A General Purpose Reasoner for Abstraction

Proof (ii) abstract (i) abs. declare (v) refine (iv) map back (iii) abstract reason Ground Context Abstract Context φ φ φ φ φ φ Figure 1: A calculus for abstraction. the information obtained from the abstract space until the goal is proved. This is why we also call it, re nement. These ve steps are graphically represented in Figure 1. The arrows describe the temporal order of activation in the (simplest) case of reasoning without bactracking. That is, we de ne the abstraction, we use it to build the abstract space, we prove the abstract goal which we then map back and re ne until the original goal is proved. However the simplicity of Figure 1 should not mislead the reader. Each of the ve steps requires the application of many simpler operations. Thus, declaring an abstraction requires the declaration of the two spaces involved and of how the logic and the alphabet are translated. Generating 2 means generating its alphabet, axioms and inference rules, the goal and often some of its theorems. Finding the abstract proof requires the application of the inference rules of the abstract space. The mapping back is particularly complicated as there are many possible strategies for extracting the information contained in an abstract proof. At one extreme only the abstract theorem is mapped back (as in e.g. [GG88]). In some cases no mapping back is performed at all, and the proof (or disproof) of the abstract theorem is taken as an approximation of the proof (disproof) of the ground theorem (as in e.g. [KS92]). At the opposite extreme, the entire abstract proof is mapped back (as in e.g. [Kno90]). There are also intermediate situations, for instance in [Plu87, GW89] only the partial order of unfoldings of de nitions in the abstract proof is used. All these possible ways to perform the mapping back strongly in uence the re nement as well. For instance the re nement of an abstract proof requires bridging the gaps among its nodes. This process is quite 3 complicated to formalize as it involves reasoning from the middle out (see the example in section 3). For each step we must therefore de ne a set of operations, i.e. a set of inference rules which de ne the calculus for that step. The logic of abstraction is the union of these ve sub-calculi plus the prescription for when the inference rules of each calculus can be applied. One problem is that the inference rules which can be used depends on the abstraction and in particular on how provability is preserved across abstraction spaces. For instance, an abstract theorem in general cannot be used to assert its unabstraction as a ground theorem. It can only be taken as a \suggestion" of this fact. This is the case with TI abstractions. An abstraction f = h 1; 2; f i is TI i ` 1 ' =) ` 2 f (') for any w ' in 1: However with TD abstractions, ` 2 f (') =) ` 1 ' for any w ' in 1; and the unabstraction of an abstract theorem can be directly asserted as a theorem. There is no need for re nement. The control of abstract reasoning rises many problems as well. The key fact is that the temporal order suggested by Figure 1 is rarely followed in practice. For instance the abstract space may be generated only partially, this may require that we apply the rules of step (ii) after having done some abstract reasoning. It may happen that steps (iii) and (iv) are iterated. This kind of backtracking happens very often, e.g. any time we realize that we do not know how to re ne the unabstraction of the abstract proof into a ground proof. We may iterate the entire process, e.g. perform step (i) (if we want to use a new abstraction) or step (ii) after step (v). In practice it is possible to envisage cases where the inference rules of the calculi of steps (i) (v) are applied in any order. The main consequence is that no ad hoc control strategy can be hardwired in ABSFOL. Our solution is to move from a completely automatic use of abstraction (as it has always been in the past) to one where abstraction is used interactively and the user can tell the system the exact sequence of operations to perform. ABSFOL is therefore built as an interactive system. However this is not an optimal solution as it still leaves the user with too much, often tedious, work to do. As is very common in interactive theorem proving (see e.g. [GMW79, Pau89, CAB+86]), we propose a solution where ABSFOL is provided with an ML-like metalanguage for writing programs which implement search control strategies [HMM86, GMW79]. We call such programs, tactics. Automated theorem proving 4 can then be implemented by writing complicated tactics. The user does not have to write the control strategy from scratch as the system is provided with a library of tactics implementing (some of) the most useful strategies. For a list of the advantages of this approach see [GMW79] and also [Bun88]. This issue is not further described in this paper. Two observations are worth making. First, the implementation of a calculus and a control metalanguage for abstraction is quite complex and rises many theoretical and practical problems. The main point is one of correctness. This means not only that the underlying code does the right things but also that the user interface prevents the user from doing bad things, e.g. from asserting nontheorems. This implies a lot of code structuring and hiding that it is not necessary in ad hoc implementations. Second, the interactive use of abstraction, as well as allowing the construction of a general reasoner also has another important advantage. Despite some promising theoretical and experimental results (see for instance [Kor87, Kno91, GW91]) abstraction has proved, in automatic theorem proving at least, less useful than expected [GW91, Pla90]. The integration of user interaction and sophisticated heuristics can lessen some of the problems which have been found in the use of abstraction. For instance we think that it is very hard (if not impossible) to nd a general heuristic which would automatically generate the abstraction used in section 3. 3 A calculus of abstraction The goal of this section is to describe some of the details of the ve sub-calculi of the logic of abstraction. We do this by describing the use of a TI abstraction according to the strategy where \we rst abstract the goal, we prove its abstracted version and then use the structure of the resulting proof as an outline (or plan) to help construct the proof of the original goal. This is the hardest use of abstraction to provide a calculus for. It is also the most common use of abstraction in theorem proving, problem solving and planning" [GW92b]. We describe this use of abstraction via the proof of a theorem closely related to G odel's First Incompleteness theorem. 2 This is an interesting example per se, for at least two reasons. First, the proof of this theorem is a subtle piece of mathematics well beyond the reach of current automatic theorem provers. Second, the proof shows how the interactive use of abstraction allows the construction of proofs which are much easier to understand and to explain. The precise statement of the goal is \9F : valid(F ) ^ :provable(F )". That is, there exists a 2The complete proof hinted in this paper can be found in [BGVW93]. 5 formula F which is valid in the standard model of arithmetic but not provable in the standard axiomatization of Peano arithmetics (PA from now on). This problem is posed in a context called maths which knows of e.g. validity, provability, consistency of PA. Consider for instance the following sequence of ABSFOL's commands. noname:: NAMECONTEXT maths; maths:: AXIOM m4: forall F. provable(F) imp valid(F); Teletype font is used to write input and output to ABSFOL. (Input and output have been slightly edited to make them more readable.) \::" is the ABSFOL prompt. The string before \::" is the name of the current context, that is the theory we are working in. NAMECONTEXT names the current context. AXIOM adds an axiom to the current context. Axiom m4 says that any theorem of PA is true in the standard model of arithmetics. For simplicity, we assume that the G odel numbering has been de ned and that the diagonalisation lemma has been proved. maths:: AXIOM diag: provable(diag(x) IFF ~ prf(formno(diag(x)),x)); where formno(F) is the G odel number of the formula F, diag(x) is the G odel formula constructed by diagonalization (which asserts its own unprovability), prf(Fn,Pn) is true i Pn is the G odel number of a proof of the formula whose G odel number is Fn. Although these assumptions simplify the theorem greatly, the proof is still long and complicated. Indeed, our experiments suggest that the proof is well beyond the reach of a state of the art resolution theorem prover like Otter [McC90]. 