assume that we know that a is red, while c is known not to be red. From these assumptions, prove that there are some blocks x and y such t h a t x is red, y is on x, and y is not red. Symbolically: From On c b, On ha, Red a, and -~Red c conclude 3x3y [On y x A -~Red y A Red x] T h e following intuitive deduction which makes use of the law of excluded middle is the one our algorithm eventuMly generates. Deduction

4

1. Either b is red or it is not red.

2. I f b is red, then b and c satisfy the criterion for x and y, respectively, since c is on b and c is not red, while b is red. 3. If b is not red, then a and b satisfy the criterion for x and y, respectively, since b is on a and b is not red, while a is red. A deduction which uses indirect proof will be much less intuitive. Here is one possible version 6. 6A formal counterpart of this version would have been generated by an earlier version of the translation procedure.

347

D e d u c t i o n 5 We proceed by contradiction, thus (after some rules commuting negations with quantifiers and connectives) it remains to derive a contradiction from the assumptions

Oncb, Onba, R e d a , -~Redc, and Y x V y [ - , O n y x V R e d y V -,Redx] The final of these assumptions must be true for x = b and y = c and also for x = a and y = c, leading to a contradictory propositional formula. From examining either of these two deductions, we can see ttiat the original goal is at an existential impasse as described in Section 5; we cannot directly prove an instantiation of the conclusion, nor can we apply an intuitionistic elimination rule to an assumption and make progress. The reason is that x must somehow be instantiated to two different terms (b and c) to complete the deduction. Instead of using indirect proof, we set up a symmetric simplification problem and apply our earlier algorithm. Examining the expansion proof, we find that b is an instantiation term for x such that b contains no parameters selected in the proof. It also satisfies our heuristic of containing more negative literals used in the expansion proof than does the tree for the other instantiation term a. Thus we begin with Co = 3y [Onyb A -~Redy A Redb], and the starting point for the l e m m a is Co V -~C0. . T h e existentially quantified subformula of -,Co is negative, so the quantifier (on y) is essentially existential in the new subproof. In addition, it is instantiated with a single t e r m c. Hence we can use Single instantiation to instantiate y with c. C1 then becomes On c b A -~Red c A Red b; the lemma has now been simplified to C1 V -~C1. Single instantiation cannot be applied again, so we go to step 2 of the algorithm. . Single deletion cannot be applied, since every literal of C1 and --5'1 is being used in the current subproofs. Thus we go to step 3 of the algorithm, propositional restructure. .

.

Note that C1 contains as conjuncts two literals, On c b and -,Red c, which also appear as assumptions. Hence we can restructure the proof so that instead of using the literal occurrences in 6'1, we use the corresponding assumptions. Once we have done that we go back to step 1 of the algorithm. Single instantiation is not applicable (6'1 contains no quantified subformulas).

5. Single deletion can now be applied to the two literals of C1 that were made unnecessary by the propositional restructure step above; we delete them and their dual occurrences in --C1. C2 becomes Red b. The lemma now has been simplified to Red b V --Red b. . Propositional restructure is no longer applicable; every literal in the lemma is necessary. Seeing that single instantiation and single deletion are also not applicable, we terminate.

348

Our lemma is 6'2 V -,C2, that is, Red bV -,Red b; this is exactly the lemma our intuition told us we should use. The resulting deduction is Deduction 4. We chose this example because it illustrates each of the steps of the symmetric simplification algorithm. The result of the algorithm is a propositional lemma, which could leave the impression that lemmas could somehow be generated by looking at contradictory propositional formulas only. However, this is not always the case. As a case in point, consider the theorem 3xVy[Px --+ Py]. In the translation of this proof into a natural deduction, we immediately run into an existential impasse. If symmetric simplification is used rather than a proof by contradiction (which does not generate a nice proof) the lemma which results is Yy[Py] V ",VyPy.

8

Conclusion

For many theorems, symmetric simplification will provide a lemma that makes the natural deduction more intuitive. While we are guaranteed to make progress in the cases of existential and disjunctive impasse, that is not the case for other impasses; sometimes using indirect proof is "better" than using the lemma that our algorithm could create. This is true specifically for the situations mentioned at the end of Section 5. More work must be done in determining where symmetric simplification is useful in these cases, and criteria must be developed for evaluating the intuitiveness of proofs and for deciding whether using a given lemma yields an improvement or not. We have found one particular tactic that is often useful, though we do not yet have a good heuristic on when to use it. This tactic, which can be used when there is an implication in the assumptions, but the ~ elimination tactic (Tactic 3) does not apply, involves setting up a symmetric simplification problem from the left-hand side of the implication. The last two lemmas in the table below were generated by using this tactic. Another problem that has not been addressed is that of choosing the "best" lemma. Instead of using a lemma of the form C V -~C, we could use any formula D V E such that D = C and E - -~C. This may make the resulting subproofs easier, at the expense of more difficulty in proving the lemma. Thus this only appears reasonable when a certain amount of sophistication has been achieved, that is, certain lemmas in a deduction can be assumed without proof. In addition, the lemmas that our algorithm constructs are all themselves theorems. Improvements may result if our lemmas are merely provable from the current assumptions. Given all tactics and heuristics we have developed and implemented, there are still some remaining unintuitive deductions. They arise primarily due to negated, non-atomic assumptions combined with existential conclusions. The prototypical example of such situation is to derive 3x-~Px from ",VxPx. The best way we could find to deal with this problem is to assume that there are previously proven theorems or derived rules of inference which allow the permutation of negations with other connectives and quantifiers. Finally, we end with some "benchmarks," simple theorems for which one of the impasses described in Section 5 arises, along with the lemma (or lemmas, when several are needed) which our algorithm generates.

349

Theorem 3yVx[Py --* Px] Pa A -~P[f[f a]] ~ 3x[Px A -,P[f x]] Pa A -.P[f[f[f[f a]]]] --~ 3x[Px A -,P[f x]]

3x[Px ~ P[fx]] A --* [A A B] V [A A -~B] [A --~ [B V C]] ~ [[A --+ B] V [A ~ C]] [A --~ B] --~ [--A V B] , 3PP [A --+ 3xBx] ~ 3x[A ~ Bx] [YxPx --~ B] ~ 3z[Px --~ B]

Lemma derived VxPx V -~VxPx -~P[f a] V P [ f a] ....... -.P[fa] V P[fa] -.P[f[fa]] V P[f[fa]] '~P[f[f[f a]]] V P [ f [ f [ f a]]] --,P[fa] V P[fa] -~B V B C V --C A V --A po V _~po A V -~A VxPx V -.VxPx

References

[1] Peter B. Andrews. Transforming matings into natural deduction proofs. In Proceedings of the 5th Conference on Automated Deduction, Les Arcs, France, pages 281-292. Springer-Verlag, 1980. [2] Peter B. Andrews. On connections and higher-order logic. Journal of Automated Reasoning, 5:257-291, 1989. [3] Peter B. Andrews, Sunil Issar, Daniel Nesmith, and Frank Pfenning. The TPS theorem proving system. In Ewing Lusk and Russ Overbeek, editors, 9th International Conference on Automated Deduction, Argonne, Illinois, pages 760-761, Berlin, May 1988. Spring-Verlag LNCS 310. System abstract. [4] Dana Angluin and Carl H. Smith. Inductive inference: Theory and methods. Computing Surveys, 15(3):237-269, September 1983. [5] Joseph Bates and Robert Constable. Proofs as programs. A C M Transactions on Programming Languages and Systems, 7(1):113-136, January 1985. [6] Michael Beeson. Some applications of Gentzen's proof theory in automated deduction. To appear, 1988. [7] W. W. Btedsoe. The UT prover. Technical Report ATP-17B, Departments of Mathematics and Computer Science, University of Texas at Austin, 1983. [8] Daniel Chester. The translation of formal proofs into English. Artificial Intelligence, 7:261-278, 1976. [9] Robert L. Constable et al. Implementing Mathematics with the Nuprt Proof DeveIopment System. Prentice-Hall, Englewood Cliffs, New Jersey, 1986. [10] Thomas Ellman. Explanation-based learning: A survey of programs and perspectives. A C M Computing Surveys, 21(2):163-221, June 1989.

350

[11] Amy P. Felty. Using extended tactics to do proof transformations. Technical Report MS-CIS-86-89, Department of Computer and Information Science, University of Pennsylvania, 1986. [12] Gerhard Gentzen. Untersuchungen fiber das logische Schlie~en. Mathematische Zeitschrifl, 39:176-210, 405-431, 1935. [13] Michael J. Gordon, Arthur J. Milner, and Christopher P. Wadsworth. Edinburgh LCF. Springer-Verlag LNCS 78, 1979. [14] Xiaorong Huang. A human oriented proof presentation model. Technical Report SR-89-11, SEKI, 1989. [15] Georg Kreisel and Angus MacIntyre. Constructive logic versus algebraization I. In A. S. Troelstra and D. van Dalen, editors, The L.E.J. Brouwer Centenary Symposium, pages 217-260. North-Holland Publishing Co., 1982. [16] Christoph Lingenfelder. Transformation of refutation graphs into natural deduction proofs. Technical Report SR-86-10, SEKI, 1986. [17] Christoph Lingenfelder. Structuring computer generated proofs. In N. S. Sridharan, editor, Proceedings of the Eleventh IJCAL pages 378-383. Morgan Kaufmann, 1989. [18] Dale Miller. Proofs in Higher-Order Logic. PhD thesis, Carnegie-Mellon University, October 1983. [19] Dale Miller. Expansion tree proofs and their conversion to natural deduction proofs. In R. E. Shostak, editor, Proceedings of the 7th Conference on Automated Deduction, pages 375-393, Heidelberg, May 1984. Springer Verlag. [20] Dale A. Miller. A compact representation of proofs. Studia Logica, 46(4):347-370, 1987. [21] Frank Pfenning. Analytic and non-analytic proofs. In R.E. Shostak, editor, 7th Conference on Automated Deduction, pages 394-413. Springer-Verlag, May 1984. [22] Frank Pfenning. Proof Transformations in Higher-Order Logic. PhD thesis, Carnegie Mellon University, January 1987. [23] Frank Pfenning, Sunil Issar, Dan Nesmith, and Peter B. Andrews. ETPS User's Manual, fifth edition, 1984. 44+ii pp. [24] Dag Prawitz. Natural Deduction. Almquist ~ Wiksell, Stockholm, 1965. [25] Edward H. Shortliffe. MYCIN: a Rule-Based Computer Program for Advising Physicians Regarding Antimicrobial Therapy Selection. PhD thesis, Stanford University, 1974. [26] Richard Statman. Bounds for proof-search and speed-up in the predicate calculus. Annals of Mathematical Logic, (15):225-287, 1978. [27] William van Melle. A Domain-Independent System that Aids in Constructing Knowledge-Based Consultation Programs. PhD thesis, Stanford University, 1980.

Toward Mechanical M e t h o d s for Streamlining Proofs* William Pierce

Department of Computer Sciences The University of Texas at Austin Austin, TX 78712

Abstract

We present preliminary work on the problem of mechanical proof simplification. Our approach is to take advantage of the correspondence between proofs and programs. Techniques from the field of program transformation may be used to transform the computational content of a proof. Using examples from elementary number theory, we illustrate how such transformations can lead to simpler proofs.

1

Introduction

It is often the case that a theorem can be proved in multiple ways, and that some of the proofs are simpler, more straightforward, or in some sense more elegant than others. In such cases, there can be good reasons for trying to find the best proof. If one wants to teach or explain a difficult theorem, one will do well to find the most economical path from the basic principles to the theorem. If one wants to use a proof as a source of knowledge, say for explanation or for discovering new proofs by analogy, one will do well to consider the proof which omits extraneous details. Naturally we would like to develop methods for discovering good proofs. Since the problem of finding any kind of' proof is such a dimcult one, we are investigating methods for taking proofs which are already provided and transforming them into proofs which are by some metric improved. We see two potential benefits of such an investigation. First, it should lead us to a better understanding of what constitutes a good proof. Formulating reasonable metrics for ewluating proofs may well be one of the hardest parts of this research. Second, the actual methods developed for simplifying proofs can be useful. Automated reasoning systems often produce proofs which are difficult to follow; these methods may allow such systems to present proofs more clearly. Our approach to proof trazlsformation takes advantage of the correspondence between proofs and programs. Drawing from the literature on program transformation, we can employ transformations which preserve the computational content of a proof. As we shall see, such transformations can lead to programs which can no longer be interpreted as proofs. This approach thus necessitates the following choice: we must ensure that all *This work supported by National Science Foundation Grant CCR-8613 706.

352

transformations preserve proofhood, or we may allow intermediate steps which are not proofs and simply check that the final result is. Examples we shall see later provide some evidence that the latter is preferable. In order to develop mechanical methods for streamlining proofs, we need efficient strategies for applying transformations so that a proof is improved if it is changed at all. Developing such strategies is still future work; for the present, we use the following heuristic: a transformation is desirable if it eliminates computational redundancy. As we shall see, an efficient program does not always correspond to a desirable proof. However, this is a starting point. The primary goal of this paper is to identify potentially useful transformations. To limit the scope of this investigation, we have restricted our consideration to firstorder proofs in elementary number theory involving rewriting and induction. The metric we use to measure a proof is a count of the rewrite steps involved (where each rewrite step is justified by an axiom, lemma, or inductive hypothesis) plus the sum of the measures for the lemmas used in the proof. In the next section, we introduce the class of proofs we will be considering and show how such proofs may be interpreted as programs. In the following sections, we describe methods for transforming these programs and illustrate with examples. We then discuss the status of our current investigations and problems for future research. We conclude with a discussion of related work.

2

Proofs and Programs in Elementary N u m b e r Theory

For reasons of space, the following presentation must be somewhat informal. We are currently investigating proofs in elementary number theory involving rewriting and induction. Lemmas and axioms are equations whose terms may involve the constant 0 and the function s u c c (meaning successor and often abbreviated with a postfix '). Axioms and theorems are given names; for example, the following axioms, named P0 and Pt, characterize the function plus: plus

0 x

=

plus

n' x

= (plus n x)'

x

PO Pl.

We will assume the above axioms for the examples that follow. Proofs are built up from applications of axioms and lemmas using the two rules of concatenation and induction. An application of an axiom or lemma is characterized by three items: the list of terms to which it is applied, an orientation specifying the direction in which the axiom or lemma is applied, and an address specifying the subterm being rewritten. For example, the proof of f 0 (g 0)

= f 0 (g (plus 0 0))

involves the axiom P0 instantiated with 0 for x. It is applied in the reverse direction to the first subterm of the second subterm of ( f 0 (g 0)). We might render this proof by reverse (po o) at (2 1). Here (2 1) is an address specifying that the proof is applied to the first subterm of the second subterm.

353 If, for 1 < i < n, A ( i ) is an application of an axiom or a lemma proving %( i - l ) = %( i ) , then A(1) through A(n) may be concatenated to form a proof of %(0) = %(n). We may render this by ...

A(1) A(2)

A(n).

For example, the equation p l u s 0' 0 = 0' is proved in two steps by (pl o o )

((PO o )

at

(1)).

Note that we do not display null addresses. This representation for a proof is useful for the manipulations we will be performing, but it is difficult to read. Therefore, we will also use a proof presentation which makes explicit the terms being rewritten by the proof. Thus the above proof may be presented: plus O' 0 = (plus 0 0)'

(Pl 0 O)

= 0,

(p0 0) at ( 1 ) .

Finally, a theorem of the form %1(n) = %2(n) may be proved by induction. To represent such a proof, we give the theorem a name, say T. If P s i is a noninductive proof of %1(0) = t 2 ( 0 ) and Phi is a noninductive proof of % l ( n ' ) = %2(n') which uses an application of T instantiated with n, then the complete proof of T may be rendered T 0

=

T n'

=

Psi Phi.

In general, t l ( n ) and t 2 ( n ) may contain other variables. Here is an example proof of the theorem p l u s n 0 = p l u s 0 n to which we give the name L. LO L n'

= =

I (Pln

O) ((i n) at (I)) ((PO n) a% (l)) (reverse (PO n')).

Here, I represents the concatenation of zero proofs. (I is thus a proof of any equation of

the form % -- t . ) To facilitate presentation of more complex proofs, we will henceforth adopt a more succinct notation. Thus, we will represent L by LO L n'

=

I

=

(Pln

O) (L n;(1))

(PO n;(1)) r(PO n').

We have replaced a t with ; and reverse with r. Again, this program does not show clearly what is being proved. We may present the proof L more explicitly by plus n 0 = plus 0 n O. plus 0 0 = plus 0 0 n

~ .

plus n' 0 = (plus n 0)' = (plus 0 n)' =

n

~

= plus 0 n'

L I

(P1 n O) (L n;(1)) (PO n;(1)) r(PO n').

354

Before presenting techniques for transforming proofs, it is appropriate to justify our interpretation of proofs as programs. These remarks are made with the above logic in mind; as we consider other logics, we will have to reevaluate the utility of this interpretation. First, there is an intuitive sense in which proofs of this logic correspond to programs. A proof of t l ( x ) = t 2 ( x ) , when applied to a number n, reduces to a sequence of axiom applications which specifies how t l (n) may be rewritten to t 2 ( n ) . For example, using the equations for L, (L 0' ' ) may be expanded in the obvious way: L 0" ; =

(Pl O' 0) (L 0 ' ; ( 1 ) ) (P0 0 ' ; ( 1 ) ) r(PO 0 " ) (Pl 0' 0) (PI 0 0;(I)) (L 0;(I i)) (PO 0; (i I)) r(P0 0';(i))

(p0 0,;(i)) r(P0 0") =

(Pl 0' 0) (P1 0 0;(I)) (P0 0; (I I)) r(P0 0';(i)) (P0 0';(I)) r(P0 0'')

which indeed specifies h o w plus 0' ' 0 m a y be rewritten to plus 0 0' ' Second, we have found the interpretation of proofs as programs to be strongly suggestive of useful transformations. W h e n one understands the computational effect of a proof one can sometimes see immediately whether there is a simpler means of accomplishing the same effect. In fact, it is the elimination of computational redundancy that motivates most of the transformations we are currently investigating. Third, as we shall see, the class of proofs generalizes in a straightforward way to a class of programs not all of which are proofs. Currently, it seems simpler to investigate transformations over this class of programs than to ensure that all transformations preserve proofhood.

3

Program Transformations

We have already defined our proof metric as a count of the rewrite steps used plus the measures for the needed lemmas. For our equational representations of proofs this measure is simply the number of terms appearing on the right hand sides of the rules involved in the proof. Thus, for exampIe, our measure for the proof L is four. This is a very simple metric, and more sophisticated ones may be required in the future. The motivation for the metric is simple: it is meant to correlate directly with the amount of work involved in checking the correctness of a given proof. Thus it is meant to approximate the difficulty with which a human understands a proof. We do not currently have transformational strategies which are guaranteed to decrease the measure of a suboptimal proof. Instead, as a starting point, we have been investigating the heuristic that the elimination of computational redundancies can lead to shorter proofs. As an example, consider the following proof (call it M) that p l u s n 0 = n: M n

=

(L n) (PO n).

Here, L is the proof of the previous section that plus n 0 = plus 0 n. Now M to O' and expand, we obtain the following proof that plus I 0 = I: M 0'

=

if we apply

(Pl 0 O) (P0 0;(I)) r(P0 0') (P0 0').

This program instance is redundant because it contains the adjacent inverses r(P0 0') and (P0 0'). The second term undoes what is accomplished by the first. This example motivates the following somewhat narrow definition of computational redundancy: a

355

program is computationally redundant if some instance reduces to a program containing adjacent inverses. We desire means for transforming programs so that such redundancies are eliminated. Clearly, we could delete the adjacent inverses in the previous equation to obtain M 0'

=

(Pl o 0) ( p 0 0 ; ( 1 ) ) .

But we desire a way to transform the definition of M so that the redundancies in all instances are removed. To find such transformations, we draw from the work of Burstall and Darlington on program transformation~[2]. Using their approach, we begin with a set of equations defining a function. We then extend this set using a fixed collection of rules. From the final set of equations we obtain a new definition for the original function. The rules explored in [2] include the following: instantiation of an equation, unfolding, in which the left side of an instance of an equation is replaced by its right, folding in which the opposite occurs, definition of a new function, redefinition, in which two functions similarly defined may be equated, and application of laws in which metarules about the terms of the equations are used to derive new equations. We will use all of these rules. The laws we use are for deleting and inserting adjacent inverses and permuting subproofs. We will discuss these rules as they are motivated by examples. To see how folding and unfolding can be used with the deletion of inverses to simplify a proof, consider again the proof M. Note that (M O) unfolds to (PO 0), and thus admits no deletion of inverses. On the other hand, unfolding (M n ' ), we have M n'

= =

(L n') ( P O n ' )

(P1 n 0) (L n ; ( 1 ) )

(P0 n ; ( 1 ) ) r(P0 n')

(P0 n ' ) .

Here the pair of inverses r (P0 n ' ) and (P0 n ' ) may be deleted to yield the equation M n'

=

(el n O) (L n;(1)) (eo n;(1)).

By a folding step, we obtain M n'

=

(Pln

O) (M n;(1)).

We can now take the equations M 0 M n'

= =

(PO O) ( P I n O) (M n;(1))

to be the new definition of Min which the redundancy has been eliminated. We thus have a simpler program for rewriting p l u s n 0 to n. We must now determine whether this is a proof. In fact, it is. Note that M Ois a proof that p l u s 0 0 = 0. M n ' rewrites p l u s n ' 0 to ( p l u s n O) ' and then uses the inductive hypothesis by applying M to the subterm ( p l u s n 0). This proof may be presented more explicitly by: plus n 0 = n O.

n'.

M

plus 0 0

= 0

(PO O)

plus n' 0 = (plus n 0)' = n'

( P I n O) (M n;(1)).

356

Note that this proof has measure 3 while the previous proof has measure 6 (2 for M and 4 for L). This example illustrates our basic approach to transforming programs. Definitions are unfolded so that inverses may be eliminated; then folding steps are performed to produce a concise proof. This is the ideal situation of course. In general, more complicated manipulations are required to allow the deletion of inverses. We illustrate such transformations by presenting more complicated examples in the next section.

4 4.1

Examples The Commutativity

of Plus

Consider the following proof which uses the axioms for p l u s and our earlier lemma M to prove that p l u s is commutative. plus m n = plus n m O. plus m 0

C

= m

(M m)

= plus 0 m

r(PO m)

n ~.

= = = =

plus m n' plus m' n (plus m n)' (plus n m ) ' plus n' m

(LL m n) (Pl m n) (C m n;(1)) r(Pl n m)

plus m n' = plus m' n O. plus 0 n'

m'.

LL

= n'

(PO n')

= (plus 0 n)' = plus O' n

r(PO n;(1)) r(Pl 0 n)

plus m' n' = (plus m n')' = (plus m' n)' = plus m'' n

(Pl m n') (LL m n;(1)) r(Pl m' n)

Using our equational representation~this proofis rendered: C m 0 C m n'

= =

(M m) r(PO m) (LL m n) (Pl m n) (C m n;(1))

r(Pl n m)

M 0

=

(PO O)

M n'

=

(PI n O)

LL 0 n LL m' n

= =

(PO n') r(PO n;(1)) r(Pl 0 n) (PI m n ' ) (LL m n;(1)) r(Pl m' n).

(M n ; ( 1 ) )

By our definition, this proof is redundant. Note that

357

CO0'

= =

(LL 0 0) (Pl 0 0) (C 0 0 ; ( 1 ) ) r(P1 0 0) (P0 0 ' ) r(P0 0 ; ( 1 ) ) r(P1 0 0) (P1 0 0) (C 0 0 ; ( 1 ) )

r(Pl 0 0).

The final right hand side contains the inverse pair r ( P l 0 0) (Pl 0 0). adjacent inverses will occur in any application of (LL m n)

In general,

(Pl m n).

to a natural number. We will eliminate these inverse pairs by defining a new function W m n

=

(LL m n)

(Pl m n)

and simplifying the definition of W. We consider the ways that W m a y be applied, first to 0, then to m'. Now WOn

= = =

(LL 0 n) (P1 0 n) (PO n ' ) r(P0 n ; ( 1 ) ) r ( P l 0 n) (PO n ' ) r(P0 n ; ( 1 ) ) ,

(Pl 0 n)

by unfolding and the deletion of adjacentinverses. Similarly, W m' n

= = =

(LL m' n)

(Pl m' n)

(Pl m n') (P1 m n')

(LL m n;(1)) r(P1 m' n) (P1 m' n) (LL m n;(1)).

We would like to obtain a simple recursive definition for W, yet there is no way to fold the definition of W in the last equation. However, there will be if we insert the inverse pair (Pl m n; ( 1 ) ) r ( P l m n; ( 1 ) ) . Thus we derive W m' n

= =

(PI m n') (Pl m n')

(LL m n;(1)) (LL m n;(1))

=

(Pl m n')

(W m n;(1))

(Pl m n;(1)) r(Pl m n;(1)) r(Pl m n;(1)).

The equations for (W 0 n) and (W m' n) now give a new definition for W. By folding W m n in for (LL m n) ( P l m n) in the equation for (C m n ' ) , we obtain the new definitionfor C: C m 0 C m n'

= =

(M m) r(PO m) (W m n) (C m n;(1)) r(Pl n m)

M 0 M n'

= =

(P1 n O) (M n;(1))

W 0 n

=

(PO n') r(PO n;(1))

W m' n

=

(PI m n')

(PO O)

(W m n;(1))

r(Pl m n;(1)).

This p r o g r a m is in fact a proof, and can be represented by plus m n = plus n m O. plus m 0

= m = plus 0 m

C

(M m) r(PO m)

358

plus m n' = (plus m n)' = (plus n m)' = plus n' m plus m n' = (plus m n)' O. plus 0 n'

m

(W m n) (C m n;(1)) r(Pl n m) W

= n'

(PO n')

= (plus 0 n)'

r(PO n;(1))

plus

~ .

m' n'

= (plus m n ' ) ' = (plus m n ) ' ' = (plus m' n)'

(P1 m n ' ) (W m n ; ( 1 ) ) r(Pl m n;(1)).

The measure for this proof is 13, 2 less than the measure for the original proof. 4.2

A Program

W h i c h is N o t a P r o o f

We said earlier that some programs are not proofs. In fact, we will exhibit a program which is computationally equivalent to the current proof for C which is nevertheless not a proof. Note that the proof for C is still computationally redundant. For example, COO'

=

=

(W 0 0) (C 0 0 ; ( I ) ) r(P1 0 0) (P0 0 ' ) r(P0 0 ; ( 1 ) ) (M 0 ; ( 1 ) ) r(P0 0 ; ( 1 ) ) r(P1 0 0) (P0 0 ' ) r(P0 0 ; ( 1 ) ) (P0 0 ; ( 1 ) ) r(P0 0 ; ( 1 ) ) r(P1 0 0)

thus admitting a deletion. We can apply further transformations to obtain the following simple definition for C: Cmn

=

(U m n) (V m n)

u 0 n U m' n

= =

(p0 n) (pl m n) ( u m n ; ( 1 ) )

Vm0 V m n'

= =

r(P0 m) (V m n ; ( 1 ) ) r(P1 n m).

T h e derivation of this new program is not trivial; we have done it on p a p e r in 56 steps. Now if one examines carefully our current definition for C, one will see that indeed it does define a program for rewriting ( p l u s m n) to ( p l u s n m). Yet this program is not a proof, since U and V are not proofs. We will demonstrate this for the program V. Suppose (V m n) was a proof of t l ( m , n ) = t 2 ( m , n ) , where t l ( m , n ) and t 2 ( m , n ) are terms possibly containing occurrences of m and n. Since (V m 0) equals r ( P 0 m) and is therefore a proof of m = ( p l u s 0 m), it follows in particular that the t e r m t l ( m , n ) , with 0 replacing all occurrences of n, is the t e r m m. This is only possible if, regardless of n, t 1 (m, n) is the t e r m m. Now, (V r a n ' ) is a proof of t l ( m , n ' ) = t 2 ( m , n ' ) in which (V m n) is applied inductively to the first subterm. Since (V m n) is a proof of t l ( m , n ) = t 2 ( m , n ) , the first subterm of t l ( m , n ' ) must be the t e r m t l ( m , n ) . But this is a contradiction since b o t h t l ( m , n ' ) and t l ( m , n ) equal the t e r m m.

359

4.3

Generalizing Programs

to Obtain Proofs

Now it m a y seem useless to derive an efficient program which is not a proof. But in fact such programs can be useful for deriving proofs of other theorems. Suppose we desire a proof of ( p l u s n n ' ) = ( p l u s n ' n). T h e rewriting of ( p l u s n n ' ) to ( p l u s n ' n) can certainly be accomplished by applying our efficient program for C to n and n ' . We m a y thus define a function D by =

D n

Cnn'

and a t t e m p t to transform it into a proof. Let us try to manipulate this program so that it calls itself recursivety. We can reduce (D n) and (D n ' ) as follows: Dn

=

Cnn' (U n n') (V n n') (U n n') (V n n;(1)) r(P1 n n)

D n ' --

(U n ' n ' ' )

(V n ' n ' ; ( 1 ) )

r(P1 n ' n ' )

=

(P1 n n ' ' )

(U n n ' ' ; ( 1 ) )

(V n' n ; ( 1 1)) r ( P l n n ' ; ( 1 ) )

r ( P l n' n ' ) ,

Here, (D n) cannot be folded into the equation for (D n ' ) ; however, we can obtain a recursive program if we generalize. Let us introduce a new function E with (D n) = (E n n). This gives us the following equations. E n n

= (U n n') (V n n;(1)) r(P1 n n)

E n' n' = ( P I n

n'')

(U n n'';(1))

(V n' n;(l 1)) r(Pl n n';(1)) r(Pl n' n')

E is currently underspecified. We desire a recursive definition of E; by symmetry, we may choose the first argument as the variable of recursion. We thus want a definition of E in which (E 1 ' m) makes a recursive call to (E 1 m). In particular, we want (E n ' n ' ) to make a recursive call to (E n n ' ) . Thus we would iiketo fold (E n n ' ) i n for (U n n ' ' ) (V n ' n; ( 1 ) ) r ( P l n n ' ) in the last equation above. To summarize, we want a definition of E satisfying the following. (E 1 m)[n/l,n/m]

=

(U n n') (V n n;(1)) r(Pl n n)

(E 1 m)[n/l,n'/m]

--

(U n n'')

(V n' n;(1)) r(P1 n n').

From these constraints, it is clear that E must be defined by (E 1 m)

=

(U 1 m')

(V m i;(I)) r(P1 1 m).

Thus, by unfolding and folding, (E i' m) = = =

(U i' m') (V m 1';(1)) r(Pl I' m) (Pl 1 m') (U 1 m';(1)) (V m 1;(1 i)) r(Pl 1 m;(1)) r(PI I' m) (Pl 1 m') (E 1 m;(1)) r(Pl I' m).

Reducing (E 0 n), we obtain (E 0 m)

= --

(U 0 m') (V m 0;(I)) r(Pl 0 m) (PO m') r(PO m;(1)) r(Pl 0 m)

We now have the p r o g r a m for E: (E 0 m) = (E l' m) =

(PO m') r(PO m;(1)) r(Pl 0 m) (P1 1 m') (E 1 m;(1)) r(P1 i' m).

This p r o g r a m is a proof, and is in fact (with renaming) the same proof as LL in section 4.1.

360

4.4

Simplification

Requiring

Subproof

Permutation

The next example introduces a new transformation in which terms must be p e r m u t e d to allow deletion and folding steps. Consider the following axiomatization for minus: pred 0 pred k'

= =

0 k

minus m 0 minus m k'

= =

m pred

PrO Prl MO MI.

(minus m k)

Using these axioms and the previous ones for plus, w e m a y prove minus

(plus n a) (plus n b) = minus a b

R

by proving and using the l e m m a

RR.

minus n' k' = minus n k

Now using l e m m a R and l e m m a M which we introduced earlier, we m a y prove the theorem which we call T: minus n n minus = minus = minus = minus

= 0 n n (plus n O) n (plus n O) (plus n O) 0 0

T r(M n;(1)) r(M n;(2)) (R n 0 O)

= o

(Mo o).

Equationally, this proof, with lemmas, is given by T n

-- r(M n;(1)) r(M n;(2))

M0 M n'

-=

(P0 0) ( P l n 0)

R 0 a b

=

(P0 a ; ( 1 ) )

(R n 0 O) (MO O)

(M n ; ( 1 ) ) . (P0 b ; ( 2 ) )

R n' a b =

(P1 n a ; ( 1 ) )

RR n 0 RR n k '

(MI n ' 0) (M0 n ' ; ( 1 ) ) ( P r l n) r(M0 n) (M1 n ' k ' ) (RR n k ; ( 1 ) ) r(M1 n k ) .

= =

(Pi n b ; ( 2 ) )

(RR (plus n a) (plus n b ) ) (R n a b)

By our metric, this proof has measure 20. We will transform this to a much simpler proof in which T is defined recursively. Applying T to 0, we obtain TO

: =

r(M 0;(i)) r(M 0;(2)) (R 0 0 O) (MO O) r(PO 0;(I)) r(PO 0;(2)) (PO 0;(I)) (PO 0;(2)) (MO 0).

Now note that r ( P 0 0 ; ( 2 ) ) and (P0 0 ; ( 1 ) ) are applied to non-overlapping subterms. Thus, their computational effect is independent of the order in which they are applied. We are therefore justified in transforming the above equation by permuting these two terms. This allows the following steps.

361

T 0

= = =

r(P0 0;(I)) r(PO 0;(2)) (P0 0;(I)) (PO 0;(2)) (MO 0) " (P0 0;(I)) r(P0 0;(2)) . . . . r(P0 0;(2)) (PO 0;(2)) (M0 O)

=

(M0 0).

T h e transformation for (T n') is s o m e w h a t m o r e complex. A ~ e r expanding (T n'), T n' = r(M n';(1)) r(M n';(2)) (R n' 0 O) (M0 0) = r(M n;(l 19) r(Pl n 0;(I)) r(M n;(2 1)) r(Pl n 0;(2)) ( P l n 0;(I)) ( P l n 0;(2)) (RR (plus n O) (plus n 0)) (R n 0 0) (M0 O)

we can again permute subproofs which affect non-overlapping subterms, and delete inverses. This yields the following equation. T n' = r(M n;(l I)) r(M n;.(2 i)) (RR (plus n 0) (plus n 0)) (R n 0 0) (M0 O)

In order to fold (T n) into this last equation, we need to bring the term (I~ (plus n 0) (plus n 0)) to the outside. In fact, such a permutation can be justified by a syntactic analysis of the equations corresponding to the two subproofs. The proof r(M n;(1 1)) r(M n;(2 1)) (RR (plus n 0) (plus n 0)) produces the same effect as the proof (RR n n) r(M n;(1)) r(M n;(2)). Both rewrite (minus n' n') to (minus

(plus n 0) (plus n 0)). B y m a k i n g this per-

mutation, we mayfold (T n) as follows: T n'

=

(RR n n) r(M n;(1)) r(M n;(2))

=

(RR n n )

(R n 0 0) (M0 0)

(T n ) .

We thus have a new program for T given by T 0

=

(M0 0)

T n'

=

(RR n n) (T n).

In fact this is a proof, which m a y be presented m o r e explicitly by minus n n = 0 O. minus 0 0 = 0 n'.

minus n' n' = minus n n = 0

minus m' n' = minus m n O. minus m' O' = pred (minus m' O) = pred m' = m = minus m 0 n'.

minus m' n'' = pred (minus m' n') = pred (minus m n) = minus m n'

T (S0 0)

(RR n n) (T n) KR (M1 m' 0) (M0 m';(1)) (Prl m) r(M0 m)

(MI m' n') (RR m n;(1)) r(Ml m n).

362

This proof has measure 10, half the measure for the original proof. This example illustrates an intriguing prospect for the type of systems we would like to develop. One may first prove a theorem in a straightforward manner (e.g., without induction) by applying powerful lemmas. One may then mechanically derive a less roundabout proof for the same theorem which does not rely on those lemmas.

5

Discussion

We have shown how proofs in a logic of equality and induction can be manipulated to obtain shorter proofs. The approach involves applying transformations to a larger class of programs. The fact that some programs are not proofs does not make the approach unfeasible; we must simply check that a finM program is a proof. The method for doing this was illustrated in section 4.2. We assume the program rewrites t l to t2. We then determine whether t l and t2 can be consistently assigned values by analyzing the rewriting behavior of the program and the way it applies recursive calls. While we have shown the potential of program transformations for simplifying proofs, we do not yet have an effective procedure for improving suboptimal proofs. One might remark that the approach of applying program transformations is not so different from determining in advance what the optimized proof has to be and then proving that it is computationally equivalent to the original proof. The transformationM space is so large, it seems one needs to know the final result before applying transformations to produce it. This remark is well taken: to develop an effective procedure, one needs appropriate strategies for applying transformations. We have already begun to address this problem by investigating the strategy of eliminating computational redundancy, as defined in section 3. The utility of this strategy is supported by the examples presented earlier. As evidence that this strategy can be feasibly applied, an algorithm exists for detecting computational redundancy in a wide class of programs. For a program in this class, the program instances admitting a deletion can be summarized with a finite list of substitutions for the variables of the program. For example, the program Mof section 3, admits deletions whenever applied to m'. The algorithm computes such instances by first determining, for each subprogram, which variable instances correspond to which outermost terms of the subprogram expansion. As an example, consider the program defined by XO

=

B

X n'

=

(A n)

(X n ) .

The first few expansions of (X n) are given by n=O

B

n = 1

n = 2

(A O) B

(A t )

(A O) B.

Now both the rightmost and leftmost terms of the expansion of (X 0) are B. The leftmost term of the expansion of (X k' ) is (A k). The rightmost term of the expansion of (X k ' ) is again B. Thus, specifying the leftmost terms of the expansions of (X n) requires only the mention of two instances: n = 0, and n = k ' . All the rightmost terms are summarized by a single instance. For a wide class of programs, the outermost terms associated with the program can be characterized with a finite list of instances.

363 Using these characterizations of the outermost terms of subprograms, our algorithm can determine recursively whether a program expands to produce adjacent inverses for any instance. To illustrate, if the body of a program is (X n) (Y n), then our Mgorithm will consider the rightmost terms of instances of (X n) and the leftmost terms of instances of (Y n) to see (via unification) if any instance yields adjacent inverses. It will then recursively determine whether (X n) or (Y n) admits a deletion. This algorithm terminates if the outermost terms of each subprogram can be characterized with a finite set of instances. Since appropriately instantiating equations is a crucial step in many of our transformations, this algorithm aids greatly in the application of our heuristic to eliminate computational redur~dancy.

6

Future Work

A primary emphasis of future work will be on the identification of better heuristics for applying transformations. Our current heuristic of eliminating computational redundancy has limitations. There are redundant proofs which are shorter than any proof of the same equation in which the redundancy is eliminated. For a contrived example, consider the axiom fn'

=

fn

F

and the proof P that f n = f 0 ' : P

fn=fO' o.

f o

= f o'

r(F O)

n'.

f n'

= f n

(F n)

= f

(P n ) .

0'

The proof is redundant: (P 0 ' ) = (F 0) r ( F 0). Yet eliminating this redundancy produces the longer proof Q: fn=fO'

Q

0.

f 0

n'.

f

f n'

n'

= f 0' = f

0'

= f O'

r(F 0) (G n) G

O.

f O'

= f O'

I

n'.

f n"

= f n' = f O'

(F n ' ) (G n).

Another area for future work involves the investigation of other types of suboptimality. A complication which has not arisen in any examples we have considered, but which may be worth analyzing, is the occurrence of more complex sequences of deletable operations. A subproof of the form t l = Z2

P1

t3

P2

= tl

P3

=

364

may be deleted from a program even though it contains no adjacent inverses. More examples must be considered before it is clear whether developing a method for handling such subproofs would be worthwhile. Another optimization we plan to investigate is common subexpression elimination. If the same sequence of at least two subproofs occurs several times in a proof, by our metric it will be worthwhile to replace the occurrences of the sequence with a call to a lemma. Of course, it will be necessary to ensure that the sequence, taken in isolation, is a proof of some equation. It may also be possible to simplify a proof by the permutation of subproofs. Consider, for example, that the proof max (plus 0 n) (plus 0 n) = max n (plus 0 n) = max n n

(P0 n ; ( 1 ) ) (P0 n ; ( 2 ) )

= n

(Lemmal n)

proves the same

theorem

as the shorter

max (plus 0 n) (plus 0 n) = plus 0 n -- n

(Lemmal (plus 0 n)) (PO n)

in which subproofs have been permuted. In a related optimization, permuting the order of subproofs may make one of the proofs superfluous. For example, the proof minus 0 (plus 0 n) -- minus 0 n = 0

(PO n ; ( 2 ) ) (Lemma2 n)

m a y be replaced by the simpler minus 0 (plus 0 n)

(Lemma2 (plus 0 n))

-- O.

Finally, we desire to make program simplification techniques practical. We wish to consider a more general logic so that we can attempt to streamline proofs of the complexity produced by program verification systems.

7

Related Work

A primary motivation for our work is the desire for economy in the communication of mathematical arguments. Thus, we must allude to the delightful work of A. J. M. van Gasteren [6]. Her emphasis is on effective "human" theorem proving, where we emphasize the use of formal metrics and mechanical procedures for evaluating and developing proofs. Research on transforming proofs has been reported in [1], [7], [8], and [9]. The emphasis of this work is on transformations between different proof systems (e.g., proof systems involving matings, expansion trees, resolution, and natural deduction). This work and ours share the following motivation: to present mechanically derived proofs in a format appropriate for human comprehension. Our domains of investigation are different, however. We are investigating induction and equality rather than first and higher-order logic.

365

Given a proof, our approach to finding a shorter proof involves transforming a program which captures the computational content of that proof. Thus our work is related to research on both program transformation and constructive mathematics. Reference [5] provides an extensive bibliography for research on program transformation. The work in this area which is most closely related to ours is that of Burstall and Darlington [2, 4]. We use many of the transformations they introduce. The major difference, of course, is that our goal is to simplify proofs rather than to transform programs into more efficient ones. This means we have the additional responsibility of verifying that the results of our transformations are indeed proofs. This also means we have a simpler means of evaluating the efficacy of our transformations: our measure of proof desirability is a simple syntactic one. Current research in constructive mathematics is represented well by the work being done with the Nuprl system. Reference [3] describes this project and includes an extensive bibliography of related work. The NuprI project is exploring several applications of the "proofs as programs" paradigm. Our explorations are similar to some of these but our motivation is different. Our primary reason for using the "proofs as programs" correspondence is not an interest in constructivity or correct programs, but rather a desire to explore the use of a larger space in which to transform proofs. As far as we know, this is a new approach.

References [1] Andrews, Peter B., "Transforming Matings into Natural Deduction Proofs," in Fifth Confer. ence on Automated Deduction, W. Bibel, R. Kowalski (eds.), LNCS, no. 87, Springer-Verlag, 1980, pp. 281-292. [2] Burstall, R. M., John Darlington, "A Transformation System for Developing Recursive Programs," JACM, vol. 24, no. 1, January 1977, pp. 44-67. [3] Constable, Robert L., et. al. Implementing Mathematics with the Nuprl Proof Development System, Prentice-Hall, Englewood Cliffs, 1986. [4] Darlington, John, "An Experimental Program Transformation and Synthesis System," Artificial Intelligence, vol. 16, no. 1, March 1981, pp. 1-46. [5] Feather, Martin S., "A Survey and Classification of Some Program Transformation Approaches and Techniques," in Program Specification and Transformation, L. G. L. T. Meertens (ed.), North-Holland, Amsterdam, 1987. [6] Gasteren, A. J. M. van, On the Shape of Mathematical Arguments, Ph.D. thesis, Eindhoven University of Technology, 1988. [7] Lingenfelder, Christoph, "Structuring Computer Generated Proofs," Proc. of the l l t h IJCAI, Detroit, 1989. [8] Miller, Dale A., "Expansion Tree Proofs and their Conversion to Natural Deduction Proofs," in Seventh International Conference on Automated Deduction, R. E. Shostak (ed.), LNCS, no. 170, Springer-Verlag, 1984, pp. 375-393. [9] Pfenning, Frank, "Analytic and Non-analytic Proofs," in Seventh International Conference on Automated Deduction, R. E. Shostak (ed.), LNCS, no. 170, Springer-Verlag, 1984, pp. 394-413.

Ordered Rewriting and Confluence Ursula Martin* and Tobias Nipkow t

Department of Computer Science, I~HBNC, University of London Egham, Surrey TW20 0EX, UK and

University of Cambridge, Computer Laboratory Pembroke Street, Cambridge CB2 3QG, UK

Abstract One of the major problems in term rewriting theory is what to do with an equation which cannot be ordered into a rule. Many solutions have been proposed, including the use of special unification algorithms or of unfailing completion procedures. If an equation cannot be ordered we can still use any instances of it which can be ordered for rewriting. Thus for example z * y = y . x cannot be ordered, but if a, b are constants with b * a > a * b we may rewrite b * a ~ a * b. This idea is used in unfailing completion, and also appears in the Boyer-Moore system. In this paper we define and investigate completeness with respect to this notion of rewriting and show that many familiar systems are complete rewriting systems in this sense. This allows us to decide equality without the use of special unification algorithms. We prove completeness by proving termination and local confluence. We describe a confluence test based on recursive properties of the ordering.

1

Introduction

One of the m a j o r problems in t e r m rewriting t h e o r y is w h a t to do w i t h an e q u a t i o n which cannot be ordered into a rule. M a n y solutions h a v e been proposed, including t h e use of special unification a l g o r i t h m s [7] or of unfailing c o m p l e t i o n procedures [1,6]. If an e q u a t i o n cannot be ordered we can still use any instances of it which can be ordered for rewriting. T h u s for e x a m p l e

x.y=y.x cannot be ordered, but if a, b are constants w i t h b * a > a • b we m a y rewrite

b,a--.*a.b. This idea is used in unfailing completion, and also appears in B o y e r - M o o r e [2]. In this paper we define and investigate completeness w i t h respect to this n o t i o n of rewriting and show t h a t m a n y familiar systems are c o m p l e t e rewriting systems in this sense. This allows us to decide equality w i t h o u t the use of special unification algorithms. We prove completeness by proving t e r m i n a t i o n and local confluence. W e describe a confluence test based on recursive properties of the ordering. *The author acknowledges support of the UK SERC under grant GR/E 83634. tThis research was supported in part by NYNEX, NSF grant CCR-8706652, and by the Advanced Research Projects Agency of the DoD, monitored by the ONR under contract N00014-83-K-0125.

367

1.1

Summary

In this section we summarize our results. Precise definitions are given below. An ordered rewriting system consists of a set of equations E and a monotonic ordering on terms > which is total on ground terms. We say a term s rewrites to a term t, denoted by s - - ~ t, if there is an equation r = l or I = r in E, a substitution a and a subterm al of s such that al > a r and t is s with that subterm replaced by a r . Thus for example if x • y = y • x is in E and a * b > b • a then a * b ~ b* a. We observe that the usual notion of a rewriting system c~n be regarded as a special case of our concepts in the case when the ordering allows all the equations to be ordered into rules. A ground complete ordered rewriting system is one which is terminating and confluent on ground terms. This means that any ground term can he rewritten to a unique canonical form, and we can decide equality between ground terms, and hence between variable terms by regarding the variables as generalised constants. This process uses only unification in the empty theory. In section 4 we give examples of ground complete ordered rewriting systems including AC, ACI, Boolean tings, Distributivity and Abelian Groups. E x a m p l e 1.1 As an example let E be

(x,y),z

=

x*y

• ,(y,z)

x,(y,z)

(1)

=

y*x

(2)

=

y,(=,z)

(3)

and let > be any monotonic ordering on terms which is total on ground terms and satisfies for all ground terms x, y, z

(=,y),z

>

x*y x*(y*z)

(4)

>

y*x

ifx>y

(5)

>

y*(x*z)

ifx>y.

(6)

Then (E, >) is an ground complete ordered rewriting system. For example suppose that > is the lexicographic path ordering (see section 3) and a, b, c are constants with c > b > a. Then b,(c,(b,a))~b,(c,(a,b))--~b,(a,(c,b))

) a*(b,(c,b))--~a,(b,(b,c)).

To prove completeness we need as usual to prove termination and confluence. Termination is generally proved by showing that the ordering is well-founded1, and the orderings we need to do this for our examples are discussed in section 3. To prove confluence we need to prove local confluence, and in section 2.1 we prove the necessary version of the critical pairs lemma. The usual notion of rewriting and confluence allows confluence to be checked automatically by computation of normal forms. Ground confluence, however, is already undecidable for ordinary rewriting systems [8], and thus even more so for ordered rewriting. However we shall explain in section 2.2 how a ground confluence test may indeed be automated in many cases by axSomatising the properties of the orderings and rewritings that we need. This automation works for most of the examples of section 4. Consider the example above. Computing critical pairs between (x,y),z

x*y

=

x,(y,z)

=

y*x

1In fact, it is sufficientto show well-foundednesswithin equivalenceclasses, tf Ml equivalence classes are finite, this follows because any ordering on a finite set is well-founded.

368

we obtain

z , ( x , y) ~ - ( x , y ) , z ---, x , ( y , z), so we have to prove that z , ( x , y) and x * (y * z) are joinable for all ground terms x, y, z. Now since x, y, z are ground terms we may consider the possible relationships between them under >. For example if x > z > y then x,(y,z)

........~ y , ( x , z ) - - - * y , ( z , x ) ~ - - z * ( y , x ) ~ - - z , ( x , y )

While our technique allows the computation of canonical forms without a special matching algorithm we note that it is not always as powerful as rewriting with an equational matching algorithm. E x a m p l e 1.2 Consider the example above together with the equation f ( x * x) = 1. Rewriting with an AC matching algorithm shows that f(a*(a*(b*b))) = 1. However, there is no equivalent ground complete ordered rewriting system as any such system would have to contain infinitely many equations to deal with

f(a,a),

f(a*(a*(b*b))),

f(a,(a,(a,(a,(b,b)))))

and so on. On the other hand the advantages of our method are that • Ground rewriting is possible without E-matching algorithms. • Ground rewriting is sufficient for theorem proving. • Completion is possible without E-completion. It shares these features with unfailing completion, as described for example in [6]. Indeed, it is very similar to unfailing completion in two technical aspects: both sides of an equation may give rise to critical pairs, and complete systems need only be confluent for ground terms. In contrast to [6], our method is specially designed to detect critical pairs all of whose ground instances can be joined. Thus we are able to discard many critical pairs, and to obtain complete systems which their approach fails to verify as complete.

2

Critical

Pairs, Confluence,

and Completion

We assume that all concepts and definitions are as in [5] or [3]. Let E be a set of function symbols and V a set of variables. The set of all terms in E U V is denoted by T = T ( Z t3 V), and the set of all ground terms is the subalgebra Ta = T ( E ) . The function V returns the set of variables in a term. A term can be represented as subterms in a context by writing C[sl,..., sn]. The context C is a A-term A x l , . . . , x,~.t, and C[sl,..., sn] denotes application, i.e. the simultaneous the replacement of all xl by si. In particular we assume that every xl occurs exactly once in t. An ordering > on a set S is a relation which is irreflexive and transitive, so that it is false that x > x, and i f x > y and y > z then x > z. An ordering.on T is monotonic if for all function symbols f and terms s ~ , . . . , s ~ , s , t we have f ( s l , . . . , s , . . . s , ~ ) > f ( s l , . . . , t , . . . s ~ ) if s > t. An ordered rewriting system is a pair (E, >) where E is a set of equations in T and > is a monotonic ordering on 7" which is total on ground terms. The notation s - t E E is short for s=t E E V t = s E E. If for some l - r E E we have al > ar for all substitutions a we write I - - + r and call it a rule.

369 The ordered rewriting system ( E , >) induces a relation - - * defined as

C[as] --~ C[at]

if s - t E E

A as>at

Since > is monotonic, p ~ q implies p > q. The restriction of - - - , to ground terms is denoted by =:=~. We use ----** to denote the reflexive transitive closure of - - + . Two terms s and t are called joinable, written s .[ t, iff there is a term u such t h a t s ---~* u and t --~* u. They axe called groundjoinable, written s ~ t, iff for any ground substitution a, a s and at are joinable. An ordered rewriting system is called ground terminating if there is no sequence of ground terms {aili E N } such t h a t ai ~ ai+l for M1 i. An ordered rewriting system is cMled ground confluent if whenever r, s, t are ground terms with r ===~* s and r ==~* t then s ~ t. If the t e r m i n a t i n g or confluence conditions hold for all terms rather than just ground terms we call ( E , > ) terminating or confluent respectively. An ordered rewriting system which is terminating and confluent is called complete; one which is ground terminating and ground confluent is called ground complete. It follows from Newman's lemma that if ( E , >) is complete then each term s has a unique normal form, and if ( E , >) is ground complete this is true for ground terms. Thus if s, t are terms (ground terms) and ( E , > ) is complete (ground complete) then s =E t if and only if their normal forms are identical. If s and t are a r b i t r a r y terms we may still use a ground complete system to decide equality if we regard the variables occurring in s and t as new constants. In the sequel let ( E , > ) denote an ordered rewriting system and let ---% ~ etc. be the rewrite relations it generates. If there is a second ordering, say ~-, we write - - + ~ , ~ etc. to denote the relations induced by ( E , ~). 2.1

T h e Critical P a i r L e m m a

This section deals with the extension of the critical pair lemma to ordered rewriting. D e f i n i t i o n 2.1 Given two equations C[u] = t, u ~ V, and v = w with no variables in common and a most general unifier a o f u and v such that a(C[u]) ~ at and av ~ aw, then (crt,a(C[w])) is a critical pair. The set of all critical pairs of E is the set of all critical pairs between any two equations

p-~q, s-~t E E. Critical pairs in our sense are the extended criticalpairs of Bachmair et al. [1]. Note that because of the s y m m e t r y of --" both sides of an equation can give rise to critical pairs. If > orders every equation in E into a rule our definition of critical pairs reduces to the usuM one. 2.1 If > is total within equivalence classes of ground terms, both sides of an equation s - t E E are ground joinable.

Lemma

The following l e m m a extends the ordinary critical pair lemma [4] to ground confluence of ordered rewriting systems. It is a corollary to the critical pair lemma in [1]. L e m m a 2.2 An ordered rewriting system (E, > ) is locally ground confluent iff all critical pairs

are ground joinable. The proof of this l e m m a relies o n the totality of > within equivalence classes of ground terms. The following example shows that this requirement cannot be dropped: E x a m p l e 2.1 Let E = {*} U C, where C is a set of constants, E = { x , y = y , x}, and s > t iff the leftmost constant in s is > the leftmost constant in t. Clearly > is not total because a

370

and a * b are incomparable. Assume t h a t a < b. Then the term r = (b * a) * a can be rewritten to s = a * (b * a) and t = (a * b) * a. However, s and t are not joinable because s rewrites only to a • (a * b), which is in normal form, and t is in normal form already. On the other hand there is only a single critical pair (y • x, y * x) in E which is trivially ground joinable. This shows t h a t for non-total > the consideration of critical pairs does not suffice to determine local ground confluence. Finally we have: C o r o l l a r y 2.1 A terminating ordered rewriting system is ground confluent i.ff all critical pairs

are ground joinable.

2.2

A u t o m a t i n g It

In contrast to ordinary rewriting systems, where critical pairs are required to be joinable, we need the weaker criterion of ground joinability. It is not at all clear how a test of the latter property can be automated since it talks about an infinite set of ground instances. In fact we believe t h a t ground joinability is in general undecidable. The purpose of this section is to give some sufficient criteria which are easily implementable and powerful enough to solve some non-obvious examples. On the other hand they are far fl'om complete. Section 4.9 contains an example which is easily proved to be ground joinable but which is not covered by our method. The principle idea underlying the automation has Mready been sketched in the introduction: given two terms s and t, we consider all possible relationships between the variables in s and t under > and = and try to join s and t for each of them. Since there are only finitely many relationships, namely M1 linear orderings, we only have to consider a finite, albeit possibly very large, number of cases. It remains to be explained how rewriting of terms with variables is to proceed if we do not know what the variables stand for, only how they are related to each other with respect to >. As an example take the term y • z with the constraint x < y. It requires some intimate knowledge of > to determine whether this implies t h a t y , x > x • y, i.e. whether commutativity is applicable. Instead of working with a particular ordering and inferring some of its properties, we assume a small set of properties of the ordering which allow us to order enough terms for proving ground confluence. For the AC case we have seen in the introduction t h a t the implications (4)-(6) are sufficient for joining one of the critical pairs under a particular set of constraints. In section 4.2 we show t h a t the equations (1)-(3) together with any ordering satisfying (4)-(6) are ground confluent. The advantage of this approach is its generality: ground confluence is proved for any ordering satisfying the properties we have assumed. However, it means t h a t one has to be careful in the choice of properties. For example they must not violate well-foundedness. We will now describe a test for ground joinabitity based on the above ideas. Formally, the "properties" of the ordering are given as a closure operator C on 7" x T subject to the restriction

(s,t) e c(>)

e

(7)

where a ( > ) = {(au, av) I u > v}. The intuition is that C takes a relation on terms and returns the set of consequences implied by the properties we assumed of the ordering. The above restriction ensures that C is well behaved with respect to substitutions. This enforces for example t h a t if x * y > y • x follows from x > y, then x r > yt must imply x ~ • y~ > y t , x~. We say that an ordering > is compatible with C if C(>) = >. As a consequence of restriction (7) we obtain:

371

L e m m a 2.3 Let E be a set of equations, let > and ~- be two relations on T , and let a be a substitution such that a(~-) C >. Then u ---+c(~-) v implies cru ----*c(>) av for all terms u , v . P r o o f From u ----*c(~-) v it follows t h a t u = C[Sl], v = C[Sr] and (8I, 8r) E C(~-) for some l - r E E . From (~l, 0r) e C(~-) it follows by (7) that (ct~l, a S r ) E C(a(~-)). Since C is a closure operator and a(~-) C > we also have (aOI, nor) e C(>). Thus eta = a(C)[crSl] -'-~c(>) a(C)[aOr] = av. [] Ordering the variables in a term with respect to = and > is equivalent to providing a total order on equivalence classes of variables. If p is an equivalence on a set of variables, ~ denotes a substitution which maps each variable to some fixed representative of its equivalence class. Testing for ground joinability of two terms s and t by considering all total orders o~n equivalence classes of variables in s and t leads to the following definition. If ~s ~c(~-) /~t holds for all equivalences p on the variables in s and t and all t o t a l orders ~- on the range of t~, then we write s ~ e t. Restriction (7) ensures that this definition is independent of the particular choice of representatives of p-equivalence classes. The next l e m m a shows t h a t s Jjv t does imply ground joinability: L e m m a 2.4 I f s J~c t then s ~> t holds for all orderings > compatible with C. P r o o f Let > be compatible with C and let a be some ground substitution with dora(a) = 1)(s) U •(t). We have to show that as 1> at. Let p = k e r ( a ) and define x ~- y iff ctx > a y for x , y in the range of ~. Theft ~- is a total order and s ~c t implies/~s ~c(~-)/~t. Since >, ~-, and a satisfy the assumptions of lemma 2.3 it follows t h a t as = ads lc(>) apt = at. Since > is compatible with C we have as 1> at. [] From this l e m m a and the definition of ~c it follows directly that C o r o l l a r y 2.2 I f C(~-) is recursiv¢ and well-founded for all recursive and well-founded ~-, then ~c is a sufficient recursive criterion for ground joinability with respect to all orderings compatible with C. This is the first step towards automating the test for ground joinability. The second ingredient is l e m m a 2.1. Combining all these criteria we obtain the following set of rules: s~t

~

s=t

s~t

~

s#et

s~t

~

31-rEE,

f ( S l , . . . , 8n) ~L f ( t l , . . . , t n )

~

Vi. si ~ ti

a. a l = s

A ar=t

The first clause is obvious, the second and third ones are consequences of lemmas 2.4 and 2.1 respectively, and the last one follows from compatibility of rewriting. The p r o t o t y p e implementation of this test is written in Prolog and follows exactly the above four Horn clauses. C is just another predicate. In all our examples C consists of the implications (4)-(6) and further clauses specific to the example.

2.3

Completion

T h e critical pair l e m m a in the preceding section leads to a completion algorithm in the usual way: critical pairs which are not ground joinable are added as new equations. Formally this can be expressed as an inference rule between sets of equations:

372

E E u {s = t}

if (s, t) is a critical pair of E and not s ~ t.

If this process terminates because all critical pairs are ground joinable, we have obtained a ground complete ordered rewriting system. In addition one may want to obtain a reduced rewriting system by simplifying the right or left hand sides of equations by other equations. This can be achieved by the following rule:

E v {s-t}

EU{s=u}

ift----~EU A s - t ~ _ E

Since we are only interested in ground confluence, ground joinable equations can be removed:

EU{s-t}

ifs~t E The applications of these three rules may be interleaved arbitrarily. A prototype implementation of this completion procedure has been written in Prolog and was used for all the examples in section 4.

3

Orderings

Our notations and concepts are taken from Dershowitz [3]. An ordering is called well-founded if there is no set {aili E N} with al > ai+l for each i. We have L e m m a 3.1 Let (E, >) be an ordered rewriting system. If > is well-founded then (E, >) is

terminating. P r o o f The monotonicity condition ensures that if s ----, t then s > t, so if > is terminating there can be no infinite chain of rewrites.

[]

The following orderings will be used in the sequel.

Lexieographie P a t h O r d e r i n g Let s = f ( s l , . . . , s m ) , t = g ( t l , . . . , t n ) . Let > be an ordering on function symbols. Then s > t if and only if • si >_ t for some i = 1 , . . . , m , or • f > g and s > tj for all j = 1 , . . . , n, or • f = g (so n = m) and ( S l , . . . , s~) is greater than ( t l , . . . , t~) in the lexicographic ordering from the left on sequences induced by >, and s > tl for i = 1 , . . . , n. Then we have

L e m m a 3.2

1. The lexicographic path ordering is well-founded, and is total on ground terms if the operator precedence is total. 2. If f, g are binary function symbols with f > g and x , y , u , v are any terms and f ( x , y ) >

u, f(x, y) > v then f(x, Y) > g(u, v).

373

Knuth-Bendix Orderlngs The essence of the Knuth-Bendix orderings is to compare terms first by weight and then lexicographieally by an operator precedence. For details see [9] or [11], where proofs will be found of L e m m a 3.3 The Knuth-Bendix ordering is monotonic and well-founded, and is total on ground terms if the operator precedence is total.

Lexieographie Orderings Let E = { f , al . . . . ,ak} where f is binary and a l , . . . a n are constants. Assume al < a 2 . . . < ak. Define >, for t = 1,2 by

ai f(x,y) f(al,x) aj f(al, x)

>t aj >t f ( z , u ) >1 aj >1 f(a~, x) >2 aj

if and only if if and only if if and only if if and only if for all i , j = 1 , . . . , k

i > j x>zorx=zandy>u i>j j > i

where x, y, z, u are arbitrary ground terms. Then L e m m a 3.4 For each of the orderings >1, >2

1. >t is a monotonic ordering and total on ground terms 2. f ( f ( x , y ) , z ) x,y,z.

>t f ( x , f ( y , z ) )

and if x >t Y then f ( x , y ) > f ( y , x ) for all ground terms

3. >~ is not well-founded. Proof

The proof is straightforward. For (3) notice that we have

f(a2, al) >t f ( a l , f(a2, al)) >t f ( a l , f ( a l , f(a2, al))) >t . . . . [] Notice that >1 is described by Boyer and Moore [2], where it is expressed in terms of projecting onto strings by s(al) = al, s(f(x, y)) -- f s ( x ) s ( y ) where f denotes function application, and ordering the strings lexicographically. To enable us to use the automatic confluence test described in section 2.2 we need to identify orderings with certain properties.

Definition 3.1 An ordering is called A C compatible for the binary operator f if it is monotonic, well-founded and total on ground terms, and satisfies for all ground terms x, y, z

f(f(z, y),z) > f(z, f(y,z)) f(x,y) f(x,f(y,z))

> f(y,x) > f(y,f(x,z))

ifx>y ifx>y

L e m m a 3.5 Let > be the Knuth-Bendix ordering or the lexicographie path ordering and f any binary function symbol. Then > is A C-compatible for f .

374

4

Examples

We present here examples of ground complete ordered rewriting systems. 4.1-4.9 are standard algebraic systems. In 4.10 we investigate combination of rewriting systems. In 4.11 we investigate an alternative ordering for which AC has a ground complete system containing two rules only, and in we give a ground complete ordered rewriting system for abelian groups. Examples 4.~-4.9 are all ground complete for any ordering > which 1. is AC-compatible for all AC operators in the system, and 2. satisfies s > t for all rules s - - + t. For examples 4.1-4.6 the Knuth-Bendix orderings and the lexicographic path orderings have the required properties. These examples were all proved ground complete using the method of section 2.2. The closure operator C was induced by 1 and 2 above. Intuitively one reason why all the examples involving AC work is that we are doing is using a sorting algorithm. Any ground term is equal to a product of irreducibles and the AC rules (1)(3) are sorting these irreducibles into increasing order using bubble sort. The two rule version is merely using a different sorting algorithm.

4.1

Commutativity

Let E be { x , y = y , x } and > any monotonic ordering total within equivalence classes of ground terms. Then (E, >) is a ground complete ordered rewriting system. It is confluent because there are no (non-triviai) critical pairs. It is terminating since each equivalence class is finite, and so any infinite chain of rewrites would contain a loop, whictl would imply that > was not irrefiexive.

4.2

A s s o c i a t i v i t y and C o m m u t a t i v i t y

This example has been discussed in the introduction. Let E be

(x,y),z

, x,(y,z)

x*y

=

y*x

x*(y*z)

=

y*(x*z)

(E, >) is also ground complete if > is either of the lexicographic orderings >i.

4.3

A s s o c i a t i v i t y and C o m m u t a t i v i t y - - A n o t h e r Version

In the introduction we observed that one of the criLical pairs generated by 4.2 was (z * (x • y), x * (y * z)). We may use this to obtain another three rule ground complete ordered rewriting system for AC. Let E be (x,y),z

~

x,(y,z)

x,y

=

y,x

z,(x,y)

=

x,(y,z)

and > any ordering which satisfies (5) and z • ( x , y) > x • (y • z) if z > x. The lexicographic path ordering and the Knuth-Bendix ordering have this property.

375

4.4

Associativlty, Commutatlvlty,

and Idempotence

Let E be --'-*

(x,y),z x*y x * (y * z)

x*(y*z)

=

y*x

=

y*(X*Z) X

X,*X

---.+

x * ( x * y)

x * y.

