[hal-00909784, v1] Zenon Modulo: When Achilles Outruns the Tortoise using Deduction Modulo

17 Pages·2014·0.58 MB·English

Author manuscript, published in "LPAR - Logic for Programming Artificial Intelligence and Reasoning - 2013 8312 (2013)
274-290"
DOI : 10.1007/978-3-642-45221-5_20
Zenon Modulo: When Achilles Outruns
the Tortoise using Deduction Modulo(cid:63)
David Delahaye1, Damien Doligez2, Frédéric Gilbert2,
Pierre Halmagrand1, and Olivier Hermant3
1 Cedric/Cnam/Inria, Paris, France,
[e-mail]
[e-mail]
2 Inria, Paris, France,
[e-mail]
[e-mail]
3 CRI, MINES ParisTech, Fontainebleau, France,
[e-mail]
3 Abstract. We propose an extension of the tableau-based first order
1
0 automated theorem prover Zenon to deduction modulo. The theory of
2
deduction modulo is an extension of predicate calculus, which allows us
c
e torewritetermsaswellaspropositions,andwhichiswellsuitedforproof
D
search in axiomatic theories, as it turns axioms into rewrite rules. We

6 also present a heuristic to perform this latter step automatically, and
2
- assessourapproachbyprovidingsomeexperimentalresultsobtainedon

1 the benchmarks provided by the TPTP library, where this heuristic is

n able to prove difficult problems in set theory in particular. Finally, we
o
si describe an additional backend for Zenon that outputs proof certificates
er for Dedukti, which is a proof checker based on the λΠ-calculus modulo.
v

,
4 Keywords: Tableaux, Deduction Modulo, Rewriting, Automated The-
8
7 orem Proving, Proof Checking, Zenon, Dedukti.
9
0
9
0 1 Introduction
0
-
al
h Proof search in axiomatic theories, such as Peano arithmetic and set theory,
or decidable fragments (Presburger arithmetic, arrays and pointers, axiomati-
zations of memory models, etc.) is receiving increasing attention, driven by the
applicationsofformalmethodsinindustrialsettings.Leavingaxiomswandering
among the hypotheses is not a reasonable option, as it induces a combinatorial
explosion in the proof search space. Moreover, axioms themselves generally do
notbearanyspecificmeaningthatcouldbeusedbyautomatedtheoremprovers.
A solution to address this problem is to use a cutting-edge combination of a
first order automated theorem proving method (resolution) with theory-specific
decisionprocedures.Thisapproachhasdrawbacks,namelytheneedforaspecific
(cid:63) This work is supported by the BWare project [13] (ANR-12-INSE-0010) funded by
the INS programme of the French National Research Agency (ANR).
decision procedure for each given theory. This imposes a decidability constraint
on the theories that we can work with, as well as a lack of automatability. As
a consequence, we lose genericity over the theories. However, SMT solvers are
well-suited for industrial applications, where those problems are not a concern.
Our approach is to make use of the advances of deduction modulo [9], which
allows us to transform axioms into rewrite rules. For example, Peano arithmetic
orZermelosettheorycanbeexpressedwithoutaxioms.Thisway,weturnproof
searchamongtheaxiomsintocomputations,avoidingunnecessaryblowups,and
we shrink the size of proofs by recording only their meaningful steps. Deduction
modulo has already been experimented within first order automated theorem
provers. This is the case of iProver Modulo [7], where a resolution-based auto-
mated theorem prover has been extended to deduction modulo. This is also the
caseof SuperZenon[10],whichisanextensionoftheZenontableau-basedauto-
mated theorem prover [4] to superdeduction [5], a variant of deduction modulo.
In this paper, we go further along this path by adapting Zenon to deduction
modulo itself, and following some of the ideas of [3]. Compared to the approach
of Super Zenon, this new tool, called Zenon Modulo, allows us to capture more
3
1 computational aspects of theories, since deduction modulo also adds the possi-
0
2 bility to rewrite over terms, while superdeduction only considers rewrite rules

c over propositions. Moreover, it will also allow us to compare this extension with
e
D that of iProver Modulo, and assess the impact of the integration of deduction

6 modulo into different proof search techniques (i.e. resolution and tableaux).
2
- Another contribution introduced in this paper is a heuristic that automati-