3.1 Declaring an abstraction We have provided ABSFOL with the following tools for de ning abstractions: a language expressive enough to allow the de nition of all the abstractions de ned in the past (plus more), an interpreter for such a language which allows for the automatic (partial or total, see next section) generation of the abstract space, and a library of abstraction prototypes which can be easily instantiated to the desired application [Seb93]. At the moment the library contains all the most important abstractions de ned in the past. The abstraction we consider here is adapted from a proposal by Alan Bundy. The main idea is to collapse the distinction between (the name of a) formula and its diagonalizing term. This is performed via the following many-to-one mapping on terms which collapses together terms which are semantically similar, 6 diag(x), diag(el), all(x,diag(x)), ~prf(formno(diag(x),x)), ~prf(formno(diag(x),el)) ) ~d prf(formno(diag(x),x)), prf(formno(diag(x),el)) ) d In ABSFOL this abstraction is de ned with the following command maths:: MAKECONTEXT absmaths; maths:: ABSTRACTION goedel:maths => absmaths BY ... f(A and B) := f(A) and f(B) f(A or B) := f(A) or f(B) f(A imp B) := f(A) imp f(B) f(A iff B) := f(A) iff f(B) f(not A) := not f(A) f(forall X.A) := forall X. f(A) f(exists X.A) := exists X. f(A) f(P(T1,...Tn)) := P(f(T1),...f(Tn)) f(diag(T)) := ~d f(all(x,diag(x)) := ~d ...; goedel is the name of the abstraction. MAKECONTEXT creates a new context of name its rst argument. maths and absmaths are the names of the ground and the abstract spaces. The second line onwards de ne the abstraction. f is declaratively de ned using a set of (terminating) rewrite rules. Notice that goedel preserves the logical structure of expressions and only abstracts atomic w s (in particular, on terms). In fact goedel is an atomic abstraction and is TI [GW92b]. Notice that most (statistically more than ninety per cent) of the abstractions proposed in the past are atomic. 3.2 Applying an abstraction A rst option is to give ABSFOL the following command maths:: ABSTRACT CONTEXT BY goedel; This would cause the complete generation of the language, the axioms and the inference rules of absmaths. However it is often useful to build the abstract space only partially (e.g. to save time or to make the abstract search space smaller). ABSFOL provides commands which generate the components of the abstract space one by one, or by subsets. 7 maths:: ABSTRACT ALPHABET BY goedel; maths:: ABSTRACT GOAL valid(all(x,diag(x))) and not provable(all(x,diag(x))) BY goedel; valid(~d) and not provable(~d) is the abstract goal. maths:: ABSTRACT AXIOM diag BY goedel; adiag: provable(~d IFF ~d) maths: ABSTRACT AXIOM m4 BY goedel; am4: forall F. provable(F) imp valid(F) (The lines which follow \;" and are before the prompt are ABSFOL's output). The rst command completely generates the language of absmaths. The second abstracts the goal. The third and the fourth abstract two axioms. Notice that the argument of provable in diag collapses into a tautology (diag can therefore be forgotten), while m4 translates unmodi ed. 3.3 Abstract reasoning Step (iii) consists of \standard" theorem proving and can therefore be performed using GETFOL's logic [Giu92]. Finding a proof in absmaths is much easier than nding a proof in maths. In fact, the abstract proof requires just 7 of the 22 abstract axioms and it does not require any of the complicated axioms like the diagonalization lemma. Indeed, experiments have shown that it is well within the reach of current resolution theorem provers. Otter, for example, is able to nd it in 0.67 seconds on a Sun/4 generating just 183 clauses (of which 125 are kept). The most important steps of the abstract proof are reported in Figure 2. The line numbers on the left are automatically associated by GETFOL to each new theorem. Each context has its own distinct numbering sequence. The numbers are used for future reference to the indexed theorems. The abstract proof divides naturally into two halves. In the rst half we show that ~d is unprovable (line 15); in the second half, we show that ~d is, however, valid (line 29). Note that the abstract space is inconsistent; indeed at line 15 we demonstrate not provable(~d)whilst later on, at line 27, we prove provable(~d). In [GW93] we demonstrate that the fact that the abstract space might be inconsistent cannot be avoided with TI abstractions like goedel. However, provided we are careful not to exploit this inconsistency in our proofs, this does not cause problems [GW93]. For example, although it is able to determine the inconsistency of the abstract space with relative ease, Otter does not use this fact when proving the abstract goal. 8 Abstract Proof Ground Proof 1 provable(d) 1 provable(diag(x)) 15 not provable(~d) 32 not provable(all(x,diag(x)) 20 not provable(d) 38 not provable( prf(formno(diag(x),el)) 27 provable(~d) 53 provable(diag(el)) 29 valid(~d) 58 valid(all(x,diag(x)) 30 valid(~d) and 59 valid(all(x,diag(x))) and not provable(~d) not provable(all(x,diag(x))) Figure 2: Outlines of the abstract and the ground proofs. 