,2,

4.5

Groups of Exponent

Two

Let E be (x,y),z

~

x,y

=

x,(y,z)

=

X*X

x*(x*y)

x,(y,z) y,x

y,(x,z) )

1

----*

y

x*l

~

x

l*x

~

x

Then (E, >) is a ground complete ordered rewriting system for groups of exponent two. 4.6

Groups of Exponent

T w o in D i s g u i s e

We want to prove that the two laws (x,x),y

=

y

(=,y),z

=

(y,z),z

(s)

axiomatize groups of exponent two. Starting from this system, the completion procedure generated the following list of critical pairs, ordering some of them into rules: (x*y)*x

~

(x*y)*y

---*

x,x

y

=

x y*y

x *x

-.--+

1

1 *x

~

x

x*l x*(x*y) x*y

(9) (lo)

~ x ~ =

y y*x

(x*y)*z

---~

x*(y*z)

x*(~*z)

=

y*(~*z)

Notice that (10) is the result of "dividing" (9), i.e. introducing the new constant t. The final set of equations (all the ones below and including (10)) is the same as in section 4.5. All the other equations are now joinable.

376

In [10] the same problem is attacked with the help of the term rewriting system Reve. Because (8) cannot be oriented into a rule, Reve cannot deal with it directly. Martin obtained the result by working with consequences of (8) that can be ordered.

4.7

Distributivity

Let E be (x,y),z

----* x , ( y , z )

x*y

=

• ,(y,z)

y*x

=

x*(y+z)

~

x*y+x*z

(x+y)*z

~

x*z+y*z

and let > be any ordering which is AC-compatible for both + and ,. For example the lexicographic path ordering fits the bill. Then (E, >) is a ground complete ordered rewriting system. 4.8

Boolean

Rings

The following is a ground complete set of ordered rewrite rules for Boolean rings. x+y

x+(y+z) x+x O-b x 1,x x,O

(x,y),z x,(y+z)

=

y+x

=

y+(x+z)

~ -----* ~ ~

x*y

=

x,(y,z)

0 x x 0

x+O x , x x,1 O,x

y,x

=

y*(x*z)

~ ~ ---.+ ~

x x x 0

---~

x,(y,z)

(x+y)+z

--~

x+(y+z)

~

x,y+x,z

(x+y),z

---~

x*z+y,z

The ordering must be AC-compatible for both + and ,. The lexicographic path ordering has these properties. Ground confluence can be checked by the technique of section 2.2. 4.9

Another

System

Herewe present two similar small examples; for one our method works and for the other it does not. Consider the equation (x,y),

z = z,(x

,y),

(11)

and any ordering > in which x , y > z implies (x * y) * z > z * (x * y). The criteria of section 2.2 fail to prove ground confluence, although there is a very simple proof. The two critical pairs are (z*(x*y)),u

=

u,((x,y)*z)

((~,y),z),~

=

~,(z,(~,y)).

(12)

Let us just consider the first one. If (x * y) = z, (12) is an instance of (11). If (x • y) > z or ( x , y ) < z, (12)can be rewritten to ( z , ( x , y ) ) , u

= u,(z,(x,y))or

((x,y),z),u

= u,((x,y),z),

both of which are instances of (11). Again lemma 2.1 implies ground joinability. The proof for the second critical pair is practically identical.

377

The tests in section 2.2 cannot cope with these critical pairs because the proof of ground joinability is based on a case distinction which compares not just variables but whole subterms, namely x • y and z. On the other hand the equation (~,~),y=y,(~,x)

(13)

is an example of a system that our method proves ground confluent for any ordering total and well-founded on ground terms. The reason is that the only nontrivial critical pair y • ((x • x) • (x • x)) = ((~ • x ) , (x • ~)) • y is an instance of (13). By lemma 2.1 this implies ground joinability. 4.10

Combination

of Systems

In this section we discuss how a ground complete ordered rewriting system may be combined with a ground complete rewriting system in the usual sense. L e m m a 4.1 Suppose that 1. R is a ground complete rewriting system in the usual sense over a set of function symbols E andR I= {l=rlI~rE R},

2. (E, >) is a ground complete ordered rewriting system over a set of function symbols F, 3. there is a well-founded monotonic total ordering ~- on T ( E U F) such that ~- D_ > and al ~- a r f o r each rule l ---* r E R and ground substitution a, and 4. there are no critical pairs in the sense of definition 2.1 between E and R ~ w.r.t. ~-. Then ( E U R ~, ~-) is a ground complete ordered rewriting system.

P r o o f Condition 3 ensure that (E U R', >-) is terminating. Due to condition 4 the only critical pairs of ( E U R', ~-) are those of E or of R and hence are ground joinable. Thus (E U R t, ~-) is ground complete. [] As a corollary we see immediately that the combination of any of the theories we have considered above with new free function symbols (so R is empty) gives a ground complete ordered rewriting system. If R and E are both proved terminating using the lexicographic path ordering or KnuthBendix ordering, and assuming that the operator precedences are consistent on E N F, we may obtain a total ordering ~- by constructing a total operator precedence on E U F which subsumes the two partial precedences. Thus we may combine any of the examples above with any such R. 4.11

AC with Two Rules

In this section we show how with a suitable choice of ordering two rules suffice for a ground complete AC rewriting system. Let E be (x*y)*z x*y

--~ =

x*(y*z) y*x

378

and > any m o n o t o n i c ordering which is total on ground terms and satisfies for all ground terms x, y, z and all c o n s t a n t s a, b

(x,y),z

> x,(y,z)

x,y a

> >

ifx>y ifa>b.

y*x b,x

We show t h a t ( E , > ) is ground complete. Notice that the ordering >2 of the previous section has the required properties. (In fact it is not hard to see t h a t a n y ordering with these properties is not well-founded). We m u s t first prove t e r m i n a t i o n . Suppose t h a t 81 ===~ 8 2 ===~ is a n infinite chain of rewrites. Since each equivalence class is finite it must c o n t a i n a loop si ~ si+l ~ "" Si+k ~ 8i. But since s ~ t implies s > t we have si > Si+l > " " > si, which contradicts the definition of >. T h u s ( E , > ) is t e r m i n a t i n g . To prove g r o u n d confluence we first observe - - "

L e m m a 4.2 Let g and h be ground terms and let S~ be the multiset of all constants occurring in the term w. I f g =E h then Sg = Sh. Proof

Sg is i n v a r i a n t when a p p l y i n g the equations of E .

D

T h e n we can prove Theorem

4.1 Let ( E , > ) be as above. Then

1. I f w E TG then W =:=~* al * (a2 * ' " *

(an-1 * a n ) . . . )

where S~ = { a l , . . . , an} and al y). A reduction is applied to a ground t e r m only if the constraint is satisfied. If a > b in some ordering, then this constrained c o m m u t a t i v e law will rewrite a • b to b • a, but it will not rewrite b • a to a • b. By using constraints such as these we are able to generalize the entire K n u t h - B e n d i x process. In fact, complete sets of constrained reductions are now known for m a n y c o m m o n equational theories including Abelian groups, rings, and Boolean algebras, and there is an analogue of the K n u t h - B e n d i x procedure which begins with the axioms of an equational theory and a t t e m p t s to generate a complete set of reductions. This

382

constrained version of the Knuth-Bendix process will never fail because a non-orientable equation shows u p - - e v e r y equation can be oriented. It may, of course, fail because it runs forever trying to find a complete set. The process reduces to that of K n u t h and Bendix when presented with equations which are orientable without the use of constraints. Because of space limitations, we do not describe the entire process in this paper. Here we present the underlying theory that forms the basis for a mechanical test of the completeness of a given set of constrained reductions. T h e n we exhibit complete sets for various theories. Follow-on papers will be devoted to the completion process. In these sequels it will be necessary to specialize to a specific term ordering; here we are able to get by with a list of properties which the ordering must satisfy. The entire process has been implemented in C o m m o n Lisp running on a Symbolics 3650. The run-time characteristics are similar to implementations of the Knuth-Bendix process except that when constraints come into play, the process slows. This program has found complete sets of reductions for algebraic systems other than those mentioned in Section 6, including Abelian groups, but some of the theory necessary to actually automatically prove the completeness is not present in this paper, so the presentation of these results will await the sequel. As an example, the following three reductions taken collectively is a complete set equivalent to associativity and commutativity.

1. (=-u).z

=.

(u-z)

2. x . y - - - * y . x i f x > y 3. x . ( y . z ) ~ y . ( x . z )

1.1

if x > y.

Related Work

The approach of this paper is an alternate to the use of special unification algorithms such as associative-commutative unification [PS81] [JK86]. The advantage of constrained reductions is that constraints allow every equation to be oriented. The advantage of special unification algorithms is that they may be more efficient in situations where they are applicable. While studying the associative-commutative-identity version of the Knuth-Bendix algorithm [BP89] we found that constraints similar to, but simpler than, those of this paper were necessary. The present work came about because the author reasoned that if constraints were necessary when using certain special unification algorithms, why not back up to the beginning and find out what happens if the use of constraints, but not special unification, is added to Knuth-Bendix. A substantial b o d y of work (see [DO88] and [ZR85]) is available for "conditional" or "contextual" rewrite systems. These are only superficially similar to the constrained systems of this paper. For one thing, our constraints never affect the t r u t h of the constrained equation, only its applicability--all the equations we consider are universally true. For another, the constraints we use are reduced to conjunctions of atoms whose predicate symbol is >. This is an entirely different kind of expression t h a n those allowed in conditions or contexts.

383

T h e r e are other approaches to dealing with non-orientabte equations. For example, the "unfailing completion" of [BD87] carries the non-orientable equations along with the reductions and has special rules for handling them. C o m o n [Co90] has shown t h a t the existence of solutions of a constraint is decidable w h e n > is the lexicographic p a t h ordering.

2

Definitions We work in first-order logic with equality.

T h e reader should be familiar with

terms, substitutions, instances, ground terms, etc., as in [CL73]. T h e reader should also be familiar with ideas and terminology related to locations in a term, such as the t e r m formed by replacing the s u b t e r m at location ~ of a t e r m t by s: t[g +- s], and ancestors of a location, etc., as in [PS81]. We use 0 to represent the location of the root of a term, (1) for the leftmost s u b t e r m , etc. As usual we use --*+ as the transitive closure of the relation --% and -+* as its reflexive, transitive closure. We assume given a total simplification ordering > on the set of ground terms. T h a t is, > is a total ordering on ground terms which satisfies 1. if s is a strict s u b t e r m of t, then t > s (subterm property), and 2. if s > t, then u[~ ~- s] > u[~ +- t] for every t e r m u and location ~ (monotonicity). It is known IDES7] t h a t such an ordering is a well-ordering. The K n u t h - B e n d i x ordering and the lexicographie p a t h ordering are two examples of total simplification orderings ([De87]).

A constraint is a well-formed logical formula built from terms, the constants t and f, the predicates > and --, and the logical operators -~, A and V. The following are examples of constraints: x>y, = f(b))

f ( x , fCy, z)) > f ( y , f ( z , x ) )

v

>

/X (~(x > y) ',/ f ( x , g ( a , z ) ) ~- fCg(a,b),gCz, a))).

A constrained equation e is an expression of the form ~=p

if c

where )~ and p are t e r m s and c is a constraint. All variables are implicitly universally quantified and every variable in p or in c is also in ,k. In e the variables are interpreted as ranging over ground terms. Thus, in c, = and > have the meaning they acquire on ground terms. T h a t is, = means identical and > is the ordering on ground t e r m s which we assume exists. We assume t h a t > is a c o m p u t a b l e function so for every ground instance cO of c, there is a c o m p u t a b l e process which determines whether cO is I or f. In a constrained equation, if the constraint is t, then the constraint m a y be o m i t t e d and we will refer the equation as being unconstrained. In order to avoid wordiness, we will usually s p e a k simply of equations rather t h a n constrained equations.

384

We say t h a t constraints cl a n d e2 are logically equivalent, cl =- c2 if w h e n e v e r c10 and e20 are g r o u n d instances of cl a n d e2, respectively, it follows t h a t c10 is logically equivalent to e20. We define cl :=~ e2 similarly.

A true ground instance of a constrained e q u a t i o n e = (~ = p if e) is an equality of the f o r m (~0 = p0) where 0 is such t h a t e0 is g r o u n d a n d cO is true. A constrained reduction or rewrite rule is a c o n s t r a i n e d e q u a t i o n r = (~ = p if c) such t h a t for every true g r o u n d instance r0 of r, ~0 > pO. R e d u c t i o n s are n o r m a l l y w r i t t e n as ( A ~ p i f c). A n e x a m p l e is ( x . y - - + y . x i f x > y). Note. W h e n we say t h a t r = ( x - y -+ y . x if x > y) is a c o n s t r a i n e d r e d u c t i o n we are also implicitly saying s o m e t h i n g a b o u t the ordering > , for r will n o t be a r e d u c t i o n for all total simplification orderings. In fact, we are saying t h a t > satisfies: if s a n d t are g r o u n d t e r m s a n d s > t, t h e n s • t > t • s. This s t a t e m e n t is t r u e for the K n u t h - B e n d i x ordering and for the lexicographic p a t h ordering, t h e two orderings of m o s t interest to US.

Let R be a set of c o n s t r a i n e d reductions and t , s g r o u n d terms. We write t = ~ s w h e n e v e r there is a location £ of t and a reduction (~ -+ p if c) of R such t h a t either t/£ = ),0 and s = tie ~ pO] or t / l = pO and s = tie +- )@. We define =• as the reflexive, transitive closure of = ~ . We write t -~ s w h e n e v e r there is a c o n s t r a i n e d reduction (~ -+ p if e), a location e of t and a s u b s t i t u t i o n 0 such t h a t

c0 ~- t,

t/£ = ~0, and s = tie +

po].

It follows f r o m our definitions t h a t --.C_>. Therefore, since > is well-founded on g r o u n d terms, so is -~. If t is a g r o u n d term, tl is a -+ n o r m a l f o r m for t. A set R of c o n s t r a i n e d r e d u c t i o n s is a complete set of reductions if t = R s is equivalent to t ~ = s~. Let s ++ t m e a n s --+ t or t --+ s. Note t h a t when R contains c o n s t r a i n e d reductions, ,~* is n o t the s a m e as = R . We say g r o u n d terms s and t are joinable if there is a g r o u n d t e r m u such t h a t s --+* u and t --~* u. T h e relation --+ is ground confluent if w h e n e v e r s and t are g r o u n d t e r m s such t h a t s ++* t, it follows t h a t s a n d t are joinable. It is well-known t h a t if --~ is g r o u n d confluent and well-founded, t h e n each g r o u n d t e r m has a unique n o r m a l form, and w h e n e v e r s ++* t it follows t h a t s J,= tj,. If R is u n c o n s t r a i n e d , t h e n we m a y remove the w o r d "ground" f r o m t h e previous p a r a g r a p h a n d o b t a i n well-known definitions a n d results.

3

Ground Confluence versus Confluence

W h e n dealing with c o n s t r a i n e d reductions, one of necessity m u s t consider their applicability e x t e n d i n g only over g r o u n d terms. For, if we t r y to apply a c o n s t r a i n e d r e d u c t i o n to a t e r m c o n t a i n i n g variables, t h e n it m a y be impossible to d e t e r m i n e if t h e constraint is true or false. For example, (x • y --+ y • x if x > y) c a n n o t be applied to h(z) .w b e c a u s e h(z) > w c a n n o t be evaluated t o t or f since z and w are n o t g r o u n d .

385

This creates a small p r o b l e m because we want our work to have the same power as the work of K n u t h and Bendix, but they applied equations and reductions to general t e r m s and we are restricted to ground terms. This p r o b l e m would be solved if we could show t h a t in the unconstrained case, working over the ground level and working over the general level are equivalent. Therefore, let's consider the difference between ground confluence and confluence in the unconstrained case. According to the N e w m a n L e m m a [Ne42] an unconstrained s y s t e m of reductions is confluent if for every t e r m s, the following confluence test holds: W h e n e v e r s --+ tl a n d s --* t2, there is t3 such t h a t tl --** t3 and t2 --** t3. T h e test for ground confluence is the s a m e except t h a t it must hold only for every ground term. Our h o p e t h a t working over the ground and general levels would be equivalent seems to be dashed because we have the following example of a set of reductions which is ground confluent b u t not confluent [KN 87]. 1. f ( g ( f ( z ) ) ) -* 9 ( f ( g ( z ) ) ) 2. f(c) c 3. 9(c) --, c

This is not confluent because f ( g ( f ( g ( f ( Y ) ) ) ) ) rewrites to g ( f ( g ( g ( f ( y ) ) ) ) ) and to f ( g ( g ( f ( g ( Y ) ) ) ) ) and neither of these can be further rewritten. However, it is ground confluent because the only ground constant is c and since f(c) and g(c) b o t h rewrite to c, every ground t e r m will rewrite to c. This example seems to work because there is only one ground constant. If there were additional ground constants besides c, it would not work. P e r h a p s if there were enough ground constants, this kind of thing could not h a p p e n and our hope would be substantially restored. Indeed, this is the case. T h e o r e m 3.1. Let R be a set of unconstrained reductions and suppose there are infinitely m a n y constant symbols. Then R is confluent if and only if R is g r o u n d confluent.

Proof. We only need to show t h a t ground confluence implies confluence. So suppose R is ground confluent and suppose t is a t e r m which rewrites to b o t h tl and t2. Let 0 be a substitution which replaces the variables of t with constants which do not occur in R; each different variable with a different constant. In essence, applying 0 to a t e r m fixes the variables, turning t h e m into constants. Then t0 --, t10 and tO ~ t20. By ground confluence there is a t e r m t3 such t h a t t10 ~ * t3 and t20 --+* t3. It follows from the definition of --, t h a t if s is a t e r m whose variables occur in t and if s0 --* s', then s --, s'0 -1 where 0 -1 is the "antisubstitution" which is inverse to 0. T h a t is, in the unconstrained case, if you can reduce a term when variables are thought of as constants, you can also reduce it when they are thought of as themselves. (This s t a t e m e n t follows f r o m the fact t h a t if I --, r E R then la > r a for every substitution 0.) Going back to the original proof, we apply this to obtain tl --'* t30 -1 and t2 --,* t30 - 1 . I Reviewing this proof we see t h a t in fact it is not necessary to have infinitely m a n y constant symbols, b u t there must be enough so t h a t for every t e r m which occurs while checking confluence, the distinct variables can be fixed to represent distinct constants. Therefore, we m a k e the blanket a s s u m p t i o n t h a t enough constant symbols for this p u r p o s e are available in the language. Because of this we are justified in regarding our

386

work as a generalization of the work of K n u t h and Bendix even though our reductions will only be applicable to ground terms. We do not feel this is a serious restriction because in most situations, it is permissible for the logician to invent new constant symbols whenever they are deemed useful. Ground confluence is also considered in [KN87], [G587], and [ZR85].

4

A Completeness Test

In this section we develop a completeness test for a set of constrained reductions which is equivalent, when restricted to unconstrained reductions, to the Knuth-Bendix critical pairs completeness test. Critical constrained equations are formed as follows. For each pair of reductions (),1 --~ p l if el) and (A2 ~ P2 if c2) of R, including a reduction paired with itself, and for each non-variable location t of A1 such that A1/£ is unifiable with ),2 with most general unifier a, the constrained equation

(p,a

= )q[£ * - p2]cr if

(ClO A c2a))

is a critical equation of the hard type; and for each reduction (A --+ p if c) of R, the constrained equation

(~ =

p if ~ c )

is a critical equation of the easy type. We prefer to use the terminology "critical equation" rather t h a n the "critical pair" of other authors because we then have fewer different kinds of things. Both reductions and critical equations are a special kind of constrained equation and a new kind of entity, i.e. pair, is not necessary. Example. The critical equations of the complete set of reductions and commutativity which was given in the introduction are shown in first 3 equations in the figure are the easy ones and the remainder are 1. (x . y) . z = x . (y . z) if ~t from 1 from 2 2. x . y = y . x if -~(x > y) 3. x - ( y . z) = y - ( x . z) if ~(x > y) from 3 from 1 4. (x. (y. z)). zl = (x- y)- (z- zl) if t/X t from 2 5. (y.x).z = z. (y.z) if t/~ (x > y) from 2 6. z . ( x - y ) = x . CY.z) i f t A ( x . y > z ) 7. y l . ( ( x . y ) . z l ) = x - (y- ( y l - zl)) if t/X ( x - y > yl) from 3 from 3 8. x l . ((yl. z l ) - z ) --- ( y l . ( x l . z l ) ) . z if t A (xl > yl) from 1 9. ( x . y ) - ( x l . z) = x l - ( x - ( y . z ) ) if l A (xl > x. y) 10. y . ( x - z ) = ( y - z ) - x i f (x>y) A(x>y-z) from 2 from 2 11. y-C x . z ) = x . ( z . y ) if ( x > y ) A ( y > z ) 12. x. ( x l . (y. z)) = x l . (y. (x. z)) if (xl > x) A (x > y) from 3

for associativity Figure 4.1. The the hard ones.

into 1 into 1 into 1 into 1 into 1 into 3 in?~o 3 into 3 into 3

at at at at at at at at at

(1) (1) 0 0 (1) (2) 0 (2) (2)

Figure 4.1 Critical equations for associativity and commutativity A constrained equation e = (s = t if c) is joinable if for every true ground instance (sO = tO) of e, sO and tO are joinable. Given ground terms s, t, and u, we say t h a t (s = t)

387

is connected below u if there exist terms t 0 , Q , . . . ,t,~ such t h a t s = to, t = t,~, u > t~ for 0 < i < n, a n d t ~ _ x ~ t~ for 0 < i < n. A constrained equation e : (s = t i f e) is subconnected if for every true ground instance (sO : tO) of e and for every ground u such t h a t u -++ s0 and u --~+ tO, (sO : tO) is connected below u. 4.1. (Critical equations completeness test) The following statements are equivalent. i R is a complete set of reductions, ii every critical equation is jolnable, iii every critical equation is subconnected.

Theorem

T h e implication ii=~i is the analogue of the ordinary critical pairs completeness test. S t a t e m e n t iii is included because the implication iii=~i will p r o b a b l y be useful if results pertaining to the elimination of critical pairs ([ZK89]) are generalized to the case of constrained reductions.

Proof. i=~ii: Suppose R is a complete set of reductions and let e = (s = t if c) be a critical equation. Let (s0 = tO) be a true ground instance of e. By the m a n n e r in which the critical equation was formed, sO :z~ tO. Since R is complete, sO~: tg~. Thus e is joinable. ii=¢,iii: This follows because joinable implies subconnected. iii=~i: Suppose every critical equation is subconnected. We wish to show t h a t R is complete. Note first t h a t : R is the same relation as +-** because easy critical pairs are subconnected. Therefore, it will suffice to show t h a t --~ is ground confluent and for this it will suffice to show t h a t -+ satisfies the hypotheses of the generalized N e w m a n l e m m a [WB83]: The relation ~ is confluent if and only if for all ground t, Q, t2: if t -~ tl and t --~ t2, then tt and t2 are connected below t. Suppose t, t l , t 2 are ground terms such t h a t t ~ tl and t --+ t2. It follows t h a t there are r l : (At --+ pl if el) and r2 = (A2 --~ P2 if e2) in R, locations £I, £2 of t, and a s u b s t i t u t i o n 0 such t h a t

c10 = t

t/el

c20 : t

: AIO

t/£2 : ~zO

tl = t[et *-- p10]

(1)

t2 = t[£2 is monotone, it is clear t h a t tl and t2 are connected below t if and only if p10 and A10[£ y) ~ x : y V y > x 4. - , ( x : y ) ~ x > yV y > x

6.

v y) +

A

(= v y) ^ z

F i g u r e 5.1 N o t - e l i m i n a t i o n rules

^ z) v (y ^ z)

Figure 5.2 A n d over or rules

Step 2 - - D i s t r i b u t e and over or. A p p l y the reductions of Figure 5.2 to c until t h e y are no longer applicable. After this is done, c will be a disjunct of conjuncts. Step 3 - - M a k e n e w equations f r o m each disjunct. At this point, e has the f o r m (s : t if cl V c2 V . . . V c,,). Replace e by the n new critical equations

(s = t if cl),

(s = t if ce) " " (s = t if c.).

This is justified by T h e o r e m 5.3. T h e equation (s = t if cl Vc2) is joinable i[ and only if both (s = t if cl) a n d (s = t if c2) are joinabIe. Proof. If e = (s = t if cl v c2) is joinable a n d (s0 = tO) is a t r u e g r o u n d i n s t a n c e of e l = (s = t if c t ) , t h e n (sO = tO) is also a true g r o u n d instance of e, so (sO = tO) is j o i n a b l e a n d it follows t h a t e l is joinable. Similarly ee = (s = t if c2) is joinable. If el a n d e2 are b o t h j o i n a b l e a n d (sO = tO) is a t r u e g r o u n d instance of e, t h e n (sO = tO) is a t r u e g r o u n d instance of either el or e2 so (sO = tO) is joinable and it follows t h a t e is joinable. II A f t e r this s t e p we are left w i t h A as the only logical o p e r a t o r in t h e c o n s t r a i n t s of o u r critical equations. Step 4 - - R e m o v e t and f. Use the rules of Figure 5.3 until t h e y are no longer applicable. A f t e r this step, either c = f or c = t or neither t nor f occur in c.

390

tAx--~ x xAf--~ f fAx~f Figure 5.3 Rules for r e m o v i n g t a n d f

Step 5--Remove equalities. Suppose c = (tl = t2)Ac'. If tl and t2 are n o t unifiable, t h e n replace c by I; if tl a n d t2 are unifiable w i t h m g u a, t h e n replace e by (s : t if d ) a . This is justified by T h e o r e m 5.4. The equation (s : t if (tl : t2) A c) is joinable if and only if Q and t2 are not unifiable, or (s = t if c)a is joinable where a is the mgu of tl and t2.

Proof. Suppose e = (s = t if (tl = t : ) A c) is joinable a n d t~ and t2 are unifiable w i t h m g u a. Let ( s a c = t o e ) be a t r u e g r o u n d instance of e' = (s = t if c)a. T h e n c a ¢ = | and t l a ¢ = t 2 a ¢ . Since e is joinable, ( s a c = the) is joinable and it follows t h a t e * is joinable. O n the o t h e r h a n d , s u p p o s e either tl and t2 are not unifiable, or e ~ is joinable. If tl a n d t2 are not unifiable, t h e n for every g r o u n d instance e0 of e, t10 ¢ t20 and it follows t h a t t h e r e are no true g r o u n d instances of e. So s u p p o s e e ~ is joinable and let (sO = tO) be a true g r o u n d instance of e. It follows t h a t tlO = t~O and c0 -- i. T h u s , there is ¢ such t h a t 8 = h e . Since e ~ is joinable, (tO = sO) is joinable a n d it follows t h a t e is joinable. | After this step c is either i or an only > 's constraint, i.e., a c o n j u n c t of a t o m s each with predicate s y m b o l > . Let a greater-than atom be one whose predicate s y m b o l is > .

Step 6--Eliminate contexts, redundancies, tautologies and inconsistencies; add transitive implications. It seems best to phrase these final steps in t e r m s of t h e a l g o r i t h m s h o w n in Figure 5.4. T h e function N F ( N o r m a l Form) takes two only > ' s c o n s t r a i n t s cl and c2 as a r g u m e n t s , the first of which is already in n o r m a l form. It r e t u r n s a n o r m a l f o r m for cl A c2. For p u r p o s e s of this algorithm, a c o n j u n c t of a t o m s is considered as a set of atoms. If it is desired to p u t c into n o r m a l form, t h e n NF(O, c) would be called, where 0 is the e m p t y set. T h e idea is to take the g r e a t e r - t h a n a t o m s f r o m c2 one at a !NFCc,,c2) : ire2 is e m p t y , then return el;

(s > t) ~-- first(c2); c2 ~ rest(c2); i f ( s > t) = u[£ +- s'] > u[£ ~-- t'] for some terms u , s ' , t ' a n d location £ ¢ 0 , then replace s > t w i t h s ~ > t ' and r e p e a t this step if possible. if s is a s u b t e r m of t, then return f; f i t is a s u b t e r m of s, then return N F ( c l , c 2 ) ; f i t is a s u b t e r m of u for some (s > u) E cl, then return g r ( c l , c 2 ) ; f l u is a s u b t e r m of s for some (u > t) E Cl, then return g F ( c t , c 2 ) ; for every (s > u) E ct such t h a t u is a s u b t e r m of t, do cl *- Cl - (s > u); for every (u > t) E cl such t h a t s is a s u b t e r m of u, do cl ¢- cl - (u > t); for every (u > v) • ct such t h a t s = v / l , do c2 ~ e2 + (u > v[£ +- t]); for every (u > v) • cl such t h a t u = t/g, do c2 ~-- c2 + (s > t[£ ~-- v]); return W E ( c , A (s > t), c2). Figure 5.4 A l g o r i t h m for p u t t i n g only > ' s constraints into n o r m a l f o r m

1

2 3 4 5 6

7 8 9 10 11 12 13 14

391

time and add t h e m to Cl, in the process keeping cl in normal form and adding new consequences to c2. We now briefly describe the algorithm. At line 3 we take the first element s > t of c2. We will process it and possibly add it to cl at line 14. Lines 4 and 5 remove contexts, i.e. if s and t are the same except for some subterm, then s and t may be replaced by this subterm, respectively. This is justified by monotonicity. For example, x. ( y . z ) > x . y may be replaced by y . z > y. Line 6 removes inconsistencies; no term can be less t h a n a subterm of itself. Line 7 removes tautologies; every term is greater than a strict s u b t e r m of itself, so this does not need to be explicitly stated in the constraint. Lines 8, 9, 10, and 11 remove redundancies. For example, if x > y • z and x > y both occur in a constraint, then the second is redundant because it easily follows from the first. Lines 12 and 13 add transitive implications. For example, if x > y • z and y > u b o t h occur in a constraint, then we also add x > u. It is important to do this in order to reveal hidden inconsistencies. For example, if x > y and y > x b o t h occur in a constraint, then this step will add x > x which will be found to be inconsistent when it is received by line 6. We have no proof t h a t this algorithm always terminates, but it has terminated on many examples and we believe it always terminates. The soundness of the algorithm can easily be proved, however. This is left to the reader. Unfortunately, there are constraints equivalent to t which this algorithm will not reduce to I. For example, it is possible to set up the Knuth-Bendix ordering so that a and f(a) are adjacent for some constant a and function symbol f . In this situation, (x > a) A (f(a) > x) is inconsistent, but this will not be discovered by the algorithm. However we have found this algorithm quite adequate in practice.

Examples. Since redundancies are discarded, N F ( x . Consider N F ( x . x > z, z > x). During the processing of z > x - x > x is added to c2 but it is later discarded because it is is ( x . x > z) A (z > x). Finally, N F ( x > y, ( - y ) > ( - x ) . y ) is added to c2 at line 13 and then at line 6, I is returned.

5.2

x > z, x > z) = x > z. x, the transitive implication a tautology, thus the answer = f because ( - y ) > ( - y ) .y

Joinability by Cases

Once we have the constraint into normal form, the real work of testing joinability begins. The job is to reduce the equational part of the contrained equation to normal form and check to see if the sides are identical. Since the reductions in R are applicable only under certain circumstances, this leads to splitting the reduction process into cases depending on whether or not the conditions for some reduction are satisfied. The equation e = (s = t if c) is partially reducible by (,~ --~ p if cl) to el with remainder e2 if there is a substitution a and a location e of (s = t) such that (s = t)/e =

~o, (c A c~o) ~ f, et = ((s = t)[e ~-- pal if (c A cla)) e2 = (s = t if (c A -~Cla)).

and

392

In the same situation, e is reducible to el if (c/x -~cla) = f, i.e. c =~ Cla. In particular, if ci = t, then e is reducible to el. Note that if e reduces to e l , then the constraint of el is simply c. In order to use this definition in practice, we must have a way to test (c/~ cla) ~ f and e =~ cia. T h e first is checked by executing N F ( c , cla) and testing to see if the result is f. As mentioned, there might be cases in which (c/x cia) - f but this test shows otherwise. However, the consequence is that e is replaced by el and e 2 and it is still true t h a t e is joinable if e l and e2 are. (See Theorem 5.5 below.) T h e consequence of this error is that some equations that ~ i g h t have been proved joinable if the error were caught will not be proved joinable. To check c :=~ cia we first put cia into normal form, then try to show t h a t every greater-than atom of cla is redundant in c A cla as in lines 8-11 of Figure 5.4. If this is the case, then c ==~cla, otherwise it doesn't. For example,

(= > y. z)

(x > y).

T h e o r e m 5.5. If the equation e reduces to el, then e is joinable if el is joinable. If e partially reduces to el with remainder e2, then e is joinable if ei and e2 are joinable. This is the primary result used in proving that an equation is joinable. Given an equation e, we try to find a reduction that will reduce it. If we can find such, then e is replaced by the equation to which it reduces. Otherwise we try to find a constrained reduction t h a t will partially reduce it. If this is found, then e is replaced by el and e2. Proof. We prove the second statement, the first then follows. Suppose

e=(s=tifc), el = ((s = t)[e ~ pa] if (c/~ ¢ia)),

e~ = (s = t if (c/x -~cio)), and e l and e2 are both joinable. Let e0 be a true ground instance of e. If cio8 = f, then (s9 = t0) is joinable since e2 is joinable. On the other hand, if cla8 = t, then sl9 and t18 are joinable, where (si = Q) = (s = t)[~ ~-- pa]. But either s --~ si or t ~ ti and it follows that s8 and t0 are joinable. II Example. Consider the proof of joinability of equation 6 of Figure 4.1. We show part of this proof in Figure 5.5. In Figure 5.5, the first line of each box is the left-hand side of the equation, the second line is the right-hand side, and the additional lines are joined by A's to make the constraint. T h e original equation can be partially reduced by ( x . (y- z) ~ y . (x. z) if x > y) to ( x . ( z - y ) = x - ( y . z) if (x. y > z) A (z > x)) with remainder (z. (x.y) = x. (y. z) if ( x . y > z) A-~(z > x)). T h e first of these is shown in the left box of the second row in Figure 5.5 and the joinability of the remainder is implied by the joinability of the equations shown in the last two boxes on the second row. The '5.5b' listed on the arcs indicates that it is primarily the second part of T h e o r e m 5.5 that is used to show t h a t the joinability of the top box follows from the joinabili'ty of its children. The remainder of the figure is interpreted similarly. At this point the reader could profit by using these ideas to prove the joinablilty of the critical equations for associativity and commutativity shown in Figure 4.1.

393

x (y. ~) x y>z l

li.tz.~)/ `[5.5b

(y.

y>z z>x

~5.5b ~. (x.y) Ix.(y.~)

`[5.5[

I~

y>z >z ....

tx.y>z IZ=X

1

15.4

,[5.5b

15-5b i

15.5b

(y. x)

(~. z) • . (y. z) x.

x.y>z z>x z>y

~)

. (x. y) (y.

y>x

l::>x

>x >z

:Z

,~5.4

x. (y. y) x. (y. y)

I

x.y>y y>x

t5.5a !"• (~. (~• y) y) .y>z >x >z

x• (y. x) x.y>x x>y

`[5.5b

5.5b

I x. (y.~5.5b x)

(y.x)

ti"(x.y) y>x

=X

,[5.4

" (x. y) • '(y. x)

If

.y>x >x

,L5.ga

(x.y)

(x. x) x>x

y>x >x

li• (x.y)

Figure 5•5 Proving joinability by cases

6 Examples Consider the reductions in Figure 6.1. As we have seen, the first three of these constitute a complete set for associativity and commutativity. Reductions 1 through 5 constitute a complete set for a semilattice--a set with one binary operator which is associative, commutative and idempotent, see [MB67], page 487. Reductions 1 through 18 constitute a complete set for a boolean algebra with • denoting and, + exclusive or, 1 true, and 0 false• Finally, it follows from Theorem III in [Gr47] that reductions 1 through 20 constitute a complete set for a ternary boolean algebra. 1. ( x - y ) - z--* x - ( y . z) 11. x - 1 --* x 2. x . y - - ~ y . x i f x>y 12. 1 . x - ~ z 3. x . ( y . z ) - ~ y . ( x . z ) if x > y 13. x + O - - - * x 4. x * x - + x 14. O + x - - - ~ x 5. x . ( x . y ) - - ~ x . y 15. x . 0 - * 0 6. ( x + y ) + ~ - - , x + ( y + ~ ) 16. 0 . x - ~ 0 7. x + y - - - ~ y - ~ x | f x > y 17. x . ( y + z) --* x . y + x . z 8. x + ( y + z ) ---* y + ( x + z ) if x > y 18• ( x + y ) . z - - - * x . z + y . z 9. x T x - - ~ O 19. f ( x , y , z ) - - ~ x . y + y . z + z . x 10. x + (x + y) --~ y 20. - x - - * l + x Figure 6.1 Reductions in complete sets

394

References [BD87] L. Bachmair, N. Dershowitz, and D. Plaisted, "Completion Without Failure," Preliminary Proceedings of the Colloquium on the Resolution of Equations in Algebraic Structures, Lakeway Texas, May 4-6, 1987, sponsored by Microelectronics and Computer Technology Corporation, M. Nivat and H Ait-Kaci, organizers. [BP89] T. Baird, G. Peterson, and R. Wilkerson, "Complete Sets of Reductions Modulo Associativity, Commutativity and Identity," Lecture Notes in Computer Science 355 Rewriting Techniques and Applications, RTA-89, N. Dershowitz, ed., SpringerVerlag, 1989, 29-44. [CL73] C. Chang and R. Lee, Symbolic Logic and Mechanical Theorem Proving, Academic Press, New York, 1973. [Co90] H. Comon, "Solving Inequations in Term Algebras," Fifth Syrup. on Logic in Computer Science, LICS 90, 1990. [DES7] N. Dershowitz, "Termination of rewriting," J. Symbolic Computation, 3 (1987), 69-116. [DO88] N. Dershowitz, M. Okaba, and G. Sivakumar, "Canonical Conditional Rewrite Systems," Lecture Notes in Computer Science 310, 9th International Conference on Automated Deduction E. Lusk and R. Overbeek editors, 1988, 538-549. [G 86] R. GSbel, "Completion of Globally Finite Term Rewriting Systems for Inductive Proofs," UniversitSt Kaiserslautern SEKI-REPORT SR-86-06, June 1986. [G 871 R. GSbel, "Ground Confluence," Lecture Notes in Computer Science 256 Rewriting Techniques and Applications, RTA-87, P. Lescanne, ed., Springer-Verlag, 1987, 156167. [Gr47] A. A. Grau, "Ternary boolean algebra," Bulletin of the American Mathematical Society, 53 (1947), 567-572. [JK861 J.-P. Jouannaud and H. Kirchner, "Completion of a set of rules modulo a set of equations," SIAM Journal of Computing, 15 (1986), 1155-1194. [KB70] D. Knuth and P. Bendix, "Simple word problems in universal algebras," Computational Problems in Abstract Algebras, J. Leech, ed., Pergamon Press, Oxford, England, 1970, 263-297. [KN871 D. Kapur, P. Narendran, and F. Otto, "On Ground-Confluence of Term Rewriting Systems," Technical Report 87-6, Department of Computer Science, State University of New York, Albany, N.Y. 12222. [MB67] S. MacLane and G. Birkhoff, Algebra, The Macmillan Company, New York, 1967. [Ne421 M. H. A. Newman, "On theories with a combinatorial definition of 'equivalence'," Annals of Mathematics 43/2 (1942), 223-243. [PS81] G. Peterson and M. Stickel, "Complete sets of reductions for some equational theories," Journal of the Association for Computing Machinery, 28 (1981), 233-264. [StSXl M. Stickel, "A unification algorithm for associative-commutative functions," Journal of the Association for Computing Machinery, 28 (1981), 423-434. [WB831 F. Winkler and B. Buchberger, "A Criterion for Eliminating Unnecessary Reductions in the Knuth-Bendix Algorithm," Colloquia Mathematiea Soeietatis Jdnos

395

Bolyai 42, Algebra, Combinatorics and Logic in Computer Science, GySr, Hungary, 1983. [ZK89] H. Zhang and D. Kaput, "Consider Only General Superpositions in Completion Procedures," Lecture Notes in Computer Science 355, Rewriting Techniques and Applications, RTA-89, Springer-Verlag, 1989, 511-527. [ZR85] H. Zhang and J.-L. Remy, "Contextual Rewriting," Lecture Notes in Computer Science 202 Rewriting Techniques and Applications, edited by Jean-Pierre Jouannaud, 1985, 46-62.

Rewrite Systems for Varieties of Semigroups* Franz Baader G e r m a n Research Center for Artificial Intelligence DFKI, Projektgrup~pe W I N O , Postfach 2080 D-6750 Kaiserslautem, West G e r m a n y

Abstract We consider term and word rewriting systems for semigroup theories and study the connection between these two concepts. As an application, the lattice of all varieties of idempotent semigroups is investigated with the following point of view: Can we decide the word problem of the varieties in question by using finite canonical term or word rewriting systems ? In spite of the fact that there are infinitely many varieties of idempotent semigroups, this question can be solved completely. We thus obtain infinitely many examples of equational theories which satisfy the following property: The theory has decidable word problem, but it cannot be decided by using a finite canonical term or word rewriting system.

1 Introduction A finite canonical term rewriting system can be used to decide the word problem for the corresponding equational theory. The fact that there exist equational theories with undecidable word problem thus implies that there are equational theories which do not have a finite canonical term rewriting system. However, we can ask whether all decidable word problems can be decided with the help of a finite canonical term rewriting system. The corresponding question for semi-Thue systems was asked by Jantzen [8] in 1982, and negative answers were given e.g. by Book [3] in 1983, and by Jantzen [9] and Kapur-Narendran [10] in 1985. Since semi-Thue systems can be considered as term rewriting systems for terms over monadic function symbols ( see Kapur-Narendran [10], p. 342 ), this also answers the question for term rewriting *Thisresearchwas donewhilethe authorwas stillat the IMMD 1, UniversityErlangen.

397

systems. But the examples - which were used to demonstrate this answer - were merely constructed for that purpose. In Section 4 we shall give countably many examples which are of some mathematical interest: All varieties of idempotent semigroups have a decidable word problem. But only three of them can be defined by a finite canonical term rewriting system. Using term rewriting systems for semigroup theories means that we work with terms and realize associativity by rules of the rewrite system. A more promising - and also more usual - approach would be to rewrite modulo associativity, i.e., to work with words instead of terms. In this case we talk about word rewriting systems ( please note that our word rewriting systems have nothing to do with semi-Thue systems, which are sometimes also called "word rewriting systems" ). But even for word rewriting systems, only nine varieties of idempotent semigroups can by defined by finite canonical systems. In Section 3 we shall consider term rewriting systems for semigroup theories and show that canonical term rewriting systems for regular semigroup theories are of a very specific form. This will be used in Section 4 to prove the above mentioned result about term rewriting systems for varieties of idempotent semigroups. Section 5 is devoted to word rewriting systems and clarifies the connection between finite canonical term and word rewriting systems. In Section 6 we shall state the results about word rewriting systems for varieties of idempotent semigroups. A proof of these results can be found in Baader [1], Chapter IV. It is rather involved and requires knowledge of Fennemore's solution of the word problem for varieties of idempotent semigroups ( Fennemore [4], see also Baader [1] Chapter III ).

2

Definitions and Notations

Let f2 be a signature, i.e., a set of function symbols with fixed arity, and let V be a countable set of variables. We denote the set of all f~-terms with variables in V by F(I2,V). This set is the carrier of the free f2-algebra with generators V, which will also be denoted by F(fLV). Any mapping of V into an f~-algebra A can be uniquely extended to a homomorphism of F(I2,V) into .~ We write homomorphisms in suffix notation, i.e., sO instead of 0(s). Consequently, composition is written from left to right, i.e., G0 means fn'st ~ and then 0. An endomorphism 0 of F(~,V) is called a substitu-

tion iff it has finite domain, where the domain of 0 is defined as D(0) := { x; x0 # x }.

398

Let s be a term. The set of all variables occurring in s is denoted by V(s). Let E be a set of identities ( equational theory ) and let ~

be the equality of terms,

induced by E. The theory E is called regular iff (1,r) ~ E implies V(1) = V(r). An equational theory E defines a variety ~ ] , i.e., the class of all algebras ( of the given signature f~ ) which satisfy each identity of E. The set of all subvarieties of a given variety ~ ] is a complete lattice w.r.t, set inclusion, which will be denoted by L([E]).

EXAMPLE 2.1. Consider f2 = { f } for a binary function symbol f. The variety of all

idempotent semigroups ( which are also called bands in the literature ) is defined by B := { f(f(x,y),z) = f(x,f(y,z)), f(x,x) = x }. Complete descriptions of the lattice L([B]) have been given by Birjukov [2], Gerhard [5], and Fennemore [4] ( see Figure 2.3 below, and Baader [1], Chapter III ). There are countably many varieties of bands. The varieties [TB], [RZ], [LZ], [RB] of all trivial, right zero, left zero, and rectangular bands are defined by non-regular theories, namely by TB = { x = y }, RZ = { f(f(x,y),z) = f(x,f(y,z)), f(x,y) = y }, LZ = { f(f(x,y),z) = f(x,f(y,z)), f(x,y) = x }, and RB = { f(f(x,y),z) = f(x,f(y,z)), f(x,f(y,x)) = x, f(x,x) = x }. The other varieties are defined by regular theories.

DEFINITION 2.2. An equational theory E is called semigroup theory iff the corresponding signature consists of only one binary function symbol, say f, and E implies associativity of f, i.e., f(f(x,y),z) =E f(x,f(y,z)) holds.

Please note that we do not allow constant symbols in the signature.

3 Term Rewriting Systems for Semigroup Theories Let R be a term rewriting system ( TRS ) and let -->R be the rewrite relation defined by R. The transitive closure of '->R is denoted by +-%R' and the reflexive, transitive closure is denoted by -'g R" Obviously, =R is the reflexive, transitive, and symmetric closure of "-->R"A term t is R-irreducible iff there does not exist a term s such that t ->R s. The system R is canonical iff -->R is both confluent and terminating. It is a term

399

The lattice of all varieties of bands

FIGURE 2.3.

fight semiregular

left

fight seminormal

left seminormal

left q

quasinormal

fight regular

left regular rectangular right normal

left

left zero

semilattice

trivial

right zero

400 rewriting system for the equational theory E iff =E = =R" A finite canonical TRS R for E can be used to decide the word problem for E as follows: for given terms s, t we reduce s to an R-irreducible term s' and t to an R-irreducible term t'. Then

s =E t iff

s' = t'. For a finite terminating TRS R, confluence can be decided by considering finitely many critical pairs. If R is not confluent we can try to find an equivalent confluent system with the help of the Knuth-Bendix algorithm ( Knuth-Bendix [11], Huet [7] ).

E X A M P L E 3.1. We consider the semigroup theories L Z o f all left zero bands, RB of all rectangular bands ( see Example 2,1 ), and LR = { f(f(x,y),z) = fix,fiy,z)), f(x,f(y,x)) = fix,y), fix,x) = x ], which is the theory of all left regular bands. If we orient the identities of LZ, RB, and LR from left to right, we obtain terminating TRSs R, S and T. The system R = { f(f(x,y),z) --) f(x,fiy,z)), fix,y) --) x } is confluent. The system S = { f(f(x,y),z) --~ f(x,f(y,z)), f(x,fiy,x)) ---) x, fix,x) ---) x } is not confluent since the critical pair between the first and the third rule is not confluent. If we apply the Knuth-Bendix algorithm to S, we obtain the finite canonical TRS { f(f(x,y),z) --~ fix,z), f(x,f(y,z)) --~ fix,z), fix,x) ~ x } for RB. The Knuth-Bendix algorithm does not terminate for T = { f(f(x,y),z) ~

f(x,f(y,z)),

f(x,f(y,x)) ---) f(x,y), fix,x) ---) x } since it computes infinitely many critical pairs of the form

or .

But it is easy to see that it generates the following infinite canonical TRS for LR: { f(f(x,y),z) --~ fix,fly,z)), fix,x) --~ x, fixl,f(x 2 ..... fiXn_l,fiXn,Xl))...)) ---) f(xl,f(x 2 ..... flXn_1 ,Xn)..-)), f(xl,f(x 2 ..... f(Xn_l,f(xl,Xn))..,)) ---) f(xl,f(x 2 ..... flXn_1 ,Xn)...)); n > 2 }.

Most implementations of the Knuth-Bendix algorithm yield reduced TRSs, i.e., TRSs R where the right hand side r of the rule 1 --) r ~ R is R-irreducible and the left hand side 1 is (R \ { 1 --) r })-irreducible. P R O P O S I T I O N 3.2. ( Metivier [12] ) (1) Let R and S be reduced canonical TRSs for E and assume that termination of R and S can be shown with the same termination ordering. Then R and S are equal up to

401

variable renaming. (2) Let R be a canonical TRS for E, and let S be defined as follows: S := { (l,r$); (1,r) e R, 1 is ( R \ {I --~ r})-irreducible a n d r $ is the unique R-irreducible element of the =E-Class of r

}

Then S is a reduced canonical TRS for E. The canonical TRSs for RB and LR of Example 3.1 are reduced. The system R = { f(f(x,y),z) ~

fix,fly,z)), fix,y) ~

x } is not reduced since the left hand side of

f(f(x,y),z) ~ f(x,f(y,z)) can be reduced by f(x,y) --~ x. Part (2) of Proposition 3.2 implies that { f(x,y) ~ x } is a reduced canonical TRS for LZ. Reduced canonical TRSs for regular semigroup theories are of a very specific form. L E M M A 3.3. Let R be a canonical TRS for the regular semigroup theory E. Then we have either f(x,fiy,z)) ~ R flf(x,y),z) oder f(fix,y),z) +-+--~Rf(x,fly,z))PROOF.

In this and in the following proofs we shall write --+ instead of ~R" From

f(x,(y,z)) =E f((x,y),z) we obtain that there exists a term t such that f(x,f(y,z)) -~ t ~*- f(f(x,y),z). If one of the -~-derivations is a 0-step derivation, then the lemma is proved. Otherwise, we have fix,fiy,z)) -% t ~+ f(fix,y),z). Since E is regular we know that V(t) = { x, y, z }. That means that f occurs at least twice in t, i.e., t = f(u,f(v,w)) or t = f(f(u,v),w) for terms u, v, w. Without loss o f generality we may assume that t = f(u,f(v,w)). The terms t, u, v, w do not contain other variables than x, y, z. Hence we can write t = t(x,y,z), u = u(x,y,z), v = v(x,y,z), w = w(x,y,z). W e define u 1 := u, v 1 := v, w 1 := w and - if u n, v n, w n are already def'med - Un+l:= U(Un,Vn,Wn), Vn+l := V(Un,Vn,Wn), Wn+l:= W(Un,Vn,Wn). Now the following is an infinite chain of reductions for R: f(x,f(y,z)) ~

t(x,y,z) = f(ul,f(vl,Wl)) ~

t(Ul,Vl,W 1) = f(u2,f(v2,w2)) ~

t(u2,v2,w 2) =

f(u3,fiv3,w3) ) --% ... --~ t(Un,Vn,Wn) = f(Un+l,f(Vn+l,Wn+ 1) --~ .... This contradicts the fact that R terminates. ~1

The canonical TRS { f(x,y) --~ x } for LZ shows that the condition "E regular" is necessary. According to Proposition 3.2, any canonical system R for E can be trans-

402

formed into a reduced canonical system S for E such that ISI _ Irl for all rules I ---) r e R \ { f(f(x,y),z) ~ f(x,f(y,z)) }" need not terminate. As an example, consider the system S = { f(f(x,y),z) ---) f(x,f(y,z)), f(y,f(y,x)) ---) f(x,x)}. We have f(z,f(z,f(z,z))) ' ) S f(f(z,z),f(z,z)) ~ S f(z,f(z,f(z,z))), which shows that S does not terminate. This example depends on the fact that x occurs only once on the left hand side of f(y,f(y,x)) --~ f(x,x, ) but twice on the right hand side. A rule 1 --~ r is called length reducing if it satisfies the property III > trl and illx > Irlx for all variables x occurring in 1. If 1 ---) r is length reducing then 11~1 > Ircl for all substitutions o. This shows P R O P O S I T I O N 3.6. Let R be a right normalized TRS such that all rules I --~ r e R \ { f(f(x,y),z) --~ f(x,f(y,z)) } are length reducing. Then R terminates. The assumption of the proposition is sufficient for termination of right normalized TRSs, but it is not necessary: E X A M P L E 3.7.

Consider the right normalized TRS R := { f(f(x,y),z) ---) f(x,f(y,z)),

f(y,f(x,z)) ---) f(x,x) }. The rule f(y,f(x,z)) ~ f(x,x) is not length reducing. The termination of R can be shown with the following polynomial interpretation ( which has been found by Frank Drewes from the University of Bremen ): the minimal value of the interpretation has to be > 3, and the polynomial x 2 + xy is associated to f(x,y).

404

4 Term Rewriting Systems for Varieties of Idempotent Semigroups We have already seen that { fix,y) ~ x } ( resp. { f(fix,y),z) --~ f(x,z), fix,fly,z)) --a fix,z), fix,x) --~ x } ) is a finite canonical TRS for L Z = { f(f(x,y),z) = f(x,f(y,z)), fix,y) = x } ( resp. RB = { f(f(x,y),z) = fix,fly,z)), f(x,f(y,x)) = x, f(x,x) = x } ). By symmetry we have that {f(x,y) --~ y } is a finite canonical TRS for RZ = { f(f(x,y),z) = fix,fly,z)), fix,y) -- y }, which is the theory of right zero bands. There does not exist a canonical TRS for TB = { x = y } - which is the theory of all trivial bands - since all rules 1 ~ r of a terminating TRS must satisfy V(r) ~ V(1). All the other theories which define varieties of bands are regular theories.

PROPOSITION 4.1. Let E be a regular semigroup theory which defines a variety of bands. Then there does not exist a finite canonical TRS for E. PROOF.

Assume that S is a canonical TRS for E. By Proposition 3.2, there exists a

reduced canonical TRS R for E which does not have more rules than S. Without loss of generality we may assume f(fix,y),z) --) fix,fiy,z)) ~ R ( Lemma 3.4 ). Now =B _c =E implies flx0,fix 1..... f(Xn,f(x0,fix 1..... flXn-l'Xn)'")))"')) =E flx0'fixl ..... f(Xn-l'Xn)'")) for all n > 0. Since E is regular, the term t := fix0,f(x 1..... f(Xn.l,Xn)...)) has minimal length in its =E-Class. Because t is also right normalized, Lemma 3.5 implies that t is R-irreducible. Hence f(x0,fix 1..... f(Xn't)"')) +---)R t. Assume that the first step in this derivation is done with the rule g --~ d and the substitution ~. Since t is R-irreducible we have g a = f(x i..... flXn,t)...) for some i, 0 < i < n. This implies that g is of the form g = f(zjl,flzj2,...f(Zjm_l,Zjm)...)) for variables Zjv. Since g can be reduced by R, the variables Zjv cannot be pairwise different. In addition, we have that IZja~l = lzj/cl . . . .

=

Izjmqerl = 1 because otherwise g~ would not be right normalized. For IZjm~l = 1 we have m = 2(n+l)-i > n. On the other hand, lzjmol > 1 implies: Zjm is different from zjl, zj2 ..... zjm_t, and there

405

exist v < g < m-1 such that Zjv = zig. The first n+l variables of g~ - namely xi, Xi+l, .., Xn, x 0 ..... xi_ 1 - are all different. This yields g > n+l. In any case we have Igl > n. This shows that R cannot be finite, which implies that S is also infinite. ~1

Thus we have shown our first main theorem

T H E O R E M 4.2. Let E be a semigroup theory which defines a variety of bands. There exists a finite canonical TRS for E if and only if E defines one of the varieties [LZ], [RZ], or [RB].

5 Word Rewriting Systems Let A := { f(f(x,y),z) ---) fix,fly,z)) } denote the theory of semigroups. The quotient algebra F({f},V)/= A is isomorphic to V +, i.e., the free semigroup with generators V. The elements of V + are words over the alphabet V, and the semigroup operation is the concatenation of words. If we omit the f's and the parentheses, then any semigroup theory can be regarded as a subset of V + x V +. Instead of TRSs, we can now consider word rewriting systems ( WRSs ) for E. A set R c V + x V + is called word rewriting system iff for all (1,r) ~ R we have V(r) K V(1) ( for a word w we denote by V(w) the set of all variables occurring in w ). The W R S R defines the following rewrite relation --)R on V+: ---)R := { (u(l~)v,u(r~)v); t ~ r ~ R, ~ is a substitution and u, v ~ V* } ( In this context substitutions are endomorphisms of V + such that { x ~ V; xG ~ x } is finite. V ' d e n o t e s the free monoid with generators V ). It is easy to see that { x 2 --~ x, xyx ---) xy } is a canonical WRS for LR = { x 2 = x, xyx = xy }. This shows that it m a y be advantageous to use WRSs instead of TRSs. A disadvantage of WRSs is the fact that, even for terminating systems, confluence can in general not be decided by considering only finitely many critical pairs. This is a consequence of the fact that A is of unification type "infinitary" ( see e.g. Plotkin [13] ).

406

But termination of WRSs is decidable. For a word w ~ V + and a variable x e V we denote by Iwl the length of w, and by lwl x the number of occurrences of x in w. A rute 1 --~ r of a W R S is called

length reducing iff

Ill > Id and Iltx > Irlx for all variables x oc-

curring in 1.

P R O P O S I T I O N 5.1. A WRS R terminates iff all rules of R are length reducing. PROOF.

I f all rules of R are length reducing, then u -%R v implies lul > Ivl, which

shows termination of R. Conversely, assume that the rule 1 ~ r e R is not length reducing. It is easy to see that there exists a substituition ¢r such that llcl < trcl and V(kr) = V(rcr) = { z }. But then l c is a subword of rcr which yields an infinite derivation.

As an immediate consequence of this proposition we have

C O R O L L A R Y 5.2.

Let R be a canonical W R S and let w E V + be a word. The =R"

class of w contains exactly one element u o f minimal length. The word u is the unique R-irreducible element in the =R-Class of w.

Before we can clarify the connection between confluence of WRSs and TRSs we need a technical l e m m a concerning abstract reduction properties ( see Huet [6] for notations ). Let -~1 u --~2 c T x T be a reduction on the set T, and let ~ be the reflexive, transitive, and symmetric closure of --~2" The relation ---~1 induces a reduction ~

on

the set o f all --classes T/_ = { T ; t e T } ( where ~ := { s; t ~ s } ): --,'~ :¢~ There exist s' E ~, t' e "t such that s' ---~1 t'.

L E M M A 5.3 If --~1 u -~2 is confluent on T, then -~ is confluent on T / . PROOF.

Let ~ 1 , 2 denote the reduction ~ 1 u ~ 2 " N ° W ' i l ~ "/2 implies t 1 ~ 1 , 2 t2"

Since -~1,2 is confluent, there exists t ~ T such that t I -'~1,2 t 4~--1,2 t 2.

The --~l-steps

407

of these derivations can be simulated by ---)-steps on the --classes. The --)2-steps can be omitted since they do not change the N-class. Hence we have't 1 --*-)'t~- "{2" Q

P R O P O S I T I O N 5.4. Let R = R 1 t_) R 2 be a confluent TRS for the semigroup theory E such that all rules 1 ---) r ~ R 1 satisfy 1 =A r. Then there exists a confluent WRS S for E with I R21 rules. If, in addition, all rules of R 2 are length reducing, then S is canonical. PROOF.

Without loss of generality we may assume that f(f(x,y),z) ---) f(x,f(y,z))

R 1. Otherwise we can insert this rule into R 1 without changing the generated congruence, or destroying the confluence property. W e want to apply L e m m a 5.3. To that purpose, we define T := T({f},V), ---~1 := ---)Rr and ---)2 := --)R2" Let ~

and - be de-

fined as in L e m m a 5.3. The l e m m a yields that --~ is confluent on T/N. Obviously, T/_ is isomorphic to V +. The system R 2 can be considered as W R S S which generates the reduction --). If the rules of R 2 are length reducing, then S is terminating by Proposition 5.1. Q

It is still open whether there exists a semigroup theory E which has a finite canonical TRS, but which does not have a finite canonical WRS. The problem is termination. If E has a finite canonical TRS, then it also has a finite canonical TRS which is reduced and thus right ( or left ) normalized. But the property "length reducing" - which is necessary for termination o f WRSs - is not necessary for termination of fight ( left ) normalized TRSs ( see Example 3.7 ). The TRS of Example 3.7 is not confluent. Thus it remains an open question whether there exists a semigroup theory which has a

re-

duced canonical TRS which is not length reducing.

E X A M P L E 5.5.

R = { f(f(x,y),z) ---) f(x,f(y,z)), fix,y) ~ x } is a canonical TRS for

L Z and S = { fff(x,y),z) --) f(x,f(y,z)), f(x,f(y,z)) -~ f(x,z), fix,x) ~ x } is a canonical TRS for RB. Proposition 5.4 implies that { xy --) x } is a canonical W R S for L Z and { x 2 ~ x, xyz ~ xz } is a canonical WRS for RB.

408

6 Word Rewriting Systems forVarieties of Idempotent Semigroups Siekmann and Szabo [15] showed that { x 2 ---) x } w { uvw ~

uw; V(v) ~ V(u) =

V(w) } is an infinite canonical W R S for B, the theory of idempotent semigroups. They conjectured that B does not have a finite canonical WRS. In Baader [1] it is shown that this conjecture is true for almost all varieties of idempotent semigroups. Another proof of the conjecture for B can be found in Schmidt-Schaul3 [14]. In this section we shall recall the results of Baader [1], Chapter IV. For the theories TB = { x = y }, LN = { x 2 -- x, xyz = xzy } ( left normal bands), RN = { x 2 = x, zyx = yzx } ( right normal bands), N = { x 2 = x, xyzx = xzyx } ( normal bands ) and R = { x 2 = x, xyxzx = xyzx } ( regular bands ) one can easily find equivalence classes with two different elements of minimal length. By Corollary 5.2 we thus get that these theories do not have finite canonical WRSs. The proofs for the other theories are rather involved. They require knowledge of Fenn e m o r e ' s solution of the word problem for varieties of idempotent semigroups ( Fennemore [4], see also Baader [1], Chapter III ).

T H E O R E M 6.1. Let E be a semigroup theory which defines a variety of bands. There exists a finite canonical WRS for E if and only if E defines one of the varieties [LZ], [RZ], [RB], [LR], [RR], [LQN], [RQN], [LSN] or [RSN]. More precisely: (1) The theory L Z = { xy = x } of all left zero bands has the canonical WRS { xy ---) x}. (2) The theory RZ = { xy = y } of all right zero bands has the canonical W R S { xy ---~y} (3) The theory RB = { xyx = x, x 2 = x } of all rectangular bands has the canonical WRS { x 2 ---) x, xyz " ' ) XZ }. (4) The theory L R = { xyx = xy, x 2 = x } of all left regular bands has the canonical W R S { x 2 ~ x, xyx ---~ xy }. (5) The theory RR = { xyx = yx, x 2 = x } of all right regular bands has the canonical WRS { x 2 --) x, xyx ~ yx }. (6) The theory L Q N = { xyxz = xyz, x 2 = x } of all left quasinormal bands has the canonical WRS { x 2 ---) x, xyxz ~ xyz }.

409

(7) The theory RQN = { zxyx = zyx, x 2 = x } of all fight quasinormal bands has the canonical WRS { x 2 ~ x, zxyx --~ zyx }. (8) The theory LSN = { xyz = xyzxz, x 2 = x } of all left seminormal bands has the canonical WRS { x 2 --~ x, xazbzx ~ xazbx, xzbzx --4 xzbx, zxbzx --~ zxbx, zbxzx --~ zbx, zbxazx ~ zbxax }. (9) The theory RSN = { zyx = zxzyx, x 2 = x } of all fight seminormal bands has the canonical WRS { x 2 ~ x, xzbzax ~ xbzax~ xzbzx ~ xbzx, xzbxz ~ xbxz, xzxbz xbz, xzaxbz ~ xaxbz }. (10) The other varieties of bands cannot be defined by a finite canonical WRS. PROOF.

See Baader [1], Chapter IV. The proof cannot be included in this paper due

to the space limitations. El

Acknowledgements I should like to thank Frank Drewes for the termination proof of Example 3.7.

References [1] Baader, F. Unifikation und Reduktionssysteme fiir Halbgruppenvarietaten. Ph.D. Dissertation. Arbeitsberichte des IMMD 22. Erlangen: Institut fiir Mathematische Maschinen und Datenverarbeitung, 1989. [2] Birjukov, A.P. Varieties of Idempotent Semigroups. Algebra i Logika 9, 1970. English translation in Algebra and Logic 9, 1970. [3] Book, R.V. A Note on Special Thue Systems With a Single Defining Relation.

Math. Systems Theory 16, 1983. [4] Fennemore, C.F. All Varieties of Bands I, II. Math. Nachr. 48, 1971. [5] Gerhard, J.A. The Lattice of Equational Classes of Idempotent Semigroups. J. Al-

gebra 15, 1970. [6] Huet, G. Confluent Reductions: Abstract Properties and Applications to Term Rewriting Systems. J. ACM 27, 1980. [7] Huet, G. A Complete Proof of the Correctness of the Knuth Bendix Completion Algorithm. J. Comp. Sys. Sci. 23, 1981.

410

[8] Jantzen, M. Semi Thue Systems and Generalized Church-Rosser Properties. Bericht Nr. 92, Fachbereich Informatik, Universit~it Hamburg, 1982. [9] Jantzen, M. A Note on a Special One-Rule Semi-Thue System. Information Pro[10] [11]

[12] [13] [14] [15]

cessing Letters 21, 1985. Kapur, D. and P. Narendran. A Finite Thue-System with Decidable Word Problem and without Equivalent Finite Canonical System. Theor. Comp. Sci. 35, 1985. Knuth, D.E. and P.B. Bendix. Simple Word Problems in Universal Algebra. In Leech, J. ( Ed. ). Computational Problems in Abstract Algebra. Pergamon Press, 1970. Metivier, Y. About the Rewriting Systems Produced by the Knuth-Bendix Completion Algorithm. Information Processing Letters 16, 1983. Plotkin, G. Building in Equational Theories. Machine Intelligence 7, 1972. Schmidt-SchauB, M. Unifikation Properties of Idempotent Semigroups. SEKI Technical Report, Universit~it Kaiserslautern, 1986. Siekmann, J. and P. Szab6. A Noetherian and Confluent Rewrite System for Idempotent Semigroups. Semigroup Forum 25, 1982.