1 callytransformsanysetofaxioms(andthereforeanytheory)intoasetofrewrite

n
o rules,whichcanbeusedduringtheproofsearchstepof Zenon.Withthisheuris-
si tic,weobservesignificantimprovementsoverthepureaxiomaticproofsearchof
r
e Zenon,ascanbeseenintheexperimentalresultsobtainedonthesetofproblems
v
, provided by the TPTP library [12]. In particular, this heuristic appears to be
4
8 quite appropriate for set theory, where we are able to prove difficult problems.
7
9 It should be noted that in the short term, we also plan to work on the dual
0
9 approach,whichconsistsinbuildingtheoriesmodulomanually.Inparticular,we
0
0 aimtoconsiderthesettheoryoftheBmethod[1],inordertoapplyZenonMod-
-
al ulo to the verification of proof obligations coming from industrial applications,
h which is one of the goals of the BWare project [13].
One of the major interests of Zenon to experiment deduction modulo resides
initscertifyingapproach,i.e.itsabilitytoproduceproofcertificatesthatcanbe
skeptically checked by other proof assistants such as Coq or Isabelle. Extending
Zenontodeductionmodulomeanstoalsoprovideabackendabletocheckproofs
in deduction modulo. To do so, we have provided Zenon with a backend that
outputsproofsforDedukti[2],aproofcheckerbasedontheλΠ-calculusmodulo.
This paper is organized as follows: in Sec. 2, we first introduce the principles
ofdeductionmodulo;wethenpresent,inSec.3,therulesof Zenonfordeduction
modulo, and describe, in Sec. 4, the corresponding implementation and the ex-
perimental results obtained on the benchmarks provided by the TPTP library;
finally, in Sec. 5, we provide an overview of the Dedukti backend.
2 From Axioms to Deduction Modulo
Deduction modulo [9] focuses on the computational part of a theory, where ax-
iomsaretransformedintorewriterules,whichinducesacongruenceoverpropo-
sitions,andwherereasoningisperformedmodulothiscongruence.Forexample,
considering the inclusion in set theory ∀X,Y (X ⊆Y ⇔∀x(x∈X ⇒x∈Y)),
the proof of A⊆A in sequent calculus has the following form:
Ax
...,x∈A(cid:96)A⊆A,x∈A
⇒R
... (cid:96)A⊆A,x∈A⇒x∈A
∀R Ax
... (cid:96)A⊆A,∀x(x∈A⇒x∈A) ...,A⊆A(cid:96)A⊆A
⇒L
...,∀x(x∈A⇒x∈A)⇒A⊆A(cid:96)A⊆A
∧L
A⊆A⇔∀x(x∈A⇒x∈A)(cid:96)A⊆A
∀L×2
∀X,Y (X ⊆Y ⇔∀x(x∈X ⇒x∈Y))(cid:96)A⊆A
In deduction modulo, the axiom of inclusion can be seen as a computation
3 rule,andthereforereplacedbytherewriteruleX ⊆Y −→∀x(x∈X ⇒x∈Y).
1
0 The previous proof is then transformed as follows:
2

