Problem solving with interactive theorem-proving a case study

Transcription

1 2016 4th Intl Conf on Applied Computing and Information Technology/3rd Intl Conf on Computational Science/Intelligence and Applied Informatics/1st Intl Conf on Big Data, Cloud Computing, Data Science & Engineering Problem solving with interactive theorem-proving a case study Shivashish Jaishy, Nobuhiro Ito, and Yoshinobu Kawabe Department of Information Science, Aichi Institute of Technology 1247 Yachigusa Yakusa-cho, Toyota, Aichi, Japan { shivashish.jaishy, n-ito, kawabe }@kwb.aitech.ac.jp Abstract With the development of artificial intelligence technology over several decades, it is getting possible to find useful knowledge from an enormous amount of data. Also, it is getting possible to solve the difficult problems which cannot be solved by a human r. Actually, a Japanese research project called Todai Robot Project tries to develop an intelligent robot that passes an entrance examination of the University of Tokyo. A case study was conducted to solve a prep school s practice test with an artificial intelligence technology called Torobo-kun. It attracted great attention because of the good results. It is interesting to clarify the kind of an entrance exam problem which can be solved with a computer-assisted theorem proving tool. In this study, we conduct a case study to solve an entrance exam of a top university with an interactive theorem proving tool. Specifically, we employ Larch Prover (LP) which is a theorem proving tool based on equational theory and we solve a Kyushu University s entrance exam problem of mathematics. Keywords interactive theorem proving, problem solving, artificial intelligence I. INTRODUCTION With the development of artificial intelligence technologies over several decades, it is getting possible to find useful knowledge from an enormous amount of data; also, it is getting possible to solve difficult problems which cannot be solved by a human r. Actually, for computer games such as chess, shogi (Japanese chess) etc., there have appeared computer programs that beat a human masterie. Moreover, in the field of artificial intelligence, there are many research projects such as RoboCup [1][2][3], a worldwide research project to develop a strong robot team of association football. We can see that there is a growing interest about what is achievable by artificial intelligence technologies. In Japan, a research project called Todai Robot Project [4][5] is well-known. This project tries to develop an intelligent robot that passes an entrance examination of the University of Tokyo. The artificial intelligence technology in this project is called Torobo-kun, and it attracts a great attention since Torobo-kun succesfully solved a prep school s practice test with good results. However, it is still difficult to solve enterance exam problems fully automatically; in practice, it is required for a human operator to translate the exam problem into a form which a computer tool can deal with. It is interesting to clarify what kind of an entrance exam problem can be solved with a computer-assisted theorem proving tool. In this study, we conduct a case study to solve an entrance exam of a top university with an interactive theorem proving tool. Many theorem-proving tools are known; for example, Coq [6] and Isabelle [7]. This study employs Larch Prover (LP) [8], and we solve a Kyushu University s entrance exam problem of mathematics. LP is a theorem proving tool based on equational theory and it can handle first-order predicate logic s formulae. In this sense, the language of LP is restricted from that of Coq or Isabelle. However, by restricting the language we see that LP can many formulae automatically; from this reason we employ LP in this study. This paper is organized as follows. Section II describes an overview of Larch Prover, and we also describe three problems to solve. In Section III, we describe FOL formulae of the problems and we give some lemmata and proofs for the first two problems. We could not solve the final problem in Section III since some important proof method is not provided in LP. Finally, in Section IV we give the proof method and we the final problem. II. A. Larch theorem r PRELIMINARIES Larch Prover (LP) [8] is a theorem proving tool based on many-sorted first-order predicate logic and it can deal with equations. The implementation of Larch Prover is based on the theory of term rewriting systems [9], so the basic operation of Larch Prover is to reduce a formula into another simpler formula. Hence, in proving some mathematical problem with Larch Prover, a user can concentrate on the essential portion of the problem. Larch Prover is applicable to many sorts of problems; for example, LP is employed for a formal verification tool [10] for distributed algorithms /16 $ IEEE DOI /ACIT-CSII-BCD