Improving

associative Joachim

path

orderings"

Steinbach 2

Abstract The effective computation with term rewriting systems modulo a t h e o r y E p r e s u m e s E - t e r m i n a t i o n . W e w i l l g i v e a c l a s s i f i c a t i o n of t h e w e l l known methods guaranteeing AC-termination based on the recursive path ordering. Furthermore, we will show that these techniques [called associative p a t h o r d e r i n g s ~] c a n n o t u s e q u a s i - o r d e r i n g s o n o p e r a t o r s . A b o v e all, t h i s r e p o r t w i l l d e a l w i t h t w o n e w o r d e r i n g s a p p l i c a b l e to A C - t h e o r i e s . W e a p p l y t h e c o n c e p t of t h e a s s o c i a t i v e p a t h o r d e r i n g to t h e r e c u r s i v e p a t h o r d e r i n g w i t h s t a t u s [RPOS] a n d t h e i m p r o v e d r e c u r s i v e d e c o m p o s i t i o n o r d e r i n g w i t h s t a t u s [IRDS]. S i n c e t h e s e o r d e r i n g s a r e s t r o n g e r t h a n t h e r e c u r s i v e p a t h o r d e r i n g , t h e c o r r e s p o n d i n g o r d e r i n g s r e s t r i c t e d to A C - t h e o r i e s a r e m o r e p o w e r f u l t h a n t h e a s s o c i a t i v e p a t h o r d e r i n g . F r o m a p r a c t i c a l p o i n t of v i e w t h e a s s o c i a t i v e commutative IRDS is m o r e i n t e r e s t i n g than the associative path ordering b e c a u s e t h e d e t e c t i o n of a n a d m i s s i b l e p r e c e d e n c e for o r i e n t i n g t h e r u l e s of a g i v e n s y s t e m is e a s i e r .

1 Motivation T e r m r e w r i t i n g s y s t e m s a r e g a i n i n g m o r e a n d m o r e in i m p o r t a n c e because t h e y a r e a u s e f u l m o d e l for n o n - d e t e r m i n i s t i c computations: They are based o n d i r e c t e d e q u a t i o n s w i t h n o e x p l i c i t c o n t r o l . T h e b a s i c c o n c e p t of t e r m r e w r i t i n g s y s t e m s [[KB70]] is t h a t of r e d u c i n g a g i v e n t e r m to a s i m p l e r o n e . A n e q u a t i o n is c o n v e r t e d i n t o a d i r e c t e d r e w r i t e r u l e in s u c h a w a y t h a t t h e right-hand s i d e of t h e r u l e is s i m p l e r t h a n t h e l e f t - h a n d s i d e . In o r d e r to exclude infinite derivations of t e r m s a r e w r i t e system must terminate. 0 r d e r i n g s on t e r m s a r e a b l e to g u a r a n t e e t e r m i n a t i o n . A s u r v e y of t h e m o s t i m p o r t a n t o n e s is g i v e n in [De87]. T h e b a s i c i d e a of u s i n g a n o r d e r i n g > is t o v e r i f y t h a t t h e r e w r i t e r e l a t i o n ~ [ i n d u c e d b y t h e r u l e s y s t e m 9%] is i n c l u d e d in >. S u c h a n o r d e r i n g m u s t b e w e l l - f o u n d e d to a v o i d i n f i n i t e d e r i v a t i o n s of t e r m s . To c h e c k t h e i n c l u s i o n ' ~ c >' a l l [ i n f i n i t e l y m a n y ] p o s s i b l e d e r i v a t i o n s m u s t b e t e s t e d . The m a i n i d e a is t o r e s t r i c t t h i s i n f i n i t e t e s t to a f i n i t e o n e b y r e q u i r i n g a r e d u c t i o n ordering. A reduction o r d e r i n g is a w e l l - f o u n d e d ordering which has the replacement p r o p e r t y [ a l s o c a l l e d c o m p a t i b i l i t y w i t h t h e s t r u c t u r e of t e r m s ] w h i c h e n s u r e s t h a t a v a l u e of a t e r m w i l l b e d e c r e a s e d if a n y o n e of i t s s u b t e r m s is d e c r e a s e d . T h e n o t i o n of r e d u c t i o n o r d e r i n g s l e a d s t o t h e f o l l o w i n g d e s c r i p t i o n of t e r m i n a t i o n of r e w r i t e s y s t e m s [ d e v e l o p e d b y L a n k f o r d , s e e

[De87]]: 1 This research was supported by the Deutsche Forschungsgemeinschaft. S F B 314 2Universit~t Kaiserslautern, FB Informatik, Postfach 3049, D-6750 Kaiserslautern

412

A r e w r i t e s y s t e m if{ t e r m i n a t e s if a n d o n l y i f t h e r e e x i s t s a r e d u c t i o n o r d e r i n g > s u c h t h a t o[i] > air] for e a c h r u l e 1 -->~ r a n d for a n y g r o u n d s u b s t i t u t i o n cs. This t h e o r e m r e v e a l s a n o t h e r d i l e m m a w h i c h is k n o w n a s t h e u n i v e r s a l quantification on substitutions or t h e s o - c a l l e d s t a b i l i t y w.r.t, s u b s t i t u t i o n s : s > t i m p l i e s ~[s} > ~[tl, for a l l g r o u n d s u b s t i t u t i o n s 6. S u m m a r i z i n g , i t is t o r e m a r k t h a t a t e r m i n a t i o n p r o o f of a t e r m r e w r i t i n g s y s t e m r e q u i r e s a r e d u c t i o n o r d e r i n g s t a b i l i z e d w.r.t, s u b s t i t u t i o n s . In g e n e r a l , it is v e r y d i f f i c u l t t o g u a r a n t e e t h e w e l l - f o u n d e d n e s s of a r e d u c t i o n o r d e r i n g . This f a c t l e a d s to t h e b a s i c c o n c e p t of c h a r a c t e r i z i n g c l a s s e s of o r d e r i n g s for w h i c h t h e r e is no n e e d to p r o v e t h i s c o n d i t i o n . O n e p o s s i b l e s o l u t i o n is r e p r e s e n t e d b y t h e c l a s s of s i m p l i f i c a t i o n o r d e r i n g s w h i c h a r e a t l e a s t r e d u c t i o n orderings:

A n o r d e r i n g is a s i m p l i f i c a t i o n o r d e r i n g i f a n d o n l y if it h a s the replacement property, t h e s u b t e r m p r o p e r t y [ a n y t e r m is g r e a t e r t h a n a n y of i t s proper subterms] and t h e d e l e t i o n p r o p e r t y [ d e l e t i n g s u b t e r m s r e d u c e s t h e term]. Well-known simplification orderings are the recursive path orderings, various k i n d s of p a t h a n d d e c o m p o s i t i o n o r d e r i n g s a n d t h e K n u t h - B e n d i x orderings, for e x a m p l e . U n f o r t u n a t e l y , t h e t e r m i n a t i o n of a n a r b i t r a r y t e r m r e w r i t i n g s y s t e m is a n u n d e c i d a b l e p r o p e r t y , e v e n in t h e ) o n e - r u l e c a s e ' [[Da88]]. A n a d d i t i o n a l n e g a t i v e f a c t d e r i v e s f r o m t h e e x i s t e n c e of e q u a t i o n s of w h i c h t h e l e f t - h a n d s i d e a n d t h e r i g h t - h a n d s i d e a r e i n c o m p a r a b l e in a n y c a s e . F o r example, a rewriting system containing the commutativity a x i o m x*y = y+x as a r u l e is n o n - t e r m i n a t i n g , H o w e v e r , if t h e t e r m i n a t i o n p r o p e r t y is n o t s a t i s f i e d , t h e s e t of a x i o m s c a n b e s p l i t i n t o t w o p a r t s [[PS81], [ J K 8 6 ] ] : T h o s e axioms causing non-termination are used as equations E while the others are used as rewrite rules ~. The appropriate reduction relation allows reductions m o d u l o t h e e q u a t i o n s in E. T h e e f f e c t i v e c o m p u t a t i o n w i t h t h i s r e l a t i o n p r e s u m e s

a c o m p l e t e u n i f i c a t i o n a l g o r i t h m for t h e e q u a t i o n a l t h e o r y E, E - t e r m i n a t i o n , i.e. t h e r e is n o i n f i n i t e s e q u e n c e of t e r m s of t h e f o r m t I ~ ' E t~ ~ t2 = E t~2 ~9~¢ ....

W e n o w a d a p t t h e g e n e r a l r e s u l t s on t e r m i n a t i o n m e n t i o n e d a b o v e t o t h e c a s e of e q u a t i o n a l t e r m r e w r i t i n g s y s t e m s . A n e q u a t i o n a l t e r m r e w r i t i n g s y s t e m t e r m i n a t e s if t h e r e is a n o r d e r i n g > w h i c h c o n t a i n s t h e r e w r i t e r e l a t i o n ~ / E E° ~ o = E [ w h e r e o d e n o t e s c o m p o s i t i o n of r e l a t i o n s ] . T e s t i n g t h i s i n c l u s i o n r e q u i r e s a l l d e r i v a t i o n s of t h e f o r m s ~ / E t tO b e c h e c k e d . This requirement c a n b e r e f i n e d : If > is E - c o m p a t i b l e { [ P S 8 1 3 , s e e fig. 11, t h e n > contains ~IE if a n d o n l y if it c o n t a i n s ~ [cf. [BP85]I.

413

If a r e d u c t i o n o r d e r i n g > is E - c o m p a t i b l e a n d e[ll > e[rl, for e v e r y r u l e 1 -->;~ r a n d e v e r y g r o u n d s u b s t i t u t i o n e, t h e n t h e e q u a t i o n a l t e r m r e w r i t i n g s y s t e m ~/E terminates. Jouannaud and Munoz succeeded in w e a k e n i n g the E-compatibility for t h i s s t a t e m e n t [see [JM84]I. They introduced a property called E-commutation [ s e e fig. 1). S

~-'~"E

SI

>

t

S I ~'~>

~'-~'E t ~ i8 E - c o m p a t i b l e

S

>

>

t~

t

Figure 1

~E

S~

Sj ~>

~t ~

>

t

=E

t~

~ is E-commuting

T h e f o l l o w i n g t h e o r e m [of [ S t 8 9 b ] ] p o i n t s o u t t h e m a i n i m p o r t a n c e of t h e E-commutation for t h e E - t e r m i n a t i o n p r o b l e m . T h e t h e o r e m is a m o d i f i c a t i o n of a r e s u l t c o n t a i n e d in [ J M 8 4 1 A rewrite system ~ is E-terminating i f t h e r e e x i s t s an E-commuting s i m p l i f i c a t i o n o r d e r i n g > s u c h t h a t ~[1] > ~[r] f o r e a c h r u l e 1 --~¢ r a n d f o r a n y g r o u n d s u b s t i t u t i o n o. Obviously, E-termination strongly depends For example, E must satisfy the following i n f i n i t e d e r i v a t i o n s I s e e [ J M 8 4 ] I : F i r s t of v a r i a b l e s of b o t h t e r m s m u s t b e i d e n t i c a l . b e s a t i s f i e d if t h e r e is a n e q u a t i o n of t h e t h a n o n e o c c u r r e n c e in t.

o n t h e g i v e n u n d e r l y i n g t h e o r y E. t w o c o n d i t i o n s in o r d e r t o p r e v e n t all, if s = t E E, t h e n t h e s e t of Furthermore, E-termination cannot form t =E x such that x has more

W e a r e g o i n g t o d e a l w i t h a s p e c i a l t h e o r y E: a s s o c i a t i v e - c o m m u t a t i v e a x i o m s . A n e q u a t i o n a l t h e o r y E is c a l l e d a n a s s o c i a t i v e - c o m m u t a t i v e theory if e v e r y e q u a t i o n in E is e i t h e r a n a s s o c i a t i v e [ f [ x , f [ y , z l ) = f [ f [ x , y l , z ) , f E ~ A 1 or c o m m u t a t i v e [ f [ x , y l = f l y , x ) , f E ~ c ) a x i o m . In o r d e r t o d e s c r i b e t h e f a c t t h a t f is b o t h a s s o c i a t i v e a n d c o m m u t a t i v e w e u s e 'f c ~ A C ' A n e q u a t i o n a l term rewriting system [~,El will be an associative-commutative term r e w r i t i n g s y s t e m if E is a n a s s o c i a t i v e - c o m m u t a t i v e theory. T h e r e o n l y e x i s t a f e w o r d e r i n g s for t h i s k i n d of r e w r i t i n g s y s t e m s , e.g. t h e a s s o c i a t i v e p a t h o r d e r i n g s [EGL86], [BP85], [ D H J P 8 3 ] I , t h e o r d e r i n g s o n s p e c i a l polynomial interpretations [EBL87], ESZ90]I a n d t h e a s s o c i a t i v e - c o m m u t a t i v e Knuth-Bendix orderings [[St89b]l. Associative path orderings extend the r e c u r s i v e p a t h o r d e r i n g s to A C - c o n g r u e n c e c l a s s e s . T h e y a r e b a s e d on f l a t t e n i n g a n d t r a n s f o r m i n g t h e t e r m s b y a r e w r i t i n g s y s t e m w i t h r u l e s s i m i l a r to t h e distributivity [or t h e e n d o m o r p h i s m l a x i o m s . H e r e , w e s u p p l y a c o n c e p t w h i c h e x t e n d s t h e a s s o c i a t i v e p a t h o r d e r i n g in t w o w a y s . F i r s t of alt, a p r o o f w i l l b e g i v e n t o j u s t i f y t h e u s e of s t a t u s in t h e d e f i n i t i o n of t h e a s s o c i a t i v e p a t h o r d e r i n g s I t h e u s e of s t a t u s is a n e x t e n s i o n to t h e c o n c e p t s of [GL863, [BP85] a n d EDHJP83]I. F u r t h e r m o r e , w e h a v e s u c c e e d e d in a p p l y i n g t h e c o n c e p t s of t h e a s s o c i a t i v e p a t h o r d e r i n g s to

414

t h e i m p r o v e d r e c u r s i v e d e c o m p o s i t i o n o r d e r i n g [[Ru87], [St89a]]. T h u s , t h e results presented h e r e e x t e n d t h o s e of [ S t 8 9 a ] to A C - t h e o r i e s . A n o t h e r a d v a n t a g e of t h i s A C - d e c o m p o s i t i o n o r d e r i n g is t h a t t h e p r e c e d e n c e c a n o f t e n b e d e r i v e d f r o m t h e s t r u c t u r e of t h e r e d u c t i o n r u l e s i n a n e a s i e r w a y t h a n with the associative path ordering. After giving some indispensable definitions in the next chapter, the classical t e r m o r d e r i n g s [ s e e [St89a]] w i l l b r i e f l y b e p r e s e n t e d . In c h a p t e r 4, w e r e c a p i t u l a t e , c l a s s i f y a n d e x t e n d [ b y i n c o r p o r a t i n g s t a t u s ] t h e c o n c e p t of t h e r e s t r i c t i o n to A C - t h e o r i e s c o n t a i n e d i n [BP85] a n d [GL86]. M o r e o v e r , i t w i l l b e s h o w n t h a t t h e s e t e c h n i q u e s c a n n o t u s e q u a s i - o r d e r i n g s o n t h e s e t of f u n c t i o n s y m b o l s . S u b s e q u e n t l y , t h e a p p l i c a t i o n of t h i s a p p r o a c h to t h e d e f i n i t i o n of o n e of t h e m o s t p o w e r f u l p a t h a n d d e c o m p o s i t i o n o r d e r i n g s a s w e l l a s t h e a p p r o p r i a t e l e m m a s a n d s o m e e x a m p l e s w i l l b e g i v e n . The c o r r e s p o n d i n g p r o o f s of t h e l e m m a s a r e g i v e n i n [St89c].

2 Notation A t e r m r e w r i t i n g s y s t e m ~R o v e r a s e t of t e r m s F is a f i n i t e or c o u n t a b l y i n f i n i t e s e t of r u l e s , e a c h of t h e f o r m 1 - - ~ r , w h e r e 1 a n d r a r e t e r m s i n F, s u c h t h a t e v e r y v a r i a b l e t h a t o c c u r s i n r a l s o o c c u r s i n I. The s e t F of all t e r m s is c o n s t r u c t e d from e l e m e n t s of a s e t ~ of o p e r a t o r s [or f u n c t i o n s y m b o l s ] a n d s o m e d e n u m e r a b l y i n f i n i t e s e t ~ of v a r i a b l e s . T h e s e t of g r o u n d t e r m s [ t e r m s w i t h o u t v a r i a b l e s ] is d e n o t e d b y Fo The l e a d i n g f u n c t i o n s y m b o l a n d t h e t u p l e of t h e [ d i r e c t ] a r g u m e n t s of a t e r m t a r e r e f e r r e d to b y top[t] a n d args[t], r e s p e c t i v e l y . A s u b s t i t u t i o n d is d e f i n e d as a n e n d o m o r p h i s m o n F w i t h t h e f i n i t e d o m a i n {x i~[x] $ x}. W e u s e t h e f o r m a l i s m of p o s i t i o n s of t e r m s w h i c h a r e s e q u e n c e s of n o n - n e g a t i v e i n t e g e r s . The s e t of all p o s i t i o n s of a t e r m t is c a l l e d t h e s e t of o c c u r r e n c e s a n d i t s a b b r e v i a t i o n is OIt]. A t e r m i n a l o c c u r r e n c e is a n o c c u r r e n c e of a leaf of a t e r m . W e w r i t e t / u to d e n o t e t h e s u b t e r m of t a t o c c u r r e n c e u E O[t]. A [ p a r t i a l ] o r d e r i n g o n FO is a t r a n s i t i v e a n d i r r e f l e x i v e b i n a r y r e l a t i o n >. It is c a l l e d w e l l - f o u n d e d if t h e r e a r e n o i n f i n i t e d e s c e n d i n g c h a i n s . M o s t of t h e o r d e r i n g s on t e r m s are p r e c e d e n c e o r d e r i n g s u s i n g a s p e c i a l o r d e r i n g on o p e r a t o r s . M o r e p r e c i s e l y , a p r e c e d e n c e is a p a r t i a l l y [or q u a s i - ] o r d e r e d s e t [~ , ~] c o n s i s t i n g of t h e s e t ~ of o p e r a t o r s a n d a n i r r e f l e x i v e [or r e f l e x i v e ] a n d t r a n s i t i v e b i n a r y r e l a t i o n ~ d e f i n e d o n e l e m e n t s of ~. O b v i o u s l y , a q u a s i - o r d e r i n g d e f i n e s a n e q u i v a l e n c e r e l a t i o n -- as b o t h E a n d ~_ [~_ n ~_], a n d a p a r t i a l o r d e r i n g ~ as E b u t n o t 4 [ E \ ~_]N o t e t h a t a t e r m o r d e r i n g ~ is u s e d to c o m p a r e t e r m s . S i n c e o p e r a t o r s h a v e t e r m s as a r g u m e n t s w e d e f i n e a n e x t e n s i o n of 7, c a l l e d l e x i c o g r a p h i c a l l y g r e a t e r [~lex], o n t u p l e s of t e r m s as f o l l o w s : [sl,s 2 ..... Sm} ~.lex [ t l , t 2 ..... t n ] if e i t h e r [m > 0 ^ n = 0 ] or [s i ~ t 1] or Is I = t 1 ^ Is 2 ..... Srn] ~lex It 2 ..... t n ] ] '

415

If t h e r e i s n o o r d e r of s u c c e s s i o n a m o n g t h e t e r m s of s u c h t u p l e s , t h e s e structures are called multisets. Multisets differ from sets by allowing multiple o c c u r r e n c e s of i d e n t i c a l e l e m e n t s . T h e m u l t i s e t d i f f e r e n c e is r e p r e s e n t e d b y \. T h e e x t e n s i o n of ~ o n m u l t i s e t s of t e r m s is d e f i n e d a s f o l l o w s . A m u l t i s e t S is g r e a t e r t h a n a m u l t i s e t T, d e n o t e d b y S ~ T i f f S ~ T ^ [Vt 6 T\SI [3s 6 S\TI s ~ t. To c o m b i n e t h e s e t w o c o n c e p t s of t u p l e s a n d m u l t i s e t s , w e a s s i g n a s t a t u s z[fl to each operator f 6 ~ that determines the order according to which the s u b t e r m s of f a r e c o m p a r e d . F o r m a l l y , a s t a t u s is a f u n c t i o n w h i c h m a p s t h e s e t of o p e r a t o r s i n t o t h e s e t { m u l t , l e f t , r i g h t } . Thus, a f u n c t i o n s y m b o l c a n h a v e o n e of t h e f o l l o w i n g t h r e e t y p e s of s t a t u s : m u l t [ t h e a r g u m e n t s will b e c o m p a r e d a s m u l t i s e t s ] , l e f t [ l e x i c o g r a p h i c a l c o m p a r i s o n f r o m l e f t to r i g h t ] a n d r i g h t [ t h e a r g u m e n t s w i l l l e x i c o g r a p h i c a l l y b e c o m p a r e d f r o m r i g h t to left]. T h e r e s u l t of a n a p p l i c a t i o n of t h e f u n c t i o n a r g s to a t e r m t = f[t I ..... tn] d e p e n d s o n t h e s t a t u s of f : If z[f] = m u l t , t h e n a r g s [ t ] is t h e m u l t i s e t {t 1..... t n} a n d o t h e r w i s e , a r g s [ t l l e a d s to t h e t u p l e It 1..... tn]. In t h e r e m a i n i n g p a r t s of t h i s r e p o r t , b y w r i t i n g s, t a n d ~ w e w i l l a l w a y s a s s u m e t h a t s a n d t a r e t e r m s o v e r F a n d ~ is a [ p a r t i a l or q u a s i - ] p r e c e d e n c e o n t h e s e t ~ of o p e r a t o r s . M o r e o v e r , w e s y n o n y m o u s l y use >ord with ord to d e n o t e a n o r d e r i n g . T h e i n d e x ~[f] of > o r d , z [ f ] m a r k s t h e e x t e n s i o n of >ord w.r.tt h e s t a t u s of t h e o p e r a t o r f: Is 1 . . . . . s m l > o r d , z [ f ] It1 . . . . . t n ] iff z[f] = m u l t ^ > {s~ . . . . . sin} >~ord {tl . . . . . t n} or z[f] = l e f t ^ Is I . . . . . Srn I ol er dx [tl ' ... , t n ] o r z[f] = r i g h t ^ [Srn . . . . . s 1] > loe xr d It n ' ... ' tl]. Permitting additional

v a r i a b l e s , w e h a v e to c o n s i d e r e a c h a n d e v e r y o n e of t h e m a s a n c o n s t a n t s y m b o l i n c o m p a r a b l e [w.r.t. ~] to a l l o t h e r o p e r a t o r s in 6.

3 Term

orderings

T h e m a i n p o i n t of t h i s c h a p t e r is a b r i e f d e s c r i p t i o n of t h e r e c u r s i v e p a t h ordering with status and the improved recursive decomposition ordering with s t a t u s . T h e m e t h o d of c o m p a r i n g t w o t e r m s w.r.t, t h e r e c u r s i v e p a t h o r d e r i n g w i t h s t a t u s [RPOS, for s h o r t ] d e p e n d s on t h e l e a d i n g f u n c t i o n s y m b o l s . T h e r e l a t i o n s h i p b e t w e e n t h e s e o p e r a t o r s w.r.t. ~ a n d t h e s t a t u s z is r e s p o n s i b l e for d e c r e a s i n g o n e [or b o t h ] t e r m [ s ] i n t h e r e c u r s i v e d e f i n i t i o n of t h e RPOS. If o n e of t h e t e r m s is ' e m p t y ' [i.e. t o t a l l y d e c r e a s e d ] t h e n t h e o t h e r o n e i s g r e a t e r . D e f i n i t i o n s iff

3.1

[ R P O S , [ K L S 0 ] & [De87]]

>RPOS i] ii]

t top[sl ~ t0p[t] topis] = t0p[t]

^ ^

{S} ~RPOS a r g s [ t l z[top[s]] = mult

A

a r g s [ s l **RPOS a r g s [ t ]

iii]

topis] = t0p[t]

^

z[top[s]] ~ mult

^

{s} *~RPOS a r g s [ t ]

iv]

^ args[s] >RPOS,z[top[s]] args[t] a r g s [ s ] Z R P O S {t}

416 R e m a r k

3.2

W e w o u l d l i k e t o p o i n t o u t t h a t t h e r e e x i s t t w o d i f f e r e n t v e r s i o n s of t h e RPOS in the publications: a somehow non-deterministic one [see definition 3.1] a n d a d e t e r m i n i s t i c o n e [if t h e f o u r t h c o n d i t i o n [iv] is r e p l a c e d by ~ [ t o p [ s ] ~_ t o p [ t ] ] ^ a r g s [ s ] ~ R P o s {t}]. N o t e t h a t t h e d e t e r m i n i s t i c version is n o t a s i m p l i f i c a t i o n o r d e r i n g , in g e n e r a l , s i n c e [ x * y ] ~ z S R P O S x * y if z[~)=right. • The improved recursive decomposition o r d e r i n g [IRDS, for s h o r t ] h a s b e e n developed by Rusinowitch [ERu87]]. H e h a s a l s o i n c o r p o r a t e d s t a t u s i n it. H o w e v e r , w e p r e s e n t a n o t h e r [ s i m p l e r ] v e r s i o n [of [ S t 8 9 a ] ] w h i c h is s i m i l a r t o it, T h e p o w e r of t h e s e t w o o r d e r i n g s o v e r l a p w i t h e a c h o t h e r . To d e f i n e t h e o r d e r i n g of [ S t 8 9 a ] , w e n e e d s o m e k i n d of f o r m a l i s m .

3.3

D e f i n i t i o n

[Decomposition]

" Path-decomposition of a t e r m f i t 1..... t n ] : d e c i . u [ f [ t l ..... t n ] ] = {fit I ..... tn]} u d e c u [ t i ]

with

deceit]

• Decomposition of a s e t {t I ..... t n} of t e r m s : d e c [ { t I ..... tn}] = { d e c u [ t i ] I i c [1,n], u is a t e r m i n a l " S e t of p r o p e r s u b t e r m s of a p a t h - d e c o m p o s i t i o n s u b [ P , t] : { s 6 P I [Bu¢~] t / u = s }

P

= {t}

occurrence

w,r.t, a t e r m

of t i } t: •

O n e of t h e i m p o r t a n t d i f f e r e n c e s b e t w e e n t h e i m p r o v e d r e c u r s i v e d e c o m p o s i t i o n ordering and the recursive p a t h o r d e r i n g is t h e f a c t t h a t t h e I R D S s t o p s a comparison a s s o o n a s it h a s t o c o m p a r e i n c o m p a r a b l e o p e r a t o r s . A t e r m s is g r e a t e r t h a n a t e r m t [w.r.t. t h e IRDS] if t h e d e c o m p o s i t i o n of s is g r e a t e r t h a n the decomposition of t. T h e o r d e r i n g o n t h e s e m u l t i s e t s [ , ~ D ] is a n e x t e n s i o n of t h e b a s i c o r d e r i n g o n t e r m s [>D' D s t a n d s for d e c o m p o s i t i o n ] to multisets of m u l t i s e t s .

3.4

D e f i n i t i o n s >IRDS t iff w i t h >D d e f i n e d

dec[{s}] as:

[IRDS, [St89a]] * *~D d e c [ { t } ]

d e c u [ S ' ] ~ s >D t £ d e c v [ t ' ] iff i] t o p [ s ] ~ t o p [ t ] ii] t o p [ s ]

-- t o p [ t ]

^ z[top[s]] = mult

^ sub[decu[S']'s]

~D s u b [ d e c v [ t ' ] . t ]

i i i ] t o p [ s ] -- t o p [ t ] ^ dec[args[s]]

^ z[top[s]] = mult ,~D dec[args[t]]

^ sub[decu[S'],s]

= sub[decv[t'],t

iv] t o p [ s ]

^ z[top[s]]

^ {s} ~ I R D S a r g s [ t ]

^

-- t o p [ t ]

args[s]

>IRDS,z[top[.]]

¢ mult

]

args[t]

N o t e t h a t b o t h o r d e r i n g s [ t h e R P O S a s w e l l a s t h e IRDS1 u n i q u e l y define a congruence ~ dependent o n ~ a n d z v i a : f[s 1..... s m] ~ g [ t 1..... t n] iff f -- g ^ m -- n ^ i] z[f} = m u l t ^ [3rc][Vi] s i ~ t~[i} or ii] z[f] ¢ m u l t ^ [Vii s i ~ t i.

417

4 An

improved

concept,

of the

APO

T e r m i n a t i o n o r d e r i n g s b a s e d on t r a n s f o r m a t i o n t e c h n i q u e s h a v e b e e n first p r o p o s e d in [ D H J P 8 3 I This m e t h o d is r a t h e r c o m p l e x a n d it w a s n o t p o s s i b l e to lift t h e c o r r e s p o n d i n g o r d e r i n g to t e r m s c o n t a i n i n g v a r i a b l e s . The a s s o c i a t i v e p a t h o r d e r i n g [APO, for s h o r t ] o f [BP85] is s i m i l a r to t h i s o r d e r i n g . H o w e v e r , t h e A P O is c o n c e p t u a l l y s i m p l e r s i n c e a n y t e r m is t r a n s f o r m e d i n t o a s i n g l e t e r m w h e r e a s in [ D H J P 8 3 ] t h e t r a n s f o r m a t i o n of a t e r m l e a d s to a m u l t i s e t of t e r m s . The s t a b i l i t y w.r.t, s u b s t i t u t i o n s c a n b e g u a r a n t e e d b y c h e c k i n g ~ a f i n i t e n u m b e r of t h e p o t e n t i a l l y [ i n f i n i t e l y m a n y ] g r o u n d substitutions. In [GL86], G n a e d i g a n d L e s c a n n e s i m p l i f y t h e A P O to t h e s o - c a l l e d NFLO. The NFLO g e n e r a l i z e s t h e r e c u r s i v e p a t h o r d e r i n g a n d t h e t r a n s f o r m a t i o n c a n be d e s c r i b e d b y a r e d u c t i o n r e l a t i o n , In c o n t r a s t to t h e APO, t h i s o r d e r i n g m a k e s a strong difference between the flattening and the distributing [applying d i s t r i b u t i v i t y a x i o m s ] p r o c e s s e s . F i r s t of all, d i s t r i b u t i v i t y r u l e s m a p t h e t e r m s to b e c o m p a r e d in t h e s a m e c l a s s m o d u l o d i s t r i b u t i v i t y , in o r d e r to i n s u r e t h e r e p l a c e m e n t p r o p e r t y . Then, for s a t i s f y i n g A C - c o m m u t a t i o n , t h e s e t e r m s w i l l b e f l a t t e n e d a l o n g i t s A C - o p e r a t o r s [to r e p r e s e n t t h e a s s o c i a t i v i t y a x i o m s ] a n d c o m p a r e d w.r.t, t h e r e c u r s i v e p a t h o r d e r i n g w i t h o u t s t a t u s [to r e p r e s e n t the commutativity axioms]. Besides the simplicity, Gnaedig and Lescanne g a v e a proof for t h e u n i v e r s a l q u a n t i f i c a t i o n on s u b s t i t u t i o n s b a s e d on s i m p l e o b s e r v a t i o n s on t h e s u b s t i t u t i o n m e c h a n i s m . O b v i o u s l y , from a p r a c t i c a l p o i n t of v i e w , t h i s m e t h o d is m o r e i n t e r e s t i n g t h a n t h a t of B a c h m a i r a n d P l a i s t e d . H o w e v e r , t h e r o o t of t h e NFLO is t h e APO, a n d t h e r e f o r e , in t h e r e m a i n i n g p a r t s of t h i s p a p e r , w e w i l l r e f e r to t h i s o r d e r i n g b y ' a s s o c i a t i v e p a t h o r d e r i n g L In t h i s c h a p t e r w e t r y to g i v e a m o t i v a t i o n for t h e u s e of G n a e d i g ' s a n d L e s c a n n e ' s a p p r o a c h . T h e y h a v e p r e s e n t e d t h e i r m e t h o d for A C - t h e o r i e s , only. F i r s t of all, w e w i l l s p l i t AC i n t o t h e c o n c e p t s of C- a n d A - t h e o r i e s , In p r a c t i c e , t h i s w i l l b e a n e n h a n c e m e n t of t h e e f f i c i e n c y if e i t h e r C - t h e o r i e s or A - t h e o r i e s a r e u s e d . The r e a s o n .is t h a t t h e c o n d i t i o n s r e q u i r e d of t h e RPO a r e n o t as s t r i c t a s t h o s e for t h e c o m b i n e d t h e o r i e s . S u b s e q u e n t l y , t h e p o w e r of t h e v a r i o u s m e t h o d s w i l l b e c o m p a r e d . A n o t h e r m a i n p o i n t of t h i s c h a p t e r is t h e i n t r o d u c t i o n of an i m p r o v e m e n t of t h e APO. The e x t e n s i o n w e d e a l w i t h c o n s i s t s of t h e i n c o r p o r a t i o n of s t a t u s to t h e RPO. It w i l l b e s h o w n t h a t t h e c o n c e p t s of t h e A P O [ b a s e d on t h e RPO] c a n b e t r a n s f e r r e d to t h e RPOS b y g u a r a n t e e i n g m u l t i s e t s t a t u s of a s s o c i a t i v e and commutative operators. L a s t b u t n o t l e a s t , w e s h o w t h a t p a r t i a l [ i n s t e a d of q u a s i - I p r e c e d e n c e s a r e n e c e s s a r y to g u a r a n t e e t h e s t a b i l i t y w.r.t, s u b s t i t u t i o n s of t h e t e c h n i q u e s p r e s e n t e d in t h i s c h a p t e r . It is s t r a i g h t f o r w a r d to s e e t h a t t h e RPOS is C - c o m p a t i b l e if e a c h c o m m u t a t i v e f u n c t i o n s y m b o l h a s m u l t i s e t s t a t u s . T h e r e f o r e , l e t s >c t iff s >RPOS t w i t h z[f] = m u l t if f 6 ~ c

418

In o r d e r to r e s t r i c t t h e RPOS so t h a t it c a n p r o v e t h e A - t e r m i n a t i o n of t e r m r e w r i t i n g s y s t e m s w e p u r s u e t h e f o l l o w i n g s t r a t e g y : [i] E s t a b l i s h i n g e x a c t l y o n e r e p r e s e n t a t i v e of e a c h A - e q u i v a l e n c e c l a s s , [ii] R e d u c i n g e a c h t e r m to the representative of its A - e q u i v a l e n c e c l a s s a n d [iii] C o m p a r i n g the r e p r e s e n t a t i v e s w.r,t, t h e RPOS. O b v i o u s l y , t h e m a i n p r o b l e m of t h i s m e t h o d is t h e d e f i n i t i o n of t h e r e p r e s e n t a t i v e s . U s u a l l y , t e r m s w i t h A - o p e r a t o r s a r e d e s c r i b e d b y f l a t t e n e d t e r m s h a v i n g no n e s t e d o c c u r r e n c e s of i d e n t i c a l a s s o c i a t i v e o p e r a t o r s , e.g. *[+[1,*[2,+[1,3]]],2] = +[1,2,1,3,2]. This r e p r e s e n t a t i o n r e q u i r e s t h e o p e r a t o r s to h a v e v a r i a b l e a r i t y , i.e, a s s o c i a t i v e f u n c t i o n s y m b o l s m a y p o s s e s s a n y p o s i t i v e n u m b e r [> 1] of a r g u m e n t s , w h e r e a s n o n - a s s o c i a t i v e o p e r a t o r s h a v e f i x e d a r i t y . B a s e d on t h i s b a c k g r o u n d , t h e f l a t t e n i n g o p e r a t i o n -is d e f i n e d as f o l l o w s : Definition

4.1

[Flattening

operation,

[BP85]]

Let t = f[t 1..... t n] b e a t e r m . Then, t

t

if t is a c o n s t a n t

or a v a r i a b l e

t' otherwise w i t h t ~ r e s u l t s f r o m t b y r e p l a c i n g t i b y Ti a n d r e p l a c i n g t i b y s 1..... s m if ~ = f[s 1..... Sm].

if

top[t i]¢

f,

In o r d e r to c o m p a r e t e r m s [w.r.t. t h e R P O S ] w i t h o p e r a t o r s h a v i n g v a r i a b l e a r i t y , w e do n o t n e e d to c h a n g e t h e d e f i n i t i o n of t h e RPOS. H o w e v e r , t h e d e l e t i o n p r o p e r t y [ f[..,t,...] > f[ ....... ] ) m u s t be s a t i s f i e d to p r e s e r v e t h e p r o p e r t y of b e i n g a s i m p l i f i c a t i o n o r d e r i n g , The r e c u r s i v e p a t h o r d e r i n g w i t h o u t s t a t u s d o e s h a v e t h e d e l e t i o n p r o p e r t y . Thus, in o r d e r to g u a r a n t e e t h i s p r o p e r t y , t h e s t a t u s f u n c t i o n of t h e RPOS m u s t s a t i s f y t h e m u l t i s e t s t a t u s of e a c h v a r y a d i c f u n c t i o n s y m b o l . C o n s e q u e n t l y , e a c h A - o p e r a t o r h a s to h a v e m u l t i s e t s t a t u s . Now, an A - c o m p a t i b l e o r d e r i n g c o u l d b e d e f i n e d as s >A t iff S >RPOS ~ U n f o r t u n a t e l y , >A d o e s n o t h a v e t h e r e p l a c e m e n t p r o p e r t y : Let f E ~A a n d f ~ g. Then, f[a,b) > R P o s g [ a , b ] b u t f[f[a,b],c] = f[a,b,c] F r e w r i t e s a t e r m to a n irreducible form with the system described by the two rules D:

f[x,g[y,z]]

--> g [ f [ x , y ] , f [ x , z ] ]

f[g[x,y],z]

--~ g[f[x,z],f[y,z]]

•

N o t e t h a t t w o f l a t t e n e d ~ - n o r m a l f o r m s of t e r m s a r e C - e q u i v a l e n t . D u e t o t h e C - c o m p a t i b i l i t y of t h e R P O S it is p o s s i b l e to d e f i n e a n A - c o m p a t i b l e o r d e r i n g : s ~ , D t i f f 8Is] >RPOS ~[t] r e q u i r i n g t h e p r e c e d e n c e to h a v e t h e a s s o c i a t i v e p a i r c o n d i t i o n a n d z[f]=mult if f c ~ A

T h e g e n e r a l i z a t i o n ~ D of ~ a d m i t s p r e c e d e n c e s w h e r e a n A - o p e r a t o r is g r e a t e r t h a n a n o t h e r A - o p e r a t o r . H o w e v e r , t h e r u l e f[x]~f[y] --> f[x~y] c a n n o t b e o r i e n t e d w i t h t h e h e l p of ~ D b e c a u s e t h e A - o p e r a t o r * m u s t b e g r e a t e r t h a n f w h i c h is n o t a s s o c i a t i v e . A s o l u t i o n for t h i s p r o b l e m c o n s i s t s of a p p l y i n g t h e b a s i c c o n c e p t of t h e f o r m e r a p p r o a c h : I n s t e a d of u s i n g d i s t r i b u t i v i t y axioms we take rules similar to the endomorphism for p r e - r e d u c i n g t e r m s . In o r d e r t o e x a c t l y d e f i n e t h i s m e t h o d , t h e s e t of a d m i s s i b l e p r e c e d e n c e s must be established first. D e f i n i t i o n

4.4

[Simple pair condition,

A precedence ~ has the simple pair condition • f is m i n i m a l or [3 u n a r y g 6 8] f is m i n i m a l w.r.t. ~ \ { g } . To g u a r a n t e e t h e r e p l a c e m e n t reduced in the following way: D e f i n i t i o n

4.5

property,

the terms

[Endomorphism

[Ze89]]

if a n d o n l y if [Vf

E

~A ] •

to b e c o m p a r e d

operation,

must

be

[GL86]]

L e t ~ b e a p r e c e d e n c e s a t i s f y i n g f ~ g w h e r e f is a n a s s o c i a t i v e o p e r a t o r a n d g is a u n a r y f u n c t i o n s y m b o l . T h e e n d o m o r p h i s m o p e r a t i o n s : F ~ F r e w r i t e s a t e r m to a n i r r e d u c i b l e f o r m w i t h t h e s y s t e m d e s c r i b e d b y t h e two rules E: f [ g [ x ] , y ] --~ g [ f [ x , y ] ] f [ x , g [ y ] ] --> g [ f [ x , y ] ] • N o t e t h a t t h i s r u l e s y s t e m [E] is c o n f l u e n t a n d t e r m i n a t i n g u s i n g t h e r e c u r s i v e p a t h o r d e r i n g w i t h f ~ g. T h e n o r m a l f o r m of a t e r m t is d e n o t e d b y s[t]. It c a n be proved that two terms are AE-equivalent if a n d o n l y if t h e i r f l a t t e n e d ~ - n o r m a l f o r m s a r e s y n t a c t i c a l l y e q u a l : s ~ A E t i f f ~[S] = ~[t]. B a s e d on t h i s f a c t , another A-compatible ordering can be defined: s hE tiff ~[s] >RPOS requiring the precedence to h a v e t h e s i m p l e p a i r c o n d i t i o n a n d z[f]=mult if

f ~A-

420

N o w w e a r e g o i n g to d e a l w i t h t h e e x t e n s i o n s [to C - t h e o r i e s ] of t h e o r d e r i n g s p r e s e n t e d a b o v e [ ~ , ~ D a n d ~_E]" Thus, w e d e m o n s t r a t e t h e c o n t e n t s of [ G L 8 6 ] e x t e n d e d b y t h e i n c o r p o r a t i o n of s t a t u s to t h e r e c u r s i v e p a t h o r d e r i n g .

D e f i n i t i o n

4.6

Let z be a status function such that each C-operator has multiset status. s ~c

t

iff

S >RPOS ~^ each A-operator

is m i n i m a l

and each A-operator

w.r.t.

s ~CD

t

iff

8[s] > R P O S 8[t] A > satisfies the associative pair condition

s ~.cE

t

iff

4s] >RPos 4t] A

~ satisfies the simple pair condition

It is p o s s i b l e t o e x t e n d t h e s e c o n d a n d t h e t h i r d o r d e r i n g . In [BP85] a m o r e powerful method is p r e s e n t e d . If t w o t e r m s h a v e the same flattened ~-normalforms [flattened ~-normalforms] they could be still compared using s o m e r e d u c t i o n o r d e r i n g ~ t h a t is A C - c o m p a t i b l e a n d w e l l - f o u n d e d on e v e r y s e t [t] = {s I ~[s] -- ~[t]} [{s I ~[s] = ~[t]}]. S u c h a n o r d e r i n g is c a l l e d a d m i s s i b l e for t h e t r a n s f o r m a t i o n 8 [E]. F o r e x a m p l e , c o m p a r i n g t e r m s b y t h e i n v e r s e of t h e i r s i z e s is a n a d m i s s i b l e o r d e r i n g for t h e t r a n s f o r m a t i o n u s e d h e r e . M o r e p r e c i s e l y , ~ c a n b e d e f i n e d a s s ~ t i f f Isl < Itl a n d no v a r i a b l e a p p e a r s m o r e o f t e n i n s t h a n i n t [ w h e r e Iti d e n o t e s t h e s i z e of t]. In [GL863, > d e p e n d s o n a n d s, r e s p e c t i v e l y : s ~ t i f f s ~ D / A t IS ~ E / A t].

A s w e h a v e s e e n , for g u a r a n t e e i n g the C-compatibility of t h e A - c o m p a t i b l e o r d e r i n g s p r e s e n t e d a t t h e b e g i n n i n g of t h i s c h a p t e r , w e o n l y h a v e to r e q u i r e m u l t i s e t s t a t u s of c o m m u t a t i v e o p e r a t o r s . Thus, t h e u n i o n of t h e a p p r o a c h for C - t h e o r i e s w i t h e a c h m e t h o d for A - t h e o r i e s m u s t b e c o n s i d e r e d . T h e o r e m

4.7

>c, ~ , ~ D , ~,E, ~a.c, ~ C D a n d ~ C E a r e s i m p l i f i c a t i o n o r d e r i n g s w h i c h a r e s t a b l e w.r.t, s u b s t i t u t i o n s a n d C-, A - a n d A C - c o m p a t i b l e , r e s p e c t i v e l y . •

In a d d i t i o n to t h e a s s e r t i o n s of [GL86], ACD-compatible lACE-compatible]. L e m r n a ~CD

we

can

prove

that

~a_CD [ ~ C E ]

is

4.8 is A C D - c o m p a t i b l e

and

~-CE is A C E - c o m p a t i b l e .

•

421

All orderings presented i n t h i s c h a p t e r a r e b a s e d o n a p r e c e d e n c e b. T h i s o r d e r i n g on t h e o p e r a t o r s is n o t c l e a r l y d e f i n e d a n y w h e r e . N o t e t h a t it c o u l d be a partial ordering as well as a quasi-ordering. However, quasi-precedences on A C - o p e r a t o r s m u s t b e p r o h i b i t e d i n o r d e r to g u a r a n t e e t h e s t a b i l i t y w.r.t. substitutions:

L e m r n a

4.9

>.4.' >AD' >AE' >AC' >ACD a n d >ACE a r e n o t s t a b l e w.r.t, s u b s t i t u t i o n s p r e c e d e n c e o n t h e A [ C l - o p e r a t o r s is a q u a s i - o r d e r i n g .

if t h e ,,

The following counter-example s a t i s f i e s t h i s a s s e r t i o n : L e t ^, v E ~ A a n d ^ --~ v, 0 ~ 1 a n d > a n y of t h e o r d e r i n g s of l e m m a 4.9. T h e n , 0 v x > l^x. But, ~[0vx] ~ ~[l^x) u s i n g ~ = {x + - 0v0}, It is o b v i o u s t h a t q u a s i - o r d e r i n g s on n o n AC-operators can still be used.

F i n a l l y , w e n o w c o m p a r e t h e p o w e r of t h e o r d e r i n g s p r e s e n t e d in t h i s c h a p t e r . N o t e t h a t w e o n l y e x a m i n e t h e r e l a t i o n b e t w e e n [ n o t t h e s i z e ofl t w o s e t s of c o m p a r a b l e t e r m s . T h e f o l l o w i n g l e m m a d e s c r i b e s t h e c o m p a r i s o n w.r.t. partial precedences. aem~-,a

4.10

A s s u m i n g a r b i t r a r y t e r m s a n d p a r t i a l precedences [ t h a t a r e a d m i s s i b l e r e l a t e d to t h e c o r r e s p o n d i n g o r d e r i n g s l , t h e f o l l o w i n g r e l a t i o n s a r e v a l i d :

~CD / ~.D

~

/

~cs ~

>

~C

The relations are represented using a kind of Hasse diagrams. If > is stronger than ~, w e arrange > above

AE

A difference between the orderings presented here and those in other papers published is the additional status. It is obvious that the orderings without status are included in the corresponding orderings with status [see example 6.2 and example 6.3].

5 Decomposition

ordering

This chapter deals with the application to t h e i m p r o v e d r e c u r s i v e d e c o m p o s i t i o n

modulo

AC

of t h e c o n c e p t s u s e d in c h a p t e r o r d e r i n g of c h a p t e r 3.

4

422

Note that an essential precondition must be guaranteed t o u s e a n y of t h e o r d e r i n g s d e s c r i b e d i n c h a p t e r 4: e a c h A - o p e r a t o r a n d C - o p e r a t o r m u s t h a v e m u l t i s e t s t a t u s . A n o t h e r f a c t t h e p r e s e n t e d o r d e r i n g s h a v e in c o m m o n is t h a t t h e y a r e b a s e d on t h e r e c u r s i v e p a t h o r d e r i n g w i t h s t a t u s . O u r g o a l c o n s i s t s of e x t e n d i n g each strategy by making the basic ordering stronger. More precisely, the recursive path ordering with status will be replaced by a more powerful ordering: the improved recursive decomposition ordering with status. F o r a c l e a r - c u t r e p r e s e n t a t i o n of t h e o r d e r i n g s w e c h o o s e t h e i r p a r a m e t e r s in t h e f o l l o w i n g w a y , F o r e x a m p l e , l e t > 6 { ~ , >c ' ~a~c , ~a~D , ~ E ' ~ C D ' ~ C E }" T h e n , >* d e n o t e s t h e m e t h o d of > w h e r e >RPOS is r e p l a c e d b y >IRDS' F o r e x a m p l e , s ~ c * t iff s >IRDS "[- b y g u a r a n t e e i n g that each A-operator is m i n i m a l w.r.t, b a n d e a c h A - / C - o p e r a t o r has multiset status. T h e o r e m

5.1

>c * is a s i m p l i f i c a t i o n ordering, C-compatible a n d s t a b l e w.r.t. substitutions. ~*, >ADS a n d >AE * a r e s i m p l i f i c a t i o n o r d e r i n g s , A-compatible and s t a b l e w,r.t, s u b s t i t u t i o n s . >AC * , >ACD* a n d ~ C E ~ a r e s i m p l i f i c a t i o n o r d e r i n g s , A C - c o m p a t i b l e a n d s t a b l e w.r.t, s u b s t i t u t i o n s . •

T h i s t h e o r e m g u a r a n t e e s t h e c o r r e c t n e s s of m e r g i n g t h e c o n c e p t s of t h e v a r i o u s v e r s i o n s of t h e a s s o c i a t i v e path orderings with the improved recursive d e c o m p o s i t i o n o r d e r i n g . In o r d e r to c o m p l e t e t h i s s t u d y w e w o u l d l i k e to p o i n t o u t t h a t it is p o s s i b l e to a p p l y t h i s m e t h o d to o t h e r p a t h a n d d e c o m p o s i t i o n o r d e r i n g s i n c l u d i n g t h e p a t h of s u b t e r m s o r d e r i n g of P l a i s t e d [[P178]], t h e p a t h ordering of K a p u r , N a r e n d r a n and Sivakumar [[KNS85]], t h e recursive decomposition o r d e r i n g of L e s c a n n e , J o u a n n a u d a n d R e i n i g [[JLR82]]. The c o r r e s p o n d i n g l e m m a s a n d p r o o f s a r e c o n t a i n e d in [St89c]. In s u m m a r y , it c a n b e s t a t e d t h a t t h e s t r a t e g y of t h e A P O a s w e l l a s t h e s p e c i a l i z e d [to A - or C - t h e o r i e s , o n l y ] a n d i m p r o v e d o n e [to t h e R P O w i t h status] can be applied to the improved recursive decomposition ordering with status. Note that ~CD • and ~CE • are the most powerful orderings presented here. Another advantage of t h e s e o r d e r i n g s r e l a t i v e to t h e A P O is t h e f a c t t h a t it is e a s i e r to c o n s t r u c t a p r e c e d e n c e for a g i v e n r u l e s y s t e m w i t h t h e h e l p of a d e c o m p o s i t i o n ordering than with the recursive path ordering [ s e e [Ch84 ]].

There only exist a few other orderings proving AC-termination: the polynomial o r d e r i n g s o n r e s t r i c t e d i n t e r p r e t a t i o n s of o p e r a t o r s [ w h i c h a r e n o t a s e a s y to h a n d l e as t h e o r d e r i n g s p r e s e n t e d p r e v i o u s l y , s e e [BL87] a n d [SZ90]] a n d t h e associative-commutative Knuth-Bendix o r d e r i n g s [[St89b]]. C o m p a r i n g t h e m , t h e f o l l o w i n g r e l a t i o n s c a n b e d e t e c t e d [ s e e [St89c]]:

423

The p o w e r of t h e A C - o r d e r i n g decomposition ordering

based

on

the

improved

is s t r o n g e r t h a n t h a t of t h e A P O [cf. 6.1] o v e r l a p s w i t h t h a t of t h e p o l y n o m i a l orderings i n t e r p r e t a t i o n s of o p e r a t o r s [cf. 6.3] o v e r l a p s w i t h t h a t of t h e a s s o c i a t i v e - c o m m u t a t i v e o r d e r i n g s [cf. 6.3]

on

recursive

restricted

Knuth-Bendix

T h e p o w e r s of t w o o r d e r i n g s > a n d ~ o v e r l a p if t h e r e e x i s t s a t l e a s t o n e p a i r of t e r m s w h i c h is o r i e n t a b l e w.r.t, > b u t n o t w.r.t. ~, a n d v i c e v e r s a .

6

E x a m p l e s

T h i s c h a p t e r d e a l s w i t h t h e p o w e r of t h e p r a c t i c a l a p p l i c a b i l i t y of t h e o r d e r i n g s p r e s e n t e d . W e c o l l e c t e d s o m e e x a m p l e s of r e w r i t e s y s t e m s [9~] t o g e t h e r w i t h u n d e r l y i n g t h e o r i e s [E]. A d d i t i o n a l l y , t h e a p p r o p r i a t e o r d e r i n g g u a r a n t e e i n g t h e E - t e r m i n a t i o n of 9~ is g i v e n . E x a m p l e

6.1

A s s u m i n g w e h a v e t h e t w o b o o l e a n c o n s t r u c t o r s O [ f a l s e ] a n d ~ [not]. F u r t h e r m o r e , t h e r e is a c o m p l e t e d e f i n i t i o n of t h e b o o l e a n o p e r a t o r ^ [ a n d ] i n a d d i t i o n to t h e r u l e ~ x - - - > x. T h e n , t h e f o l l o w i n g s y s t e m is a c o m p l e t e d e f i n i t i o n of t h e b o o l e a n i m p l i c a t i o n [h~]. 9~:

--~

~0

x D 0

-~

~x

-,x ~ ~y

--~

y D [x ^ y]

0

~ y

E:

^ E SAC

~C[>IRDS

]

with

D >~ ~^

Note that the last rule cannot be oriented in this way by the associative path ordering. E x a m p l e

6.2

[Jantke

9~: x ÷ 0 x ÷ s[yl

fig[fix]I]

--.>

f[g[h[x,y],y]] f[h[x,h[y,z]]] E x a m p l e X

6.3 • 0

& Thomas]

x s i x ÷ y]

E:

÷ ~ SAC

f[h[s[O],x]} f[h[s[x],y]] f[h[x + y,z]]

~a.CE[>RPOS] w i t h >: g > 0 ~ h ~ ÷~s z[h] = r i g h t

[Padawitz] --~

0 Ix * y] ÷ x

E:

s[O] fac[0]

-->

1

fac[s[x]]

--~

six] * fac[x] y f l o o p [ x , s [ x ] • y]

~.CD[>RPOS] w i t h ~: fac~ • >÷ fac ~ 1 > s ~ 0 floop ~ * ~[ftoop] = left

x • s[y]

floop[O,y] floop[s[x],y]

÷, • 6 S A C

.

424

It is n o t e w o r t h y t h a t n e i t h e r t h e p o l y n o m i a l o r d e r i n g s nor t h e a s s o c i a t i v e c o m m u t a t i v e Knuth-Bendix orderings can g u a r a n t e e the E-termination of ~.

7 Conclusion This p a p e r i n t r o d u c e s t w o c l a s s e s of t e r m i n a t i o n o r d e r i n g s for a s s o c i a t i v e a n d [or] c o m m u t a t i v e t e r m r e w r i t i n g s y s t e m s . These o r d e r i n g s e x t e n d t h e w e l l k n o w n a s s o c i a t i v e p a t h o r d e r i n g s [see for e x a m p l e [BP85], [GL86]] b y u s i n g a s t r o n g e r [ t h a n the RPO] u n d e r l y i n g ordering. More p r e c i s e l y , w e a p p l y the b a s i c f e a t u r e s of the a s s o c i a t i v e p a t h o r d e r i n g to t h e r e c u r s i v e p a t h o r d e r i n g w i t h s t a t u s [[I M ( z ) , for all z. Union and intersection ofmultisets are defined in the usual way by identities M1 tJ M z ( z ) = M l ( z ) + M2(~) and M1 N M2(~) = m i n ( M l ( ~ ) , M2(z)). If M is a multiset and S a set, we write M C S to indicate t h a t every element of (the multiset) M is an element of (the set) S, and use M f3 S to denote the set {z E S : M(z) >_ 1}. For simplicity, we often use a set-like n o t a t i o n to describe multisets. For example, (~, ~, z} denotes the multiset M such t h a t M(z) = 3 and M(y) = 0, for y ¢ z. A n equation is a multiset {s, t}, where s a n d t are (first-order) terms built from given function symbols a n d variables. We write s ~ t to denote the equation {s,t}. By a ground expression we m e a n an expression containing no variables. A clause is a pair of multisets of equations, written I" -~ A. The multiset I' is called the antecedent; the multiset A, the succedent. We usually write F1, F2 instead of I'z t2 F2; P , A or A , F instead of I' t3 {A); and A 1 , . . . , A m --~ B a , . . . , B , ~ instead of { A 1 , . . . , A m } --~ ( B 1 , . . . , B n ) . A clause A 1 , . . . , A m --~ BI,...,B,~ m a y be regarded as representing an implication A1 A . . . A Am D B1 V .-. V Bin. The empty clause --* indicates a contradiction. Clauses of the form F , s ~ t --~ s ~ t , A or F --* A , t ~ t are called tautologies. We write u[s] to indicate t h a t s is a s u b t e r m of u and (ambiguously) denote by u[t] the result of replacing a particular occurrence of s by t. By t~r we denote the result o f a p p l y i n g the substitution ¢r to t, and call t ¢ an instance of t. If tcr is ground, we speak of a ground instance. We shall also consider instances of multisets of equations and of clauses. For example, the multiset {a ~ b, a ~ b} is an instance of {z ~ b, a .~ y}. T h e c o m p o s i t i o n vp of two substitutions r and p is defined by: z r p = (zr)p, for all variables X.

An equivalence is a reflexive, transitive, s y m m e t r i c binary relation. A congruence is an equivalence ~ on terms, such that s ~ t implies u[s] ~ u[t], for all terms u, s, and ~. If E is a set of g r o u n d equations, we denote by E* the smallest congruence N such t h a t s .- t whenever s ~ t C E. By an (equality Herbrand) interpretation we mean a congruence on g r o u n d terms. A n interpretation I is said to satisfy a g r o u n d clause F --~ A if and only if either F ~ I or else A N I 7& 0. We also say t h a t a g r o u n d clause C is true in I, if I satisfies C; and t h a t C is false in I, otherwise. An interpretation I is said to satisfy a (n6ng r o u n d ) clause F --* A if and only if it satisfies all ground instances Fc~ --. A~r. For instance, a t a u t o l o g y is satisfied by any interpretation. A clause which is satisfied by no i n t e r p r e t a t i o n is called unsatisfiable. The e m p t y clause is unsatisfiable by definition. If I satisfies all clauses of a set N, we say t h a t I is a (equality Herbrand) model of N. A set N of clauses is unsatisfiable if it has no model. We say t h a t a set of clauses N implies a clause C (and write N ~ C) if and only if C is satisfied by any model of N.

3

Canonical Rewrite Systems

We shall use canonical rewrite systems to describe and reason a b o u t equality interpretations.

430

A b i n a r y r e l a t i o n ::~ on t e r m s is called a rewrite relation if a n d only i f s ~ t i m p l i e s u[s~r] ~ u[tcr], for all t e r m s s, t a n d u, a n d s u b s t i t u t i o n s or. A transitive, well-founded rewrite r e l a t i o n is called a reduction ordering. By ¢~ we d e n o t e the s y m m e t r i c closure o f ¢ ; by ~ + t h e t r a n s i t i v e closure; by 3 " t h e t r a n s i t i v e , reflexive closure; a n d b y ¢:>* the s y m m e t r i c , t r a n s i t i v e , reflexive closure. F u r t h e r m o r e , we write s ~ t to i n d i c a t e t h a t there exists a t e r m v such t h a t s o * v a n d t ~ * v. A r e w r i t e r e l a t i o n ::~ is said to be Church-Rosser i f a n d o n l y if t h e two r e l a t i o n s ¢~* a n d g are the same. W e say t h a t a set o f e q u a t i o n s E is a rewrite system w i t h respect to an o r d e r i n g ~for every e q u a t i o n s ~ t in E , either s ~- t or t ~- s. E q u a t i o n s in a rewrite s y s t e m are s o m e t i m e s called (rewrite) rules. W e s p e a k o f a g r o u n d r e w r i t e s y s t e m E if all e q u a t i o n s in E are g r o u n d . If E is a r e w r i t e s y s t e m w i t h respect to ~-, we d e n o t e b y ~ E ~ (or simply ~) t h e s m a l l e s t r e w r i t e r e l a t i o n such t h a t s ~ E t, whenever s ~ t C E a n d s ~- t. A t e r m s is said to be reducible by E i f t h e r e is a t e r m t such t h a t s ~ E t; a n d irreducible, otherwise. For i n s t a n c e , if s ~E t a n d s ~- t, t h e n the t e r m s is reducible by E . A rewrite s y s t e m E is said to be canonical i f a n d o n l y if the rewrite r e l a t i o n ~ + is well-founded a n d C h u r c h - R o s s e r . L e r n r n a 1 Let E be a ground rewrite system with respect to some reduction ordering ~-. I f there are no two distinct equations s ~ t and u ,~ v in E, such that s ~- t and u ~ v and s is a subterm of u, then E is canonical. For a p r o o f o f t h e l e m m a see H u e t (1980). A n y o r d e r i n g F- on a set S can be e x t e n d e d to an o r d e r i n g ~-m~t on m u l t i s e t s over S as follows: M ~-muZ g i f a n d only if (i) M ~ N a n d (it) whenever g ( z ) > M ( z ) then M'(y) > N ( y ) , for s o m e y such t h a t y ~- ~. If ~- is a t o t a l [well-founded] o r d e r i n g on g r o u n d t e r m s , t h e n ~,n~z is a t o t a l [well-founded] o r d e r i n g on equations. If C is a clause A 1 , . . . , A , ~ --~ B 1 , . . . , B n , let 7 c be t h e m u t t i s e t (of m u l t i s e t s )

{A1 U {T},...,Am U {T},B1 U {_L},..., B~ U { ± } } , where 2_ a n d T are new s y m b o l s , used to d i s t i n g u i s h occurrences of e q u a t i o n s in t h e a n t e c e d e n t from occurrences in the succedent. W e a s s u m e t h a t t >- T ~- 2-, for all t e r m s ~, a n d define the o r d e r i n g ~c on clauses b y : C ~-~ C ~ if a n d only if 7c(~-mul)rnul .yC'. If ~- is a t o t a l [well-founded] o r d e r i n g on t e r m s , t h e n ~-~ is a t o t a l [welt-founded] o r d e r i n g on clauses. I f ~- is a n o r d e r i n g on t e r m s , we say t h a t a n e q u a t i o n A is maximal with respect to a m u l t i s e t o f e q u a t i o n s I~ i f a n d only if t h e r e is no e q u a t i o n B in F such t h a t B ~-ra~t A. We say t h a t A is strictly m a x i m a l with r e s p e c t to P if a n d o n l y if A is m a x i m a l a n d does n o t occur in r . A t e r m s is m a x i m a l in a clause C --- F --~ zX if a n d only if C c o n t a i n s an e q u a t i o n s ~ t a n d s ~ s is m a x i m a l w i t h r e s p e c t to P u A.

4

Ordered Inference Rules

Let >- be a r e d u c t i o n o r d e r i n g . W e say t h a t a clause P --* A , s ~ t is reductive (for s ~ t) i f a n d only i f (i) t ~ s, (it) s ~ t is s t r i c t l y m a x i m a l w i t h respect to P u A , a n d (iii) s does not occur in P.

431

T h e following inference rules are defined with respect to ~-. P,s~t-+A rc~ --* Ao-

Equality resolution:

where o- is a m o s t general unifier of s a n d t, a n d so- ~ to- is m a x i m a l with respect to 1"o- U Ao'. This inference rule encodes the reflexivity of equality. Its ground version is the inference F, s m s - ~ A P-~A where s is a m a x i m a l term in F U A. Ordered

F ~

factoring:

A,A,B

I~o- --~ AO-, Ao-

where o- is a m o s t general unifier of A and B, and A~ is m a x i m a l with respect to Po-U Ao'. We do not include a corresponding inference rule for factoring in the succedent, as such a rule is not necessary in order to obtain a refutationally complete inference system. Strict Superposition,

left:

r~A,s~t

u[s']zv,

h~lI

u[t]a ~ vo-, to-, ho- ~ Ao-, II~

where (i) o- is a m o s t general unifier of s and s', (ii) the clause to- --~ Act, so- ~ to- is reductive for so- ~ to-, (iii) vo- ~ uo- and uo- ,~ vo- is maximal with respect to Ao- and strictly m a x i m a l with respect to IIo-, and (iv) s' is not a variable. Strict Superposition,

right:

r-~ A,s~t A --, u [ s '] ~ v , II I'o-, Ao- -~ u[t]o- ~ vo-, Ao-, IIo-

where (i) o- is a m o s t general unifier of s and s', (ii) the clause l'o- --+ Ao-, so- ~ to- is reductive for sir ~ to-, (iii) vo- ~ uo- and uo- ~ vo- is strictly m a x i m a l with respect to ho. U IItr, and (iv) s I is not a variable. Strict s u p e r p o s i t i o n is a sharpened version of superposition. For instance, if a >- b ~c >- d, then a ~ d --+ a ~ c

--+ a .~ b, a ~ d

a ~ d --~ b ~ c , a ..~ d

is a superposition inference, but not a strict one (as the clause a ~ d --+ a ~ c is not reductive, if a is maximal). Observe the difference, in condition (iii), between the two superposition rules: when superposing on an e q u a t i o n u m v in the antecedent o f a clause, we require uo- ~ voto be m a x i m a l , b u t not necessarily strictly maximal. This difference is due to the fact t h a t ordered factoring is applied only to equations in the succedent of a clause. Indeed, if ordered factoring is also applied to antecedents, it suffices to superpose on strictly m a x i m a l equations. It is evident (from our previous example) t h a t strict superposition is not refutationally complete, but has to be c o m b i n e d with an additional inference rule.

432

r ~ A,s,z t

Merging Paramodulation:

to', Act ~

h---,u~v[s'],u'~v',ii

u # "z v[t]~r, u~r ~. v ' ~ , A c t , Ilo"

where (i) c~ is the composition r p of a most general unifier r of s and s', and a most general unifier p of u r and u'z, (ii) the clause F a --+ An, act ~ to" is reductive for so- ~ to-, (iii) the clause Ao" --+ IIe, ucr ~ vet is reductive for u ~ ~ we, (iv) uv >- v r and v'~r ~ v~r, and (v) s' is not a variable. Merging paramodulation is more restrictive than ordered paramodulation, in that the clause obtained is an i n s t a n c e (by p) of the ordered paramodulant

rr,

hr

-+ u r ~ v[t]r, u ' r ~ v ' r , A r , I I r

(where r is a most general unifier of s and s ' ) . If the ordering >- is total on ground terms, the ground version of merging paramodulation can be written as: r --, A , s .~ t

h --, u .~ v[s], u ~ v ' , i i

r , A --, u ~ v[t], u ~ v ' , A , i i

where P --+ A , s ~ t is reductive for s ~ t and A --+ lI, u ~ v ' , u

~ v is reductive for

For example, if a >- b >- c >- d, then ---, b ~ d

---, a ~ b, a "~ d

---* a ~ d, a ,~ d

is a merging paramodulation inference. Continuing our previous example, we see that the clause --+ a ~ d may be obtained by ordered factoring. This clause allows us to replace each occurrence of the term a by the simpler term b (el. the discussion of simplification below), so that we obtain two clauses c~

d

d~d

---+ --*

d~c

where the second can be superposed on the first to yield the clause d~d,d~d

--+

from which the empty clause (a contradiction) can be obtained by equality resolution. Note that merging paramodulation is designed in such a way that its repeated application to ground clauses (in conjunction with ordered factoring) has the effect of merging certain atoms containing the maximal term. By S we denote the inference system consisting of all of the above inference rules, with the additional restrictions: (a) the premises of an inference rule must not share any variables (if necessary, the variables in one premise are renamed); and (b) no premise must be a tautology.