c Ax
e x∈A(cid:96)x∈A
D ⇒R
(cid:96)x∈A⇒x∈A
6 ∀R, A⊆A−→∀x(x∈A⇒x∈A)
2 (cid:96)A⊆A

-
1 where it can be seen that computations are interleaved with the deduction

n rules. It can be noticed that the proof is much simpler than the one completed
o
si using sequent calculus. In addition to simplicity, deduction modulo also allows
r
e for unbounded proof size reduction [6].
v
There exist some other approaches, which can be considered as variants of
,
4
8 deduction modulo. This is the case of superdeduction [5], the formalism at the
7 origin of Super Zenon [10], which proposes to use axioms to enrich the deduc-
9
0 tionsystemwithnewdeductionrules(calledsuperdeductionrules).Thus,while
9
0 deduction modulo integrates some axioms of the theory as computations, su-
0
- perdeduction integrates them as deduction rules, following Prawitz’s ideas [11].
al
h However,incontrastwithsuperdeduction,deductionmodulocanalsocapture
some computational aspects that are modeled by means of equational axioms.
For instance, if we consider an equational sequent calculus with the theory of
Peano arithmetic, the proof of ∃x (x+s(0) = s(s(0))) is the following without
deductionmodulo(intheproofcontext,weonlyprovidethetwoaxiomsofPeano
arithmetic required to complete the proof, referring to them as P):
Ax
P,s(0)+s(0)=s(s(0)+0)(cid:96)s(0)+s(0)=s(s(0)+0)
∀L×2
P (cid:96)s(0)+s(0)=s(s(0)+0) Π
Subst
P
P (cid:96)s(0)+s(0)=s(s(0))
∃R
(cid:26)
∀x(x+0=x)
(cid:96)∃x(x+s(0)=s(s(0)))
∀x,y (x+s(y)=s(x+y))
where Π is the proof expressed as follows:
Ax
P,s(0)+0=s(0)(cid:96)s(0)+0=s(0)
∀L Refl
P (cid:96)s(0)+0=s(0) P (cid:96)s(s(0))=s(s(0))
Subst
P
P (cid:96)s(s(0)+0)=s(s(0))
Indeductionmodulo,thetwoaxiomsaretransformedintocomputationrules
on terms, and therefore replaced by the two rewrite rules x + 0 −→ x and
x+s(y)−→s(x+y). The corresponding proof is then the following:
Refl, s(0)+s(0)−→∗ s(s(0))
(cid:96)s(0)+s(0)=s(s(0))
∃R
(cid:96)∃x(x+s(0)=s(s(0)))
As previously, it can be noticed that the proof in deduction modulo is much
simplerandshorterthantheoneobtainedusingtheequationalsequentcalculus.
3
1
0 3 Deduction Modulo Rules for Zenon
2

c
e
D Inthissection,weprovidetheadaptationoftheproofsearchrulesof Zenontode-
6 ductionmodulo.Thismainlyconsistsinextendingtheusualrulesof Zenon[4]by
2 allowing them to work modulo a congruence relation over propositions induced

-
1 by a set of rewrite rules over propositions and a set of equational axioms and
n rewrite rules over terms (this extension is partially inspired by the presentation
o
si of tableaux modulo presented in [3]).
er In the following, we borrow some of the notations, definitions, and proposi-
v
tions of [9], and we call FV the function that returns the set of free variables of
,
4 a formula. In particular, we introduce the notion of class rewrite system:
8
7
9
0 Definition 1 (ClassRewriteSystem).Atermrewriteruleisapairofterms
9
0 denotedbyl−→r,whereFV(r)⊆FV(l).Anequationalaxiomisapairofterms
0
denoted by l=r. A proposition rewrite rule is a pair of propositions denoted by
-
al l −→r, where l is an atomic proposition and r is an arbitrary proposition, and
h
where FV(r)⊆FV(l).
A class rewrite system is a pair, denoted by RE, consisting of:
– R: a set of proposition rewrite rules;
– E: a set of term rewrite rules and equational axioms.
Given a class rewrite system RE, the relations = and = are the congru-
E RE
ences generated respectively by the sets E and R∪E. We then define the notion
of RE-rewriting. In the definition below, we use the standard concepts of sub-
term and term replacement: given an occurrence ω in a proposition P, we write
P for the term or proposition at ω, and P[t] for the proposition obtained by
|ω ω
replacing P by t in P at ω.
|ω
Definition 2 (RE-Rewriting). Given a class rewrite system RE, the propo-
sition P RE-rewrites to P(cid:48), denoted by P −→ P(cid:48), if P = Q, Q = σ(l),
RE E |ω
and P(cid:48) = Q[σ(r)] , for some rule l −→ r ∈ R, some proposition Q, some
E ω
occurrence ω in Q, and some substitution σ.
Therelation= isnotdecidableingeneral,buttherearesomecaseswhere
RE
this relation is decidable depending on the class rewrite system RE and the
rewrite relation −→ , as identified by the following proposition:
RE
Proposition 1 (Decidability of = ). If the rewrite relation −→ is con-
RE RE
fluent and (weakly) terminating, then the relation = is decidable.
RE
Given a class rewrite system RE, the proof search rules of Zenon adapted
to deduction modulo are summarized in Figs. 1 and 2 (for the sake of simplifi-
cation, the unfolding and extension rules are omitted), where the “|” symbol is
used to separate the formulas of two distinct nodes to be created, (cid:15) is Hilbert’s
operator ((cid:15)(x).P(x) means some x that satisfies P(x), if it exists, and is consid-
3 ered as a term), capital letters are used for metavariables, and R , R , R , and
1 r s t
0 R are respectively reflexive, symmetric, transitive, and transitive-symmetric
2 ts
relations (the corresponding rules also apply to equality). As hinted by the use
c
e of Hilbert’s operator, the δ-rules are handled by means of (cid:15)-terms rather than
D
usingSkolemization.Whatwecallheremetavariablesareoftennamedfreevari-
6
2 ables in the tableau-related literature. However, metavariables are not used as