3.4 Mapping back and re nement We want to use the abstract proof to help guide the construction of the ground proof. The idea is that the abstract proof should be shorter and easier to construct than the ground. It should also be \similar". These intuitions are formalized by a monotonicity relation between proof trees, called \tree subsumption" [GW92c]. Informally, we say that a tree 1 subsumes a tree 2, written \ 1 2", i the same w s occur in 2 as in 1 with the same global ordering. 2 can therefore be obtained from 1 simply by adding nodes. The intuition is that the unabstraction of the abstract proof should subsume the ground proof. In this case we say that it is an outline. Outlines can be re ned simply by adding nodes. In general we have to perform more complex operations, e.g. deleting nodes. However this is not the case for a very large class of abstractions including atomic abstractions [GW92c]. An outline of the ground proof which results from the mapping back and the re nement of the abstract proof is reported in Figure 2. The line numbers show that the ground proof is much longer than the abstract proof. They also show that the two proofs have the same global structure (if a node is above/ below/ adjacent another in the abstract proof, the same holds for their unabstractions in the ground proof). The implementation of the calculi for the mapping back and the re nement rises some non trivial problems. First, from the abstract proof we can only build a parametric outline of the ground proof. This outline is not a proof in the ground space since it contains parameters which represent choices in unabstracting the (many-to-one) mapping function. In the example, the user is called upon in to pick unabstractions for d and ~d. Thus, the abstract formula ~d which is valid but not provable (lines 15, 29 and 30 of the abstract proof) corresponds to the 9Proof Ground Proof 1 provable(d) 1 provable(diag(x)) 15 not provable(~d) 32 not provable(all(x,diag(x)) 20 not provable(d) 38 not provable( prf(formno(diag(x),el)) 27 provable(~d) 53 provable(diag(el)) 29 valid(~d) 58 valid(all(x,diag(x)) 30 valid(~d) and 59 valid(all(x,diag(x))) and not provable(~d) not provable(all(x,diag(x))) Figure 2: Outlines of the abstract and the ground proofs. 3.4 Mapping back and re nement We want to use the abstract proof to help guide the construction of the ground proof. The idea is that the abstract proof should be shorter and easier to construct than the ground. It should also be \similar". These intuitions are formalized by a monotonicity relation between proof trees, called \tree subsumption" [GW92c]. Informally, we say that a tree 1 subsumes a tree 2, written \ 1 2", i the same w s occur in 2 as in 1 with the same global ordering. 2 can therefore be obtained from 1 simply by adding nodes. The intuition is that the unabstraction of the abstract proof should subsume the ground proof. In this case we say that it is an outline. Outlines can be re ned simply by adding nodes. In general we have to perform more complex operations, e.g. deleting nodes. However this is not the case for a very large class of abstractions including atomic abstractions [GW92c]. An outline of the ground proof which results from the mapping back and the re nement of the abstract proof is reported in Figure 2. The line numbers show that the ground proof is much longer than the abstract proof. They also show that the two proofs have the same global structure (if a node is above/ below/ adjacent another in the abstract proof, the same holds for their unabstractions in the ground proof). The implementation of the calculi for the mapping back and the re nement rises some non trivial problems. First, from the abstract proof we can only build a parametric outline of the ground proof. This outline is not a proof in the ground space since it contains parameters which represent choices in unabstracting the (many-to-one) mapping function. In the example, the user is called upon in to pick unabstractions for d and ~d. Thus, the abstract formula ~d which