433

5

Refutation

Completeness

We shall prove t h a t the inference system S is refutationally complete. T h e key to the p r o o f is the construction o f an equality H e r b r a n d model for a given set of clauses. From now on let N denote some fixed set of clauses and ~ a reduction ordering t h a t is total on ground terms. We shall construct an i n t e r p r e t a t i o n by m e a n s of a canonical rewrite system as follows. We use induction on ~c to define sets of equations E c , R v , a n d I c , for all g r o u n d instances C of clauses in N. Let C be such a g r o u n d instance a n d suppose t h a t E v , , R c , , and Iv, have been defined for all clauses C j with C ~ -c C ~. T h e n we define

Re=

U

Ec,

and Ic=R~.

Moreover

Ec = {s z t} if C is a clause F --~ s ~ t, A such t h a t (i) C is reductive for s ~ t, (it) s by R e , ( i i i ) r c I v , and (iv) A N I c = 0. In t h a t case, we also say t h a t C equation s ~ t. In all other cases, E v = 0. Finally, let I be the equality interpretation R*, where R = ~Jv E c is equations generated by g r o u n d instances of clauses in N. (It is evident t h a t system with respect to ~-.) Lemma

is irreducible generates the the set of all R is a rewrite

2 A n y of the rewrite s y s t e m s R e and R is canonical.

Proof. There are no two distinct equations s ~ t and u ~ v in R v [R], such t h a t s ~- t and u ~- v and s is a s u b t e r m of u. By L e m m a 1 the rewrite system R e [R] is canonical. [] L e m m a 3 Let C be a ground instance of some clause in N with m a z i m a l term s. (1) I] s ~- u and s ~- v, then u ..~ v ~ I if and only if u J~Rc v. (2) I t s is reducible by R e and s ~ u and s ~ v, then u ~ v C I if and only if u ~Ro

V.

L e m m a 4 Suppose Ccr is a ground instance of a clause C in N and z a is reducible by R, for some variable ~ occurring in C. Then there is a ground instance C7" of C, such that (i) Cer ~e C r and (it) C'r is true in I if and only if Ccr is true in I. Proo£ If z e ~ R t, define ~- to be the s u b s t i t u t i o n for which z r = t and y r = y~, for all ywithy#z. [] T h e preceding l e m m a ensures t h a t the following Lifting L e m m a can be applied to certain g r o u n d instances of clauses. L e m m a 5 ( L i f t i n g L e m m a ) Let C be a clause F --* A , s z t and D a clause A, A[u] --* II or A 2.~ A [ u ] , I I , such that u is not a variable and C and D have no variables in common. Suppose scr =- ucr and C ' is a grounfl clause of the f o r m [ ~ , A~s, k[t]cr --+ Ao', Iio"

434

or

F~, A ~ -~ Aft]o-, Ac~, II(T

obtained from C a and Da by strict superposition or merging paramodulation. Then C ~ is a ground instance of a clause that is obtained from C and D by strict superposition or merging paramodulation. Note t h a t (ordered) factoring is not required for this (version o f the) Lifting L e m m a , since we have defined a clause as a multiset ( r a t h e r t h a n as a set) o f a t o m s . Also n o t e t h a t a merging p a r a m o d u l a t i o n on the g r o u n d level m a y c o r r e s p o n d to a s t r i c t s u p e r p o s i t i o n inference on the n o n - g r o u n d level. L e m m a 6 Suppose the set N of clauses is closed under the inference rules of S. If C = F -* s ~ t, A is a ground instance of some clause in N and generates s ~ t, then

(i) r c i, (2) i r a = s ~ w , A j, then t is irreducible by R a n d t ~ w, and (3) A N I = O. Proof. T h e p r o o f proceeds by i n d u c t i o n on ~-¢. Let us a s s u m e t h a t ( 1 ) - ( 3 ) a r e t r u e for all ground instances C ~ of N with C N ¢ C ' . (1) Observe t h a t P C Iv C I. (2) We know t h a t t ~ w, because s ~ t is s t r i c t l y m a x i m a l w i t h respect to F tA A. I f t is reducible by R, then there exists a g r o u n d i n s t a n c e D = A -~ u ~ v, ]I of s o m e clause in N , such t h a t (i) t = t[u] a n d u ~ v, (it) D generates u ~ v, a n d (iii) C ~c D. Let C ~ be a clause F ' -~ s' ~ t', A I in N a n d o" be a s u b s t i t u t i o n , such t h a t C = CJo" ( a n d s = s'a and t = t'o'). If z0~ is reducible by R e , for some v a r i a b l e z occurring in t ' , t h e n by L e m m a 4 t h e r e is a n o t h e r g r o u n d i n s t a n c e C " = F " -~ s" ~ t ' , A " of C I, such t h a t C N c C " a n d ( b e c a u s e s is irreducible by R e ) s = s". Moreover, F " C Re,, a n d A ' N R c , , = O, as F " a n d A " are o b t a i n e d from F a n d A , respectively, b y r e w r i t i n g b y R. Also, since s does n o t occur in F a n d F~-eP ", the t e r m s can not occur in F " either. B u t this i m p l i e s t h a t C" generates a rule s ~ w ~, which c o n t r a d i c t s t h e a s s u m p t i o n t h a t s is i r r e d u c i b l e by R e . Let us therefore a s s u m e t h a t x(r is irreducible by R e , for all v a r i a b l e s • o c c u r r i n g in t *. Consider the inference

h - ~ u ~ v , II r - ~ s ~ t [ u ] , s ~ w , A ' r , h - ~ s ~t[v],s ~ w,h',II by merging p a r a m o d u l a t i o n . Since C is an instance Cto - of a clause C ~ in N a n d ~o- is irreducible, for all z, we m a y a p p l y the Lifting L e m m a to infer t h a t the conclusion D ~ of this inference is a g r o u n d i n s t a n c e of N . Using the i n d u c t i o n h y p o t h e s i s , we m a y infer t h a t IIV)ID, C I I N I = O. Moreover, the t e r m s does not occur in F U A a n d ( F U A ) C ID'. Consequently, we m a y infer t h a t D ~ generates a rule s ~ w ~. tIowever, C N ¢ D ~, so t h a t s is reducible by R e , which is a c o n t r a d i c t i o n . (3) Suppose there is an e q u a t i o n u ~ v in I , such t h a t A = u ~ v, A I. Since A ~ I c = 0, we have u ~ v E I \ I c , so t h a t by L e m m a 3 we o b t a i n s = u a n d t ~ v C I c . F r o m (2) we conclude t h a t t ~- v a n d t is irreducible by R e , which c o n t r a d i c t s t ~Rc v. [] T h e o r e m 1 Let N be a set of clauses closed under S. only if it contains the empty clause.

Then N is unsatis]iable if and

435

Proof. Evidently N is unsatisfiable if it contains the e m p t y clause. Suppose N does not contain the e m p t y clause. We show t h a t the equality interpretation I constructed f r o m the set of all ground instances of clauses in N is a model of N. Suppose, to the contrary, t h a t some ground instance of a clause in N is not satisfied by I. Let C = I' --, A be a minimal (with respect to the ordering ~-~) g r o u n d instance o f a clause in N for which r c I and A N I = 0, and let s ~ ~ be a m a x i m a l equation occurring in C. We m a y assume t h a t s ~ t and t h a t C -- Ccr is an instance of a clause in N for which z a is irreducible by R, for all variables ~. (1) Suppose C is r ~, s ~ s --~ A. Since N is closed under equality resolution, the clause P~ --~ A is also a ground instance of N and is false in I . This clause is simpler than C, which contradicts the assumption t h a t C is a minimal clause false in I. (2) If C is 1'1, s ~ ~ --* A and s >- ~, then s m ~ ff I and s is reducible by R. Let D = A --~ u ~ v, II be a clause t h a t generates the rule u ~ v, where u F- v and u is a subterm of s. Using L e m m a 6 we m a y infer t h a t (i) A C I and lI N I = 0 a n d (ii) u .~ v occurs exactly once in D and, if u occurs in II, v is irreducible by R. Consider the inference step

r', A, sly]

~ ~ ~ ~x, ii

by strict superposition. By the Lifting L e m m a the conclusion C ' of this inference is a ground instance of some clause in N . Since ( r ' U A) C I and s[v] ~-. * E I and (A U II) N I - = O, the clause C ~is false in Z. I f u does not occur in II, then C ~ c C ' , which is a contradiction to C being a minimal clause false in L Otherwise, v is irreducible by R. Therefore, * ~ v, whenever ~ -- ~, because * ~R ~. Therefore (s ~ *) ~ _ . ~ (~ ~ ~) and, since u m v occuzs only once in D, we m a y infer t h a t (s ~ t) ~,n~,z A, for every equation A in A U I I . But then again C ~_c C ~, which is a contradiction to C being a m i n i m a l clause false in I. (3) If C is r - . A ' , s ~ t, then s ~- *. Note t h a t in this case the t e r m s is reducible by R. (This is certainly so if s occurs in the antecedent F of C. If s occurs only in the succedent A of C, then s also has to be reducible, for otherwise C would generate the rule s ~ t and consequently would be true in L ) Again let D : A --~ u ~ v, II be a clause t h a t generates the rule u m v, where u F- v and u is a s u b t e r m of s. Using L e m m a 6 we m a y infer that (i) A C I and II N I ---- 0 and (ii) u m v occurs exactly once in D and, if u occurs in II, v is irreducible by R. Consider the inference step

A--,u~v,

II

r --. A ' , s [ u ] ~ ~

r , A -~ A, n, s[v] ~ by strict superposition. The conclusion C t of this inference is a g r o u n d instance o f some clause in N (by the Lifting L e m m a ) and is false in I. Since C is a minimal clause false in [ and C # C t, we m a y infer t h a t C ' ~c C. This is only possible if s :- u and II --- IU, s m w, where v ~- w ~ t. T h e n F can not contain an equation s ~ w', for this would imply ~ ~- w' ~ v (cf. case (2) abo~e). In other words, the term s does not occur in F U A . We also know ( F U A ) C_ I, from which we m a y infer (F U A) C Iv,. Furthermore, ( A ' U II') N I = 0 implies ( A ' U II') n Ic, = 0. From s~vGI and s ~ t ~ I , weinfer v~t~I, a n d h e n c e v . . ~ * ~ I c , . Since D ~ - * C ' a n d s

438

is irreducible by RD, we may infer that s is also irreducible by R e , . But then C ~ would generate the rule s m w, which is a contradiction. In summary, we have shown that no ground instance of a clause in N can be false in I. Thus I is a model of N, which completes the proof. [3

6

Horn

Clauses

A Horn clause is a clause P ~ A where A contains at most one atom. Ordered factoring and merging paramodulation require at least two atoms in the succedent of a clause; hence can not be applied to Horn clauses. The refutation completeness of strict superposition for Horn clauses is therefore an immediate corollary of Theorem 1. C o r o l l a r y 1 Let N be a set of Horn clauses that is closed under equality resolution and strict superposition. Then N is unsatisfiable i] and only if it contains the empty clause. Kounalis and Rusinowitch (1988) announced the somewhat weaker result that ordered resolution and superposition (with ordered factoring in antecedents) is refutationally complete.

7

Additional

Predicate

Symbols

In formulating our inference rules, we have assumed that the only atomic formulas are equations. Suppose we also wish to consider atomic formulas P ( t l , . . . , t , ~ ) , where P is a predicate symbol other than equality. We represent such atomic formulas as equations P ( t l , . . . , tn) ..~ ± (where 3, is minimal in the given reduction ordering ~-). Clauses of the form r, P(*l,...,t~) ~ ± -~ • or r -~ ~ , P ( t l , . . . , t,) . ± in which P ( t l , . . . , t,~) ..~ ± is a maximal equation can evidently not be part of an equality resolution or merging paramodulation inference. Furthermore, the strict superposition of a clause 17 --~ A , P ( S l , . . . ,sn) .~ A_ on a clause A --* II, P ( t l , ...,t,~) ..~ A_ results in a tautology £o-, A(r ---+ A~r, H(r, 3_ ~ 3" and is therefore unnecessary. Strict superposition inferences of the form r ~ a, e(s~,..., s,) ~ ±

e ( t ~ , . . . , t,,) ~ ±, A -~ n

on the other hand, correspond to ordered resolution in the sense of Hsiang and Rusinowitch (1989), whereas inferences of the form

F -* A , s ,-~ t

A --~ II, P ( u l , . . . , u[s'],..., un) 'm _l_

r~, A~ -~ zx~, n~, P(u~,..., u[t],..., u.)~ ~ ± (and analogous superpositions into the antecedent of a clause) correspond to ordered paramodulation in the sense of Hsiang and Rusinowitch (1989). (The remaining inference rules are more restrictive, of course, than the corresponding inference rules specified by Hsiang and Rusinowitch.)

437

8

Equality Factoring

We have shown t h a t strict superposition is not refutationally complete for non-Horn clauses, but have obtained a refutationally complete inference system by adding merging paramodulation as an inference rule. Another refutationally complete inference system is obtained by generalizing ordered factoring as follows: E q u a l i t y f a e t o r i n g ~ left:

r , s I , ~ t I -~ A , s ~ t Fo-, slo- ~ rio- ~ Aft, to" ~ ~lff

where (i) ~ is a most general unifier of s and s'; (it) to- ~ so- and t'o- ~ so-; and (iii) scr ~ tc~ is m a x i m a l with respect to Fo- u Ao- U {s~o- ~ ~to-}. Equality factoring, right:

to-, to- ~ t~a --~ Act, J a ~ t'o-

where (i) ~ is a most general unifier of s and s'; (it) tc~ ~ sc~ and t'~r ~ so-; and (iii) scr ~ ~c~ is maximal with respect to to- t2 Ac, U {sto- ~ t~r}. It can easily b e checked t h a t these inference rules are sound. Equality factoring has a similar effect as merging p a r a m o d u l a t i o n in that occurrences of equations with the same maximal term can be merged. By 9r we denote the inference system obtained from S by substituting equality factoring for merging paramodulation. T h e o r e m 2 Let N be a set of clauses that is closed under the inference rules of Y . Then N is unsatisfiable if and only if it contains the empty clause.

Sketch ofproo£ The proof is similar to the proof of Theorem 1 in t h a t it can be shown that whenever N is closed under equality resolution, equality factoring, and strict superposition and does not contain the e m p t y clause, then the interpretation I constructed from the set of ground instances of N is a model of N. The main difference is in certain modifications that are required because part (2) of L e m m a 6 does not hold under the given conditions on N. O Equality factoring may essentially be regarded as the controlled application of superposition to tautologies. For instance, the (derived) inference F---+ A , s ~ t , S

I~t I

SI ~ t t - ~ St ~ t I

I~o-,tO- ~ tter --* AO-, stcr ~ ~lowhich corresponds to superposition followed by factoring, yields the same conclusion as equality factoring on the right.

9

R e d u n d a n t Clauses

A theorem proving procedure deduces new clauses by systematically applying the given inference rules to existing clauses. Some of these deduced clauses may be redundant in that a refutation can be constructed without them. In particular, a clause C is redundant

438

in a set N of clauses if every ground instance Cc~ logically follows from simpler ground instances of N. Redundant clauses can be deleted. In formalizing this notion of redundancy, we first define a well-founded ordering >--* on pairs (C, or) of clauses and substitutions. A clause C = P ~ A is said to subsume a clause D = A -~ II if there exists a substitution ~r such that Fo" C A and A~r C II. We say that C properly subsumes D (and write D t> C) if C subsumes D but not vice versa. We define: (C, ~r) ~-' (D, ~) if and only if Cc~ ~-~ D r , or else C~ = D r and C t> D. Given a set N of clauses, a clause C = F -~ A is said to be redundant in N if and only if for every ground instance Cc~ there exist clauses C 1 , . . . , C,~ in N and corresponding ground substitutions ~ 1 , . . . , o-n such that (i) { C ~ r l , . . . , C~¢~} ~ C~r and (it) (C, o-) ~-' (Ci, ~ri), for all i with 1 < i < n. This notion of redundancy is quite general and encompasses a number of mechanisms for simplifying and eliminating clauses. Tautology elimination.

A tautology is evidently redundant in any set of clauses N.

S u b s u m p t i o n . If a clause C properly subsumes another clause D, then there exists a substitution ~r such that (D, r) ~-' (C,~r~-) and Ccrr ~ D r , for all substitutions ~-. Therefore, if N contains clauses C and D where C properly subsumes D, then D is redundant and can be deleted from N. C o n t e x t u a l r e d u c t i v e r e w r i t i n g . If C is a clause and N is a set of clauses, let in the following N~c denote the set of all substitution instances D~r of clauses D in N such that (C, ~) ~-' (D, e), with ~ denoting the identity substitution. Let C = r , A[up] a (or C = r zx, A[up]) be a clause in N and let 7- be a skolemizing substitution (which replaces each variable by a new constant). Suppose that there exists a clause D = A ~ u ~ v, II in N, such that (i) u ~- v, (ii) Dp E Y l c , (iii) ( Y l c ) r ~ Pv --~ spr ~ tpr, for any s ~ t in ,,1 and (iv) ( N I c ) r ~ spy ~ tpT" --* A t , for any s z t in II. Then C can be simplified to C ' = F, A[vp] --~ A (or C ' = F --~ A, A[vp]). In other words, if C f is added to the set of clauses then C can be deleted afterwards. Replacing C by C t is a generalization of simplification by contextual and reductive conditional rewriting as described by Ganzinger (1987) in the context of a completion procedure for conditional equations. The contextual aspect is that up and vp have to be equal only for those substitutions that make P true and A false. In practice, proofs of ( N I c ) r ~ F r ~ sp~-~ tp~-, for any s ~ t in A, may be conducted by reductive conditional rewriting with rule instances in N l c , and using the skolemized antecedent Yr as additional rewrite rules. Reductive conditional rewrite rules D in N do not have an occurrence of the maximal term in the antecedent. If they match a proper subterm in C, the corresponding substitution instances belong to N I c . The ordering ~-' as defined above places too hard a restriction on rewriting occurrences of the maximal term up of C in a positive literal of C. In this case vp must be smaller than the smaller term t in A[u]p = up ~ t as otherwise Dp would not be in N l c . A slightly more complex ordering on clause-substitution pairs exists which would allow to rewrite the root of up, regardless of the size of vp, if II = 0, Dp is reductive for up ..~ vp and if u is a proper prefix of up. 1One cannot replace this condition simply by "NIc ~ F --* sp ~. tp." When proving that F implies Ap one must not instanti~te clauses in NIc by too big substitutions.

439

E l i m i n a t i o n o f r e d u n d a n t a t o m s . Let C : F , u ~ v -~ A be a clause in N and let v be as above. If for n -- F -~ u ~ v , A we can show that ( N l c ) r ~ D~-, then C can be simplified to C' :- F --* A. A particular case is the elimination of multiple occurrences of atoms in the antecedent, ff C = r , u ~ v, u ~ v --~ A, then the clause F, u ~ v -~ u ~ v, A is a tautology and hence trivially implied by N l c . In a similar way, redundant atoms in the suecendent can be eliminated. Let 7~ be a set of inference rules. We say that a set of clauses N is closed under 7£ up to redundancy if and only if there exists a set N', such that (i) N C_ N ' , (ii) any clause in N' \ N is redundant in N ' , and (iii) N ' contains all clauses obtained from N by an inference rule in 7~. In this case we also say that N is closed relative to N' under 7Z. T h e o r e m 3 Let N be a set of clauses which is closed under S (or Y:) up to redundant

clauses. Then N is unsatisfiable if and only if it contains the empty clause. P r o o f If N contains the empty clause it is unsatisfiable. Let us now assume that N is closed relative to N ' and construct the interpretation I from N'. We show that if the empty clause is not in N' (and hence not in N as the empty clause is not redundant), [ is a model of g ' (and of N). If (C,~r) is a minimal (wrt. >-') ground instance of a clause in N ' such that C~r is false in I, C cannot be redundant in N'. Moreover, if C a is a clause which generates a rule s ~ t we can always choose the minimal such C in the subsumption ordering. Then, if we may additionally assume that I is a model of all ground instances of clauses in N ' with a maximal term smaller than s, C cannot be redundant either. For if C is redundant, there exist ground instances C ~ ' 1 , . . . , C~a,~ of clauses in N ' such that C a >.c C~r~. The Cicr~ are then valid in I c . For if they contain s in the antecedent, the antecedent is false in I c . If s occurs in the succedent of C~c~ but not in the antecedent, Cicri is true in Iv as otherwise C/ai would have generated a rule for s. Finally, if s does not occur in a Cic~i, C~ri is true in I v as it is true in I. But, then, Ccr would also be true in Iv, hence not generating a rule. With these additional facts, the proof for Theorem 1 can be used as a proof of the present theorem, provided that Lemma 6 can be extended, too. It is possible to prove (a version) of Lemma 6 for sets of clauses N which are closed under S up to redundancy, with the additional assumption that I is a model of all ground instances of clauses in N with a maximal term smaller than s~ for s as in L e m m a 6. The proof makes again use of the fact that clauses which generate rules are not redundant. [] To construct a set of clauses that is closed under 7~ up to redundancy, we may proceed as follows. A finite or countably infinite sequence No, N1, N ~ , . . . of sets of clauses is called a theorem proving derivation in T~ if and only if Ni+l results from Ni either by adding some clause which is implied by N~, or else by deleting a redundant clause from Ni. By Noo we denote the set Uj Nk>j Nk of all persisting formulas. A derivation is called fair if any clause that can be deduced from N ~ by 7£ (in one step) is contained in some set Nj. In other words, fairness requires that that inference rules be exhaustively applied to persisting clauses. Apart from these requirements it may be useful to freely add other clauses (in a sound way) if this triggers subsequent deletions of more complex clauses. The composition of two such steps can be considered as one step of simplification of the complex clause.

440

L e I n l n a 7 If No, Nx, N2,... is a fair theorem proving derivation in S (or iT), then Noo

is closed up to redundant clauses. Hence, No is inconsistent if and only if the empty clause is in some of the Nj.

10

Summary

In this paper we have been able to shed some new light on the refutation completeness of restrictions of ordered paramodulation. We have introduced a calculus of strict superposition and proved its refutation completeness for Horn clauses. We have also demonstrated that this completeness property does not extend to the full first-order case. Fortunately, some moderate enrichments of the calculus suffice to achieve refutation completeness for general first-order clauses. We have proposed two such enrichments, represented by the inference rules of merging paramodulation and equality factoring, respectively. We have left open the question as to whether superposition with tautologies, though of little worth in practice, would form a refutationally complete enrichment of the strict superposition calculus, too. We have chosen to consider clauses as pairs of multisets of atoms, rather than sets, as this more closely reflects actual implementation practice and at the same time allows a more precise investigation as to where factoring is needed and where not. In particular, we have shown that factoring in the antecedent is not needed, at the expense of a slightly more liberal strict superposition rule. Besides these improvements of previously known completeness results, another contribution of this paper is our technique for constructing a model for a consistent set of clauses via a canonical rewrite system. The technique admits comparatively simple completeness proofs based on elementary properties of canonical rewrite systems. In particular we have been able to include a rather general notion of redundancy for clauses in the strict superposition calculus without complicating the completeness proofs too much. We have briefly indicated how various simplification and deletion techniques (such as subsumption, contextual rewriting, and elimination of redundant atoms) can be formulated within this framework. The completeness results of this paper are based on one particular proposal of how to lift the ordering on terms to an ordering of clauses. In Bachmair and Ganzinger (1990) a slightly different, and perhaps preferable, ordering is given in which occurrences of a term in the antecedent of a clause have more weight than occurrences in the succedent. As a consequence, there are corresponding slight variations in the definition of strict superposition. It can be shown that strict superposition in this latter sense is refutationally complete without any extensions such as merging paramodulation or equality factoring, and is also compatible with the elimination of redundant clauses. In fact, the notion of redundancy which we propose in (Bachmair and Ganzinger 1990) is even more powerful than the one given above as it refers to inferences rather than to clauses and hence takes into account of how a clause is generated from (larger) parent clauses.

References [1] BACHMAII¢, L., DERSHOWITZ, N., AND PLAISTED, D. 1989. Completion without failure. In Resolution of Equations in Algebraic Structures, vol. 2, ed. H. Ait-Kaci

441

and M. Nivat, 1-30. Academic Press. [2] BACHMAII~, L., AND GANZINGER, H. 1990. Completion of first-order clauses with equality by strict superposition, In Proc. Second Int. Workshop on Conditional and Typed Rewriting Systems. Leer. Notes in Comput. Sci. Berlin, Springer-Verlag. To appear. [3] GANZINGER, H. 1987. A completion procedure for conditional equations, tn Conditional Term Rewriting Systems, ed. S. Kaplan and J.-P. Jouannaud, 62-83. Leer. Notes in Comput. Sci., vol. 308. Berlin, Springer-Verlag. To appear in J. Symbolic Computation. [4] I-IsIANG, J., AND RUSINOWITCH, M. 1987. On word problems in equational theories. In Proc. l$th ICALP, ed. T. Ottmann, 54-71. Lect. Notes in Comput. Sei., vol. 267. Berlin, Springet-Verlag. [5] HSIANG, :I., AND RUSINOWITCtt, M. 1989. Proving refutational completeness of theorem proving strategies: The transfinite semantic tree method. Submitted for publication. [6] HUET, G. 1980. Confluent reductions: Abstract properties and applications to term rewriting systems. J. ACM 27:797-821. [7] KNUTH, D., AND BENDIX, P. 1970. Simple word problems in universal algebras. In Computational Problems in Abstract Algebra, ed. J. Leech, 263-297. Oxford, Pergamon Press. [8] KOUNALIS, E., AND RUSINOWlTCH, M. 1988. On word problems in Horn theories. In Proc. 9th Int. Conf. on Automated Deduction, ed. E. Lusk and R. Overbeek, 527-537. Lect. Notes in Comput. Sci., vol. 310. Berlin, Springer-Verlag. [9] LANKFORD, D. 1975. Canonical inference. Teeh. Rep. ATP-32, Dept. of Mathematics and Computer Science, University of Texas, Austin. [10] ROBINSON, G., AND Wos, L. T. 1969. Paramodulation and theorem proving in first order theories with equality. In Machine Intelligence 4, ed. B. Meltzer and D. Michie, 133-150. New York, American Elsevier. [11] RUSlNOWITCtI, M. 1988. Theorem proving with resolution and supetposition: An extension of the Knuth and Bendix procedure as a complete set of inference rules. Submitted for publication. [12] Wos, L. T., ROBINSON, G. A., CARSON, D. F., AND SHALLA, L. 1967. The concept of demodulation in theorem proving. J. ACM 14:698-709. [13] ZI~ANG~ H. 1988. Reduction, superposition and induction: Automated reasoning in an equational logic. Ph.D. diss., Rensselaer Polytechnic Institute, Schenectady, New York. [14] ZHANG, H., AND KAPUR, D. 1988. First-order theorem proving using conditional rewrite rules. In Proc. 9th Int. Conf. on Automated Deduction, ed. E. Lask and R. Overbeek, 1-20. Lect. Notes in Comput. Sci., vol. 310. Berlin, Springer-Verlag.

Simultaneous Paramodulation Dan Benanav New Jersey Institute of Technology Computer and Information Science Department Newark, New Jersey 07102 Email: [email protected]

Abstract In this paper we present a variant of paramodulation, called s-paramodulation, that simultaneously replaces certain subterms that unify with the "into-term" by an instance of the "from-term". We show that in contrast to ordinary paramodulation, the lifting lemma holds for s-paramodulation. We also show that s-paramodulation in conjunction with resolution is refutationally complete in the ground case. Completeness in the general case follows easily from the lifting lemma and the ground case.

1

Introduction

There are several ways to use resolution-based systems for theorem proving with equality. By adding axioms for transitivity, reflexivity, commutativity and substitution, the resolution inference rule alone suffices. Alternatively, other methods such as paramodulation, E-resolution and RUE-resolution build the equality axioms into the inference rules and use resolution in conjunction with those rules. In [7] an inference rule is formulated that encompasses both resolution and paramodulation. In this paper we present a form of paramodulation in which terms are replaced simultaneously, in contrast to paramodulation where terms are replaced one at a time. We call this form of paramodulation, s-paramodulation. Although the lifting lemma does not hold for paramodulation we show that it holds for s-paramodulation. By slightly modifying a proof found in [7] we are able to show that s-paramodulation in conjunction with resolution is complete in the ground case. Completeness in the general case follows easily from the ground case and the lifting lemma. Some theorem proving systems appear to offer paramodulation with simultaneous replacement [3]. However, more experiments are required to determine if the method improves the performance of such systems. In addition to this potential improvement, we

443

believe the results will be useful in proving other conjectures. In particular, to show completeness of a strategy one can a t t e m p t to show that s-paramodulation can be simulated. In [1] we show an example of one such conjecture. To prove claims about s-paramodulation it is often necessary to make statements involving sets of positions within terms. These statements can become rather long. To shorten and simplify the presentation of such proofs we have introduced a notation for referring to sets of terms that satisfy certain properties. We present this notation in section 2.2.

2

Notation

We will briefly describe notational conventions used in this paper. For a more complete description see [5]. Terms are constructed in the usual manner using variable, function and predicate symbols. Positions of subterms are denoted by strings of natural numbers. The e m p t y string wilt be denoted by 0. Two positions are independent if neither is a prefix of the other. A set of positions is independent if they are pairwise independent. The subterm at position n of a term t is denoted by t/n. For example if t = f(x, (g(y))) then t/(1) = x, t/(2, l) = y, and t/O = t. We use tl[n #-- t2] to denote the term obtained by replacing tl at position n by t2. If N is an independent set of nodes then tl[N ~-- t2] denotes the term obtained by replacing tl at all positions in N by t2. The set of variables in a term t or a set of terms S is denoted by Vars(t) or Vats(S) respectively. The set of positions that occur in a term t is denoted by dora(t). The set of positions of a term t where a nonvariable subterm occurs is denoted by sdom(t). Atoms and literals are defined in the usual way. A clause is a set of literals. We will sometimes write a clause of the form { L 1 , . . . , L,~} as L1 V . . . , V L,~. If C1 and C2 are clauses then (C1 V C2) = (C1 U C2) In addition we sometimes write VAeC F(A) to denote UAec{F(A)} where F(A)is an expression that depends on A.

2.1

Substitutions

and

Unification

A substitution is a mapping 0 : Terms ~ Terms such that O(c) = c if c is a constant, and if t = f ( t l , . . . , tk), then O(t) = f(O(tl),..., O(tk)). Thus a substitution is determined by its values on the variable symbols. Bowing to common usage, we write tO instead of O(t). If O and ¢ are substitutions, then 0¢ = ¢ o O. It follows that if O, ¢, and ¢ are substitutions and t is a term, then ¢(0¢) = ( ¢ 0 ) ¢ and t(0¢) = (t0)¢. For any set of terms S, SO = {tOlt E S} The substitution, e, defined by e(x) = x for all x E 13, is called the identity substitution. For any substitution 0,

Lvar (O) = {v VivO # v} Rvars(O) = {v e l;I(3u e Lvars(O))(v e Vars(uO))} Vars(O) = Lvars(O) U Rvars(O)

444

For any substitution 8 and any V C P the projection of 0 to V, denoted by 8 J~ V, is given by xO for x E V (8~V)(x)= x forxeV It follows from this definition that if S is a set of terms and Vars(S) C V then S(8 V) = Se. D e f i n i t i o n 2.1 Suppose 0 is a substitution. Then 8 is a variable substitution if and only if for a l l y E P, v8 ~ P. 8 is a permutation if and only if the restriction of 8 to 12, 8 y : ]~ --* ~, is a bijection. T h a t is, for all v, v' E ~, v8 E ~ and v8 = v~8 implies v = v'. Note that the identity substitution, e, is a permutation. Also for any permutation e it is easy to show that there is a unique permutation ¢-1 such that e = ¢~-1 = ¢-~s. For any permutations ¢1 and s2, cle2 is a permutation. D e f i n i t i o n 2.2 Let S be a set of terms and 0 a substitution. Then 0 is a unifier of S if and only if SO is a singleton. S is unifiable if and only if there is a unifier of S. A substitution 0 is an most general unifier(m.g.u) of S if and only if 0 is a unifier of S and for all A, if A is a unifier of S then there exists a A~ such that 0 = AA~. L e m m a 2.1 If a set of terms S is unifiable then there exists an m.g.u, of S such that

Lvars(O) C__Vats(S). PROOF: See Robinson unification algorithm, o Any such m.g.u, that satisfies the conditions of this lemma will be called a standard

unifier. The following ]emma is easy to prove. L e m m a 2.2 If 0 is an m.g.u of a set of terms S then for any permutation ¢, 0c is an m.g.u of S. D e f i n i t i o n 2.3 A clause C1 subsumes a clause C2, denoted by C1 E C~, if and only if there exists a substitution 0 such that CIO C C2.

2.2

Position

Sets

The position set notation introduced here facilitates references to sets of positions within terms that satisfies certain properties. For example, b/e(tl, t2) denotes all positions within t2 in which there occurs a subterm equal to tl. U(tl, t2, 0) denotes all positions in within t2 which become equal to tl after applying the substitution 0 to t2. sbl(tl, t2, O) denotes all nonvariable positions in within t2 that become equal to tl after applying 0 to t2. Finally, vN(tl, t2, O) denotes variable positions within t2 that contain a subterm equal to tl after applying O to t~.

445 D e f i n i t i o n 2.4 For any terms tl, and t~, and any substitution 0,

U(tl,t~,O)

=

U~(tl,t2)

~- U ( t l , t 2 , £ )

sl.t(tl,t2,0) vU(t,,t2,0)

= =

Note that U e ( t l , t : ) = {u E

{u e dom(t2)l(t:lu)O = t,} {u E sdom(t2)I(t~lu)O = tl} {u E vdorn(t2)]Ue(tl, (t2/u)O) ~ ft}.

dom(t2)lt2/u = tl}.

Example 2.4.1 With

t = f(x,g(~), g(z),g(~)), all d

0 = {~ ~- b , z ~- b,x ~- g(b)} then tO =

and

f(g(b), g(b), g(b), g(b))

u~(g(y),t)

=

{{2},{4>}

udb, t)

=

0

u(g(b), t, o) = ~u(g(b), t, o) = vU(b, t, o) =

{(i),,,} {(2>,{3},{4>}

{{I},{2,1>,(3,1), @lan.lnformatlk.tu-muenchen.dbp.de

Abstract Our approach to improve the search of a theorem prover employs empirical knowledge gMned from former proofs. A connectionist network is used to learn heuristics which order the choices at nondeterministic branch-points. This is done by estimating their relative chance for leading to a shortest proof. Using the method it was possible to reduce the search effort required by a high speed theorem prover. Several experiments are presented showing the attained improvements. K e y w o r d s : Automated theorem proving, model elimination, heuristics, evaluation functions, features, learning, connectionism, back-propagation.

1

Introduction

Automatic proving of challenging mathematical theorems is a very difficult task even for the best today existing general purpose theorem provers. Since proving formulas of firstorder logic is a NP hard search problem, faster computers and better implementations which reduce the time for finding a proof by a constant factor cannot solve the problems. One way to reduce the search complexity involved seems to be the employment of additional knowledge supporting the proof process. For this purpose heuristics can be sought which select the "best" out of the set of branches (alternatives) at each branch-point occuring during the search. *This paper was supported by the Nixdorf Computer AG within E S P R I T project 415 F.

471

Several attempts have been made to improve the performance of AI-programs by learning of evaluation functions based on features. It all started with Samuels successful use of such techniques for playing checkers ([11] and [12]). Examples of work applying it to automated theorem proving can be found in [13] and [8]. A more recent contribution employing hand coded heuristics is found in [2]. In [5] Bayes decision theory is used for training an Othello playing program which leads to a better performance than linear evaluation functions. The back-propagation (BP) algorithm used in our approach is nonlinear as well, but makes less assumptions on the distribution of the training data. We use a general purpose theorem prover based on model elimination, which is a sound and complete calculus for full first-order logic. At each branch-point during a proof various independent possibilities exist for a continuation. Our heuristic evaluation function now attaches a numeric value to each of the branches. Then the branches are selected in the order of their associated ratings until a branch leads to a success or no more branches are available. The evaluation function used by the heuristic is realized by a BP-network whose functionality comes from training on a set of example proofs (these proofs are found by the prover without heuristics). All the choices made in such proofs are called successful selections and will be used as positive training data. The remaining choices which were not selected for the proof are taken as negative training data (see Figure 1). In some sense the neural network is used to represent the intuition of a mathematician during the process of finding a proof. The learning phase of the neural network corresponds to what humans do when they study already existing proofs in the literature and develop their skills by training on easy problems.

m : Positive training data r=n: Negative training data .~::~: Not used as training data

Figure 1: Schematic search-tree with a solution-path marked by bold lines. The nodes in this path serve as positive training data. The nodes marked with a minus sign stand for the negative training data, In this article we describe our approach to automatic learning of feature-based evaluation functions. Section 2 gives a short outline of the model elimination proof calculus. In section 3 we describe evaluation functions and some of the features which are used to represent the alternatives at branching points. Section 4 covers the back-propagation learning algorithm used for training the evaluation function. In section 5 finally we present the results of various experiments showing significant performance gains through the use of the heuristics.

472

2

D e s c r i p t i o n of the P r o v e r

SETHEO (for SEquential THEOremprover) is a fast and efficient theorem prover for full first-order logic. The proof calculus employed is model elimination, which is also used as the basis for several other high-speed theorem provers. (A well known example is the PTTP system [14]). SETHEO uses powerful preprocessing for reducing the input formula and various heuristics and strategies during the search for a proof. The implementation of the prover is based on an extended Warren Abstract Machine which interprets compiled input formulas. The peak performance on a SUN 4/110 lies at about 40 kLIPS 1. A detailed description of the prover and performance evaluations can be found in [6]. For better understanding of the heuristic module and the learning part a brief description of the relevant issues is given in this section. Model Elimination [7] can be viewed as a tree-based refinement of the Connection Method [1]. The language used for expressing formulas of first-order predicate logic is restricted to skolemized conjunctive normal form. The Model Elimination calculus provides two kinds of inference steps. Extension steps are a generalisation of ordinary PROLOG steps for solving subgoals of clauses. The difference to PROLOG is that each literal of a clause can serve as head where the remaining literals are the (positive/negative) subgoals. For Horn clauses the execution mechanism is identical to the PROLOG procedure. In case of non-Horn clauses reduction steps are necessary to attain completeness. They allow inferences with predecessor literals. For our purposes, however, these steps do not need to be considered. Since usually several clauses (OR-branches) exist which are possible candidates for an extension step, a decision must be made which one to choose (see Figure 2). In case the decision does not lead to a proof, one of the other alternative choices needs to be tried instead (backtracking). Obviously, good decisions at OR-branches would lead to enormous performance improvements. In practice, no proof can be found unless appropriate bounds which restrict the size and/or shape of the search tree are supplied. One method to approach this problem is the use of iterative deepening search, which means that a bound is successively increased until a proof is attained. However, in many cases it will be practically impossible to explore the search tree for a specific bound, although a proof might be easily found if the correct, but larger bound would be specified. On the other hand, of course, a bound too large than necessary may increase the search space tremendously, which is detrimental as well. Obviously the optimal selection of bounds is an important issue. Therefore a backpropagation network was recently used to learn the selection of depth bounds for a propositional theorem prover ([4]). The heuristic approach presented in this paper will turn out to reduce the need for specifying optimal bounds significantly. 1Our experiments have been performedon a slower machine.

473

Formula

p(a,b)

p(a,b)

p(a,b)

{ {~p(a,b)}, {p(X,Y),-~q(X),-~q(Y)}, {p(a,Y),-~p(Y~a)}, {p(X, Y), -~q(X), -~p(y,y)}, {q(a)}, {q(b)} }

I -~q(a)

-~q(b)

f

t

q(a)

q(a)

-,q(a)

-~p(b,a)

p(b,a)

p(b,a) q(a)

-,p(b,b)

p(b,b)

p(b,b)

.'.

.'.

j,

Figure 2: A partial model elimination search tree for the formula given on the right. A '*' denotes a closed branch of the tree. The surrounded area marks a proof for the formula.

3

Feature-based

Evaluation

Functions

The goal is to shorten the search for a proof by using empirical knowledge. Therefore the choices given at any OR-branch shall be tried in an order which reflects their estimated usefulness to derive a proof. In the following we explain in more detail how this can be done. To compare the various branches of an OR branch-point an evaluation function eval for branches is used. This evaluation function gets as input a representation of a clause occurrence2 and calculates as output a numeric value (the rating for the branch). Having the ratings of all the branches (ck)k=l ...... , the order for trying them is defined by

rating(q) > rating(cj)

==~ ci is tried b e f o r e c j , i,j E [ 1 , . . . , n ]

ratin9(ci) -- rating(cj)

~

default order (i.e. order in the input file)

T h e case that two branches are rated equally means that they are either very similar or that the evaluation function is not selective enough. In the latter case a more complex evaluation function could be introduced which is invoked only if two or more ratings are equal. This would improve the ability to differentiate between the branches and yet would have limited effect on the average heuristic overhead. For the representation of the input to the evaluation function, features (attributes) of the branches (i.e. the number of literals in a clause) have been used. In general, a feature is a function

f,: {d~use occurrences} -~ {0, 1,..., k,} 2A clause occurrence refers to the particular occurrence of a clause within a proof-tree (i.e. a node of the tree), possibly including information on the tree built so far.

474

mapping a clause instance on an integer value between 0 and ki, where kl is a constant limiting the range of feature i. As input for the feature-based evaluation function we have a fixed number of n features, the so called feature-vector (fi(c)),=l,...,~ of clause occurrence c. Now the term evaluation function can also be defined formally: An evaluation function is a function

eval:

{0,1,...,kl) ×...x{0,1,...,k~} (fi(c))i=, ...... '

~

[0,1]C/F/

, eval((f,(c))i=l ...... )

which maps a feature-vector onto its rating.

Features All the features we use are easy to calculate. Some of them, e.g. the depth of the branch-point in the proof are explicitly present in the data structures of the prover. Moreover, most of the features are invariant for a given clause and therefore need only be calculated once and for all during the preprocessing phase. To account for such differences, a classification of the features is introduced. Static f e a t u r e s are independent of the actual clause occurrence and are calculated at compile time. Examples for static features are the number of literals and the number of different predicates in a clause. Uniform d y n a m i c f e a t u r e s are not static, but uniform for all branches of an OR branch-point and therefore must be calculated only once for each branch-point. An example is the current depth in the proof which is equal for all possible choices at an OR branch-point. D i s t i n c t d y n a m i c features finally depend on the actual clause occurrence at prooftime and therefore must be calculated for each branch. The total number of uses of a clause in the proof so far is such a dynamic feature. According to the distinction between static and dynamic features, heuristics can be separated as well. Any heuristic which solely relies on static features is independent of proof time aspects and therefore can be restricted to the compilation of the formula (static heuristic). This results in a rearranged, but fixed order of evaluation for choices at branch-points. On the other hand, any heuristic which makes use of a dynamic feature can only be applied at proof-time, which causes heuristic overhead during the search for a proof (dynamic heuristic). For the SETHEO theorem prover a feature module has been implemented which performs an efficient calculation of the features and invokes an evaluation function ([16]). The evaluation function can be supplied by the user and may be a simple hand coded heuristic. However, in the present work the function is learned by a back-propagation network. The features to be employed can be selected by the user out of a set of currently 21 static, 4 dynamic and 3 uniform dynamic features. Note, however, that this is not supposed to be used to derive an optimal set of features by hand. Rather, the option is

475

supplied for generality of the tool and for increasing efficiency. A subset of the features is listed below together with their symbolic names, a brief description, and some examples. Static features : Number of LITeralS in a clause : Number of N E G a t i v e Literals in a clause (e.g. {p(X) ;q(V) :- r(X).} --~ N_LITS = 3, N_NEG_L = 1) N_DIS-P : Number of DIStinct Predicates in a clause N_ALL_V : Number of ALL Variable occurrences in a clause (e.g. {p(X,Z) :- q(X,Y), q(Y,Z).} ~ N-DIS_P = 2, N.ALL_V = 6) N_CONSTS : Number of occurrences of CONSTantS in a clause N_FUNCTS : Number of FUNCTionS in a clause (e.g. {p(a,f(X,b)) :- q(g(h(a))), r(X,g(f(a,b)),b).} --* N_CONSTS = 6, N-FUNCTS = 5) Number of Variables CONnecting 2 literals N_CON2_V : N_EXPL_I : average Number of subgoals to be solved 1 level deeper in the proof-tree (i.e. N_EXPL_I( P ) = ~QE,~bgoat,(P)average(Isubg°als(Q)[) ) N_HDIS_V : Number of DIStinct Variables in the Head (e.g. {p(X,f(g(X)),Y) :. . . . . } --* N_ItDIS_V = 2) N_HCON_V: Number of CONnections through Variables from Head to subgoals (e.g. {p(X,f(X),Y) :- q(f(Y),g(X,Y)).} ---* N_ttCON_V = 4) N_LITS N_NEG_L

Dynamic features N_ALUSES : total Number of USES of the clause in the proof so far S P E C I A L I : n u m b e r of variables of calling clause becoming SPECIALIzed G E N E R A L I : n u m b e r of vars of clause-head G E N E R A L I z i n g a p a r a m e t e r of the caller (e.g. calling subgoal: -~ p(X,Y,c), with run-time instantiation of X with constant 'a'; OR-branch clause (to be rated): {p(a,b,Z) :. . . . . } --, SPECIALI = 1 [since Y = b], GENERALI = 1 [since c = Z]) Uniform dynamic features D E P T H _ P T : current D E P T H in the ProofTree N_INST_V : Number of INStantiated Variables in the calling subgoal N_UNIN_V : Number of UNInstantiated Variables in the calling subgoal From these examples it can be seen that most static features represent counts of syntatic components, relations between literals or global properties of predicates like the explosiveness (see NSEXPL_I). The dynamic features refer to the clause history, proof status and run-time instantiations.

476

4

Using Back-Propagation for Learning

T h e B a c k - P r o p a g a t i o n A p p r o a c h Obviously there are many possibilities for the realization of the learning task. However, a connectionist approach using back-propagation learning qualifies more than other methods for its ability to represent nonlinear relati, onships between features, and for the relatively small computational complexity of the obtained functions (in case of small networks). For a more detailed analysis of this issue and comparisons to other learning schemes see [16]. L The algorithm employed is a straightforward variant (see [3] for details) of standard back-propagation as presented in [10]. Figure 3 shows the basic components employed to obtain a learning network in a slightly simplified form. connectionist model (for standard backpropagation) activation function (determining the activity of a unit)

network model (arrangement of units and interconnections)

learning rule (how interconnection weights are changed)

l

generalized delta rule:

oi(t + 1) = fi(neti(t)) ~er later

1 f~(,mi) = i + e:,,,i

/kwii 81 ,,~tp,~t

=

~ioi

=

(ti - o i ) f [ ( n e t l )

layer

layers

ol fi wij 0i

: : : :

activation value of unit i activation function applied to unit i weight of connection between unit j and unit i bias for unit uj ~_~ wiioj + 61 : net input into unit i

:

target output (desired output for presented input)

neti

k

J

~i

Figure 3: Components of the learning system

Topology: A network consists of layers of units. Each unit in a layer is connected to all units of adjacent layers, and no other connections exist. The bottom layer contains the so-called input units, which are used to encode the feature-vector of a clause-occurrence to be rated. The top layer is made up of a single unit. In between the input and the output layer there may be a hidden layer, in which case the number of hidden units used has been determined empirically (Fig. 3: network model). Each connection between units has a weight coefficient wlj representing the strength of the connection.

477

Activity:

The activation values of the input units are set in a way to represent the values of a feature-vector. The activation values o~(t) of all other units depend on the state of the network at time t - 1 and are determined by a function which maps the net input of unit ui to its output (Fig. 3: activation function). In normal application mode (i.e. non-learning mode) the network operates in a feedforward fashion, that is, activation values are spread only from the input layer towards the output layer, but not backwards. With properly learned weight coefficients, this represents the evaluation function with the activation value of the output unit as heuristic rating of the feature-vector presented as input.

Learning: One training step consists of two parts: First, input values of a learning pattern (i.e. a feature-vector) are propagated forward through the network (same way as in application phase). The resulting output value is then compared with the desired output (intended rating for presented feature-vector) and the difference (error) is determined. Second, the error is propagated back through the network and weight changes are performed to reduce the error according to the generalized delta rule (Figure 3: learning rule). Since the activation function is nondecreasing and differential~le with respect to the net total output, learning is done through a gradient descent minimizing the quadratic error function Ep = (desired output-value - actual output-value) 2. This basic step is executed for all pairs of training patterns (which is called a learn cycle), and this again is repeated until the reduction of the overall error (sum of errors per pattern) ceases.

5

E x p e r i m e n t a l Results

A good domain for the evaluation of the benefits through the heuristic needs to be simple enough such that a proof can be found without heuristics and complicated enough to make the application of heuristics efficient (problems solved within milliseconds by the unaided prover are not considered as being of interest). A standard problem with these properties which is often used for benchmarking automated theorem provers is Schuberts Steamroller (taken from [9], discussed in [15]). The basic formula describes a world of animals and plants and the eating relationships between them (employing 6 facts and 19 rules). The Steamroller then is a theorem (specific query) which states that a particular relation between individuals holds. Additional theorems (labeled SimpIesteam, Stl, St2, . . . , St7) have been created for this domain to allow the investigation of domain-specific heuristics. Finally, to check for the behaviour of the evaluation functions in domains different from where the training data are from, two other problems from [9] (namely P43, P46) have been examined. To attain some intuition about the complexity of these problems, Table 1 shows the required work to find a proof using optimal proof bounds. In addition to depth-bounds, inference-bounds are used. These bounds limit the number of inference-steps allowed in a proof. A straightforward way to evaluate the quality of the learned functions is to compare the size of the explored space using/not using a heuristic. This measures the reduction

478

Problem3 (only query shown) sroller: t~ ~. " ~(x), ~(v), g(z), ¢(x,Y), e(Y,Z). s~c~pl¢.. 7- a(x), a(¥), s(z), e(X,Y), ~(w,z). Stl: ?- a(x), m(X,Y), e(Y,cb). St2: ?- e(X,Y),e(Y, cc). St3: ?- m(Z,W), m(Y,Z), m(x,Y), e(Z,Y). St4: ?- m(X,Y), m(Y,Z), m(Z,W). St5: ?- m(X,Y), e(Y,Z), m(Z,Y). St6: ?- e(X,V), e(Y,Z), e(Z,W). St7: ?- a(X), a(Y), e(X,Y), e(Y,Z). P43: Pelletier 43 P46: Pelletier 46

Length of shortest proof (inferences)

70 25 (40) 4 53 51 57 10 10 53 10 25 (27) 4 35 (75) 4

required depth 6 5 6 6 6 4 4 6 4 7 6

total n u m b e r of

inferencesw i t h depth bound

4725 338 270 1038 360 31 42 8706 65 1275 410

Table 1: Complexity of the problems. Note that all problem-labels beginning with "S..." refer to the Steamroller world and represent different queries in this domain. Problems "P..." are 2 unrelated problems and serve as comparisons for the use of heuristics in other domains. of work achieved by the reordering of choices, and therefore depends on the search space spanned by the formula under consideration (different theorems may inherently allow for very different reductions of search). However, this makes comparisons between different heuristics tested on different theorems problematic. Therefore a specific performance measure (Obey) was developed, whic~ gives an evaluation of the orderings derived through a heuristic relative to a random ordering (the ordering which would be obtained from an evaluation function doing blind guessing). For simplicity it shall be sufficient to supply the asymptotic behaviour of the performance measure: 1 0 Ohe~, =

-1

best possible performance (at each branch-point correct decision) performance equal to random ordering of choices (at each branch-point, a random ordering is used) worst possible performance (at each branch-point, correct choice is tried last)

We shall now present a comparison both between static and dynamic heuristics and between the consequences induced by choosing different training data. In Figure 4 the performance of 6 heuristics on 5 different problem sets is given. The bar-graph is organized into 5 sets of bars, one set for each test problem. Each set in turn consists of 3 pairs of bars, one pair at a time for a specific training set used. The leftmost pair of a triple is based on the data from SimpleSteam, the middle one on {Stl,St2,St3} and the one on the right side on the Steamroller itself. Finally, the 3Note that the clause orderings of the problem formulas are taken unmodified from the literature. 4This is the length of the proof attained using the smallest depth-bound (a minimal depth-bound does not guarantee to find a shortest proof).

479

pairs consisting of a framed and a filled bar represent the best static (~) and dynamic (I) heuristic found for the training data.

0.6 0.4

Oheu

0.2 0.0 -0.2

×

I ...... I

I

SimpleSteam

Stl St2 St3

I

I

I

Steamroller

s~4 sts s~s s,7

P43 P46

different test sets used Figure 4: Performance of static and dynamic heuristics based on different training sets. A 'x' denotes that the above bars give the performance on the training data. Unsurprisingly, the best performance is achieved by a heuristic when applied to its own training data (see bar-pairs marked with 'x'). As expected, dynamic heuristics are clearly superior in this case, since more information is employed. But interestingly this can have detrimental effects when used on other problems (see black bars n o t marked with 'x', esp. above {P43, P46}). This is a quite important fact to realize, since it means that dynamic heuristics are much less general than static heuristics. A consequence is to apply dynamic heuristics only in the context of a single domain. Now the actual gains for the proof process will be determined. Since a major limitation of the prover is the necessity to supply bounds which sufficiently restrict the search space, the benefit through heuristics will be examined for the case that suboptimal depth-bounds are used. In all graphs, the smallest value of the abscissae is equal to the smallest depthbound allowing a proof to be found. The quality measures employed will be the number of inferences performed during the search for a proof and the length of the obtained proof (also in inferences). Note that for static heuristics an additional time measurement is unnecessary, since no run-time overhead occurs.

Static Heuristics In the following, two heuristics will be compared with the non-heuristic case (remember that these heuristics are only applied during the preprocessing phase). In all graphs, the results for the standard prover will be denoted by a 'o'. Those for the heuristic learned from SimpleSteam will be indicated by a '*', and those derived from training set {Stl,St2,St3} by a '×'. For simplicity, we will refer to heuristics in the following by the letter H indexed with the symbols used for them in the figures (here: H. and H× ). Figure 5 shows the results of applying the heuristics to the Steamroller problem.

480

o : no heuristic, • : SimpleSteam, x : {Stl,St2,St3} 5 000 000

1

000 000 500 000

total number of inferences done

$ X

X

X

100 000 50 000

10 000 5 000

1 000 numberof 125 1 inferences in proof 70 -J

i

I

•

i

*

m

m

m

*

*

I

|

I

I

I

I

I

I

6

7

8

9

l0

11

12

,.;,h~t depth

depth bound

bound

Figure 5: Static heuristics for the Steamroller Using H× doe.s lead to proofs of the same length as without heuristics, but only about half as many inference-steps are required in order to find a proof. H., on the other hand, requires marginally the same amount of computations as without using a heuristic, but allows a shortest possible proof to be found for all depths. For other complex examples from the Steamroller world similar results apply. In Figure 6 the same heuristics will be applied to a different domain. Here H× leads to an exponential reduction of required inferences for non-optimal depths, while H. is inferior to the non-heuristic case (with respect to the total number of inferences required) until the depth-bound is 3 counts larger than the optimum. Analyzing the results it can be found that static orderings have a significant impact on the proof process. Although any static arrangement is predetermined to lead to wrong choices at times, the difference between "good" and "bad" orderings is enormous. The improvement that can be obtained by static heuristics depends, of course, crucially on the initial ordering of the clauses. Since in most cases such orderings are not optimized, static heuristics are usually beneficial to apply. The presented experiments show that automatically derived static heuristics are a simple, yet powerful approach to enhance the given proof system. They are especially

481

• :

SimpleSteam, x : {Stl,St2,St3} $

10 000 ooo 5 000 000

$

000 000 500 000

0

1

total number of inferences done

100 ooo; 50 000 10 000 000 500 i

5o01 100 "

200 length of 100 proof (inferences) 50 30

0

X

o

i

I

I

I

'I

I

I

6

7

8

9

10

20

50

depth bound Figure 6: Static heuristics for P46. Missing evaluations denote either stack overflow or unterminated search. desirable, since their application reduces to fast heuristic preprocessing, and no run-time overhead is incurred which would lead to a decrease in the inference rate of the prover.

D y n a m i c Heuristics By use of proof time information dynamic heuristics are capable of adaptive behaviour. This promises improved decisions and consequently better performance of the prover. On the other hand, Figure 4 shows that dynamic heuristics are much less general (and therefore less reliable) than static ones. There is also the question about the trade-off between quality and complexity of heuristics, since any gain in the reduction of the search space has to be compared to the extra time spent for the heuristic overhead. To illuminate this issue, two evaluation functions of different complexity have been learned from {Stl,St2,St3}. One of them employs a 3-layer network with 25 hidden units (H,), while the other one is based on a simple 2-layer setting (H×). In both cases, binary coding of the input was used. Standard evaluations (e.g. Oh~) showed H. to be superior over H×. On the other hand, each application of the evaluation function from H. takes about 25 times longer than the one from H×. Thus the comparison illuminates the trade off between

482

* : 25 hidden units, x : no hidden units o : without heuristic

5 000 000

I o /

1 000 000

,s

500 000

.-.0"

100 000 50 000

total number

of inferences done

10 000 --X . . . . . . ~1:. . . . . . .

...,,X--

1 000

. .

X --'~

100

length of proof (inferences)

1251 7O

0

~

I~1

X

Q

n

t

m

n

•

*

*

I

I

I

I

I

I

I

6

7

8

9

10

11

12

I

without depth bound

depth bound Figure 7: Dynamic heuristics for the Steamroller- Inferences

0

1000

/ / 1 /

t

t

i00

50 proof

time in seconds

10 5:

X

_.-.-~ -x~

" .....

x ' - ' - ' ' x .......

i

~x~X.--~ 0

I

I

I

I

I

I

I

I

6

7

8

9

10

11

12

..ho.t

depth bound Figure 8: Dynamic heuristics for the Steamroller - Proof time

depth

bou,~d

483

decision quality and required time. Figure 7 shows the reduction in the search space and the length of the obtained proofs, while Figure 8 reveals how much time was actually spent for the search of the proof. Clearly, H, achieves better heuristic decisions than H×. For larger depths, the 3-layer network leads to minimal proofs wasting only a few inferences. H× requires slightly more inferences and leads to suboptimal proofs after a certain depth. However, Figure 8 reveals an important performance trade-off. Employing a significantly simpler and therefore faster evaluation function, H× takes between ~ and ~ of the time to find a proof than using H.. For a high-speed proof system, even the reduction to half the number of inferences (maximal gain of H. over H×) cannot outweight the additional computational costs. Experiments with other problems from the Steamroller world showed comparable results. Moreover, in some cases the simpler function even gave the better heuristic (resulting in very fast proofs with much less inferences wasted than by the complex function). This seemed to be due to insufficient generalization of the complex heuristic. Altogether, dynamic heuristics proved to be able to lead to enormous improvements with respect to all performance indicators. A relatively complex evaluation function was shown to outweight the expensive overhead and to lead to much faster proofs than not using a heuristic. However, a less complex function may outweight quality differences by speed. Another advantage of simple functions is, that in case no gain is achieved, the useless overhead is more tolerable. This brings up an important issue. A major drawback of dynamic heuristics is their unreliability when applied to new problems. This can be reasonably controlled only by restricting the application of an evaluation function to the same domMn as the training data are from and by using a sufficiently large training set.

6

Summary

We described a method for supporting a theorem prover through a trainable connectionist network. The network serves as an evaluation function and works on a meta-level guiding the search of the prover. The feature concept solves the problem of coding arbitrary complex clauses as fixed-length input for the evaluation function. Running experiments we found that static heuristics constitute a way to speed up the prover without any runtime overhead. Significantly higher performance is possible through the use of dynamic heuristics which, however, are very domain specific. While the results show a success of the principal approach, our aim is to come up with a completely automatic system which is able to generate problem-specific heuristics for difficult theorems. A larger set of features will be necessary to make sure that the full power of the connectionist approach is utilized, and more experiments need to be conducted to access the generality of the method. For these goals the results of our work form the basis of ongoing research.

484

References [1] W. Bibel. Matings in Matrices. In Comm. of the ACM, 26 1983. [2] K. Bl~ius, N. Eisinger, J. Siekmann, G. Smolka, A. Herold, and C. Walther. The Markgraf Karl refutation proof procedure. In Proceedings of the Seventh International Joint Conference on Artificial Intelligence, Vancouver, 1981. [3] W. Ertel. Back-Propagation with Temperature Parameter and Random Pattern Presentation. Techn. Report FKI-122-90, Technische Universit£t Miinchen, 1990. [4] W. Ertel, J. Schumann, and C.B. Suttner. Learning Heuristics for a Theorem Prover using Back Propagation. In Proceedings of the 5. OGAI-Conference, Igls, Austria, 1989. Springer. [5] K.F. Lee and S. Mohajam A Pattern Classification Approach to Evaluation Function Learning. Artificial Intelligence, 36, 1988. [6] R. Letz, S. Bayerl, J. Schumann, and W. Bibel. SETttEO: A High-Performance Theorem Prover. to appear in: Journal of Automated Reasoning. [7] D.W. Loveland. Mechanical theorem-proving by model elimination. JACM, 15(2), 1968. [8] R. Overbeek, J. McCharen, and L. Wos. Complexity and Related Enhancements for Automated Theorem-Proving Programs. Comp. ~ Maths. with Appls., 2(l-A), 1976. [9] F. J. Pelletier. Seventy-five problems for testing Automated Theorem Provers. Journal of Automated Reasoning, 2:191-216, 1986. [10] D.E. Rumelhart, G.E. Hinton, and R.J. Williams. Learning Internal Representations by Error Propagation. In Parallel Distributed Processing, 1986. [11] A.L. Samuel. Some Studies in Machine Learning Using the Game of Checkers. IBM Journal,

1(3), 1959. [12] A.L. Samuel. Some Studies in Machine Learning Using the Game of Checkers, II. IBM Journal, 11(6), 1967. [13] J.R. Slagle and C.D. F~rrell. Experiments in Automatic Learning for a Multipurpose Heuristic Program. Comm. of the ACM, 14(2), 1971. [14] M.E. Stickel. A prolog technology theorem prover. New Generation Computing, 2(4):371383, 1984. [15] M.E. Stickel. Schubert's steamroller problem: Formulations and solutions. Journal of Automated Reasoning, 2:89-101, 1986. [16] C.B. Suttner. Learning Heuristics for Automated Theorem Proving. Diploma Thesis, Technical University Munich, May 1989.

Automated Reasoning Contributes to Mathematics and Logic* L. Wos S. Winker W. McCune R. Overbeek E. Lusk R. Stevens Mathematics and Compu~r Science Division Argonne National Laboratory Argonne, IL 60439-4844 R. Butler Division of Computer and Information Science University of North Florida Jacksonville, FL 32216

Abstract In this article, we present some results of our research focusing on the use of our newest automated reasoning program OTTER to prove theorems from Robbins algebra, equivalential calculus, implicational calculus, combinatory logic, and finite semigroups. Included among the results are answers to open questions and new shorter and less complex proofs to known theorems. To obtain these results, we relied upon our usual paradigm, which heavily emphasizes the role of demodulation, subsumption, set of support, weighting, paramodulation, hyperresolution, and UR-resolution. Our position is that all of these components are essential, even though we can shed little light on the relative importance of each, the coupling of the various components, and the metarules for making the most effective choices. Indeed, without these components, a program will too often offer inadequate control over the redundancy and irrelevancy of deduced information. We include experimental evidence to support our position, examples producing success when the paradigm is employed, and examples producing failure when it is not. In addition to providing evidence that automated reasoning has made contributions to both mathematics and logic, the theorems we discuss also serve nicely as challenge problems for testing the merits of a new idea or a new program and provide interesting examples for comparing different paradigms. 1. O b j e c t i v e s a n d O r g a n i z a t i o n Consistent with our primary research objectives of contributing to mathematics and logic, designing ever more effective programs, and stimulating additional research, from the preceding year's experiments with our newest program OT'IER [5], we select and present certain new results and then focus on the key elements of the underlying paradigm [11] and various implied and as yet unanswered questions. The contributions include new theorems, answers to open questions, shorter proofs, and less complex proofs. They were obtained with *This work was supported by the AppLied Mathemat/cal Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38, and by the National Science Foundation under grant CCR-8810947.

486

a variety of approaches, discussed here, relying to various extents on the use of demodulation, subsumption, the set of support strategy, and weighting. The new results concern Robbins algebra, equivalential calculus, implicational calculus, combinatory logic, and finite semigroups. Because of space limitations, we omit the clause proofs and various other details---which are presented in a far more comprehensive Argonne report in preparation [14]--but include the input clauses for each problem. Regarding additional research in automated reasoning itself, we discuss the given experimental data in the context of the control of redundancy and irrelevancy. For example, without the use of demodulation and subsumption, the growth of redundant information will ordinarily be so large that assignment completion can be made impossible. Since we can shed little light on the precise nature and importance of the individual components of the paradigm underlying our research, and since we understand very little concerning the coupling of these components, the implied questions provide the basis for future research in the field. The evidence we present strongly suggests that paradigms that do not avail themselves of all four major components----demodulation, subsumption, the set of support strategy, and weighting--will, for most studies, offer inadequate power. Even further, the problems on which we focus present challenges for and tests of ideas, approaches, paradigms, and programs. They also provide interesting examples for comparing different paradigms for the automation of reasoning. Regarding additional research in mathematics and logic--whether the goal is to attempt to answer an open question, find a new proof for a known theorem, or simply obtain (possibly the first) computer proof of some theoremmwe present various approaches, each within the given paradigm. Among the approaches, we focus on one that relies on a weighting scheme based simply on symbol count, one based on a scheme emphasizing the " t a i l " of expressions, and one in which the use of weighting is replaced by level saturation. Since we currently cannot explain when and why one approach will be far more successful than another, implicit in this discussion is the basis for research both in automated reasoning and in mathematics and logic. A source of additional research rests with the incomplete results we include concerning questions in mathematics that are still open. The thesis throughout this article is that to make contributions to mathematics and logic by relying on an automated reasoning program, one must have a means to control the deduction of redundant information and also a means to control the deduction of irrelevant information. The means the program OTTER employs consists of the use of demodulation, subsumption, the set of support strategy, and weighting. However, even with reasonable control of redundancy and irrelevancy, one must currently rely on a variety of approaches, for example, by varying the choice of inference rule, of set of support, and of demodulators. One of the different approaches we present here may provide the basis for research that leads to the answer to an open question, a new and shorter proof, or a computer proof that had not been found earlier.