- variablesastheyareneversubstituted,anddonotevenhelptogenerateaglobal
1
n constraint closing all the branches of the tableau at once; metavariables are in-
o stead used as clues (through unification attempts) for the “real” instantiation
si
r rules γ /γ . The proof search rules are applied with the usual tableau
e ∀inst ¬∃inst
v method: starting from the negation of the goal, apply the rules in a top-down

,
4 fashion to build a tree. When all branches are closed (i.e. end with a closure
8
7 rule), the tree is closed, and this closed tree is a proof of the goal. This algo-
9
0 rithm is applied in strict depth-first order: we close the current branch before
9 starting working on another branch. Moreover, we work in a non-destructive
0
0 way: working on a branch will never change the formulas of another branch.
-
al Compared to [9] and [3], it should be noticed that there is no explicit rule of
h
extendednarrowingintheproposeddeductionmodulorulesforZenon,sincethe
relation = is actually disseminated in all the initial rules of Zenon. However,
RE
the extended narrowing rule is not only a rule that allows us to apply rewrite
rules, but also a rule that may suggest instantiations for metavariables. The
techniqueusedby Zenontofindthoseinstantiationsmustthereforebeextended
as well. Initially, Zenon tries to close a branch by looking for two formulas P
and ¬P that can be unified by a substitution σ (over metavariables), and this
substitutionσisthenusedintheγ /γ rulescorrespondingtotheunified
∀inst ¬∃inst
metavariables. In deduction modulo, this method must be extended as follows:
we look for two formulas P and Q s.t. P = P(cid:48), Q= ¬Q(cid:48), and there exists
RE RE
a substitution σ s.t. σ(P(cid:48))= σ(Q(cid:48)). To be complete, we must also extend this
E
metavariable instantiation search to anypropositional narrowing (even if we are
Closure and Cut Rules
P (cid:12) ¬Q (cid:12) ifP=REQ P |¬Q cut ifP=REQ
P ¬P
(cid:12) (cid:12)⊥ ifP=RE⊥ (cid:12) (cid:12)¬(cid:62) ifP=RE(cid:62)
¬P P ¬Q
(cid:12) (cid:12)r ifP=RERr(t,t) (cid:12) (cid:12)s ifP=RERs(a,b)
andQ=RERs(b,a)
Analytic Rules
S ¬S
P,Q α∧ ifS=REP∧Q ¬P |¬Q β¬∧ ifS=REP∧Q
S ¬S
P |Q β∨ ifS=REP∨Q ¬P,¬Q α¬∨ ifS=REP∨Q
S ¬S
¬P |Q β⇒ ifS=REP⇒Q P,¬Q α¬⇒ ifS=REP⇒Q
3
1
0 S ¬S
2 ¬P,¬Q|P,Q β⇔ ifS=REP⇔Q ¬P,Q|P,¬Q β¬⇔ ifS=REP⇔Q

c
e
D ¬S
6 P ᬬ ifS=RE¬P
2
- S ¬S
1 P((cid:15)(x).P(x)) δ∃ ifS=RE∃xP(x) ¬P((cid:15)(x).¬P(x)) δ¬∀ ifS=RE∀xP(x)