is valid but not provable (lines 15, 29 and 30 of the abstract proof) corresponds to the 9 ground formula all(x,diag(x)). By comparison, the abstract formula ~d atline 27, which is provable and from which we derive the validity of ~d at line 29,corresponds to the ground formula diag(el) (where el is a random element ofthe standard model of PA). Second, the unabstraction of the abstract proof is nota ground proof since the abstract proof only contains deductions correspondingto the key steps in the ground proof. For instance some of the ground inferencesbetween steps 53 (unabstraction of line 27) and 58 (unabstraction of line 29)translate diag(el) into all(x,diag(x)). Finally, we need to add a new datatypeto represent the steps in an outline since they do not have the same status as stepsin a proof. The steps in an outline may not be derivable as mapping back is notguaranteed. They are merely conjectures. To represent such steps we thereforeintroduce a new datatype called try. A try may contain parameters (which wewill instantiate) and may not follow immediately from earlier tries.ABSFOL allows for mapping back the whole of an abstract proof into a completeoutline.absmaths:: MAPBACK ALL BY goedel;However, let us consider, as an example, the pointwise mapping back and re ne-ment of the last two lines of the abstract proof.absmaths:: SHOW PROOF;...30 valid(~ d) and not provable(~ d)31 exists F. (valid(F) and not provable(F))We rst map lines 30 and 31 back to ground conjectures.absmaths:: MAPBACK 31 BY goedel;31.0 exists F. (valid(F) and not provable(F))absmaths:: MAPBACK 30 BY goedel;30.0 valid(~ d) and not provable(~ d)A try, like a proof line, is numbered. In this case, the tries are numbered 30.0and 31.0. To add extra steps between these tries, ABSFOLwould use line numbersof the form 30.n. Note that 31.0 is the unique unabstraction of line 31 in theabstract proof. It represents the conjecture that we can prove the existence ofa valid but unprovable formula. Line 30, by comparison, has several possibleunabstractions. The formula displayed for try 30.0 is meant to represent oneof a set of ground formulae which abstract onto line 30. In re ning the outline,we must chose an instantiation for this parameter. In this case, we decide toinstantiate it to the term, all(x,diag(x)).maths:: INSTT 30.0 ~ d:all(x,diag(x)) BY goedel;30.0 valid(all(x,diag(x))) and not provable(all(x,diag(x)))10 Try 31.0 now follows immediately from 30.0. To show this we perform an exis-tential introduction on 30.0, and match the result of this existential introductionwith 31.0.maths:: TRYEXISTI 30.0 all(x,diag(x)):F;30.1 exists F. (valid(F) and not provable(F))maths:: MATCHTRY 30.1 31.0;30.1 has been bound to 31.0When one try does not follow immediately from previous tries, re nement alsoconsists of adding in extra tries.4 ConclusionsThere are many di erent abstractions and uses of abstractions. However, we haveshown that it is possible to envisage a general, abstraction independent, reasonerwith abstraction called ABSFOL. The de nition of this reasoner is based on thedistinction between logic and control and on the interactive use of abstraction.Using ABSFOL avoids implementing abstraction from scratch. It also suggests anew use of abstraction where interactivity can be exploited to overcome some ofthe traditional problems with using abstraction.References[BGVW93] A. Bundy, F. Giunchiglia, A. Villa orita, and T. Walsh. Godel'sIncompleteness Theorem via Abstraction. Technical Report 9302-15,IRST, Trento, Italy, 1993. Also DAI Research Paper, University ofEdinburgh.[BGW91] A. Bundy, F. Giunchiglia, and T. Walsh. Calculating criticalities.Technical report, Dept. of Arti cial Intelligence, University of Edin-burgh, University of Edinburgh, 1991. Submitted to Arti cial Intel-ligence. Also IRST-Technical Report 9112-23, December 1991.[Bun88] A. Bundy. The Use of Explicit Plans to Guide Inductive Proofs. InR. Luck and R. Overbeek, editors, Proc. of the 9th Conference onAutomated Deduction, pages 111{120. Springer-Verlag, 1988. Longerversion available as DAI Research Paper No. 349, Dept. of Arti cialIntelligence, Edinburgh.11 [CAB+86] R.L. Constable, S.F. Allen, H.M. Bromley, et al. Implementing Math-ematics with the NuPRL Proof Development System. Prentice Hall,1986.[GG88] F. Giunchiglia and E. Giunchiglia. Building complex derived infer-ence rules: a decider for the class of prenex universal-existential for-mulas. In Proc. 7th European Conference on Arti cial Intelligence,pages 607{609, 1988. Extended version available as DAI ResearchPaper 359, Dept. of Arti cial Intelligence, Edinburgh.