2. Robbins Algebra The first area for discussion is Robbins algebra, an area that presents a question that is still open. Is every Robbins algebra a Boolean algebra? A Robbins algebra is a nonempty

487

set satisfying the following three axioms in which the function o can be interpreted as plus and the function n as negation. (R1) o(x,y) = o(y,x) (R2) o(o(x,y),z) = o(x,o(y,z) ) (R3) n ( o ( n ( o ( x , y ) ) , n ( o ( x , n ( y ) ) ) ) ) = x A Boolean algebra is a nonempty set S with two operations, plus and times, and a 0 and a 1. Each operation is commutative, and each distributes over the other. The 1 is a multipicative identity, and the 0 is an additive identity. In addition, for every x, the negation of x exists with x plus its negation equal to 1 and x times its negation equal to 0. An alternative axiomatization of Boolean algebra consists of R1, R2, and Huntington's axiom [3]. (H3) o(n(o(n(x),y) ),n( o(n(x),n(y) ) ) ) = x Therefore, a way to prove a Robbins algebra Boolean is to derive H3 from R1-R3. This question has obviously interested mathematicians, for Tarski and his students studied it [2]. It has been proved that every finite Robbins algebra is a Boolean algebra. Our contributions focus on the addition of one or more properties to see whether the resulting system can be shown to be Boolean. For example, some years previous, we proved that the addition of the single equality o(x,x) = x to the Robbins axioms yields a Boolean algebra. Also, the addition of a 0 such that o(x,O) = x, or a 1 such that o(x,1) = 1 suffices. But weaker axioms can be added and still yield a Boolean algebra. For example, the addition of the equality o(a,a) = a for some constant a suffices. Even weaker, the addition of o(a,b) = a for some a and b suffices. We call these properties s u ~ c i e n c y p r o p e r t i e s [14]. For this last result, in contrast to the preceding results, our proof required substantial intervention, direction, and a number of runs by Winker using one of our programs. Here we select from recent research two new results concerning the addition of a single equality that guarantees, when considered with the axioms of a Robbins algebra, the properties of a Boolean algebra. T h e o r e m RA-1, near miss equality. If there exist elements a and b in a Robbins algebra that satisfy n ( o ( n ( o ( a , o ( a ~ ) ) ) , n ( o ( a , n ( b ) ) ) ) ) = a (which is syntactically similar to R3), the resulting algebra is Boolean. T h e o r e m RA-2. If the equality n(o(x,y)) = i(n(x),n(y)) is adjoined to R1-R3, the resulting algebra is Boolean. (Although intersection has not been defined, the given equality is reminiscent of De Morgan's law.) To attempt to prove that a Robbins algebra is not Boolean, two ways to proceed are (1) find a (infinite) model of R1-R3 that fails to satisfy one of the known sufficiency propertSes, or (2) prove that from R1-R3, one cannot derive one of the known sufficiency properties. 3. C a l c u l i In this section, we focus on theorems concerned with possible axiom systems for various logical calculi. The calculi to be visited are equivalential calculus, implicational calculus, and the R-calculus. We begin with equivalential calculus.

488

3.1. Equivalential Calculus The study of equivalential calculus can be confined to the consideration of formulas involving variables and a two-place function e such that, in each formula, every variable occurs twice [12]. In addition, the single inference rule condensed detachment suffices; this inference rule permits the deduction of the formula d from the formulas e(a,b) and c when c and a unify, with d the corresponding instance of b. If hyperresolution is used, the clause --~P(e(x,y)) I ~P(x) 1P(y) suffices to encode condensed detachment. Equivalential calculus can be axiomatized with formulas quite reminiscent of reflexivity, symmetry, and transitivity. The following three clauses serve nicely. P(e(x,x)) P(e(e(x,y),e(y,x))) P(e(e(x,y),e(e(y,z),e(x,z)))) In place of this perhaps more natural axiomatization, it can be proved that there exist single formulas each of which provides a complete axiomatization. The shortest consists of eleven symbols, excluding parentheses and commas, and thirteen such formulas exist. Theorem EC-1. The formula

(XHN) e(x,e(e(y,z),e(e(z~x),y)) ) provides a complete axiomatization for equivalential calculus. Our proof, requiring approximately 443 CPU seconds on a Sun 3, rests on deriving the formula

(UM) e( e(e(x,y),z),e(y,e(z,x) ) ) which itself is known to be a single axiom for this area of logic [7]. The question regarding the axiomatic status of XHN was open until Winker obtained a proof in the early 1980s. His original (never published) proof consisting of 159 derived formulas, the longest of which consists of 103 symbols, was obtained over a period of weeks from a number of runs with one of our earlier programs. We have recently obtained a proof consisting of 23 derived formulas, the longest of which consists of 39 symbols, and in a single run with OTTER. Our approach was one of level saturation combined with a technique for comparing and preferring shorter derivations of each deduced formula. Theorem EC-2. The formula

(XHK) e(x,e(e(y,z),e(e(x,z),y) ) ) provides a complete axiomatization for equivalential calculus. Our proof, requiring approximately 461 CPU seconds, rests with the derivation of

(YRO) e(e(x,y),e(z,e(e(z,y),x))) which is known to be a single axiom for the calculus. The corresponding open question was first answered by Winker in the early 1980s when he obtained a proof consisting of 83 derived formulas, the longest of which consists of 71 symbols. As with XHN, he extracted the proof from a series of runs with an earlier program. We recently obtained a 35-step proof, the longest formula of which consists of 47 symbols,

489

and in a single run with OTTER. In contrast to the use of level saturation, which led to the cited proof of XHN, for XHK we employed a weighting strategy that emphasizes the consideration of formulas whose righthand major argument is short.

3.2. Implicational Calculus As with equivalential calculus, there exist single formulas that serve as complete axiomatizations for implicational calculus; the inference rule of condensed detachment is used. In the preceding CADE conference, one of the challenge problems that was posed asks one to find a computer proof of a theorem by Lukasiewicz concerning such a single axiom [8]. The calculus can be axiomatized with the following three formulas.

i (x,i (y ,x ) ) i(i(i(x,y),x),x) i(i(x,y),i(i(y,z),i(x,z)))

(Simplification) (Peirce's Law) (Hypothetical Syllogism)

Theorem IC-1. The formula i(i(i(x,y),z),i(i(z,x),i(u,xi)) provides a complete axiomatization for implicational calculus. Our proof rests with deriving each of the given three axioms, requiring approximately 11 CPU hours. Our approach involved weighting formulas by symbol count and used hyperresolution as the inference rule.

3.3. R-Calculus The R-calculus also admits axiom systems that consist of a single formula [7]; condensed detachment again is the inference rule. Indeed, any of the following three formulas, by itself, provides a complete axiomatization.

(aYE) (YAM) (WO)

e(e(e(x,y),e(x,z)),e(z,y)) e(e(x,y),e(e(z,y),e(z,x))) e(e(x,e(y,z)),e(z,e(y,x)))

Both of theorems RC-1 and RC-2 answer, respectively, open questions; the two proofs were obtained by Winker in the early 1980s. Theorem RC-1. The following formula is a new shortest single axiom for the Rcalculus.

(XGJ) e(x,e( e(y,e(z,x) ),e(y,z) ) ) Our proof rests with a derivation of the formula WO. Theorem RC-2. The formula (XEH) e(x,e( e(y,e( e(y,z ),x ) ),z ) ) is not a single axiom for the R-calculus. Our proof rests with producing a complete characterization of the formulas deducible from

XEH and showing that none of the given single axioms can be so deduced.

490

4. Combinatory Logic In this section we focus on combinatory logic, a field that offers a variety of problems for testing, and sometimes exceeding, the power of an automated reasoning program. Barendregt [1] in effect defines combinatory logic as an equational system satisfying the combinators S and K (defined shortly) with S and K as constants. Noting that expressions are assumed to be left associated unless otherwise indicated, the actions of S and K are given by the following two equations. Sxyz = xz(yz) Kxy=x

If one uses paramodulation as the inference rule, problems from combinatory logic in its entirety can be submitted to the program OTTER with the following axioms. X=X

a(a(a(S,x),y),z) = a(a(x,z),a(y,z)) a(a(K,x),y) = x Rather than focusing on combinatory logic as a whole, here we study various fragments, subsets of the logic in which S and K are replaced by other combinators of which the basis of the fragment under consideration consists. In this article, we confine the discussion to the search for what are called combinations. By definition, when given a specific combinator P, a combination from the basis B of the fragment is an expression that satisfies the equation for P. Also, by definition, the length of a combination is the number of occurrences of the basis elements. For a simple example of the type of question under consideration in this section, let us focus on the combinator L with Lxy = x(yy)

and the fragment whose basis B consists of the combinators B and W with Bxyz = x(yz) Wxy = xyy

Given this basis B, a search for a combination satisfying the equation for L will succeed, finding the combination BWB. For a proof of success, one simply notes that BWBxy = W(Bx)y = Bxyy = x(yy).

Given the preceding material as background, let us now turn to some of the theorems we succeeded in proving in our study of combinations. Based on correspondence with Raymond Smullyan, we understand that the theorems presented here make a contribution to combinatory logic, by answering questions that were open concerning the existence, minimal length, and number (of that length) of various combinations. Rather than a complete proof, for each theorem we simply give one of the corresponding combinations and certain additional information, reserving the details (including the precise clauses and parameter settings) for the far more comprehensive Argonne report [14]. We also include some of the pertinent statistics (to permit one to judge the difficulty of the theorem), the input for OTTER, and a summary of the approach we used.

491

These theorems, if viewed as challenge problems for testing programs, approaches, or paradigms, do not ask one to verify that the combination that we give fulfills its requirements. Instead, the more interesting challenge is to begin with an appropriate set of axioms--which might include those for equality, especially when no mechanism exists for equality-oriented reasoning--and the denial that a combination of the desired type exists. Using as an example the B, W, and L problem discussed earlier--purely for illustration and for a template o f how to attack the various theorems presented shortly--with one of the notations acceptable to OTTER, one could have the input consist of the following. X=X

a(a(a03,x),y),z) = a(x,a(y,z)) a(a(W,x),y) = a(a(x,y),y) a(a(x,f(x)),g(x)) ~ a(f(x),a(g(x),g(x))) In contrast, were one simply attempting to have OTTER prove that BWB is a combination that behaves as L does, one would replace the given inequality by the following. a(a(a(a(B,W-),B),f),g) ~ a(f,a(g,g)) The presence of Skolem constants in place of Skolem functions makes the corresponding problem, in general, far easier to solve. Here is a list of the combinators [10] relevant to this section.

03) (C) (F) (G) (L) (P)

Bxyz = X(yz) Cxyz = xzy Fxyz = zyx Gxyzw = xw(yz) Lxy = x(yy) Pxyyz = xy(xyz)

(Q) Qxyz = y(xz) (Q1) alxyz = x(zy) (T) Txy = yx ( v ) Vxyz = z ~ ( w ) Wxy = xyy

T h e o r e m CL-1. From the basis consisting o r B and T, a combination can be found that satisfies the equation for Q. A proof of the theorem rests with an examination of either of the following two combinators, both found in less than 6 CPU seconds.

B(TB)(BBT)

B(B(TB)B)T

In addition, no shorter combination exists with the desired properties, nor does any other exist of length 6. T h e o r e m CL-2. From the basis consisting of B and T, a combination can be found that satisfies the equation for Q1. A proof of the theorem rests with an examination of either of the following two combinators, both found in less than 14 CPU seconds.

B(TT)(BBB )

B (B (TT)B)B

In addition, no shorter combination exists with the desired properties, nor does any other exist of length 6.

492

Theorem CL-3. From the basis consisting of B and T, a combination can be found that satisfies the equation for C. A proof of the theorem rests with an examination of either of the following two combinations, both found in less than 19 CPU seconds.

B(T(BBT) )(BBT)

B(B (T(BBT))B)T

In addition, no shorter combination exists with the desired properties, nor does any other exist of length 8. Theorem CL-4. From the basis consisting of B and T, a combination can be found that satisfies the equation for F. A proof of the theorem rests with an examination of any of the following five combinations, all found in less than 50 CPU seconds.

B(TT)(BB (BBT) ) B(B(TT)B)(BBT) B(TT)(B(BBB)T)

B(B(TT)(BBB ))T B(B(B(TT)B)B)T

In addition, no shorter combination exists with the desired properties, nor does any other exist of length 8. Theorem CL-5. From the basis consisting of B and T, a combination can be found that satisfies the equation for V. A proof of the theorem rests with an examination of any of the following ten combinations, all found in less than 248 CPU seconds.

B(T(BBT) )(BB(BBT) ) B(B(T(BBT))B)(BBT) B(T(BBT) )(B(BBB)T) B(B (T(BBT) )(BBB) )T B(B(B(T(BBT))B )B)T

B(T(BBT) )(BB(BTI3 ) B(B(T(BBT))B)(BTT) B(T(BBT) )(B(BBT)T) B(B(T(BBT))(BBT))T B(B(B(T(BBT))B)T)T

In addition, no shorter combination exists with the desired properties, nor does any other exist of length 10. Theorem CL-6. From the basis consisting of B and T, a combination can be found that satisfies the equation for G. Rather than giving a combination of the desired type, we instead observe that five of length 10 do exist, and no smaller ones suffice. Theorem CL-7. From the basis consisting of B, Q, and W, a combination can be found that satisfies the equation for P with Pxyyz = xy(xyz). A proof of the theorem rests with an examination of either of the following two combinations, both found in less than 11 CPU seconds.

QQ(W(Q(QQ) ))

B(W(Q(QQ)))Q

In contrast to our approach to proving the preceding six theorems, for this theorem, we replaced the restriction of paramodulating from the left sides of equalities into the left sides of inequalities with the restriction of paramodulating from the right sides into the right sides.

493

Moreover, the shortest such combination that we have found in which all three combinators occur, measured in occurrences of B, Q, and W, has length 6, and we have also found a combination of length 6 in which B is absent. Our approach to finding appropriate combinations relies heavily on paramodulation and the set of support strategy. In addition, for this type of problem, we frequently restrict paramodulation to be from the left side of positive equalities only and into the left side of the inequalities. We use the ANSWER literal to extract (from each proof) the desired combination.

5. Finite Semigroups The basic operations of a theorem prover like OTTER can be used to carry out a variety of algebraic operations. For example, given a subset S of a set T and a binary operation f on T, it is easy to get OTTER to compute the subset of T generated by S andf. One merely lists the elements of S: p(a) p(b) . ° °

where p(x) means " x is an element of the set generated by S a n d f ' , and where the elements a, b .... are the elements of S. One also needs a "closure" axiom ~p(x) I ~p(y) I p(f(x,y)) and a definition off, which can be given as a demodulator f(x,y) =.... Then the standard algorithm of OTIER, computing as it does the logical closure of its input, computes the closure of S in T under f [9]. Optimizations are possible, also within the OTYER framework, if f is associative. Recently we have applied this outlook to the computation of the sizes of certain finite semigroups whose sizes were previously unknown. A semigroup is a set with an associative binary operation. We start by defining the 5-element Brandt semigroup B2 by the following multiplication table:

0 e

f a

b

0 0 0 0 0 o

e 0 e 0 0 b

f 0 0 f a o

a 0 a 0 0 f

b 0 0 b e o

An interesting semigroup, because it plays a key role in classifying other semigroups with certain properties (see [4]) is F2B2, which can be described as follows: Consider all 25tuples of the form xl ... x25, where xi is in B2. Let g l = (O,O,O,O,O,e,e,e,e,ef f f f J, a,a,a,a,a,b,b,b,b,b)

494

g2 = (O,ef , a,b,O,e f ,a,b,O,e f ,a,b,O,e f ,a,b,O,e f ,a,b ) (It will be useful to denote these by 05eSfSaSb 5 and (0efab) 5, respectively.) Define F2B2 to be the semigroup generated by g l and g2 under componentwise multiplication in B2 and the "inverse" operation in B2. (The elements 0, e, a n d f are their own inverses, and a and b are mutual inverses.) Although F2B2 is clearly finite, there are potentially 525 = 298,023,223,876,953,125 elements. In [4], an automated theorem prover similar to OTTER was used to compute that it actually had only 71 elements and to reveal other information about its internal structure. Since the operation in a semigroup is associative, it was possible to take advantage of the optimization cited above, so the input to O'IWER consisted of the following clauses, where p(x) is construed to mean that x is an element of F2B2. Axioms

Set of Support

g(tup(0,0,0,0,0,e ..... b,b)) g(tup(0,e,f,a,b,0 ..... a,b)) g(tup(0,0,0,0,0,e ..... a,a)) g(tup(0,e,f,b,a,0 ..... b,a)) -.g(x) I ~p(y) I p(f(x,y))

p(tup(0,0,0,0,0,e ..... b,b)) p(tup(0,e,f,a,b,0 ..... a,b)) p(tup(0,0,0,0,0,e ..... a,a)) p(tup(0,e,f,b,a,0 .....b,a))

Demodulators f(tup(xl,x2 ..... x25),tup(yl,y2 ..... y25)) = tup(m(xl,yl),m(x2,y2) ..... m(x25,y25)) m(0,x) = 0

m(b,b) = a In this case the deduction is small enough that almost any theorem prover is adequate. However, related questions are more difficult. The first of these is to compute the size of F3B2, where B2 is as above and F3B2 is the corresponding set of 125-tuples generated by 025 e 25f25 a 25b 25 (05 eS fS aS aSbS)S (Oefab) z~ and their inverses. This has a potential size of 5125. We used O'ITER to compute that its actual size was 1435. A semigroup closely related to B2 is the semigroup B21 obtained by adjoining an identity element 1 to B2. One then asks for the sizes of F2B21 and F3B21. The size of F2B21 was readily calculated to be 223. One was left with the following table:

B2 B21

F2 71 223

F3 1435 ?

Despite the fact that the F3B21 appeared within reach, it turned out to be much larger than expected, and resisted attempts to calculate it until OTTER was moved to a large-memory

495

machine and specially tuned for this problem by adding a special intrinsic for calculating products and some modifications to the underlying data structures to conserve memory. The potential number of elements is 636. Finally, on a Sequent Symmetry with 120 megabytes of memory, the answer 102,303 was obtained. The run was a substantial one, involving generation of 613,818 clauses altogether, of which 511,521 were subsumed in a run lasting more than 7 hours. The most essential feature of OTTER used was its extremely fast forwardsubsumption technique. The run also computed substantial information on the internal structure of F3B21. This will be reported on separately.

6. The Art of Exploring Huge Search Spaces Problems of the sort discussed in this paper vividly illustrate the need to dramatically prune the search space. The programs that we have created to produce proofs of such problems are directly based on a number of techniques that address different aspects of redundancy control and search prioritization. In particular, we have made use of subsumption, the set of support strategy, demodulation, and weighting. In this section, we discuss each of these techniques, pointing out specific problems that illustrate w h y we believe that each is required.

6.1. Subsumption Subsumption offers a straightforward attempt to eliminate redundancy by discarding clauses that are obviously "weaker" than other existing clauses. Debates have existed for years about the cost of performing subsumption tests, and it is not completely clear that a complete subsumption test is always required. For example, one might test only for cases in which the subsuming clause is a unit, since that test can be performed quickly. Similarly, one can frequently avoid the use of back subsumption (the subsumption of already existing clauses by a newly derived clause) without disastrous consequences. However, we doubt that any system will automatically derive a proof of the following problem from the implicational calculus (posed as a challenge problem by Frank Pfenning at CADE-9 [8]) without using subsumption: --~(i(x,y)) 1--d?(x) I P(y) P(i(i(i(x,y),z),i(i(z,x),i(v,x)))) --~(i(i(a,b),i(i(b,c),i(a,c)))) A typical run of our system to demonstrate that this set of clauses is, in fact, unsatisfiable generates over 6,000,000 clauses, of which well over 90% are subsumed. It is worth noting, in the context of subsumptiou, that we recently wrote a paper [13] with (what we thought were) a graduated set of five problems illustrating the utility of subsumption. To our surprise, Andre Marien was able to solve the fourth problem in the set using a "Prolog Technology Theorem Prover" which did not use subsumption. Mark Stickel has verified his result (by reproducing it on his system). The specific problem asks one to prove that the formula XGK is a single axiom for equivalential calculus, by deriving the formula PYO.

496

6.2. The Set of Support S t r a t e g y The set of support strategy is not, in fact, a mechanism for redundancy control. Rather, it is used to avoid generation of general lemmas, when a more focused search often produces a proof fax more quickly. Examples of the general utility of this strategy are widely available in the literature. Indeed, serious debates have revolved around how best to choose the clauses to be put into the set of support. As always, we encourage the reader to experiment and observe the results on a wide class of problems. To emphasize the utility of the set of support strategy (for some, but certainly not all problems), we propose the following problem: X----X

a(a(a(Q,x),y),z) = a(y,a(x,z)) a(a(W,x),y) = a(a(x,y),y) a(a(a(a(x,f(x)),g(x)),g(x)),h(x)) ~ a(a(f(x),g(x)),a(a(f(x),g(x)),h(x))) This problem is an encoding of a theorem in combinatory logic that states the following: A combinator A can be constructed from the combinators Q and W such that Axyyz = xy(xyz), for arbitrary x, y, and z. It should be noted that this is actually a more general version of a problem proposed in the context of relevance logics by Ohlbach and Wrightson at CADE-7 [6]. In our experiments, using paramodulation with minimal constraints (in particular, no paramodulafionfrom or into variables), we found that the use of the set of support strategy (putting just the last clause in the set of support) allowed a proof in less than 10 seconds (on a Sun 4); without the use of set of support, no proof was produced in 10 minutes. A proof produced in less than 30 seconds that did not rely on the use of set of support would be of interest to us. 6.3. D e m o d u l a t i o n Demodulation is used to control redundancy by performing two distinct functons: 1.

When two apparently distinct terms have been proven equal, it is frequently critical that one of the references be removed from the set of current clauses. For example, in problems in group theory, one might always wish to rewrite i(i(x)) as x (where i(x) is the inverse of x).

2.

In some cases, demodulation is used to rewrite a term into a known canonical representation (for example, one might wish to fight-associate a term in which the function is known to be associative).

Clearly, the two uses are closely related, and deeper insights into the basic theory of rewriting have emerged over the last decade. A problem that clearly illustrates the practical role of demodulation can easily be found within the context of Robbins algebras: Input Clauses X=X

o(x,y) = o(y,x) o(o(x,y),z) = o(x,o(y,z))

497

n(o(n(o(x,y)),n(o(x,n(y))))) = x n(g(x)) = x o(E,E) = E

o(n(o(A,n(B))),n(o(n(A),n(B)))) ¢ B n(n(C)) ;~ C o(D,D) # D o(x,n(x)) # x

% Robbins axiom R3 % lemma % hypothesis % denial of Huntington axiom H3 % denials of sufficiency properties

Demodulators o(x,y) = o(y,x) o(o(x,y),z) = o(x,o(y,z)) n(o(n(o(x,y)),n(o(x,n(y))))) = x n(g(x)) = x o(E,E) = E

% Robbins axiom R3 % lemma % hypothesis

Our experiments using paramodulation produce computer proofs in a few minutes, and demodulation apparently plays a major role. Again, we would be quite interested in having anyone produce a proof without making heavy use of rewriting. 6.4. W e i g h t i n g

Versions of weighting have now been in use for almost twenty years. The essential notion is that one circumscribes the set of terms that are allowed to appear in clauses, or that one limits the complexity of the clauses that are retained. To do this, a mechanism is used to estimate the complexity of terms and clauses. For example, the most common (and quite useful) measure is just to count the symbols that occur in the term or clause. Various schemes use weighting to discard generated clauses and to prioritize the search by using weighting to dictate when clauses become candidates for use by inference rules. The use of weighting to discard generated clauses that exceed some designated complexity can dramatically limit the number of clauses that must be retained. However, the more critical use appears often to be the use of weighting to order the selection of clauses from the set of support (in particular, the selection of the next clause used to generate new resolvents or paramodulants). We should note that a very simple weighting scheme (such as symbol count) is often adequate. Occasionally, it is very useful to be able to use specialized weighting schemes to produce desired effects. For example, one might preferentially weight equality clauses that had " h e a v y " left arguments, but " l i g h t " right arguments, to produce rewrite rules that simplify generated clauses. To illustrate the utility of something as simple as symbol count, we urge the reader to consider the problem from the impticational calculus cited earlier under the topic of subsumption. We believe that weighting and subsumption are the two key redundancy control mechanisms required to derive a proof for that problem. Perhaps a more interesting phenomenon is represented by the following problem from the equivalential calculus. --ff'(e(x,y)) I ~P(x) I P(y) ---~P(e(e(a,b),e(c,e(e(c,b),a))))

% denial of YRO

498

P(e(x,e(e(y,z),e(e(x,z),y))))

% XHK

A proof that this set is unsatisfiable is straightforward, if preference is given to clauses of the form P(e(tl,t2)) in which the complexity of t2 is less than the complexity of tl (and greater emphasis is placed upon clauses in which the difference is greatest).

6.5. Summary Our view that effective theorem proving hinges on successful redundancy control is probably an overgeneralization. There are almost certainly interesting theorems for which proofs can be acquired more quickly by foregoing the cost of the techniques we employ. On the other hand, we seriously doubt that approaches with minimal redundancy control will be at all "robust" in that most of the theorems that can be proven with the techniques of redundancy control cannot be proven without such techniques.

7. Conclusions The objectives of this article are three: (1) to present some of the results of our research forays into various areas of mathematics and logic; (2) to offer experimental data supporting our position concerning essential components for the automation of reasoning when the goal is the proof of interesting theorems; and (3) to suggest challenge problems for measuring the value and power of concepts, paradigms, and programs. Consistent with these objectives, we began by giving evidence of the value of using an automated reasoning program for making contributions to mathematics and logic. The contributions briefly discussed here include answers to open questions, new theorems, and proofs (of existing results) that are far shorter and far less complex than those previously known. The fields of interest are Robbins algebra, various logical calculi, combinatory logic, and finite semigroups. Focusing on the results of the earlier sections, we discuss the need for using the set of support strategy, demodulation, subsumption, and weighting. Our conjecture is that, without all of these components, a paradigm or program will offer inadequate power when the goal is proving theorems of even moderate difficulty or of attacking open questions. Because of the growing interest in automated reasoning, evidence to the contrary is most welcome. From the viewpoint of challenge problems, whereas some of the theorems discussed here focus on equality-oriented reasoning, for others, such reasoning is irrelevant. These problems vary widely in difficulty; for us to solve them, they required a number of approaches, of course all within our usual paradigm.

References [1] Barendregt, H.P. The Lambda Calculus: Its Syntax and Semantics, North-Holland, Amsterdam, 1981. [2] Henkin, L., J. Monk, and A. Tarski. Cylindric Algebras, Part I, North-Holland, Amsterdam, 1971. [3] Huntington, E. New sets of independent postulates for the algebra of logic, with special

499

reference to Whitehead and Russell's Principia Mathematica, Trans. of AMS 35 (1933), 274304. [4] Lusk E. and R. McFadden. Using automated reasoning tools: a study of the semigroup {F2B2}, Semigroup Forum 36, 1 (1987), 75-88. [5] McCune, W. OTTER 2.0 Users Guide, ~krgonne National Laboratory Report ANL-90/9, 1990. [6] Ohlbach, H.-J. and G. Wrightson. Solving a problem in relevance logic with an automated theorem prover, Proc. of CADE-7, Springer-Verlag Lecture Notes in Computer Science, Vol. 170, ed. R. Shostak, New York, 1984, 496-508. [7] Peterson J. The Possible Shortest Single Axioms for EC-Tautologies, Aukland University Department of Mathematics Report Series No. 105, 1977. [8] Pfenning, F. Single axioms in the implicational propositional calculus, Proc. of CADE-9, Springer-Verlag Lecture Notes in Computer Science, Vol. 310, ed. E. Lusk and R. Overbeek, New York, 1988, 710-713. [9] Slaney, J. K. and E. Lusk. Parallelizing the closure computation in automated deduction, to appear in the proceedings of CADE-10, 1990. [10] Smullyan, R. To Mock a Mockingbird, A. Knopf, New York, 1985. [11] Wos, L.o R. Overbeek, E. Lusk, and J. Boyle. Automated Reasoning: Introduction and Applications, Prentice-Hall, New York, 1984. [12] Wos, L., S. Winker, B. Smith, R. Veroff, and L. Henschen. A new use of an automated reasoning assistant: open questions in equivalential calculus and the study of infinite domains, Artificial Intelligence 22 (1984), 303-356. [13] Wos, L., R. Overbeek, and E. Lusk. Subsumption, a sometimes undervalued procedure, preprint MCS-P93-0789, Argonne National Laboratory, Argonne, IlL, July 1989. [14] Wos, L., S. Winker, W. McCune, R. Overbeek, E. Lusk, R. Stevens, and R. Butler. OTFER Experiments Pertinent to CADE-10, Argonne National Laboratory Report ANL89/39, to appear.

A Mechanically Assisted Constructive Proof in Category Theory James A. Altucher

Prakash Panangaden*

Department of Computer Science Carnegie Mellon University

Department of Computer Science Cornell University

Abstract Recently there has been a significant confluence of ideas from category theory, constructive type theory and functional programming. Our goal is to develop a toolkit that provides mechanical assistance in putting together constructive proofs of theorems in category theory and to extract executable programs from the result. We describe a machine-assisted proof of the adjoint functor theorem from category theory. The theorem is a simple version of the adjoint functor theorem. It was chosen because of its interesting constructive content, the fact that the machine-checked proof is fairly large and because it is mathematically non-trivial. The category theory toolkit was built on top of the Nuprl system. The core of this toolkit is a collection of tactics for mechanizing "diagram chasing". We selected Nuprl because the underlying type theory is constructive and one can automatically extract executable programs from the proofs and partly because of the large collection of tactics and techniques that were available to us. So far we have concentrated on proving the theorem rather than on extracting the computational content of the theorem.

1

Introduction

The last twenty years have seen a significant confluence of ideas from category theory, constructive type theory and functional programming. Constructive type theories have been recognized as examples of certain classes of categories. Type constructors have been recast as categorical constructions and category theorists have developed fascinating new models of type theories. Research in type systems have led to new typed lambda calculi and, in turn, to new typed functional languages. Recently Burstall [3] has proposed categoricalprogramming. Categorical programming takes advantage of the fact that proofs in category theory tend to be constructive and often *Research supported in part by NSF Grant CCR-8818979.

501

of a very mechanical nature, amenable to programming. Furthermore, when coded up as programs they lead to very general programs since they are abstracted over categories and hence independent of data type. This program has been pursued vigourously by Burstall, Rydeheard and their co-workers, see, for example, the recent book by Burstall and Rydeheard [14]. Another example of the relevance of category theory to computer programming has been shown by Moggi. He showed that by using monads one can incrementally build models for languages with fairly complicated features; in other words, one has a modular approach to denotational semantics. Our program is twofold, first we would like an environment in which one can develop theorems in category theory with as much automated assistance as possible. As such, this is part of the general efforts to develop mathematical problem solving environments such as, for example, is being done in the Nuprl project at Cornell [6] or in the Ergo project at CMU. We believe that category theory is a particularly interesting choice in view of the generality of the subject and its recently forged connections with computer science. Our second goal is to contribute to categorical programming in the same spirit as the Computational Category Theory program enunciated by Burstall. Our approach, however, is to extract the programs from constructive proofs rather than to write the prograr~s directly. Clearly, our extracted programs will be much less efficient than hand-coded programs but we feel that it is nevertheless an important experiment. The importance stems from the clear advantage of being able to develop proof and "program" together. We are also motivated by the fact that the more interesting extracted programs one can exhibit the more pressure there will be to improve "extraction technology." To summarize, our goal is to develop a toolkit that provides mechanical assistance in putting together constructive proofs of theorems in category theory and to extract executable programs from the result. In this paper, we describe an experiment in using a machine-assisted proof development enviromnent to prove an adjoint functor theorem. This theorem was chosen because of its interesting constructive content and the fact that the proof was fairly large and hence stressed the capabilities of the Nuprl system. Even stating the theorem requires the development of a significant fraction of all the elementary definitions in category theory. It required the development of new automated inference mechanisms for diagram chasing. Finally, the adjoint functor theorem is mathematically nontrivial and part of the experiment was to do this with a person who was learning category theory as the proof was being developed. In this regard we are able to say that the proof was carried out without any unusual contortions that required an expert categorist; the main technical contribution was in the development of powerful and efficient enough tactics that made this program feasible. The version of the theorem that we prove is taken from Herrlich and Straeker [8]. It says that if G is a functor from a complete category A to B then G has a left adjoint if and only if G preserves limits and every/3 object has a G-solution set. The mechanical proof at this point is complete in one direction, the one that asserts the existence of the left adjoint. This is the direction with interesting constructive content. In the other direction we have proved that every object has a solution set but we have yet to complete the demonstration of limit preservation. This statement of the theorem should give some idea of the number of definitions involved.

502 As a prelude to the adjoint functor theorem we completed a mechanical proof of the special case when the categories are posets and the adjoint pair is a Galois connection. We also proved several simple theorems as a sanity check of our definitions. As an example, suppose that One is the one object one morphism category and F is the unique functor from a category ~t to One. Then the left adjoint of F maps the object of One to the initial object of A. The category theory toolkit was built in the Nuprl system. We selected Nuprl because the underlying type theory is constructive and one can automatically extract executable programs from the proofs. We also benefited tremendously from the sophisticated user interface it provides, from the the rich collection of tactics that the Cornell group has developed and from the expressiveness of the underlying type theory. The results of the experiment are that it is indeed feasible to develop such a proof. We feel that the most significant outcome is that it has given us ideas for designing and implementing a new theorem proving environment especially geared towards category theory. The effort took approximately 7 months to complete, this included the time spent for the first author to learn to use the Nuprl system and to learn the category theory needed to define the concepts and carry out the proofs. Clearly, a more experienced user would have done this more quickly. In this short version of the paper we do not provide a review of category theory or type theory. In the full paper [1] we include self contained reviews of these concepts. As far as the category theory is concerned, the first few chapters of Mac Lane's book should more than suffice [9]. A summary of both type theory and category is contained in a review article by Panangaden, Mendler and Schwartzbach [12].

2

Nuprl Definitions for Category Theory

An important part of the development of any mathematical theory is the ability to state definitions that abstract out some important ideas. Category theory possesses a small core of remarkably general definitions; category, functor, natural transformation, universal morphism. Nuprl provides a definition facility that allows one to state theorems and lemmas much as they might appear in a mathematical logic text. Unfortunately, this level of abstraction is not preserved by the proof steps. In other words, refinement steps may expand definitions into the base type theory and result in proofs that are not possible to read at the proper level of abstraction. The definition facility is under development and we expect that the new definition facility will allow significantly more elegance in the use of definitions. The definition of category uses the dependent product type to encode the standard definition, like Dyckhoff [5]. The definition below is as it appears in the proofs we developedI.

Category == Obj :U2

1We use typewriter font for text that is taken directly from the Nuprl system.

503

# Mor:(Obj

# Obj)->Ul

# Id: (ol:Obj->Mor(ol,ol)) # o : (ol :Obj ->02 :Obj ->o3 :Obj ->Mor (oi, o2) ->Mor (o2, o3) ->Mor (oi, o3) )

# forall A,B:Obj.forall f:Mor(A,B). f o Id(A) {A,A,B} = f in Mor(A,B)

# forall A,B:Obj.forall g:Mor(B,A) Id(A) o g {B,A,A} = g in Mor(B,A)

# forall A,B,C,D:Obj.forall f:Mor(C,D).forall g:Mor(B,C).forall h:Mor(A,B). ((f o g {B,C,D}) o h {A,B,D}) (f o (g o h {A,B,C}) {A,C,D})

-in Mor(A,D)

The definition above asserts that a category consists of two collections, the objects and the morphisms and that the morphisms obey some standard axioms. Note that composition is defined between composable morphisms only. Having dependent types makes it possible to express this easily. Composition, defined this way, takes five arguments instead of two. We use the definition facility to put the three additional arguments in braces so that it reads more like the traditional definition of composition. The last part of the definition expresses associativity of composition. The definition above uses the notion of type "universes" in an essential way. Note that the collection of objects is in a higher universe (1/2) than the collection of morphisms between two objects. In category theory one traditionally requires the collections of morphisms between a pair of objects to be a set whereas the collection of objects may be a proper class, such category is called a locally small category. Categorists are often driven to a thesaurus to find synonyms for the word "collection" in order to accomodate larger and larger collections. The point is that there are simple constructions that drive one out of a collection of categories; for example, functor categories between locally small categories are not locally small, in general. In fact the notion of stratified universes was present in some treatments of category theory, notably Grothendieck's [7], long before Martin-Lof's type theory emerged. The other feature worth noting about the above definition is that a morphisms comes with the information of what its domain and codomain are. This turned out to be essential in the rewrite tactics that we developed later. It allows one to check whether morphisms are indeed composable. Categories are often used to model different areas of mathematics or different aspects of programming languages and programming logics. In Nuprl when we want to model a particular theory using the category theory library we will open a new theorem and state as the top level goal "Category". A proof of this goal will be a term which actually inhabits the type Category. For instance we have proved the goal "Category" using U1 (the universe of small types in Nuprt) to represent the objects and the function space between two types to represent the morphisms. Identity and composition are what you would expect and the axioms were easily proved. Proving theorems about this category would be equivalent to proving theorems about U1 so in some sense each category can be thought of as a "mathematical workspace". Reasoning about the relationship between

504

two categories can thought of as reasoning about the relationship between two areas of mathematics. This leads us to the next definition: F u n c t o r ( A , B ) == fl:IAt -> [B] # f2:(ol:IAJ -> o2:[Al -> Hom(A)(ol,o2) -> Hom(B)(fl(ol),fl(o2))) # forall x,y,z:IAl, forall f:Hom(A)(y,z).forall g:Hom(A)(x,y). f2(x)(z)(f o(A) g) = f2(y)(z)(f) o(B) f2(x)(y)(g) in Hom(B)(fl(x),fl(z)) # forall x : l J I , f2(x)(x)(Id(A)(x)) = Id(B)(fl(x)) in Hom(B)(fl(x),fl(x))

In this definition we refer to two different categories with different compositions and identities. Here we use the notation o as a function that takes a category as argument and returns the composition of that category. Thus we write ( f o (A) g) to mean that we are using composition in the category A. A similar statement applies to Id and Hom. We have suppressed the additional arguments that occur in the definition of composition. The definition typed into Nuprl must, of course, have these arguments. Here Horn is a function that takes a category and extracts the morphism function, the latter is a function that takes two objects and returns the type of morphisms between those objects. When A is a category IAI stands for the class of objects in A. Part of the original motivation for formulating category theory is to make precise the notion of natural transformation. The following definition is the Nuprl definition for natural transformation. Nat_Trans(C,D,F,G) == n: ( o l : l C l -> H o m ( D ) ( F ( o l ) , G ( o l ) ) ) # forall a,b:IC].forall f:Hom(C)(a,b).

G(f) o n(a) = n(b) o F(f).

Although we have given three important definitions in category theory all we can do so far is model theories and logics with categories, functors or natural transformations. To actually prove theorems in category theory we need many other basic tools and constructs. Among the definitions that were implemented are sections, retractions, isomorphisms, epimorphisms, subobjects, limits, pullbacks, universal maps, adjunctions, CCC's,triples and many more. Particularly important was the ability to express universal maps: If A and B are categories, G is a functor from A to B ,b is an object of B, a is an object of A, and u is of type Hom(b,G(a)) then universal_map(A,B,G,b,a,u) == forall al:iAi.forall f:Hom(B)(b,G(al)), f = G(fl) o u

exists!

fl:Hom(A)(a,al).

505 Many theorems also had to be proved in order to make non-trivial use of these definitions. The development of the library was greatly assisted by the interface provided by the Nuprl system. The definitions and proofs greatly benefited from the definition facility in Nuprl and the readability and naturality of our definitions was assisted by the use of the dependent product (often referred to as a "Sigma" type) type in the Nuprl type theory.

3

Tactics

The use of tactics in interactive proof development has proved crucial to the development of non-trivial proofs. In the Nuprl project a rather rich collection of tactics has been assembled, primarily through the work of Howe, Basin and Murthy. An example of a very powerful tactic developed by the Nuprl group is the Autotactic. This tactic is capable of proving many goals of the form t E T where T is a type. This type of goal is known as a well-formedness goal and appears at almost every stage of a proof in Nuprl. A basic, but rather outdated, account of tactics in Nuprl appears in the book "Implementing Mathematics" by R. Constable and his coworkers [6]. For our purposes the main tactics that we needed were "diagram chasing" tactics. When developing the category theory library we have attempted to make the proofs as automatic as possible. Although the tactics provided by the Nuprl system were helpful, particularly in proving well-formedness goals, they did not provide the support required in order to do diagram chasing. Tactics for doing this became important for both aesthetic reasons (we wanted the proofs to resemble textbook proofs) as well as for practical reasons. Some proofs that could be solved automatically using some simple rewrite tactics would take hundreds of steps using the tactics that were provided or even thousands of steps using just the inference rules of the underlying type theory. Using these tactics we have been able to prove other basic results, largely automatically, including an proof that the composition of two functors is a functor. This latter proof was done after the proof of the adjoint functor theorem was complete and did not use tactics that wre specifically writen for it. Also included in our rewrite package are tactics for exposing the properties of certain terms in an equation and doing some simple syntactic manipulations. The core of the package is a user supplied database of lemmas of the form Vx....Vy.B1 --~ Each lemma is paired with a list of patterns where each pattern represents the left-hand side of the equality in the lemma. A subterm of an equation is said to match a lemma if it unifies with one of the patterns. The reason that each lemma is associated with more than one pattern is because the Nuprl definition facility allows the user to supply more than one possible form for a given term. Current changes being made in Nuprl may resolve this inefficiency. The tactic, R e w r i t e , takes a lemma, a list of patterns, and a term appearing in the goal of the proof being proved. If the term unifies with one of the patterns then the appropriate variables are instantiated into the lemma. The result will be an equation X ' = Y ' . R e w r i t e will transform this equation into the rewrite rule X --* Y and apply this rewrite to the goal. A similar tactic can be used to rewrite hypotheses. •. . B 2 . X t = X 2 .

506

Using the currying capabilities of ML one can build rewrite tactics such as LeftAssociate by applying Rewrite to the associativity lemma and the appropriate pattern list. T h e result will be a tactic which given a term of the form f o (g o h) will rewrite it to ( f o g) o h. A tactic that makes use of Rewrite is the DiagramRewrite tactic. This tactic first breaks an equation into a tree of subterms. A simple example is the following: if the equation is (f o (go h)) o k = (fog) o (h o k)

then the resulting tree is root

(f

o (g o h)) o k f o (g o h)

f goh g

h k (f o g) o (h o k) fog f g

hok h k

DiagramRewrite will then take a rewrite tactic, R, as input and, by doing a depth first search on the tree, attempt to apply R to each subterm. If R successfully rewrites a subterm then DiagramRewrite is called recursively on the new resulting equation. This process will continue until the equation does not change. It is also possible to combine rewrite tactics using the tacticals supplied by Nuprl. For instance, if one wanted a rewrite tactic which given a subterm of the form f oid rewrites the term to f or given a subterm of the form id o g rewrites it to g one would want a tactic Identity where Identity = )~x. LeftIdentity x O R E L S E RightIdentity x. T h e tactics LeftIdentity and RightIdentity are the rewrite tactics that reduce the above terms. A similar rewrite package for Nuprt was developed independently for the hardware verification library [2]. T h e techniques used there are similar to the techniques developed by Paulson for ISABELLE [13]. These are also similar to the techniques used in this part of our rewrite package in that they both use higher order tactics which take rewrite tactics and a user supplied temma database to do the appropriate rewriting. However, our rewrite package does not extend to user-defined equalities but only makes use of the equality which is associated with each type in Martin-Lof type theory. We feel that it would not be difficult to extend our rewrite package to include this facility but an example where it is needed in our proofs has not occurred yet.

507

An example of our rewrite package follows. To show" the equality

F ( f o g) o F(h o k) = (F(f) o (F(g) o F(h))) o F(k) where F is a functor and the other symbols denote morphisms, one can apply

DiagramRewrite(FunctorsPreserveComp) and

T H E N DiagramRewrite( Assoc). A similar tactic was used to prove that the composition of two functors is a functor. This theorem is similar to the challenge problem issued by Wos in the Journal of Automated Reasoning to prove automatically that the composition of homomorphisms is a homomorphism [15]. Another application of DiagramRewrite occurs when we prove theorems about diagrams. For instance, we know that if the following two equations hold l o l' = g o h and k o j = f o l' then the equation (k o j) o I = f o (g o h) also holds. Once this lemma was proved we were able to construct a rewrite tactic which given terms of the form f o (g o h) would rewrite them to (k o j ) o l. It would also be possible to make a rewrite tactic which would rewrite the above term in the other direction, i.e. (k o j ) o I would rewrite to f o (g o h). Hence, by implementing a theory of diagrams on Nuprl one can build a substantial and useful set of general rewrite tactics related to simple diagram chasing. When using a constructive theorem prover it is important to have tactics that can expose the properties of a certain proposition by reducing the function that a proposition might represent. For instance suppose

9. P:D -> U1 I0. f: (forall a:A. forall b:B. exists d:D. P(d)

appears in the hypothesis list and f s t ( f (x) ( y ) ) appears in the goal. We would like to be able to say that this term satisfies P. This can be accomplished by a tactic written by the Nuprl group called GenThen. When given the above term as input, GenThen introduces a new constant, say dl, replaces every occurrence of f s t ( f (x) ( y ) ) with dl and introduces a new hypothesis P ( d l ) . GenThen takes as input the term that the user wants simplified and the number of the hypothesis that contains the relevant function. Often, however, a given function may appear in many different places in a goal. Each occurrence of the function may have different arguments applied to it. It would be too difficult for the user to apply GenThen to each occurrence of a term containing the function in order to expose its properties. As part of our package, we have written a tactic, ExposeProperties, which takes a function and the number of arguments the function expects and attempts to unify the function with every subterm in the subterm tree. Similarly to DiagramRewrite, every time ExposeProperties succeeds in rewriting a subterm it calls itself recursively on the new" resulting equation. An example of when this proved useful will be shown in the next section.

508

4

The P r o o f of the Adjoint Functor T h e o r e m

In this section we outline the proof of the adjoint functor theorem at the level of lemma structure. This closely follows the pattern of the presentation in Herrlich and Straeker's book [8]. One of the positive experiences that we had was being able to carry out this proof without any contortions. The mechanically developed proof closely follows this structure. We annotate the proof outline with a discussion of the Nuprl definitions involved and the tactics used. T h e o r e m 1 ( F i r s t A d j o i n t F u n c t o r T h e o r e m ) Let A and/3 be categories, ~4 is complete and G is a functor from A to B. G has a left adjoint if G preserves limits and each B-object has a G-solution set.

We will first show what conditions are necessary for an adjoint situation to exist and then show how the above situation meets these conditions. L e m m a 1. If each b E Obj(B) has a G-universal map (nb, Ab) then G has a left adjoint. Constructing the left adjoint is the heart of the proof. The following lemma is used to do this. L e m m a 2. Let A and B be categories and G a functor from A to B. Let bl, b2 E Obj(/3) such that (ui, Ai) is a G-universal map for Bi, i = 1,2 then for each morphism f : bl --* b2 there exists a unique morphism f~ : A1 -* A2 such that the following diagram commutes. Since each bl E Obj(B) has a G-universal-map (ul, al) we can construct the left adjoint F in the following manner. Let F(bc) = ac and if f : b --* b' then let F(f) = f' where f' is as constructed in the above theorem. Proving this is actually a functor requires using the extracted code obtained from the above lemma and doing some rather extensive diagram chasing. T h e tactic ExposeProperties came in particularly useful when proving that the functor preserves composition of morphisms. At that point, several different occurrences of the above lemma, being used as a function, appeared in the goal. Also, the fact that each occurrence had 9 parameters made it too unwieldy in practice to repeatedly apply the GenThen tactic. The tactic ExposeProperties was able to reduce the goal significantly. When proving the above functor is an adjoint to G we made use of the fact that for each hi, ul is the unit of the adjunction. Now that we have shown that an adjoint functor can be constructed when every b has a G-universal map, we need to show that if G preserves limits and every b has a G-solution set then every b has a G-universal map. This is shown by proving several lemmas about the properties of multiple equalizers and multiple products. Some of the lemmas which needed to be proved were: 1. Each multiple equalizer is a subobject.

509

2. If e is an equalizer for f and G and e is an epimorphism then e is an isomorphism. 3. Let G : A--* B b e a f u n c t o r and let u : b ~ following are equivalent:

G(a) b e a B - m o r p h i s m .

Then the

(a) (u,a) is a G-universal map for b (b) (u,A) is a G-solution set for B and u-G-generates for A. 4. If (u,a) is a G-universal map for B then u extremally G-generates A. 5. If f is an isomorphism then it is a monomorphism and a retraction. 6. If A,B are categories, G : A --* B, F : B --+ A, and F is the left adjoint to B then for all b E Obj(B) there exists a universal map for b. Other lemmas that were proved are listed in the complete paper [1]. The proof was complicated and detailed enough that it provides a useful study of what is needed in a theorem prover which is to be used to prove substantial constructive proofs.

5

Extracting Constructive Content

One of the interesting aspects of adjoint functors is that uninteresting functors have interesting adjoints. For example, the forgetful functors from a category to algebras to S E T typically have, as left adjoint, the free construction of that algebra. The proof of the A F T allowed the Nuprl system to extract a program which is an example of an interesting categorical programming paradigm. The work described here is still preliminary. The extracted terms turn out to be very large and executing them involves first showing that the functor for which we are computing the adjoint satisfies the limit preservation properties and the solution set condition. We expect to carry out the proofs needed for this section and compute free constructions as adjoints over the next two months. Given some category of algebras one can use the A F T to generate the functor from

S E T to t h a t category which given a set returns the free algebra generated from that set. As an example define MON, the category of monoids and monoid homomorphisms, in the following way:

Monoid

== A:UI

# op:(A->A->A) # e:A # ... m o n o i d a x i o m s

A monoid homomorphism would be defined as:

510

monoid_homomorphism(A,B) == f:IAl->ISl # f(Id(A)) = Id(B) # forall x,y:IAl f(x * y) = f(x) * f(y)

Using these definitions we can prove the theorem >>Category by using monoids to represent the objects and monoid homomorphisms to represent the morphisms. The extracted code from this proof will be the category M O N . In a similar way we can prove a theorem in which the extracted code is the forgetful functor from M O N to S E T . Proving that M O N is complete, that the forgetful functor preserves limits and that every object in S E T has a solution set could be a non-trivial task on Nuprl. The tactics that we developed and the definitions and lemmas in the library made these proofs fairly easy. The fact that many categories have a similar structure to M O N should allow tactics to be written that can automatically prove many categories of algebras to be complete. The term extracted from the AFT when applied to a set should generate an object of the category M O N . described our experiences with using Nuprl as a proof development environment for category theory. The main technical effort involved the development of a family of tactics for rewriting that are of use in category theory. For example, we were able to show that the composition of functors is a functor almost completely automatically. Recently Larry \Vos had posed the problem of showing that the composition of two homomorphisms is a homomorphism [15] as test problem 15. Our proof that the composition of two functors is a functor does not, of course, solve Wos' problem but it does represent progress in that direction. Category theory is an excellent arena for automated deduction partly because of the tremendous variety of mathematical concepts that can be expressed and partly because there are a few, very general, proof patterns. In our opinion this area of mechanized mathematical reasoning has not received the attention that it deserves from the automated deduction community at large. Indeed we feel that our main contribution is that we demonstrated that one can really do a non-trivial proof in category theory. It is our opinion that experts in rewriting theory could implement systems that would probably be more useful than our package. It is our hope that our effort will motivate such people to think about using their methods to prove substantial theorems in category theory. We suspect that a system with powerful rewrite mechanisms, for example, Paulson's ISABELLE system [13], could well be as effective for automated deduction in categorytheoretic. Part of our goal was to extract executable terms from the constructive proof. In principle, such extraction can be done now, but we need to do more work before we can apply the extracted term and obtain a meaningful result. Currently we are interested in generating the adjoint to the forgetful functor from monoids to sets. Martin-Lof type theory provided a very useful object language for implementing category theory. Martin-LSf remarked that "set theory does not provide adequate foundations for category theory" [10]. While we do not make such a claim, we do find that the hierarchy of universes in intuitionistic type theory fit naturally with many of the definitions

511

of category theory. Viewing concepts in category theory as specifications in a programming logic has allowed us to move towards extracting meaningful programs that could be of use in the development of a categorical programming language. Another possible choice for an object language could have been the Calculus of Constructions (CoC) [4]. However, the fact that an equality relation is built into each type in Nuprl proved to be quite useful. If the category theory toolkit were implemented in a type theory like that of CoC, we would have had to define equality for each type. Clearly, one could have carried out this work in the CoC. The major difference in the type theories is that fact that CoC allows impredicative definitions whereas in Nuprl one has a predicative hierarchy of type universes. The impredicativity can potentially allow one to express certain concepts that may not be expressible in the predicative theory but we have not come across concepts in our experience with category theory where this would have made a difference. The Nuprl type theory was not always able to express ideas and concepts in the most natural way. For instance, proving that f o (go h) o k = ( f o g ) o (h o k) requires a non-trivial rewrite tactic. The tactic is often quite inei~cient because of the number of lemma instantiations, substitutions and wetl-formedness goals that have to be proved even though that we know the tactic will work every time. The natural solution to this is to explore the idea of reflection. How can we use the object logic to reason about proofs in the logic? Wbrk on this is currently being done at Cornell. In the example above, one of the sources of inefficiency in the rewrite tactic was the fact that we would have to repeatedly instantiate the lemma which handled associativity and then use the results of this instantiation in the substitution. In other words, although every value of type "category" comes equipped, by definition, with a built in associativity property for composition, the tactic writer cannot conveniently make use of this fact without proving additional Iemmas or theorems. An implementation of a theory in Nuprl can be viewed as a small subset of types out of all the possible types in one or more universes. The creation of a theorem to specify a property already known to be trivially true adds one more type to our theory or the specification of our theory. Whether or not this is the most natural and economical way to specify a theory is an open question. We are considering two new directions for future research. The first is an extension of the rewriting package for category theory. The second is developing a theory of monads on top of our existing libraries. Recently the importance of monads for computer science has been pointed out by Moggi [11]. Roughly; the idea is that you have a fixed category which represents all the basic types and operations in your programming language and then you incrementally add more features by defining the appropriate monad and using this monad to build the Kteisti category over the fixed category. This new category now models a programming language where the programs are morphisms taking values to computations. Thus the terms extracted from proofs about morphisms in this category can be viewed as programs in a Nuprl defined programming language where the semantics of this language is modeled by the Kleisli category over the monad. We have begun to implement parts of Moggi's theory and have been able to express the basic definitions like monad and Kleisli category.

512

It would be interesting to understand the relation between the extraction process and the computations defined in Moggi's calculus.

Acknowledgements We have benefited from helpful discussions with Doug Howe, David Basin and Chet Murthy. This research was supported in part by NSF grant CCR-8818979.

References [1] J. A. Altucher and P. Panangaden. A machine-assisted proof of the adjoint functor theorem. Technical report, Cornell University, 1990. In preparation. [2] D. Basin. Generalized rewriting in type theory. Technical Report 89-1031, Cornell University, Computer Science Department, 1989. [3] R. BurstM1. Electronic category theory. In Proceedings of the Ninth Annual Symposium on the Mathematical Foundations of Computer Science, 1980. [4] T. Coquand and G. Huet. Constructions: A higher order proof system for mechanizing mathematics. In Proceedings of EUROCAL85, Linz. Springer-Verlag, 1985. [5] R. Dyckhoff. Expressing category theory in martin-loPs type theory. Unpublished manuscript, 1984. [6] R. L. Constable et. al. Implementing Mathematics with the Nuprl Proof Development System. Prentice-Hall, 1986. [7] A. Grothendieck and J. L. Verdict. Theorie des Topos, volume 267-270 of Lecture Notes in Mathematics. Springer-Verlag, 1972. Reprinted in LNM, original version 1957. [8] Horst Herrlich and George E. Straeker. Category Theory. Allyn and Bacon, Boston, 1973. [9] Saunders Mac Lane. Categories for the Working Mathematician, volume 5 of Graduate texts in Mathematics. Springer-Verlag, New York, 1971. [10] P. Martin-L5f. Notes on intuitionistic type theory. Padova Summer School, notes by G. Sambin, 1980. [11] E. Moggi. Computational tambda-calcutus and monads. In Proceedings of the Fourth IEEE Symposium on Logic in Computer Science, pages 14-23, 1989. [12] Prakash Panangaden, Paul Mendler, and Michael Schwartzbach. Resolution of Equations in Algebraic Structures I, chapter Recursively Defined Types in Constructive Type Theory, pages 369-410. Academic Press, 1989.

513

[13] L. Paulson. Natural deduction proof as higher-order resolution. Technical Report 82, University of Cambridge, Computer Laboratory, 1985. [14] D. Rydeheard and R. Burstall. Computational Category Theory. Prentice-Hall, 1988. [15] L. Wos. Automated Reasoning: 33 Basic Research Problems. Prentice Hall, EngleWood Cliffs, New Jersey, 1988.

D y n a m i c Logic as a U n i f o r m F r a m e w o r k for T h e o r e m P r o v i n g in I n t e n s i o n a l Logic* Heikki Tuominen

Nokia Telecommunications P.O.Box 33, SF-02601 ESPOO, Finland e-mail: [email protected]

Abstract Dynamic logic is proposed as a uniform framework for theorem proving in propositional intensional logic. Satisfiability and unsatisfiability preserving translations from various modal, deontic, epistemic, temporal, and intuitionistic calculi into dynamic logic calculi are defined and partly proved to be correct. The translations unify theorem proving in intensional logic by using dynamic logic as an intermediate logic for which the actual theorem provers can be implemented.

1

Introduction

Automated reasoning in intensional - - i.e. modal, temporal, epistemic etc. - - logics has recently drawn much attention. Several methods based on resolution, natural deduction, and semantic tableaux have been proposed for the most general form of this reasoning, theorem proving. However, the reasoning is complicated by the multiplicity of intensional calculi, the methods have to be at least partly calculus-specific.

One way to reduce the multiplicity and to unify theorem proving in intensional logic is to use a common intermediate logic into which formulas of the various calculi can be translated. It is much easier to develop and maintain one theorem prover for the intermediate logic and a set of translation rules than several separate theorem provers. The standard candidate for the intermediate logic is first-order predicate logic which can be used for most intensional calculi, the intensional operators correspond in a way to quantifiers of first-order logic. Unfortunately the use of first-order predicate logic *This research was supported by the Academyof Finland.

515 as the intermediate logic leads to an unnatural representation, the intensionality gets reduced to a certain kind of extensionality. To avoid the unnatural reduction to extensionMity also the intermediate logic should be an intensional one. Fortunately there is an intensional logic - - actually a family of calculi - - which includes most of the other intensional calculi as special cases. It is dynamic logic which was originally developed by V. Pratt in the middle of the 1970's for reasoning about computer programs [11]. The generality of dynamic logic is based on the fact t h a t its primitives are on a lower level than those of the other calculi. This makes it possible to construct other intensional operators on top of the operators of dynamic logic. Although the generality was noticed already in the pioneer paper on propositional dynamic logic [7], it seems not to have been exploited systematically. The approach taken in this paper is to define satisfiability and unsatisfiability preserving translations from various propositional modal, deontic, epistemic, temporal, and intuitionistic logic calculi into dynamic logic. Most of the translations are fairly obvious; they reflect the properties of the accessibility relation in the source calculus and are based on the similarity of models in the source and target calculus. In addition to defining the translations, a systematic method to prove their correctness in cases of modal and deontic logics is presented. Because the translations cause only polynomial blow-up in the length of the formula, it is clear that the computational complexity of satisfiability in the target calculus has to be at least as high in the complexity hierarchy as that in the source calculus. Fortunately there are dynamic logic calculi in the relevant complexity classes, mainly PSPACE complete and E X P T I M E complete, so that the target calculus can be chosen to be in the same class as the source calculus. The rest of the paper is organized as follows. Section 2 is a short introduction to dynamic logic. The translations from various intensional calculi into dynamic logic are presented and partly proved correct in Section 3.

2

Dynamic logic

By syntax dynamic logic resembles modal logic. The modal operator L is replaced by the constructions [a], where a is a program. The intended reading of [a]~b is "¢ is true after every possible execution of the program a " and (a) is defined as -,[a]-,. Programs of the basic propositional dynamic logic, PDL, are constructed from atomic programs using the (regular) program operators concatenation (;), nondeterministic choice (U), and repetition (*). In addition there is the test operator, ?, which maps formulas to programs. Models of dynamic logic are ordered 3-tuples (W,%p), where W is a non-empty set (set of states), r is a function from the set of atomic formulas to the power set of W (valuation function), and p is a function from the set of atomic programs to binary relations over W (set of accessibility relations). The valuation function and the

516

accessibility relations are extended for arbitrary formulas and programs of PDL by the following definitions.

~(2) ~(~) ~(~ ^ ~) ~([~]~)

: =

: = p(¢?) = p(~;~) = p(~ u 19) = p(a,) =

O, ~ ( T ) : W w~(~) ~(~) n ~(~) {~ c wlvt(O,t) E p(~) ~ t E ~(~))} {0,~)1~ E r ( ¢ ) } p(~) o p(19) -- {(s,t)l~KO,~) E p(~) ^ (~, t) E p(19))} p(,~) u p(19) (p(a)),, the reftexive transitive closure of p(a)

In the sequel also the more familiar notation M, s ~ ~b is used instead of s E T(ff). DPDL, the deterministic version of PDL, differs from PDL only in that the accessibility relations assigned to atomic programs in its models are functional. SDPDL (structured or strict DPDL) is the syntactic restriction of DPDL in which the program operators U and * are allowed to appear only in constructs of the form (if?; a) U (-~b?; a) and (~b?;a)*;~¢?, respectively. The constructs are abbreviated as if ~b then a else 19 and while ~ do a. CPDL, PDL with converse, is PDL augmented with the converse operator, c, whose semantics is defined as follows.

p(o~°)

=

p-'((~)

=

{O, t)l(t, ,) E p(oO}

RPDL, PDL with repeat, allows reasoning about infinite computations using the repeat operator mapping programs to formulas with the following semantics.

r(repeat(a))

=

{so13S13S2...Vi > 0 (s,,s~+l) Z p(a)}

ODPDL is the obvious combination of CPDL and DPDL, CRPDL similarly of CPDL and RPDL. PDL has the collapsed model property. The construction of the filtration of the canonical model through the Fischer-Ladner closure of a given formula can be used to decide satisfiability of the formula [17]. The only drawback of the method is that it takes exponential time in the length of the formula independently of the formula. There exists also a tableaux-based goal-oriented procedure which constructs only the relevant part of the filtration [18]. CPDL has as well the collapsed model property and the filtration method is thus available for testing satisfiability [11]. However, a goal-oriented procedure is more difficult to formulate because a model cannot be built recursively in a simple way. DPDL doesn't have the collapsed model property but the existence of the pseudo-model (filtration of the canonical model) for a formula can be shown to guarantee the existence of a model [2]. This makes it possible to use a tableaux-based decision procedure for satisfiability also in DPDL. RPDL has the finite model property but not the collapsed model property [11]. CRPDL is still more complicated, it is decidable even though it doesn't have the finite model property, e.g. the satisfiable formula [b.](b)T A [b*]-~repeat(b c) has no finite models, The same goes for CDPDL, e.g. the satisfiable formula P A [(bC)*](b¢)-~P has no finite models. The published decision procedures for RPDL, CRPDL, and CDPDL are based on automata

517

almost

almost

reflexive reflexive symmetric K KD KT KB K4 K5 KDB KD4 KD5 K45 KD45 KB4 KTB KT4 KT5 OM 0S4 OB OM + 0S4 +

symmetric

transitive

Euclidean

•

0 0

• • •

0

• •

•

•

•

•

•

• •

• •

• •

OB +

Table 1: Properties of the accessibility relation for some modal logic calculi (p is almost symmetric if VzVyVz(((z,y) 6 p A (y,z) E p) ~ (z,y) 6 p) and almost reflexive if

w v y ( ( y , ~) • p ~ (~,, x) e p)). on infinite trees [5,19]. S D P D L is of special interest in the present context because its satisfiability problem is P S P A C E complete [10]. The other calculi are harder: PDL, DPDL, CPDL, CDPDL, and R P D L are E X P T I M E complete [11,19,5] and C R P D L is decidable in eightfold exponential time [11].

3

Translations into dynamic logic

The translations from intensional calculi into dynamic logic are defined as two-level functions, the upper levels are labelled with Fcl,c~ and the lower levels by ~1.~:2, where £1 and £2 are the source and target calculus, respectively. If not otherwise stated the 4~c,,c~ functions preserve atomic formulas and the truth-functional connectives in the following way.

518 Oz,,L2(¢)

=

¢, for atomic formulas ¢

• ~,,~2(¢ ^ ¢)

=

¢~,,L,(¢) ^ ~ , , ~ , ( ¢ )

b is used as an anonymous atomic program in the translation functions. T h e translations for modal and deontic logic calculi are proved correct, the others are given without proof. The translations for epistemic and tense logics are obvious extensions of the ones for modal logic and the translation for intuitionistic logic is based on the well-known reduction to the modal calculus KT4 ($4). At the end of the section part of the translations are reformulated so that the target calculus is SDPDL, the calculus whose satisfiability problem is P S P A C E complete.