n
o
γ-Rules
si
r
e S ¬S
, v P(X) γ∀M ifS=RE∀xP(x) ¬P(X) γ¬∃M ifS=RE∃xP(x)
4
8
7 S ¬S
09 P(t) γ∀inst ifS=RE∀xP(x) ¬P(t) γ¬∃inst ifS=RE∃xP(x)
9
0
0
al- Fig.1. Deduction Modulo Rules for Zenon (Part 1)
h
not trying to close a branch): we look for a formula P and a substitution σ s.t.
P = P(cid:48), and there exist P(cid:48) and a rule l−→r of R∪E s.t. σ(P(cid:48) )= σ(l).
RE |ω |ω E
4 Implementation and Experimental Results
In this section, we present our implementation of the extension of Zenon to de-
duction modulo, as well as a heuristic to transform an axiomatic theory into a
theorymoduloautomatically.Wealsodiscusstheresultsobtainedonthebench-
marks provided by the TPTP library, and we detail a problem that is difficult
according to the TPTP ranking, and whose proof is found by our extension.
Relational Rules
P(t ,...,t ) ¬Q(s ,...,s )
1 n 1 n
t (cid:54)=s | ... |t (cid:54)=s pred ifP(t1,...,tn)=RES(t1,...,tn)
1 1 n n
andQ(s1,...,sn)=RES(s1,...,sn)
f(t ,...,t )(cid:54)=g(s ,...,s )
1 n 1 n
t (cid:54)=s | ... |t (cid:54)=s fun iff(t1,...,tn)=Eh(t1,...,tn)
1 1 n n
andg(s1,...,sn)=Eh(s1,...,sn)
P(s,t) ¬Q(u,v)
t(cid:54)=u|s(cid:54)=v sym ifP(s,t)=RERs(s,t)
andQ(u,v)=RERs(u,v)
¬P(s,t)
s(cid:54)=t ¬refl ifP(s,t)=RERr(s,t)
P(s,t) ¬Q(u,v)
u(cid:54)=s,¬R (u,s)|t(cid:54)=v,¬R (t,v) trans ifP(s,t)=RERt(s,t)
t t
andQ(u,v)=RERt(u,v)
P(s,t) ¬Q(u,v)
3 v(cid:54)=s,¬Rts(v,s)|t(cid:54)=u,¬Rts(t,u) transsym ifP(s,t)=RERts(s,t)
1 andQ(u,v)=RERts(u,v)
0
2 P(s,t) ¬Q(u,v)
transeq
c u(cid:54)=s,¬R (u,s)|¬R (u,s),¬R (t,v)|t(cid:54)=v,¬R (t,v)
e t t t t ifP(s,t)=RE(s=t)
D
andQ(u,v)=RERt(u,v)
6
2 P(s,t) ¬Q(u,v)
transeqsym
-
1 v(cid:54)=s,¬Rts(v,s)|¬Rts(v,s),¬Rts(t,u)|t(cid:54)=u,¬Rts(t,u) ifP(s,t)=RE(s=t)
n
o andQ(u,v)=RERts(u,v)
si
r
e Fig.2. Deduction Modulo Rules for Zenon (Part 2)
v

,
4
8
7
9 4.1 Implementation
0
9
0
0 Theextensionof ZenontodeductionmodulodescribedinSec.3hasbeenimple-
-
al mentedinatoolcalledZenonModulo4.Inthisimplementation,theclassrewrite
h
system RE is assumed to be a pure rewrite system, i.e. there are only rewrite
rules and no equational axiom in E. In addition, the rewrite relation −→
RE
is assumed to be confluent and (weakly) terminating, and the relation = is
RE
therefore decidable (see Prop. 1 in Sec. 3). Thus, given two propositions P and
Q,itissufficienttocomparetheirnormalforms(w.r.t.−→ )todecidewhether
RE
P = Q. A solution to deal with the relation = is then to normalize all the
RE RE
formulasoftheproofsearchtree.However,thissolutionisnotefficientingeneral,
as it may perform many useless rewritings. To alleviate this problem, we use an
alternate (but equivalent) solution, which consists in performing rewriting only
if the formula is a literal. In this case, the terms of the formula are normalized,
4 Available on demand (sending a mail to the authors).
and one step of proposition rewriting is then applied; if the obtained formula is
still a literal, the process is reiterated.
To generate the rewrite system R∪E, we have implemented two options.
With the first one, the user builds a theory modulo (with axioms and rewrite
rules) and provides this theory to Zenon Modulo through an extension of the
TPTP input syntax [12], which is one of the input formats used by Zenon,
to natively support rewrite rules. With the second option, the user provides a
purely axiomatic theory and Zenon Modulo transforms it into a theory modulo
automatically.ThistransformationreliesonaheuristicdescribedinSubsec.4.2.
ZenonModuloisstillinanearlystageofdevelopmentandsomefeatureshave
not been implemented yet. In particular, this is the case of the narrowing for
terms and propositions. As a consequence, this leads to incompleteness cases,
some of which arise in the benchmarks presented in this paper.
4.2 A Heuristic to Build Theories Modulo
To obtain a theory modulo from an axiomatic theory automatically, we propose
3
1 a heuristic that generates rewrite rules from axioms based on the shape of the
0
2 latter.Ingeneral,thisheuristicdoesnotpreservecut-freecompleteness.Hereare
c theshapesofaxiomsthatcanbehandledbyourheuristic,aswellastherewrite
e
D rulesthataregeneratedfromthem(inthefollowingP isanatomicformulathat
6 is not an equation, ϕ an arbitrary formula, and s and t two terms):
2