2 Proof by induction ( res by ind on A command): s the conjecture by induction on the structure of terms; Proof by generalization ( res by gen A from B command): if the conjecture has the form \A A P, then LP removes the universal quantifier \A by replacing all the free occurrences of A in P with a fresh constant B. Fig. 1. Proving with Larch Prover Figure 1 shows a series of user s operations. At first a user gives some definitions and axioms to LP s memory. The axioms are equations which are transformed into rewrite rules. And then, the user gives LP a conjecture to. When we some conjecture, two or more proof methods may be applicable; for example, if a conjecture has the form of implication P => Q then we can assume P and a subgoal Q, but it might be possible to consider cases where other formulae are true. If there are two or more proof methods applicable, the proof method is chosen by a user of LP. That is, we can see that LP is a tool to assist a user, rather than a tool to conjectures fully automatically. Larch Prover has many proof methods and we show several useful proof methods below: Proof by normalization: translates a formula with rewrite rules automatically and if a conjecture normalizes to true, then the conjecture is a theorem; Proof by cases ( res by cases A command): s the conjecture by dividing into two cases whether proposition A is true or not; Proof by contradiction ( res by contra command): adds equation P = false to LP s memory, where P is a formlua for the conjecture to and tries to lead a contradiction (true = false); Proof of implications ( res by => command): if the conjecture has the form P => A, then LP adds equation P = true to the memory and s subgoal Q; Proof by specialization ( res by spec A to B command): if the conjecture has the form \E A P, then LP removes the existential quantifier \E by replacing all the free occurrences of A in P with B; B. Problem to This study deals with a mathematical question employed for an entrance examination of Kyushu University, which is a top university in Japan. The question is with regard to a property of natural numbers and there are three subproblems. The problems are as follows. Prove the following propositions. (1) Let a be a natural number. When a 2 is divided by 3, the remainder is either 0 or 1; (2) For any natural numbers a, b and c, if we have a 2 + b 2 = 3c 2 then all of a, b and c are multiples of 3; and (3) For any natural numbers a, b and c, a 2 +b 2 = 3c 2 implies a = b = c =0. III. THEOREM-PROVING MATH PROBLEMS A. FOL formulae Let N be the set of natural numbers. We can describe the problems as first-order logic formulae: (1) a N [(a a) mod 3 = 0 (a a) mod 3=1]; (2) a, b, c N[((a a) +(b b) =3 (c c)) = ((3 a) (3 b) (3 c)) ]; and (3) a, b, c N[((a a) +(b b) =3 (c c)) = (a = b = c =0)]. where a mod b is the remainder of dividing a by b. That is, p mod q = r iff k N[ p =(k q)+r ] 0 r r<q. In this study, we use (q p) to denote mod(p, q) =0for any natural numbers p and q. This means p is a multiple of q. The definitions of mod and are described in the Larch s language as follows: asserts with x, y, z, p, q, r, k: Nat (\A p:nat (\A q:nat (\A r:nat ((mod(p, q) = r) <=> ( (\E k:nat (p = (k*q) + r)) /\ 0 <= r /\ r < q))))) ; (\A p:nat (\A q:nat ((q p) <=> (mod(p, q) = 0)))). 302

3 B. Lemmata to We need several propositions to (1), (2) and (3). These propositions are basic properties of natural numbers; for example, we need a proposition 3 is greater than 0. Larch Prover requires formulae of such basic propositions to the problems. We can see the lemmata below: dec op 3:->Nat dec op 4:->Nat assert 2 = 1+1; assert 3 = 2+1; assert 4 = 3+1; succ(2) > 0 succ(2) > 1 2 > 0 (\A a:nat ((a > 0) <=> (a = 0))) (\A x:nat (x+2 = succ(succ(x)))) (\A x:nat (\A y:nat ((x+x+x = y+y+y) <=> (x = y)))) (\A x:nat ( mod(x, 3) = 0 \/ mod(x, 3) = 1 \/ mod(x, 3) = 2)) (\A x:nat (\A y:nat ( (3*x = (3*y)+1) /\ (3*x = (3*y)+2) /\ ((3*x)+1 = (3*y)+2)))) (\A a:nat ((a*a = 0) <=> (a = 0))) where succ is an operator for the successor function; that is, succ(x) = x+1. C. Proving problem (1) In this section we Problem (1). The problem is described in the Larch s language as follows. (\A a:nat ( mod(a*a, 3) = 0 \/ mod(a*a, 3) = 1)) This conjecture is d with the following Larch s proof script: rewrite con with formula rewrite con with formula res by ind on a res by spec k to 0 res by case (\E x:nat (ac = 3*x)) dec op xc:->nat fix x as xc in *hyp res by case (\E x:nat (ac = (3*x)+1)) dec op xc:->nat fix x as xc in *hyp make passive ((c-o(\/) / c-o(succ)) c-o(=>)) c-o(*) instantiate x by ac in ((c-o(\/) / c-o (succ)) c-o(=>)) c-o(*) dec op kc:->nat fix k as kc in (mathproblems* / c-o(ac )) *inducthyp res by spec k to (3+((3*(kc*kc))+((3*k c)+(3*kc)))) Larch Prover s (1) by induction on natural number a; see res by ind on a command in this proof script. The variable a is replaced with a fresh constant ac and further we the conjecture by dividing into three cases: Case 1: ac is a multiple of 3 (res by case (\E x:nat (ac = 3*x))); Case 2: The remainder is 1 when ac is divided by 3 (res by case (\E x:nat (ac = (3*x)+1))); Case 3: Otherwise. In all cases we can the formula for Problem (1). D. Proving problem (2) Problem (2) is described in the Larch s language as follows. => ( (3 a) /\ (3 b) /\ (3 c)))))) To this, we need additional lemmata 303