[Giu92] F. Giunchiglia. The GETFOL Manual GETFOL version 1. TechnicalReport 92-0010, DIST University of Genova, Genoa, Italy, 1992.[GMW79] M.J. Gordon, A.J. Milner, and C.P. Wadsworth. Edinburgh LCF -A mechanized logic of computation, volume 78 of Lecture Notes inComputer Science. Springer Verlag, 1979.[GW89] F. Giunchiglia and T. Walsh. Theorem Proving with De nitions. InProc. of the 7th Conference of the Society for the Study of Arti cialIntelligence and Simulation of Behaviour, pages 175{183, 1989. AlsoIRST-Technical Report 8901-03 and DAI Research Paper No 429,University of Edinburgh.[GW91] F. Giunchiglia and T. Walsh. Using abstraction. In Proc. of the 8thConference of the Society for the Study of Arti cial Intelligence andSimulation of Behaviour, Leeds, UK, 1991. Also IRST-Technical Re-port 9010-08 and DAI Research Paper 515, University of Edinburgh.[GW92a] F. Giunchiglia and T. Walsh. Theories of Abstraction: a Histori-cal Perspective. In Proc. AAAI Workshop on Approximation andAbstraction of Computational Theories, San Jose', CA, 1992. AlsoIRST-Technical Report 9206-23, IRST, Trento, Italy.[GW92b] F. Giunchiglia and T. Walsh. A Theory of Abstraction. Arti cial In-telligence, 56(2-3):323{390, 1992. Also IRST-Technical Report 9001-14, IRST, Trento, Italy.[GW92c] F. Giunchiglia and T. Walsh. Tree subsumption: Reasoning withoutlines. In Proc. 10th European Conference on Arti cial IntelligenceECAI-92, pages 77{81, Vienna, Austria, 1992. Also IRST-TechnicalReport 9205-01, IRST, Trento, Italy.[GW93] F. Giunchiglia and T. Walsh. The inevitability of inconsistent ab-stract spaces. Journal of Automated Reasoning, 11:23{41, 1993. AlsoIRST-Technical Report 9006-16, IRST, Trento, Italy.12 [HMM86] R. Harper, D. McQueen, and Robin Milner. Standard ML. LFCSreport series ECS-LFCS-86-2, Laboratory for Foundations of Com-puter Science, Dept. of Computer Science, University of Edinburgh,1986.[Hob85] J.R. Hobbs. Granularity. In Proc. of the 9th International JointConference on Arti cial Intelligence, pages 432{435, 1985.[Kno90] C. A. Knoblock. Abstracting the Tower of Hanoi. In Working Notesof AAAI-90 Workshop on Automatic Generation of Approximationsand Abstractions, pages 13{23. AAAI, 1990.[Kno91] C.A. Knoblock. Automatically Generating Abstractions for ProblemSolving. PhD thesis, School of Computer Science, 1991.[Kor87] R.E. Korf. Planning as search: A quantitative approach. Arti cialIntelligence, 33:65{88, 1987.[Kow79] R. Kowalski. Algorithm = logic + control. Communications of theACM, 22(7):424{436, 1979.[KS92]H. Kautz and B. Selman. Forming Concepts for Fast Inference. InProc. of the 10th National Conference on Arti cial Intelligence, pages786{793, 1992.[McC90] W. W. McCune. Otter 2.0 users guide. Technical Report ANL-90/9,Maths and CS. Division, Argonne National Laboratory, Argonne,Illinois, 1990.[Mel87] T.F. Melham. Abstraction mechanisms for hardware veri cation.Technical Report 106, University of Cambridge, Computer Labora-tory, 1987.[Pau89] L. Paulson. The Foundation of a Generic Theorem Prover. Journalof Automated Reasoning, 5:363{396, 1989.[Pla80]D.A. Plaisted. Abstraction mappings in mechanical theorem proving.In 5th Conference on Automated Deduction, pages 264{280, 1980.[Pla90]D. Plaisted. Mechanical Theorem Proving. In Formal Techniques inArti cial Intelligence. Elsevier Science Publishers B.V., 1990.[Plu87]D. Plummer. Gazing: Controlling the Use of Rewrite Rules. PhDthesis, Dept. of Arti cial Intelligence, University of Edinburgh, 1987.[Sac73]E.D. Sacerdoti. Planning in a Hierarchy of Abstraction Spaces. InProceedings of the 3rd International Joint conference on Arti cialIntelligence, 1973.13 [Seb93] R. Sebastiani. Astrazione: dalla Teoria alla Realizzazione di un Ab-stract Proof Checker. AI*IA Notizie, 2:41{53, 1993.[Ten88] J.D. Tenenberg. Abstraction in Planning. PhD thesis, ComputerScience Department, University of Rochster, 1988. Also TR 250.[UR89]A. Unruh and P. Rosenbloom. Abstraction in problem solving andlearning. In Proc. of the 11th International Joint Conference onArti cial Intelligence, pages 681{687, 1989.[Wel91] D.S. Weld. Reasoning about model accuracy. Technical Report 91-05-02, University of Washington, Dept. Computer Science and Engi-neering, 1991.[Wey80] R.W. Weyhrauch. Prolegomena to a Theory of Mechanized FormalReasoning. Arti cial Intelligence, 13(1):133{176, 1980.14