-
– Axiom of the form ∀x¯ (P ⇔ ϕ): the proposition rewrite rule P −→ ϕ is
1
n generatedifFV(ϕ)⊆FV(P),otherwiseifϕisaliteralandFV(P)⊂FV(ϕ)
o
then we apply the heuristic to the formula ∀x¯(ϕ⇔P);
si
r – Axiom of the form ∀x¯ (¬P ⇔ ϕ): the proposition rewrite rule P −→ ¬ϕ is
e
v generatedifFV(ϕ)⊆FV(P),otherwiseifϕisaliteralandFV(P)⊂FV(ϕ)

,
4 then we apply the heuristic to the formula ∀x¯(ϕ⇔¬P);
8
7 – Axiom of the form ∀x¯ s = t: the term rewrite rule s −→ t is generated if
9
0 FV(t) ⊆ FV(s), otherwise the term rewrite rule t −→ s if FV(s) ⊂ FV(t).
9
In addition, all the axioms expressing the commutativity of a given symbol
0
0 are excluded from this rule of our heuristic.
-
al
h
In this heuristic, it should be noticed that we exclude the axioms where P
is an equation in order to benefit from the equational reasoning of Zenon. To
illustratethisheuristic,anexampleisprovidedinSubsec.4.4,whereitisshown
how a part of the theory is transformed into rewrite rules automatically.
4.3 Experimental Results
We propose a test of our approach on a benchmark drawn from the TPTP
library [12] (v.5.5.0), which is a large library of standard benchmark exam-
ples for automated theorem proving systems. On this benchmark, we compare
Zenon with two different heuristics of Zenon Modulo. The first heuristic consists
in only selecting the axioms that can be transformed into proposition rewrite
Zenon Modulo
TPTP Zenon Zenon Modulo
(Term & Prop.
Category (Prop. Rewriting)
Rewriting)
FOF +114(7.2%) +170(10.7%)
1,586 1,626 1,616
6,659 problems -74(4.7%) -140 (8.8%)
(2.5%) (1.9%)
SET +78(52.3%) +86(57.7%)
149 219 222
462 problems -8 (5.4%) -13 (8.7%)
(47%) (49%)
Table 1. Experimental Results over the TPTP Library
rules (equational axioms that can be transformed into term rewrite rules are
ignored), while the second one is a greedy heuristic that transforms every ax-
3 iom that matches one of the patterns described above, producing both term
1
0 and propositional rewrite rules. The results of this experiment (run on an In-
2
tel Xeon X5650 2.67GHz computer, with a memory limit of 1GB and a timeout

c
e of300s)aresummarizedinTab.1,wherewehaveconsideredthefirstorderprob-
D
lems of the whole library (FOF category) and the problems of set theory (SET

6
2 category). This table has three columns: the first one provides the number of

- problems proved by Zenon for each category, while the two other columns show

1
the results of Zenon Modulo with each of the heuristics described above. For
n
o ZenonModulo,therearethreenumberspercategoryandheuristic:theleft-hand
si side number is the number of problems proved by Zenon Modulo, while the two
r
e
v right-handsidenumbersrepresent,fromtoptobottom,thenumberofproblems