4 (\A a:nat (\A b:nat (a+b = 0 <=> (a = 0 /\ b = 0)))), (\A a:nat ((3 (a*a)) <=> (3 a))), and (\A a:nat (\A b:nat (( (3 (a*a)) /\ (3 (b*b))) <=> (3 ((a*a) + (b*b)))))). We omit the entire proof script for them due to space limitation. A human r first tries to Problem (2) without these lemmata, but he/she recognizes that the goal cannot be solved without them. For example, suppose that an equation a+b = 0 is true and a human r finds the formula in LP s memory; note that a and b are natural numbers. Intuitively, we can see that (i) a = 0 and b = 0 are true; and (ii) the proof for Problem (2) is easier if we employ a = 0 and b = 0 rather than a+b = 0. Hence, the r concludes that a lemma (\A a:nat (\A b:nat (a+b = 0 <=> (a = 0 /\ b = 0)))) should be introduced. We can see that the formula for Problem (2) has three variables a, b and c. To the formula, we first d a proposition for variables a and b and another proposition for variable c. The proposition with regard to variables a and b is => ((3 a) /\ (3 b)))))) The following is a proof script to the above formula. res by ind on c res by => (3 ((ac*ac) + (bc*bc))) make passive ((mathproblems / c-o(*)) / c-o(+)) / c-o(/\) rewrite con with reversed ((mathproble ms / c-o(*)) / c-o(+)) / c-o(/\) res by spec k to (1+(cc*cc)+(cc+cc)) For variables c we the following proposition; we also describe the entire proof script below. => (3 c))))) res by ind on c res by => (3 ((ac*ac) + (bc*bc))) make passive ((mathproblems / c-o(*)) / c-o(+)) / c-o(/\) rewrite con with reversed ((mathproble ms / c-o(*)) / c-o(+)) / c-o(/\) res by spec k to (1+(cc*cc)+(cc+cc)) dec op kc:->nat fix k as kc in c-o(ac) dec op k c:->nat fix k as k c in c-o(bc) make passive (mathproblems c-o(*)) c -o(succ) instantiate x by ((3*(k c*k c))+(3*(kc*kc))), y by (1+(cc*cc)+(cc+cc)) in (mathproblems c-o(*)) c-o(succ) (3 ((cc+1)*(cc+1))) res by spec k to ((k c*k c)+(kc*kc)) make passive ((((mathproblems/c-o(+))/co(*)) c-o(cc)) c-o(/\)) c-o(\/) instantiate a by (cc+1) in ((((mathproblems / c-o(+)) / c-o(*) ) c-o(cc)) c-o(/\)) c-o(\/) Consequently, Problem (2) is d with Larch Prover. => ( (3 a) /\ (3 b) /\ (3 c)))))) res by => \E k (ac = k + k + k) /\ \E k (bc = k + k + k) make passive (mathproblems / c-o(*)) / c-o(+) instantiate a by ac, b by bc, c by cc in (mathproblems / c-o(*)) / c-o(+) make passive (mathproblems / c-o(*)) / c -o(+) instantiate a by ac, b by bc, c by cc in (mathproblems / c-o(*)) / c-o(+) A. Formula to IV. PROVING PROBLEM (3) Problem (3) is described in the Larch s language as follows. 304