3.1

M o d a l and d e o n t i c calculi

To be compatible with dynamic logic we represent models of modal and deontic logic as ordered 3-tuples (W, % p), where W is a non-empty set of states, T a valuation function assigning subsets of 14~ to atomic formulas and p a binary accessibility relation between states. The calculi differ from each other only regarding the properties p is supposed to have. The properties of p for the considered calculi are given in Table 1 which is collected from [3] and [11. The translations for the calculi whose accessibility relation is not serial are defined as follows.

r~,,~(¢)

=

~,,~.(¢)

• ~,~(r¢) ~KB,OPDL(L¢)

= =

[b u r ? ] ~ , ~ . ~ ( ¢ ) [bUbC]~KBOpD,(¢)

q)KS,CPDL(L¢)

=

[((bC)T?; (b U be)*; (be)T?) U ([b¢l_L?; b)](I)Ks,CPDL(¢)

~K~,OPDL(L¢)

=

[(~ U b°);(b U bc)*l~B~,o~,~(¢)

(I)KTB,CPDL(L¢) ----- [b U T ? U bC]~KTB,CPDL(¢) q~XT4,er)i(L¢) = [b*I~KT4,PDL(¢)

• o~.,o~,~(o¢) (I)oB,CPDL(O¢)

= =

[(b;b.) u T?)~;(b U b~)*;(be>T?) = p((be)T?; (b U be)*; (b U be)*; (be)T?) = p((b)T?; (b U be),; (be)T?) C_p((b U be)*; (b~)T?). KB$: To show that p((b U be); (b U b*)*) is symmetric suppose that (s,,s2) E p((b U b*); (bUb~)*). This implies that (s2, sl) e p(((bUbe); (bUb~)*) ~) = p(((bUb*)*)c; (bUb~) *) = p((b U be)*; (b U be)) = p((b U be); (b U be)*). To show that p((b U be); (b U be)*) is transitive suppose that there are states Sl, s2, and sa such that {(s~, s2), (s2, s~)} C p((b U be); (b U be).). This implies that (Sl, ss) E p((bUb~);(bUbe)*; (bUb¢); (bUb¢)*) C_ p((bUb¢); (bUbe).). KTB: To show that p(b U T? U be) is reflexive suppose that sl is a state. Clearly (sl, Sl) E p(T?) C p(b U T? U b~). To show that p(b U T? U b¢) is symmetric suppose that (sl, s2) E p(b U T? U b~). This implies that (s~, Sl) E p((b U T? U be)¢) = p(b¢ U T? U b). KT~: To show that p(b*) is reflexive suppose that s~ is a state. Clearly (sl,s~) E p(T?) C p(b*). To show that p(b*) is transitive suppose that there are states Sl, s2, and s~ such that {(s~ s2), (s~., sz)} C p(b*). This implies (sl, ss) E p(b*; b*) C_ p(b*). KTh: To show that p((b U b~)*) is reflexive suppose that s~ is a state. Clearly (s~,sl) E p(T?) C_ p((b U b~)*). To show that p((b U be)*) is transitive suppose that {(sl, s2), (s~, s~)} C_ p((bUb¢),). This implies (sl, ss) E p((bUbC)*;(bUb¢)*) = p((bUbe)*). To show that p((b U be)*) is symmetric suppose that (s~, s2) E p((b U b)*). This implies e p(((b u bg,) o) = p((b u bo),). OM, OM+: To show that p(b U (be)T?) is almost reflexive suppose that (,$1,S2) E p(b U (b~)T?). This implies that (s2, s2) E p((bC)T?) C p(b U (b~)T?).

OS4, OS4+: To show that p((b¢)T? U (b; b*)) is almost reflexive suppose that (s~, s2) E p((b¢)T? U (b;b*)). This implies that (s2,s2) E p((bC)T?) C_ p((b¢)T? U (b;b*)). To show that p((b¢)T? U (b;b*)) is transitive suppose that {(s~,s2),(s2,ss)} C_p({b¢)T? U (b;b*)). Thus (s,,sa) E p(((b~>T? U (b;b*));(T? U (b;b*)) = p((ibC>T?; T?U({b~)m?; (b; b*))U (b; b*)U (b; b,)) = p(T? U (be; ~ A ^ ~C} A1 has two extensions : E11 = Th(Wl u {S}) E1 z = Th(W1 t3 {A,C}) In Reiter (1980) we find the following theorem which characterizes extensions in terms of theories over W and consequences of defaults.

Theorem 2 (Theorem 2.5. from Reiter) Suppose that E is an extension for a default theory without free variables A = (W, D). Then E = Th(W kJ CONS(GDfE, A))).

Theorem 3 (Corollary 2.2. from Reiter) A default theory D = (W, D) without free variables has an inconsistent extension iff W is inconsistent. But some default theories do not have extensions :

Example 2 : q:--¢ A2 = (W2, D2) with D2 = { " 7 - }, W2 = {~p ^ q}. A2 has no extension because the consequent of the default rule is inconsistent with W2 whereas its prerequisite and its justification suggest that it should be applied. But Reiter has presented a class of defaults, called normal defaults, for which extensions always exist.

A normal default is a default of the form

a(x): t~(x)

13(x)

Default proofs are defined for a normal default theory A = (W, D) without free variables in the following way : A formula F has a default proof with respect to A iff there exists a finite sequence DO, D1 ..... Dk of finite subsets of D (1) W u CONS(D0) ~- F (2) For 1 < i < k W k3 CONS(Di) }-- PREREQ(Di.1) (3) Dk = 0 (4) W u U

{CONS(Di) : 0 < i < k} is satisfiable.

532

Reiter has shown that a formula F has a default proof with respect to a default theory A iff F is contained in an extension of A. But the extension membership problem is not even semidecidable as is shown clearly in (1) and (4). Therefore we consider a trivially decidable subset of first-order logic, the predefinite variable formulas. It is the same subset considered by (Besnard et al. 1983) and first defined by (Bossu and Siegel 1985). The formulas contain only constant function symbols and all variables occuring positively in a formula occur also negatively in it. For example, 3x p(x) does not belong to the subset, but p(x) ~ q(x) does. Let us also note that this definition of a default proof is incremental, i.e. it suggests that we take a default, then try to "apply" it to the set W, when possible, and then continue the same process with the new set W augmented by the default consequence (which has been "added" to W). We will see later that our approach is radically different in its philosophy because we will suggest that all default consequences be added first and then those which could not be applied (for two kinds of reasons either they lead to contradictions or the prerequisite condition does not hold) be retracted.

III. THE THEOREM PROVER The theorem prover we have used is based on the analytic tableaux method [Smullyan 1968] and is described in [Schwind 1985], where the classical part contains only predefinite variable clauses. Within the scope of this paper, we will consider only its propositional part (for classical logic). This is sufficient because the idea of our algorithm is the same whether the logic has quantifiers or not. TP proves a formula F by trying to derive a contradiction from assuming --~F. TP builds for ..qz a set of sets of formulas (called semantic tableaux) by applying a number of operations to ~ F yielding this set.TP can be defined as a mapping between sets of formulas and sets of sets of literals recursively defined as follows : TP(M)=TP(M'u{p})if--,~p~

TP(M) =TP(M'u (p} u{q} ) i f

M andM'=M\{~p} p^qE

M and M ' = M \ { p ^ q }

TP(M) = T P ( M ' • { ~ p } ) u T P ( M ' u {--, q}) if - - , ( p A q ) ~ M and M ' = M \ {--,(pAq) } TP(M) = TP( M u {A[c] }) if 3 x A(x) E M, where c is a ~ew parameter TP(M) = TP( M u {A[c] }) if V x A(x) ~ M, where c is any parameter TP(M) = {M} if M is a set of literals.

533

For an example : TP({(avb)Ac}) = TP({avb,c}) = { {a,c},{b,c} } Note that this way of splitting formulas gives us sets of sets of literals at the end of the process. The tableau for a formula corresponds to its disjunctive normal form, i. e. each set represents the conjunction of its elements and the tableau represents the disjunct of its elements. Definition

4 :

A set of literals is closed if it contains two opposite literals (i.e. L and ~ L ). A set of sets of literals is closed if each of its elements is closed. The fundamental property of TP for theorem proving is the following completeness theorem : Theorem

4 :

F is a theorem iff TP({--T}) is closed. (Proof in [Smullyan 1968]). We consider TP not only as a theorem prover (or consistency checker) for first-order formulae but also as an application which has useful properties for formulas and formula sets. We will frequently use the following properties of TP : Lemma

1 :

TP({FAG})={XuY:X~ TP({F}) and Y~ TP({G})} This will allow us to consider conjunction as an operation upon sets of sets of literals. We will have to compute only once the image by TP of each formula and the image of any conjunction of already "split" formulas will be obtained using lemma 1. Lemma 1 gives rise to the following notation : F ® F' = {XwY:X~ F and Y~ F'}. The set of sets of literals constructed by TP for a formula F corresponds to the disjunctive normal form of F, where each set corresponds to a conjunction and is itself a disjunct. For example : TP({ (avb)Ac })= { {a,c 1, {b,c } ] = TP({ (a,xc)v(bAc) }) and (aAC)v(bAc) is the disjunctive normal form of (avb)Ac. The disjunctive normal form of a formula F obtained from TP(F) is denoted ~p(TP({F})).

534 As an immediate consequence of the completeness theorem, we have

Corollary

1

:

F ~ Th(F) i f f T P ( F ) ® TP({~F}) is closed. Proof: F e Th(F) i f f F I- F iff t- F --~ F (deduction theorem) iff T P ( { ~ ( F --~ F)}) is closed (completeness theorem) iff TP(F ^ {-~F}) = TP(F) ® TP({~F}) is closed. In what follows we will frequently consider "subtableaux", where literals in a set are suppressed. This is written as follows : Let T be a set of sets of literals, and L a set of literals. Then T+L=

{Y:Y =XXL forXe

T}.

Sometimes, we will have to consider "subtabteaux" (for a complex formula), where all literals coming from the same subformula are suppressed. In order to recognize from which part the literals come, we will index the formulas and subsequently literals. For example, let be dl = (A A B) v G, d2 = F m A --~ G. Then dlAd2 may be noted (A(dl) ^ B(dl)) v G(dl) ^ (F(d2) ^ A (d2)--~ G(d2). By suppressing within a tableau constructed from a conjunction of formulas all literals coming from one of the conjuncts, we obtain the tableau belonging to the conjunction of all the other formulas. Lemma 2

Let F(d), G(d') be indexed formulas and L ( d ) , L'(d') the set of literals of F resp. G. Then TP({F(d) }) = TP((F(d)AG(d') }) + L'(d').

TP frequently contains closed sets or sets which contain other sets in TP. In this case we are sometimes (especially when a TP is not closed) interested in a minimal form, defined by TS(M) = T P ( M ) \ {X : X ~ TP(M) and X closed o r 3 y ~ TP(M) such that Y c X}

Clearly, q) (TS(M)) 4-~ q>(TP(M)), because of (A ^ B)v A 4-~ A and (A ^ - - ~ ^ B)v C 4-->C.

This can very often considerably shorten a tableau.

535

IV. C O M P U T I N G

EXTENSIONS

The idea of our proposed method is very simple : An extension for a default theory A = (W,D) is roughly speaking the set of theorems over the union of W and a set of default consequences (see Theorem 2). It is a maximal set of this kind in the sense that the addition of any other default consequence is not possible because the prerequisite condition does not hold or this would make E inconsistent. Now the idea of our algorithm is as follows : We consider the set W u CONS(D). There are two cases : either W to

CONS(D)

is consistent. Then

A

has at most one extension,

T h ( W u CONS(D')), where D' is the greatest subset o f D containing the respective prerequisites. in the other case, W w CONS(D) is not consistent. Then the tableau T constructed for -

W to CONS(D) is closed, i.e. each set in T is closed. But it is possible to "open" T by suppressing within T literals "responsible" for the contradiction. Remember that T is open whenever at least one of its sets is open. By opening each of the sets of T in this way and by verifying the prerequisite condition, all extensions can be obtained.

Example 1 (continued) : A1 = (W1, D1) with D1 =

f

:A A'

:B B'

:C } C and

W l = {B --~ --,A ^ ~C} The extensions are obtained in the following way : TP(W1 u {A, B, C}) = { {--~, ~C, A, B, C}, {~B, A, B, C}} TP(W1 u {A, B, C}) is closed. There are two ways of opening it by suppressing literals coming from default consequences : We can suppress A and C responsible for the contradiction in its first element, or we can suppress B, responsible for the contradiction in the second element. This yields the two extensions : E1 i = Th(Wl u {B}) E12 -- Th(Wl u {A,C}) In this example it was straightforward to give the extensions because the consequences of the formulas were atomic. When this is not the case, we have to suppress together with a literal all other literals which come from the same default consequence. In order to find them, default consequences are indexed and together with the literal L(d) all other literals L'(d) are suppressed.

536

Example 3 :

:wE :B } RE ' B and

A3 = (W3, D3) with D3 = {dl, d2, d3} = ~{ :A ^ F , AAF W3 = {A ^ B ~ E } . TP(W3) = { {E }, {mA }, {mB } }

TP(CONS(D3)) = { {A(dl), F(dl), -~E(d2), B(d3)} } T3 = TP(W3 u CONS({dl, d2, d3})) = TP(W3) ® TP(CONS({dl, d2, d3})) = {{E, A(dl), F(dl), mE(d2), B(d3)}, {RA, A(dl), F(dl), ~E(d2), B(d3)}, {roB, A(dl), F(dl), ~E(d2), B(d3)} } T3 is closed and there are several ways to open it yielding the following extensions : E31 = Th(W3 u {A, F, B }) (by suppressing all L(d2) because of the contradicnon in the first se0 E32 = Th(W3 u {--~E,B }) (by suppressing all L(dl) because of the

contradiction in the

second set) E33 = Th(W3 u {A, F, RE}) (by suppressing all L(d3) because of the contradiction in the third set) When a default d "to be kept" in an extension has a prerequisite 0~, it has to be verified that tx is derivable. This is the case when TP(W) ® TP(CONS(D \ {d})) ® TP({RO~}) is closed.

Example 4 (Example 4.1 from Reiter 1980) : A4 = (W4, D4) with D 4 = {dl, d2, d3, d4}=

W4=

f

It

EvF:AAF A A F

A:B

'

B

AAE:C

'

C

:mE

' RE

{C--> D, A ^ B --~ E, E v D, D ~ F}.

We represent the sets of the tableau for W4 as colums : TS(W4) =

RC

mC

--~

~B

D

-4)

E

D

D

E

E

F

F

F

F

TP(CONS(D4)) = {{A(dl), F(dl), B(d2), C(d3), RE(d4)} }

J and

537

TS(W4) ® TP(CONS(D4)) is closed. The f'n'st set is closed by E and ~E(d4). Hence dl, d2 and d3 possibly belong to the extension. The precondition for dl, E v F is derivable, since TS(W4) ® TP(CONS({d2, d3})) ® TP({~(E v F)}) is closed. In the same way, we find that the prerequisites of d2 and d3 are also derivable. By verifying the other colums in the same way, we get the following extensions : E41 = Th(W4 u CONS({dl, d2, d3}) E42 = Th(W4 u CONS({dl, d4}) The algorithm for choosing the defaults to keep is described in more detail in (Risch 1989). The following example shows how the method behaves with directly contradictory defaults.

Example 5 : A 5 = ( W 5 , D5) w i t h D 5 = { B~A., B:--aA ~ A } and W5 = {B }. The extensions are obtained in the following way : TP(W5 u {A, --,A}) = {{B, --,a, A} } TP(W5 w {A, ~A}) is closed. There are two ways of opening it by suppressing literals coming from default consequences : We can suppress A coming from the first default or --~ coming from the second default. This yields the two open tables T x = TP(W5 u {A}) and T2

=

TP01¢'5 t..) {~A}).

The prerequisite condition holds for both since TP(W5 u {A}) ® TP({~B }) and TP(W5 u {--~A})® TP({--,B}) are both closed. This gives the two extensions : E5x = Th(W5 u {A}) E5 z = Th(W5 t3 {---,A}) It is also straightforward to deduce formulas from the default theory. A formula F is deducible if it is in an extension Th(F), i.e. if TP(F) ® TP({--,F}) is closed (by Corollary 1). Since, with our algorithm all extensions are constructively produced and then available in the form TP(...), it is sufficient to construct TP({-,F}) and to check whether TP(F) ® TP({~F}) is closed using lemma 1. Defaults have to be "grounded" in the set W. Each prerequisite has to be derivable in W alone or in W and some set of consequences of defaults which have not been derived by means of the

538 prerequisite itself. It is not possible that two defaults have as a consequence the prerequisite of each other (and be applied). The following example illustrates this case.

Example 6 : A6 = (W6, D6) with D6 =

B:A A '

A:B } B

and W6 = O.

A6 has one extension : E6-- Th(O) In order to exclude that {A, B } be an extension, we define groundedness of default sets in the following way. D~finition 5 : A set D of normal defaults without free variables is grounded in W iff for all de D there is a

o~i : ~i finite sequence do, dl .... dn of elements of D, di - - such that if0 e Th(W) and tXi+l e Th(W u CONS({d0, dl .... di}) for 1 B({~, ¢ } , ¢), and this top-down renaming, containing ~, is not free in ¢, hence not optimal (it is easy to show, using tim, that any optimal renaming is free in ¢). Here, a bottom-up strategy is better, but other examples show that the contrary is also (and often) true, hence none of bottom-up or top-down strategies are optimal.

565

3.2

invariance

The problem is then to find under which conditions top-down strategies are better than bottom-up ones. In the following, we will restrict ourselves to linear formulas (without equivalence), and show a much stronger result: that any top-down renaming is optimal. For the sake of simplicity, we will work on negation normal forms (nnf), which is not a problem since transformation into nnf (from a linear formula) is linear in size, as well as in time. We then have polynomials pC with only one argument. We will first show that all top-clown renamings bring the same number of clauses, the consequence of which, from a computational point of view, is that we do not have to program a particular strategy: any top-down strategy suits, and in particular the simple depth-first left-right one, resulting in ease and efficiency. Surprisingly so, the proof of this fact is more difficult and technical than (the rest of) the proof of optimality, hence we will skip some details. We first have to establish, as a lemma, a structural property of top-down renamings. L a m i n a 4 let ~ r-" ¢, n a renaming of ~ top-down in ¢, ~' t-- ~, R ~ = R N S F ( ~ ' ) - { ~ ' } , and if 3~" e R, ~' f- ~" then ¢' = S u p R ( ~ ' ) [ R - R'] else ¢' = ¢ [ R - R~], then R' is a renaming of ~' top-down in ¢~ P r o o f : it is not difficult to show that R ~ is free in ¢~: Y~ '' E R', we have B ( ¢ ' , Rename R' - {~"} in ¢') = B(~", Rename R - {q0"} in ¢) (because ~¢' ¢ R - R'), which is positive as R is free in ¢. The condition of saturation in ¢t is also verified V~" ff ~', trivially if SupR(~") = SupR,(~"), and in the case where Supn,(~ N) is undefined, it comes from the fact that (R - It') t.J (R' - S F ( ~ " ) ) = R - S F ( ~ " ) (because (R - R') N SF(qo") = 0). Q.E.D. This lemma will of course help to establish inductive proofs on top-down renarnings, but we also need a more specific lemma concerning disjunction: L e m m a 5 Let ~ C ¢ with ~ = ~l V.. . v ~ , and P¢~ = )~x.x + c, R a renaming of ~ topdown in ¢, a n d s = {i e {1..n} : P(~i) > 1}, then 3k e S,~k f[ RAVi e S - { k } , ~ o l e R Proof.- it is very easy to see that if there are at least two ~i's with p(~Pi) > 1, their benefit in ¢ is positive, and negative otherwise. We conclude that they all are in R (from the saturation condition) except one (from R free). Q.E.D. We can now show our theorem of invariance: T h e o r e m 6 V~ ff ¢, let R, R' be two renamings of ~ top-down in ¢, then: p(Rename n in ¢) = p(Rename R' in ¢) P r o o f : by induction on ~, that the equality holds for any ¢, R, R'. If ~ is a literal, we have R = R ' = 0, and the equality is trivial. Otherwise, we first suppose that B(~, ¢) < 0, hence that ~ g R, ~ ~ R ~, and consider three cases:

566

1. ~ is a quantified formula Qxl..zn~', then from lemma 4, R and R' are renamings of ~ top-down in ¢, and the induction hypothesis directly gives p(Rename R in ¢) =

p( Rename R' in ¢ ). 2. ~ is a conjunction ~lA--.A~n, let Rk = R n S F ( ~ k ) and R~ = R ' n S F ( ~ k ) . From lemma 4 we infer that Rk (resp. R~) is a renaming of ~k top-down in ¢[R - Rk] (resp. ¢[R - R~]), but the replacement of subformulas not in SF(~k) is actually irrelevant: because of the conjunction, they do not interfere with the benefits inside ~k. If we take for example R~ = t,J~=~ R~ I J Uin=k+l Ri, then Rk and R~ are topdown in CIR,'I, and by induction hypothesis we have p(Rename Rk in CIR,]) = p(Rename R~ in ¢[R~]), which can be translated into k-1

n

k

n

P ¢ ( ~ p(~i[R~]) + ~-~p(~i[Ri])) + rk = PC(~-~p(~i[R~]) + ~ i=k

i=1

i=1

p(~i[Ri])) + r~

i=k+l

with rk = E~,eR~ p(~"[Rk]) and r~ = E ~ , e , ~ p(~'[R~]). Now, it is easy to show that

p( Rename R in ¢) n

= =

PC(~p(~,[Ri])) + ~ r l i=1

i=1

k

n

PC(~p(~i[R~]) + ~ i=1 rl

=

k

i=k+l rl

PC(~p(~i[R~])) + ~ i=l

n

p(~i[R,])) + ~ r ~ + ~ i=1

r, (by induction on k)

i=k+l

r~ (with k = n)

i=1

= p(Rename l ~ i n ¢ ) 3. ~ is a disjunction ~xV...V~n. Ifp(~) = 1, then R = R ~ = ¢ and it is finished, else we have pC = Az.z + c (because B(~, ¢) < 0), and we are in the conditions of lemma 5. Let S = { i E {1..n} : p(~i) > 1},and k , k ' E S s u c h that ~k ¢ R,~k, C R ' , and let Ri = / ~ f'l SF(Wi) - {WI}, R~ = R' N SF(~i) - {~i}. For i ¢ k, k', R/ and R~ are renamings of ~i top-down in ~i (lemma 4), hence p(Rename Ri in ~i) = p(Rename R$ in ~i) (induction hypothesis). From this we obtain

p( Rename R in ¢ ) - p( Rename R' in f ) =

p( Ren me

-

p( Ren me R'k in

)

-(p(Rename R~, in ¢ ' [ ~ ] ) - p(Rename Rk, in ~k,)) where ¢t = ¢[{~i : i ~ S - {k, k'}}]. However, it is very much the same to rename subformulas of ~ inside ¢~[~,] or inside ~ , because the benefits are the same ( ~ is the only non atomic disjunct in ¢ ' [ ~ , ] ) . We deduce that Rk (resp. R~) is top-down in ~ (resp. ~ , ) , and that

p( Rename R in ¢) - p( Rename R ~in ¢) = p( Rename R~ in ~ ) - p( Rename R~ in ~ ) -(p( Rename R~, in ~ , ) - p( Rename R~, in ~ , ) ) = 0 (from the induction hypothesis for ~k and qa~,)

567

We now suppose that B ( ~ , ¢ ) >_ 0, hence ~ 6 R O R ' , and R - { ~ } , R ' - { ~ } are renamings of ~ top-down in ~ (lemma 4). As B(~, ~) < 0, we proved in the previous ease that p(Rename R - {~} in ~) = p( Rename Rf - {~} in ~), in all possible cases for ~. But p(Rename R i n ¢) = p(¢[~]) + p(Rename R - {~) in ~), and the same holds for R', hence we also have p(Rename R in ¢) = p(Rename 1~ in ¢). Q.E.D.

3.3

optimality

It is clear from this theorem of invariance that in order to show that a particular top-down renaming Rinl(¢) is optimal, it is sufficient to show that there exists an optimal topdown renaming. To prove this, we are going to use a well-founded order on renamings, decreasing from any optimal renaming to a top-down one. Let us call the depth of E ¢ in ¢, and note d¢(!p), the cardinal of {~' E ¢ : ~ r- ~'}. We extend this definition to renamings R by: de(R) = ~ e R d¢(~), which gives a preorder defined by R -< R t c ~ d ¢ ( R ) _ 0 with ¢' = Supn(~) if defined, and ¢' = ¢ otherwise. Hence ~ ~ R. We also have I n f n ( ~ ) # O, otherwise R = R - SF(~), and B(~,¢'[R]) >_ O, in contradiction with R complete. Let ~' E I n f n ( ~ ) , and R' = R - {~,'} U {~}. Obviously, q¢' r- ~, ~' # ~,, thus R' -~ R, R ~ R', Let a,b such that pC'JR] = Az.ax+b, we have B ( ~ , ¢ ' [ R - S F ( ~ ) ] ) > O, hence a > 1. But P : I ~ ] = pC'[n], and B(~[R], ¢'[R]) < 0 (from R complete), hence p(~[R]) = 1, and p~[R] = Ax.z (as td E R, we should rather write p~[R] ~ But SkL~,~]"

p(Re.ame R in ¢) - p( =

p(¢'[R])

- p(¢'[R'])

.a +

e

in ¢) -

---- .iO¢'[R]l'D~alR](l"l'~~a ,.~ ~, , . , , - PC'JR](1) + p(~'[R]) - P2,[RI(p(~'[R])) because InfR(~') = I n f w ( ~ ' ) . These two facts show that p ( R e n a m e R i n ¢ ) p(Rename R ~in ¢), thus R ~ is optimal.

=

There remains to establish that R' is complete (we can not complete /~ as above, because we would obtain a complete renaming greater than R ~ in -~). Showing that

568

V~o" E S F ( ¢ ) - n', B(~", Rename n' in ¢) < 0 involves many different cases for ~d' (~" E ~ , ~" ff ~o, ~" E ¢~...), but we can see intuitively that ~0 and ~,~ play the same role as to the benefits, because p~0[nl _=. )~x.x, and exchanging them can not change these benefits, which were negatives. Q.E.D. From the existence of an optimal and complete renaming we then deduce the existence of an optimal and top-down renaming, hence that all top-down renamin#s are optimal.

3.4

a top-down

strategy

We now have to show that with a particular top-down strategy, the procedure Rin] computes a top-down renaming. Choosing the depth-first left-right strategy makes R/hi(C) = R(¢, ¢) with: R(~,¢)=

if B(~, ¢) > 0 t h e n r e t u r n ( { ~ } U R(~, ~)) else let ~1..~,~ be the direct subformulas of 9, and R = ~bin for i = 1 to n do R := RU R(~i,¢[R]); return(R)

The saturation condition is rather obvious, but we have to prove that R(¢, ¢) is free in ¢. In other words, we have to show that whatever the order of renamings, the benefits are positive. We first prove a lemma of independence concerning disjoint subformulas (within top-down saturation!): L e m m a 8 V~, ~,' t- ¢, if ~ and ~' are disjoint and V~", (q~ E ~o"A~ • ~") ~ B(~o", ¢) < O, then B ( ~ , ¢ ) > 0AB(~',¢[~]) > 0=~B(~v, ¢[~o']) > 0 P r o o f : we write 9 U ~o' for the smaller supformula of 9 and 9' (lub of 9, ~o' in the order

E). If 9 U 9' is a conjunction, we have B(~o, ¢[~o']) = B(9, ¢) > O, otherwise ~o U ~o~ is a disjunction ¢ , l V . . . V ~ , , with ~ E ~ j , ~ ' F" ~i' (J # J')- We have B(9 U 9 ' , ¢ ) < 0 (hypothesis) and p(~ U ~') > I, hence PCu~, = Ax.x + c. Let a, b, a', b' such that p f i = $ z . a z + b and P:," = .~x.a'x+ b', let d = YIi#j,j, p(¢,i), we have pC[~'l = .~z.d(a' + b')(az + b) + c. We now suppose that B(~, ¢[~']) < O, hence d(a'+b')a = 1, i.e. d = a = a ' = l a n d b ' = O. Thus P:,[~] = ) t z . ( b + l ) z + c , but B(~o, ¢[@) > O, hence b > O, and ~ # ~oj (otherwise p~s = Az.x). We conclude that B(~oj, ¢ ) < O. However, P~j = A~:.p(~')z+c and p(~,j) = p(~)+b > 1, thus B(~j, ¢) > O, which is in contradiction with the hypothesis, hence we conclude that B(~, ¢[~']) > O. Q.E.D. The next lemma establishes an analogous result of independence for the complementary case, i.e. for non disjoint subformulas. L e m m a 9 V~o' E 9 r-- ¢ , B ( 9 , ¢ ) > OAB(9',Def¢(9)) > 0:=~B(919'], ¢[~o']) > 0

569

P r o o f : Let a, b, a', b' such that pC = )~z.ax + b and pC = )~a:.a'z + b~, we have a > 1 and a' > 1. Thus p(~o[~']) = a' + b' > 1, and P¢[*'] ~[*'l = pC, hence B(~o[~o'],¢[~']) >_ 0. Q.E.D. From these two lemmas we can prove our final theorem: T h e o r e m 10 r e , R(¢, ¢) is top-down in ¢ P r o o f : We consider the order in which the subformulas in R(¢, ¢) are computed. Let (~Ol..~,) = R(¢, ¢). It is easy to show that the saturation condition holds: V~o E ¢, let i such that (qoi [Z ~ or ~i = ~) and ~i+1 I- ~ and ~/+1 ¢ ~ (with i = 0 if ~1 [-- ~0 and ~1 ¢ ~o), we have B(~o, ¢'[~1..~i]) < 0, with ¢' = SupR(¢,¢)(~) if defined, and ¢' = ¢ otherwise. Hence B(~, ¢'[R(¢, ¢) - SF(~)]) < 0 from tim. We now have to establish that R ( ¢ , ¢ ) is free in ¢.

Let i e {1..n}, we have

B(~i, Rename {~ol..~i_1} in ¢) > 0 by definition of R(¢, ¢). Let p such that ~i+l--~p l-~i and ~op+l..~on ~ ~oi, we have B(~oj, Def¢(~i)[~i+l..~j-1]) > 0 for j = i + 1..p, hence from lemma 9 we obtain B(~i, Rename {~l..~Oi-l~i+l..qop} in¢) > O. We also have B(~j, Rename {~l..~oj-1} in ¢) > 0 for j = p + 1..n, hence from lemma 8 we finally obtain B(~i, Rename {~x..~i-1, ~i+1--~'n} in ¢) > 0. Q.E.D. It should be clear that this theorem actually holds for R / , f ( ¢ ) with any top-down strategy (the proof is simpler with R(¢, ¢)), hence the notion of top-down renaming corresponds exactly to the renamings obtained from the procedure Riny with a topdown strategy. The correspondence only holds for linear formulas; the counterexample of optimality in the general case, presented above, exhibits a non free (hence non topdown) renaming computed by means of a top-down strategy. For a renaming, being free seems to be the key property to optimality - - is there any non optimal renaming of ¢ free in ¢ ? In the general case, although R(¢, ¢) is not optimal on non linear formulas, we shall not linearize ¢ before renaming, for linearization is exponential in size. However, it might be interesting to linearize some equivalences (in a way which avoids the exponential worst case complexity) before renaming. For example let ¢ = P ¢~ (Ain___xAivAinl Bi), we have R(¢, ¢) = {Ai=l " Ai} (if n >_ 3), and the resulting number of clauses is 2n + 3. If the formula is linearized first, only the positive occurrence of Ain=l Ai is renamed, and the number of clauses is 2n + 2. A systematic study of the best way to rename and linearize would however certainly be much more difficult than just studying the best way to rename on non linear f o r m u l a s - - the number of possibilities is not just exponential. It is already improbable to be able to compute the best renaming in polynomial time.

4

Some

experimental

results

The top-down renaming is not difficult to program. The algorithm works in two passes on the formula considered as a tree. The first pass computes the values p(~),~(~) for each subformula ~o C ¢, and stores them. The second pass uses these values to compute the

570

coefficients of P~, hence the values B(~, ¢), and performs the renamings (while updating the values p(~),p(~)). The complexity is bounded by O(1¢1 logmax(p(¢), V(¢))) = O(t¢IISF(¢)I). Xt is also possible to design a linear algorithm restricted to the linear case, using lemma 5 (still in two passes, to decide which subformulas ~o are such that p(~o) = 1, but without arithmetic computations). From a practical point of view, the program is based on arithmetic computations and pointer manipulations, and is very efficient. It is implemented in Common-Lisp on a SUN3 workstation, and is part of our interactive formula transformer (see [2]). The first example from [6] is the following: ¢

=

# u,',Vz(z = ^

[3zw3wvy((r(

4 . 3wVy3zW((F(x,y)4*

= y)) ,

4.

= w) 4 , • = z) = z)4*y =

and is designed to test clause form translators (the difficulty of this problem is assigned 7 points in a scale of 10). It is estimated that a correct number of clauses is about 146. However, using only the polarity-dependent linearization from [5] (presented in subsection 2.1), we have 34 clauses and a length of 1105. On this example, the structure preserving translation increases the number of clauses to 41, but the length becomes 466. Our top-down renaming is very restricted: it contains only one subformula, namely the first operand of the topmost 4* sign. The number of clauses is then 18, with length 327, which is to be compared with the expected 146 clauses. The second example is the famous challenge due to P. Andrews, and which is worked out in [5]. The formula is: ¢

=

--[3zVy(P(z) 4*P(y))4*(3zQ(z)4*VyP(y))

4* 9xVy(q(x) 4. Q(y) ) 4* (9xP(x) 4* VyQ(y) )] which yields thousands of clauses with the polarity-independent linearization (2704 clauses, length 79045). The polarity-dependent linearization also results in a quite big clause form: 128 clauses and length 3716. The structure preserving translation reduces the number of clauses to 43 and the length to 337. This was approximately the transformation used in [5], together with simplifications performed by the TAMPR system, but not described in the paper, which reduced the number of clauses to 26 (length not specified). The top-down renaming contains only three subformulas:

the subformulas

qzzVy(P(z) 4. P(y)) and qxVy(Q(:c) 4* Q(y)), and the first operand of the top-most 4. sign. The resulting number of clauses is 24, with length 274. As for the rest of the examples, this result is obtained without any simplification, hence very efficiently. We can notice that although optimality is not guaranteed on these two examples, our results are better than those obtained with other methods, hence probably very close to the optimal number of clauses. We also tried to find a proof of this last theorem with our resolution theorem prover (see [2]) using the three available translations. No proof was found after 1000 seconds with the standard clause form. The structure preserving clause form was refuted in 587 seconds, and the one obtained with the top-down renaming was refuted in 28.5 seconds.

571

5

C o n c l u s i o n and f u t u r e w o r k

The choice we have made to focus on a tractable syntactic criterion, the number of clauses, has resulted in a very efficient translation into a concise clause form, with strong properties. Our more interesting results are certainly those concerning optimality: the restricted optimality, relative to the standard and the structure preserving translations, and the optimality of top-down renamings on linear formulas. These two positive results come with two negative ones: the non-optimality of top-down renamings in the general case, and a worst case complexity which is the complexity of the structure preserving translation multiplied by a factor n, i.e. the number of subformulas of the initial formula. However, experiments with difficult examples show that these two negative facts have little importance in comparison with the positive ones. The next step is obviously to evaluate the gains of renamings with respect to proofs and search strategies. In particular, resolving first upon the new literals should be avoided. In [5] and [7], lock resolution is adopted, and examples show that this strategy can improve the efficiency of the search. There are many other ordering strategies that can be tried, but more interesting is to build new strategies, adapted to this technique. In particular, the links between resolution refutations on renamed formulas and non-clausal refutations, mentioned in [5] and [7], seem especially interesting to investigate ; the proof obtained with the structure preserving clause form is isomorphic to a proof obtained with a tableaux theorem prover, but the search space is greater (some inferences lead to tautologies). It is therefore interesting to restrict resolution in function of the renaming. The problem is then to see in which respect top-down renamings are adapted to resolution refutations, or which top-down renaming is the best: this has the advantage of preserving the property of optimality. There may be better ways to rename a formula, but we can be sure that a relative conciseness of the clause form is determinant. One possibility is to minimize the number of literals ; this is more complicated than just minimizing the number of clauses, but also very efficient. From a more general point of vue, it is known that one important problem in automated deduction is the handling of definitions. Quoting [8] (problem 30): What criteria should be used to cause a reasoning program to expand or contract definitions? [...] A solution to [this problem] would mark one of the more significant advances in the field of automated reasoning. and considering that renaming consists in creating definitions shows that it is important not to restrict the technique of renaming to clause form translation; it can be used with other theorem proving methods than the resolution calculus. The ability to creale relevant definitions, as well as expanding and contracting them, is one of the major difference existing between actual theorem provers and mathematicians. A c k n o w l e d g e m e n t s : I thank Ricardo Caferra, Gilles Chaminade and Nicolas Zabel for their helpful comments and careful reading of this paper.

572

References [1] Thierry Boy de la Tour. A Locally Optimal Transformation Into Clause Form using Partial Formula Renaming. RR 765-I-IMAG - 90 LIFIA, institut IMAG, BP 68, 38402 Saint Martin d'H~res cedex, January 1989. [2] Thierry Boy de la Tour, Ricardo Caferra, and Gilles Chaminade. Some tools for an inference laboratory (atinf). In E. Lusk and R. Overbeek, editors, Proccedings of the 9lh International Conference on Automated Deduction, pages 744-745, Springer Lecture Notes in Computer Science 310, 1988. [3] Thierry Boy de la Tour and Gilles Chaminade. Renommage et forme clausale. In Acres des 3e Journdes nationales PRC-GDR Intelligence artificielle, pages 183-192, 6ditions Hermes, March 1990. [4] Elmar Eder. An implementation of a theorem prover based on the connection method. In W. Bibei and B. Petkoff, editors, AIMSA '84, Artificial Intelligence--Methodology Systems Applicafion, pages 121-128, North-Holland, September 1984. [5] L. ttenshen, E. Lusk, R. Overbeek, B.T. Smith, R. Veroff, S. Winker, and L. Wos. Challenge problem 1. SIGART newsletter, (72):30-31, July 1980. [6] J.F. Pelletier. Seventy-five problems for testing automatic theorem provers. Journal of Automated Reasoning, 2:191-216, 1986. [7] David A. Plaisted and Steven Greenbaum. A structure-preserving clause form translation. Journal of Symbolic Compufation, 2:293-304, 1986. [8] Larry Wos. Automated Reasoning: 33 Basic Research Problems. Prentice-flail, 1988.

HIGHER

ORDER

E-UNIFICATION

Wayne Snyder Boston University Department of C o m p u t e r Science 111 C u m m i n g t o n St. Boston, MA 02215 [email protected] (215)-353-8925 In this extended abstract we report on an investigation of Higher-Order E-Unification, which consists of unifying typed lambda terms in the context of a first-order set of equations E. This problem subsumes both higher-order unification and general E-unification, and provides a theoretical background for reasoning systems which incorporate both algebraic and higherorder logic. The problem and its properties are discussed~ a set of transformations (inference rules) extending those of Ma~rtelli-Montanarl for standard unification is glven~ and then we prove the completeness of this non-deterministic algorithm. The completeness of restrictions of these rules for hlgher-order pre-E-unification and higher-order narrowing are corollaries of these results. Finally, we connect these results with previous work, and conclude with future directions and open problems. The major result is a set of inference rules for higher*order E-unification and a proof of its soundness and completeness (wrt complete sets of unifiers).

1 Introduction T h e m o d e r n period of a u t o m a t e d reasoning began with the rediscovery in 1963 by J. Robinson of the process of unification [39], which had been described in 1930 in Herbrand's thesis. T h e resolution m e t h o d (and Andrews's m e t h o d of matings [1]) were b o t h originally based on first-order logic without equality, and subsequent efforts to e x t e n d these deduction methods to more powerful languages, e.g., higher-order logic and first-order logic plus equational axioms, crucially depended on developing new forms of unification, e.g., higher-order unification [23, 24,42] and E-unificatlon [16,38,41] (the recent development of a fundamentally new form of E-unification, namely rigid Eunification [17,18], in extending the matings m e t h o d to first-order logic with equality is a case in point). In the same spirit, this paper initiates the study of Higher-Order E-Unlfication, which would form the basis for deduction systems which combine higher-order type systems and algebraic reasoning. It has been suggested [5] that such a combination arises naturally in the logic of functional programming languages. Term rewriting systems and the lambda calculus are both useful models of computation in such logics, the former for modeling first-order operations over abstract d a t a types, and the latter for modeling various notions of programming languages such as scope, higher-order

This research was partially supported by NSF Grant No. CCR-8910268.

574

functions, parameter passing, and (in the typed cases) various complex type systems, such as polymorphism and dependent types. In addition, first-order equations are used in algebraic specification languages and to prove inductive properties of data types. As argued in [5,6,9], investigating the combination of both formal systems is crucial to understanding the logic of programming, where higher-order functionality and firstorder data and functions interact in complex ways. Future 'meta-programming systems' [20,37] may combine the methods of term rewriting theory, algebraic specification, or proof by consistency with those of various typed lambda calculi to synthesize, transform, or proof correct computer programs. (To give just one example, it would be interesting to see if term rewriting techniques, such as algebraic simplification, thought of as 'code optimization' in [5], could be incorporated into the partial evaluator implemented in AProlog discussed in [21].) More generally, automated deduction systems may someday combine the computational advantages of term rewriting in algebraic contexts with higher-order expressivity. Current higher-order reasoning systems (see for example [2,31,33,35]) do not include explicit first-order equality; and on the other hand, implementations of rewrite rule laboratories [8,19], typically have no higher-order functionality. Clearly, a system with the advantages of both would worth exploring. Strictly speaking, higher-order systems gain no additional expressivity by adding explicit equality, since a first-order equation s - t can be represented by the axiom VP.P(s) D P(t) (see [36]). But manipulating such representations of essentially algebraic axioms may make little sense computationally when efficient implementations of the axioms as terminating and confluent rewrite rules exist [8]. Or, again, in the light of recent progress in E-unification [16,26,27,28,34,41], which has resulted in many sophisticated unification algorithms, it seems likely that a higher-order unification algorithm which calls a first-order AC-unification module, or one which also does basic narrowing, will be more efficient than a higher-order unification algorithm which simply operates with higher-order encodings of algebraic theories, where the algebraic flavor is lost. Thus it seems worthwhile to investigate the incorporation of explicit first-order equality into higher-order type systems; and the fundamental process to understand at the outset is the corresponding form of unification. Formally, a substitution 0 is a HigherOrder E- Unifier of two terms s and t iff O(s)~ * '#~E O(t) where < * , # ~ represents /~r/-convertability combined with E-equivalence. For example, if E = {f(m) - g ( m ) } , then [Am.f(m)/F] is a higher-order E-unifier of f ( f ( a ) ) and g(F(a))), since 0(F(S(=))) =

S(a)

I(S(a))

g(S(a))

a) =

Clearly, this subsumes both general E-unification and higher-order unification, and shares their general characteristics: it is undecidable and finite sets of most general unifiers may not exist in general. But in analyzing the problem further, it is not obvious how higher-order type systems and Mgebraic rewriting combine, 1 and what the general properties of ~ *#nE are; fortunately, is has been shown in [5,6] that this interaction is clean and without pathologies (see Theorem 2.7). Using these results, we can argue

1

For an interesting e x a m p l e of a potential problem, see [5].

575

that whenever 8 is a higher-order E-unifier of a and t, then there is a proof of this fact in the form 8'.- ' ,Bt', * s 0 ( t ) , and when the equational part of the problem is given by a canonical set of rewrite rules R, then we have * 8' --:-,R * R t ; * O(t). This allows us to separate out the higher-order and equational parts of the problem, so that we can apply separately the techniques higher-order unification and E-unification developed in [16,42,43] to analyse this new problem. In fact, combining these separate results is non-trivial, and several interesting problems needed to be solved. It should be noted that one might define a more general version of this problem where E is not just a first-order algebraic theory, but a set of equations between lambda terms. Unfortunately, in this setting it is not. clear that a higher-order version of Birkoff's completeness theorem for equational rewriting holds [40], and so--in spite of the fact that in this richer context many useful, non-pathological examples of equational reasoning exist--we can not adapt our standard notion of completeness from E-unification. The point of the current paper is to explore the combination of two well-understood unification problems in light of the results of [6]. The major results of this paper may now be stated. The primary contribution of this extended abstract is a definition of a new and potentially significant form of unification, a set of inference rules for the problem and a proof of its completeness; this is, as far as we know, the first rigorous analysis of this problem. In addition, we have attempted above to suggest some motivations for this work, and at the end we shall suggest some interesting open questions. Obviously much remains to be done, and in the full paper (in preparation) we look at the whole question of explicit equality in higher-order logic in more detail, as well as present a full version of the completeness proof. This work was first presented in preliminary form at the Unification Workshop in Lambrecht, Germany in the summer of 1989. The outline of this abstract is as follows. After a brief review of basic definitions and notations in the next section, in Section §3 we define the problem formally and also the notion of complete sets of higher.order E-unifiers; then we present a set of transformations for the problem which extend the Herbrand-Martelli-Montanari transformations for standard unification, and prove their soundness. The use of complete sets of transformations for analyzing unification algorithms was developed in the case of general E-unification in [16] and for higher-order unification in [42]. The major advantage of this approach (which is nothing else but giving a set of non-determlnistic inference rules for simplifying the problem into a trivial form from which a solution can immediately be extracted) in comparison with other approaches is that the purely logical properties of the problem (such as the invariance of solution sets under certain transformations) can be isolated from procedural information and data structures; also, the relationship of various unification problems with respect to the basic operations necessary for their solution is highlighted. In addition, the transformation method allows more direct and mathematically elegant proofs to be found; at the end of Section §3 we sketch our completeness proof, which for lack of space must be condensed from the version in the full

576

paper in preparation. Finally, in the finM section we conclude with some connections with our previous work and discuss some future directions and open problems.

2 Preliminaries In an attempt to be (relatively) self-contained, we now present the basic notions of term rewriting and the lambda calculus we shall need; for a more extensive treatment, see [3,8,22,24] and especially [16,42,43]. D e f i n i t i o n 2.1 Given base types To (e.g., int) the set of simple types 7" is the smallest set containing To such that (a --* fl) E 7" if a,fl E 7". (We write a l , ... ,a,~ --* fl for ax ---* ( a 2 . . . (aT, ~ f i ) . . . ) . ) Given a set E = U~Er E~ of function constants and a set V = U~ET V~ of variables (where each V~ is countably infinite), the set of atoms is , 4 = E U V , and the set o f l a m b d a terms is Z: = UBET/Z~,where {Z;~lfl E T} is the 7"-sorted collection of the smallest sets such that, for each fl, 3' E T : (i) r. e u v e c G ; (ii) el E 12~-..-~ and e2 E/2~ implies (ele=) E £-~ ; and (iii) e E £'r and a~ E V~ implies (),a~.e) E £3--*~" The type of a term e is r(e) = fl iff e E/2~. (We shall, in the interest of clarity, omit type information whenever possible, since it is inferrable from context in the cases we consider.) We follow the normal conventions ofleft-associativity of application, dropping of parentheses, etc. and assume the familar definition of free and bound vaadables; the set of free variables of a term e is denoted by FV(e) and the set of bound variables by

BY(e). The subset of algebraic terms af-. is the smallest set containing U~eTo(E~ U V~) and such that if f E E~, ..... ~ __.~, where {ill, ... ,fl,~,fl} C To, and el E a / i N £ ~ , , for 1 < i < n , then (fel...e,~) E a £ . D e f i n i t i o n 2.2 A substitution is any type-preserving (total) function ~r : V --* £ such that ~(=) # = for only finitely many • e Y (called the support, D(~)) and is

denoted by

[h/*l,

...

when the support is

.

.

.

The

restrictio

of a

substitution ~r to some W', denoted ~rlw,, is the substitution ~r' such that a ' ( z ) = cr(z) when a~ E W' and a'(x) = ~ otherwise. We denote the application of a substitution to a term e, i.e., the effect of replacing each occurrence of z E FY(e) by ~r(x), as ~(e) or

eo".

We now present the basic notions of algebraic rewriting and of lambda conversion. D e f i n i t i o n 2.3 We have the following lambda conversion rules: (a-reduction) e ~ e' iff e' is obtained from e by replacing a subterm of the form ,ks. s by ,~y. (a[y/~]), where y fd BY(s) U FY(s); (fl-reduction) e ~ e' if[ e' is obtained from e by replacing a subterm (,~a~.s)t by s[t/a~]; (y-reduction) e ,~ e' iff e' is obtained from e by replacing a subterm (,kx. s)z by s, where • ¢f F Y ( s ) . (As is common, we factor out a-conversion and assume the correctness of fl-reduction by the usual conventions, see [22,42].) Let a rewriting system be a binary relation R C a / : x a / : such that r(1) = r ( r ) for every (l,r) E R . Given any s,t E £., s rewrites to t, denoted by s ~R t , iff

577

t is produced from s by replacing some subterrn s' = le" with re', where e" is some substitution and ( l , r ) E R. We denote ~t3 O ~/~ by ~#R and similarly for other combinations; we denote the reflexive and transitive closure, the symmetric closure, and the reflexive, symmetric, and transitive closure of -'~x for any X E {fl,~hR,13E,...} by * ~×, *"'-*x, ~----'*x, * respectively. W h e n we focus on the non-symmetric relations ---~R and * ~R we call a pair ( l , r ) a rewrite rule and denote it I ~ r . On the other hand, when we emphasize ~R and ~* ~R , i.e., the unoriented use of pairs, w e d e n o t e (s,t) by a - t andcall it an equation; we shall use E (rather than R) to denote a set of equations. D e f i n i t i o n 2.4 If there exists no term t t such that t ~R ~', then t is in R-normal form, and fl-, 7/-, and fly-normal forms are defined similarly. If there exists no term t t such that t ~ v t', then t is in long r1 form, and a term in fl-normal and long r / f o r m is in long fl-normal form. If there exist no infinite sequences to ~ t2 * ... then ~ is noetherian and if there exists some e such that a-----*e~ t whenever s~ * ,t, then ~ is Church-Rosser. A rewrite system R is said to have these properties whenever ~R does. It is well-known [22] that 13- and r/-conversion are noetherian and Church-Rosser, and so unique normal forms exist (and analogously when R has these properties); these normal forms are denoted by, e.g., fl-nf(s), flR-nf(s), and l/3-nf(s) (the last for the long fl-nf). As discussed in [42], it is useful to develop unification in the presence of both fland y-conversion, and so we factor out y-conversion by keeping terms in long rI form, and only explicitly use fl-conversion (this is very natural computationally). A term in long fl-nf may be represented as Axl ... ~ n ( a e l . . . era), where the head a is an atom (and each ei is in long/3-nf). By analogy with first-order notation, such a term will be denoted A~:I . . . ~,~. a(el, . . . , e,,~), and furthermore we represent lists by vectors to obtain the notation A~-~=.a(~'m). A t e r m whose head is a function constant or a bound variable is called a rigid term; if the head is a free variable it is a flezible term. D e f i n i t i o n 2.5 The composition of e" and 0 is the substitution denoted by e'o0 such that for every variable x we have e" o 0(~) = 0(a(x)). (Note that we denote composition from left to right.) Given a set W of variables, we say that two substitutions e" and 0 are x-equal over W , for some X e {~,rh E,13E, . . .} , denoted e" = x O[W] , iff Vz E W , e'(z) ~L-~ x 0(z) (when X is absent, this is just equality). We say that e" is x-more general than 0 over W , denoted by e" < x 0[W], iff there exists a substitution 7/ such that 0 = x e" o r/[W]. W h e n W = V we drop [W]. D e f i n i t i o n 2.6 A substitution 0 is said to be normalized if 0(z) is in long/3-nf for every variable ~ E D(O), and is idempotent if 0 o 0 =Or 0. A substitution e" is idempotent whenever I ( a ) f3 D(e') = 0, and any substitution is equivalent (over an arbitrarily chosen set of variables) up to renaming to an idempotent substitution. In addition, any substitution is fly-equal to a normalized substitution; thus in this p a p e r for simplicity we assume substitutions are normalized whenever possible. Finally, we summarize the i m p o r t a n t new results from [5,6] on the interaction between higher-order types and first-order rewriting which are necessary for this paper.

578

T h e o r e m 2.7 Let s, t E / : , R be a set of rewrite rules, and E a set of equations. (1) If 8, * , ~ t , then flnf(s), Y ~Eflnf(t) and lflnf(s), * ~Elflnf(t); (2)

*

t iff

* ,E

(3) If s is in fl-nf and s }R t , then t is in fl-nf; (4) If R is Church-Rosser (noetherian) on a/:, then it is Church-Rosser (noetherian) on all terms in L in/3-nf; As a corollary we have that whenever it/is canonical on a t , then for any two terms 8 and t, s, * '#nn t i f f there exists a term w such that lflnf(s) *=~.nw ~---R lflnf(t). Also, it can be shown [24] that if t is in long r/form and t }# t ~, then t ~ is in long 77 form, and for any normalized 0, O(t) is in long r/form.

3 Higher-Order E-Unification Motivated by the possibility of combining algebraic rewriting and higher-order types, we may extend the standard notions of unification theory [43,44] to this new context.

Definition 3.1 A multiaet is an unordered collection with possible duplicates (note that multiset union is different from set union, since A t3 AA ~ A unless A = 0 ). A term pair is a multiaet of two lambda terms, denoted, e.g., by (s,t). For any set of equations E, a substitution 8 is a higher-order E-unifier of 8 and t (or HO E-unifier in brief) iff e(s),

*

0(t).

A term aystern is a multiset of term pairs, and a substitution is a higher-order E-unifier of a system iff it unifies each pair as above. The set of HO E-unifiers of a system S is denoted UE(S), and when S = {(s,t)}, it is denoted UE(s,t). By the results at the end of the previous section, this definition can be put in the form: whenever 8 is a hlgher-order unifier of two terms a and t in/fl-nf, then there exists a normalized 8 t =#n 8 and a "proof"

This formulation isolates the various components of the problem. Clearly, when E = 0, this is just higher-order unification; when all terms are first-order, it is E-unification; and when both, just standard unification. Since it subsumes two undecidable forms of unification, it is not surprizing that HO E-unification is undecidable in general. Also, mgu's may not exist, motivating the following definition (see also [14,16,42]).

Definition 3.2 Let E be a finite set of equations, S a term system, and W a set of 'protected' variables. A set U of normalized substitutions is a complete aet of higherorder E-unifier~ .for S away from W (a CSV~(S)[W l for short) iff (i) (Purity) For all ~ E U, D(tr) C F V ( S ) and I(~) N (W U D(~)) = 0; (ii) (Soundness) U C_ UE(S);

579 (iii) (Completeness) For every normalized 0 6 UE(S), there exists some a • U such that ~r lp(f(h(z)), f(~)), (,~z. g(~),,~z, g(h(z))} ==>d (h(z), ~), (~z. g(~), ,Xz.g(h(z))) ===>,,e (h(z), ~), (~z. g(h(z)), ,~z. g(h(z))). Here we pulled the term h(z), out of the scope of ,~z and then, using variable elimination, inserted it back in, which is awkward; in fact, it is not obvious that such manipulations are correct: how do we know that such freed bound variables will not be confused with originally free variables, and that at the end they all have returned to the correct scope? There are various solutions, none completely satisfactory; The solution adopted in the full paper is to rectify all terms in the beginning and to 'freeze' variables when they leave their scope, so that they will not be confused with normal variables; then we define failure conditions which flag illegal uses and show that these are sufficient to guarantee correctness. For reasons of space, we shall not treat this m a t t e r further in this abstract, referring the interested reader to the full paper to appear. In general, there are many other failure conditions one can define, and also many forms of optimizations which preserve completeness. For example, one optimization

583

is that we never apply Lazy Paramodulation to a solved pair; another is that (since wlg we may restrict our search to idempotent unifiers) whenever an imitation binding t = A~'-~.g(Az-~. H,,~(~-~,z-~)) for some variable K is added to the system in either Imitation or Flex-Flex, we mark this variable somehow and never try to find a binding for this variable thereafter. Another important optimization of this set of rules for the equational first-order case has been given by Dougherty and Johann [10] (this conference). The extension of this to the present context seems natural. The following lemmas will enable us to prove the soundness of this set of transformations. L e m m a 3.8 If S ~

S' using Trivial or Variable Elimination, then

UE(S) = UE(S').

Proof. (See the proof of Lemma 4.12 in [42].) [] This lemma shows that the invariant properties of a problem are preserved under these two transformations, as they were in the first-order case. L e m m a 8.9 If S ==~ S' using either Decomposition, Imitation, Projection, Flex-Flex, or Lazy Paramodulation, then UE(S') C UE(S).

Proof. (See Section 4.2 of [42] and Theorem 6.2 in [16].) [] Since in Imitation, Projection, and Flex-Flex, we commit ourselves to a particular approximation of a solution, and in Decomposition we may eliminate unifiers (e.g. F(a) and F(b) are unifiable but not necessarily a and b), clearly the inclusion UE(S') C__UE(S) is proper in general. This is very different from standard unification, where the set of solutions is invariant under rules Trivial, Decomposition, and Variable Elimination. Finally, using these lemmas we can show that the set of transformations ~ET is sound in the sense that an answer substitution that is computed by some sequence of transformations must always be a HO E-unifier of the original system. T h e o r e m 3.10

(Soundness) If S = ~ S t, with S r in solved form, then the substitution

~s, IFv(s) • UE(S).

Proof. We simply apply induction on the length of the transformation sequence to show that UE(~s,) C UE(S). Then we simply observe that the restriction to FV(S) has no effect on the terms in S, concluding that crS,IFV(S) 6 UE(S). [] We now sketch the completeness of the set of transformations 7-/ET presented above by showing that for any H 0 E-unifier O of an input system S, the transformations can compute a unifier ~ more general than O, i.e., such that ~ -xx List(Token)) (List(Token) ~ y x List(Token)) =~ (List(Token) ~ (x x y) × List(Token)) This is the type given in [12, Sec. 6.6], but the most general type of (&} is

(Zl =~Z x z 2 ) z ~ ( z 2 ~ yxz3)::~(zt ~ ( z × y)x z3)

(I have simplified the (&) of [12] a little by ignoring how to handle a failure to parse, but this does not change the main idea.) •

606 1.3

Combining

the Methods

T h e problem we solve in this paper is how to recognize a t y p e A which is more general, m o d u l o isomorphism, t h a n a query B. A n o t h e r way to express this is t h a t A m a t c h e s B m o d u l o isomorphism. T h e usual definition of such a relation is t h a t A m u s t be more general than a type B ' , which is isomorphic to B. P r o b l e m s of this kind are studied in u n i f i c a t i o n / m a t c h i n g theory. Unifiability m o d u l o isomorphism m a y also have applications for library search, b u t it might be undecidable; see Section 6. 2

Unification/Matching

in Equational

Theories

Some basic notions of terms and substitutions are assumed known, see e.g. [17, 2, 20]. T h e set of terms over a set F of function symbols with arity and an infinite set V of variable symbols (or simply variables) is denoted T(F, V). T h e set of variables occurring in a t e r m t is written V(t); t is ground if V(t) = 0. T h e top symbol of a t e r m t is denoted 7-l(t). Substitutions on terms are e n d o m o r p h i s m s t h a t only change a finite set of variables. We denote the domain of a substitution a by T)(a) and its set of introduced variables by Z(~r). Composition of substitutions is such t h a t ((r o r)(t) = a ( r ( t ) ) . T h e union o f two substitutions al and a2 with disjoint domains is written al U tr2. T h e n o t a t i o n tr[x denotes the restriction of a to a set X of variables. A rewrite rule is a pair of terms (l, r), usually written l ~ r . A rewriting system is a set of rewrite rules. If R is a rewriting system, we write t ----~n s iff there is a rewrite rule l ---~r in R and a substitution o', such that there is a s u b t e r m o f t t h a t equals c~(l), and s is the result of replacing t h a t s u b t e r m of t by c~(r). A n identity, or equational axiom, is a pair of terms (s,t), usually written s = t. If E is a set of equational axioms, we define the relation = E to be the finest congruence relation on terms such t h a t a(s) = E ~r(t) holds whenever s = t is an axiom o f E and tr is a substitution. A n equational theory is a set of identities E such t h a t s = E t if, and only if, s = t is an element of E. If E is an arbitrary set of identities, the equational theory presented by E is the smallest one that includes E. We often blur the distinction between a set of axioms and the equational theory they present. We extend the relation = E to substitutions, by letting a = E r i f f ~(z) = E r ( x ) for all x E V. If X is a set of variables, we write ~ = E r [X] if a[x =E r[X. We define the preorder _<E on terms by letting p _<E s if there is a substitution (r such t h a t 0, where the qi's are variables or constants different from 1, and the ti's are arbitrary terms. I will call terms of this form regular forms. (The case where n = 0 is seen as the constant 1. A single variable or constant q is L-equal to the term l ~ q , which is regular.) 2Lang calls it .4, b u t this c a n b e m i s t a k e n for a single associativity axiom.

608 Lang calls the sequence q l " " q , , a base of t, and calls t l . - . t n an exponeni. This is in analogy with the arithmetic interpretation of the function symbols, where t =~ q is interpreted as qt. One can see the base as a t e r m ql * "'" * q,~ in a "smaller" equational theory AU: x.(y*z)=(x,y).z, A*x=z, z*A=x where '*' is a new binary function symbol, and 'A' is a new constant. T e r m s in this smaller theory will be called base ~erms. We can use the notation t B b as an abbreviation of "t has a base b" .3 Lang's key observation is that given a substitution a on terms, one can define a base w of c~ as a substitution on base terms with the property that or(z) B w ( z ) for every variable x, and t h a t this gives that if a(p)

:L

S, and p B bp, and s B b,, and w is a base of cr, then w(bp) =AU bs

that is, if p L-matches s by a, then a base of p AU-matches a base of s by any base of e. This observation gives a divide-and-conquer algorithm to find all L-matchers of a pattern p to a subject s, when the subject is ground. First, all possible bases of an L-matcher are the AU-matchers of (bp, bs), where bp and b~ are chosen to be bases of p and s, respectively. These can be found by known algorithms for AU-matching. Second, for each possible base of an L-matcher, one can find a most L-general substitution ~0 which has this base. If the base is w = {xl ~ qll * " " * ql,~,, . . . , Xm ~ qml * "'" * qmn,~.} then the substitution a0 = {xl ~-* ( Y l l ~ qll) x . . . x (Yln,:=~ q l n , ) , . . . , zm ~ ( Y m l ~ q m l ) x . . . x (Y,~n,~=:~qmn,~)} where the Ylj's are distinct variables not occurring in w, is more L-general than any other substitution whose base is w. Third, a0 is applied to p. The L-matching system {{pl, s l ) , . . . , {p,, s , ) } remains to be solved, where P l , . . . , ion is the exponent of a0(p), and s l , . . . , sn is the exponent of s. This system is solved by successive instantiation in the usual way, using the L-matching procedure recursively for subproblems. All L-matchers of p to s can be found this way. 3.2

D i f f e r e n c e s in o u r S e t t i n g a n d O v e r v i e w o f A l g o r i t h m

There are two m a j o r differences in our application. The first is that we have commuta~ tivity of ×, the second is t h a t free function symbols of any arity can appear (like List). The latter means t h a t in the regular forms, the qi's need not be variables or constants, but can also be terms like f i ( . . . ) , where fi is a free function symbol. Earlier each base component qi had a single t e r m attached (its exponent ti), now it m a y have several (the parameters of fi); this is not a difficulty. We can re-define the base of a t e r m as a bag 3 L a n g works o n equivalence classes of t e r m s , a n d h e w o u l d i n s t e a d write B(e) = u, w h e r e e is t h e equivalence class of t u n d e r L, a n d u is t h e equivalence class of b u n d e r A U . Since I prefer to w o r k directly w i t h t e r m s , I m a k e B a relation, r a t h e r t h a n a function.

609

containing all the top symbols 7-l(qi). We regard the base as a term zx ~ ... ~ Zm ~ .t'1 • . - ~ fk, in a "smaller" equational theory ACU:

xuy=y

x,

0

,=x

where 'W' is a new binary function symbol, and '0' is a new constant. The base matchers can be found as before, but by using ACU-matching [4, 19] rather than AU-matching. However, the commutativity means that for a given base matcher, there may be alternative ways to obtain a set of smaller matching problems. Consider the example ((pl:=~f)x(p2:=~f), (sl::~f)x(s2=~f)) where f is a constant. Both terms have the base f N f , so the most general base matcher is the identity. A full matcher can be found by finding a marcher either for tile system {(Pl, Sl), (p2, s2)} or for the system {(Pl, s~}, (p2, Sl}}, so we must solve the disjunction system consisting of these two systems. So when we have found a base matcher, the remaining work is to solve a disjunction system, rather than an ordinary system, which means that F-matching is slower than L-matching. In fact, F-matching is NP-complete [9], but practical experience shows that it is feasible for library search, see Section 5. E x a m p l e 4. We want to match the pattern p = (Bool =~ z) to the subject s = (IntxBool::~ List(Char)). We get that p B x and s B List. A complete set of ACU-matchers o f x to List is the singleton set containing w = {x ,-* List}. A most F-general substitution with w as base is v" = {x ~-* (Yl ==~ List(y2))}, where yl and Y2 are new variables. It remains to match the exponent of or(p) to the exponent of s. W'e have that ~(p) = (Bool ==~@1 ==~ List(y2))) = r (Bool x Yl =~ List(y~)), so we get a disjunction matching system {{(Boolxyl, IntxBool}, (Y2, Char)}}, which only contains a single matching system, consisting of two pairs. A complete set of F-matchers for the disjunction system is the singleton set only containing M = {Yl ~+ Int,y2 ~ Char}; we omit the details of how or' is found. The composition a' ocr = {x ,-* (Int =~ List(Char)), yl ~ Int,y2 ~ Char} is a F-marcher of p to s, but its domain includes variables that do not occur in p. The singleton set containing ( a ' o or)Iv(p) = {z ~-~ (Int :=~ List(Char))} is a complete set of F-matchers of p to s (away from any set of variables). • In summary, then, there are four important parts of the F-matching algorithm. 1. The definition and properties of bases of terms and substitutions. 2. How to find base matchers by ACU-matching. (This will not be described in this paper, though, since the methods of [4] or [19] suffice.) 3. How to find a most F-general substitution with a given base. We will define a function 'Mg' that does this. This function needs a supply Y of fresh variables, so we will provide it as an extra argument. 4. When a base matcher w has been found, and or0 = Mg(w, Y) has been computed, the remainder of the matching problem can be broken down to a disjunction matching system. We will define a function 'D' that takes care of this. 4

An

Algorithm

for F-matching

In this section we present a matching algorithm for the theory F; most proofs are omitted but can be found in [14]. We want to match in the presence of free function symbols of

610

any arity, since our equational theory does not interpret type operators like Int, Char, or List. So, let F be a set of free function symbols, and let a be a function F --+ IN, that gives the arity of a function symbol. Three function symbols are not in F, they are 1, x, and ==~; we let G = F U {1,×,=ez} and extend the arity function a to G so t h a t a ( 1 ) = 0, a(x) = 2, and a(:=~) = 2. In terms, x and =~ are written infix. To denote the set of function symbols given with their arity, we write Go. We let V be a countably infinite set of variables. The set of terms over G~ and V would usually be denoted T ( G ~ , V), but we will use T~ as an abbreviation. The axioms of F were given in Section 1.1. 4.1

Regular Forms

We need to show that terms have regular forms as sketched in the previous chapter. We want to show both t h a t every term has a regular form, and that regular forms are unique up to rearrangements of factors. These statements are given as Theorems 3 and 5 below. To deal with them, we use the techniques of Peterson and Stickel [10], who provide means to rewrite modulo an associative-commutative theory. We single out the associative and commutative axioms of F into a subtheory AC, and direct the other axioms into a rewriting system R.