, proved by Zenon Modulo but not by Zenon, and the number of problems proved
4
8 by Zenon but not by Zenon Modulo.
7
9 From the results of Tab. 1, we observe that Zenon Modulo always proves
0
9 more problems than Zenon whatever the considered category and the selected
0
0 heuristic.IfthegainseemstobelowforthewholeFOFcategory(lessthan3%)
-
al in spite of a significant proportion of problems proved by Zenon Modulo but not
h
by Zenon(about7%and11%dependingontheheuristic),thisisessentiallydue
to incompleteness cases of Zenon Modulo, where narrowing is actually required
and for which Zenon succeeds in finding a proof (about 5% and 9% of the cases
depending the heuristic). Once narrowing will have been implemented, we can
reasonably hope to drastically reduce the number of these cases, and obtain a
quite higher gain (probably up to about 11% in the best case scenario).
However, even without narrowing, the gain of Zenon Modulo becomes quite
significant for the SET category (about 50% for both heuristics). This very
promising result in the SET category tends to show that set theory is a good
candidate for automated reasoning with deduction modulo, even when using an
automated heuristic. Moreover, as said in the introduction, we plan to apply
Zenon Modulo in the context of the B method [1], in particular to verify proof
obligations coming from industrial applications. This is one of the tasks of the
BWare project [13]. As the modeling technique used by the B method relies on
a customized set theory, which will have a hand-tailored expression as a rewrite
system,wecanthereforebequiteconfidentintheeffectivenessofourtoolinthe
verification of these proof obligations.
The results of the two instances of Zenon Modulo are close, but the heuristic
based on term and proposition rewriting proves more problems that are not
proved by Zenon (about 11% for FOF and 58% for SET), and once narrowing
will be implemented, this heuristic should therefore be preferred.
It should be also noticed that among the 86 problems of the SET category
proved by Zenon Modulo (with the heuristic based on term and proposition
rewriting) but not by Zenon, there are 29 difficult problems according to the
TPTP ranking, namely 29 with a ranking greater than 0.75, 9 with a ranking
greater than 0.8, and 1 with a ranking greater than 0.9.
4.4 A Nontrivial Example from the TPTP Library
3
1 Toshowtheeffectivenessof ZenonModulo,letusdescribetheprooffoundforthe
0 problem SET815+4, which has the highest ranking (0.91) among those solved,
2
c and which deals with the theory of ordinal numbers. The conjecture states that
e
any ordinal number is equal to the union of the elements of its successor. The
D
axioms used to complete this proof are the following:
6
2

-

1 ∀A,B (A⊆B ⇔∀X (X ∈A⇒X ∈B)) (subset)

n
o ∀A,B (A=set B ⇔A⊆B∧B ⊆A) (eqset)
si ∀X,A,B (X ∈A∪B ⇔X ∈A∨X ∈B) (union)
r
e ∀X,A (X ∈{A}⇔X =A) (singleton)
v
, ∀X,A (X ∈(cid:83)A⇔∃Y (Y ∈A∧X ∈Y)) (sum)
4
8 ∀A (A∈On⇔set(A)∧∀X (X ∈A⇒X ⊆A) ∧ (ordinal)
7
9 strict_wo(mem_pred,A))
0
9 ∀X,A (X ∈A+1⇔X ∈A∪{A}) (successor)
0
0
- wheresetisapredicatethatrequirestheargumenttobeaset,andwhereOn
al
isthe“set” ofordinalnumbers,mem_predthemembershiprelationoverordinal
h
numbers (this relation is related to ∈ by means of an axiom not shown here as
it is not required to complete the proof), and strict_wo a formula encoding the
strict well-order relation.
AccordingtherulesoftheheuristicdescribedinSubsec.4.2,alltheseaxioms
canbeturnedintopropositionrewriterules(weusethefirstruleoftheheuristic,
andeachaxiomisorientedfromlefttoright).Oncethistheorymodulohasbeen
built, we can then try to prove the conjecture, which is expressed as follows:
(cid:91)
∀A(A∈On⇒ (A+1)= A)
set
5 It means that at least 70% of the tested automated theorem provers fail in proving
the considered problems.