5 => ( a = 0 /\ b = 0 /\ c = 0))))) In this study we first tried a command res by ind on c in proving the above formula by induction on natural number c. For the base case, we have c = 0 and the proof is straightforward. Actually, Larch Prover can the conjecture fully automatically. For the case c 0, we tried a proof by contradiction with the command below: res by contra. However, we could not the conjecture only with lemmata in Section III-B. This means that we need to look for an additional lemma to. Larch Prover found the following facts with regard to variables a, b and c: 1) a, b, c+1 are multiples of 3; 2) If we write a =3 ka, b =3 kb and c +1= 3 kc, wehave ka 2 + kb 2 =3 kc 2 ; 3) From the result of Problem (2), ka, kb and kc are multiples of 3; 4) c > kc holds; 5) If we write ka =3 k a, kb =3 k b and kc =3 k c, then we have 6) kc k c holds. (k a) 2 +(k b) 2 =3 (k c) 2 ; From conditions in 2. and 5., we have: (ka ka)+(kb kb) =3 (kc kc), (k a k a)+(k b k b) =3 (k c k c), ka =3 k a, kb =3 k b and kc =3 k c. From condition 6., we have either kc = k c or kc > k c. If kc = k c holds, then we have kc = 0 from kc =3 k c. This leads to a contradiction since there is no natural number c such that c +1=3 kc =0. Thus, the proof by contradiction method succeeds for the case of kc = k c. Ifkc > k c holds, then in the same way as we defined k c from kc, we can define k c, k c,. such that k c = 3 k c, k c = 3 k c, However, we deal with natural numbers so this is not possible. That is, the proof by contradiction method also succeeds for kc > k c. B. Introducing proof by infinite descent The proof method described in the previous section is called a proof by infinite descent. This proof method is: For any natural number p, ifwehave If P (p) holds then there is some natural number q with q<pand P (q). then, we have P (r) for any natural number r. The formula P [( p (P (p) = ( q (q <p P (q))))) = ( r P (r))] formulates the above condition, where p, q and r are any natural numbers and P (x) is a proposition whose parameter x is a natural number. Larch Prover is a theorem proving tool based on firstorder predicate logic, but the above formula is not a firstorder predicate logic s formula, since P is a variable. Thus, we cannot deal with the above formula directly. However, in this study it suffices to use some specific P for Problem (3). From the discussion in the previous section, we define P (p) as p > 0 holds and there are natural numbers a and b with a 2 + b 2 =3 p 2. With Larch s language, this condition is described as: dec op P: Nat -> Bool assert P(c) <=> ( (c > 0) /\ (\E a:nat (\E b:nat ((a*a) + (b*b) = 3*(c*c))))) We introduced a condition for the proof by infinite descent as follows: set name inf_descent assert (\A p:nat (P(p) => (\E q:nat (q < p /\ P(q))))) => (\A r:nat ( P(r))) Note that in this definition predicate P is not a variable but a constant. With Larch Prover, we can the following lemma: 305

6 (\A p:nat (P(p) => (\E q:nat (q < p /\ P(q))))) Finally, for Problem (3), we can : => ( a = 0 /\ b = 0 /\ c = 0))))) The the proof script is as follows: dec op cc:-> Nat res by gen c from cc res by case cc = 0 make passive inf_descent instantiate r by cc in inf_descent [2] D. Nardi and L. Iocchi, Artificial Intelligence in RoboCup, Reasoning, Action and Interaction in AI Theories and Systems, LNCS 4155, pp , [3] C. Skinner and S. Ramchurn, The RoboCup Rescue Simulation Platform, In Proc. of AAMAS 10, Vol.1, pp , [4] Todai Robot Project, [5] T. Uno, Torobo-kun from the Perspective of Algorithms ( ) In proceedings of the 27th Workshop on Circuits and Systems, pp , (In Japanese) [6] The Coq Proof Assistant, [7] Isabelle, [8] S. J. Garland, J. V. Guttag and J. J. Horning, An overview of Larch, LNCS 693, pp Springer, [9] F. Baader and T. Nipkow, Term Rewriting And All That, Cambridge University Press, [10] A. Bogdanov, Formal verification of simulations between I/Oautomata, Master s thesis, MIT, [11] Theorem proving and rs for reliable theory and implementations (TPP2014), In this script we have two cases where c =0or not; in the case of c 0we employ the lemma of the infinite descent method. V. CONCLUSION In this study we applied a theorem proving tool for solving a math problem of an entrance examination. We employed Larch Prover, and we described a complete proof script for an exam of Kyushu University, which is a top university in Japan. The same problem was dealt with in [11], where other interactive theorem proving tools such as Coq and Isabelle were used. We can see that these theorem rs are based on higher-order logic, while LP s language is based on first-order predicate logic. In this sense, the language of LP is restricted from that of Coq or Isabelle. However, by restricting the language we see that LP can many formulae automatically. This is a main reason to employ LP in this study. This study has demonstrated that we can a difficult mathematical problem with a theorem-proving tool that is based on a lighter framework. ACKNOWLEDGMENT This work was supported by JSPS KAKENHI Grant Number REFERENCES [1] H. Kitano, M. Asada, Y. Kuniyoshi, I. Noda, E. Osawa and H. Matsubara, RoboCup: A Challenge Problem for AI, AI Magazine, 18(1), pp ,