AC

x×y (x×y) xz

= =

yxx x×(yxz)

R

l×x l==>x xWl

~ x ---4> x ~ 1

We let --~a,AC = (=AC o---~Ro =AC) (cf. [10, p. 244]). We say that a term t is irreducible, if there is no t e r m s such that t ----~r~,ACs. To show t h a t ---~R,AC is well-founded, i.e. that there are no infinite sequences to --4>R,AC tl ----~R,AC t2 ---i>R,AC '" ", we use the following measure of term size. [xj [g(tx,,.,,t~(g))j

=

4,

if×

=

4+[tlJ+...+[t~(g)j,

ifgEFU{1,x}

Ls tJ

=

[sJ

E V

• [tJ

Note that if t =AC s, then [tj = [sJ, and t h a t if t---~rt.hCS, then [tj > [sJ. Since the size of a term is at least 4, a sequence to ---I>R,ACtt ----t>R,ACt2 ---4>R,AC •. • cannot be infinite. It follows, of course, that every term is F-equM to an irreducible term. An irreducible term is a (possibly empty) product of factors, each of which has either the form s ::~ q or just q, where q denotes a t e r m such that 7"/(q) E V U F. It would be more convenient if there were only one kind of factor; we could achieve this by replacing each factor q by 1 ::¢, q. Therefore, we will define regular forms, which have only one kind of factor. T h e notion of regular form will differ from the notion of irreducible t e r m also in that regular forms need be regular only at the top level; the subterms of a regular form need not be regular. C o n v e n t i o n 1 When we talk about a product tl x . . . x t n , that the case when n = 0 is seen as the term 1.

with n >_ O, it is understood

611

D e f i n i t i o n 2 A regular f o r m is a term of the form. (sa ~ ql) × " " × (sn :=~qn), for some n >_ O, where each top symbol 7"[(qi) is either a variable or a free f u n c t i o n symbol. I f t = r r, where r is a regular form, we say that t has a regular f o r m r. T h e o r e m 3 Every term t E 7-c~ has a regular form. P r o o f . Let t I be an irreducible term F-equal to t. This term will almost be regular, but we may need to insert some l's. By a structural induction over tt, we show that it has a regular form, which must then be a regular form of t. (See [14].) • To show that regular forms are unique up to some reordering of factors, we need to know that the irreducible form of a term is unique up to AC-equality. L e m m a 4 I f t = r s, and t (-~R,A¢)* tl, and ducible, then t+ =AC s+.

s

(--4>R,AC)*St,

where t I and s I are irre-

In Peterson's and Stickel's terminology [10], the lemma states that R is AC-complete. It can be proved from [10, Theorems 9.3 and 10.5]. Given a regular form as in definition 2, we can get another regular form by rearranging the top level factors (si :=~qi), and by replacing subterms si and qi by F-equal ones. We can use Lemma 4 to prove that these are all the possibilities for F-equal regular forms to be syntactically different. Theorem 5 Left=

( t l,o =~ pl ) × . . . × ( tm,o ~ pm ) a n d s = ( SLo :~ qt ) x . . . x ( sn,o =~ qn ) be two F-equal regular forms. Let each non-variable term Pi have the f o r m f i ( t i A , .. . ,ti,~(]i)), and let each non-variable term qi have the f o r m g i ( s i A , . . . , si,a(gO). For brevity, we let oq = a ( f i ) , if pi = f i ( . . . ) , and oq = O, if pi is a variable. From these assumptions follows that m = n and that there is a permutation ~r on { 1 , . . . m} such that

Vi E { 1 , . . . , m}(7-/(pi) = 7t(q~(i)) and Y j E {0, ... , a i ) t i j

= r s,~(OJ )

P r o o f . We can translate regular forms to irreducible forms by removing l ' s to the left of=Cs, and then use Lemma 4. Details in [14]. • 4.2

Bases of Terms and Substitutions

In analogy with [5], we define a base of a term in 7"c~. Intuitively, a base of term t is the bag of the symbols 7/(qi) in a regular form of t (as written in definition 2). We define a base as a term in another equational theory ACU, whose equivalence classes behave as bags. To define ACU, we let 0 and t2 be two function symbols not in F, and we let /3 be a new arity function, with/3(0) = 0, j3(~) = 2, a n d / 3 ( f ) = 0 if f E F. We define H = F U {0, t2}. In terms, ~ is written infix and is syntactically left-associative. We write T~ as an abbreviation of 7"(Hz, V). ACU is the equational theory on Tp presented by xt2y=y~x,

x®(y~z)=(x~y)~z,

O~x=x

C o n v e n t i o n 6 When we talk about a term bl W . . . ~ bn, with n >_ O, it is understood that the case when n = 0 is seen as the term O.

612

D e f i n i t i o n 7 Let t E Ta have a regular form (sl =¢, ql) × " " × (s~ :¢, qn), where n > O. Then if b =ACU 7 t ( q 1 ) t ~ . . . ~J T-l(qn), we say that t has a base b, which we write t Bb. C o r o l l a r y 8 I f tt = r t2, and t 1 Bbt, and t2 Bb2, then bl =ACU b2. P r o o f . Follows from T h e o r e m 5. D e f i n i t i o n 9 If cr is a substitution on Ta, and ~ is a substitution on T3, we say that ¢r has a base w, and write o'Bw, if cr(x) B ~(x) for all x E V. Our main result is that a base of a r - m a t c h e r for two terms is an ACU-matcher for their bases. T h e o r e m 10 Let p , s E Te, and bp,bs G Tp, and let (r be a substitution on Ta. c~(p) = r s, and pBbp, and s Bbs, and ~r Bw, then w(bp) --'--ACUbs. P r o o f . See [14]. 4.3

If •

Most General Terms and Substitutions with a Given Base

Given a base in Tp, it is interesting to ask which terms in 7-~ that have this base. Theorem

11 Let b E 7-~, and t E 7-~, and let t Bb.

1. I f b = x, where x E V, then t = r ( t o , x ) ,

for some to E T~.

2. I f b --= f , where f E F, then t =r (to=~ f ( t t , . . . , t a ( y ) ) ) , for some t o , t l , . . . , t ~ ( ] ) E T~. 3. I f b = O, then t = r l . 4. I f b = bl ~ b2, where bx, b2 E T#, then t = r tx × t2, for some tl,t2 E T a such that tl Bbl and t2 Bb2. P r o o f . Follows from the definition of t B b.

•

Given a t e r m b E T~, we can now find a most r-general term among the terms t E T a for which t B b. Inspired by [3, Sec. 9.6], we will use two functions Take and Split to get hold of "new" variables. T h e function Take takes a natural number n and an infinite set Y of variables, and returns n distinct variables of Y. The function Split takes a natural number n and an infinite set Y of variables, and returns n infinite, pairwise disjoint, subsets of Y. Neither of the functions is defined if Y is only a finite set of variables. D e f i n i t i o n 12 We define a function Mg, that takes a term in Tp and an infinite set of variables, and returns a term in Ta. Mg(x,Y) Mg(f,Y)

= y0~z = Y o U r ( Y 1 , . . . , Y~(I))

Mg(0, Y) = 1 Mg(bl~b2,Y) = Mg(bl,Yt)×Mg(b2,Y2)

where Y0 = Take(1,V) where Yo, y l , . . . , Y , U ) = T a k e ( l + a ( f ) , Y ) where Y1,Y2 = Split(2,Y)

T h e o r e m 13 Let t B b, and let Y be an infinite set of variables such that Y f') V(b) = O. Then there is a substitution a with D(~) C_ Y , such that ~r(Mg(b,Y)) = r t.

613 Note that this means that Mg(b, Y) _ 0, ti,l is either 1 or a proper subterm of ti-l,l. Since the sequence must end when a term becomes F-equal to 1, and since we cannot take proper subterms indefinitely, there are no infinite decreasing sequences - - in other words, the ~- relation is well-founded. We extend it to matching problems by letting (p, s) >- (pr, s') iff s ~- s'. Now, when the function cMp is called with a matching problem (p, s), it reduces the problem to a finite number of other matching problems (p~, si), such that (p, s) ~- (Pi, si) for all i, and cMp must therefore terminate. The reduction goes via calls to eMd and cMs, but cMp makes only a finite number of calls to cMd, since ACU-matching is finitary, and cMd makes only a finite number of calls to cMs, since a disjunction system that corresponds to a matching problem can only consist of finitely many matching systems. Therefore, cMpair always terminates with a finite complete set of matchers. 5

Practical

Experience

of Library

Search

In 1988, I implemented a search system that retrieved library identifiers of types Fequal to a given query [13]. The speed of the system was satisfactory, but the examples in Section 1.2 convinced me that F-equality was not always enough in a programming language with polymorphic types. I have now implemented a search system that retrieves library identifiers of types more F-general than a given query. The implementation follows the description in Section 4 closely. The major difference is that the disjunction matching systems are never generated explicitly; the representation used is more like AND-OR-trees. My search system is implemented in Standard ML [12], but for my tests, I have used the Lazy ML [1] library. The test library contains 185 identifiers, but by preprocessing it, I reduced the number of attempted matches to be between 16 and 61, depending on the query. Related ideas can be found in [11]. None of my test queries has retrieved more than 14 identifiers. The time to process a query usually varies between 0.2 and 2.0 CPU seconds, but one complex query (the most specific type of (&) given in Example 3) requires 32 CPU seconds. My implementation can no doubt be made more efficient, but it already works well for resonably complex queries and fairly large libraries. The timings were made using Standard ML of New Jersey on a SUN-360. In [14], you can find some examples of search and ideas on how to reduce the number of unwanted identifiers that are retrieved.

616

6

Unification

in ( S u b s e t s

of) F

Runciman and Toyn has proposed that library identifiers should be retrieved if their types are unifiable with the query [15]. Their reason is that they derive queries automatically from contexts of use, specification laws etc. In [13], I argued that the user should be allowed to indicate, for each variable in his query, whether or not it may be instantiated. In [9], it is reported as an open question whether F-unifiability is decidable, but it is shown (among other things) that • Let P ~ be the equational theory presented by the axioms for F except distributivity. Unifiability in F ~ is NP-complete (and thus decidable), and unification is finitary. • F-matchability is NP-complete. These results are only stated for unification in the presence of free constants. It does not follow immediately that an algorithm for F~-unification can be extended to free function symbols of any arity, but the techniques in [16] might apply. The method in [9] also yields an algorithm that finds finite complete sets of unifiers in the equational theory presented by just AC and currying. Such an algorithm can be extended to free function symbols, since the theory is regular and collapse-free, see e.g. [20]. 7

Summary

and Conclusion

I have argued that when function libraries are searched by means of type, one would like to retrieve functions of types at least as general as the query, modulo canonical CCCisomorphism. To be able to do this, I have developed an algorithm that gives a finite complete set of F-matchers. An implementation of a library search system shows that satisfactory speed can be 'achieved. 8

Acknowledgements

My supervisor, Peter Dybjer, has read through many versions of this paper and given valuable comments; I have recieved further suggestions for improvements from an anonymous referee. I have also benefitted from discussions with Lennart Augustsson. I am indebted to Bernard Lang for sending me his paper and other references, and to G~rard Huet for referring me to Lang. I have also got information, references, and/or software from Tom Blenko, Hans-Jfirgen Bilrckert, Roberto Di Cosmo, Conal Elliott, Claude Kirchner, Giuseppe Longo, Paliath Narendran, Kim H. Pedersen, Gerald Peterson, Frank Pfenning, Andrew Pitts, Erik Tid~n, and Ralph Wilkerson. References [1] L. Augustsson and T. Johnsson. The Chalmers Lazy-ML compiler. The Computer Journal, 32(2), 1989. [2] F. Fages and G. Huet. Complete sets of unifiers and matchers in equational theories. Theoretical Comp. Sci., 43:189-200, 1986. [3] P. Hancock. A type-checker. In S.L. Peyton Jones, The Implementation of Functional Programming Languages, chapter 9. Prentice-Hall, 1987. [4] J.M. Hullot. Associative commutative pattern matching. In Sixth Int. Joint Conf. on Artificial Intelligence, Tokyo, 1979.

617

[5] B. Lang. Matching with multiplication and exponentiation, May 1978. Author's current address: INRIA, Domaine de Voluceau, Rocquencourt, B.P. 105, F-78153 Le Chesnay Cedex, France. E-mail: [email protected] [6] G. Longo, A. Asperti, and R. Di Cosmo. Coherence and valid isomorphism in closed categories. In D.H. Pitt et al., eds., Category Theory and Computer Science, Manchester, 1989. LNCS 389, Springer-Verlag. [7] C.F. Martin. Equational Theories of Natural Numbers and Transfinite Ordinals. PhD thesis 1973. University of California, Berkeley, CA 94720, USA. See also Notices of the Am. Math. Soc., 19(7):A-778-779, Abstract 698-E1, 1972. [8] R. Milner. A theory of type polymorphism in programming. J. of Comp. and System Sei., 17(3):348-375, 1978. [9] P. Narendran, F. Pfenning, and R. Statman. On the unification problem for Cartesian closed categories, 1989. Addresses: P. Narendran, State Univ. of New York at Albany, USA. F. Pfenning and R. Statman, Carnegie Mellon Univ., Pittsburgh, USA. E-mail: [email protected], [email protected], [email protected] [10] G.E. Peterson and M.E. Stickel. Complete sets of reductions for some equational theories. JACM, 28(2):233-264, April 1981. [11] P.W. Purdom, Jr. and C.A. Brown. Fast many-to-one matching algorithms. In J.-P. Jouannaud, ed., Rewriting Techniques and Applications, Dijon, France, 1985. LNCS 202, Springer-Verlag. [12] C. Reade. Elements of Functional Programming. Addison-Wesley, 1989. [13] M. Rittri. Using types as search keys in function libraries. In Fourth Int. Conf on Functional Programming Languages and Computer Architecture, London, 1989. ACM Press, Addison-Wesley. (Part B of [14] is a revised version.) [14] M. Rittri. Searching Program Libraries by Type and Proving Compiler Correctness by Bisimulation. PhD thesis, 1990. Dept. of Comp. Sci., Chalmers U. of Tech. and U. of G6teborg, S-412 96 Gbteborg, Sweden. E-maih rittriQcs.chalmers.se [15] C. Runciman and I. Toyn. Retrieving re-usable software components by polymorphic type. In Fou~th Int. Conf. on Functional Programming Languages and Computer Architecture, London, 1989. ACM Press, Addison-Wesley. [16] M. Schmidt-SchauS. Unification in a combination of arbitrary disjoint equational theories. J. of Symbolic Computation, 8:51-99, 1989. [17] J.H. Siekmann. Unification theory. J. of Symbolic Computation, 7:207-274, 1989. [18] S.V. SoIov'ev. The category of finite sets and Cartesian closed categories. J. of Soviet Math., 22(3):1387-1400, 1983. [19] M.E. Stickel. A unification algorithm for associative-commutative functions. JA CM, 28(3):423-434, July 1981. [20] E. Tid~n. First-Order Unification in Combinations of Equational Theories. PhD thesis, 1986. Dept. of Num. Anal. and Comp. Sci., The R. Inst. of Technol., Stockholm, Sweden. [21] D.A. Turner. Miranda: A non-strict functional language with polymorphie types. In J.-P. Jouannaud, ed., Functional Programming Languages and Computer Architecture, Nancy, France, 1985. LNCS 201, pages 1-16, Springer-Verlag.

Unification in Monoidal Theories Werner Nutt DFKI, Postfach 2080 D-6750 Kaiserslautern, West Germany e-mail: nutt @uklirb.informatik.uni-kl.de

Abstract

We study the unification problem for a class of equational theories that comprises imt)ortant examples like abelian monoids (AC), idempotent abelian monoids (ACI), and abelian groups. Monoidal theories have the common characteristic that unification algorithms are based on solving linear equation systems over a semiring. The close correspondence between unification and linear algebra can be used to characterize the unification type of monoidal theories in purely algebraic terms, and an application of Hilbert's Basis Theorem gives a sufficient criterion for a monoidal theory to be unitary.

1

Introduction

In recent years, unification algorithms for many equational theories have been devised. But in spite of the substantial body of results, the field still lacks abstraction and a reservoir of general methods. In this paper we try to make a first step in the direction of abstraction and generality exploiting techniques and results from linear algebra. We characterize a class of equational theories for which unification is basically equivalent to solving linear equations. We call these theories monoidal because they describe varieties of abelian monoids. This class comprises well-studied theories like that of abelian monoids (AC), idempotent abelian monoids (ACI), and abelian groups (AG). It is well-known that AC-unification amounts to solving linear equations over the natural numbers [LS78, St81, Fo85, B/i86], and unification in abelian groups is done by solving linear equations over the integers [La84]. But it was not clear whether the correlation between equational theories and linear equations is merely accidental or if there is some structural connection. We will show that the latter is the case. To each monoidal theory corresponds a semiring, an algebraic structure that can be thought of as a generalized ring. For instance, to AC corresponds the semiring of natural numbers and to AG the ring of integers. Unification Agorithms for monoidal theories fit into one general schema: solving pure problems is equivalent to solving homogeneous linear equation systems over the semiring, problems with constants correspond to inhomogeneous systems.

619

Applying this schema to AC-unification gives an elegant transformation from ACunification problems to linear equation systems over the natural numbers as illustrated by the following example. Suppose we want to solve the term unification problem Y2+Y2

Yl + Y3 + Y3

--

Yl+Yl+Y3

--" y l + Y 2

where + is an associative and commutative symbol. We reformulate this problem as the task to find a unifier for the homomorphisms a, ~-: ~-AC(Xl, x~) --~ ~'AC(Yl, Y2, Y3) between free AC-algebras given by UXl

~-"

Yl + Y3 + Y3

TXl

=

aX2

=

Yl Jr y l + Y3

TX2

---- Yl + Y2.

Y2 + Y2

T h a t is, we look for some homomorphism 5: ~'AC(Yl, Y2, Y3) --* ~'AC(Zl,. •., Zm) such that 5 a = 5T (see [RB85, Go89] for related ideas to generalize unification in categorical terms). Now we exploit a crucial observation: the free AC-algebras over n generators are isomorphic to cartesian products of n copies of N, the semiring of natural numbers. Moreover, under this identification we can consider a and T as N-linear mappings a, 7: N {x1'~2} --~ N (yl'y~'y3) that are represented by the matrices

C~

=

201

110

The task to find unifiers for ~r and r is now equivalent to finding matrices D solving the linear equation system C~,D

-

CrD

since from every matrix solution one can reconstruct a unifying substitution. A matrix D represents a most general unifer if and only if every vector a satisfying C o a = C.~a can be obtained as a linear combination of the rows of D. Unfortunately, this matrix equation cannot be solved with standard methods known from linear algebra over fields (like e.g. the Gauss algorithm), because the natural numbers form a proper semiring where neither inverses for multiplication nor for addition exist. This situation is typical for the general case. A specific algorithm for solving linear equations has to be found for every given monoidal theory. But a rich supply of methods for such problems is known that can be used for these unification problems. T h e clsoe correspondence between unification and linear algebra can be used to characterize the unification type [Si89] of monoidal theories algebraically: a theory without constants is unitary if the solution spaces of linear equation systems are finitely generated, otherwise it is nullary. An application of Hilbert's Basis Theorem gives a sufficient criterion for a monoidal theory to be unitary without and with constants. In this paper we restrict our attention to unification problems without constants. A more detailed presentation of the theory including the proofs is given in [Nu90].

620

In section 2 we briefly review basic definitions and fix our notation. In section 3 we give an abstract reformulation of unification as unification of homomorphisms rather than of terms. Section 4 presents semirings as the basic structure for linear equations. In section 5 we introduce monoidal theories and discuss their fundamental properties. The heart of the paper is section 6, where we characterize unification problems in monoidal theories in purely algebraic terms and derive a general schema for algorithms.

2

Basic Definitions

We briefly review the necessary notions and notation from equational logic that are used in unification theory. A collection of papers representing the state of the art can be found in the special issue [Ki89]. We assume that two disjoint infinite sets of symbols are given, a set of function symbols (like f, h) and a set of variables (like x, y, z). A signature E is a finite set of function symbols each of which is associated with its arity. Every signature E determines a class of E-algebras and E-homomorphisms. The realization of a E-function symbol f in a Nalgebra A is written as f A We define E-terms and E-substitutions as usual. The set of all E-terms with variables in X forms the free term algebra Tz(X). Substitutions are the homomorphisms between term algebras. An equational theory g = ( E , E ) is a pair consisting of a signature E and a stable congruence E on the set of all E-terms. We will write s = e t or s - t E E if (s, t) E E. Every equational theory g determines a variety of g-algebras. The set of all E-congruence classes ~ of E-terms s E T z ( X ) forms an g-algebra U~(X). The algebra ~'e(X) is free over X in the sense that for every g-algebra A every map f : X --~ A can be uniquely extended to a E-homomorphism c~]: Ye(X) --* A. Since free algebras are unique up to E-isomorphism, we call ~'c(X) the free g-algebra over the set of generators X . Every E-substitution a': T~(X) --+ Tz(Y) gives rise to a E-homomorphism a: ~'e(X) -~ ~'e(Y) if we put ax := ~7~. Conversely, every such E-homomorphism between free g-Mgebras can be obtained from some E-substitution.

3

An Abstract View of Unification

In this paper we consider unification as the unification of homomorphisms instead of terms. Let g = (E, E ) be an equational theory. A unification problem is a pair a, r: 9%(X) --* Ye(Y) of parallel E-homomorphisms between finitely generated free g-algebras. An gunifier of a and r is a E-homomorphism 5: ~e(Y) ~ Ye(Z) such that 5c~ = 57. The E-homomorphism 5 is more general than a E-homomorphism 5': ~'e(Y) --* ~-e(Z') if there exists some E-homomorphism t : 9%(Z) ~ ~e(Z') such that 5 ' = AS. In this case we write 5 _< 5r. We say that 5 is strictly more general than 5 ~ and we write 5 < ~, if 5 < 5~ but not 5' _< 5. The unifier 5 is most general if there is no unifier that is strictly more general. A set U of unifiers is complete if for every unifier 5 there is a 5 ~ E U such that ~ _< 5. A minimal complete set of unifiers is a complete set such that no proper subset is a complete set of unifiers.

621

Following Siekmann [Si89], we divide equational theories into four classes according to their unification type. A theory is infinitary if for every unification problem there exists a minimal complete set of unifiers and nullary otherwise. It is finitary or unitary if there always exists a minimal complete set that is finite or a singleton, respectively. To see how these definitions relate to the traditional concept of unification (cf. [Ki89]) consider a E-equation system F = (sl "- t l , . . . , s ~ - tn). Let X = {Xl,...,x,~} be a set of cardinality n, let Y be the set of variables occurring in F, and a, r: ~'e(X) --* .T'e(Y) be the unique E-homomorphisms satisfying axi = ~ and rx~ = ~. Suppose the E-homomorphism 6: Y e ( Y ) --~ Y e ( Z ) is given by the substitution ~'. Then we have ~a = ~r iff 8~Si =e ~tt~ for i = 1 , . . . , n . In other words, 3 is a unifier of a and T i f f St is a unifying substitution for F. Conversely, it is easy to see that for every pair a, r of parallel holnomorphisms there exists an equation system F such that unifying substitutions for F give rise to unifiers of a, v and vice versa. Moreover, one easily checks that our relation < is an abstract version of the usual instantiation preorder on substitutions. Thus traditional term unification and unification of homomorphisms are essentially the same.

4

B a s i c S t r u c t u r e s for Linear E q u a t i o n s : Semirings

The theory of linear equations is usually developed as the theory of fields, vector spaces, and linear mappings. In order to deal with a wide class of unification problems we need a generalized linear algebra. It is well known that for AC-unification one has to solve linear equations over natural numbers. Natural numbers do not form a field since inverses for addition and multiplication do not exist. They form an algebraic structure called semiring. We briefly present those definitions and results on semirings that we will need in the sequel. 4.1

Semirings

A semiring $ is a tuple (8, +, 0, -, t) such that (S, +, 0) is an abelian monoid, ($,., 1) is a monoid, and all a, fl, 7 E $ satisfy the equalities

1.

2.

(a+fl).-/=a.7+fl.

7

3.

0.c~=a.0=0.

=

We call the binary operations " + " and "." the addition and the multiplication of t h e semiring, respectively. The elements 0 and 1 are called zero and unit. A semiring is commutative if its multiplication is commutative. Semirings are different from rings in that they need not be groups with respect to addition. E x a m p l e s 4.1 Natural numbers form a semiring IN. Every ring is a semiring. In particular, the ring of integers Z and the ring of gaussian numbers Z ® iZ, consisting of complex numbers m + i n where m, n E Z, are semirings. The set {0, 1} becomes a semiring B if we define 1 + 1 := 1 and extend addition and multiplication as required by the above axioms. For every semiring $ one can construct the semiring SIX] of polynomials in the indeterminate X with coefficients from 8.

622

4.2

Modules

Modules over semirings are a generalization of vector spaces over fields. As in the case of non-commutative fields, where one has to distinguish between left and right vector spaces, we will define left and right modules. A left module over a semiring S is an abelian monoid (M, +, 0) together with a scalar multiplication S X M ~ M

(a,m) ~ am

such that for all a,/~ E S and m, n E M the following equalities hold:

1. (o~ . f3)m = a ( # m )

4.

aO = O

2.

(a+j3)m=am+flm

5.

lm=m

3.

a ( m + n) = a m + a n

6.

0m=0.

Right modules over S are defined in the same way with the only exception that equality (1) is replaced by the equality

1'. (a. #)m = fl(am). In a left module, semiring elements are applied to the left of module elements. Analogously, one could define right modules as structures where semiring elements are applied to the right of module elements. The only to the definition of left modules, that is not merely notational difference, would be in the analogue of equality (1), which would be m ( a . ~) = ( m a ) # . But this is equivalent to equality (1'). E x a m p l e 4.2 For every finite set X the cartesian product S x is turned into a left (right) S-module if we define the left scalar multiplication by a(fl~:)~ex := ( a - flx)~ex (and the right one by a(~:)~:ex := ( # , . a ) , z x ) . The y-th unit vector % E S x is the tuple (a~:),ex where ay = 1 and a , = 0 for x # y. Next we introduce structure preserving mappings between left (right) modules M, N. A map a: M --* N is left (right) linear if all a E S and all m, m' E M satisfy the equalities:

I.

a ( m + m') = a m + ~m'

2.

~(~m)

3.

aO=O

= ~m

For commutative semirings, there is no difference between left and right modules and left and right linear mappings. A left (right) module F is free over a set of generators X C_ F if for every left (right) module M and every function f : X ~ M there is a unique left (right) linear map aS: F --* M such that aS(z ) = f ( z ) for all x E X. If F , F ' are left (right) S-modules such that F is free over X and F ' is free over X', then F and F ' are isomorphic if and only if there exists a bijection between X and X'. P r o p o s i t i o n 4.3 If X is finite then S x with left (right) scalar multiplication is the free left (right) S-module over {e~ I x E X } .

623

4.3

Matrices

We compute with linear mappings by means of matrices: a left linear mapping (r: S x --* 8 Y can be described by an X x Y-matrix C~ with entries from S as follows: the x-th row of C~ = (7=~)=ex,yey contains the components of ere=, the image of the x-th unit vector e, under (r. Following the usual rules of matrix and vector multiplication we have a a = aC~ where a E 8 X is written as a row vector. Conversely, every X × Y-matrix C defines a left linear map (re: 8 x --~ St" by a c a := aC. If cr is right linear we have to slightly modify the construction. We take C~ as the Y × X - m a t r i x containing in the x-th column the components of ae=. Then (ra = C~a where a E S X is written as a column vector. For Commutative semirings both constructions are equivalent. It is the second one that is usually chosen in linear algebra over commutative fields. If (re: S x --* $ Y is left (right) linear, then the dual map of (r is the right (left) linear map a*: S r --* S x defined by (r*a = C~a (= aC~). Note that (r(r)* = (r'r*.

5

Monoidal Theories

Monoidal theories generalize AC, ACI, and the theory of abelian groups. It will turn out that unification problems in monoidal theories are equivalent to systems of linear equations over a certain semiring.

5.1

Definitions

An equational theory g = (~, E ) is m o n o i d a l if 1. ~ contains a constant 0, a binary symbol +, and all other function symbols are unary 2. + is associative and commutative 3. 0 is the identity for +, that is 0 + x =c x + 0 =~ x 4. every unary symbol h is a homomorphism for + and 0, that is h ( x + y ) =~ h ( x ) + h ( y ) and h(0) =~ 0. A monoidal theory may contain arbitrary additional equalities over ~, the only requirement is, that at least the above laws hold. Monoidal theories describe varieties of abeIian monoids with homomorphisms. E x a m p l e s 5.1 The theory AC, where EA¢ = {+: 2, 0: 0} and EA¢ is generated by associativity, commutativity, and identity laws for + and 0 describes the variety of abelian monoids. It is the least monoidal theory in that its signature contains no unary symbol and only the equalities required by the definition hold. Adding the idempotence law x + x -'-- x to AC we obtain the theory ACI of idempotent abelian monoids. Adding to AC the symbol " - " and the equality x + ( - x ) -" 0 gives the theory of abelian groups (AG). Adding to AC or AG a homomorphism symbol i results in the theories of abelian

624

monoids or groups with homomorphism (ACH or AGtt), respectively. Adding to ACH the equality x + i(i(x)) "- 0 gives a theory that we denote as GAUSS. A monoidal theory C is a theory with commuting homomorphisms if for all unary function symbols h, h ~ E E we have h(h'(x)) =c h~(h(x)), h monoidal theory E is a group theory if for some term t we have x + t =E 0. Intuitively, in a group theory inverse elements for addition exist. All our examples are theories with commuting homomorphisms, and AG, AGH, and GAUSS are group theories.

5.2

M o n o i d a l T h e o r i e s Define S e m i r i n g s

It is well-known that AC-unification amounts to solving linear equations over N [LS78, St81, Bfi86, Fo85] and unification in abelian groups is done by solving linear equations over Z [La84]. On these grounds it is natural to ask whether the correlation between equational theories and semirings is merely accidental or if there is some structural connection. We will show that the latter is the case. To every monoidal theory E one can canonically associate a semiring S~ that extends the operations specified by the signature of C.

General Assumption. In the rest of the paper we assume that E = (~, E) is a monoidaI theory. Let 1 be a distinguished variable symbol. We define a multiplication on Tz(1) by s . t := [1/t]s for terms s, t E Tg(1). In other words, the product s . t is obtained from s by replacing all occurrences of 1 with t. E x a m p l e s 5.2 If s e T~(1), then 1. s = [1/s]l = s and s . 1 = [1/1]s = s. Hence, the symbol 1 is a unit. If h is a unary function symbol, then h(1). s = [1/s]h(1) = h(s). Hence, left multiplication by h(1) is the same as applying h. The operation "." mimics multiplication of natural numbers modulo associativity and commutativity of + . For instance, (1 + 1). (1 + 1) = [1/(1 + 1)](1 + 1) = (1 + 1) + (1 + 1), which can be read as "two times two is four". C o n s t r u c t i o n 5.3 Let Se be the quintuple (~'e(1), +, 0 , . , 1-) where 0, 1 are the congruence classes of 0 and 1 in ~'e(1), " + " is the addition on .To(l) defined by ~ + t :-- s + t, and "." is the multiplication on 9v~(1) defined by ~. t := s- t. Using the laws that hold in monoidal theories it is straightforward to verify the following theorem. T h e o r e m 5.4 Ge is a semiring. We call Se the canonical semiring of C. The canonical semiring doesn't come in like the famous rabbit pulled out of the magician's hat. It is isomorphic to the semiring of E-homomorphisms ~e(1) --~ 9vc(1) where the zero is the constant mapping 0, the unit is the identity map, addition is defined pointwise and multiplication is composition in reverse order. We prefer to define Se by operations on terms as above because we find this more intuitive.

625 E x a m p l e s 5.5 The canonical semirings of the theories AC, ACI, AG, GAUSS, ACH, and AGH are isomorphic to N, B, Z, Z ~3 iZ, N[X], and Z[X]. As seen in the examples, the canonical semiring SE mirrors properties of g. P r o p o s i t i o n 5.6 1. SE is commutative if and only if g is a theory with commuting homomorphisms 2. Se is a ring if and only if C is a group theory. Finally we show that the concepts of monoidal theory and semiring have the same generality. P r o p o s i t i o n 5.7 For every semiring S there exists a monoidaI theory g such that S and Se are isomorphic. Proof. If S is a semiring, let E be the signature containing the symbols 0 and + and for every s E S a unary symbol hs. Let E be the set of equalities that hold over $ if 0 and + are interpreted as zero and addition and every unary symbol h8 is interpreted by hS~(a) = s • a for all a E S. Then it is easy to see that g = (E, E ) is a monoidal theory such that S and Se are isomorphic. []

5.3

Algebras and M o d u l e s

Next we show that it is just a m a t t e r of perspective whether one views an algebraic structure as an C-algebra or as a left Sc-module. Theorem

5.8 Let A be an S-algebra. Then there exists a unique scalar multiplication

Sex A ~ A

(-$, m) ~ ~ m

turning A into a left Se-module such that addition and zero are inherited from the algebra structure of A and h(1)a = ha(a) for all unary function symbols h and all a E A. Proof. To show existence, consider for every a C A the unique Z-homomorphism e~: ~-c(1) ~ A satisfying e~]- = a. Then it is easy to verify that ~a := ca~ defines a scalar multiplication as required, turning A into a left Se-module. To show uniqueness suppose that o:Se x A --* A is a scalar multiplication turning A into a left Se-module such that h(1)a = hA(a) for all a E A. Then ¢ ~ := ~oa defines a E-homomorphism ¢~: 9%(1) --* A satisfying Ca]- = a. Hence ¢~ = ~ , since 5%(1) is free over {1}, which proves the claim. [] We denote the left Se-module obtained from the g-algebra A as A m°d. Conversely, every left SE-module M can be turned into an g-algebra M ~ag if addition and zero are inherited from the module structure and if every unary function symbol h is interpreted as hM(m) = h(1)m. Transforming £-algebras into So-modules and Se-modules into £algebras behave like inverse operations.

626

P r o p o s i t i o n 5.9 I f A is an E-algebra and M is an Se-module, then (Am°d) ~lg = A and (Malg) m°d = M. Viewing S-algebras as left Se-modules and vice versa can be extended to structurepreserving mappings.

P r o p o s i t i o n 5.10 1. I f A, B are S-algebras and a: A ---+ B is a E - h o m o m o r p h i s m , then is left linear.

~:

A m°d -'-+ B m°a

2. I f M , N are left S e - m o d u l e s and a: M -~, N is left linear, then c~: M ~ag --* N ~lg is a E-homomorphism.

Free algebras and modules are defined by the existence of certain structure preserving maps. Since the latter remain invariant, so do free objects. C o r o l l a r y 5.11 If X is a finite set, then 2rc(X) ~°d is the free left $e-raodule over X and s is the f ee E-algebra over I x e x}. As a consequence of this corollary we obtain canonical isomorphisms between the algebras 2re(X) and ,gx~ag and the left modules S x and 2re(X) m°d if we identify the generators x E X with the unit vectors e~, x E X.

6

Unification

We saw that we can canonically identify free S-algebras and free left Se-modules and that this identification extends to homomorphisms and linear maps. This identification allows us to transfer unification problems into the framework of linear algebra. E x a m p l e 6.1 Consider the term unification problem

i( 1) + y3 =" y2 + Yl + Y3 + Y3 --

Yl + i(Y2)

for the theory GAUSS. Let X = { x l , x : } and Y = {yl, y2, y3}. Define Eancss-homomorphisms Or, T: . ~ ' G A U s s ( X ) ""+

9C'GAUss(Y)

by the equations axl

=

i(y,)+y3

~x~ =

y~+i(y2)

crx2

=

Yl -'k Y3 '{- Y3

TX2

Yl + i(y2).

=

A substitution 5' is a GAUSS-unifier of the term unification problem if and only if the corresponding EcAuss-homomorphism 5 is a unifier of a and r. Since .T'GAUss(X) m°d is isomorphic to (Z @ i Z ) x and 2rGAUSS(Y)~°d to (Z @ i Z ) Y, we can view a and r as the left linear maps given by the matrices

627

C~

=

102

1

i

0

Now, 6 is a unifier of a and r if and only if it is described by a m a t r i x C~ such that CoC~ = C~C~.

6.1

C h a r a c t e r i z a t i o n of U n i f i e r s

Our identification allows us to study unification in monoidal theories as unification of linear m a p s rather than of E-homomorphisms. In the following we assume that all Eunification problems are already transferred into problems for left linear maps. Let a, T: Sex ~ S ~ be right linear. The kernel of a and r is the set ker(a, 7-):= {a • s x [ aa = Ta}. T h e kernel of a and T is a right submodule of Sex. The image of a is the set i m a := {b • s Y ] 3 a • s x . a ( a )

- b}.

T h e image of a is a right submodule of S~'. We start with a characterization of the instance relation between left linear m a p s in t e r m s of kernels and images of their dual maps. T h e o r e m 6.2 Let 6: Sex ---+ S ~ and y: Sexm ---* S z be left linear. equivalences hold:

1. 6 < y

¢==~

im y* C im 6*

2. 6 < y

~

ira rl* is a proper subset of im 6*.

Then the following

Proo£ 1. "=C' If 6 _< 7/, then 7/= A6 for some A: Sev --* S z. Hence 71" = 6*A*, which implies imy* = 6*(imA*) C_ 6"(8~) = ira6*. " ~ " It suffices to show that there is a right linear m a p #: S z __. $ ~ such that 5"# = 7/*, since then #*6 = 7/. Let ez, z • Z, be the unit vectors o f $ z. S i n c e i m y * _ i m 6 * , i t follows t h a t y*ez • ira6* for all z • Z. Hence, there exist vectors az • 8 ~ such that 6*a~ = y*ex. Define # by #ez = az. Then 6*#e~ = q*e~. Since 6"# and y* agree on the generators of s z , they are equal. 2. T h e claim is a trivial consequence of statement (1). [] T h e next theorem characterizes unifiers. T h e o r e m 6.3 Let a, T: $ex --* Sev and 6: $ ~ --* S z be left linear. equivalences hold:

1. ~ is a unifier of a and T

~

Then the following

im 6" C ker(a*, T*)

2. 6 is a most general unifier of a and T

-'. '-

im6* = ker(a*,T*).

628

Proof. 1. 5 is a unifier of a and r ~ 5a = 6r 4==~ a*6* = r*5* 4=~ Va E S z . a*~*a = T*5*a ¢::=# VbE imh*.a*b = v*b .'. '. imh* C_ ker(a*,r*). 2. "=~" Suppose 5 is a unifier of a and r and there exists some a E ker(o'*, r*) such that a ~ imh*. Define r/:$Y --* S~{~} by r/*e~ = a. Then imr/* C_ ker(c~*, r*), and therefore 7? is a unifier of a and r by part (1). Since a E imr/* and a ~ imP*, it follows from Theorem 6.2 that 8 is not more general than q. "¢=" Suppose imh* = ker(a*,T*). We know by part (2) that for every unifier 7? we have imp* C ker(a*, r*) = imh*. By Theorem 6.2, 5 is more general than r]. [] C o r o l l a r y 6.4 Every E-unification problem is solvable by the constant map O.

Proof. Since ~ = 0, it follows that im-O* = {0} C ker(a*, r*).

[]

Intuitively, 5 is a most general unifier of a and r if 5* parameterizes the submodule ker(a*, r*) of S Y. Whether this is possible or not depends on the size of ker(a*, r*). To formalize this idea we need some definitions. Let S C ,.qx. The submodule generated by S is [S] = { ~ l a ~ a i I n E N, a~ E ,-qc, ai E S}. It consists of all linear combinations of elements of S. A submodule M of $Y is finitely generated if M = [S] for some finite set S C M. T h e o r e m 6.5 ( T y p e U n i t a r y ) Let a, r:,qx ~ ,q[ be left linear. There exists a most general unifier of a and r if and o n l y / f ker(a*, r*) is finitely generated.

Proof. 1. "=~" If 5: S y ---* S z is a most general unifier of a and T, then ker(a*, r*) = imh* = 5*(SZ). Since S z is generated by the set of unit vectors {ez I z E Z}, it follows that ker(rr*, r*) = ~*(Sz ) is generated by the finite set {5*e~ } z E Z}. "¢=" If ker(a*, r*) is generated by the finite set {a~ I z E Z}, then define 5 : 8 / --* S z by 5*e, = a,. Since S z is generated by the unit vectors e~, it follows that imh* = 5"($ z ) is generated by the vectors 5*ez = az. Hence, we know that imh* = ker(a*,r*). By Theorem 6.3, 5 is a most general unifier of a and r. [] T h e o r e m 6.6 ( T y p e N u l l a r y ) Let or, r: $ x __, SY be left linear maps. For every unifier r~ of or and T there exists a strictly more general unifier 5 if and only if ker(cr*, v*) is not finitely generated.

Proof. "=~" If ker(a*, r*) is finitely generated, then by Theorem 6.5 a most general unifier 5 of a and v exists. Hence, there doesn't exist any unifier strictly more general than 5. "¢=" Let r/: S~ --* S z be a unifier of a and r and suppose that ker(¢*, r ' ) is not finitely generated. Since/mr/* is generated by the finite set {r/*ez I z E Z}, it follows that imp* is a proper subset of ker(a*, r*). Hence, there exists some a E ker(¢*, r*) \ imp*. Suppose z' ~ Z and let 5: ,.qY --* ,qz~{z'} such that 5*ez = r/*ez for z E Z and 5*ez, = a. Then imh* C ker(cr*, T*), which implies that 5 is a unifier of of a and r. Furthermore, imp* is a proper subset of imh*, which implies t h a t / i is strictly more general than ~/. E] C o r o l l a r y 6.7 ( U n i t a r y - O r - N u l l a r y )

A monoidal theory is either unitary or nullary.

629

• let C~, C~ be the matrices describing a, r: Sex ~ $ ~ • find a generating set {a~ I z e Z} of solutions for C~,a - C~a * for every finite set V C Z let Dv be the matrix whose v-th column is a., v E V • let ~v: S Y --~ ,¢y be given by Dy • if Z is finite then 5z is a most general unifier else {by I V C_ Z, V finite} is a complete set of unifiers Figure 1: Schema for a unification algorithm for a monoidal theory g E x a m p l e s 6.8 It is well known that the theories AC [LS78], ACI [BB86], and AG [LAB4] are unitary. Recently Baader proved that ACH is nullary [Ba89a]. Analyzing the proofs of Theorems 6.5 and 6.6 we can derive a schema for unification algorithms which is shown in Figure 1. We illustrate the algorithm with an example. E x a m p l e 6.9 Consider the GAUSS-unification problem in example 6.1. Since Z • iZ is a ring, we can subtract matrices. Thus ker(a*, r*) = {a e Z (D iZ I (C~ - C~)a = 0}. The solutions of the the corresponding equation system 1

0

-i

2

a~

=

0

a3

are generated by the vector a -- (1 -}- 2 i , - 2 , - i ) .

Therefore, a most general unifier

5: 70A,ss(Y) -* 7aAUSS(z) is given by the equations

5yl -~ z + i(z + z)

5y2 = i(i(z ÷ z))

@3 = i(i(i(z))).

It is obvious how to obtain a unifying substitution from 5.

6.2

Noetherian Theories

In the following we are interested in sufficient conditions for a monoidal theory to be unitary. Bfirckert et al. [BH89] called an equational theory g = (~, E) noetherian if there exists no infinite strictly decreasing sequence ch > a2 > ... of Z-homomorphisms a~: ~'e(X) --~ ~e(Y~), n e N. Obviously, a noetherian theory is not nullary. Since monoidal theories are either unitary or nullary we have thus identified a class of unitary monoidal theories. 1In [Kn68] an algorithm for solving linear equations over the integers is given. It is straightforward to generalize this algorithm to arbitrary euclidean rings.

630 P r o p o s i t i o n 6.10 A noetherian monoidal theory is unitary. In algebra so-called noetherian rings have been thoroughly studied (for example see [Ja80]). Surprisingly, this concept is intimately related to the concept of a noetherian theory. We start with the appropriate generalization for semirings. A semiring S is noetherian if for finite sets X every right submodule of S x is finitely generated. As an example the ring Z of integers is noetherian. The following theorem shows how noetherian monoidal theories and noetherian semirings are connected. T h e o r e m 6.11 A monoidal theory $ is noetherian if and only if ~qe is a noetherian semiring.

Proof. Since we are dealing with monoidal theories we can identify E-homomorphisms between free algebras and left linear maps between free left modules. If c%: S x ~ sY., n C N, is a strictly decreasing sequence of left linear maps, then M := U~__I im a* is a right submodule of S x that is not finitely generated. Conversely, if M is a right submodule of S x that is not finitely generated one can inductively define a sequence of left linear maps cry: S x ~ sY" where lY I = n such that ima~ G M and ima~ is a proper subset of ima*+l. By Theorem 6.2, we know that al > a2 > ... is an infinite strictly decreasing sequence. [] This characterization gives us a first hint how to identify noetherian theories. C o r o l l a r y 6.12 A monoidal theory $ is unitary if SE is finite.

Proo[. If Sc is finite, then all right submodules of S x are finite and therefore finitely generated. [] Since SACI has only two elements this corollary proves that ACI is unitary without referring to an algorithm. Noetherian semirings and rings have important inheritance properties. T h e o r e m 6.13 Every quotient semiring of a noetherian semiring is noetherian. T h e o r e m 6.14 ( H i l b e r t ' s B a s i s T h e o r e m ) If S is a noetherian commutative ring, then S [ X I , . . . , A ~ ] , the ring of polynomials over $ in n indeterminates, is a noetherian commutative ring. These theorems can be translated into criteria for noetherian monoidal theories. If we add arbitrary equalities to a noetherian monoidal theory we obtain again a noetherian theory. C o r o l l a r y 6.15 Let $ = (E, E) be a noetherian monoidal theory. If E t is a stable congruence on E-terms that contains E, then $' := (E, E') is again a noetherian monoidal theory.

631

Proof. Clearly, C~ is again monoidal. Since the semiring Sc, is a quotient of $c, it is again noetherian and so is g'.

[]

This result is in sharp contrast to the general situation. Adding equalities to a noetherian theory can produce a theory that is no longer noetherian. For instance, the theory of associativity is noetherian, but adding idempotence produces a nullary theory [Ba86, ScS6]. C o r o l l a r y 6.16 A group theory with finitely many commuting homomorphisms is noethe-

rian. Proof. Since the ring of integers Z is noetherian, so is the ring Z[X1,... ,X~] of integer polynomials in n indeterminates by Hilbert's Basis Theorem. If g is a group theory with commuting homomorphisms then Sg is a commutative ring. Let h i , . . . , h~ be the homomorphism symbols of g. Then h i ( e ) , . . . , h~(e) are elements of Sg, and the evaluation map Z[X1,... ,X~] ~ Sg, p ( X , , . . . ,X~) ~-~ p ( h l ( e ) , . . . , h~(e)) is a surjective ring homomorphism. Hence, SE is the quotient of a noetherian ring and therefore again noetherian. [:3 E x a m p l e s 6.17 By the preceding corollary, AGH and GAUSS are noetherian. ACH is a theory with commuting homomorphisms, but it is not a group theory. As shown in [Ba89a], it is nullary and therefore not noetherian. Unfortunately, Hilbert's proof is not constructive. No general method is known to construct a generating set for submodules of S[X1,... ,X,~] x from generating sets for submodules of S x. Therefore, devising unification algorithms for group theories with commuting homomorphisms is still an open problem. Baader [Ba89b] gave a method for solving linear equations over the ring Z[X1,..., X,~] thus furnishing the cornerstone of a unification algorithm for the theory of abelian groups with commuting homomorphisms.

7

Conclusion

Monoidal theories encompass many theories that turned out to be useful in automated deduction like AC, ACI, and abelian groups. They have as common characteristic that unification problems can be reduced to linear equation systems over a semiring. For problems without constants the system is homogeneous. If constants are present it is inhomogeneous. In the constant free case, problems either have a most general unifier, or arbitrarily general unifiers exist. In the constant case we have a similar result for group theories: a group theory with constants has the same unification type as it has without constants. In particular, group theories with finitely many commuting homomorphisms are unitary without and with constants [Nu90]. Since the reduction of a given unification problem to linear equations is the same for all monoidal theories we are able to set up a schema for unification algorithms that has to be filled with a solution procedure for linear equations in order to give a complete unification algorithm. As a first application, Baader [Ba89b] obtained unification algorithms for

632

abelian groups with commuting and noncommuting homomorphisms, devising procedures for solving linear equations over the rings Z[Xa,..., X~] and Z ( X a , . . . , X~). Baader [Ba89a] studied unification in so-called commutative theories which he defined by categorical properties. It can be shown that modulo a signature transformation monoidal and commutative theories are the same. Therefore all results on monoidal theories apply to commutative theories as well. Baader characterized the unification type of commutative theories using techniques from category theory. In contrast to his work, our approach clarifies the algebraic structure of unification problems, and thus allows directly to use algebraic techniques in designing unification algorithms for these theories.

References [Ba86] [Ba89a] [Ba89b] [BB86] [BH89] [Bfi86] [FH86] [Fo85] [Go89] [Ja80] [Ki89] [Kn68] [LAB4] [LS78] [Nu90] [RB85] [Sc86] [Si89] [St81]

F. Baader, "The Theory of Idempotent Semigroups is of Unification Type Zero", J. Automated Reasoning 2, 1986. F. Baader, "Unification in Commutative Theories", in C. Kirchner (ed.), Special Issue on Unit~cation, J. Symbolic Computation, 1989. F. Baader, "Unification in Commutative Theories, Hilbert's Basis Theorem, and GrSbner Bases", preprint, 1989 F. Baader, W. Biittner, "Unification in Commutative Idempotent Monoids", preprint, 1986, to appear in TCS. H.-J. Biirckert, A. Iierold, M. Schmidt-Schau~, "On Equational Theories, Unification, and Decidability", in C. Kirchner (ed.), Special Issue on Unification, J. Symbolic Computation, 1989. W. Biittner, "Unification in the Data Structure Multiset'. J. Automated Reasoning 2, 1986. F. Fages, G. Huet, "Complete Sets of Unifiers and Matchers in Equational Theories", TCS 4a (2,3), 1986. A. Fortenbacher, "An Algebraic Approach to Unification under Associativity and Commutativity", LNCS 202, 1985. J. Goguen, "What Is Unification?", in H. Ait-Kaci, M. Nivat (eds.), ResoIution of Equations in Algebraic Structures, Academic Press, 1989. N. Jacobson, Basic Algebra II, Freeman, San Francisco 1980. C. Kirchner (ed.), Special Issue on Unification, J. Symbolic Computation, 1989. D.E. Knuth, The Art of Computer Programming, Vo1.1, Addison Wesley, 1968. D. Lankford, G. Butler, B. Brady, "Abelian Group Unification Algorithms for Elementary Terms", Contemporary Mathematics 29, 1984. M. Livesey, J. tI. Siekmann, "Unification of Sets and Multisets', SEKI-Report, Universit£t Karlsruhe 1978. W. Nutt, "Unification in Monoidal Theories", SEKI-Report, Universit~t Kaiserslautern 1990. Also presented at 2nd International Workshop on Unification, Val d'Ajol, France, 1988. D.E. Rydeheard, R. M. Burstall, "A Categorical Unification Algorithm", LNCS 240, 1985. M. Schmidt-Schau~, "Unification under Associativity and Idempotence is of Type NuUary', J. Automated Reasoning 2, 1986. J. It. Siekmann, "Unification Theory: A Survey", in C. Kirchner (ed.), Special Issue on Unit~cation, Journal of Symbolic Computation, 1989. M . E . Stickel, "A Unification Algorithm for Associative-Commutative Functions", J. ACM 28, 1981.

A S c i e n c e of R e a s o n i n g : E x t e n d e d A b s t r a c t * Alan Bundy Department of Artificial Intelligence University of Edinburgh Edinburgh, EH1 1HN, Scotland Email: [email protected], Tel: 44-31-225-7774

Abstract How can we u n d e r s t a n d reasoning in general and m a t h e m a t i c a l proofs in particular? It is argued t h a t a high-level understanding of proofs is needed to c o m p l e m e n t the low-level u n d e r s t a n d i n g provided b y Logic. A role for c o m p u t a t i o n is proposed to provide this high-level understanding, namely by the association of proof plans with proofs. Criteria are given for assessing the association of a p r o o f plan with a proof.

1

Motivation: proofs

t h e u n d e r s t a n d i n g of m a t h e m a t i c a l

We a r g u e t h a t Logic 1 is not enough to u n d e r s t a n d reasoning. It provides only a lowlevel, step b y step understanding, whereas a high-level, strategic understanding is also required. M a n y c o m m o n l y observed p h e n o m e n a of reasoning cannot be explained without such a high-level understanding. Furthermore, a u t o m a t i c reasoning is impractical w i t h o u t a high-level understanding. We p r o p o s e a science of reasoning which provides b o t h a low- a n d a high-level understanding of reasoning. It combines Logic with the concept of proof plans, [Bundy 88]. *The research reported in this paper was supported by SERC grant GR/E/44598 and an SERC Senior Fellowship to the author. I would like to thank other members of the mathematical reasoning group at Edinburgh for feedback, especially Frank van Harmelen, Colin Phillips, Mitch Harris and Toby Walsh. I am grateful for comments on the first draft of this paper from two anonymous referees. The full version of this extended abstract will appear in ~Computational Logic: Essays in Honor of Alan Robinson", MIT Press, forthcoming. 1We adopt the convention of using uncapitalised 'logic' for the various mathematical theories and capitalised 'Logic' for the discipline in which these logics are studied.

634

We illustrate this with examples f r o m m a t h e m a t i c a l reasoning, but it is intended t h a t the science should eventually a p p l y to all kinds of reasoning.

2

T h e N e e d for H i g h e r - L e v e l E x p l a n a t i o n s

A p r o o f in a logic is a sequence of formulae where each formula in the sequence is either a n axiom or is derived from earlier formulae in the sequence b y a rule of inference. E a c h m a t h e m a t i c a l theory defines w h a t it m e a n s to be a formula, an axiom or a rule of inference. T h u s Logic provides a low-level explanation of a m a t h e m a t i c a l proofl It explains the p r o o f as a sequence of steps and shows how each step follows f r o m previous ones by a set of rules. Its concerns are limited to the soundness of the proof, and to the t r u t h of proposed conjectures in models of logical theories. While Logic provides an explanation of how the steps of a proof fit together, it is inadequate to explain m a n y c o m m o n observations a b o u t m a t h e m a t i c a l proofs. • M a t h e m a t i c i a n s distinguish between understanding each step of a proof and understanding the whole proof. • M a t h e m a t i c i a n s recognise families of proofs which contain c o m m o n structure. • M a t h e m a t i c i a n s use their experience of previously encountered proofs to help t h e m discover new proofs. • M a t h e m a t i c i a n s distinguish between 'interesting' and ' s t a n d a r d ' steps of a proof. • M a t h e m a t i c i a n s often have an intuition t h a t a conjecture is true, but this intuition is fallible. • Students of m a t h e m a t i c s , presented with the same proofs, learn from t h e m with varying degrees of success.

3

C o m m o n S t r u c t u r e in P r o o f s

Several researchers in a u t o m a t i c t h e o r e m proving have identified c o m m o n s t r u c t u r e in families of proofs. For instance, [Bundy & W e l h a m 81] describes the c o m m o n s t r u c t u r e in solutions to symbolic equations. This c o m m o n structure was i m p l e m e n t e d in a process of recta-level inference which guided the search for solutions to equations. [Bundy et al 88] describes the c o m m o n structure in inductive theorems a b o u t natural numbers~ lists, etc. This c o m m o n structure was i m p l e m e n t e d as an inductive proof plan which was used to guide the search for proofs of such theorems.

635 [Bledsoe et al 72] describes the common structure in theorems about limits of functions in analysis. This common structure was implemented as the limit heuristic and used to guide the search for proofs of such theorems. [Wos & McCune 88] describes the common structure in attempts to find fixedpoints combinators. This common structure was implemented as the kernel method and used to guide the search for such fixed-points. [Polya 65] describes the common structure in ruler and compass constructions. This common structure was implemented by [Funt 73] and used to guide the search for such constructions.

4

Proof Plans

Common structure in proofs can be captured in proof plans. A proof plan consists of two parts: a tactic and a method. A tactic is a procedure which constructs part of a proof by applying a sequence of rules of inference. High-level tactics are defined in terms of lower-level sub-tactics. The lowest level tactics will apply individual rules of inference. A method is a partial specification of a tactic. It consists of preconditions which must be satisfied before the tactic is executed and some effects which will be true provided the tactic application is successful. Proof plans have been implemented within the OYSTER-CLAMsystem, [Bundy et al 88]. OYSTER is a theorem prover for Intuitionist Type Theory. CLAMis a plan formation program which has access to a number of general-purpose tactics and methods for inductive proofs. This system has been used to control the search for inductive proofs about natural numbers and lists. CLAMconstructs a special-purpose proof plan for each conjecture out of its methods and tactics. The tactic of the proof plan is then executed. It instructs OYSTER to build a proof of the conjecture. The search for a proof plan at the meta-level is considerably cheaper than the search for a proof at the object-level. This makes proof plans a practical solution to the problems of search control in automatic theorem proving.

5

T h e H i g h - L e v e l U n d e r s t a n d i n g of P r o o f s

Thus a high-level explanation of a proof of a conjecture is obtained by associating a proof plan with it. The tactic of this proof plan must construct the proof. The method of this proof plan must describe both the preconditions which made this tactic appropriate for proving this conjecture and the effects of this t a c t i c s application on the conjecture. It must also describe the role of each sub-tactic in achieving the preconditions of later sub-tactics and the final effects of the whole tactic. In fact, this association provides a multi-level explanation. The proof plan associated with the whole proof provides the top-level explanation. The immediate sub-tactics and

636 sub-methods of this proof plan provide a medium-level explanation of the major subproofs. The tactics and methods associated with individual rules of inference provide a bottom-level explanation, which is similar to that already provided by Logic. The general-purpose tactics and methods which we will use to build proof plans, and the association of proof plans with proofs will constitute the theories of our science of reasoning. This extends the way in which logical theories and the association of logical proofs with real proofs and arguments, constitute the theories of Logic (especially Philosophical Logic). Just as Logic also has meta-theories about the properties of and relations between logical theories, we may also be able to develop such meta-theories about proof plans.

6

W h a t is t h e N a t u r e o f our S c i e n c e o f R e a s o n i n g ?

Before we can dignify this proposed study of the structure of proofs with the epithet science we must address a fundamental problem about the nature of such a science. Traditional sciences like Physics and Chemistry study physical objects and the way they interact. The subject of our proposed science is proof plans. But proof plans are not physical objects. If they can be said to exist at all it is in the minds of mathematicians proving theorems, teachers explaining proofs and students understanding them. Physicists assume that the electrons in the apple I am eating as I write are essentially the same as the electrons in some distant star. But proof plans will differ from mind to mind and from time to time. There will be billions of such proof plans. Are we doomed merely to catalogue them all? Given the difficulty of discovering the nature of even one such proof plan, what a difficult and ultimately pointless task this would be. We would prefer to narrow our focus on a few representative proof plans. But on what basis could these few be chosen? Fortunately, this is not a new problem. It is one faced by all human sciences to some extent and it is one that has been solved before. Consider the science of Linguistics. In Linguistics the theories are grammars and the association of grammatical structure with utterances. Linguists do not try to form different grammars for each person, but try to form a grammar for each language, capturing the commonality between different users of that language. They try to make these grammars as parsimonious as possible, so that they capture the maximum amount of generality within and between languages. Linguists do not claim that everyone or anyone has these target grammars stored in their head - - nor, indeed, that anyone has a grammar at all - - only that they specify the grammatical sentences of the language. Another example is Logic itself. Again judged by the arguments people produce, the logical laws differ between minds and vary over time. Logicians do not try to capture this variety, but confine themselves to a few logics which specify 'correct' arguments. As with grammatical sentences, correct arguments are identified by initial observation of arguments actually used and consultation with experts to decide which of these are correct.

637

I place our proposed science of reasoning between Linguistics and Logic. Proof plans are more universal than grammatical rules, but it is possible to associate different, equally appropriate proof plans with the same proof. The study of proof plans appeals both to an empirical study of the way in which mathematicians structure their proofs and to reflection on the use of logical laws to put together proofs out of parts. Thus there are strong precedents for a science that takes mental objects as its domain of study and tames the wide diversity of exemplars by imposing a normative explanation informed by reflection and empirical study. It only remains to propose criteria for associating proof plans with proofs that will enable us to prefer one proof plan to another. This we can do by appealing to general scientific principles. Our proposals are given in the next section.

7

C r i t e r i a for A s s e s s i n g P r o o f P l a n s

If there were no criteria for the association of proof plans with proofs, then we could carry out our programme by associating with each proof an ad hoe tactic consisting of the concatenation of the rules of inference required to reproduce it, and constructing an ad hoe method in a similar way. This would not go beyond the existing logical explanation. The only assessment criterion we have proposed so far is correctness, i.e. that the tactic of the proof plan associated with a proof will construct that proof when executed. We now discuss some other possible criteria. the way in which the proof is structured by a proof plan accords with our intuitions about how we structure the proof.

• Intuitiveness:

Psychological Validity: there is experimental evidence that all, most or some mathematicians producing or studying proofs also structured a proof in the way suggested by some proof plan. • Expectancy:. there must be a basis for predicting the successful outcome of a proof

plan. • Generality: a proof plan gets credit from the number of proofs or sub-proofs with

which it is associated and for which it accounts. • Prescriptiveness: a proof plan gets more credit the less search its tactic generates

and the more it prescribes exactly what rules of inference to apply. • Simplicity: a proof plan gets more credit for being succinctly stated. • Ejfficieney: a proof plan gets more credit when its tactic is computationally effi-

cient.

638

• Parsimony; the overall theory gets more credit the fewer general-purpose proof plans are required to account for some collection of proofs. We might start designing proof plans using the criteria of intuitiveness and psychological validity as sources of inspiration, but then use the criteria of correctness, expectancy, generality, prescriptiveness, simplicity, efficiency and parsimony to revise them.

8

T h e R o l e of t h e C o m p u t e r

So far we have not involved the computer in this methodological discussion. One might expect it to play a central role. In fact, computers have no role in the theory, b u t play an i m p o r t a n t practical role. Computation plays a central role in the theory, because the tactics are procedures and they are part of the theory of our science of reasoning. It is not, strictly speaking, necessary to implement these tactics on a computer, since they can be executed by hand. However, in practice, it is highly convenient. It makes the process of checking that the tactics meet the criteria of the §7 b o t h more efficient and less error prone. Machine execution is convenient: • for speeding up correctness testing, especially when the proof plans are long, or involve a lot of search, or when a large collection of conjectures is to be tested; • to a u t o m a t e the gathering of statistics, e.g. on size of search space, execution time, etc; • to ensure t h a t a tactic has been accurately executed; and • to d e m o n s t r a t e to other researchers that the checking has been done by a disinterested party. In this way the computer can assist the rapid prototyping and checking of hypothesised proof plans. Furthermore, in its 'disinterested party' role, the computer acts as a sceptical colleague, providing a second opinion on the merits of hypothesised proof plans t h a t can serve as a source of inspiration. Unexpected positive and negative results can cause one to revise ones current preconceptions.

9

T h e R e l a t i o n to A u t o m a t i c T h e o r e m P r o v i n g

Although o u r science of reasoning might find application in the building of high performance, a u t o m a t i c theorem provers, the two activities are not co-extensive. T h e y differ b o t h in their motivation and their methodology.

639

I take the conventional motivation of automatic theorem proving to be the building of theorem provers which are empirically successful, without any necessity to understand why. The methodology is implied by this motivation. The theorem prover is applied to a random selection of theorems. Unsuccessful search spaces are studied in a shallow way and crude heuristics are added which will prune losing branches and prefer winning ones. This process is repeated until the law of diminishing returns makes further repetitions not worth pursuing. The result is fast progress in the short term, but eventual deadlock as different proofs pull the heuristics in different directions. This description is something of a caricature. No ATP researchers embody it in its pure form, but aspects of it can be found in the motivation and methodology of all of us, to a greater or lesser extent. Automatic theorem provers based on proof plans make slower initial progress. Initial proof plans have poor generality, and so few theorems can be proved. The motivation of understanding proofs mitigates against crude, general heuristics with low prescriptiveness and no expectancy. The 'accidental' proof of a theorem is interpreted as a fault caused by low prescriptiveness, rather then a lucky break. However, there is no eventual deadlock to block the indefinite improvement of the theorem prover's performance. If two or more proof plans fit a theorem then either they represent legitimate alternatives both of which deserve attempting or they point to a lack of prescriptiveness in the preconditions which further proof analysis should correct. Thus, we expect a science of reasoning will help us build better automatic theorem proving programs in the long term, although probably not in the short term.

10

Conclusion

In this paper we have proposed a methodology for reaching a multi-level understanding of mathematical proofs as part of a science of reasoning. The theories of this science consist of a collection of general-purpose proof plans, and the association of special-purpose proof plans with particular proofs. Each proof plan consists of a tactic and a method which partially specifies it. Special-purpose proof plans can be constructed by a process of plan formation which entails reasoning with the methods of the general-purpose proof plans. Ideas for new proof plans can be found by analysing mathematical proofs using our intuitions about their structure and, possibly, psychological experiments on third party mathematicians. Initial proof plans are then designed which capture this structure. These initial proof plans are then refined to improve their expectancy, generality, prescriptiveness, simplicity, efficiency and parsimony while retaining their correctness. Scientific judgement is used to find a balance between these sometimes opposing criteria. Computers can be used as a workhorse, as a disinterested party to check the criteria and as a source of inspiration. T h e design of general-purpose proof plans and their association with particular proofs is an activity of scientific theory formation that can be judged by normal scientific criteria. It requires deep analysis of mathematical proofs, rigour in the design

640

of tactics and their methods, and judgement in the selection of those general-purpose proof plans with real staying power. Our science of reasoning is normative, empirical and reflective. In these respects it resembles other human sciences like Linguistics and Logic. Indeed it includes parts of Logic as a sub-science.

Personal

Note

For many years I have regarded myself as a researcher in automatic theorem proving. However, by analysing the methodology I have pursued in practice, I now realise that my real motivation is the building of a science of reasoning in the form outlined above. Now that I have identified, explicitly, the science I have been implicitly engaged in for the last fifteen years, I intend to pursue it with renewed vigour. I invite you to join me.

References [Bledsoe et al 72]

W.W. Bledsoe, R.S. Boyer, and W.H. Henneman. Computer proofs of limit theorems. Artificial Intelligence, 3:27-60, 1972.

[Bundy & Welham 81] A. Bundy and B. Welham. Using meta-level inference for selective application of multiple rewrite rules in algebraic manipulation. Artificial Intelligence, 16(2):189--212, 1981. Also available from Edinburgh as Research Paper 121. [Bundy 88]

A. Bundy. The use of explicit plans to guide inductive proofs. In 9th Conference on Automated Deduction, pages 111-120, Springer-Verlag, 1988. Longer version available from Edinburgh as Research Paper No. 349.

[Bundy et al 88]

A. Bundy, F. van Harmelen, J. Hesketh, and A. Smaill. Experiments with Proof Plans for Induction. Research Paper 413, Dept. of Artificial Intelligence, Edinburgh, 1988. To appear in JAR.

[Fnnt 73]

B. V. Funt. A procedural approach to constructions in Euclidean geometry. Unpublished M.Sc. thesis, University of British Columbia, October 1973.

[Polya 65]

G. Polya. Mathematical discovery. John Wiley & Sons, Inc, 1965. Two volumes.

[Wos & McCune 88]

L. Wos and W. McCune. Searching for fixed point eombinatots by using automated theorem proving: a preliminary report. ANL-88-10, Argonne National Laboratory, 1988.

The TPS Theorem Proving System Peter B. Andrews Sunil Issar Dan Nesmith Frank Pfenning Carnegie Mellon University Pittsburgh, PA 15213-3890, U.S.A.

TPS is a theorem proving system for first- and higher-order logic which runs in Common Lisp and can operate in automatic, semi-automatic, and interactive modes. As its logical language TPS uses the typed A-calculus [6], in which most theorems of mathematics can be expressed very directly. TPS can be used to search for an expansion proof [10, 11] of a theorem, which represents in a nonredtmdant way the basic combinatorial information required to construct a proof of the theorem in any style. TPS also has facilities based on the ideas in [10, 11, 12, 13, 14] for translating back and forth between expansion proofs and natural deduction proofs. When one is seeking an expansion proof for a theorem of higher-order logic, not all necessary substitution terms can be generated by unification of formulas already present, so certain expansion options [5] are applied, and then a search for a p-acceptable mating [2] is made, using Huet's higher-order unification algorithm [8] to generate all remaining substitution terms. The expansion options consist of quantifier duplications and projective and primitive substitutions (such as . • 1 2 3 4 5 those whxch substitute [Awo~.Poco~W A Po(o~)w], [AWo~.Po(o~,)w V Po(o~)w], [Awo~.w[P~(o~ow]], [Awo~!3x.y.Pto.r(o~)WX],and [Awo~Vx~.P~(o~)WX]for a variable Po(o~)). These substitutions introduce a small amount of new structure, and contain variables for which additional substitutions can be made at a later stage. Different sets of expansion options are applied to create different expansion trees which are all subtrees of a master expansion tree. Smaller subtrees are explored before larger ones in an attempt to keep the search space manageable. The sets of expansion options are generated in a systematic and exhaustive way, except that at present the types of quantified variables in primitive substitutions (such as 7 above) are chosen from a small fixed set of types which is specified interactively. We conjecture that if this restrictive (but practical) method of specifying types were replaced by a general enumerative procedure, the search procedure implemented in TPS would be complete in principle for elementary type theory (the logical system of [ 1]). The second author has developed a matingsearch procedure (calledpath-focused duplication [9]) in which quantifier duplications are localized to vertical paths (thus reducing the enormous growth in the number of paths which accompanies duplications), and the duplications for each path are generated as needed to span that path. The search space grows and shrinks dynamically as different vertical paths are considered. TPs has various features designed to make it a versatile and friendly system. Many aspects of the program's behavior can be controlled by setting flags. There are over 150 of these flags, and This workis supportedby NSF grantCCR-8702699.

642

TPS has a facility called Review for examining and changing the settings of flags, and for defining and reusing groups of flag settings called modes. There is a formula editor which facilitates constructing new formulas from others already known to TPS. There is a library facility for saving formulas, definitions, and modes. Online documentation can be assembled automatically into a facilities guide which reflects the current state of the program. A program called ETPS containing the facilities of TPS for constructing natural deduction proofs interactively and many exercises from [3] is available for use by students in logic courses, and has been used extensively at our university. References

[1] Peter B. Andrews, Resolution in type theory, Journal of Symbolic Logic 36 (1971), 414-432. [2] Peter B. Andrews, Theorem proving via general matings, Journal of the ACM 28 (1981), 193-214. [3] Peter B. Andrews, An Introduction to Mathematical Logic and Type Theory: To Truth Through Proof, Academic Press, 1986. [4] Peter B. Andrews, Typed A-calculus and automated mathematics, In Edgar G. K. LopezEscobar David W. Kueker and Carl H. Smith, editors, MathematicalLogic and Theoretical Computer Science, Lecture Notes in Pure and Applied Mathematics, vol. 106, Marcel Dekker, 1987, 1-14. [5] Peter B. Andrews, On connections and higher-order logic, Journal of Automated Reasoning 5 (1989), 257-291. [6] Alonzo Church, A formulation of the simple theory of types, Journal of Symbolic Logic 5 (1940), 56-68. [7] Gerard P. Huet, A mechanization of type theory, In Third International Joint Conference on Artificial Intelligence, 1973, 139-146. [8] Gerard P. Huet, A unification algorithm for typed A-calculus, Theoretical Computer Science 1 (1975), 27-57. [9] Sunil Issar, Path-focused duplication: A search procedure for general matings, Technical report, Carnegie Mellon University, Pittsburgh, February 1990. [10] Dale A. Miller, Expansion tree proofs and their conversion to natural deduction proofs, In 7th International Conference on Automated Deduction, Lecture Notes in Computer Science 170, Springer-Verlag, 1984, 375-393. [ 1 I] Dale A. Miller, A compact representation of proofs, Studia Logica 46,4 (1987), 347-370. [12] Frank Pfenning, Analytic and non-analytic proofs, In 7th International Conference on Automated Deduction, Lecture Notes in Computer Science 170, Springer-Verlag, 1984, 394-413. [13] Frank Pfenning, Proof Transformations in Higher-Order Logic, PhD thesis, Carnegie Mellon University, 1987. [14] Frank Pfenning and Dan Nesmith, Presenting intuitive deductions via symmetric simplification, In l Oth International Conference on Automated Deduction, July 1990.

SCHEMATA Frank M. Brown and Carlos Araya Artificial Intelligence Laboratory University of Kansas Lawrence Kansas, 66045 (913)864-4482 [email protected] The Schemata deduction system is a programming language for specifying arbitrary deductive operations. It is based on ideas of treating deduction as (a less controlled form of) computation as suggested in [Hayes73,Kowalski74]. In particular it replaces expressions by equivalent expressions [Brown86]. Schemata was prototyped in series of previous automatic deduction systems [Brown78, Brown&Liu85, Brown86, Brown&Park87] and is now a fairly stable and well defined system which includes both an interpreter and a compiler. The constructs of the Schemata language are designed to minimize the amount of code necessary to specify complex deductive operations, thus allowing a user to more quickly prototype and test deductive systems without extensive re-programming. The following tautology checker written in Schemata gives some indication of the capability of this language. The first 11 Schemata definitions define the truth tables for a 2 valued propositional logic where the "and" symbol: ^ and the "or" symbol: v both take any number of arguments: (define (define (define (define (define (define (define (define (define (define (define

(^) t) (A "*'1 _t ooo2) (cut!(^ , , , I ,,,2))) (^ ,*oi _f *o,2) (cut! f))

(v) f) (v -,oi _f 0o02) ( c u t ! ( v 0.ol o002))) (v ,,-I _t o..2) (cutl t ) ) (-7 _t) f)

(~ _f) t) ( ~ x y) (A(-~ X y)(--) y X))) ( ~ x _t) t) (--> x _f) (-~ x))

The underscore _ symbols in the argument list of a define tell the marcher that the symbol following it is a constant and not a variable which can be instantiated by lambda conversion. For example, in the last definition of -% f is a constant while x is a variable which is bound when the definition is applied. The , - , n symbols are segment variables which match zero or more expressions. The purpose of the cut operation: CUT! in the A and v definitions is to eliminate redundant methods of computing the same row of the truth table by disallowing the application of any other A or v definition to be applied to the subexpression currently being evaluated. CUT! differs from the cut operator of PROLOG[Colmerauer et al.] in that it does not cut alternative evaluations (i.e. the other branches of the truth table) when executed. The next four definitions define t and f to be terminal symbols and tv to be the truthvalues t and f.

644

(define t _t) (define f _f) (define tv t) (define tv f) The final definition defines an example propositional function. We wish to determine whether it is a tautology or not: (define (foo a b c) (--> (^ (--> a b) (--> b c) (--~ c a) (v a b c)) (^ a b c)))

Executing foo on the truthvalues produces 8 values corresponding to the lines of the truth table. Since all values are t the result is a tautology. (foo tv tv tv) => t ,

t,

t,

t,

t,

t,

t, t

Thus, in order to write a tautology checker in Schemata all one has to do is specify the logical properties of the symbols involved and state the problem to be solved. The Schemata programming language automatically understands how to use such specifications to carry out effective and appropriate deductive operations. One does not need to program many of the details needed by other programming languages. The salient features of Schemata are the symbolic evaluation of expressions, the use of multiple definitions (axioms or derived rules of inference) for each symbol, a complete search strategy based on automatic interleaved backtracking, carefully chosen methods for controlling the backtracking such as application cutting, a powerful pattern matching language involving - - - segment variables, and some other constructs chosen to express the patterns needed to easily express deductive operations. The Schemata implementation includes both an interpreter and a compiler. The compiler is itself written in Schemata as are the laws for optimizing the object code produced by the compiler. References Brown78,F.M., "Towards the Automation of Set Theory and its Logic", ARTIFICIAL INTELLIGENCE, Vol. 10, 1978. Brown86,F.M., "An Experimental Logic based on the Fundamental Deduction Principal", (AIRIT TR-86-5), ARTIFICIAL INTELLIGENCE vol. 30 no. 2, 146 pages from page 117 to page 263, November 1986, North Holland. Brown F.M.,Liu P., "A Logic Programming and Verification System for Recursive Quantificational Logic" INTERNATIONAL JOINT CONFERENCE ON ARTIFICIAL INTELLIGENCE 85. August 1985. Brown,F.M. & P a r k , S. "Action, Reflective Possibility and the Frame Problem" (AIRIT TR-87-2), THE FRAME PROBLEM IN AI, PROCEEDINGS OF THE 1987 AAAI WORKSHOP, Morgan Kaufmann, Los Altos, CA, 1987. Colmerauer, A.,Kanoui, van Caneghem, M., "Last stops toward an ultimate PROLOG", Proceedings, 5th International Joint Conference on Artificial Intelligence, 1981. Hayes, "Computation as Deduction", Proceedings 2nd MFCS Symposium Czechoslovakia Academy of Sciences, 1973. Kowalski74 R., "Predicate Logic as Programming Language", Proc IFIP 74 North Holland Publishing Co., Amsterdam, 1974.

CYLINDRIC ALGEBRA EQUATION SOLVER Frank M. Brown Carlos Araya University of Kansas Lawrence Kansas, 66045 The Cylindric Algebra Equation Solver (CAES) is a set of about 200 Schemata definitions specifying the properties of the symbols, for solving equations in the cylindric algebra [Henkin et al.] of 25(2~N) elements with a function which maps 1 to 1 and everything else to 0. The following are some representative definitions expressed in the symbology of modal quantificational logic [Carnap, Bressan, Brown87]: (falsity: F, truth: T, and: ^, or: v, for all: V, for some: 3, not: -~, necessary: [], and synonymous: =-), rather than with algebraic symbols: (zero: 0, one: 1, multiplication: *, inclusive addition: +, products: ~, summation: sigma, minus: -, the function which maps 1 to 1 and all other elements to 0, and equality of elements of the cylindric algebra: =): (define(--> a ~) ( v ( ~ a)~)) (define( c()(-~[](-~ Or))) (define(< ~ _> (z)((^ ~ a))) (define([ ~ _] o0([](~ --> (z))) (define([=] x y ) ( [ ] ( = x y))) ( d e f i n e ( A - e , l ( _ A , , e 2 ) e , - 3 ) ( ^ --,1 oee2 , o , 3 ) ) ( d e f i n e ( [ ] (_A P o - , I ) ) ( A ( [ ] P) ( [ ] (A ' ' ' I ) ) ) )

; i f a then ; ~ i s l o g i c a l l y possible ; a is possible given ;9 entails ;x necessarily equals y ;hssociativity of A ;distribution of [ ] across A

CAES solves equations of the cylindric algebra of the form: K=-(f K) where a solution is any equation of the form: K--g where K does not occur in g. For example, K-(-~BAA) and K-=(-~.AB) are the two solutions of K=-(((-~)v(-~B))^((A)-->A)A((B)-~B)) obtained by applying Schemata defmitions to the input equation using the methods described in [Brown86]. The above equation is solved by dividing it into 4 cases one for each combination of truth or falsity of each modalized subexpression: ( ((A) A(B) A(K------((--#~V~) m.hAB) ) ) v ((A) A (-~(B)) A ( K - - ( ( - ~ h v ~ ) hA) ) ) V ((-~(A))A(B) ^(K-((-~AV-~B)AB))) V ((-~(A))A(-~(B))A(K--(~v-~B))))

The resulting cases simplify by (nonmodal) logical laws to: (((A) A(B) A(K~F)) V ((A) A(-~(B) ) ^ ( K - ( ~ A A ) ) ) v ( (-~ (A)) A (B) ^ (K-=(-~AB)) ) v ((-~(A)) A (-~ (B)) ^ (K-(~Av-~B)) ) )

Substituting the derived value of K in each case gives: ( ((^) A (B) A (K~F)) v ( (< (-~BAA) >^) A ( ~ ( < ( - ~ ^ A ) >B) ) ^ ( K - ( ~ A A ) ) ) v ( (-~(< ( d A B ) >h) ) a (< (--#~AB)>B) A(K~-(--d~AB) ) ) V ( (-~(< (~Av-~B) >A) ) ^(-~(< (~AV-~B) >B) ) ^ (K-(-~v-~B)) ) )

which simplifies by modal and non-modal laws giving the disjunction of two solutions: ((FAFA(K~F)) v (TATA(K~(~BAA))) v ( T A T A ( K - ( - ~ A B ) ) ) v (FAFA(K=(-V~v~B)))).

Many equations with universal and existential quantifiers can also be solved by the equation solver. An example is the following equation: K - ( ( I S FR PROF)A(VX((IS X PROF)-~(((HAS X PhD))-~(HAS X PhO)))) A(HAS FR MD)A(VX((HAS X MD) ~(((-~(HAS X PhD)))~(~(HAS X PhD))))))

646 which says that Frieda is a professor with an Md, that professors have a PhD if it is possible (with respect to the knowledge K), and that when possible again, Mds do not to have a Phd. CAES solves this equation producing a disjunction of two solutions: (K=-((IS FR PROF)A(HAS FR HO)A(VX((IS X PROF)~(HAS X PhO))) A(VX((HAS X MO)-->((HAS X PhD)(X[:]FR)))))) v(K=-((IS FR PROF)A(HAS FR MD)A(VX((IS X PROF)-->((HAS X PhD)(~(X[=]FR))))) A(VX((HAS X MB)-->(~(HAS X PhB))))))

CAES has been applied to several problem domains including automatic assembly [Missiaen] and troubleshooting [Park et al.]. It has also been used to find the flxpoints of nonmonotonic sentences or their intersection in the following 5 theories of nonmonotonic reasoning by solving their equational representation in Z: 1. The fixed point equation of a theory g in Autoepistemic Logic is:

k=(classical-theorems-of(gw{(L a):aek}•{-(L a):-~(aek)})) The Z representation is: K-=(G^(Va((L a)e-~([K]a)))). 2. The fLxed point equation of our Nonconstructive Default Logic is: k=(classical-theorems-of(gu{ (ci):((ai)ak) ^( Aj =l, mi(-,((-b ij)ek))))}) The Z representation is: K-(GA(^i=l,n((([K]Ai)A(Aj=l,mi(Bij)))-->Ci))) 3. The fixed point equation for Reiter default logic is: k=(c~{p:((classical-theorems-of p)cl~)A(gcp)A(Ai=l,n(((aiep)Aj=l,mi(-~(-¢bijEk)))-->(ciep)))}) Its representation in Z is: K-=(BP(PA([P]G)A(^i=I,n(([P]Ai^j=I,mi(Bij)))-->([P]Ci)))) 4. McCarthy's Parallel Circumscription is defined as: (Circ(G ~ 3)n 3)=df((G ~ 3)A(Vp,z((G p z)^(Vi,x((pi x)-~(ni x))))--ffVi,x((ni x)--->(pi x))))) The Z representation of (CIRC(G n 3)n 3) is: 3K(KA(K-((G ~ 3)^(ViVx(((~(~i x)))--~(-~(rd x)))) ^ViVx((-~('n3i x))~(-.('n3i x)))AViVx((('n3i x))-~('n3i x))))) where "n3 is the sequence of all predicates not in n or 3. 5. The Closed World Assumption on a theory g is: gu{(~(ni 8)): (-.((ni 8)e/cl-th g)))} Its Z representation is: G^ViVS((-.(ni 8))--~(-.(ni 8))). For these reasons, CAES provides a computationally effective method for doing nonmonotonic reasoning. Bressan, A., A GENERAL INTERPRETED MODAL CALCULUS, Yale Univ. Press,1972. Brown86, F.M., "A Commonsense Theory of NonMonotonic Reasoning" CADE 8, Oxford,1986. LECTURE NOTES IN COMPUTER SCIENCE 230. Springer-Verlag. Brown87, F.M. "The Modal Logic Z" (AIRIT TRo87-1), THE FRAME PROBLEM IN AI, PROCEEDINGS OF THE 1987 AAAI WORKSHOP, Morgan Kaufmann, Los Altos, CA 1987. Carnap, R., "Modalities and Quantification" JOURNAL OF SYMBOLIC LOGIC, volume 11, number 2, 1946. Henkin, L., D. Monk, A. Tarski, CYLINDRIC ALGEBRAS, Studies in Logic and the Foundations of Mathematics, North Holland, 1985. Missiaen, L., "Situation Calculus and Event Calculus in Modal Logic Z" Report CW85 Department of Computer Science, KU Leuven,1989. Park, S., S. Hundal, C. Araya and F. Brown, "Automated Nonmonotonic Reasoning and its Application in Manufacturing", 4th Int. Conf. on CAD/CAM Robotics & Factories of the Future, New Delhi, December 1989.

The OYSTER-CLAM system Alan Bundy

Frank van Harmelen

*

Christian Horn t

Alan Smaill

Department of Artificial Intelligence, University of Edinburgh, 80 South Bridge, Edinburgh, EHI IHN, Scotland. Emaih [email protected], Tel: 44-31-225-7774.

1

OYSTER

OYSTER [Horn 88] is an interactive proof editor closely based on the Cornell N u P R L system, but implemented in Prolog. The object-level logic is a version of Martin-LSf type theory (a higher order constructive logic including induction) in a sequent-calculus formulation. Proofs are constructed in a top-down fashion by application of the rules of inference. Notational definitions and libraries of theorems are supported. T h e tactic language for the system is Prolog. Predicates describing properties of a proof under construction are available to the user, who may also include a r b i t r a r y Prolog in tactics. Soundness of the system is ensured by the use of an abstract d a t a type of proofs: partial proofs can only be altered by application of the primitive proof rules. Tactics can be combined using system defined tacticats. Prolog pattern-matching and backtracking in tactics have proved useful in the automation of proof search. Since the object-level logic is constructive, terms of an enlarged )~-calculus can be c o m p u t e d from complete proofs, and these so-called extract t e r m s can then be executed by application on appropriate inputs. This allows the system to be used as a program synthesis environment, since a theorem can be regarded as a specification which is realised by its extract term. T h e system is written in some 2000 lines of Prolog, making it considerably more compact t h a n the original N u P R L system, while the speed of the two systems is comparable.

2

CLAM

CLAM is a meta-level system built on top of OYSTER to turn the interactive proof editor into a fully automatic theorem proving system. For every tactic written in the OYSTER system, CLAM is equipped with a specification of the tactic. We call such specifications methods. Methods consist of an input formula, *The research reported in this paper was supported by SERC grant GR/E/44598, and an SERC Senior Fellowship to the first author. tAuthor's address: Department of Mathematics, Humboldt University, Postfach 1297, 1086 Berlin, GDR

648

preconditions, output formulae and postconditions. A method is said to be applicable if the goal to be proved matches the input formula of a method, and the method's preconditions hold. The preconditions, formulated in a meta-logic, refer to syntactic properties of the input formula. Using the input formula and preconditions of a method, CLAMcan predict if a particular OYSTER tactic will be applicable without actually running it. Similarly, the output formulae gives a schematic description of the formulae resulting from a tactic application, and the postconditions specify further syntactic properties of these formulae. CLAM employs these methods in the search for a proof of a given formula by finding an applicable method, computing the schematic output formulae and postconditions of this method, and finally finding methods applicable to these output formulae, this process being repeated recursively until no unproved formulae remain. We call this process of concatenating methods by search at the meta-level proof planning, and the resulting tree of methods is called a proof plan. This p,roof plan can then be executed at the object-level: for each method in the proof plan, the system will execute the corresponding OYSTERtactic. This process of plan execution is not guaranteed to succeed, though it typically does. Thus the method acts as a heuristic operator which can capture the essential preconditions of a tactic while leaving out expensive checks for finer details. The process of proof plan construction as described above involves search: for a given sequent, more than one method may be applicable. We have experimented with a number of different search strategies (depth-first, breadth-first, iterative deepening, heuristic search). In practice, the search at the meta-level is small enough for a depth-first planner to succeed without very much backtracking, often none. CLAM is implemented in 2300 lines of Prolog code, and currently contains a set of methods and tactics modelled on the Boyer-Moore theorem prover. The system can, for instance, find an automatic proof of the existence of prime factorisation, thus extending the work by Boyer and Moore, since CLAMnot only verifies a given algorithm for prime factorisation, but indeed synthesizes this algorithm from an existentially quantified specification. CLAM takes 176 seconds to construct a plan for this theorem consisting of 15 methods, while the object-level proof consists of 553 steps, executed by OYSTER in 358 secs. More detailed descriptions of CLAMcan be found in [van Harmelen 89] and [Bundy et el 89].

References [Bundy et aI 89] A. Bundy, van Harmelen. F., and A. Smaill. Extensions to the RipplingOut Tactic for Guiding Inductive Proofs. Research Paper 459, Dept. of Artificial Intelligence, Edinburgh, 1989. To appear in the proceedings of CADE-10. [Horn 88]

C. Horn. The Nurprl Proof Development System. Working paper 214, Dept. of Artificial Intelligence, Edinburgh, 1988. The Edinburgh version of Nurprl has been renamed Oyster.

[van Harmelen 89] F. van Harmelen. The CLAM Proof Planner, User Manual and Programmer Manual. Technical Paper TP-4, Dept. of Artificial Intelligence, Edinburgh, 1989.

A H i g h - P e r f o r m a n c e Parallel T h e o r e m Prover Ralph Butler 1 Ian Foster 2 Anita Jindal Ross Overbeek 2 Mathematics and Computer Science Division Argonne National Laboratory Argonne, IL 60439 O v e r v i e w . We have implemented a parallel theorem proving system which supports hyperresolution, subsumption, and the set-of-support strategy. The upper level of the program, written in the concurrent programming language Strand [4], implements the general algorithm and describes the inter-connectivity of processes which perform the theorem proving tasks such as resolution, subsumption, etc. These compute-intensive tasks are performed by procedures implemented in C. The distribution of the work among parallel processes is based on techniques originally prototyped in [1] and further enhanced in [5]. A linear representation of clauses in the formula database is based on the work of Christian [3]. The clauses are indexed via high-performance indexing techniques developed by Overbeek [2]. We chose to use Strand to implement the upper level of the system because it is a widely available concurrent programming language that supports a variety of desirable features including concurrency, stream communication among processes, declarative reading of programs, and interfaces to other languages. A linear representation of clauses was chosen because it is simple and yet yields high performance. T h e P a r a l l e l A l g o r i t h m . The parallel system consists of a set of communicating processes, each responsible for one aspect of the system. These comprise a host, a distributor, and one or more generators and subsumers. The host process is responsible for loading the initial clauses and creating the process network (see Figure 1). This network may be viewed as a clause pipe-line. A new clause generated by some generator is first tested for forward subsumption at the generator. If it passes this test, it is passed to the next stage in the pipeline, a subsumer, for a further forward subsumption test. If still non-subsumed, it then passes to the distributor for addition to the clause space. Eventually, the distributor may choose that clause to send back to the generators for use in hyperresolution. The distributor selects a clause from the clause space each time it receives a request for work from one of the generators. The selected clause is sent to the requesting generator for use as its given clause; it is also sent to the other generators for use as a nucleus, but not as the given clause. After choosing the next clause, but before sending it out, the distributor applies forward and backward subsumption tests. Note that there is a certain degree of duplication of effort between the generators, distributor and subsumers, all of which perform forward subsumption tests on clauses. Experience shows that the additional tests are useful because they reduce redundancy in kept clauses. Overhead due to duplicated tests is relatively low, as most clauses are eliminated by subsumption at generators. The distributor only tests clauses selected for distribution, not every kept clause. 1Supported in part by NSF grant CCR-8810947 2Supported by the Applied Mathematical Sciences subprogram of the Office of Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38

650

Ii

®

I .O Figure 1. 4 generators, 2 subsumers, 1 distributor P e r f o r m a n c e . A sequential version of the system described here has been applied on a wide range of test problems, with pleasing results: run-times are between 0.5 and 1.3 times those obtained using MeCune's OTTER system. The parallel version is not yet in a distributable state. However, we have demonstrated speedups on small test problems. For example, a solution to Sam's lemma is obtained in 14 seconds on a single Intel 386 processor, using the sequential version. The parallel version takes 18 seconds on a single processor; the 4 second difference is mainly due to the overhead of converting clauses to and from a portable form when transferring them between processes. On 12 processors, using 1 distributor, 1 subsumer, and 10 generators, a solution is obtained in 2.1 seconds; this represents a 6.7 times speedup over the sequential version. We expect to obtain even better results on larger problems. We are currently refining the implementation and further evaluating its performance. F u t u r e P l a n s . We plan to enhance the system with additional functions such as forward and backward demodulation and paramodulation. The addition of a feature such as demodulation increases the complexity of the system and causes one to consider such issues as where (which process) and when demodulation should be performed. Also, the current system represents just one way in which one might group theorem proving functions among a set of parallel processes. We would like to explore other groupings of functions. We hope to determine a decomposition of function that works well for a wide variety of problems. [1] Butler, R.M., and Karonis, N.T., Exploitation of parallelism in prototypical deduction problems, CADE 9, Springer-Verlag, 1988. [2] Butler, R.M. and Overbeek, R.A., unpublished information, 1990. [3] Christian, J., Techniques for fast Knuth-Bendix completion, Proc. Conf. on Rewriting Techniques and Applications, Chapel Hill, N.C., 1989. [4] Foster, I.T. and Taylor, S., Strand: New Concepts in Parallel Programming, PrenticeHall, Englewood Cliffs, N.J. 1989. [5] Jindal, A., Overbeek, R.A., and Kabat, W., Exploitation of parallel processing for implementing high-performance deduction systems, Journal of Automated Reasoning (to appear).

The Romulus Proof Checker 1Carl Eichenlaub 1Bruce Esrig 2James Hook 1Carl Klapper and 1Garrel Pottinger iOdyssey Research Associates, Inc. 301A Harris B. Dates Drive Ithaca, New York 14850 U.S.A. 2Oregon Graduate Institute 19600 NW von Neumann Drive Beaverton, Oregon 97006 U.S.A. The Romulus proof checker offers an implementation of the theory of constructions to the Romulus system, which in turn supports reasoning about high-level specifications of systems[2,7]. The term language can be extended syntactically by abbreviations and semantically by introducing pairs each consisting of a typed constant and an equational definition of it[4]. The system of rules can be extended by writing ML code as in the nuPrl paradigm[l]. The abbreviations and definitions needed to express the elementary logical operators and constants in terms of the primitives provided by the theory of constructions are organized into theories. These theories are managed as independent modifiable segments of the environment, each of which has a view consisting of all the theories it assumes. A version control mechanism guarantees persistence of the view[3]. Instantiation and generalization of theories have also been designed and given semantics in terms of the primitive rules. As a result, theories can be considered parametrized, analogously to reusable program modules[6]. A decision procedure for intuitionistic propositional logic was used for preliminary testing of the proof checker[5]. The proof checker is now being connected to a specification language. Its performance is strongly dependent on the' performance of the matching facility, which is used to analyze terms, and of the typechecking facility, which is used to validate proofs. Quantitative measures of the performance of the proof checker are not yet available. The Romulus proof checker was implemented in ML and then re-implemented in Common Lisp. The Common Lisp implementation is slower, possibly because it uses Portable *Acknowledgment of Sponsorship: The research which produced the information contained in this document was sponsored, in whole or in part, by the U. S. Air Force Systems Command, Rome Air Development Center, Griffiss AFB, New York 13441-5700under Contract No. F30602-85-C-0098.

652

Common Loops (PCL), in which typechecking cannot in general be done at compile time.

References [1] Robert L. Constable et al. Implementing Mathematics with the Nuprl Proof Development System. Prentice Hall, Englewood Cliffs, New Jersey, 1986. [2] Thierry Coquand and G6rard Huet. Constructions: A higher order proof system for mechanizing mathematics. In EUROCAL85, volume 203 of Lecture Notes in Computer Science, pages 151-184, Berlin, 1986. Springer-Verlag. [3] Carl Eichenlaub and James Hook. Preliminary manual for theory manager interface, July 1988. Odyssey Research Associates, internal report. [4] Timothy G. Griffin. Notational definitions - - a formal account. In Proceedings of the Third Symposium on Logic in Computer Science, July 1988. [5] James Hook and Garrel Pottinger. Natural L-systems. Presented to the meeting of the Association for Symbolic Logic held at UCLA in January 1989. An abstract will appear in the Journal of Symbolic Logic., January 1989. [6] James Hook and Garrel Pottinger. Ulysses theories: The modular implementation of mathematics. Technical Report TR 11-14, Odyssey Research Associates, February 1989. [7] Ulysses Staff. Ulysses: a computer-security modeling environment. In Proceedings of the 11th National Computer Security Conference, September 1988.

IMPS

: An Interactive

Mathematical

Proof

System

*

William M. Farmer, Joshua D. Guttman, and F. Javier Thayer

farmer, guttman, [email protected] The MITRE Corporation Bedford, MA 01730 U.S.A.

IMPS, an Interactive Mathematical Proof System [2], is intended as a general purpose tool for formulating and applying mathematics in a familiar fashion. Its logic is a conceptually simple implementation of higher-order predicate logic that closely conforms to mathematical practice. Mathematical specification and inference are performed relative to axiomatic theories, which can be combined with each other and extended by definitions. The system supports a natural style of inference based on deduction graphs, which are akin to derivations in a sequent calculus. However, the individual inferences in a deduction graph may depend on theory-specific simplification procedures, and may encapsulate a large number of basic inferences. Logic The logic of I M P S iS called L U T I N S , 1 a Logic of Undefined Terms for Inference in a Natural Style. LUTINS is an extension of the formal system P F [1], which is a version of Church's simple theory of types in which functions may be partial. Although terms may be non-denoting, the logic, however, is bivalent; formulas are always defined. L U T I N S employs a subtyping mechanism in which subtypes (called sorts) may be overlapping. I n t e n d e d A p p l i c a t i o n s I M P S is currently being targeted to two principal application areas: (1) automated reasoning for mathematical analysis and (2) software verification. In particular, we plan to use I M P S to produce machine-assisted proofs in nonstandard analysis and to reason about the denotational definition of Scheme. The key features of L U T I N S - higher-order operators, partial functions, and overlapping sorts--directly support these applications. T h e o r y - S u p p o r t e d R e a s o n i n g M e c h a n i s m s A theory in I M P S is composed of a language, a set of axioms, and a variety of additional information (including definitions, *Supported by the Rome Air Development Center, United States Air Force, under contract F1962889-C-0001, and by the MITRE-Sponsored Research Program. 1Pronounced lyfg, as in French.

654

theorems, simplification methods, and information about definedness). Theories can be combined directly and via theory interpretations. Every proof is carried out within some particular theory; different theories can be used for different proofs. Unlike many theoremproving systems, IMPS builds a data structure representing the deduction, so that during the proof process, the user may choose the order in which he wants to work on different subgoals, and try alternative strategies on a particular node. At the end of a proof, this object, called a deduction graph, can be surveyed by the user or analyzed by software. The items appearing in deduction graphs are not formulas, but sequents of the form F ~ A, where A is a single formula called the assertion and F is a set of assumptions called the context. The procedure c o n t e x t - s i m p l i f y , which is used systematically in the course of building deduction graphs, exploits theory-specific and general methods to simplify expressions with respect to a context. As the algorithm traverses propositional connectives it augments the context [3]. Automatic definedness checking is an important component in context simplification, as well as in the procedures that add inferences to deduction-graphs. Each I M P S theory stores definedness conditions, each of which is a predicate that suffices to ensure that the result of applying a function constant to certain arguments will be well-defined. A value condition is a predicate expressing a property of the range of a function constant. By combining the definedness condition for the term with the value conditions associated with its subterms, it is often trivial to check that the term is defined relative to a given context F. T h e o r e m s P r o v e d In a theory of real arithmetic with higher-order operators such as and H, we have proved a variety of results leading up to the binomial theorem. Related theorems include: the combinatorial identity; the monotonicity of Z; and the fact that and II distribute over addition and multiplication (respectively). Cantor's theorem on the cardinality of power sets is trivial to prove. We believe that our proofs are noteworthy because they correspond closely to standard proofs. Our next goal is to prove basic facts about limits and continuous real functions, leading up to the intermediate value theorem from calculus. The prqof makes use of a pair of sequences (of upper and lower bounds) defined by mutual recursion.

References [1]

W. M, Farmer, A partial functions version of Church's simple theory of types. Technical Report M88-52, The M I T R E Corporation, 1988. Revised, 1990; forthcoming in

The Journal of Symbolic Logic. [2] W. M. Farmer, J. D. Guttman, and F. J. Thayer. I M P S : An interactive mathematical proof system. Technical Report M90-19, The M I T R E Corporation, 1990. [3] L. G. Monk. Inference rules using local contexts. Journal of Automated Reasoning, 4(4), 1988.

UNICOM:

A

Refined

Completion

Based

Inductive

Theorem Prover*

Bemhard Gramlich, FB Informatik, Universit~it Kaiserslautem Postfach 3049, D-6750 Kaiserslautem, FR Germany E-mail: [email protected] UNICOM (UNfailing Inductive COMpletion) is a toolbox for investigating equationally defined hierarchically smactured many-sorted algebraic specifications. Its structure is similar to that of TRSPEC (Term Rewriting Based system for algebraic SPECifications, cf. [AGG 87]). The main components of UNICOM are the following: -

The PARSER checks the syntax of user-defined external specifications (with free constructors), imports used subspecifications and produces an internal representation.

-

The CHECKER tests the function definitions for completeness and consistency. For that purpose the termination and ground convergence properties of the set of definition rules are tried to be established.

-

The COMPILER provides a means for rapid prototyping by an optimizing translation of (correct) specifications into executable LISP code.

- The central part of UNICOM is a refined completion based inductive theorem PROVER which tries to prove or disprove a set of inductive conjectures of a given hierarchical (equational) specification.The original completion based prover of TRSPEC was already able to handle certain non-orientable conjectures leading to globally finite instead of terminating rewriting systems (cf. [G6 85]). UNICOM now admits arbitrary possibly non-orientable conjectures (cf. [Ba 88]). The theoretical foundations of UNICOM (in particular of the prover), a summary of the system and some experimental results are provided in [Gr 89]. An extended case study in verifying a couple of sorting algorithms with UNICOM is presented in [Gr 90]. Technical details of a former implementation version are described in [Sc 88]. In the following we shall list the most important characteristic features of (the prover of) UNICOM (new features compared to TRSPEC are marked by (+)): -

Parallel independent inductive proofs are possible according to the different possibilities of choosing inductively complete positions (cf. [Fr 86], [Kii 87]) in conjectures together with corresponding minimal complete function definitions (+).

* This work was supported by the "Deutsche Forschungsgemeinschaft , Sonderforschungsbereich 314 : Wissensbasierte Systeme- KUnstlicheIntelligenz"

656 - Inessential critical pairs (cf. [Kti 87]) may be computed as potentially useful auxiliary conjectures that can be exploited later on (+). - A simple generalization technique (for minimal non-variable common subterms) is available. - Simplification (reduction) may be performed modulo the AC-properties of some operators using a new efficient algorithm for AC-matching (cf. [GD 88]) (+), - Non-equational inductive knowledge about free constructors is used for speeding up the proof or disproof of conjectures (cf. [HH 80]). - Various user interface parameters allow for switching on/off optional features (e.g. generalization, computation of inessential critical pairs) and enable a fully automatic or more or less strongly user-controlled running mode (+). Numerous experiments with UNICOM have shown that many inductive properties of common abstract specifications for booleans, natural numbers, lists, stacks etc. can easily be proved using such a flexible completion based inductive proof technique. Our experiments also include a couple of non-trivial verification problems, e.g. arithmetic summation formulae and various sorting algorithms (cf. [Gr 90]).

References [AGG 87] Avenhaus, J., Gtbel, R., Gramlich, B., Madlener, K, Steinbach, J.: TRSPEC: A Term Rewriting Based System for Algebraic Specifications, Proc. 1st Int. Workshop on Conditional Term Rewriting Systems, Orsay, France, 1987, LNCS 308, eds. S. Kaplan, J.-P. Jouannaud, 1988 [Ba 88] Bachmair, L.: Proof by Consistency in Equational Theories, Proc. of LICS, pp. 228-233, 1988 [Fr 861 Fribourg, L.: A strong restriction of the inductive completion procedure, Proc. 13th ICALP, Rennes, France, LNCS 226, pp. 105-116, 1986 [GD 88] Gramlich, B., Denzinger, J.: Efficient AC-Matching Using Constraint Propagation, SEKI-Report SR-88-14, FB Informatik,Universit~t Kaiserslautern [Go 80] Goguen, J.A.: How to prove algebraic inductive hypotheses without induction, Proc. of 5th CADE, ed. W. Bibel and R. Kowalski, LNCS 87, pp. 356-373, 1980 [GO 85] Gtbel, R.: Completion of Globally Finite Term Rewriting Systems for Inductive Proofs, Proc. of GWAI 85, Springer Verlag, 1985 [Gr 89] Gramlich, B.: Inductive Theorem Proving Using Refined Unfailing Completion Techniques, SEKI-ReportSR-89-14,FB Informatik, Universit~t Kaiserslautern [Gr 90] Gramlich, B.: Completion Based Inductive Theorem Proving - A Case Study in Verifying Sorting Algorithms, SEKI-Report,FB Informatik, Universit~t Kaiserslautern, forthcoming [HH 80] Huet, G., Hullot, J.: Proofs by Induction in Equational Theories with Constructors, Proc. 21 st FOCS, pp. 96-107, 1980, also in JCSS 25(2),pp. 239-266, 1982 [JK 86] Jouannaud, J.-P., Kounalis, E.: Automatic Proofs by Induction in Equational Theories Without Constructors, Proc. Symb. Logic in Computer Science, pp. 358-366, Boston, Massachusetts, 1986, see also: Information and Computation, vol. 82/1, pp. 1-33, 1989 [Kfi 87] Kfichlin, W.: Inductive Completion by Ground Proof Transformation, Proc. CREAS, Lakeway, Texas, 1987 [Mu 80] Musser, D.: On proving inductive properties of abstract data types, Proc. 7th ACM Symp. on Principles of Programming Languages, pp. 154-162, Las Vegas, Nevada, USA, 1980 [Sc 88] Scherer, R.: UNICOM: Ein verfeinerter Rewrite-basierter Beweiser ffir induktive Theoreme, Diplomarbeit, FB Informatik, Universi~t Kaiserslautern, 1988

The Theorem Prover of the Program Verifier Tatzelwurm

Thomas Kgiufl

Nicolas Zabel

Institut fiJr Logik, Komplexit/~t und Deduktionssysteme University of Karlsruhe Postfach 6980 7500 Karlsruhe 1 FR of Germany

LIFIA-INPG 46, Avenue F6fixViallet 38031Grenoble Cedex France

A theorem prover used in program verification must deal with the specific properties verification conditions have. First these formulae are in general not deep mathematical problems but have a big size, second they are in most cases big logical formulae and third their proof is found easier when reduction procedures for theories are used. There is in addition another problem. Frequently verification conditions are not valid, since something is wrong with the program or its specification. Then it is highly desirable to obtain counter-examples when analyzing the unsuccessful attempt to prove the formula. After some exhaustive experiments we decided to use the analytic tableaux of Smullyan [8] for our prover. The method has been extended in such a way that is possible to treat equality and function symbols too. One additional reason for this choice was that interaction with the user is easier than in provers transforming the theorem into normal form. Also the application of reduction procedures for theories by the prover was achieved in a natural way. Some Remarks on the Prover The prover uses the analytic tableaux of Smullyan [8] for our prover being extended such way that it is possible to treat equality, function symbols and reduction procedures for theories. In order to prune the search space heuristics preserving the completeness are applied. (See [5].) Reduction Procedures for Theories Examples show that it is not convenient to use a general automated theorem prover for the proof of a verification condition directly, since frequently these conditions are or contain formulae for which decision procedures exist. Assume that during the proof of a theorem a system of the inequalities i < n+l ^ ~ i < n, where i and n are variables over the integers, occurs. (Such systems occur frequently when one verifies programs containing while statements.) This system can be replaced by the equivalent equation i = n. It is more reasonable to use a decision procedure inferring this equation than an automated general theorem prover. In [4] the decision procedure for systems of linear inequalities over the integers is contained and in [3] the decision procedure for systems of linear inequalities over the rationals. In order to obtain a complete treatment for the combination of cooperating decision procedures the equality propagation of Nelson and Oppen [6] is used. This method can be generalized in such a way that it is applicable in a theorem prover for first order logic with equality and function symbols too. (The proof of its completeness is contained in [5].) In general each decision procedure for a theory determining whether a given formula is satisfiable is a simplification procedure. But a decision procedure alone is not sufficient, since the

658

formulae it is applied to are only subformulae of the formula to be proved and thus satisfiable in most cases. It must handle equations of this theory and derive equalities for the equality propagation.

The Preprocessor of the Prover The preprocessor consists o f two parts: Transformation of terms and literals belonging to a theory into a normal form if possible and truthfunctional simplification In many theories the literals and terms can be transformed into a normal form. This reduction and the transformation of literals and terms into normal forms gives the truthfunctional reduction we shall discuss now more power. In program verification one has frequently to show that a condition is left invariant by a statement. After transformation o f literals and terms into a normal form there are many cases in which the verification condition will have the format A A B -~ C A B. This formula can easily be simplified to the equivalent A A B -~ C. So the application of a truthfunctional reduction procedure often reduces the verification condition to be proved considerably. Sometimes it happened that a verification condition was proved by the preprocessor already.

The Treatment of Equations The tableau prover must deal with two kinds of equations. There are equations belonging to a theory and then equations consisting of uninterpreted terms only. Equations belonging to a theory are assumed to be handled by a simplification procedure for this theory. Since constant symbols introduced by application of logical rules can be considered as free object variables, (see Schtitte [7],) equations containing uninterpreted terms only belong to the quantifier theory of the equality with uninterpreted function symbols. This theory is known to be decidable. (See Ackermann [1]. An efficient decision procedure based on the congruence closure is due to Nelson and Opppen [6].) So the equality between uninterpreted terms is treated by use of a decision procedure for this theory. The prover is implemented in Common Lisp on a Vax station. Since object oriented programming is widely used, reduction procedures for new theories can be added to it without change of the system.

References [1] W. Ackermann: Solvable Cases of the Decision Problem Studies in Logic and the Foundations of Mathematics, Amsterdam: 1954 [2] Th. K~iufl: Vereinfachung Iogischer Formeln in einem Vorbeweiser Dissertation, Fakult~t ftir Informatik, Universit~it Karlsruhe: 1988 [3] Th. Kaufl: Reasoning About Systems of Linear Inequalities 9 th International Conference on Automated Deduction, Lecture Notes on Computer Science; Berlin, Heidelberg, New York: 1988; Springer [4] Th. K~iufl: Simplification and Decision of Linear Inequalities over the Integers Technical Report 9/88, University of Karlsruhe, Institut fiJr Logik, Komplexit~it und Deduktionssysteme: 1988 [5] Th. K~iufl: Cooperation of Decision Procedures in a Tableau-Based Theorem Prover Technical Report 16/89, University of Karlsruhe, Institut fiir Logik, Komptexit~t und Deduktionssysteme: 1989 [6] C.G. Nelson, D.C. Oppen: Simplification by Cooperating Decision Procedures, ACM TOPLAS 1, pp. 245 - 257:1979 [7] K. Schtitte: Proof Theory, Berlin, Heidelberg, New York: 1977 [8] R.M. Smullyan: First-OrderLogic Berlin, Heidelberg, New York: 1968

RCL: A Lisp Verification System Matt Kaufmann* Computational

Logic, Inc.

1717 W e s t S i x t h S t r e e t , S u i t e 290 Austin, T e x a s 78703 U S A [email protected]

Rose Common Lisp (RCL) is a system for reasoning about programs written in a language that satisfies the language definition requirements for a subset of Common Lisp [1]. The existing prototype system, which is described in some detail in [2], translates Common Lisp definitions to definitions in the Boyer-Moore logic [3], a variant of Pure Lisp. A key feature of the RCL system is its handling of non-applicative constructs: assignment, both for local (LET) and global (special) variables; explicit flow of control, both with local and non-local exits (CATCH and THROW, BLOCK and RETURN-FROM) and with iteration and "go-to" (i.e. PROG, including the GO construct); and property lists. The system also allows macro definitions. A number of examples have been worked, including the definition of a Zetalisp-like loop macro 1 and examples that exercise various features of the system. For example, we have performed a correctness proof for a function that multiplies all the leaves of a tree but performs a non-local return with value 0 as soon as a leaf of 0 is encountered. We have also performed a correctness proof for an efficient intersection program that uses property lists. A significant portion of the system code is devoted to keeping the output definitions as simple as possible, the principle being that verification will be easiest when the output of the translator is structurally similar to the input from which it arises.

Implementation notes. The system is built on top of PC-NQTttM [4], which is an interactive "proof-checker" enhancement of the Boyer-Moore Theorem Prover [3]. It is written in Common Lisp, so it should (in principle!) be usable in any Common Lisp environment, though to date it has only been run using AKCL 2 on a Sun-3 and using $ymbolics Common Lisp (on a Symbolics machine). (It is certainly our plan that RCL be written in RCL, but this hasn't yet been done.) The Sun-3 core image occupies about 8.5 megabytes of storage. It includes AKCL, the Boyer-Moore prover, PC-NQTHM, some libraries [5] of definitions and *This work was supported in part at Computational Logic, Inc., by the Defense Advanced Research Projects Agency, ARPA Orders 6082 and 9151. The views and conclusions contained in this document are those of the author(s) and should not be interpreted as representing the official policies, either expressed o r implied, of Computational Logic, Inc., the Defense Advanced Research Projects Agency or the U.S. Government. 1That work was done by Larry Smith. This work has benefitted from numerous conversations with him and other colleagues at Computational Logic, Inc. 2Bill Schelt~'~ ~nhancement of Kyoto Common Lisp

660 proved lemmas, and RCL.

Example. Here is a small example that gives some idea of how the system works. A more detailed summary is given in [2]. The first form below is a Lisp definition of a function that returns the reverse of its input (a list). Notice that the algorithm is iterative; in each iteration, the local variable a c c accumulates the next element the input list x, and x is replaced by its tail ( c d r x). The form (go loop) passes control to the label l o o p in the code below, which starts the next iteration. When x is finally empty, the value of the local accumulator variable ace is returned. We display the user input first 3, followed by the two definitions in the Boyer-Moore logic that are generated automatically by the system. Notice that iteration has been represented by recursion. The Boyer-Moore prover is notoriously good with recursion; in fact we have proved (without difficulty) a correctness theorem for this reverse function. (defun-rcl revl (x) ;; a list reversal function defined using iteration (prog ((acc nil)) loop ;; a label that serves as a target for the form (go loop) below (when (not (consp x)) (return acc)) (setq acc (cons (car x) acc)) (setq x (cdr x)) (go loop))) (DEFN *CL-REVI-TAGBODY-O (ACC X) ;; Created by the system to represent the iteration in REVI (IF (LISTP X) (*CL-REVI-TAGBODY-O (CONS (CAR X) ACC) (CDR X)) ACC)) (DEFN *CL-REVl (.RCL-FLG X) ;; The reader may ignore .RCL-FLG here, which concerns side-effects. (IF (EQUAL .RCL-FLG T) ;; Notice that *CL-REVI-TAGBODY-O is called below with ACC = NIL. (*CL-REVI-TAGBODY-O NIL X)

F)) REFERENCES [1] Guy L. Steele Jr., Common LISP: The Language, Digital Press, 1984. [2] M. Kaufmann, "A User's Manual for RCL", Internal Note 157, Computational Logic, Inc., October 1989. [3] R. S. Boyer and J S. Moore, A Computational Logic Handbook, Academic Press, Boston, 1988. [4] M. Kaufmann, "A User's Manual for an Interactive Enhancement to the Boyer-Moore Theorem Prover", Technical Report 19, Computational Logic, Inc., May 1988. [5] W. Bevier, "A Library for Hardware Verification", Internal Note 57, Computational Logic, Inc., June 1988. ausing ';' to begin comments on a line

ORME an I m p l e m e n t a t i o n o f C o m p l e t i o n P r o c e d u r e s as S e t s o f T r a n s i t i o n s R u l e s Pierre LESCANNE Centre de Recherche en Informatique de Nancy, CNRS and INRIA-Lorraine Campus Scientifique, BP 239 54506 Vandoeuvre-l~s-Nancy, France emaih [email protected]

O R M E is a set of completion procedures based on the idea that methods developed essentially with a theoretical purpose, namely proving completeness can be used to present simple short and understandable programs. O R M E can also be seen as a set of exercises on the use of a functional language to program, high level procedures and as a bridge between theory and practice. The completion procedure is a method used in equational logic to built from a set of identities an equivalent canonical set of rewrite rules i.e., a confluent, noetherian and interreduced set of rules used to compute normal forms. In ORME, a completion is seen as a set of inference rules or more precisely a set of transition rules acting oll a d a t a structure. T h e idea of using inference rules when dealing with completion is not new and provides the beautiful proofs of completeness proposed by Bachmair and Dershowitz [Bac87,BDH86,BN89]. O R M E shows how this description leads to actual, nice and elegant programs when used as a programming m e t h o d as illustrated by an actual CAML implementation [PMA*89]. Actually the inference rules one considers in completion are specific in the sense that they transform a t-uple of objects into a t-uple of objects with the same structure. This is why they are referred to as transition rules. Thus the basic components of such a procedure are

four, • a d a t a s t r u c t u r e on which the transition rules operate, sometimes called the universe, • a s e t o f t r a n s i t i o n r u l e s , that are the basic operations on the data structure, • a c o n t r o l , that is a description of the way the transition rules are invoked, * a t o o l k i t that is shared by several completion procedures. When one wants to describe a specific completion procedure, usually one uses the following method. First one chooses the data structure, then one chooses transition rules and often at the same time the control. T h e toolkit is something that remains from

662

one procedure to the other in many cases, it was partly borrowed from the "CAML Anthology" [FOR87] and is available for other uses as a natural attempt to reuse pieces of codes already debugged and tested. The control is typically data driven and can be easily expressed by rewrite rules. The influence of these choices on the efficiency of the procedure is illustrated through four refinements of the Knuth-Bendix completion procedure, and two unfailing completions [Les89] and an AC-completion. K B - c o m p l e t i o n , with a two component data structure this implements a completion which is similar to the completion described by Knuth and Bendix.

N-completion, with a three component data structure this implements a still naive completion that computes less critical pairs,

S-completion, with a four component data structure this implements a completion where simplification is made first citizen,

ANS-completion, with a six component data structure this implements a completion where again less critical pairs are computed, Unfailing, with a four component data structures and an argument which is the identity one wants to refute, this presents a naive unfailing completion,

ER-completion~ with a eleven component data structures this presents a more elaborate unfailing completion, A C - c o m p l e t i o n , with a twelve component data structure this implements an AC completion.

References [Bac87]

L. Bachmair. Proof methods for equational theories. PhD thesis, University of Illinois, Urbana-Champaign, 1987. Revised version, August 1988.

[BDH86]

L. Bachmair, N. Dershowitz, and J. Hsiang. Orderings for equational proofs. In Proceedings Syrup. Logic in Computer Science, pages 346-357, Boston (Massachusetts USA), 1986.

[BN89]

L. Bachmair and Dershowitz N. Completion for rewriting modulo a congruence. Theoretical Computer Science, 67(2-3):173-202, October 1989.

[FORST]

Projet FORMEL. The CAML Anthology. July 1987. Internal Document.

[LesS9]

P. Lescanne. Completion procedures as transition rules + control. In M. Diaz and F. Orejas, editors, TAPSOFT'89, pages 28-41, Springer-Verlag, Lecture Notes in Computer Science, 1989. Vol. 351.

[PMA*89] P. Weis, M. V. Aponte, A. Laville, M. Mauny, and A. Su£rez. The CAML Manuel Reference. Technical Report, Projet Formel, INRIA-ENS, 1989. Version 2.6.

OTTER 2.0 * William McCune

Mathematics and Computer Science Division Argonne National Laboratory Argonne, Illinois 60439-4844 U.S.A.

OTTER 2.0 is our current production theorem prover at Argonne. It is a descendent of the AURA and ITP programs, which are also closely associated with Argonne. A preliminary version of OTTER was distributed at CADE-9 in May 1988, and version lz0 was released in January 1989. OTTER operates on clauses in batch mode. The user may input quantified first-order formulas, but they are immediately translated to clauses. The main inference rules are binary resolution, hyperresolution, UR-resolution, and paramodulation. Newly inferred clauses can be rewritten with demodulators and can be deleted if subsumed; newly kept clauses can back subsume older clauses. There is a straightforward control strategy, called the given clause algorithm, which is a simple implementation of the set of support restriction. Input clauses and formulas are arranged into three sets: Axioms, Set of Support (SOS), and Demodulators. At each iteration of the main loop, a given clause is chosen from SOS, and inferences are drawn using the given clause, Axioms, and previous given clauses. Newly kept clauses a inserted into SOS. There are many options for specifying inference rules, restricting the chosen inference rules, handling equality, ordering terms and clauses, and otherwise controlling the search. In addition, the user can employ answer literals to keep track of substitutions and construct objects during the search. OTTER's strong points include hyperresolution and UR-resolution in small theories represented by Horn sets and near-Horn sets. (By a small theory, I mean one with few axioms.) For example, many abstract algebra problems in the relational formulation can be effectively attacked, and OTTER has found the first unguided computer proofs of several difficult theorems in implicational calculus, equivalential calculus, and related areas. Another strong point is paramodulation with sets of unit equalities. For example, the standard paramodulation options enable an effective implementation of the Kernel method [2] for searching for fixed point combinators in fragments of combinatory logic. *This work was supported by the Applied MathematicalSciences subprogram of the Officeof Energy Research, U.S. Department of Energy, under Contract W-31-109-Eng-38

664

OTTER has difficulty with very non-Horn theories, theories with definitions, and other kinds of rich theories. Hyperresolution is frequently ineffective with very non-Horn clauses, because it can force proofs to be convoluted, and because nonunit subsumption can be very expensive. UR-resolution is usually incomplete with very non-tiorn theories. A case splitting rule is needed. When 'if-and-only-if' definitions are present, control of the use of the definitions is very difficult--OTTER usually ends up attempting to reason at several different levels simultaneously. A more sophisticated control mechanism is needed. Setting the appropriate paramodulation and demodulation options provides an implementation of the unfailing Knuth-Bendix completion procedure. Terms are ordered by the Lexicographic Recursive Path Ordering (LRPO, also called RPO with status). The ordering on symbols is fixed at input. A weakness is the lack of associative-commutative unification. OTTER can easily prove that x 2 = x rings are commutative, but much trickery is required to prove the x 3 = x version. If your interest is in rewrite systems, you should obtain R R L [3], by Kapur and Zhang, or one of the other sophisticated rewrite systems. Demodulation has been extended with built-in integer arithmetic, logic operations, term comparison, metalogical primitives, and an if-then-else construct. The result is a usable equational programming subsystem which can be used to 'program' aspects of the search and to easily implement state-space searches and other forward-chaining rule-based systems. Performance is achieved through coding in C, careful memory management, and fast indexing to locate unifiable terms or matching terms. Discrimination tree indexing is used to locate more general terms during demodulation and forward subsumption, and FPA-Path indexing is used to find unifiable terms during application of inference rules and unit conflict tests, and to find instances of terms during back subsumption. OTTER is free and very portable (versions are available for IBM-type PCs and Macintoshes). It is available electronically by FTP, as well as on tape or diskette through several organizations (which may charge a distribution fee). All of the source code, test problems, and manuals are included in the distribution packages. No formal support is provided by me or by Argonne. For more information, contact me by electronic mail at [email protected] or by US mail.

References [1] McCune, W., OTTER 2.0 Users Guide, Report ANL-90/9, Argonne National Laboratory (March 1990). [2] McCune, W. arid Wos, L., The Absence and the Presence of Fixed Point Combinators, Preprint MCS-P87-0689, Argonne National Laboratory (June 1989). [3] Kaput, D. and Zhang, H., RRL: Rewrite Rule Laboratory User's Manual, Report 89-03, Dept. of Computer Science, University of Iowa (May 1989).

DISSOLVER: A Dissolution--based Theorem Provert Neil V. Murray, Dept. of Computer Science, SUNY Albany, Albany NY 12222 Erik Rosenthal, Dept. of Mathematics, U. of New Haven, West Haven CT 06516 Over the last few years, we have been developing a dissolution-based automated deduction system tentatively named Dissolver. It is now the platform on which we plan to build much more sophisticated proof-search control strategies. It must be noted that the modest experimental results presented here stem from a rather primitive system. Its level of sophistication is roughly comparable to the first binary-resolution prover: Built-in equality handling, restrictions such as set-ofsupport, reductions such as the Pure Rule, and special unification algorithms - all such typical enhancements are yet to be developed or implemented. We are confident that the corresponding enhancements for dissolution will result in the kind of performance improvements that we have seen with more traditional inference methods. We also expect that techniques specific to dissolution, also awaiting implementation, will be effective. Experiments show that Dissolver can already perform quite respectably, though it certainly is not yet as powerful as the systems with which it is compared. This is neither surprising nor discouraging, since Dissolver is still embryonic (as is its meta-theory, dissolution), while the others are widely acknowledged as state-ofthe-art systems. The table below compares Dissolver with Otter, a resolution-based theorem prover from Argonne National Laboratory [3], and with RRL, the Rewrite Rule Laboratory developed by Zhang and Kapur [9]. Otter was designed to be portable and accessible to other users but nevertheless is fast. It was written in C, while RRL was written in Franz-LISP, and Dissolver in Pascal. We employed quite recent versions of both Otter and RRL; all three were run on a Sun 3/60. The systems are so fundamentally different in concept and design that the comparison is based solely upon cpu time, rather than upon more traditional parameters such as proof length, number of clauses generated, number of clauses retained, etc. The times given in the table have the form minutes:seconds. The first two problems are from Appendix A of [8]; the last was done by hand in [6]. The SET =problems are NNF and CNF versions of the theorem that set equivalence is commutative; C&L is from Appendix A of Chang & Lee [1], and Murr-5 is problem 5 in [4]. The others are taken from Lawrence & Starkey [2]. Although none of these examples are propositional, our experience indicates that Dissolver will significantly outperform RRL and Otter on virtually any ground formula. (By "Dissolver" we mean the same program used in the first order experiments below, not a propositional version.) For example, Otter uses 31 seconds to refute the standard "Pigeonhole-3" problem with 22 clauses, while RRL needs 45 seconds. Dissolver takes 0.3 seconds. Both Otter and RRL are very slow on Pigeonhole-4, and neither can handle Pigeonhole-5; Dissolver refutes Pigeonhole-6 in 168 seconds. t This research was supported in part by National Science Foundation Grant CDA-8805948 and by a UNH Summer Faculty Fellowship.

666

Problem A.1 A.2 L&S-17 L&S-100 L&S-26 L&S-41 L&S-5 L&S-76 L&S-11 L&S-115 L&S-105 L&S-55 L&S-68 L&S-106 L&S-111 Murr-5 C&L-1 Set ----(unnormalized) Set - (CNF) D.1

(All were run on a SUN 3•60 under Sun UNIX 4.2) Dissolver RRL Otter 0:00.02 0:00.33 0:00.02 0:00.08 0:00.62 0:00.12 =0:00.00 0:01.73 0:01.03 0:03.28 0:00.25 0:01.13 0:02.67 0:00.77 0:00.10 0:00.17 0:00.02 0:00.08 0:00.55 0:00.23

0:00.15 0:01.63 0:00.23 0:00.80 >15:00.00 0:00.62 0:00.20 >11:00.00 0:00.23 0:16.90 0:03.40 0:03.17 >24:00.00

0:03.55 0:02.28 0:00.57 0:29.57 1:11.00 0:06.50 0:05.37

0:00.10 0:00.34 0:00.22 0:00.18 0:00.18 0:00.38 0:00.14 0:02.08 0:00.10 >7:22.00 0:00.36 0:07.44 0:01.90 0:00.40 0:00.40 0:00.80 0:00.12 not applicable >60:00.00 0:00.50

References

1. 2. 3. 4.

5.

.

7.

8.

9.

Chang, C.L., and Lee, R.C.T. Symbolic Logic and Mechanical Theorem Proving. Academic Press, New York, 1973. Lawrence, J., and Starkey, J. Experimental tests of resolution-based theorem proving strategies. CS-74-011, Computer Sci. Dept., Washington State Univ., April 1974. McCune, W. Otter 1.0 user's guide. Technical Report ANL-88/44, Argonne National Laboratory, Argonne, IL. Murray, N.V. An experimental theorem prover using fast unification and vertical path graphs. Proceedings of the Fourth National Conference on Canadian Society of Computational Studies of Intelligence, Saskatoon, Canada, May 1982, 125-131. Murray, N.V., and Rosenthal, E. Path dissolution: A strongly complete rule of inference. Proceedings of the 6th National Conference on Artificial Intelligence, Seattle, WA, July 12-17, 1987, 161-166. Murray, N.V., and Rosenthal, E. Inferencing on an arbitrary set of links. Proceedings of the 2 nd International Symposium on Methodologies for Intelligent Systems, Charlotte, NC, October 1987. In Methodologies for Intelligent Systems, (Ras, Z., and Zemankova, M., eds.) North-Holland, 1987, 416-423. Murray, N.V., and Rosenthal, E. An implementation of a dissolution-based system employing theory links. Proceedings of the 9th International Conference on Automated Deduction, Argonne Nat. Lab., May 23-26, 1988. In Lecture Notes in Computer Science, Springer-Verlag, Vol. 310, 658-674. Newborn, M. The Great Theorem Prover. Newborn Software, Westmount, Quebec, 1989. Zhang, H., and Kapur, D. First order theorem proving using conditional rewrite rules. Proceedings of CADE-9, Lecture Notes in Computer Science, vol. 310, 1-20, Springer-Verlag, Argonne National Laboratories, Argonne, IL, May 1988.

T R I P : A n i m p l e m e n t a t i o n of Clausal R e w r i t i n g Robert Nieuwenhuis Fernando Orejas Albert Rubio Universidad Polit4cnica de Catalufia Dept. Lenguajes y Sistemas Inform£ticos Pau Gargallo 5, 08028 Barcelona, Spain E-maih eanieuw@ebrupc51 (bitnet) Abstract: In this note we present the TRIP system, an implementation of clausal rewriting and completion. Its aim is to do theorem proving in theories expressed by socalled restricted equality clauses: general clauses without negative equality literMs and with at most one positive one. Rewriting with complete systems of clausal rewrite rules provides a decision procedure for the given theory. The completion procedure itself is refutationally complete. These techniques have been described and the results proved in [NO 89], using the formalism of proof orderings, as in [BDH 86, Gan 87]. The clausal rewriting relation is defined on sets of clauses: if (L ~ R ) v l l v . . . vln is a rewrite rule and the clause C rewrites into C' using L ~ R with a substitution a (in the usual sense) then C can be replaced in a set by the clauses { C'vllO'V...vln~, Cv~llG , . . . , Cv-,tncr }. Clausal Rewriting with reductive rules (in the sense of [Kap 85]) is finite terminating, since after rewriting a clause C into Cv-,l it is not allowed to rewrite descendants of Cvl using rules having t in its condition. Moreover, a clause C is a valid consequence of a theory expressed by a complete set of rules T¢ if and only if its set of normal forms obtained using T~ contains only trivially true clauses (clauses containing the literal true or the literal (t = t) or a pair of literals l and -4). The completion procedure implemented is a fair application of the following basic computation steps: orienting an axiom, adding a clausal critical pair, simplifying an axiom, and deleting a trivial axiom. Clausal critical pairs are obtained by restricted superposition and resolution inferences on maximal literals. Powerful axiom simplification and elimination is done by clausal rewriting. Since a fair derivation is not always possible, as in purely equational completion, there is a possibility of failure for certain inputs. If it does not fail, the completion procedure itself is an efficient semi-decision procedure, since it is refutationalty complete. The procedure has been implemented under Quintus-Prolog and has also been integrated at the University of Dortmund as a part of the CEC system [BGS 88a, 88b]. Several implementations of variants of clausal completion have been developed This work has been partially supported by the ESPRIT Project PKOSPECTRAref. no. 390, under subcontract with Alcatel SESA.

668

a n d tested on m a n y non-triviM examples for b o t h refutational a n d consequence finding t h e o r e m proving, with - w e t h i n k - interesting p e r f o r m a n c e results. Here we show a very simple example of completion for a specification of naturM n u m b e r s with = < a n d m a x . Note that the totality axiom for = < has been generated as a critical pair. T h e logical simbols -~ a n d V are expressed by ' - ' a n d 'v' respectively.

Initial

axioms:

0= < A -

( s (A) = < 0 ) (s ( A ) = < s (S))

s (A) = < s (B) A=